From d45fe32011eb27e4324f3bcfcdb33530d39b4380 Mon Sep 17 00:00:00 2001
From: robobun <117481402+robobun@users.noreply.github.com>
Date: Mon, 17 Aug 2026 01:03:44 +0000
Subject: [PATCH 001/258] install: bind peer edges in the hoister, the way
 loading bun.lock binds them (#38767)

---
 src/install/lockfile.rs                       |  10 +
 src/install/lockfile/Tree.rs                  |  24 +-
 src/install/lockfile/bun.lock.rs              |   3 +
 src/install/yarn.rs                           | 223 +-----------------
 test/cli/install/hoist.test.ts                |  68 +++++-
 test/cli/install/isolated-install.test.ts     |  53 +++++
 test/cli/install/migration/migrate.test.ts    |  55 +++++
 .../migration/yarn-lock-migration.test.ts     |  72 ++++++
 8 files changed, 288 insertions(+), 220 deletions(-)

diff --git a/src/install/lockfile.rs b/src/install/lockfile.rs
index da5691de7ee9..755ec191a69a 100644
--- a/src/install/lockfile.rs
+++ b/src/install/lockfile.rs
@@ -1734,6 +1734,16 @@ impl Lockfile {
             debug_assert!(
                 SemverStringBuilder::string_hash(self.str(&package.name)) == package.name_hash
             );
+            // The hoister binds peers by scanning `package_index` under the package name.
+            debug_assert!(
+                match self.package_index.get(&package.name_hash) {
+                    Some(PackageIndexEntry::Id(id)) => *id as usize == i,
+                    Some(PackageIndexEntry::Ids(ids)) => ids.iter().any(|&id| id as usize == i),
+                    None => false,
+                },
+                "package {} is not in package_index under its own name",
+                i
+            );
             debug_assert!(
                 package
                     .dependencies
diff --git a/src/install/lockfile/Tree.rs b/src/install/lockfile/Tree.rs
index 7143e9260626..b34e2f19b0b7 100644
--- a/src/install/lockfile/Tree.rs
+++ b/src/install/lockfile/Tree.rs
@@ -7,7 +7,7 @@ use bun_core::ZStr;
 use bun_paths::{MAX_PATH_BYTES, PathBuffer, SEP};
 
 use crate::lockfile::package::PackageColumns as _;
-use crate::lockfile::{DepSorter, DependencyIDList, DependencyIDSlice, Lockfile};
+use crate::lockfile::{DepSorter, DependencyIDList, DependencyIDSlice, Lockfile, bun_lock};
 use crate::package_manager::{PackageManager, WorkspaceFilter};
 use crate::{
     Dependency, DependencyID, PackageID, PackageNameHash, Resolution, invalid_dependency_id,
@@ -493,6 +493,27 @@ impl<'a, const METHOD: BuilderMethod> Builder<'a, METHOD> {
         self.lockfile().buffers.string_bytes.as_slice()
     }
 
+    /// Binds a peer edge the way loading `bun.lock` does, whatever the resolver, a previous
+    /// lockfile or a migration left it bound to, so every tree built from these packages agrees.
+    fn bind_peer(&mut self, dep_id: DependencyID) {
+        let dependency: &Dependency = &self.dependencies[dep_id as usize];
+        if !dependency.behavior.is_peer() {
+            return;
+        }
+        let lockfile_ref = self.lockfile;
+        let lockfile: &Lockfile = lockfile_ref.get();
+        if let Some(pkg_id) = bun_lock::resolve_peer_dep_version_based(
+            dependency,
+            &lockfile.catalogs,
+            &lockfile.package_index,
+            &lockfile.overrides,
+            lockfile.packages.items_resolution(),
+            lockfile.buffers.string_bytes.as_slice(),
+        ) {
+            self.resolutions[dep_id as usize] = pkg_id;
+        }
+    }
+
     /// Flatten the multi-dimensional ArrayList of package IDs into a single easily serializable array
     pub(crate) fn clean(&mut self) -> Result<CleanResult, AllocError> {
         let mut total: u32 = 0;
@@ -698,6 +719,7 @@ impl Tree {
         let sort_buf_len = builder.sort_buf.len();
         'dep: for sort_idx in 0..sort_buf_len {
             let dep_id = builder.sort_buf[sort_idx];
+            builder.bind_peer(dep_id);
             let pkg_id = builder.resolutions[dep_id as usize];
 
             // filter out disabled dependencies
diff --git a/src/install/lockfile/bun.lock.rs b/src/install/lockfile/bun.lock.rs
index 1f25d8cc6a06..148c058002c3 100644
--- a/src/install/lockfile/bun.lock.rs
+++ b/src/install/lockfile/bun.lock.rs
@@ -3353,6 +3353,9 @@ fn deferred_peer_range<'a>(
 /// re-keys isolated-linker store entries (and global-store entry hashes)
 /// on warm installs.
 ///
+/// The hoister applies the same binding to every peer edge it processes
+/// (`tree::Builder::bind_peer`), so a saved tree is the tree its reload rebuilds.
+///
 /// Peers whose name matches a workspace package need no special casing
 /// even though the fresh resolver binds them to the workspace before any
 /// deferral (`'resolve_from_workspace`): the version scan below picks an
diff --git a/src/install/yarn.rs b/src/install/yarn.rs
index cbcc3613b691..5dfb95a04f08 100644
--- a/src/install/yarn.rs
+++ b/src/install/yarn.rs
@@ -3,7 +3,7 @@ use std::borrow::Cow;
 use std::io::Write as _;
 
 use crate::Error;
-use bun_collections::{HashMap, StringHashMap};
+use bun_collections::StringHashMap;
 use bun_install::bin::Bin;
 use bun_install::dependency::{self, Dependency, DependencyExt as _};
 use bun_install::install::{self, DependencyID, PackageID, PackageManager};
@@ -26,7 +26,7 @@ use bun_install::npm;
 // `bun_install::resolution` stub keeps `Value` as a struct-of-fields and has no `init`.
 use crate::bun_json;
 use crate::repository::Repository;
-use crate::resolution_real::{Resolution, Tag as ResolutionTag, TaggedValue as ResolutionValue};
+use crate::resolution_real::{Resolution, TaggedValue as ResolutionValue};
 use crate::versioned_url::VersionedURL;
 use bun_core::strings;
 use bun_paths::PathBuffer;
@@ -1380,222 +1380,9 @@ pub(crate) fn migrate_yarn_lockfile<'a>(
         }
     }
 
-    for (base_name, versions) in scoped_packages.iter_mut() {
-        let base_name: &[u8] = base_name.as_ref();
-
-        versions.sort_by_key(|a| a.package_id);
-
-        let original_name_hash = string_hash(base_name);
-        // `remove` drops the value (and thus the `Ids` Vec) automatically.
-        let _ = this.package_index.remove(&original_name_hash);
-    }
-
-    for (base_name, versions) in scoped_packages.iter() {
-        let base_name: &[u8] = base_name.as_ref();
-
-        for version_info in versions.iter() {
-            let package_id = version_info.package_id;
-
-            let mut found_in_index = false;
-            for (_, index_value) in this.package_index.iter() {
-                match index_value {
-                    lockfile::PackageIndexEntry::Id(id) => {
-                        if *id == package_id {
-                            found_in_index = true;
-                            break;
-                        }
-                    }
-                    lockfile::PackageIndexEntry::Ids(ids) => {
-                        for id in ids.iter() {
-                            if *id == package_id {
-                                found_in_index = true;
-                                break;
-                            }
-                        }
-                        if found_in_index {
-                            break;
-                        }
-                    }
-                }
-            }
-
-            if !found_in_index {
-                let mut fallback_name = Vec::new();
-                write!(
-                    &mut fallback_name,
-                    "{}#{}",
-                    bstr::BStr::new(base_name),
-                    package_id
-                )
-                .expect("unreachable");
-
-                let fallback_hash = string_hash(&fallback_name);
-                this.get_or_put_id(package_id, fallback_hash)?;
-            }
-        }
-    }
-
-    let mut package_names: Vec<&[u8]> = vec![b"".as_slice(); next_package_id as usize];
-
-    for (yarn_idx, entry) in yarn_lock.entries.iter().enumerate() {
-        let package_id = yarn_entry_to_package_id[yarn_idx];
-        if package_names[package_id as usize].is_empty() {
-            package_names[package_id as usize] = Entry::get_name_from_spec(entry.specs[0]);
-        }
-    }
-
-    let mut root_packages: StringHashMap<PackageID> = StringHashMap::new();
-
-    let mut usage_count: StringHashMap<u32> = StringHashMap::new();
-    for entry_idx in 0..yarn_lock.entries.len() {
-        let package_id = yarn_entry_to_package_id[entry_idx];
-        if package_id == install::INVALID_PACKAGE_ID {
-            continue;
-        }
-        let base_name = package_names[package_id as usize];
-
-        for dep_entry in yarn_lock.entries.iter() {
-            if let Some(deps) = &dep_entry.dependencies {
-                for (dep_name_key, _) in deps.iter() {
-                    if dep_name_key.as_ref() == base_name {
-                        let count = usage_count.get(base_name).copied().unwrap_or(0);
-                        usage_count.put(base_name, count + 1)?;
-                    }
-                }
-            }
-        }
-    }
-
-    for entry_idx in 0..yarn_lock.entries.len() {
-        let package_id = yarn_entry_to_package_id[entry_idx];
-        if package_id == install::INVALID_PACKAGE_ID {
-            continue;
-        }
-        let base_name = package_names[package_id as usize];
-
-        if root_packages.get(base_name).is_none() {
-            root_packages.put(base_name, package_id)?;
-            let name_hash = string_hash(base_name);
-            this.get_or_put_id(package_id, name_hash)?;
-        }
-    }
-
-    let mut scoped_names: HashMap<PackageID, Vec<u8>> = HashMap::new();
-    let mut scoped_count: u32 = 0;
-    for entry_idx in 0..yarn_lock.entries.len() {
-        let package_id = yarn_entry_to_package_id[entry_idx];
-        if package_id == install::INVALID_PACKAGE_ID {
-            continue;
-        }
-        let base_name = package_names[package_id as usize];
-
-        if let Some(root_pkg_id) = root_packages.get(base_name).copied() {
-            if root_pkg_id == package_id {
-                continue;
-            }
-        } else {
-            continue;
-        }
-
-        let mut scoped_name: Option<Vec<u8>> = None;
-        for (dep_entry_idx, dep_entry) in yarn_lock.entries.iter().enumerate() {
-            let dep_package_id = yarn_entry_to_package_id[dep_entry_idx];
-            if dep_package_id == install::INVALID_PACKAGE_ID {
-                continue;
-            }
-
-            if let Some(deps) = &dep_entry.dependencies {
-                for (dep_name_key, _) in deps.iter() {
-                    if dep_name_key.as_ref() == base_name {
-                        if dep_package_id != package_id {
-                            let parent_name = package_names[dep_package_id as usize];
-
-                            let mut potential_name = Vec::new();
-                            write!(
-                                &mut potential_name,
-                                "{}/{}",
-                                bstr::BStr::new(parent_name),
-                                bstr::BStr::new(base_name)
-                            )
-                            .expect("unreachable");
-
-                            let mut name_already_used = false;
-                            for existing_name in scoped_names.values() {
-                                if existing_name.as_slice() == potential_name.as_slice() {
-                                    name_already_used = true;
-                                    break;
-                                }
-                            }
-
-                            if !name_already_used {
-                                scoped_name = Some(potential_name);
-                                break;
-                            }
-                            // else: potential_name dropped
-                        }
-                    }
-                }
-                if scoped_name.is_some() {
-                    break;
-                }
-            }
-        }
-
-        if scoped_name.is_none() {
-            let pkg_resolution = this.packages.get(package_id as usize).resolution;
-            let version_str: Vec<u8> = match pkg_resolution.tag {
-                ResolutionTag::Npm => 'brk: {
-                    let mut version_buf = [0u8; 64];
-                    let mut cursor = &mut version_buf[..];
-                    let npm_version = pkg_resolution.npm().version;
-                    let _ = write!(
-                        &mut cursor,
-                        "{}",
-                        npm_version.fmt(this.buffers.string_bytes.as_slice())
-                    );
-                    let written = 64 - cursor.len();
-                    break 'brk version_buf[..written].to_vec();
-                }
-                _ => b"unknown".to_vec(),
-            };
-            let mut name = Vec::new();
-            write!(
-                &mut name,
-                "{}@{}",
-                bstr::BStr::new(base_name),
-                bstr::BStr::new(&version_str)
-            )
-            .expect("unreachable");
-            scoped_name = Some(name);
-        }
-
-        if let Some(final_scoped_name) = scoped_name {
-            let name_hash = string_hash(&final_scoped_name);
-            this.get_or_put_id(package_id, name_hash)?;
-            scoped_names.put(package_id, final_scoped_name)?;
-            scoped_count += 1;
-        }
-    }
-    let _ = scoped_count;
-
-    for (yarn_idx, entry) in yarn_lock.entries.iter().enumerate() {
-        let package_id = yarn_entry_to_package_id[yarn_idx];
-        if package_id == install::INVALID_PACKAGE_ID {
-            continue;
-        }
-
-        if let Some(resolved) = entry.resolved.as_deref() {
-            if let Some(real_name) = Entry::get_package_name_from_resolved_url(resolved) {
-                for spec in entry.specs.iter() {
-                    let alias_name = Entry::get_name_from_spec(spec);
-
-                    if alias_name != real_name {
-                        let alias_hash = string_hash(alias_name);
-                        this.get_or_put_id(package_id, alias_hash)?;
-                    }
-                }
-            }
-        }
+    for id in 0..this.packages.len() {
+        let name_hash = this.packages.items_name_hash()[id];
+        this.get_or_put_id(id as PackageID, name_hash)?;
     }
 
     this.buffers.trees[0].dependencies = lockfile::DependencyIDSlice::new(0, 0);
diff --git a/test/cli/install/hoist.test.ts b/test/cli/install/hoist.test.ts
index 12919c36b139..471acd7dde14 100644
--- a/test/cli/install/hoist.test.ts
+++ b/test/cli/install/hoist.test.ts
@@ -1,5 +1,8 @@
-import { afterAll, beforeAll, test } from "bun:test";
+import { file, write } from "bun";
+import { afterAll, beforeAll, expect, test } from "bun:test";
+import { exists, rm } from "fs/promises";
 import { VerdaccioRegistry, bunEnv, runBunInstall } from "harness";
+import { join } from "path";
 
 const registry = new VerdaccioRegistry();
 
@@ -28,3 +31,66 @@ test("should handle resolving optional peer from multiple instances of same pack
   // this shouldn't hit an assertion
   await runBunInstall(bunEnv, packageDir);
 });
+
+test("tree written after a ranged peer gains a higher candidate is the tree the next install lays out", async () => {
+  // `peer-deps-fixed` has a peer on `no-deps@^1.0.0`. As a devDependency it is
+  // hoisted before the root's `dependencies`, so whatever its peer edge is bound
+  // to is the `no-deps` that lands at the root of node_modules. Loading bun.lock
+  // binds such an edge to the highest satisfying version in the lockfile, so
+  // the install that adds `one-dep` (no-deps@1.0.1, next to one-fixed-dep's
+  // 1.0.0) has to bind it the same way before hoisting. Otherwise it writes a
+  // lockfile keyed with 1.0.0 at the root and the very next `bun install`
+  // relinks node_modules with 1.0.1 at the root, without touching bun.lock.
+  const { packageDir, packageJson } = await registry.createTestDir({ bunfigOpts: { linker: "hoisted" } });
+  const noDepsVersion = async (...segments: string[]) => {
+    const pkg = join(packageDir, "node_modules", ...segments, "no-deps", "package.json");
+    return (await exists(pkg)) ? ((await file(pkg).json()) as { version: string }).version : null;
+  };
+  const layout = async () => ({
+    root: await noDepsVersion(),
+    "one-dep": await noDepsVersion("one-dep", "node_modules"),
+    "one-fixed-dep": await noDepsVersion("one-fixed-dep", "node_modules"),
+  });
+
+  await write(
+    packageJson,
+    JSON.stringify({
+      name: "ranged-peer-roundtrip",
+      dependencies: { "one-fixed-dep": "1.0.0" },
+      devDependencies: { "peer-deps-fixed": "1.0.0" },
+    }),
+  );
+  await runBunInstall(bunEnv, packageDir);
+  expect(await layout()).toEqual({ root: "1.0.0", "one-dep": null, "one-fixed-dep": null });
+
+  await write(
+    packageJson,
+    JSON.stringify({
+      name: "ranged-peer-roundtrip",
+      dependencies: { "one-dep": "1.0.0", "one-fixed-dep": "1.0.0" },
+      devDependencies: { "peer-deps-fixed": "1.0.0" },
+    }),
+  );
+  await runBunInstall(bunEnv, packageDir);
+  const written = await layout();
+  const lockfile = await file(join(packageDir, "bun.lock")).text();
+
+  // the tree on disk is the tree the lockfile describes, so reinstalling from it is a no-op
+  const { out, err } = await runBunInstall(bunEnv, packageDir, { savesLockfile: false });
+  expect(out).toContain("(no changes)");
+  expect(err).not.toContain("Saved lockfile");
+  expect(await layout()).toEqual(written);
+  expect(await file(join(packageDir, "bun.lock")).text()).toBe(lockfile);
+
+  // the peer is bound to the highest satisfying version, and peer-deps-fixed hoists it first
+  expect(written).toEqual({ root: "1.0.1", "one-dep": null, "one-fixed-dep": "1.0.0" });
+  expect(lockfile).toContain('"no-deps": ["no-deps@1.0.1"');
+  expect(lockfile).toContain('"one-fixed-dep/no-deps": ["no-deps@1.0.0"');
+
+  // a fresh resolve of the same package.json binds the peer the same way
+  await rm(join(packageDir, "node_modules"), { recursive: true, force: true });
+  await rm(join(packageDir, "bun.lock"));
+  await runBunInstall(bunEnv, packageDir);
+  expect(await layout()).toEqual(written);
+  expect(await file(join(packageDir, "bun.lock")).text()).toBe(lockfile);
+});
diff --git a/test/cli/install/isolated-install.test.ts b/test/cli/install/isolated-install.test.ts
index 59ddce9484b1..1e9a6aa5df67 100644
--- a/test/cli/install/isolated-install.test.ts
+++ b/test/cli/install/isolated-install.test.ts
@@ -1220,6 +1220,59 @@ test("ranged peer dependency resolution is stable across installs from bun.lock"
   });
 });
 
+test("ranged peer rebinds in the install that adds a higher satisfying version, not the one after", async () => {
+  // The first install binds peer-deps-fixed's `no-deps@^1.0.0` to 1.0.0, the
+  // only candidate. Adding `one-dep` brings in no-deps@1.0.1; loading the
+  // lockfile that install writes binds the edge to 1.0.1 (highest satisfying),
+  // so that install has to bind it the same way itself. Otherwise it links the
+  // 1.0.0 peer variant and the next `bun install`, with nothing changed,
+  // re-keys the store entry.
+  const { packageJson, packageDir } = await registry.createTestDir({
+    bunfigOpts: { linker: "isolated" },
+  });
+  const bunDir = join(packageDir, "node_modules", ".bun");
+  const peerEntries = async () => (await readdirSorted(bunDir)).filter(e => e.startsWith("peer-deps-fixed@"));
+  const peerNoDepsVersion = async (entry: string) =>
+    ((await file(join(bunDir, entry, "node_modules", "no-deps", "package.json")).json()) as { version: string })
+      .version;
+
+  await write(
+    packageJson,
+    JSON.stringify({
+      name: "rebind-ranged-peer",
+      dependencies: { "peer-deps-fixed": "1.0.0", "one-fixed-dep": "1.0.0" },
+    }),
+  );
+  await runBunInstall(bunEnv, packageDir);
+  const [initialEntry] = await peerEntries();
+  expect(await peerNoDepsVersion(initialEntry)).toBe("1.0.0");
+
+  await write(
+    packageJson,
+    JSON.stringify({
+      name: "rebind-ranged-peer",
+      dependencies: { "peer-deps-fixed": "1.0.0", "one-fixed-dep": "1.0.0", "one-dep": "1.0.0" },
+    }),
+  );
+  await runBunInstall(bunEnv, packageDir);
+  const entries = await peerEntries();
+  const lockfile = await file(join(packageDir, "bun.lock")).text();
+
+  const { out, err } = await runBunInstall(bunEnv, packageDir, { savesLockfile: false });
+  expect(out).toContain("(no changes)");
+  expect(err).not.toContain("Saved lockfile");
+  expect(await peerEntries()).toEqual(entries);
+  expect(await file(join(packageDir, "bun.lock")).text()).toBe(lockfile);
+
+  // The superseded variant stays in the store until `bun prune`, like after any peer bump.
+  const [rebound, ...rest] = entries.filter(entry => entry !== initialEntry);
+  expect(rest).toEqual([]);
+  expect(await peerNoDepsVersion(rebound)).toBe("1.0.1");
+  expect(readlinkSync(join(packageDir, "node_modules", "peer-deps-fixed"))).toBe(
+    join(".bun", rebound, "node_modules", "peer-deps-fixed"),
+  );
+});
+
 test("aliased peer dependency binds to its real package across installs from bun.lock", async () => {
   // The peer alias `no-deps` points at `npm:a-dep@^1.0.2` while the real
   // no-deps package (in two versions) is also in the graph. Loading bun.lock
diff --git a/test/cli/install/migration/migrate.test.ts b/test/cli/install/migration/migrate.test.ts
index 2429afe854aa..8bb11fffa225 100644
--- a/test/cli/install/migration/migrate.test.ts
+++ b/test/cli/install/migration/migrate.test.ts
@@ -1366,6 +1366,61 @@ describe("package-lock.json migration fixes", () => {
     },
   );
 
+  test.concurrent(
+    "a ranged peer npm satisfied with a lower version migrates to the tree a fresh resolve writes",
+    async () => {
+      // npm satisfied peer-deps-fixed's `no-deps@^1.0.0` with the 1.0.0 it hoisted. bun binds such a
+      // peer to the highest satisfying version in the lockfile (1.0.1) whenever it loads bun.lock, and
+      // peer-deps-fixed, a devDependency, hoists before the root's dependencies: a migrated tree
+      // built from npm's binding would key 1.0.0 at the root and be rebuilt with 1.0.1 there by the
+      // first install that loads it.
+      using registry = localRegistry();
+      const entry = (name: string, version: string, info: Record<string, unknown> = {}) => ({
+        version,
+        resolved: registry.tarball(name, version),
+        integrity: registry.integrity(name, version),
+        ...info,
+      });
+      const root = {
+        name: "ranged-peer",
+        dependencies: { "one-dep": "1.0.0", "one-fixed-dep": "1.0.0" },
+        devDependencies: { "peer-deps-fixed": "1.0.0" },
+      };
+      using dir = synthetic(
+        "npm-migrate-ranged-peer",
+        {
+          "package.json": JSON.stringify(root),
+          "package-lock.json": npmLock("ranged-peer", {
+            "": root,
+            "node_modules/no-deps": entry("no-deps", "1.0.0"),
+            "node_modules/one-dep": entry("one-dep", "1.0.0", { dependencies: { "no-deps": "1.0.1" } }),
+            "node_modules/one-dep/node_modules/no-deps": entry("no-deps", "1.0.1"),
+            "node_modules/one-fixed-dep": entry("one-fixed-dep", "1.0.0", { dependencies: { "no-deps": "1.0.0" } }),
+            "node_modules/peer-deps-fixed": entry("peer-deps-fixed", "1.0.0", {
+              dev: true,
+              peerDependencies: { "no-deps": "^1.0.0" },
+            }),
+          }),
+        },
+        registry.url,
+      );
+      const { lock } = await migrate(dir);
+      expect(lock.packages["no-deps"][0]).toBe("no-deps@1.0.1");
+      expect(lock.packages["one-fixed-dep/no-deps"][0]).toBe("no-deps@1.0.0");
+      await frozen(dir);
+
+      using freshDir = synthetic(
+        "npm-migrate-ranged-peer-fresh",
+        { "package.json": JSON.stringify(root) },
+        registry.url,
+      );
+      const fresh = await run(freshDir, "install", "--lockfile-only");
+      expect(fresh.exitCode).toBe(0);
+      const { lock: freshLock } = await readLock(freshDir);
+      expect(lock.packages).toStrictEqual(freshLock.packages);
+    },
+  );
+
   test.concurrent("workspace listed in the lockfile but deleted from disk is skipped", async () => {
     const src = join(ARBORIST, "workspaces-simple-virtual");
     const packageLock = JSON.parse(fs.readFileSync(join(src, "package-lock.json"), "utf8"));
diff --git a/test/cli/install/migration/yarn-lock-migration.test.ts b/test/cli/install/migration/yarn-lock-migration.test.ts
index de69143e155b..c83cec240d83 100644
--- a/test/cli/install/migration/yarn-lock-migration.test.ts
+++ b/test/cli/install/migration/yarn-lock-migration.test.ts
@@ -1639,4 +1639,76 @@ fsevents@^2.3.2:
     expect(bunLockContent).toContain("@esbuild/linux-arm64");
     expect(bunLockContent).toContain("@esbuild/darwin-arm64");
   });
+
+  test("a peer binds to the highest satisfying version, not the copy yarn.lock resolved its range to", async () => {
+    // yarn.lock resolved bar's `foo@^1.0.0` peer spec to the foo@1.0.0 it lists first, while
+    // foo@1.5.0 is in the graph too. Hoisting binds the peer the way every other tree build
+    // does, and bar hoists before uses-foo1, so the copy written at the root is 1.5.0, the
+    // same tree a reload of the migrated file builds.
+    const sha = Buffer.alloc(40, "0").toString();
+    await using tmpDir = tempDir("yarn-migration-peer-binding", {
+      "package.json": JSON.stringify({
+        name: "peer-binding",
+        dependencies: { "bar": "1.0.0", "uses-foo1": "1.0.0", "uses-foo15": "1.0.0" },
+      }),
+      // port 1 refuses connections, so the manifest fetch after the migration fails fast
+      "bunfig.toml": `[install]\nregistry = "http://localhost:1/"\n`,
+      "yarn.lock": `# THIS IS AN AUTOGENERATED FILE. DO NOT EDIT THIS FILE DIRECTLY.
+# yarn lockfile v1
+
+
+foo@1.0.0, foo@^1.0.0:
+  version "1.0.0"
+  resolved "http://localhost:1/foo/-/foo-1.0.0.tgz#${sha}"
+
+foo@1.5.0:
+  version "1.5.0"
+  resolved "http://localhost:1/foo/-/foo-1.5.0.tgz#${sha}"
+
+bar@1.0.0:
+  version "1.0.0"
+  resolved "http://localhost:1/bar/-/bar-1.0.0.tgz#${sha}"
+  peerDependencies:
+    foo "^1.0.0"
+
+uses-foo1@1.0.0:
+  version "1.0.0"
+  resolved "http://localhost:1/uses-foo1/-/uses-foo1-1.0.0.tgz#${sha}"
+  dependencies:
+    foo "1.0.0"
+
+uses-foo15@1.0.0:
+  version "1.0.0"
+  resolved "http://localhost:1/uses-foo15/-/uses-foo15-1.0.0.tgz#${sha}"
+  dependencies:
+    foo "1.5.0"
+`,
+    });
+
+    await using migrateResult = Bun.spawn({
+      cmd: [bunExe(), "pm", "migrate", "-f"],
+      cwd: tmpDir,
+      env: bunEnv,
+      stdout: "pipe",
+      stderr: "pipe",
+      stdin: "ignore",
+    });
+    const [stdout, stderr, exitCode] = await Promise.all([
+      migrateResult.stdout.text(),
+      migrateResult.stderr.text(),
+      migrateResult.exited,
+    ]);
+    expect(stdout).toBe("");
+    expect(stderr).toContain("migrated lockfile from yarn.lock");
+    expect(exitCode).toBe(0);
+
+    const lock = Bun.JSONC.parse(fs.readFileSync(join(tmpDir, "bun.lock"), "utf8")) as any;
+    expect(Object.fromEntries(Object.entries(lock.packages).map(([key, value]: any) => [key, value[0]]))).toEqual({
+      "bar": "bar@1.0.0",
+      "foo": "foo@1.5.0",
+      "uses-foo1": "uses-foo1@1.0.0",
+      "uses-foo1/foo": "foo@1.0.0",
+      "uses-foo15": "uses-foo15@1.0.0",
+    });
+  });
 });

From 96fbc40bf638a21c8cc7891d351f5cca56d869b6 Mon Sep 17 00:00:00 2001
From: robobun <117481402+robobun@users.noreply.github.com>
Date: Mon, 17 Aug 2026 01:03:48 +0000
Subject: [PATCH 002/258] install: keep transitive rows on the copy a direct
 dependency resolves to (#38770)

---
 docs/pm/cli/update.mdx                        |   1 +
 .../PackageManager/PackageManagerEnqueue.rs   |  62 +++++-
 .../PackageManager/install_with_manager.rs    |  44 +++-
 src/install/lockfile.rs                       |  26 +++
 src/install/update_transitive.rs              | 150 +++++++++++--
 test/cli/install/bun-install-registry.test.ts |  43 ++++
 .../cli/install/bun-update-transitive.test.ts | 203 +++++++++++++++++-
 test/cli/install/bun-update.test.ts           |  46 +++-
 8 files changed, 518 insertions(+), 57 deletions(-)

diff --git a/docs/pm/cli/update.mdx b/docs/pm/cli/update.mdx
index 169b8b4e8d6d..580dd0eab3a7 100644
--- a/docs/pm/cli/update.mdx
+++ b/docs/pm/cli/update.mdx
@@ -36,6 +36,7 @@ Updated packages appear in the install summary as `↑ name old → new`, with `
 ### What is held back
 
 - Bun never widens ranges. A package that depends on `foo@^1.0.0` never gets `foo@2.x`.
+- A transitive dependency that shares the copy your own `package.json` entry resolves to (in the root or in a workspace) stays on that copy and moves with it. With `@types/node: ~20` in your `package.json`, the `@types/node: *` that `@types/ws` declares keeps using your `~20` copy instead of nesting the newest major under `@types/ws`. Bun updates a transitive range on its own when it rejects the version your entry moves to, or when you removed the entry.
 - Versions in `patchedDependencies` stay put as long as their range allows. Bun reports them as `kept name@version (patched, v1.2.3 available)`. `--latest` and [`bun audit fix`](/pm/cli/audit#bun-audit-fix) do move them; re-create the patch with [`bun patch`](/pm/cli/patch) afterwards.
 - If a registry request for a transitive package fails, that package keeps its locked version and Bun prints a warning. A failed request for a direct dependency is an error.
 
diff --git a/src/install/PackageManager/PackageManagerEnqueue.rs b/src/install/PackageManager/PackageManagerEnqueue.rs
index db8f7c3058d3..a323dc824b42 100644
--- a/src/install/PackageManager/PackageManagerEnqueue.rs
+++ b/src/install/PackageManager/PackageManagerEnqueue.rs
@@ -2098,6 +2098,22 @@ fn get_or_put_resolved_package_with_find_result(
         }
     }
 
+    // `bun update <name>` re-resolves every row of the name. A row owned by a
+    // regular package stays on the copy a root/workspace dependency resolves to
+    // whenever its range allows, as a fresh resolution would dedupe it there;
+    // the direct rows themselves (enqueued first) move within their own ranges.
+    if should_update && !behavior.is_peer() && !this.lockfile.is_workspace_dependency(dependency_id)
+    {
+        if let Some(id) = direct_dependency_package_satisfying(this, name_hash, version) {
+            success_fn(this, dependency_id, id);
+            return Ok(Some(ResolvedPackageResult {
+                package: *this.lockfile.packages.get(id as usize),
+                is_first_time: false,
+                task: None,
+            }));
+        }
+    }
+
     // Was this package already allocated? Let's reuse the existing one.
     //
     // Determinism: passing `version` here unconditionally lets a
@@ -2915,15 +2931,13 @@ fn resolution_satisfies_dependency(
     resolution.satisfies_dependency_version(dependency, buf, buf)
 }
 
-fn patched_package_satisfying(
-    this: &PackageManager,
+/// The first npm package of this name that `version` allows and `accept` takes.
+fn npm_package_satisfying(
+    lockfile: &Lockfile::Lockfile,
     name_hash: PackageNameHash,
     version: &dependency::Version,
+    accept: impl Fn(PackageID) -> bool,
 ) -> Option<PackageID> {
-    let lockfile: &Lockfile::Lockfile = &this.lockfile;
-    if lockfile.patched_dependencies.count() == 0 {
-        return None;
-    }
     let candidates = lockfile.package_index.get(&name_hash)?.as_slice();
     let pkg_res = lockfile.packages.items_resolution();
     let buf = lockfile.buffers.string_bytes.as_slice();
@@ -2931,11 +2945,37 @@ fn patched_package_satisfying(
         let res = &pkg_res[id as usize];
         res.tag == ResolutionTag::Npm
             && res.satisfies_dependency_version(version, buf, buf)
-            && lockfile
-                .patched_dependencies
-                .contains(&Semver::string::Builder::string_hash(
-                    &crate::dedupe::label(lockfile, id),
-                ))
+            && accept(id)
+    })
+}
+
+fn patched_package_satisfying(
+    this: &PackageManager,
+    name_hash: PackageNameHash,
+    version: &dependency::Version,
+) -> Option<PackageID> {
+    let lockfile: &Lockfile::Lockfile = &this.lockfile;
+    if lockfile.patched_dependencies.count() == 0 {
+        return None;
+    }
+    npm_package_satisfying(lockfile, name_hash, version, |id| {
+        lockfile
+            .patched_dependencies
+            .contains(&Semver::string::Builder::string_hash(
+                &crate::dedupe::label(lockfile, id),
+            ))
+    })
+}
+
+/// The package of this name that a root or workspace dependency resolves to, if `version` allows it.
+fn direct_dependency_package_satisfying(
+    this: &PackageManager,
+    name_hash: PackageNameHash,
+    version: &dependency::Version,
+) -> Option<PackageID> {
+    let lockfile: &Lockfile::Lockfile = &this.lockfile;
+    npm_package_satisfying(lockfile, name_hash, version, |id| {
+        lockfile.is_direct_dependency_resolution(id)
     })
 }
 
diff --git a/src/install/PackageManager/install_with_manager.rs b/src/install/PackageManager/install_with_manager.rs
index ddeecd488e28..a2aaffe39e33 100644
--- a/src/install/PackageManager/install_with_manager.rs
+++ b/src/install/PackageManager/install_with_manager.rs
@@ -236,7 +236,7 @@ pub fn install_with_manager(
                 if manager.subcommand == Subcommand::Dedupe {
                     crate::dedupe::dedupe_after_differ(manager);
                 }
-                if manager.summary.changes_resolutions() {
+                if manager.summary.changes_resolutions() || bare_update {
                     direct_deps_before = DirectDependencies::snapshot(&manager.lockfile);
                 }
 
@@ -593,6 +593,9 @@ pub fn install_with_manager(
     let mut named = NamedUpdates::default();
     if !needs_new_lockfile {
         if named_update {
+            // The rows of a workspace the differ re-parsed are still queued; they are
+            // direct entries, so they go out ahead of the rows the named pass enqueues.
+            manager.drain_dependency_list();
             named = enqueue_named_updates(
                 manager,
                 &direct_deps_before,
@@ -634,8 +637,16 @@ pub fn install_with_manager(
     if manager.pending_task_count() > 0
         || manager.peer_dependencies.readable_length() > 0
         || !named.latest_rows.is_empty()
+        || transitive.has_deferred()
     {
-        resolve_pending_tasks(manager, &root, log_level, &mut named)?;
+        resolve_pending_tasks(
+            manager,
+            &root,
+            log_level,
+            &mut named,
+            &mut transitive,
+            &direct_deps_before,
+        )?;
     }
 
     direct_deps_before.redirect_dependents(&mut manager.lockfile);
@@ -1561,11 +1572,12 @@ fn enqueue_named_updates(
     let mut matched_elsewhere = DynamicBitSet::init_empty(requests).unwrap_or_oom();
     let mut named = NamedUpdates::default();
     let mut peer_rows: Vec<DependencyID> = Vec::new();
+    let mut rows: Vec<(DependencyID, PackageID)> = Vec::new();
     let dependencies_len = manager.lockfile.buffers.dependencies.len();
     for dependency_i in 0..dependencies_len {
-        let dependency = manager.lockfile.buffers.dependencies[dependency_i].clone();
+        let dependency = &manager.lockfile.buffers.dependencies[dependency_i];
         let package_id = manager.lockfile.buffers.resolutions[dependency_i];
-        let Some(request) = index_of_named_update(manager, &dependency, package_id) else {
+        let Some(request) = index_of_named_update(manager, dependency, package_id) else {
             continue;
         };
         if !walkable.is_set(dependency_i) {
@@ -1585,11 +1597,23 @@ fn enqueue_named_updates(
             }
             continue;
         }
-        manager.lockfile.buffers.resolutions[dependency_i] = invalid_package_id;
-        named.moved.push((dependency_i as DependencyID, package_id));
+        rows.push((dependency_i as DependencyID, package_id));
+    }
+
+    // Rows declared by the root or a workspace resolve first, so the rows regular
+    // packages own can land on the copy they move to (see
+    // `get_or_put_resolved_package_with_find_result`), and edges following a
+    // vacated package through `redirect_moved_edges` follow the direct entry.
+    let (direct_rows, transitive_rows): (Vec<_>, Vec<_>) = rows
+        .into_iter()
+        .partition(|&(dependency_i, _)| manager.lockfile.is_workspace_dependency(dependency_i));
+    for (dependency_i, package_id) in direct_rows.into_iter().chain(transitive_rows) {
+        let dependency = manager.lockfile.buffers.dependencies[dependency_i as usize].clone();
+        manager.lockfile.buffers.resolutions[dependency_i as usize] = invalid_package_id;
+        named.moved.push((dependency_i, package_id));
         if let Err(err) = enqueue_dependency_with_main(
             manager,
-            dependency_i as DependencyID,
+            dependency_i,
             &dependency,
             invalid_package_id,
             false,
@@ -1959,6 +1983,8 @@ fn resolve_pending_tasks(
     root: &lockfile::Package,
     log_level: Options::LogLevel,
     named: &mut NamedUpdates,
+    transitive: &mut TransitiveUpdate,
+    direct_deps_before: &DirectDependencies,
 ) -> crate::Result<()> {
     if root.dependencies.len > 0 {
         let _ = manager.get_cache_directory();
@@ -1978,6 +2004,10 @@ fn resolve_pending_tasks(
 
     wait_for_resolution(manager)?;
 
+    if transitive.plan_unanchored(manager, direct_deps_before)? {
+        wait_for_resolution(manager)?;
+    }
+
     if !named.latest_rows.is_empty() {
         let child_moves = refresh_children_of_named(manager, &named.latest_rows)?;
         named.moved.extend(child_moves);
diff --git a/src/install/lockfile.rs b/src/install/lockfile.rs
index 755ec191a69a..f80c2ed6b1ee 100644
--- a/src/install/lockfile.rs
+++ b/src/install/lockfile.rs
@@ -782,6 +782,23 @@ impl Lockfile {
         self.get_workspace_pkg_if_workspace_dep(id) != invalid_package_id
     }
 
+    /// Does a dependency declared by the root package or a workspace currently
+    /// resolve to package `id`?
+    pub(crate) fn is_direct_dependency_resolution(&self, id: PackageID) -> bool {
+        let packages = self.packages.slice();
+        let resolutions_buf = self.buffers.resolutions.as_slice();
+        packages
+            .items_resolution()
+            .iter()
+            .zip(packages.items_resolutions())
+            .any(|(resolution, resolution_list)| {
+                matches!(
+                    resolution.tag,
+                    ResolutionTag::Root | ResolutionTag::Workspace
+                ) && resolution_list.get(resolutions_buf).contains(&id)
+            })
+    }
+
     pub(crate) fn get_workspace_pkg_if_workspace_dep(&self, id: DependencyID) -> PackageID {
         let packages = self.packages.slice();
         let resolutions = packages.items_resolution();
@@ -2076,6 +2093,14 @@ impl Lockfile {
             //     (an exact pin anywhere in the tree is a deliberate choice,
             //     not a network-order artefact — `dragon test 2` /
             //     "dependency from root satisfies range from dependency"),
+            //   - no dependency declared by the root or a workspace resolves
+            //     to the entry. Those rows are enqueued before any package's
+            //     dependency list is drained, so whatever they resolved to is
+            //     already in place by the time a transitive row on the same
+            //     name gets here, whichever order the manifests landed in.
+            //     This is what keeps a project's `@types/node: ~20` as the
+            //     single copy every `@types/*` package's `@types/node: *`
+            //     collapses onto, instead of each nesting the latest major.
             //   - the manifest's best-match is a *different major* (within a
             //     major, deduping to an older patch is the long-standing
             //     behaviour and the worst case is still ^-compatible).
@@ -2088,6 +2113,7 @@ impl Lockfile {
                 if let Some(floor) = resolved_npm_floor {
                     if existing_ver.order(floor, buf, buf) == Ordering::Less
                         && existing_ver.major != floor.major
+                        && !self.is_direct_dependency_resolution(id)
                     {
                         return false;
                     }
diff --git a/src/install/update_transitive.rs b/src/install/update_transitive.rs
index d53d2adbd821..9492b81a4401 100644
--- a/src/install/update_transitive.rs
+++ b/src/install/update_transitive.rs
@@ -23,11 +23,17 @@ use crate::{
     PackageManager, PackageNameHash, ResolutionTag, invalid_package_id,
 };
 
+struct DirectRow {
+    name_hash: PackageNameHash,
+    behavior: Behavior,
+    resolved: PackageID,
+}
+
 /// Root/workspace dependency rows as loaded from bun.lock, taken before the differ re-enqueues them.
 #[derive(Default)]
 pub struct DirectDependencies {
     owners: Vec<(PackageID, u32, u32)>,
-    rows: Vec<(PackageNameHash, Behavior, PackageID)>,
+    rows: Vec<DirectRow>,
 }
 
 impl DirectDependencies {
@@ -52,7 +58,11 @@ impl DirectDependencies {
                     .get(deps)
                     .iter()
                     .zip(res_slices[owner].get(resolutions))
-                    .map(|(dep, &resolved)| (dep.name_hash, dep.behavior, resolved)),
+                    .map(|(dep, &resolved)| DirectRow {
+                        name_hash: dep.name_hash,
+                        behavior: dep.behavior,
+                        resolved,
+                    }),
             );
             out.owners.push((
                 owner as PackageID,
@@ -63,6 +73,17 @@ impl DirectDependencies {
         out
     }
 
+    /// One bit per package: the packages the direct rows resolve to.
+    fn resolved_packages(&self, packages_len: usize) -> DynamicBitSet {
+        let mut set = DynamicBitSet::init_empty(packages_len).unwrap_or_oom();
+        for row in &self.rows {
+            if (row.resolved as usize) < packages_len {
+                set.set(row.resolved as usize);
+            }
+        }
+        set
+    }
+
     /// Edges still resolving to the previous package of a direct dependency that moved follow it when their range allows.
     pub fn redirect_dependents(&self, lockfile: &mut Lockfile) {
         if self.owners.is_empty() || lockfile.loaded_package_count == 0 {
@@ -93,8 +114,8 @@ impl DirectDependencies {
                 .iter()
                 .zip(res_slices[owner].get(resolutions));
             for (i, (dep, &new)) in current.enumerate() {
-                let same = |row: &(PackageNameHash, Behavior, PackageID)| {
-                    row.0 == dep.name_hash && row.1 == dep.behavior
+                let same = |row: &DirectRow| {
+                    row.name_hash == dep.name_hash && row.behavior == dep.behavior
                 };
                 let index = if claimed.is_none() && rows.get(i).is_some_and(same) {
                     i
@@ -122,7 +143,7 @@ impl DirectDependencies {
                     taken.set(k);
                     k
                 };
-                let old = rows[index].2;
+                let old = rows[index].resolved;
                 if old == new
                     || (old as usize) >= packages_len
                     || (new as usize) >= packages_len
@@ -259,12 +280,14 @@ struct Pin {
     to: Option<Semver::Version>,
 }
 
-/// The transitive half of a bare `bun update`: every edge owned by a non-workspace package the selected workspaces reach (all of them from the root or with -r) moves to the newest release its own range allows, or to wherever its dist-tag points now.
+/// The transitive half of a bare `bun update`: every edge owned by a non-workspace package the selected workspaces reach (all of them from the root or with -r) moves to the newest release its own range allows, or to wherever its dist-tag points now. A range edge sharing the package a root/workspace entry resolves to follows that entry instead (`deferred`).
 #[derive(Default)]
 pub struct TransitiveUpdate {
     pins: Vec<Pin>,
     /// Kept for `print_plan` when no install summary will print the rows (`--dry-run`, `--lockfile-only`).
     report: Option<Report>,
+    /// Range rows left to follow the direct entry whose package they share; `plan_unanchored` plans the ones that entry did not take along.
+    deferred: Vec<DependencyID>,
 }
 
 impl TransitiveUpdate {
@@ -286,15 +309,67 @@ impl TransitiveUpdate {
             }
             edges
         };
-        let (pins, report) = plan_edges(manager, &edges, direct)?;
-        register_moved(manager, &report.moved)?;
+        let planned = plan_edges(manager, &edges, direct)?;
+        register_moved(manager, &planned.report.moved)?;
         let printed_here = manager.options.dry_run || manager.options.lockfile_only;
         Ok(TransitiveUpdate {
-            pins,
-            report: printed_here.then_some(report),
+            pins: planned.pins,
+            report: printed_here.then_some(planned.report),
+            deferred: planned.deferred,
         })
     }
 
+    pub fn has_deferred(&self) -> bool {
+        !self.deferred.is_empty()
+    }
+
+    /// Once the direct entries have resolved: a deferred row whose entry moved to a version the row's range accepts has followed it; one whose package no direct entry resolves to any more (the entry moved where the range does not reach, or was removed from package.json in the meantime) is planned on its own range here. Returns whether anything was enqueued, in which case the caller resolves again.
+    pub fn plan_unanchored(
+        &mut self,
+        manager: &mut PackageManager,
+        direct: &DirectDependencies,
+    ) -> crate::Result<bool> {
+        if self.deferred.is_empty() {
+            return Ok(false);
+        }
+        direct.redirect_dependents(&mut manager.lockfile);
+        let current = DirectDependencies::snapshot(&manager.lockfile);
+        let edges = {
+            let lockfile = &*manager.lockfile;
+            let packages_len = lockfile.packages.len();
+            let anchored = current.resolved_packages(packages_len);
+            let resolutions = lockfile.buffers.resolutions.as_slice();
+            let mut edges = DynamicBitSet::init_empty(resolutions.len())?;
+            for dep_id in self.deferred.drain(..) {
+                let target = resolutions[dep_id as usize] as usize;
+                if target < packages_len && !anchored.is_set(target) {
+                    edges.set(dep_id as usize);
+                }
+            }
+            edges
+        };
+        if edges.count() == 0 {
+            return Ok(false);
+        }
+        let planned = plan_edges(manager, &edges, &current)?;
+        register_moved(manager, &planned.report.moved)?;
+        if let Some(report) = &mut self.report {
+            report.rows.extend(planned.report.rows);
+            report.moved.extend(planned.report.moved);
+        }
+        if planned.pins.is_empty() {
+            return Ok(false);
+        }
+        let round = TransitiveUpdate {
+            pins: planned.pins,
+            ..Default::default()
+        };
+        round.enqueue(manager)?;
+        manager.drain_dependency_list();
+        self.pins.extend(round.pins);
+        Ok(true)
+    }
+
     /// Runs after the differ's own enqueues (including its override/catalog invalidation loops) so the pins win; edges the differ moved off their package are left to it.
     pub fn enqueue(&self, manager: &mut PackageManager) -> crate::Result<()> {
         self.enqueue_inner(manager, None)
@@ -417,9 +492,14 @@ pub(crate) fn refresh_children_of(
         }
         edges
     };
-    let (pins, report) = plan_edges(manager, &edges, &DirectDependencies::default())?;
-    register_moved(manager, &report.moved)?;
-    let update = TransitiveUpdate { pins, report: None };
+    // The direct rows are resolved by now, so the rows `plan_edges` defers are sharing a package those rows settled on and simply stay there.
+    let direct = DirectDependencies::snapshot(&manager.lockfile);
+    let planned = plan_edges(manager, &edges, &direct)?;
+    register_moved(manager, &planned.report.moved)?;
+    let update = TransitiveUpdate {
+        pins: planned.pins,
+        ..Default::default()
+    };
     update.enqueue(manager)?;
     Ok(update
         .pins
@@ -977,9 +1057,9 @@ pub(crate) fn plannable_peer_rows(
     let resolutions = lockfile.buffers.resolutions.as_slice();
 
     let mut providers = DynamicBitSet::init_empty(packages_len).unwrap_or_oom();
-    for &(_, behavior, resolved) in &direct.rows {
-        if !behavior.is_peer() && (resolved as usize) < packages_len {
-            providers.set(resolved as usize);
+    for row in &direct.rows {
+        if !row.behavior.is_peer() && (row.resolved as usize) < packages_len {
+            providers.set(row.resolved as usize);
         }
     }
     for owner in 0..packages_len {
@@ -1020,12 +1100,20 @@ pub(crate) fn plannable_peer_rows(
     rows
 }
 
-/// `edges` selects the rows to plan; each moves to the newest release its (post-override/catalog) range allows, or follows its dist-tag.
+#[derive(Default)]
+struct Plan {
+    pins: Vec<Pin>,
+    report: Report,
+    /// Range rows sharing a package a row of `direct` resolves to; see `TransitiveUpdate::deferred`.
+    deferred: Vec<DependencyID>,
+}
+
+/// `edges` selects the rows to plan; each moves to the newest release its (post-override/catalog) range allows, or follows its dist-tag. A range row on a package that a row of `direct` resolves to is deferred instead, since it belongs with that entry; a dist-tag row keeps following its tag.
 fn plan_edges(
     manager: &mut PackageManager,
     edges: &DynamicBitSet,
     direct: &DirectDependencies,
-) -> crate::Result<(Vec<Pin>, Report)> {
+) -> crate::Result<Plan> {
     let mut instances: Vec<Instance> = Vec::new();
     let mut kept: Vec<PackageID> = Vec::new();
     {
@@ -1124,7 +1212,26 @@ fn plan_edges(
     }
     instances.retain(|inst| !inst.wants.is_empty());
     if instances.is_empty() {
-        return Ok((Vec::new(), Report::default()));
+        return Ok(Plan::default());
+    }
+
+    let mut plan = Plan::default();
+    let shared_with_direct = direct.resolved_packages(manager.lockfile.packages.len());
+    instances.retain_mut(|inst| {
+        if inst.held || !shared_with_direct.is_set(inst.pkg_id as usize) {
+            return true;
+        }
+        inst.wants.retain_mut(|want| {
+            if want.version.tag != DependencyVersionTag::Npm {
+                return true;
+            }
+            plan.deferred.append(&mut want.dep_ids);
+            false
+        });
+        !inst.wants.is_empty()
+    });
+    if instances.is_empty() {
+        return Ok(plan);
     }
 
     let ids: Vec<PackageID> = instances.iter().map(|inst| inst.pkg_id).collect();
@@ -1137,8 +1244,7 @@ fn plan_edges(
     let buf = manager.lockfile.buffers.string_bytes.as_slice();
     let pkg_names = manager.lockfile.packages.items_name();
 
-    let mut pins: Vec<Pin> = Vec::new();
-    let mut report = Report::default();
+    let Plan { pins, report, .. } = &mut plan;
     let mut unchecked: Vec<(Box<[u8]>, Box<[u8]>)> = Vec::new();
     // Non-inline prerelease strings of planned versions live in the manifest buffer; copied into the lockfile's below.
     let mut pre_strings: Vec<(core::ops::Range<usize>, u64, Box<[u8]>)> = Vec::new();
@@ -1234,7 +1340,7 @@ fn plan_edges(
     }
 
     sort_dedup_rows(&mut report.rows);
-    Ok((pins, report))
+    Ok(plan)
 }
 
 /// The `latest` dist-tag when it is newer than the release `v` an in-range move stops at, like the `+` rows' `(vX available)`.
diff --git a/test/cli/install/bun-install-registry.test.ts b/test/cli/install/bun-install-registry.test.ts
index 0e6f5e17b6ed..4d2d41384e27 100644
--- a/test/cli/install/bun-install-registry.test.ts
+++ b/test/cli/install/bun-install-registry.test.ts
@@ -4634,6 +4634,49 @@ describe("hoisting", async () => {
       lockfile,
     );
   });
+
+  // hoist-lockfile-1@1.0.0 depends on `hoist-lockfile-shared: *`; the registry has 1.0.1, 1.0.2, 2.0.1 and 2.0.2.
+  // The project's own range decides which copy that `*` shares, the same way an exact pin would.
+  async function sharedResolutions() {
+    await runBunInstall(env, packageDir, { saveTextLockfile: true });
+    const { packages } = Bun.JSONC.parse(await file(join(packageDir, "bun.lock")).text()) as {
+      packages: Record<string, [string]>;
+    };
+    return Object.fromEntries(
+      Object.entries(packages)
+        .filter(([, [resolution]]) => resolution.startsWith("hoist-lockfile-shared@"))
+        .map(([key, [resolution]]) => [key, resolution]),
+    );
+  }
+
+  test("a dependency's `*` shares the version the root's own range resolved to", async () => {
+    await write(
+      packageJson,
+      JSON.stringify({
+        name: "foo",
+        dependencies: { "hoist-lockfile-1": "1.0.0", "hoist-lockfile-shared": "^1.0.1" },
+      }),
+    );
+
+    expect(await sharedResolutions()).toStrictEqual({ "hoist-lockfile-shared": "hoist-lockfile-shared@1.0.2" });
+    expect(await exists(join(packageDir, "node_modules", "hoist-lockfile-1", "node_modules"))).toBeFalse();
+  });
+
+  test("a dependency's `*` shares the version a workspace's own range resolved to", async () => {
+    await Promise.all([
+      write(
+        packageJson,
+        JSON.stringify({ name: "foo", workspaces: ["packages/*"], dependencies: { "hoist-lockfile-1": "1.0.0" } }),
+      ),
+      write(
+        join(packageDir, "packages", "pkg1", "package.json"),
+        JSON.stringify({ name: "pkg1", dependencies: { "hoist-lockfile-shared": "^1.0.1" } }),
+      ),
+    ]);
+
+    expect(await sharedResolutions()).toStrictEqual({ "hoist-lockfile-shared": "hoist-lockfile-shared@1.0.2" });
+    expect(await exists(join(packageDir, "node_modules", "hoist-lockfile-1", "node_modules"))).toBeFalse();
+  });
 });
 
 describe("transitive file dependencies", () => {
diff --git a/test/cli/install/bun-update-transitive.test.ts b/test/cli/install/bun-update-transitive.test.ts
index 43d7ae599a80..56857712354e 100644
--- a/test/cli/install/bun-update-transitive.test.ts
+++ b/test/cli/install/bun-update-transitive.test.ts
@@ -1119,6 +1119,133 @@ test.concurrent("the plan counts packages, not the edges that move onto them", a
   expect(exitCode).toBe(0);
 });
 
+// The root declares hoist-lockfile-shared itself, so the dependent's row shares the root's copy; `rootRange` is
+// widened after the install (the locked 1.0.1 still satisfies it, so nothing re-resolves until an update).
+async function sharedWithRoot(dependent: string, rootRange = "1.0.1") {
+  const dir = await setup({ "package.json": pkgJson({ [dependent]: "1.0.0", "hoist-lockfile-shared": "1.0.1" }) });
+  const packageJson = pkgJson({ [dependent]: "1.0.0", "hoist-lockfile-shared": rootRange });
+  if (rootRange !== "1.0.1") await reinstall(dir, packageJson);
+  expect(await lockedVersions(dir, "hoist-lockfile-shared")).toStrictEqual(["1.0.1"]);
+  return { dir, packageJson, nested: join(dir, "node_modules", dependent, "node_modules", "hoist-lockfile-shared") };
+}
+
+// hoist-lockfile-1's `*` row follows the root's own hoist-lockfile-shared entry instead of forking off to 2.0.2.
+test.concurrent.each([
+  ["bare", []],
+  ["named", ["hoist-lockfile-shared"]],
+])(
+  "a row sharing the root's copy follows the root's range instead of re-resolving on its own (%s)",
+  async (_, args) => {
+    const { dir, nested } = await sharedWithRoot("hoist-lockfile-1", "^1.0.1");
+    const { stdout, stderr, exitCode } = await run(dir, "update", ...args);
+    expectSummary(stdout, movedRow("hoist-lockfile-shared", "1.0.1", "1.0.2", "2.0.2"), "", installed(1));
+    expectCleanStderr(stderr);
+    expect(await packageJsonOf(dir)).toStrictEqual(
+      pkgJson({ "hoist-lockfile-1": "1.0.0", "hoist-lockfile-shared": "^1.0.2" }),
+    );
+    expect(await lockedVersions(dir, "hoist-lockfile-shared")).toStrictEqual(["1.0.2"]);
+    expect(await installedVersion(dir, "hoist-lockfile-shared")).toBe("1.0.2");
+    expect(await exists(nested)).toBeFalse();
+    await frozen(dir);
+    expect(exitCode).toBe(0);
+  },
+);
+
+test.concurrent.each([
+  ["bare", []],
+  ["named", ["hoist-lockfile-shared"]],
+  ["the dependent with --latest", ["hoist-lockfile-1", "--latest"]],
+])("a row sharing the root's exact pin stays on it (%s)", async (_, args) => {
+  const { dir, nested } = await sharedWithRoot("hoist-lockfile-1");
+  await expectNoop(dir, ...args);
+  expect(await lockedVersions(dir, "hoist-lockfile-shared")).toStrictEqual(["1.0.1"]);
+  expect(await exists(nested)).toBeFalse();
+});
+
+// hoist-lockfile-2's `^1.0.1` rejects the 2.0.2 the root's `>=1.0.1` moves to, so that row is planned on its own.
+test.concurrent("a row whose range rejects where the root's copy is going moves within its own range", async () => {
+  const { dir, packageJson } = await sharedWithRoot("hoist-lockfile-2", ">=1.0.1");
+  const { stdout, stderr, exitCode } = await run(dir, "update");
+  expectMoved(stdout, "hoist-lockfile-shared", "1.0.1", "2.0.2");
+  expect(normalize(stdout)).toEndWith(`\n${installed(2)}\n`);
+  expectCleanStderr(stderr);
+  expect(await packageJsonOf(dir)).toStrictEqual(packageJson);
+  expect(await lockedVersions(dir, "hoist-lockfile-shared")).toStrictEqual(["1.0.2", "2.0.2"]);
+  expect(await installedVersion(dir, "hoist-lockfile-shared")).toBe("2.0.2");
+  expect(await installedVersion(dir, "hoist-lockfile-2", "node_modules", "hoist-lockfile-shared")).toBe("1.0.2");
+  await frozen(dir);
+  expect(exitCode).toBe(0);
+});
+
+// The root's entry is edited and `bun update` runs right away, so the update sees the old entry in bun.lock and the new one in package.json.
+test.concurrent(
+  "a row is planned on its own when the root's entry is edited out of its range before the update",
+  async () => {
+    const { dir } = await sharedWithRoot("hoist-lockfile-2");
+    await write(
+      join(dir, "package.json"),
+      stringify(pkgJson({ "hoist-lockfile-2": "1.0.0", "hoist-lockfile-shared": "^2.0.1" })),
+    );
+    const { stdout, stderr, exitCode } = await run(dir, "update");
+    expectMoved(stdout, "hoist-lockfile-shared", "1.0.1", "2.0.2");
+    expect(normalize(stdout)).toEndWith(`\n${installed(2)}\n`);
+    expectCleanStderr(stderr);
+    expect(await packageJsonOf(dir)).toStrictEqual(
+      pkgJson({ "hoist-lockfile-2": "1.0.0", "hoist-lockfile-shared": "^2.0.2" }),
+    );
+    expect(await lockedVersions(dir, "hoist-lockfile-shared")).toStrictEqual(["1.0.2", "2.0.2"]);
+    expect(await installedVersion(dir, "hoist-lockfile-shared")).toBe("2.0.2");
+    expect(await installedVersion(dir, "hoist-lockfile-2", "node_modules", "hoist-lockfile-shared")).toBe("1.0.2");
+    await frozen(dir);
+    expect(exitCode).toBe(0);
+  },
+);
+
+test.concurrent.each([
+  ["bare", []],
+  ["--dry-run", ["--dry-run"]],
+])("a row is planned on its own when the root's entry is removed before the update (%s)", async (_, args) => {
+  const { dir } = await sharedWithRoot("hoist-lockfile-1");
+  const packageJson = pkgJson({ "hoist-lockfile-1": "1.0.0" });
+  await write(join(dir, "package.json"), stringify(packageJson));
+  const { stdout, stderr, exitCode } = await run(dir, "update", ...args);
+  expect(movedRows(stdout)).toStrictEqual([movedRow("hoist-lockfile-shared", "1.0.1", "2.0.2")]);
+  expectCleanStderr(stderr);
+  expect(await packageJsonOf(dir)).toStrictEqual(packageJson);
+  if (args.length) {
+    expect(normalize(stdout)).toEndWith(`\n${wouldUpdate(1)}\n`);
+    expect(await lockedVersions(dir, "hoist-lockfile-shared")).toStrictEqual(["1.0.1"]);
+  } else {
+    expect(normalize(stdout)).toContain(`\n${installed(1)}\n`);
+    expect(await lockedVersions(dir, "hoist-lockfile-shared")).toStrictEqual(["2.0.2"]);
+    expect(await installedVersion(dir, "hoist-lockfile-shared")).toBe("2.0.2");
+    await frozen(dir);
+  }
+  expect(exitCode).toBe(0);
+});
+
+// pkg2's no-deps entry, which one-range-dep's `^1.0.0` row shares, is edited to `^2.0.0` right before the update; pkg2's
+// new package.json is only read while the update resolves, so the row can only be planned once pkg2 has moved.
+test.concurrent(
+  "a row is planned on its own when a member's entry is edited out of its range before the update",
+  async () => {
+    const { dir, pkg1 } = await staleMemberTransitive("~1.0.0");
+    await write(join(dir, "packages/pkg2/package.json"), stringify(member("pkg2", { "no-deps": "^2.0.0" })));
+    const { stdout, stderr, exitCode } = await run(dir, "update");
+    expect(movedRows(stdout)).toStrictEqual([
+      movedRow("no-deps", "1.0.0", "2.0.0"),
+      movedRow("no-deps", "1.0.0", "1.1.0"),
+    ]);
+    expect(stderr).not.toContain("error:");
+    expect(await packageJsonOf(dir, "packages/pkg1")).toStrictEqual(pkg1);
+    expect(await packageJsonOf(dir, "packages/pkg2")).toStrictEqual(member("pkg2", { "no-deps": "^2.0.0" }));
+    expect(await lockedVersions(dir, "no-deps")).toStrictEqual(["1.1.0", "2.0.0"]);
+    expect(await installedVersion(dir, "one-range-dep", "node_modules", "no-deps")).toBe("1.1.0");
+    await frozen(dir);
+    expect(exitCode).toBe(0);
+  },
+);
+
 // peer-deps-fixed@1.0.0 declares peer `no-deps: ^1.0.0`; the root's exact no-deps@1.0.0 is its only provider.
 test.concurrent.each([
   ["bare", []],
@@ -1436,13 +1563,38 @@ test.concurrent(
   },
 );
 
-// The request binds to the root's exact leaf@1.0.0, which stays put; the copy that moves is parent's nested one.
+// parent's `^1.0.0` is satisfied by the root's exact leaf@1.0.0, so it shares that copy and the request has nothing to move.
+test.concurrent("`bun update <name>` keeps a dependent's row on the root's exact pin", async () => {
+  using server = await serveRegistry(TAGGED_FREE);
+  const dir = await installServed(server, "update-named-shared-pin-", pkgJson({ parent: "^1.0.0", leaf: "1.0.0" }));
+  expect(await lockedVersions(dir, "leaf")).toStrictEqual(["1.0.0"]);
+  const before = await withLeafScanner(server, dir);
+  const { stdout, stderr, exitCode } = await run(dir, "update", "leaf");
+  expectNoChangesLine(stdout);
+  expect(stdout).not.toContain("FATAL:");
+  expectCleanStderr(stderr);
+  expect(await lockText(dir)).toBe(before);
+  expect(await lockedVersions(dir, "leaf")).toStrictEqual(["1.0.0"]);
+  expect(await exists(join(dir, "node_modules", "parent", "node_modules", "leaf"))).toBeFalse();
+  expect(exitCode).toBe(0);
+});
+
+// The request binds to the root's exact leaf@1.0.0, which stays put; parent's `^1.0.1` rejects that copy, so its own
+// one (left on 1.0.1 when the root moved from 1.0.1 down to 1.0.0) is the copy that moves.
 test.concurrent(
   "`bun update <name>` also scans the nested copy it re-resolved when the root's own row stays put",
   async () => {
-    using server = await serveRegistry(TAGGED_FREE);
-    const dir = await installServed(server, "update-named-scan-nested-", pkgJson({ parent: "^1.0.0", leaf: "1.0.0" }));
-    expect(await lockedVersions(dir, "leaf")).toStrictEqual(["1.0.0"]);
+    using server = await serveRegistry({
+      parent: { "1.0.0": { dependencies: { leaf: "^1.0.1" } } },
+      leaf: { "1.0.0": {}, "1.0.1": {}, "1.1.0": {} },
+    });
+    const dir = await setupServed(
+      server,
+      "update-named-scan-nested-",
+      pkgJson({ parent: "^1.0.0", leaf: "1.0.1" }),
+      pkgJson({ parent: "^1.0.0", leaf: "1.0.0" }),
+    );
+    expect(await lockedVersions(dir, "leaf")).toStrictEqual(["1.0.0", "1.0.1"]);
     const before = await withLeafScanner(server, dir);
     const { stdout, exitCode } = await run(dir, "update", "leaf");
     const scanned = stdout.match(/^scanned: .*$/m)?.[0] ?? "";
@@ -1450,8 +1602,9 @@ test.concurrent(
     expect(scanned).toContain("leaf@1.1.0");
     expect(stdout).toContain("FATAL: leaf");
     expect(await lockText(dir)).toBe(before);
-    expect(await lockedVersions(dir, "leaf")).toStrictEqual(["1.0.0"]);
+    expect(await lockedVersions(dir, "leaf")).toStrictEqual(["1.0.0", "1.0.1"]);
     expect(await installedVersion(dir, "leaf")).toBe("1.0.0");
+    expect(await installedVersion(dir, "parent", "node_modules", "leaf")).toBe("1.0.1");
     expect(exitCode).toBe(1);
   },
 );
@@ -1875,11 +2028,10 @@ test.concurrent("`bun update <name>` from a member leaves a sibling's own entry
 test.concurrent(
   "`bun update <name>` from a member: a sibling whose range rejects the picked version stays put",
   async () => {
-    const { dir, pkg1 } = await staleMemberTransitive("~1.0.0");
-    const pkg2Text = await packageJsonText(dir, "packages/pkg2");
+    const { dir, pkg2Text } = await staleMembers("^1.0.0", "~1.0.0");
     const { stderr, exitCode } = await runIn(dir, "packages/pkg1", "update", "no-deps");
     expect(stderr).not.toContain("error:");
-    expect(await packageJsonOf(dir, "packages/pkg1")).toStrictEqual(pkg1);
+    expect(await packageJsonOf(dir, "packages/pkg1")).toStrictEqual(member("pkg1", { "no-deps": "^1.1.0" }));
     expect(await packageJsonText(dir, "packages/pkg2")).toBe(pkg2Text);
     expect(await lockedVersions(dir, "no-deps")).toStrictEqual(["1.0.0", "1.1.0"]);
     await frozen(dir);
@@ -1887,6 +2039,35 @@ test.concurrent(
   },
 );
 
+// one-range-dep's `^1.0.0` row shares the no-deps@1.0.0 that pkg2's own `~1.0.0` entry holds; neither request re-resolves pkg2's entry, so the row stays with it rather than forking off to 1.1.0.
+test.concurrent.each([
+  ["bare", []],
+  ["named", ["no-deps"]],
+])("from a member, a row sharing a sibling's copy stays with that copy (%s)", async (_, args) => {
+  const { dir, pkg1 } = await staleMemberTransitive("~1.0.0");
+  const pkg2Text = await packageJsonText(dir, "packages/pkg2");
+  const { stdout, stderr, exitCode } = await runIn(dir, "packages/pkg1", "update", ...args);
+  expectNoMoves(stdout);
+  expect(stderr).not.toContain("error:");
+  expect(await packageJsonOf(dir, "packages/pkg1")).toStrictEqual(pkg1);
+  expect(await packageJsonText(dir, "packages/pkg2")).toBe(pkg2Text);
+  expect(await lockedVersions(dir, "no-deps")).toStrictEqual(["1.0.0"]);
+  await frozen(dir);
+  expect(exitCode).toBe(0);
+});
+
+// With pkg2's entry in the request's scope, it moves within `~1.0.0` and one-range-dep's row follows it.
+test.concurrent("`bun update <name> -r` moves a sibling's entry and the rows sharing its copy follow", async () => {
+  const { dir, pkg1 } = await staleMemberTransitive("~1.0.0");
+  const { stderr, exitCode } = await runIn(dir, "packages/pkg1", "update", "-r", "no-deps");
+  expect(stderr).not.toContain("error:");
+  expect(await packageJsonOf(dir, "packages/pkg1")).toStrictEqual(pkg1);
+  expect(await packageJsonOf(dir, "packages/pkg2")).toStrictEqual(member("pkg2", { "no-deps": "~1.0.1" }));
+  expect(await lockedVersions(dir, "no-deps")).toStrictEqual(["1.0.1"]);
+  await frozen(dir);
+  expect(exitCode).toBe(0);
+});
+
 test.concurrent("`bun update <name>` from the root does not re-resolve a member's own entry", async () => {
   const root = { ...ROOT, dependencies: { "no-deps": "^2.0.0" } };
   const dir = await setup({
@@ -2002,6 +2183,7 @@ test.concurrent.each([
   },
 );
 
+// one-range-dep's `^1.0.0` row shares the copy the aliased entry holds, so it moves with that entry to 1.0.1 rather than to 1.1.0 on its own.
 test.concurrent("several names in one command are matched independently, aliases through their real name", async () => {
   const dir = await setup({
     "package.json": pkgJson({ "a-dep": "1.0.1", aliased: "npm:no-deps@1.0.0", "one-range-dep": "1.0.0" }),
@@ -2011,14 +2193,13 @@ test.concurrent("several names in one command are matched independently, aliases
   expect(await lockedVersions(dir, "no-deps")).toStrictEqual(["1.0.0"]);
 
   const { stdout, stderr, exitCode } = await run(dir, "update", "a-dep", "no-deps");
-  expect(movedRows(stdout)).toContain(A_DEP_ROW);
-  expect(movedRows(stdout)).toContain(NO_DEPS_ROW);
+  expect(movedRows(stdout)).toStrictEqual([A_DEP_ROW, movedRow("aliased", "1.0.0", "1.0.1")]);
   expect(stdout).not.toMatch(/^installed /m);
   expectCleanStderr(stderr);
   expect(await packageJsonOf(dir)).toStrictEqual(
     pkgJson({ "a-dep": "^1.0.10", aliased: "npm:no-deps@~1.0.1", "one-range-dep": "1.0.0" }),
   );
-  expect(await lockedVersions(dir, "no-deps")).toStrictEqual(["1.0.1", "1.1.0"]);
+  expect(await lockedVersions(dir, "no-deps")).toStrictEqual(["1.0.1"]);
   expect(await lockedVersions(dir, "a-dep")).toStrictEqual(["1.0.10"]);
   await frozen(dir);
   expect(exitCode).toBe(0);
diff --git a/test/cli/install/bun-update.test.ts b/test/cli/install/bun-update.test.ts
index e5dc789cc108..b39b59d8c5f4 100644
--- a/test/cli/install/bun-update.test.ts
+++ b/test/cli/install/bun-update.test.ts
@@ -1506,21 +1506,31 @@ it("bun update <name> from the root leaves a member's own entry alone; running i
 it("should update transitive resolutions of a named package", async () => {
   setHandler(
     await perNameRegistry(join(package_dir, ".tarballs"), {
-      shared: { versions: { "1.0.0": {}, "1.1.0": {} }, latest: "1.1.0" },
-      "dep-x": { versions: { "1.0.0": { dependencies: { shared: "^1.0.0" } } }, latest: "1.0.0" },
+      shared: { versions: { "1.0.0": {}, "1.0.1": {}, "1.1.0": {} }, latest: "1.1.0" },
+      "dep-x": { versions: { "1.0.0": { dependencies: { shared: "^1.0.1" } } }, latest: "1.0.0" },
     }),
   );
   await writeTextLockfileBunfig();
-  // dep-x@1.0.0 depends on shared@^1.0.0, which dedupes onto the root's
-  // exact shared@1.0.0 at install time.
+  // dep-x@1.0.0 depends on shared@^1.0.1, which dedupes onto the root's
+  // exact shared@1.0.1 at install time.
+  await writeFile(
+    join(package_dir, "package.json"),
+    JSON.stringify({ name: "root", dependencies: { shared: "1.0.1", "dep-x": "^1.0.0" } }),
+  );
+  await runInPackageDir("install");
+  expect(await lockedSharedResolutions()).toEqual(['"shared@1.0.1"']);
+
+  // Moving the root down to 1.0.0 leaves dep-x's row where it was: a plain
+  // install never re-resolves a row whose dependent did not change.
   await writeFile(
     join(package_dir, "package.json"),
     JSON.stringify({ name: "root", dependencies: { shared: "1.0.0", "dep-x": "^1.0.0" } }),
   );
   await runInPackageDir("install");
-  expect(await lockedSharedResolutions()).toEqual(['"shared@1.0.0"']);
+  expect(await lockedSharedResolutions()).toEqual(['"shared@1.0.0"', '"shared@1.0.1"']);
 
-  // The root's exact `1.0.0` cannot move; dep-x's `^1.0.0` must move to 1.1.0.
+  // The root's exact `1.0.0` cannot move and does not satisfy dep-x's `^1.0.1`,
+  // so dep-x's row must move to 1.1.0 on its own.
   await runInPackageDir("update", "shared");
   expect(await lockedSharedResolutions()).toEqual(['"shared@1.0.0"', '"shared@1.1.0"']);
   expect(
@@ -1528,6 +1538,30 @@ it("should update transitive resolutions of a named package", async () => {
   ).toMatchObject({ version: "1.1.0" });
 });
 
+// The row re-enters the queue here too, but the root's copy still satisfies it, so it
+// lands back on that copy instead of nesting 1.1.0 next to the root's 1.0.0.
+it("bun update <name> keeps a transitive row on the root's entry while its range allows it", async () => {
+  setHandler(
+    await perNameRegistry(join(package_dir, ".tarballs"), {
+      shared: { versions: { "1.0.0": {}, "1.1.0": {} }, latest: "1.1.0" },
+      "dep-x": { versions: { "1.0.0": { dependencies: { shared: "^1.0.0" } } }, latest: "1.0.0" },
+    }),
+  );
+  await writeTextLockfileBunfig();
+  await writeFile(
+    join(package_dir, "package.json"),
+    JSON.stringify({ name: "root", dependencies: { shared: "1.0.0", "dep-x": "^1.0.0" } }),
+  );
+  await runInPackageDir("install");
+  expect(await lockedSharedResolutions()).toEqual(['"shared@1.0.0"']);
+  const before = await file(join(package_dir, "bun.lock")).text();
+
+  await runInPackageDir("update", "shared");
+  expect(await lockedSharedResolutions()).toEqual(['"shared@1.0.0"']);
+  expect(await file(join(package_dir, "bun.lock")).text()).toBe(before);
+  expect(await exists(join(package_dir, "node_modules", "dep-x", "node_modules"))).toBeFalse();
+});
+
 it("bun update <name> --latest holds back only the root's entry; a transitive edge declared as a dist-tag keeps following it", async () => {
   setHandler(
     await perNameRegistry(join(package_dir, ".tarballs"), {

From 51177d0387e27e7cff696ea1439199771e434e95 Mon Sep 17 00:00:00 2001
From: robobun <117481402+robobun@users.noreply.github.com>
Date: Mon, 17 Aug 2026 01:03:53 +0000
Subject: [PATCH 003/258] install: load root and workspace dependencies from
 bun.lock the way package.json parses them (#38869)

---
 src/install/lockfile/bun.lock.rs              | 149 ++++++--
 .../__snapshots__/bun-workspaces.test.ts.snap |  30 +-
 test/cli/install/bun-workspaces.test.ts       | 344 ++++++++++++++++++
 3 files changed, 485 insertions(+), 38 deletions(-)

diff --git a/src/install/lockfile/bun.lock.rs b/src/install/lockfile/bun.lock.rs
index 148c058002c3..602670fc2770 100644
--- a/src/install/lockfile/bun.lock.rs
+++ b/src/install/lockfile/bun.lock.rs
@@ -3051,10 +3051,6 @@ pub(crate) fn parse_into_binary_lockfile(
             .resize(lockfile.buffers.dependencies.len(), invalid_package_id);
         lockfile.buffers.resolutions.fill(invalid_package_id);
 
-        // a package can list the same dependency in each dependnecy group, but only the first
-        // is chosen (dev -> optional -> prod -> peer)
-        let mut seen_deps: bun_collections::StringArrayHashMap<()> = Default::default();
-
         // The two `[0]` writes are done first via
         // sequential `&mut` accessors so the loops can take all column views
         // immutably without overlapping exclusive borrows or `unsafe`.
@@ -3065,6 +3061,7 @@ pub(crate) fn parse_into_binary_lockfile(
         let pkgs = lockfile.packages.slice();
         let pkg_deps = pkgs.items_dependencies();
         let pkg_names = pkgs.items_name();
+        let pkg_name_hashes: &[PackageNameHash] = pkgs.items_name_hash();
         let pkg_resolutions: &[Resolution] = pkgs.items_resolution();
 
         // Populated by `append_package_dedupe` while the packages object was
@@ -3073,6 +3070,10 @@ pub(crate) fn parse_into_binary_lockfile(
         let package_index = &lockfile.package_index;
         let overrides = &lockfile.overrides;
         let catalogs: &CatalogMap = &lockfile.catalogs;
+        let workspace_versions: &VersionHashMap = &lockfile.workspace_versions;
+        let link_workspace_packages = manager
+            .as_deref()
+            .is_none_or(|manager| manager.options.link_workspace_packages);
 
         // Disjoint-field split of `lockfile.buffers` so each loop body can hold
         // `&mut dependencies[i]` and `&mut resolutions[i]` together with a shared
@@ -3082,6 +3083,16 @@ pub(crate) fn parse_into_binary_lockfile(
         let dependencies: &mut [Dependency] = buffers.dependencies.as_mut_slice();
         let resolutions: &mut [PackageID] = buffers.resolutions.as_mut_slice();
 
+        let workspace_links = WorkspaceLinks {
+            pkg_names,
+            pkg_name_hashes,
+            workspace_versions,
+            catalogs,
+            overrides,
+            string_buf,
+            link_workspace_packages,
+        };
+
         {
             // first the root dependencies are resolved
             for _dep_id in pkg_deps[0].begin()..pkg_deps[0].end() {
@@ -3113,22 +3124,14 @@ pub(crate) fn parse_into_binary_lockfile(
                     return Err(ParseError::InvalidPackageInfo);
                 };
 
-                if !dep.behavior.is_workspace()
-                    && seen_deps
-                        .get_or_put(dep.name.slice(string_buf))?
-                        .found_existing
-                {
-                    resolutions[dep_id as usize] = res_id;
-                    continue;
-                }
-
-                map_dep_to_pkg(
+                map_manifest_dep_to_pkg(
                     dep,
                     dep_id,
                     res_id,
                     resolutions,
                     lockfile_version,
                     pkg_resolutions,
+                    &workspace_links,
                 );
             }
         }
@@ -3141,8 +3144,6 @@ pub(crate) fn parse_into_binary_lockfile(
                 let pkg_id: PackageID = _pkg_id;
                 let workspace_name = pkg_names[pkg_id as usize].slice(string_buf);
 
-                seen_deps.clear_retaining_capacity();
-
                 let deps = pkg_deps[pkg_id as usize];
                 for _dep_id in deps.begin()..deps.end() {
                     let dep_id: DependencyID = _dep_id;
@@ -3198,18 +3199,14 @@ pub(crate) fn parse_into_binary_lockfile(
                         return Err(ParseError::InvalidPackageInfo);
                     };
 
-                    if seen_deps.get_or_put(dep_name)?.found_existing {
-                        resolutions[dep_id as usize] = res_id;
-                        continue;
-                    }
-
-                    map_dep_to_pkg(
+                    map_manifest_dep_to_pkg(
                         dep,
                         dep_id,
                         res_id,
                         resolutions,
                         lockfile_version,
                         pkg_resolutions,
+                        &workspace_links,
                     );
                 }
             }
@@ -3453,16 +3450,7 @@ fn map_dep_to_pkg(
     if text_lockfile_version != Version::V0 {
         let res = &pkg_resolutions[pkg_id as usize];
         if res.tag == ResolutionTag::Workspace {
-            // Whole-struct assign so `DependencyVersion::Drop` frees any prior
-            // npm chain. SAFETY: `res.tag == Workspace` checked above.
-            let literal = dep.version.literal;
-            dep.version = DependencyVersion {
-                tag: DependencyVersionTag::Workspace,
-                literal,
-                value: DependencyVersionValue {
-                    workspace: *res.workspace(),
-                },
-            };
+            link_dep_to_workspace(dep, res);
         }
     }
 }
@@ -3472,6 +3460,103 @@ fn may_stay_unresolved(dep: &Dependency) -> bool {
     dep.behavior.intersects(Behavior::OPTIONAL | Behavior::PEER)
 }
 
+fn map_manifest_dep_to_pkg(
+    dep: &mut Dependency,
+    dep_id: DependencyID,
+    pkg_id: PackageID,
+    resolutions: &mut [PackageID],
+    text_lockfile_version: Version,
+    pkg_resolutions: &[Resolution],
+    workspace_links: &WorkspaceLinks<'_>,
+) {
+    resolutions[dep_id as usize] = pkg_id;
+
+    if text_lockfile_version == Version::V0 {
+        return;
+    }
+
+    let res = &pkg_resolutions[pkg_id as usize];
+    if res.tag == ResolutionTag::Workspace && workspace_links.links(dep, pkg_id) {
+        link_dep_to_workspace(dep, res);
+    }
+}
+
+struct WorkspaceLinks<'a> {
+    pkg_names: &'a [String],
+    pkg_name_hashes: &'a [PackageNameHash],
+    workspace_versions: &'a VersionHashMap,
+    catalogs: &'a CatalogMap,
+    overrides: &'a OverrideMap,
+    string_buf: &'a [u8],
+    link_workspace_packages: bool,
+}
+
+impl WorkspaceLinks<'_> {
+    /// Whether `Package::parse_dependency` links `dep` to the workspace `bun.lock`
+    /// bound it to, so that `Diff::generate` sees the loaded and the parsed
+    /// dependency as equal. With `linkWorkspacePackages` off it links no range, and
+    /// a range still bound to a workspace is loaded as linked on purpose: the diff
+    /// re-resolves it. Peers, overridden entries and dist-tags bind to a workspace
+    /// either way.
+    fn links(&self, dep: &Dependency, workspace_pkg_id: PackageID) -> bool {
+        if dep.version.tag == DependencyVersionTag::Workspace {
+            return true;
+        }
+
+        let range = if self.link_workspace_packages {
+            &dep.version
+        } else {
+            if dep.behavior.is_peer() || self.overridden(dep) {
+                return false;
+            }
+            self.catalogs.resolve_range(self.string_buf, dep)
+        };
+        if range.tag != DependencyVersionTag::Npm {
+            return false;
+        }
+
+        let npm = range.npm();
+        let workspace_pkg = workspace_pkg_id as usize;
+        // `workspace_versions` and a peer's binding are keyed by name hash; the
+        // names themselves have to match as well.
+        if !npm.name.eql(
+            self.pkg_names[workspace_pkg],
+            self.string_buf,
+            self.string_buf,
+        ) {
+            return false;
+        }
+
+        !self.link_workspace_packages
+            || self
+                .workspace_versions
+                .get(&self.pkg_name_hashes[workspace_pkg])
+                .is_some_and(|workspace_version| {
+                    npm.version
+                        .satisfies(*workspace_version, self.string_buf, self.string_buf)
+                })
+    }
+
+    /// Same exemption as `enqueue_dependency_with_main_and_success_fn`: an `npm:`
+    /// alias is never overridden.
+    fn overridden(&self, dep: &Dependency) -> bool {
+        let is_alias = dep.version.tag == DependencyVersionTag::Npm && dep.version.npm().is_alias;
+        !is_alias && self.overrides.has_rule_for_name(dep.name_hash)
+    }
+}
+
+fn link_dep_to_workspace(dep: &mut Dependency, res: &Resolution) {
+    // Whole-struct assign so `DependencyVersion::Drop` frees any prior npm chain.
+    let literal = dep.version.literal;
+    dep.version = DependencyVersion {
+        tag: DependencyVersionTag::Workspace,
+        literal,
+        value: DependencyVersionValue {
+            workspace: *res.workspace(),
+        },
+    };
+}
+
 fn dependency_resolution_failure(
     dep: &Dependency,
     pkg_path: Option<&[u8]>,
diff --git a/test/cli/install/__snapshots__/bun-workspaces.test.ts.snap b/test/cli/install/__snapshots__/bun-workspaces.test.ts.snap
index ac3d396feaab..1122399f42be 100644
--- a/test/cli/install/__snapshots__/bun-workspaces.test.ts.snap
+++ b/test/cli/install/__snapshots__/bun-workspaces.test.ts.snap
@@ -50,7 +50,10 @@ exports[`dependency on workspace without version in package.json: version: * 1`]
     {
       "name": "no-deps",
       "literal": "*",
-      "workspace": "packages/mono",
+      "npm": {
+        "name": "no-deps",
+        "version": ">=0.0.0"
+      },
       "package_id": 2,
       "behavior": {
         "prod": true
@@ -173,7 +176,10 @@ exports[`dependency on workspace without version in package.json: version: *.*.*
     {
       "name": "no-deps",
       "literal": "*.*.*",
-      "workspace": "packages/mono",
+      "npm": {
+        "name": "no-deps",
+        "version": ">=0.0.0"
+      },
       "package_id": 2,
       "behavior": {
         "prod": true
@@ -296,7 +302,10 @@ exports[`dependency on workspace without version in package.json: version: =* 1`
     {
       "name": "no-deps",
       "literal": "=*",
-      "workspace": "packages/mono",
+      "npm": {
+        "name": "no-deps",
+        "version": ">=0.0.0"
+      },
       "package_id": 2,
       "behavior": {
         "prod": true
@@ -419,7 +428,10 @@ exports[`dependency on workspace without version in package.json: version: kjwoe
     {
       "name": "no-deps",
       "literal": "kjwoehcojrgjoj",
-      "workspace": "packages/mono",
+      "dist_tag": {
+        "name": "no-deps",
+        "tag": "no-deps"
+      },
       "package_id": 2,
       "behavior": {
         "prod": true
@@ -542,7 +554,10 @@ exports[`dependency on workspace without version in package.json: version: *.1.*
     {
       "name": "no-deps",
       "literal": "*.1.*",
-      "workspace": "packages/mono",
+      "npm": {
+        "name": "no-deps",
+        "version": ">=0.0.0"
+      },
       "package_id": 2,
       "behavior": {
         "prod": true
@@ -665,7 +680,10 @@ exports[`dependency on workspace without version in package.json: version: *-pre
     {
       "name": "no-deps",
       "literal": "*-pre",
-      "workspace": "packages/mono",
+      "npm": {
+        "name": "no-deps",
+        "version": ">=0.0.0"
+      },
       "package_id": 2,
       "behavior": {
         "prod": true
diff --git a/test/cli/install/bun-workspaces.test.ts b/test/cli/install/bun-workspaces.test.ts
index 48903d67ec9f..562e1ded1f3e 100644
--- a/test/cli/install/bun-workspaces.test.ts
+++ b/test/cli/install/bun-workspaces.test.ts
@@ -2512,6 +2512,350 @@ test("matching workspace devDependency and npm peerDependency", async () => {
   expect(out).toContain("no changes");
 });
 
+// bun.lock stores a workspace's dependencies as the specifiers written in its package.json, so
+// loading it has to rebuild exactly the dependencies parsing that package.json produces: on the
+// next install the two are diffed, and any dependency that differs makes the install report the
+// workspace as updated and re-resolve it, on every install, with nothing changed on disk.
+//
+// Parsing makes a dependency a workspace dependency (version = the workspace's path) only when its
+// specifier links the workspace: `workspace:` or an npm range the workspace's version satisfies.
+// Anything else that ends up resolved to the workspace keeps its parsed version. Every entry is
+// classified on its own, including a name listed in more than one dependency group.
+//
+// With linkWorkspacePackages off, parsing links no range, so a range (written out or through a
+// catalog) that bun.lock still binds to a workspace was linked while the setting was on: it keeps
+// loading as linked and the difference gets it re-resolved. Peers, overridden entries, catalog
+// entries holding `workspace:` and dist-tags the registry does not have are bound to the workspace
+// either way and load as parsed.
+describe("dependencies on a workspace load from bun.lock the way package.json parses them", () => {
+  const linked = "workspace packages/pkg2";
+
+  // setupTest's bunfig.toml, plus linkWorkspacePackages = false
+  async function disableLinking(packageDir: string) {
+    await write(
+      join(packageDir, "bunfig.toml"),
+      Bun.TOML.stringify({
+        install: {
+          cache: join(packageDir, ".bun-cache"),
+          registry: verdaccio.registryUrl(),
+          linker: "hoisted",
+          linkWorkspacePackages: false,
+        },
+      }),
+    );
+  }
+
+  // One line per dependency on `depName` declared by `pkgName`, in lockfile order (dev, optional,
+  // prod, peer): the groups it is declared in, the specifier, and what it was loaded as. Every one
+  // of them must also resolve to the workspace package.
+  function loadedDependencies(packageDir: string, pkgName: string, depName: string): string[] {
+    const lockfile = parseLockfile(packageDir);
+    const pkg = lockfile.packages.find((p: any) => p.name === pkgName);
+    const workspacePkg = lockfile.packages.find((p: any) => p.resolution.value === "workspace:packages/pkg2");
+    return pkg.dependencies
+      .map((id: number) => lockfile.dependencies[id])
+      .filter((dep: any) => dep.name === depName)
+      .map((dep: any) => {
+        expect(dep.package_id).toBe(workspacePkg.id);
+        const loadedAs =
+          "workspace" in dep
+            ? `workspace ${dep.workspace}`
+            : "npm" in dep
+              ? "npm"
+              : "catalog" in dep
+                ? "catalog"
+                : "dist_tag" in dep
+                  ? "dist-tag"
+                  : JSON.stringify(dep);
+        return `${Object.keys(dep.behavior).join("+")} ${JSON.stringify(dep.literal)} -> ${loadedAs}`;
+      });
+  }
+
+  const cases: {
+    label: string;
+    /** dependency groups of packages/pkg1 */
+    pkg1: Record<string, Record<string, string>>;
+    /** packages/pkg2 is `no-deps@1.0.0` unless given */
+    pkg2?: Record<string, string>;
+    /** root `workspaces.catalog` */
+    catalog?: Record<string, string>;
+    /** root `overrides` */
+    overrides?: Record<string, string>;
+    linkWorkspacePackages?: false;
+    /** the name pkg1 declares the dependency under, when not `no-deps` itself */
+    declaredAs?: string;
+    loaded: string[];
+  }[] = [
+    {
+      label: "workspace:* in dependencies and devDependencies",
+      pkg1: { dependencies: { "no-deps": "workspace:*" }, devDependencies: { "no-deps": "workspace:*" } },
+      loaded: [`dev "workspace:*" -> ${linked}`, `prod "workspace:*" -> ${linked}`],
+    },
+    {
+      label: "workspace:* in dependencies and peerDependencies",
+      pkg1: { dependencies: { "no-deps": "workspace:*" }, peerDependencies: { "no-deps": "workspace:*" } },
+      loaded: [`prod "workspace:*" -> ${linked}`, `peer "workspace:*" -> ${linked}`],
+    },
+    {
+      label: "workspace:* in dependencies and optionalDependencies",
+      pkg1: { dependencies: { "no-deps": "workspace:*" }, optionalDependencies: { "no-deps": "workspace:*" } },
+      loaded: [`optional "workspace:*" -> ${linked}`, `prod "workspace:*" -> ${linked}`],
+    },
+    {
+      label: "workspace:* in dependencies, devDependencies and peerDependencies",
+      pkg1: {
+        dependencies: { "no-deps": "workspace:*" },
+        devDependencies: { "no-deps": "workspace:*" },
+        peerDependencies: { "no-deps": "workspace:*" },
+      },
+      loaded: [`dev "workspace:*" -> ${linked}`, `prod "workspace:*" -> ${linked}`, `peer "workspace:*" -> ${linked}`],
+    },
+    {
+      label: "a satisfied range in dependencies and devDependencies",
+      pkg1: { dependencies: { "no-deps": "^1.0.0" }, devDependencies: { "no-deps": "^1.0.0" } },
+      loaded: [`dev "^1.0.0" -> ${linked}`, `prod "^1.0.0" -> ${linked}`],
+    },
+    {
+      // the range names the workspace, the entry does not
+      label: "a satisfied range aliased in dependencies and devDependencies",
+      pkg1: {
+        dependencies: { "deps-alias": "npm:no-deps@^1.0.0" },
+        devDependencies: { "deps-alias": "npm:no-deps@^1.0.0" },
+      },
+      declaredAs: "deps-alias",
+      loaded: [`dev "npm:no-deps@^1.0.0" -> ${linked}`, `prod "npm:no-deps@^1.0.0" -> ${linked}`],
+    },
+    {
+      label: "workspace:* in devDependencies and a satisfied range in peerDependencies",
+      pkg1: { devDependencies: { "no-deps": "workspace:*" }, peerDependencies: { "no-deps": "^1.0.0" } },
+      loaded: [`dev "workspace:*" -> ${linked}`, `peer "^1.0.0" -> ${linked}`],
+    },
+    {
+      label: "workspace:* in devDependencies and an unsatisfied range in peerDependencies",
+      pkg1: { devDependencies: { "no-deps": "workspace:*" }, peerDependencies: { "no-deps": "2.0.0" } },
+      loaded: [`dev "workspace:*" -> ${linked}`, `peer "2.0.0" -> npm`],
+    },
+    {
+      label: "an unsatisfied range in peerDependencies",
+      pkg1: { peerDependencies: { "no-deps": "2.0.0" } },
+      loaded: [`peer "2.0.0" -> npm`],
+    },
+    {
+      label: "a range on a workspace without a version",
+      pkg1: { dependencies: { "no-deps": "*" } },
+      pkg2: { name: "no-deps" },
+      loaded: [`prod "*" -> npm`],
+    },
+    {
+      label: "a catalog entry pointing at the workspace",
+      pkg1: { dependencies: { "no-deps": "catalog:" } },
+      catalog: { "no-deps": "workspace:*" },
+      loaded: [`prod "catalog:" -> catalog`],
+    },
+    {
+      // the registry has no such tag, so the resolver links the workspace
+      label: "a dist-tag the registry does not have",
+      pkg1: { dependencies: { "no-deps": "no-such-tag" } },
+      loaded: [`prod "no-such-tag" -> dist-tag`],
+    },
+    {
+      label: "an override sends an unsatisfied range to the workspace",
+      pkg1: { dependencies: { "no-deps": "^5.0.0" } },
+      overrides: { "no-deps": "workspace:*" },
+      loaded: [`prod "^5.0.0" -> npm`],
+    },
+    {
+      label: "linkWorkspacePackages off: workspace:* in dependencies and devDependencies",
+      pkg1: { dependencies: { "no-deps": "workspace:*" }, devDependencies: { "no-deps": "workspace:*" } },
+      linkWorkspacePackages: false,
+      loaded: [`dev "workspace:*" -> ${linked}`, `prod "workspace:*" -> ${linked}`],
+    },
+    {
+      label: "linkWorkspacePackages off: an unsatisfied range in peerDependencies",
+      pkg1: { peerDependencies: { "no-deps": "2.0.0" } },
+      linkWorkspacePackages: false,
+      loaded: [`peer "2.0.0" -> npm`],
+    },
+    {
+      label: "linkWorkspacePackages off: workspace:* in devDependencies and an unsatisfied range in peerDependencies",
+      pkg1: { devDependencies: { "no-deps": "workspace:*" }, peerDependencies: { "no-deps": "2.0.0" } },
+      linkWorkspacePackages: false,
+      loaded: [`dev "workspace:*" -> ${linked}`, `peer "2.0.0" -> npm`],
+    },
+    {
+      label: "linkWorkspacePackages off: a catalog entry pointing at the workspace",
+      pkg1: { dependencies: { "no-deps": "catalog:" } },
+      catalog: { "no-deps": "workspace:*" },
+      linkWorkspacePackages: false,
+      loaded: [`prod "catalog:" -> catalog`],
+    },
+    {
+      label: "linkWorkspacePackages off: a dist-tag the registry does not have",
+      pkg1: { dependencies: { "no-deps": "no-such-tag" } },
+      linkWorkspacePackages: false,
+      loaded: [`prod "no-such-tag" -> dist-tag`],
+    },
+    {
+      label: "linkWorkspacePackages off: an override sends an unsatisfied range to the workspace",
+      pkg1: { dependencies: { "no-deps": "^5.0.0" } },
+      overrides: { "no-deps": "workspace:*" },
+      linkWorkspacePackages: false,
+      loaded: [`prod "^5.0.0" -> npm`],
+    },
+  ];
+
+  for (const {
+    label,
+    pkg1,
+    pkg2 = { name: "no-deps", version: "1.0.0" },
+    catalog,
+    overrides,
+    linkWorkspacePackages,
+    declaredAs = "no-deps",
+    loaded,
+  } of cases) {
+    test.concurrent(label, async () => {
+      using ctx = await setupTest();
+      const { packageDir, packageJson, env } = ctx;
+      if (linkWorkspacePackages === false) await disableLinking(packageDir);
+      await Promise.all([
+        write(
+          packageJson,
+          JSON.stringify({
+            name: "foo",
+            workspaces: catalog ? { packages: ["packages/*"], catalog } : ["packages/*"],
+            overrides,
+          }),
+        ),
+        write(
+          join(packageDir, "packages", "pkg1", "package.json"),
+          JSON.stringify({ name: "pkg1", version: "1.0.0", ...pkg1 }),
+        ),
+        write(join(packageDir, "packages", "pkg2", "package.json"), JSON.stringify(pkg2)),
+      ]);
+
+      await runBunInstall(env, packageDir);
+      // parseLockfile loads with this test process's settings (linking on); for the linking-off rows the
+      // install below, which reads the fixture's bunfig.toml, is what exercises that setting.
+      expect(loadedDependencies(packageDir, "pkg1", declaredAs)).toEqual(loaded);
+
+      // nothing changed, so the second install must not report pkg1 as changed
+      // ("Workspace package "packages/pkg1" has added 0 dependencies, removed 0 dependencies, and updated 1 dependencies")
+      const { err } = await runBunInstall(env, packageDir, { savesLockfile: false, verbose: true });
+      expect(err).not.toContain('Workspace package "packages/pkg1"');
+    });
+  }
+
+  test.concurrent("the root lists a workspace in dependencies and devDependencies", async () => {
+    using ctx = await setupTest();
+    const { packageDir, packageJson, env } = ctx;
+    await Promise.all([
+      write(
+        packageJson,
+        JSON.stringify({
+          name: "foo",
+          workspaces: ["packages/*"],
+          dependencies: { "no-deps": "workspace:*" },
+          devDependencies: { "no-deps": "workspace:*" },
+        }),
+      ),
+      write(
+        join(packageDir, "packages", "pkg2", "package.json"),
+        JSON.stringify({ name: "no-deps", version: "1.0.0" }),
+      ),
+    ]);
+
+    // the root warns "Duplicate dependency" and keeps both entries, next to the entry every
+    // workspace gets
+    const { err } = await runBunInstall(env, packageDir, { allowWarnings: true });
+    expect(err).toContain('Duplicate dependency: "no-deps"');
+    expect(loadedDependencies(packageDir, "foo", "no-deps")).toEqual([
+      `workspace "" -> ${linked}`,
+      `dev "workspace:*" -> ${linked}`,
+      `prod "workspace:*" -> ${linked}`,
+    ]);
+
+    // (the root has no per-package "has added ..." message; what it loads as, above, is what gets diffed)
+    await runBunInstall(env, packageDir, { allowWarnings: true, savesLockfile: false });
+  });
+
+  // The range is checked against the version bun.lock recorded, so a workspace that moved out of
+  // range is still noticed and the dependency re-resolved.
+  test.concurrent("a workspace bumped out of a range is re-resolved", async () => {
+    using ctx = await setupTest();
+    const { packageDir, packageJson, env } = ctx;
+    const pkg2Json = join(packageDir, "packages", "pkg2", "package.json");
+    await Promise.all([
+      write(packageJson, JSON.stringify({ name: "foo", workspaces: ["packages/*"] })),
+      write(
+        join(packageDir, "packages", "pkg1", "package.json"),
+        JSON.stringify({ name: "pkg1", version: "1.0.0", dependencies: { "no-deps": "^1.0.0" } }),
+      ),
+      write(pkg2Json, JSON.stringify({ name: "no-deps", version: "1.0.0" })),
+    ]);
+
+    await runBunInstall(env, packageDir);
+    expect(loadedDependencies(packageDir, "pkg1", "no-deps")).toEqual([`prod "^1.0.0" -> ${linked}`]);
+
+    await write(pkg2Json, JSON.stringify({ name: "no-deps", version: "3.0.0" }));
+    const { err } = await runBunInstall(env, packageDir, { verbose: true });
+    expect(err).toContain(
+      'Workspace package "packages/pkg1" has added 0 dependencies, removed 0 dependencies, and updated 1 dependencies',
+    );
+
+    // ^1.0.0 now comes from the registry
+    expect(pkg1Resolution(packageDir)).toMatchObject({ tag: "npm", value: "1.1.0" });
+  });
+
+  // A range the lockfile linked keeps loading as linked after linkWorkspacePackages is turned off;
+  // package.json no longer parses it as linked, and that difference is what gets it re-resolved
+  // against the registry.
+  for (const [spec, root, loadedWhileLinking] of [
+    ["^1.0.0", {}, `prod "^1.0.0" -> ${linked}`],
+    // a catalog entry stays a catalog entry while linking; the range behind it is what is stale
+    ["catalog:", { catalog: { "no-deps": "^1.0.0" } }, `prod "catalog:" -> catalog`],
+  ] as const) {
+    test.concurrent(`a linked range (${spec}) is re-resolved after linkWorkspacePackages is turned off`, async () => {
+      using ctx = await setupTest();
+      const { packageDir, packageJson, env } = ctx;
+      await Promise.all([
+        write(packageJson, JSON.stringify({ name: "foo", workspaces: { packages: ["packages/*"], ...root } })),
+        write(
+          join(packageDir, "packages", "pkg1", "package.json"),
+          JSON.stringify({ name: "pkg1", version: "1.0.0", dependencies: { "no-deps": spec } }),
+        ),
+        write(
+          join(packageDir, "packages", "pkg2", "package.json"),
+          JSON.stringify({ name: "no-deps", version: "1.0.0" }),
+        ),
+      ]);
+
+      await runBunInstall(env, packageDir);
+      expect(loadedDependencies(packageDir, "pkg1", "no-deps")).toEqual([loadedWhileLinking]);
+
+      await disableLinking(packageDir);
+      const { err } = await runBunInstall(env, packageDir, { verbose: true });
+      expect(err).toContain(
+        'Workspace package "packages/pkg1" has added 0 dependencies, removed 0 dependencies, and updated 1 dependencies',
+      );
+      expect(pkg1Resolution(packageDir)).toMatchObject({ tag: "npm", value: "1.1.0" });
+
+      // and only once
+      const again = await runBunInstall(env, packageDir, { savesLockfile: false, verbose: true });
+      expect(again.err).not.toContain('Workspace package "packages/pkg1"');
+    });
+  }
+
+  /** what pkg1's only dependency resolves to */
+  function pkg1Resolution(packageDir: string) {
+    const lockfile = parseLockfile(packageDir);
+    const pkg1 = lockfile.packages.find((p: any) => p.name === "pkg1");
+    expect(pkg1.dependencies).toHaveLength(1);
+    const dep = lockfile.dependencies[pkg1.dependencies[0]];
+    return lockfile.packages.find((p: any) => p.id === dep.package_id).resolution;
+  }
+});
+
 // While linking, the hoisted installer formats each package's version label (its
 // version, or for tarball/folder/git packages the spec it was resolved from) into a
 // 512 byte stack buffer. Labels longer than that used to abort the whole install.

From 1bd4db67a4bdaf0019f65c669a8b888f81352bbb Mon Sep 17 00:00:00 2001
From: robobun <117481402+robobun@users.noreply.github.com>
Date: Mon, 17 Aug 2026 01:03:57 +0000
Subject: [PATCH 004/258] install: keep a peer nothing in bun.lock satisfies
 where the file records it (#38892)

---
 src/install/lockfile/bun.lock.rs              |  37 +--
 test/cli/install/bun-lock.test.ts             | 238 ++++++++++++++++++
 .../install/migration/pnpm-lock-v9.test.ts    | 185 ++++++++++++++
 3 files changed, 431 insertions(+), 29 deletions(-)

diff --git a/src/install/lockfile/bun.lock.rs b/src/install/lockfile/bun.lock.rs
index 602670fc2770..086bf9b53d2f 100644
--- a/src/install/lockfile/bun.lock.rs
+++ b/src/install/lockfile/bun.lock.rs
@@ -3333,13 +3333,9 @@ fn deferred_peer_range<'a>(
 /// `install_peer`): scan the package ids recorded for the dependency's
 /// name — `package_index` lists are kept ordered by descending
 /// `Resolution::order` — and take the first whose resolution satisfies
-/// the range. When nothing satisfies, fall back to the highest-ordered
-/// candidate, and only when it is the same kind as the dependency (the
-/// "incorrect peer dependency" case; the fresh resolver inspects only
-/// `list[0]` there, and reproducing its choice exactly is the point of
-/// this helper). Returns `None` when no package with the name exists
-/// or the fallback is a different kind; the caller then falls back to
-/// the path walk. Edges `deferred_peer_range` rejects also return `None`.
+/// the range. Returns `None` when no candidate satisfies it (the tree the
+/// caller falls back to is the only record of the resolver's "incorrect
+/// peer dependency" pick) and for the edges `deferred_peer_range` rejects.
 ///
 /// Peer edges cannot be resolved from the printed tree the way regular
 /// edges are: a peer never materializes its own `node_modules` path when
@@ -3408,28 +3404,11 @@ pub(crate) fn resolve_peer_dep_version_based(
     }
 
     let candidates = package_index.get(&name_hash)?.as_slice();
-    for &id in candidates {
-        if (id as usize) < pkg_resolutions.len()
-            && pkg_resolutions[id as usize]
-                .satisfies_dependency_version(range, string_buf, string_buf)
-        {
-            return Some(id);
-        }
-    }
-
-    let &first = candidates.first()?;
-    if (first as usize) < pkg_resolutions.len() {
-        let res_tag = pkg_resolutions[first as usize].tag;
-        let ver_tag = range.tag;
-        if (res_tag == ResolutionTag::Npm && ver_tag == DependencyVersionTag::Npm)
-            || (res_tag == ResolutionTag::Git && ver_tag == DependencyVersionTag::Git)
-            || (res_tag == ResolutionTag::Github && ver_tag == DependencyVersionTag::Github)
-        {
-            return Some(first);
-        }
-    }
-
-    None
+    candidates.iter().copied().find(|&id| {
+        pkg_resolutions
+            .get(id as usize)
+            .is_some_and(|res| res.satisfies_dependency_version(range, string_buf, string_buf))
+    })
 }
 
 // Taking `&mut BinaryLockfile` plus a `&mut Dependency` that
diff --git a/test/cli/install/bun-lock.test.ts b/test/cli/install/bun-lock.test.ts
index c8ba27d17e5f..f675ac2c5710 100644
--- a/test/cli/install/bun-lock.test.ts
+++ b/test/cli/install/bun-lock.test.ts
@@ -1573,6 +1573,244 @@ it.each([
   await run(["install", "--frozen-lockfile"]);
 });
 
+// When no version in the lockfile satisfies a required peer's range, the resolver binds the
+// edge to whichever version it saw first and later installs keep that binding, so the only
+// record of it is the tree: the version is printed next to the dependent when it conflicts
+// with the version hoisted above, and otherwise the edge was deduped onto the hoisted one.
+// Loading has to read that record. Picking the highest version in the file instead moved
+// the edge whenever the file held another out-of-range version, and the re-save then
+// printed a different tree: the recorded copy dropped, or a new nested copy added. These
+// shapes are what a lockfile looks like once the package that provided the version the
+// peer was first bound to has left the project. The record only holds while nothing in the
+// file satisfies the range: once a satisfying version enters the file, loading binds the peer
+// to it by version (as a fresh install would) and the next save drops the recorded copy.
+describe("loading bun.lock keeps a peer nothing in the file satisfies where the file records it", () => {
+  const pkg = (nameAndVersion: string, info: object = {}) => [nameAndVersion, "", info, ""];
+  const oneDep = pkg("one-dep@1.0.0", { dependencies: { "no-deps": "1.0.1" } });
+  const strictPeerDep = pkg("strict-peer-dep@1.0.0", { peerDependencies: { "no-deps": "^2.0.0" } });
+
+  type Shape = {
+    root: Record<string, unknown>;
+    workspaces?: Record<string, Record<string, unknown>>;
+    packages: Record<string, unknown[]>;
+    saved: string[];
+    absent?: string[];
+    /** Set when the shape names packages the test registry does not have, so only `--lockfile-only` can run. */
+    unpublished?: true;
+  };
+
+  const shapes: [string, Shape][] = [
+    [
+      "a package's peer on the copy printed next to it",
+      {
+        root: { dependencies: { "one-dep": "1.0.0", "strict-peer-dep": "1.0.0" } },
+        packages: {
+          "no-deps": pkg("no-deps@1.0.1"),
+          "one-dep": oneDep,
+          "strict-peer-dep": strictPeerDep,
+          "strict-peer-dep/no-deps": pkg("no-deps@1.0.0"),
+        },
+        saved: ['"no-deps": ["no-deps@1.0.1"', '"strict-peer-dep/no-deps": ["no-deps@1.0.0"'],
+      },
+    ],
+    [
+      "a package's peer on the copy hoisted above it",
+      {
+        // one-dep is a devDependency so that its no-deps@1.0.1 is hoisted first and holds the
+        // root slot; the higher 1.1.0 is nested, and the peer was deduped onto the root copy.
+        root: {
+          devDependencies: { "one-dep": "1.0.0" },
+          dependencies: { "normal-dep-and-dev-dep": "1.0.1", "strict-peer-dep": "1.0.0" },
+        },
+        packages: {
+          "no-deps": pkg("no-deps@1.0.1"),
+          "normal-dep-and-dev-dep": pkg("normal-dep-and-dev-dep@1.0.1", { dependencies: { "no-deps": "1.1.0" } }),
+          "normal-dep-and-dev-dep/no-deps": pkg("no-deps@1.1.0"),
+          "one-dep": oneDep,
+          "strict-peer-dep": strictPeerDep,
+        },
+        saved: ['"no-deps": ["no-deps@1.0.1"', '"normal-dep-and-dev-dep/no-deps": ["no-deps@1.1.0"'],
+        absent: ['"strict-peer-dep/no-deps"'],
+      },
+    ],
+    [
+      "a workspace's peer on the copy printed next to it",
+      {
+        // workspace `a` is hoisted before `w`, so its no-deps holds the root slot
+        root: { workspaces: ["packages/*"] },
+        workspaces: {
+          "packages/a": { name: "a", version: "1.0.0", dependencies: { "no-deps": "1.0.1" } },
+          "packages/w": { name: "w", version: "1.0.0", peerDependencies: { "no-deps": "^2.0.0" } },
+        },
+        packages: {
+          "a": ["a@workspace:packages/a"],
+          "w": ["w@workspace:packages/w"],
+          "no-deps": pkg("no-deps@1.0.1"),
+          "w/no-deps": pkg("no-deps@1.0.0"),
+        },
+        saved: ['"no-deps": ["no-deps@1.0.1"', '"w/no-deps": ["no-deps@1.0.0"'],
+      },
+    ],
+    [
+      "the root's own peer on the copy at the root",
+      {
+        root: { dependencies: { "one-dep": "1.0.0" }, peerDependencies: { "no-deps": "^2.0.0" } },
+        packages: {
+          "no-deps": pkg("no-deps@1.0.0"),
+          "one-dep": oneDep,
+          "one-dep/no-deps": pkg("no-deps@1.0.1"),
+        },
+        saved: ['"no-deps": ["no-deps@1.0.0"', '"one-dep/no-deps": ["no-deps@1.0.1"'],
+      },
+    ],
+    [
+      "a package printed at two paths on the copy printed next to its last path",
+      {
+        // dup@1.0.0 is printed under both parents because the root holds dup@2.0.0. Its peer's
+        // copy is printed under z-parent/dup only: under a-parent/dup it was deduped onto the
+        // root's own no-deps, which root dependencies do regardless of range. The loader binds
+        // the package's edges once per printed path and the last path wins, so the record is
+        // read back here because z-parent sorts after a-parent; were the parents named the
+        // other way round, the root's copy would win and the next save would rewrite the entry to it.
+        root: {
+          dependencies: { "a-parent": "1.0.0", "dup": "2.0.0", "no-deps": "1.0.1", "z-parent": "1.0.0" },
+        },
+        packages: {
+          "a-parent": pkg("a-parent@1.0.0", { dependencies: { dup: "1.0.0" } }),
+          "dup": pkg("dup@2.0.0"),
+          "no-deps": pkg("no-deps@1.0.1"),
+          "z-parent": pkg("z-parent@1.0.0", { dependencies: { "dup": "1.0.0", "no-deps": "1.1.0" } }),
+          "a-parent/dup": pkg("dup@1.0.0", { peerDependencies: { "no-deps": "^2.0.0" } }),
+          "z-parent/dup": pkg("dup@1.0.0", { peerDependencies: { "no-deps": "^2.0.0" } }),
+          "z-parent/no-deps": pkg("no-deps@1.1.0"),
+          "z-parent/dup/no-deps": pkg("no-deps@1.0.0"),
+        },
+        saved: ['"z-parent/dup/no-deps": ["no-deps@1.0.0"'],
+        absent: ['"a-parent/dup/no-deps"'],
+        unpublished: true,
+      },
+    ],
+  ];
+
+  async function writeProject(packageDir: string, shape: Pick<Shape, "root" | "workspaces" | "packages">) {
+    await write(join(packageDir, "package.json"), JSON.stringify({ name: "foo", ...shape.root }));
+    for (const [path, manifest] of Object.entries(shape.workspaces ?? {})) {
+      await write(join(packageDir, path, "package.json"), JSON.stringify(manifest));
+    }
+    await write(
+      join(packageDir, "bun.lock"),
+      JSON.stringify({
+        lockfileVersion: 1,
+        configVersion: 0,
+        workspaces: { "": { name: "foo", ...shape.root, workspaces: undefined }, ...shape.workspaces },
+        packages: shape.packages,
+      }),
+    );
+  }
+
+  // Re-saves the shape once, checks the entries it must and must not print, and checks that
+  // the result is a fixed point: a further re-save leaves it alone and a frozen install accepts it.
+  async function resave(shape: Shape) {
+    const { packageDir } = await registry.createTestDir({ bunfigOpts: { saveTextLockfile: true } });
+    const run = makeInstallRunner(packageDir);
+    await writeProject(packageDir, shape);
+
+    await run(["install", "--lockfile-only"]);
+    const saved = await file(join(packageDir, "bun.lock")).text();
+    for (const entry of shape.saved) {
+      expect(saved).toContain(entry);
+    }
+    for (const entry of shape.absent ?? []) {
+      expect(saved).not.toContain(entry);
+    }
+
+    await run(["install", "--lockfile-only"]);
+    if (!shape.unpublished) await run(["install", "--frozen-lockfile"]);
+    expect(await file(join(packageDir, "bun.lock")).text()).toBe(saved);
+  }
+
+  it.each(shapes)("re-saving keeps %s", (_, shape) => resave(shape));
+
+  const [, nestedCopy] = shapes[0];
+
+  it("re-saving rebinds the peer once a version satisfying its range enters the file", () =>
+    resave({
+      // The first shape after `bun add one-fixed-dep@2.0.0` brought in no-deps@2.0.0: the
+      // recorded 1.0.0 is no longer the binding, so the re-save replaces it instead of keeping it.
+      root: { dependencies: { ...(nestedCopy.root.dependencies as object), "one-fixed-dep": "2.0.0" } },
+      packages: {
+        ...nestedCopy.packages,
+        "one-fixed-dep": pkg("one-fixed-dep@2.0.0", { dependencies: { "no-deps": "2.0.0" } }),
+        "one-fixed-dep/no-deps": pkg("no-deps@2.0.0"),
+      },
+      saved: [
+        '"no-deps": ["no-deps@1.0.1"',
+        '"one-fixed-dep/no-deps": ["no-deps@2.0.0"',
+        '"strict-peer-dep/no-deps": ["no-deps@2.0.0"',
+      ],
+      absent: ["no-deps@1.0.0"],
+    }));
+
+  it("a package's peer on the root's own out-of-range copy binds to it, not to the higher version nested elsewhere", async () => {
+    // Nothing is printed for this edge: either binding dedupes onto the root's copy when the
+    // tree is built, so the file is the same both ways and both linkers install the root's copy.
+    // The binding itself is what `pm why` reports (and what a tree built without the root's
+    // copy, such as `--production` when it is a devDependency, installs next to the dependent).
+    const { packageDir } = await registry.createTestDir({ bunfigOpts: { saveTextLockfile: true } });
+    await writeProject(packageDir, {
+      root: { dependencies: { "no-deps": "1.0.0", "one-dep": "1.0.0", "strict-peer-dep": "1.0.0" } },
+      packages: {
+        "no-deps": pkg("no-deps@1.0.0"),
+        "one-dep": oneDep,
+        "one-dep/no-deps": pkg("no-deps@1.0.1"),
+        "strict-peer-dep": strictPeerDep,
+      },
+    });
+
+    const { out } = await makeInstallRunner(packageDir)(["pm", "why", "no-deps"]);
+    expect(out).toMatchInlineSnapshot(`
+      "no-deps@1.0.0
+        ├─ foo (requires 1.0.0)
+        └─ peer strict-peer-dep@1.0.0 (requires ^2.0.0)
+           └─ foo (requires 1.0.0)
+
+      no-deps@1.0.1
+        └─ one-dep@1.0.0 (requires 1.0.1)
+           └─ foo (requires 1.0.0)
+
+      "
+    `);
+  });
+
+  it("the hoisted linker installs the recorded copy next to the dependent", async () => {
+    const { packageDir } = await registry.createTestDir({ bunfigOpts: { saveTextLockfile: true, linker: "hoisted" } });
+    const run = makeInstallRunner(packageDir);
+    await writeProject(packageDir, nestedCopy);
+
+    await run(["install", "--frozen-lockfile"]);
+    expect(await file(join(packageDir, "node_modules", "no-deps", "package.json")).json()).toMatchObject({
+      version: "1.0.1",
+    });
+    expect(
+      await file(join(packageDir, "node_modules", "strict-peer-dep", "node_modules", "no-deps", "package.json")).json(),
+    ).toMatchObject({ version: "1.0.0" });
+  });
+
+  it("the isolated linker links the dependent against the recorded copy", async () => {
+    const { packageDir } = await registry.createTestDir({ bunfigOpts: { saveTextLockfile: true, linker: "isolated" } });
+    const run = makeInstallRunner(packageDir);
+    await writeProject(packageDir, nestedCopy);
+
+    await run(["install", "--frozen-lockfile"]);
+    const bunDir = join(packageDir, "node_modules", ".bun");
+    const entries = (await readdirSorted(bunDir)).filter(entry => entry.startsWith("strict-peer-dep@"));
+    expect(entries).toHaveLength(1);
+    expect(await file(join(bunDir, entries[0], "node_modules", "no-deps", "package.json")).json()).toMatchObject({
+      version: "1.0.0",
+    });
+  });
+});
+
 it("adding a dependency keeps an optional peer on the package bun.lock bound it to while that package stays next to it", async () => {
   const { packageDir, packageJson } = await registry.createTestDir({ bunfigOpts: { saveTextLockfile: true } });
   const run = makeInstallRunner(packageDir);
diff --git a/test/cli/install/migration/pnpm-lock-v9.test.ts b/test/cli/install/migration/pnpm-lock-v9.test.ts
index b943197ac326..549ba0890922 100644
--- a/test/cli/install/migration/pnpm-lock-v9.test.ts
+++ b/test/cli/install/migration/pnpm-lock-v9.test.ts
@@ -79,6 +79,12 @@ const PEER_DEPS_TOO_1_0_0_INTEGRITY =
   "sha512-sBx0TKrsB8FkRN2lzkDjMuctPGEKn1TmNUBv3dJOtnZM8nd255o5ZAPRpAI2XFLHZAavBlK/e73cZNwnUxlRog==";
 const ONE_OPTIONAL_PEER_DEP_1_0_2_INTEGRITY =
   "sha512-S25U8/QXGIKfn/AWtsce1aVMnDjDL+ykFtAufpsuKGad32NlsCpi9TDuXvzoTQ+MdaZpGV3c4xghUZUsNeMp4A==";
+const STRICT_PEER_DEP_1_0_0_INTEGRITY =
+  "sha512-bz2RC/Fp4Nvc9aIiHB6Szko9m6sxNy/clIHnTAGeD9VSpQJTvlPAJqJ09lWo7N3q4JNLEqDTf3Mn+zNUsYOKWQ==";
+const NO_DEPS_1_1_0_INTEGRITY =
+  "sha512-ebG2pipYAKINcNI3YxdsiAgFvNGp2gdRwxAKN2LYBm9+YxuH/lHH2sl+GKQTuGiNfCfNZRMHUyyLPEJD6HWm7w==";
+const NORMAL_DEP_AND_DEV_DEP_1_0_1_INTEGRITY =
+  "sha512-MzZS9lLNBdqXf/lI+TKlXGeWrcDkOjzdSPJtvkRUN1FUjXg2DcGVldEqx9D8kNwF87Hxf2cRLvLv4a8GqZ6zPg==";
 const LOCAL_TARBALL_INTEGRITY =
   "sha512-HP/5Rgt3pVFLzjmN9qJJ6vZMgCwoCIl/m2bPndYT283CUqnmFiMx0GeeIJ7SyK6TYoJM78SEvFEOQie++caHqw==";
 
@@ -1471,6 +1477,185 @@ snapshots:
       `);
     });
 
+    test("a peer nothing in the lockfile satisfies keeps the version pnpm resolved it to", async () => {
+      // strict-peer-dep wants no-deps@^2.0.0; pnpm resolved it to 1.0.0 (the snapshot suffix) while
+      // one-dep brings in 1.0.1. Neither satisfies the range, so there is nothing to rebind the
+      // peer by; binding it to the highest version present would drop pnpm's 1.0.0 from the tree.
+      const { packageDir } = await verdaccio.createTestDir({
+        bunfigOpts: { linker: "hoisted" },
+        files: {
+          "package.json": JSON.stringify({
+            name: "unsatisfied-peer",
+            dependencies: { "one-dep": "1.0.0", "strict-peer-dep": "1.0.0" },
+          }),
+          "pnpm-lock.yaml": `lockfileVersion: '9.0'
+
+settings:
+  autoInstallPeers: true
+
+importers:
+
+  .:
+    dependencies:
+      one-dep:
+        specifier: 1.0.0
+        version: 1.0.0
+      strict-peer-dep:
+        specifier: 1.0.0
+        version: 1.0.0(no-deps@1.0.0)
+
+packages:
+
+  no-deps@1.0.0:
+    resolution: {integrity: ${NO_DEPS_1_0_0_INTEGRITY}}
+
+  no-deps@1.0.1:
+    resolution: {integrity: ${NO_DEPS_1_0_1_INTEGRITY}}
+
+  one-dep@1.0.0:
+    resolution: {integrity: ${ONE_DEP_1_0_0_INTEGRITY}}
+
+  strict-peer-dep@1.0.0:
+    resolution: {integrity: ${STRICT_PEER_DEP_1_0_0_INTEGRITY}}
+    peerDependencies:
+      no-deps: ^2.0.0
+
+snapshots:
+
+  no-deps@1.0.0: {}
+
+  no-deps@1.0.1: {}
+
+  one-dep@1.0.0:
+    dependencies:
+      no-deps: 1.0.1
+
+  strict-peer-dep@1.0.0(no-deps@1.0.0):
+    dependencies:
+      no-deps: 1.0.0
+`,
+        },
+      });
+
+      const { stderr, exitCode } = await migrate(packageDir);
+
+      expect(stderr).toContain("migrated lockfile from pnpm-lock.yaml");
+      expect(exitCode).toBe(0);
+
+      const bunLock = await bunLockOf(packageDir);
+      expect(bunLock).toContain(`"no-deps": ["no-deps@1.0.1"`);
+      expect(bunLock).toContain(`"strict-peer-dep/no-deps": ["no-deps@1.0.0"`);
+
+      const install = await run(packageDir, "install", "--frozen-lockfile");
+
+      expect(install.stderr).not.toContain("error:");
+      expect(install.exitCode).toBe(0);
+      expect(nodeModulesPackages(packageDir)).toMatchInlineSnapshot(`
+        "node_modules/no-deps/no-deps@1.0.1
+        node_modules/one-dep/one-dep@1.0.0
+        node_modules/strict-peer-dep/node_modules/no-deps/no-deps@1.0.0
+        node_modules/strict-peer-dep/strict-peer-dep@1.0.0"
+      `);
+    });
+
+    test("a peer nothing in the lockfile satisfies and pnpm left unmet is not given a copy of the highest version", async () => {
+      // pnpm recorded no resolution for strict-peer-dep's no-deps@^2.0.0 (no snapshot suffix),
+      // so in pnpm's layout the package sees whatever no-deps sits at the root: 1.0.1, hoisted
+      // there from one-dep. Binding the peer to the highest version present instead (1.1.0,
+      // nested under normal-dep-and-dev-dep) would add a strict-peer-dep/no-deps copy to the
+      // migrated tree that pnpm's tree does not have. Left unbound, the peer is bound to the
+      // root copy when the migrated bun.lock is loaded, like any other peer the file prints
+      // nothing for.
+      const { packageDir } = await verdaccio.createTestDir({
+        bunfigOpts: { linker: "hoisted" },
+        files: {
+          "package.json": JSON.stringify({
+            name: "unmet-peer",
+            // one-dep is a devDependency so that its no-deps@1.0.1 takes the root slot.
+            dependencies: { "normal-dep-and-dev-dep": "1.0.1", "strict-peer-dep": "1.0.0" },
+            devDependencies: { "one-dep": "1.0.0" },
+          }),
+          "pnpm-lock.yaml": `lockfileVersion: '9.0'
+
+settings:
+  autoInstallPeers: false
+
+importers:
+
+  .:
+    dependencies:
+      normal-dep-and-dev-dep:
+        specifier: 1.0.1
+        version: 1.0.1
+      strict-peer-dep:
+        specifier: 1.0.0
+        version: 1.0.0
+    devDependencies:
+      one-dep:
+        specifier: 1.0.0
+        version: 1.0.0
+
+packages:
+
+  no-deps@1.0.1:
+    resolution: {integrity: ${NO_DEPS_1_0_1_INTEGRITY}}
+
+  no-deps@1.1.0:
+    resolution: {integrity: ${NO_DEPS_1_1_0_INTEGRITY}}
+
+  normal-dep-and-dev-dep@1.0.1:
+    resolution: {integrity: ${NORMAL_DEP_AND_DEV_DEP_1_0_1_INTEGRITY}}
+
+  one-dep@1.0.0:
+    resolution: {integrity: ${ONE_DEP_1_0_0_INTEGRITY}}
+
+  strict-peer-dep@1.0.0:
+    resolution: {integrity: ${STRICT_PEER_DEP_1_0_0_INTEGRITY}}
+    peerDependencies:
+      no-deps: ^2.0.0
+
+snapshots:
+
+  no-deps@1.0.1: {}
+
+  no-deps@1.1.0: {}
+
+  normal-dep-and-dev-dep@1.0.1:
+    dependencies:
+      no-deps: 1.1.0
+
+  one-dep@1.0.0:
+    dependencies:
+      no-deps: 1.0.1
+
+  strict-peer-dep@1.0.0: {}
+`,
+        },
+      });
+
+      const { stderr, exitCode } = await migrate(packageDir);
+
+      expect(stderr).toContain("migrated lockfile from pnpm-lock.yaml");
+      expect(exitCode).toBe(0);
+
+      const bunLock = await bunLockOf(packageDir);
+      expect(bunLock).toContain(`"no-deps": ["no-deps@1.0.1"`);
+      expect(bunLock).toContain(`"normal-dep-and-dev-dep/no-deps": ["no-deps@1.1.0"`);
+      expect(bunLock).not.toContain(`"strict-peer-dep/no-deps"`);
+
+      const install = await run(packageDir, "install", "--frozen-lockfile");
+
+      expect(install.stderr).not.toContain("error:");
+      expect(install.exitCode).toBe(0);
+      expect(nodeModulesPackages(packageDir)).toMatchInlineSnapshot(`
+        "node_modules/no-deps/no-deps@1.0.1
+        node_modules/normal-dep-and-dev-dep/node_modules/no-deps/no-deps@1.1.0
+        node_modules/normal-dep-and-dev-dep/normal-dep-and-dev-dep@1.0.1
+        node_modules/one-dep/one-dep@1.0.0
+        node_modules/strict-peer-dep/strict-peer-dep@1.0.0"
+      `);
+    });
+
     // pnpm11/lockfile/fs convertToLockfileObject: every variant joins packages[removeSuffix(key)]
     const peerVariantPackageJsons = {
       "package.json": JSON.stringify({ name: "v9-peer-variants", workspaces: ["apps/*"] }),

From aecc608bdcf353f9a3053dea3245f19aa402b339 Mon Sep 17 00:00:00 2001
From: robobun <117481402+robobun@users.noreply.github.com>
Date: Mon, 17 Aug 2026 01:04:00 +0000
Subject: [PATCH 005/258] install: re-resolve a peer row instead of binding it
 to a stale bun.lock leftover (#38901)

---
 .../PackageManager/PackageManagerEnqueue.rs   | 238 ++++++++--------
 .../cli/install/bun-update-transitive.test.ts | 264 +++++++++++++++++-
 2 files changed, 389 insertions(+), 113 deletions(-)

diff --git a/src/install/PackageManager/PackageManagerEnqueue.rs b/src/install/PackageManager/PackageManagerEnqueue.rs
index a323dc824b42..f38b7acb3cde 100644
--- a/src/install/PackageManager/PackageManagerEnqueue.rs
+++ b/src/install/PackageManager/PackageManagerEnqueue.rs
@@ -2298,107 +2298,16 @@ fn get_or_put_resolved_package(
     success_fn: SuccessFn,
 ) -> crate::Result<Option<ResolvedPackageResult>> {
     if install_peer && behavior.is_peer() {
-        if let Some(index) = this.lockfile.package_index.get(&name_hash) {
-            let resolutions = this.lockfile.packages.items_resolution();
-            match index {
-                PackageIndexEntry::Id(existing_id) => {
-                    let existing_id = *existing_id;
-                    if (existing_id as usize) < resolutions.len() {
-                        let existing_resolution = resolutions[existing_id as usize];
-                        if resolution_satisfies_dependency(this, &existing_resolution, version) {
-                            success_fn(this, dependency_id, existing_id);
-                            return Ok(Some(ResolvedPackageResult {
-                                // we must fetch it from the packages array again, incase the package array mutates the value in the `successFn`
-                                package: *this.lockfile.packages.get(existing_id as usize),
-                                ..Default::default()
-                            }));
-                        }
-
-                        let res_tag = resolutions[existing_id as usize].tag;
-                        let ver_tag = version.tag;
-                        if (res_tag == ResolutionTag::Npm
-                            && ver_tag == dependency::version::Tag::Npm)
-                            || (res_tag == ResolutionTag::Git
-                                && ver_tag == dependency::version::Tag::Git)
-                            || (res_tag == ResolutionTag::Github
-                                && ver_tag == dependency::version::Tag::Github)
-                        {
-                            let existing_package = this.lockfile.packages.get(existing_id as usize);
-                            this.log_mut().add_warning_fmt(
-                                None,
-                                bun_ast::Loc::EMPTY,
-                                format_args!(
-                                    "incorrect peer dependency \"{}@{}\"",
-                                    existing_package
-                                        .name
-                                        .fmt(this.lockfile.buffers.string_bytes.as_slice()),
-                                    existing_package.resolution.fmt(
-                                        this.lockfile.buffers.string_bytes.as_slice(),
-                                        bun_fmt::PathSep::Auto
-                                    ),
-                                ),
-                            );
-                            success_fn(this, dependency_id, existing_id);
-                            return Ok(Some(ResolvedPackageResult {
-                                // we must fetch it from the packages array again, incase the package array mutates the value in the `successFn`
-                                package: *this.lockfile.packages.get(existing_id as usize),
-                                ..Default::default()
-                            }));
-                        }
-                    }
-                }
-                PackageIndexEntry::Ids(list) => {
-                    for &existing_id in list.iter() {
-                        if (existing_id as usize) < resolutions.len() {
-                            let existing_resolution = resolutions[existing_id as usize];
-                            if resolution_satisfies_dependency(this, &existing_resolution, version)
-                            {
-                                success_fn(this, dependency_id, existing_id);
-                                return Ok(Some(ResolvedPackageResult {
-                                    package: *this.lockfile.packages.get(existing_id as usize),
-                                    ..Default::default()
-                                }));
-                            }
-                        }
-                    }
-
-                    if (list[0] as usize) < resolutions.len() {
-                        let res_tag = resolutions[list[0] as usize].tag;
-                        let ver_tag = version.tag;
-                        if (res_tag == ResolutionTag::Npm
-                            && ver_tag == dependency::version::Tag::Npm)
-                            || (res_tag == ResolutionTag::Git
-                                && ver_tag == dependency::version::Tag::Git)
-                            || (res_tag == ResolutionTag::Github
-                                && ver_tag == dependency::version::Tag::Github)
-                        {
-                            let existing_package_id = list[0];
-                            let existing_package =
-                                this.lockfile.packages.get(existing_package_id as usize);
-                            this.log_mut().add_warning_fmt(
-                                None,
-                                bun_ast::Loc::EMPTY,
-                                format_args!(
-                                    "incorrect peer dependency \"{}@{}\"",
-                                    existing_package
-                                        .name
-                                        .fmt(this.lockfile.buffers.string_bytes.as_slice()),
-                                    existing_package.resolution.fmt(
-                                        this.lockfile.buffers.string_bytes.as_slice(),
-                                        bun_fmt::PathSep::Auto
-                                    ),
-                                ),
-                            );
-                            success_fn(this, dependency_id, list[0]);
-                            return Ok(Some(ResolvedPackageResult {
-                                // we must fetch it from the packages array again, incase the package array mutates the value in the `successFn`
-                                package: *this.lockfile.packages.get(existing_package_id as usize),
-                                ..Default::default()
-                            }));
-                        }
-                    }
-                }
-            }
+        if let Some((existing_id, satisfied)) =
+            existing_peer_target(this, name_hash, version, dependency_id)
+        {
+            return Ok(Some(bind_existing_peer(
+                this,
+                dependency_id,
+                existing_id,
+                satisfied,
+                success_fn,
+            )));
         }
     }
 
@@ -2565,13 +2474,28 @@ fn get_or_put_resolved_package(
 
                     break 'blk Some(result);
                 }
-                Npm::FindVersionResult::Err(err_type) => match err_type {
-                    Npm::FindVersionError::TooRecent
-                    | Npm::FindVersionError::AllVersionsTooRecent => {
-                        return Err(crate::Error::TooRecentVersion);
+                Npm::FindVersionResult::Err(err_type) => {
+                    // The leftover `existing_peer_target` passed over is all there is.
+                    if install_peer && behavior.is_peer() {
+                        if let Some(id) = highest_peer_candidate(&this.lockfile, name_hash, version)
+                        {
+                            return Ok(Some(bind_existing_peer(
+                                this,
+                                dependency_id,
+                                id,
+                                false,
+                                success_fn,
+                            )));
+                        }
                     }
-                    Npm::FindVersionError::NotFound => None, // Handle below with existing logic
-                },
+                    match err_type {
+                        Npm::FindVersionError::TooRecent
+                        | Npm::FindVersionError::AllVersionsTooRecent => {
+                            return Err(crate::Error::TooRecentVersion);
+                        }
+                        Npm::FindVersionError::NotFound => None, // Handle below with existing logic
+                    }
+                }
             };
 
             let find_result = match find_result_opt {
@@ -2922,13 +2846,103 @@ fn locked_version_in_lockfile<'a>(
         .map(|locked| (locked, buf))
 }
 
-fn resolution_satisfies_dependency(
+/// The package to bind a deferred peer row to and whether it satisfies the row; the highest-or-nothing fallback is what `resolve_peer_dep_version_based` rebinds to on load.
+fn existing_peer_target(
     this: &PackageManager,
-    resolution: &Resolution,
-    dependency: &dependency::Version,
+    name_hash: PackageNameHash,
+    version: &dependency::Version,
+    row: DependencyID,
+) -> Option<(PackageID, bool)> {
+    let lockfile: &Lockfile::Lockfile = &this.lockfile;
+    let candidates = lockfile.package_index.get(&name_hash)?.as_slice();
+    let pkg_res = lockfile.packages.items_resolution();
+    let buf = lockfile.buffers.string_bytes.as_slice();
+    if let Some(&id) = candidates.iter().find(|&&id| {
+        (id as usize) < pkg_res.len()
+            && pkg_res[id as usize].satisfies_dependency_version(version, buf, buf)
+    }) {
+        return Some((id, true));
+    }
+    let highest = highest_peer_candidate(lockfile, name_hash, version)?;
+    (!would_revive_leftover(lockfile, row, highest)).then_some((highest, false))
+}
+
+/// `package_index` lists the highest version first.
+fn highest_peer_candidate(
+    lockfile: &Lockfile::Lockfile,
+    name_hash: PackageNameHash,
+    version: &dependency::Version,
+) -> Option<PackageID> {
+    let &highest = lockfile.package_index.get(&name_hash)?.as_slice().first()?;
+    let resolution = lockfile.packages.items_resolution().get(highest as usize)?;
+    let same_kind = matches!(
+        (resolution.tag, version.tag),
+        (ResolutionTag::Npm, dependency::version::Tag::Npm)
+            | (ResolutionTag::Git, dependency::version::Tag::Git)
+            | (ResolutionTag::Github, dependency::version::Tag::Github)
+    );
+    same_kind.then_some(highest)
+}
+
+fn bind_existing_peer(
+    this: &mut PackageManager,
+    dependency_id: DependencyID,
+    existing_id: PackageID,
+    satisfied: bool,
+    success_fn: SuccessFn,
+) -> ResolvedPackageResult {
+    if !satisfied {
+        let existing_package = this.lockfile.packages.get(existing_id as usize);
+        this.log_mut().add_warning_fmt(
+            None,
+            bun_ast::Loc::EMPTY,
+            format_args!(
+                "incorrect peer dependency \"{}@{}\"",
+                existing_package
+                    .name
+                    .fmt(this.lockfile.buffers.string_bytes.as_slice()),
+                existing_package.resolution.fmt(
+                    this.lockfile.buffers.string_bytes.as_slice(),
+                    bun_fmt::PathSep::Auto
+                ),
+            ),
+        );
+    }
+    success_fn(this, dependency_id, existing_id);
+    ResolvedPackageResult {
+        // we must fetch it from the packages array again, incase the package array mutates the value in the `successFn`
+        package: *this.lockfile.packages.get(existing_id as usize),
+        ..Default::default()
+    }
+}
+
+/// `row` is a root or workspace `peerDependencies` entry and `package_id` is held only by non-root peer rows (usually this entry's own earlier install): nothing provides it, and it is not a root row's copy, which `Tree::hoist_dependency` dedupes every other peer onto regardless of range.
+fn would_revive_leftover(
+    lockfile: &Lockfile::Lockfile,
+    row: DependencyID,
+    package_id: PackageID,
 ) -> bool {
-    let buf = this.lockfile.buffers.string_bytes.as_slice();
-    resolution.satisfies_dependency_version(dependency, buf, buf)
+    if package_id >= lockfile.loaded_package_count || !lockfile.is_workspace_dependency(row) {
+        return false;
+    }
+    let deps = lockfile.buffers.dependencies.as_slice();
+    let resolutions = lockfile.buffers.resolutions.as_slice();
+    let mut owned_rows = lockfile
+        .packages
+        .items_dependencies()
+        .iter()
+        .zip(lockfile.packages.items_resolutions())
+        .enumerate()
+        .flat_map(|(owner, (dep_slice, res_slice))| {
+            dep_slice
+                .get(deps)
+                .iter()
+                .zip(res_slice.get(resolutions))
+                .map(move |(dep, &resolved)| (owner, dep, resolved))
+        });
+    !owned_rows.any(|(owner, dep, resolved)| {
+        resolved == package_id && (owner == 0 || !dep.behavior.is_peer())
+    })
 }
 
 /// The first npm package of this name that `version` allows and `accept` takes.
diff --git a/test/cli/install/bun-update-transitive.test.ts b/test/cli/install/bun-update-transitive.test.ts
index 56857712354e..8f2dd2194caf 100644
--- a/test/cli/install/bun-update-transitive.test.ts
+++ b/test/cli/install/bun-update-transitive.test.ts
@@ -2345,7 +2345,7 @@ async function stalePeerEntry() {
   return dir;
 }
 
-// A root peerDependencies entry is never re-resolved by `bun update`; a pattern still counts it as a match, a group selector does not.
+// A root peerDependencies entry whose locked version still satisfies it is never re-resolved by `bun update`; a pattern still counts it as a match, a group selector does not.
 test.concurrent("a pattern matches a peerDependencies entry", async () => {
   const dir = await stalePeerEntry();
   const packageJsonBefore = await packageJsonText(dir);
@@ -2381,6 +2381,225 @@ test.concurrent("`bun update --dev` with only a stale peerDependencies entry has
   expect(await packageJsonText(dir)).toBe(packageJsonBefore);
 });
 
+// Once its range stops accepting the locked version, a peer entry nothing else depends on resolves afresh. The locked
+// package used to be bound anyway (it has the entry's name) with an "incorrect peer dependency" warning, and the named
+// path then wrote the range back down to it.
+test.concurrent("`bun update <name>@<version>` moves a peerDependencies entry nothing else depends on", async () => {
+  const dir = await stalePeerEntry();
+  const { stdout, stderr, exitCode } = await run(dir, "update", "no-deps@2.0.0");
+  expectMoved(stdout, "no-deps", "1.0.0", "2.0.0");
+  expectCleanStderr(stderr);
+  expect(await packageJsonOf(dir)).toStrictEqual(withPeer("^1.0.1", "^2.0.0"));
+  expect((await lock(dir)).workspaces[""].peerDependencies).toStrictEqual({ "no-deps": "^2.0.0" });
+  expect(await lockedVersions(dir, "no-deps")).toStrictEqual(["2.0.0"]);
+  expect(await lockedVersions(dir, "a-dep")).toStrictEqual(["1.0.1"]);
+  expect(await installedVersion(dir, "no-deps")).toBe("2.0.0");
+  await frozen(dir);
+  expect(exitCode).toBe(0);
+});
+
+test.concurrent(
+  "`bun install` moves a peerDependencies entry nothing else depends on once its range is edited",
+  async () => {
+    const dir = await stalePeerEntry();
+    await write(join(dir, "package.json"), stringify(withPeer("^1.0.1", "^1.1.0")));
+    const stderr = await install(dir);
+    expectCleanStderr(stderr);
+    expect(await lockedVersions(dir, "no-deps")).toStrictEqual(["1.1.0"]);
+    expect(await installedVersion(dir, "no-deps")).toBe("1.1.0");
+    await frozen(dir);
+  },
+);
+
+// devDependencies provides no-deps@1.1.0, so the peer entry keeps pointing at it and the warning is the right answer.
+test.concurrent("a peerDependencies entry another group provides keeps following that group", async () => {
+  const provided = (peerRange: string) => ({
+    name: "foo",
+    devDependencies: { "no-deps": "^1.0.0" },
+    peerDependencies: { "no-deps": peerRange },
+  });
+  const dir = await setup({ "package.json": provided("^1.0.0") });
+  expect(await lockedVersions(dir, "no-deps")).toStrictEqual(["1.1.0"]);
+  await write(join(dir, "package.json"), stringify(provided("^2.0.0")));
+  const stderr = await install(dir);
+  expect(stderr).toContain('warn: incorrect peer dependency "no-deps@1.1.0"');
+  expect(await lockedVersions(dir, "no-deps")).toStrictEqual(["1.1.0"]);
+  expect(await installedVersion(dir, "no-deps")).toBe("1.1.0");
+  await frozen(dir);
+});
+
+const PEER_ONLY = (range: string) => ({ name: "foo", peerDependencies: { "no-deps": range } });
+
+// no-deps@1.5.0 was never published (a `bun init` project hits this with `bun add typescript@5.0.0`): with nothing to install
+// instead, the entry keeps the copy it has and warns as it always did, instead of spinning on or dropping the unresolvable row.
+test.concurrent(
+  "`bun add <name>@<unpublished version>` on a peerDependencies entry keeps the installed copy",
+  async () => {
+    const dir = await setup({ "package.json": PEER_ONLY("^1.0.0") });
+    expect(await lockedVersions(dir, "no-deps")).toStrictEqual(["1.1.0"]);
+    const { stderr, exitCode } = await run(dir, "add", "no-deps@1.5.0");
+    expect(stderr).toContain('warn: incorrect peer dependency "no-deps@1.1.0"');
+    expect(stderr).not.toContain("error:");
+    expect(await packageJsonOf(dir)).toStrictEqual(PEER_ONLY("1.5.0"));
+    expect(await lockedVersions(dir, "no-deps")).toStrictEqual(["1.1.0"]);
+    expect(await installedVersion(dir, "no-deps")).toBe("1.1.0");
+    await frozen(dir);
+    expect(exitCode).toBe(0);
+  },
+);
+
+// Same when the only release the new range accepts is still inside --minimum-release-age.
+test.concurrent(
+  "a peerDependencies entry whose new range only matches a too recent release keeps the installed copy",
+  async () => {
+    using server = await serveRegistry(
+      { leaf: { "1.0.0": {}, "2.0.0": {} } },
+      {},
+      { times: { leaf: { "1.0.0": daysAgo(30), "2.0.0": daysAgo(1) } } },
+    );
+    const entry = (range: string) => ({ name: "foo", peerDependencies: { leaf: range } });
+    const dir = await installServed(server, "peer-entry-min-age-", entry("^1.0.0"));
+    expect(await lockedVersions(dir, "leaf")).toStrictEqual(["1.0.0"]);
+    await write(join(dir, "package.json"), stringify(entry("^2.0.0")));
+    const { stderr, exitCode } = await run(dir, "install", "--minimum-release-age", THREE_DAYS_SECONDS);
+    expect(stderr).toContain('warn: incorrect peer dependency "leaf@1.0.0"');
+    expect(stderr).not.toContain("error:");
+    expect(await lockedVersions(dir, "leaf")).toStrictEqual(["1.0.0"]);
+    expect(await installedVersion(dir, "leaf")).toBe("1.0.0");
+    await frozen(dir);
+    expect(exitCode).toBe(0);
+  },
+);
+
+// The root's peer entry alone holds no-deps@1.1.0 at the top of node_modules; one-fixed-dep@1.0.0 then nests the no-deps@1.0.0
+// it depends on, so bun.lock carries two copies, the higher of which nothing depends on outright.
+const rootPeer = (range: string, dependencies: Json) =>
+  pkgJson(dependencies, { peerDependencies: { "no-deps": range } });
+
+async function twoCopies() {
+  const dir = await setup({ "package.json": rootPeer("^1.0.0", {}) });
+  await reinstall(dir, rootPeer("^1.0.0", { "one-fixed-dep": "1.0.0" }));
+  expect(await lockedVersions(dir, "no-deps")).toStrictEqual(["1.0.0", "1.1.0"]);
+  expect(await installedVersion(dir, "no-deps")).toBe("1.1.0");
+  expect(await installedVersion(dir, "one-fixed-dep", "node_modules", "no-deps")).toBe("1.0.0");
+  return dir;
+}
+
+// Rewritten past both copies, the entry takes neither: the one that would be bound, the highest, is the one it installed
+// itself, and the provided 1.0.0 is a binding loading bun.lock (which binds the highest copy too) would not reproduce.
+test.concurrent(
+  "a rewritten peerDependencies entry replaces the copy it installed rather than binding a lower one",
+  async () => {
+    const dir = await twoCopies();
+    await write(join(dir, "package.json"), stringify(rootPeer("^2.0.0", { "one-fixed-dep": "1.0.0" })));
+    const stderr = await install(dir);
+    expectCleanStderr(stderr);
+    expect(await lockedVersions(dir, "no-deps")).toStrictEqual(["1.0.0", "2.0.0"]);
+    expect(await installedVersion(dir, "no-deps")).toBe("2.0.0");
+    expect(await installedVersion(dir, "one-fixed-dep", "node_modules", "no-deps")).toBe("1.0.0");
+    await frozen(dir);
+  },
+);
+
+// strict-peer-dep@1.0.0's own peer `no-deps: ^2.0.0` accepts neither copy either, but a package's peer rows take whatever
+// copy the tree has (a copy resolved for them alone would never be placed), so it binds the highest one and warns as before.
+test.concurrent("a package's own peer entry still binds to the highest copy in bun.lock and warns", async () => {
+  const dir = await twoCopies();
+  await write(
+    join(dir, "package.json"),
+    stringify(rootPeer("^1.0.0", { "one-fixed-dep": "1.0.0", "strict-peer-dep": "1.0.0" })),
+  );
+  const stderr = await install(dir);
+  expect(stderr).toContain('warn: incorrect peer dependency "no-deps@1.1.0"');
+  expect(await lockedVersions(dir, "no-deps")).toStrictEqual(["1.0.0", "1.1.0"]);
+  expect(await installedVersion(dir, "no-deps")).toBe("1.1.0");
+  await frozen(dir);
+});
+
+// Workspaces declaring the same peer share the one no-deps@1.1.0 the install put at the top of node_modules.
+const peerRoot = (range?: string) => (range ? { ...ROOT, peerDependencies: { "no-deps": range } } : ROOT);
+const peerMember = (name: string, range: string) => ({
+  name,
+  version: "1.0.0",
+  peerDependencies: { "no-deps": range },
+});
+
+async function sharedPeer(root: Json, ...members: [string, string][]) {
+  const files: Record<string, Json> = { "package.json": root };
+  for (const [name, range] of members) files[`packages/${name}/package.json`] = peerMember(name, range);
+  const dir = await setup(files);
+  expect(await lockedVersions(dir, "no-deps")).toStrictEqual(["1.1.0"]);
+  return dir;
+}
+
+// The tree dedupes every other peer onto the root's copy whatever their range says, so a member's copy of its own would
+// never be installed; the member's entry keeps the root's copy and the warning.
+test.concurrent("a member's rewritten entry keeps binding to the copy the root's own entry holds", async () => {
+  const dir = await sharedPeer(peerRoot("^1.0.0"), ["pkg1", "^1.0.0"]);
+  await write(join(dir, "packages/pkg1/package.json"), stringify(peerMember("pkg1", "^2.0.0")));
+  const stderr = await install(dir);
+  expect(stderr).toContain('warn: incorrect peer dependency "no-deps@1.1.0"');
+  expect(await lockedVersions(dir, "no-deps")).toStrictEqual(["1.1.0"]);
+  expect(await installedVersion(dir, "no-deps")).toBe("1.1.0");
+  await frozen(dir);
+});
+
+test.concurrent("rewriting the root's and a member's entries together moves both onto the new copy", async () => {
+  const dir = await sharedPeer(peerRoot("^1.0.0"), ["pkg1", "^1.0.0"]);
+  await write(join(dir, "package.json"), stringify(peerRoot("^2.0.0")));
+  await write(join(dir, "packages/pkg1/package.json"), stringify(peerMember("pkg1", "^2.0.0")));
+  const stderr = await install(dir);
+  expectCleanStderr(stderr);
+  expect(await lockedVersions(dir, "no-deps")).toStrictEqual(["2.0.0"]);
+  expect(await installedVersion(dir, "no-deps")).toBe("2.0.0");
+  await frozen(dir);
+});
+
+// Rewriting only the root's entry installs what it asks for; the member's unchanged `^1.0.0` is deduped onto the root's copy,
+// the same as when a root dependency moves past it (the tree warns about neither yet, so stderr is not asserted).
+test.concurrent("rewriting only the root's entry installs its copy for the unchanged member too", async () => {
+  const dir = await sharedPeer(peerRoot("^1.0.0"), ["pkg1", "^1.0.0"]);
+  await write(join(dir, "package.json"), stringify(peerRoot("^2.0.0")));
+  const stderr = await install(dir);
+  expect(stderr).not.toContain("error:");
+  expect(await lockedVersions(dir, "no-deps")).toStrictEqual(["2.0.0"]);
+  expect((await lock(dir)).workspaces["packages/pkg1"].peerDependencies).toStrictEqual({ "no-deps": "^1.0.0" });
+  expect(await installedVersion(dir, "no-deps")).toBe("2.0.0");
+  await frozen(dir);
+});
+
+// With no root entry, pkg2's copy is not forced on pkg1: each member ends up with the copy its own entry asks for.
+test.concurrent(
+  "a member's rewritten entry gets its own copy next to a sibling's when the root declares nothing",
+  async () => {
+    const dir = await sharedPeer(peerRoot(), ["pkg1", "^1.0.0"], ["pkg2", "^1.0.0"]);
+    await write(join(dir, "packages/pkg1/package.json"), stringify(peerMember("pkg1", "^2.0.0")));
+    const stderr = await install(dir);
+    expectCleanStderr(stderr);
+    expect(await lockedVersions(dir, "no-deps")).toStrictEqual(["1.1.0", "2.0.0"]);
+    const { workspaces } = await lock(dir);
+    expect(workspaces["packages/pkg1"].peerDependencies).toStrictEqual({ "no-deps": "^2.0.0" });
+    expect(workspaces["packages/pkg2"].peerDependencies).toStrictEqual({ "no-deps": "^1.0.0" });
+    await frozen(dir);
+  },
+);
+
+// Without a lockfile the no-deps the first peer row installs is all the second one can bind to; that still dedupes onto it
+// and warns. Which row goes first follows the order the two manifests arrive in, so only the single copy is pinned down.
+test.concurrent("on a fresh install two peer entries nothing provides still share one no-deps", async () => {
+  const { packageDir: dir } = await registry.createTestDir({
+    bunfigOpts: { saveTextLockfile: true, linker: "hoisted" },
+    files: { "package.json": stringify(pkgJson({ "peer-deps-fixed": "1.0.0", "strict-peer-dep": "1.0.0" })) },
+  });
+  const stderr = await install(dir, ...linkerArgs({}));
+  const [version] = await lockedVersions(dir, "no-deps");
+  expect(["1.1.0", "2.0.0"]).toContain(version);
+  expect(stderr).toContain(`warn: incorrect peer dependency "no-deps@${version}"`);
+  expect(await lockedVersions(dir, "no-deps")).toStrictEqual([version]);
+  expect(await installedVersion(dir, "no-deps")).toBe(version);
+  await frozen(dir);
+});
+
 // pkg1 has a stale entry in every group; pkg2 only in dependencies; the root has none.
 const PKG1_GROUPS = (noDeps: string, types: string, aDep: string) => ({
   name: "pkg1",
@@ -2646,3 +2865,46 @@ test.concurrent("`bun update -i --latest` honours an entry toggled back to its i
   await frozen(dir);
   expect(exitCode).toBe(0);
 });
+
+// Offered as `a-dep` (dependencies), then the `no-deps` peer row showing Current 1.0.0, Target 1.1.0, Latest 2.0.0.
+test.concurrent("`bun update -i` installs the Target version a peerDependencies row shows", async () => {
+  const dir = await stalePeerEntry();
+  const { stderr, exitCode } = await runInteractive(dir, "j \r");
+  expect(stderr).not.toContain("error:");
+  expect(stderr).not.toContain("warn:");
+  expect(await packageJsonOf(dir)).toStrictEqual(withPeer("^1.0.1", "^1.1.0"));
+  expect(await lockedVersions(dir, "no-deps")).toStrictEqual(["1.1.0"]);
+  expect(await lockedVersions(dir, "a-dep")).toStrictEqual(["1.0.1"]);
+  expect(await installedVersion(dir, "no-deps")).toBe("1.1.0");
+  await frozen(dir);
+  expect(exitCode).toBe(0);
+});
+
+// With 1.1.0 locked, the row's Target equals Current, so selecting it takes the Latest column.
+test.concurrent("`bun update -i` installs the Latest version a peerDependencies row shows", async () => {
+  const dir = await setup({ "package.json": PEER_ONLY("^1.0.0") });
+  expect(await lockedVersions(dir, "no-deps")).toStrictEqual(["1.1.0"]);
+  const { stderr, exitCode } = await runInteractive(dir, " \r");
+  expect(stderr).not.toContain("error:");
+  expect(stderr).not.toContain("warn:");
+  expect(await packageJsonOf(dir)).toStrictEqual(PEER_ONLY("^2.0.0"));
+  expect((await lock(dir)).workspaces[""].peerDependencies).toStrictEqual({ "no-deps": "^2.0.0" });
+  expect(await lockedVersions(dir, "no-deps")).toStrictEqual(["2.0.0"]);
+  expect(await installedVersion(dir, "no-deps")).toBe("2.0.0");
+  await frozen(dir);
+  expect(exitCode).toBe(0);
+});
+
+test.concurrent("`bun update -i -r` installs the version a workspace member's peerDependencies row shows", async () => {
+  const pkg1 = (range: string) => ({ name: "pkg1", version: "1.0.0", peerDependencies: { "no-deps": range } });
+  const dir = await setup({ "package.json": ROOT, "packages/pkg1/package.json": pkg1("^1.0.0") });
+  expect(await lockedVersions(dir, "no-deps")).toStrictEqual(["1.1.0"]);
+  const { stderr, exitCode } = await runInteractive(dir, " \r", "-r");
+  expect(stderr).not.toContain("error:");
+  expect(stderr).not.toContain("warn:");
+  expect(await packageJsonOf(dir, "packages/pkg1")).toStrictEqual(pkg1("^2.0.0"));
+  expect((await lock(dir)).workspaces["packages/pkg1"].peerDependencies).toStrictEqual({ "no-deps": "^2.0.0" });
+  expect(await lockedVersions(dir, "no-deps")).toStrictEqual(["2.0.0"]);
+  await frozen(dir);
+  expect(exitCode).toBe(0);
+});

From b618d99c05db52cfa9fabe21590012dc5bd3e9dc Mon Sep 17 00:00:00 2001
From: robobun <117481402+robobun@users.noreply.github.com>
Date: Mon, 17 Aug 2026 01:04:04 +0000
Subject: [PATCH 006/258] install: keep the packages bun.lock holds only
 through optional peers when an install re-resolves (#39002)

---
 .../PackageManager/install_with_manager.rs    |  5 +-
 src/install/dedupe.rs                         |  3 +-
 src/install/lockfile.rs                       | 46 ++++++++++++++-----
 src/install/lockfile/Package.rs               | 10 +++-
 test/cli/install/bun-lock.test.ts             | 45 ++++++++++++++++++
 5 files changed, 93 insertions(+), 16 deletions(-)

diff --git a/src/install/PackageManager/install_with_manager.rs b/src/install/PackageManager/install_with_manager.rs
index a2aaffe39e33..06c22d2f9a4c 100644
--- a/src/install/PackageManager/install_with_manager.rs
+++ b/src/install/PackageManager/install_with_manager.rs
@@ -91,8 +91,9 @@ pub fn install_with_manager(
 
     // Snapshot the loaded-from-lockfile package count so
     // `Lockfile::get_package_id` can tell loaded pins apart from packages
-    // appended by manifest fetches in this resolve session.
-    manager.lockfile.mark_loaded_packages();
+    // appended by manifest fetches in this resolve session, and which loaded
+    // packages a non-peer dependency holds, for `clean_with_logger`.
+    manager.lockfile.mark_loaded_packages()?;
 
     let (config_version, changed_config_version) = load_result.choose_config_version();
     manager.options.config_version = Some(config_version);
diff --git a/src/install/dedupe.rs b/src/install/dedupe.rs
index 32ed09e28e02..e524e2b6e54a 100644
--- a/src/install/dedupe.rs
+++ b/src/install/dedupe.rs
@@ -605,7 +605,8 @@ pub(crate) fn effective_version(
     Some(version)
 }
 
-// Optional-peer edges are followed too: with an in-sync package.json `clean` runs with `keep_optional_peer_targets`.
+// Optional-peer edges are followed too: `clean` keeps a target the loaded lockfile held through them alone
+// (`Lockfile::held_at_load`), and a version that survives here keeps every edge it had, so anything else they reach stays held.
 fn reachable(lockfile: &Lockfile, resolutions: &[PackageID]) -> DynamicBitSet {
     crate::lockfile::reachable::packages(
         lockfile,
diff --git a/src/install/lockfile.rs b/src/install/lockfile.rs
index f80c2ed6b1ee..938634608a26 100644
--- a/src/install/lockfile.rs
+++ b/src/install/lockfile.rs
@@ -203,6 +203,19 @@ pub struct Lockfile {
     /// Runtime-only — never serialised.
     pub(crate) loaded_package_count: PackageID,
 
+    /// `bit[id] == true` ⇔ a dependency other than an optional peer resolved
+    /// to package `id` in the lockfile as loaded. An optional peer slot never
+    /// keeps such a package alive through `clean_with_logger` (it is bound in
+    /// `Cloner::flush` if something else still reaches it), so a package whose
+    /// last real dependent leaves package.json is dropped. A loaded package
+    /// with the bit unset was held by optional peers alone; 1.3.x wrote such
+    /// entries and they are kept, otherwise every resolve would prune them and
+    /// rewrite the file on any unrelated change. Sized to
+    /// `loaded_package_count`, so packages appended during this resolve read
+    /// as held (a fresh resolve never creates peer-only entries). Set by
+    /// `mark_loaded_packages`; runtime-only — never serialised.
+    pub(crate) held_at_load: DynamicBitSet,
+
     /// `bit[id] == true` ⇔ package `id` was appended for a dependency whose
     /// version range was an exact `=X.Y.Z` (i.e. the user — root or workspace
     /// — pinned this exact version somewhere in the tree). `get_package_id`'s
@@ -986,9 +999,6 @@ impl Lockfile {
 
         let mut package_id_mapping = vec![invalid_package_id; old.packages.len()];
         let clone_queue_ = PendingResolutions::new();
-        // A frozen install never saves, so dropping peer-held targets could only fail its check.
-        let keep_optional_peer_targets =
-            manager.options.enable.frozen_lockfile() || !manager.summary.changes_resolutions();
         // Explicit `&mut *` reborrows so `old`/`manager`/`new` are
         // released back to this scope once `cloner` is dropped.
         let mut cloner = Cloner {
@@ -997,7 +1007,6 @@ impl Lockfile {
             mapping: &mut package_id_mapping,
             clone_queue: clone_queue_,
             optional_peers: PendingResolutions::new(),
-            keep_optional_peer_targets,
             log,
             old_preinstall_state,
             manager: &mut *manager,
@@ -1224,7 +1233,6 @@ pub struct Cloner<'a> {
     pub(crate) clone_queue: PendingResolutions,
     /// Bound in `flush`, once `clone_queue` has decided which targets survive.
     pub(crate) optional_peers: PendingResolutions,
-    pub(crate) keep_optional_peer_targets: bool,
     pub lockfile: &'a mut Lockfile,
     pub(crate) old: &'a mut Lockfile,
     pub(crate) mapping: &'a mut [PackageID],
@@ -2013,16 +2021,32 @@ impl Lockfile {
             // session-appended, so the order-independence guard in
             // `get_package_id` applies from id 0.
             loaded_package_count: 0,
+            held_at_load: DynamicBitSet::default(),
             exact_pinned: DynamicBitSet::default(),
         }
     }
 
-    /// Snapshot `packages.len()` as the "loaded from lockfile" watermark.
-    /// Call exactly once after `load_from_cwd` (including npm/pnpm/yarn
-    /// migration) before any manifest-driven `append_package`.
-    #[inline]
-    pub(crate) fn mark_loaded_packages(&mut self) {
-        self.loaded_package_count = self.packages.len() as PackageID;
+    /// Snapshot `packages.len()` as the "loaded from lockfile" watermark and
+    /// which of those packages a non-peer dependency resolves to
+    /// (`held_at_load`). Call exactly once after `load_from_cwd` (including
+    /// npm/pnpm/yarn migration), before the differ, an update or a dedupe
+    /// re-points any resolution and before any manifest-driven
+    /// `append_package`.
+    pub(crate) fn mark_loaded_packages(&mut self) -> Result<(), AllocError> {
+        let packages_len = self.packages.len();
+        self.loaded_package_count = packages_len as PackageID;
+        let mut held = DynamicBitSet::init_empty(packages_len)?;
+        // A load that failed partway leaves `resolutions` shorter than `dependencies`;
+        // that lockfile is replaced by `init_empty` before anything reads the set.
+        let dependencies = self.buffers.dependencies.as_slice();
+        let resolutions = self.buffers.resolutions.as_slice();
+        for (dependency, &package_id) in dependencies.iter().zip(resolutions) {
+            if !dependency.behavior.is_optional_peer() && (package_id as usize) < packages_len {
+                held.set(package_id as usize);
+            }
+        }
+        self.held_at_load = held;
+        Ok(())
     }
 
     /// Record that package `id` was appended via an exact-version dependency
diff --git a/src/install/lockfile/Package.rs b/src/install/lockfile/Package.rs
index fcd5b545bd4d..767c6aa80c1f 100644
--- a/src/install/lockfile/Package.rs
+++ b/src/install/lockfile/Package.rs
@@ -616,8 +616,14 @@ impl Package<u64> {
                 resolve_id: new_package.resolutions.off + PackageID::try_from(i).expect("int cast"),
             };
 
-            // Peer slots must not keep their target alive; bound in `Cloner::flush`.
-            if old_dependencies[i].behavior.is_optional_peer() && !cloner.keep_optional_peer_targets
+            // A peer slot must not keep a target alive that something else held
+            // when the lockfile was loaded; it is bound in `Cloner::flush` if that
+            // holder survived. A target the loaded lockfile held through optional
+            // peers alone is cloned like a dependency (see `Lockfile::held_at_load`).
+            if old_dependencies[i].behavior.is_optional_peer()
+                && old
+                    .held_at_load
+                    .is_set_allow_out_of_bound(*old_resolution as usize, true)
             {
                 cloner.optional_peers.push(pending);
                 continue;
diff --git a/test/cli/install/bun-lock.test.ts b/test/cli/install/bun-lock.test.ts
index f675ac2c5710..be0f1d31ad2b 100644
--- a/test/cli/install/bun-lock.test.ts
+++ b/test/cli/install/bun-lock.test.ts
@@ -1450,6 +1450,51 @@ it("--frozen-lockfile keeps a package that an older lockfile lists only as an op
   expect(await exists(join(packageDir, "node_modules", "no-deps", "package.json"))).toBeTrue();
 });
 
+// Same entries, but the install that re-resolves and saves: a package.json change
+// unrelated to them (here a dependency bun.lock already has) must not prune them
+// either. Only a package whose real dependent leaves is dropped (the tests above).
+it("a re-resolving install keeps the packages an older lockfile holds through optional peers alone", async () => {
+  const { packageDir, packageJson } = await registry.createTestDir({
+    bunfigOpts: { saveTextLockfile: true, linker: "hoisted" },
+  });
+  const run = makeInstallRunner(packageDir);
+  const noDepsEntry = '"no-deps": ["no-deps@1.0.0"';
+  const locked = { "optional-peer-deps": "1.0.0", "uses-a-dep-1": "1.0.0" };
+  await Promise.all([
+    // a-dep is already in bun.lock through uses-a-dep-1, so nothing resolves differently.
+    write(packageJson, JSON.stringify({ name: "foo", dependencies: { ...locked, "a-dep": "1.0.1" } })),
+    write(
+      join(packageDir, "bun.lock"),
+      JSON.stringify({
+        lockfileVersion: 1,
+        configVersion: 1,
+        workspaces: { "": { name: "foo", dependencies: locked } },
+        packages: {
+          "a-dep": ["a-dep@1.0.1", "", {}, ""],
+          // only optional-peer-deps's optional peer refers to this entry
+          "no-deps": ["no-deps@1.0.0", "", {}, ""],
+          "optional-peer-deps": [
+            "optional-peer-deps@1.0.0",
+            "",
+            { peerDependencies: { "no-deps": "*" }, optionalPeers: ["no-deps"] },
+            "",
+          ],
+          "uses-a-dep-1": ["uses-a-dep-1@1.0.0", "", { dependencies: { "a-dep": "1.0.1" } }, ""],
+        },
+      }),
+    ),
+  ]);
+
+  await run(["install"]);
+  const saved = await file(join(packageDir, "bun.lock")).text();
+  expect(saved).toContain('"a-dep": "1.0.1"');
+  expect(saved).toContain(noDepsEntry);
+  expect(await exists(join(packageDir, "node_modules", "no-deps", "package.json"))).toBeTrue();
+
+  await run(["install", "--frozen-lockfile"]);
+  expect(await file(join(packageDir, "bun.lock")).text()).toBe(saved);
+});
+
 // The optional-peer-hoist-* fixtures are described in
 // registry/packages/create-optional-peer-hoist-packages.ts. In short: consumer
 // has an optional peer on target, and deep -> deep-child reaches target@1.0.0

From ca659933dc40d7459861c77871a6877327c374ed Mon Sep 17 00:00:00 2001
From: robobun <117481402+robobun@users.noreply.github.com>
Date: Mon, 17 Aug 2026 01:04:08 +0000
Subject: [PATCH 007/258] install: bind unbound required peers while hoisting,
 like optional peers (#39343)

---
 src/install/lockfile.rs                       |  12 +-
 src/install/lockfile/Tree.rs                  |  51 +++--
 .../install/migration/pnpm-lock-v9.test.ts    | 199 ++++++++++++++++++
 .../migration/yarn-lock-migration.test.ts     | 101 ++++++++-
 4 files changed, 328 insertions(+), 35 deletions(-)

diff --git a/src/install/lockfile.rs b/src/install/lockfile.rs
index 938634608a26..f97520b42842 100644
--- a/src/install/lockfile.rs
+++ b/src/install/lockfile.rs
@@ -1294,7 +1294,7 @@ impl<'a> Cloner<'a> {
 // ────────────────────────────────────────────────────────────────────────────
 
 impl Lockfile {
-    /// Re-hoists while a pass bound an optional peer late; a reload has that binding up front.
+    /// Re-hoists while a pass bound a peer late; a reload has that binding up front.
     pub(crate) fn resolve(&mut self, log: &mut bun_ast::Log) -> Result<(), tree::SubtreeError> {
         while self.hoist::<{ tree::BuilderMethod::Resolvable }>(log, None, true, &[], None)? {}
         Ok(())
@@ -1318,7 +1318,7 @@ impl Lockfile {
         Ok(())
     }
 
-    /// Sets `buffers.trees`/`hoisted_dependencies`; returns `Builder::late_bound_optional_peer`.
+    /// Sets `buffers.trees`/`hoisted_dependencies`; returns `Builder::late_bound_peer`.
     pub(crate) fn hoist<const METHOD: tree::BuilderMethod>(
         &mut self,
         log: &mut bun_ast::Log,
@@ -1349,8 +1349,8 @@ impl Lockfile {
             install_root_dependencies,
             workspace_filters,
             packages_to_install,
-            pending_optional_peers: Default::default(),
-            late_bound_optional_peer: false,
+            pending_peers: Default::default(),
+            late_bound_peer: false,
             list: Default::default(),
             sort_buf: Default::default(),
         };
@@ -1369,10 +1369,10 @@ impl Lockfile {
         }
 
         let cleaned = builder.clean()?;
-        let late_bound_optional_peer = builder.late_bound_optional_peer;
+        let late_bound_peer = builder.late_bound_peer;
         self.buffers.trees = cleaned.trees;
         self.buffers.hoisted_dependencies = cleaned.dep_ids;
-        Ok(late_bound_optional_peer)
+        Ok(late_bound_peer)
     }
 }
 
diff --git a/src/install/lockfile/Tree.rs b/src/install/lockfile/Tree.rs
index b34e2f19b0b7..1a959cda7efa 100644
--- a/src/install/lockfile/Tree.rs
+++ b/src/install/lockfile/Tree.rs
@@ -436,14 +436,13 @@ pub struct Builder<'a, const METHOD: BuilderMethod> {
     /// overlap; reads go through [`Builder::lockfile()`] which never touches
     /// `buffers.resolutions`.
     pub lockfile: bun_ptr::ParentRef<Lockfile>,
-    // Unresolved optional peers that might resolve later. if they do we will want to assign
+    // Unresolved peers that might resolve later. if they do we will want to assign
     // builder.resolutions[peer.dep_id] to the resolved pkg_id. A dependency ID set is used because there
     // can be multiple instances of the same package in the tree, so the same unresolved dependency ID
     // could be visited multiple times before it's resolved.
-    pub(crate) pending_optional_peers:
-        ArrayHashMap<PackageNameHash, ArrayHashMap<DependencyID, ()>>,
-    /// An optional peer got bound after its dependent was placed; see `Lockfile::resolve`.
-    pub(crate) late_bound_optional_peer: bool,
+    pub(crate) pending_peers: ArrayHashMap<PackageNameHash, ArrayHashMap<DependencyID, ()>>,
+    /// A peer got bound after its dependent was placed; see `Lockfile::resolve`.
+    pub(crate) late_bound_peer: bool,
     pub(crate) manager: Option<&'a PackageManager>,
     pub(crate) sort_buf: Vec<DependencyID>,
     pub(crate) workspace_filters: &'a [WorkspaceFilter],
@@ -539,7 +538,7 @@ impl<'a, const METHOD: BuilderMethod> Builder<'a, METHOD> {
             for &dep_id in child.iter() {
                 let pkg_id = self.resolutions[dep_id as usize];
                 if pkg_id == invalid_package_id {
-                    // optional peers that never resolved
+                    // peers that never resolved
                     continue;
                 }
 
@@ -551,7 +550,7 @@ impl<'a, const METHOD: BuilderMethod> Builder<'a, METHOD> {
             tree.dependencies.len = len;
         }
 
-        // queue / sort_buf / pending_optional_peers freed by Drop; explicit deinit removed.
+        // queue / sort_buf / pending_peers freed by Drop; explicit deinit removed.
         // The sole caller (`Lockfile::hoist`) drops the Builder immediately after clean().
 
         slice.deinit_owned();
@@ -790,7 +789,11 @@ impl Tree {
                 }
 
                 if pkg_id == invalid_package_id {
-                    if dependency.behavior.is_optional_peer() {
+                    // An unbound peer (optional, or one a migration had nothing recorded for)
+                    // binds to the copy next to or above its dependent, which is where loading
+                    // the saved bun.lock binds it (`PkgMap::find_resolution`); the isolated
+                    // store keys the dependent by that binding.
+                    if dependency.behavior.is_peer() {
                         break 'hoisted Tree::hoist_dependency::<true, METHOD>(
                             next_id,
                             hoist_root_id,
@@ -843,14 +846,10 @@ impl Tree {
                     debug_assert!(pkg_id == invalid_package_id);
                     debug_assert!(res_id != invalid_package_id);
                     builder.resolutions[dep_id as usize] = res_id;
-                    debug_assert!(
-                        !builder
-                            .pending_optional_peers
-                            .contains_key(&dependency.name_hash)
-                    );
+                    debug_assert!(!builder.pending_peers.contains_key(&dependency.name_hash));
 
                     if let Some(entry) = builder
-                        .pending_optional_peers
+                        .pending_peers
                         .fetch_swap_remove(&dependency.name_hash)
                     {
                         let peers = entry.1;
@@ -868,10 +867,10 @@ impl Tree {
                 }
                 HoistDependencyResult::ResolveReplace(replace) => {
                     debug_assert!(pkg_id != invalid_package_id);
-                    builder.late_bound_optional_peer = true;
+                    builder.late_bound_peer = true;
                     builder.resolutions[replace.dep_id as usize] = pkg_id;
                     if let Some(entry) = builder
-                        .pending_optional_peers
+                        .pending_peers
                         .fetch_swap_remove(&dependency.name_hash)
                     {
                         let peers = entry.1;
@@ -909,12 +908,10 @@ impl Tree {
                     builder.resolutions[dep_id as usize] = res_id;
                 }
                 HoistDependencyResult::ResolveLater => {
-                    // `dep_id` is an unresolved optional peer. while hoisting it deduplicated
-                    // with another unresolved optional peer. save it so we remember resolve it
+                    // `dep_id` is an unresolved peer. while hoisting it deduplicated
+                    // with another unresolved peer. save it so we remember resolve it
                     // later if it's possible to resolve it.
-                    let entry = builder
-                        .pending_optional_peers
-                        .get_or_put(dependency.name_hash)?;
+                    let entry = builder.pending_peers.get_or_put(dependency.name_hash)?;
                     if !entry.found_existing {
                         *entry.value_ptr = ArrayHashMap::default();
                     }
@@ -996,15 +993,15 @@ impl Tree {
             let res_id = builder.resolutions[dep_id as usize];
 
             if res_id == invalid_package_id && package_id == invalid_package_id {
-                debug_assert!(dep.behavior.is_optional_peer());
-                debug_assert!(dependency.behavior.is_optional_peer());
-                // both optional peers will need to be resolved if they can resolve later.
+                debug_assert!(dep.behavior.is_peer());
+                debug_assert!(dependency.behavior.is_peer());
+                // both peers will need to be resolved if they can resolve later.
                 // remember input package_id and dependency for later
                 return HoistDependencyResult::ResolveLater;
             }
 
             if res_id == invalid_package_id {
-                debug_assert!(dep.behavior.is_optional_peer());
+                debug_assert!(dep.behavior.is_peer());
                 return HoistDependencyResult::ResolveReplace(ResolveReplace {
                     id: this.id,
                     dep_id,
@@ -1012,9 +1009,9 @@ impl Tree {
             }
 
             if package_id == invalid_package_id {
-                debug_assert!(dependency.behavior.is_optional_peer());
+                debug_assert!(dependency.behavior.is_peer());
                 debug_assert!(res_id != invalid_package_id);
-                // resolve optional peer to `builder.resolutions[dep_id]`
+                // resolve peer to `builder.resolutions[dep_id]`
                 return HoistDependencyResult::Resolve(res_id); // 1
             }
 
diff --git a/test/cli/install/migration/pnpm-lock-v9.test.ts b/test/cli/install/migration/pnpm-lock-v9.test.ts
index 549ba0890922..972eaf3aebd1 100644
--- a/test/cli/install/migration/pnpm-lock-v9.test.ts
+++ b/test/cli/install/migration/pnpm-lock-v9.test.ts
@@ -1848,6 +1848,205 @@ ${variants}`;
       ).toBeTrue();
     });
 
+    describe("a peer pnpm left unmet is bound by the install that migrates", () => {
+      // pnpm records a met peer as a suffix on the dependent's snapshot key; an unmet one (autoInstallPeers
+      // off) has no suffix, so the migration has nothing to bind peer-deps-too's `no-deps` edge to. Loading
+      // the migrated bun.lock binds it to the no-deps hoisted to the root, and the isolated store keys
+      // peer-deps-too by that binding, so the migrating install has to bind it the same way or the next
+      // install re-keys the entry (bun.lock itself is identical either way).
+      const unmetPeerProject = (importer: string, packageJson: Record<string, unknown>) => ({
+        "package.json": JSON.stringify({ name: "unmet-peer", ...packageJson }),
+        "pnpm-lock.yaml": `lockfileVersion: '9.0'
+
+settings:
+  autoInstallPeers: false
+
+importers:
+
+  .:
+${importer}
+
+packages:
+
+  no-deps@1.0.1:
+    resolution: {integrity: ${NO_DEPS_1_0_1_INTEGRITY}}
+
+  one-dep@1.0.0:
+    resolution: {integrity: ${ONE_DEP_1_0_0_INTEGRITY}}
+
+  peer-deps-too@1.0.0:
+    resolution: {integrity: ${PEER_DEPS_TOO_1_0_0_INTEGRITY}}
+    peerDependencies:
+      no-deps: '*'
+
+snapshots:
+
+  no-deps@1.0.1: {}
+
+  one-dep@1.0.0:
+    dependencies:
+      no-deps: 1.0.1
+
+  peer-deps-too@1.0.0: {}
+`,
+      });
+
+      const storeEntries = (dir: string) =>
+        readdirSync(join(dir, "node_modules", ".bun"))
+          .filter(name => name !== "node_modules")
+          .sort();
+
+      // Hoisting places a package's dependencies breadth-first in dependency-group order. With both in
+      // `dependencies`, one-dep's no-deps reaches the root before peer-deps-too's peer is looked at; as a
+      // devDependency peer-deps-too is processed first, and the peer is bound when no-deps arrives later.
+      test.concurrent.each([
+        {
+          group: "dependencies",
+          packageJson: { dependencies: { "one-dep": "1.0.0", "peer-deps-too": "1.0.0" } },
+          importer: `    dependencies:
+      one-dep:
+        specifier: 1.0.0
+        version: 1.0.0
+      peer-deps-too:
+        specifier: 1.0.0
+        version: 1.0.0`,
+        },
+        {
+          group: "devDependencies",
+          packageJson: { dependencies: { "one-dep": "1.0.0" }, devDependencies: { "peer-deps-too": "1.0.0" } },
+          importer: `    dependencies:
+      one-dep:
+        specifier: 1.0.0
+        version: 1.0.0
+    devDependencies:
+      peer-deps-too:
+        specifier: 1.0.0
+        version: 1.0.0`,
+        },
+      ])(
+        "peer-deps-too in $group keys its isolated store entry like a reinstall and like a fresh install",
+        async ({ packageJson, importer }) => {
+          const files = unmetPeerProject(importer, packageJson);
+          const { packageDir } = await verdaccio.createTestDir({ bunfigOpts: { linker: "isolated" }, files });
+
+          const install = await run(packageDir, "install");
+
+          expect(install.stderr).toContain("migrated lockfile from pnpm-lock.yaml");
+          expect(install.exitCode).toBe(0);
+          const migrated = await bunLockOf(packageDir);
+          expect(migrated).toContain(`{ "peerDependencies": { "no-deps": "*" } }`);
+          const store = storeEntries(packageDir);
+          expect(store).toEqual([
+            "no-deps@1.0.1",
+            "one-dep@1.0.0",
+            expect.stringMatching(/^peer-deps-too@1\.0\.0\+[0-9a-f]{16}$/),
+          ]);
+
+          const reinstall = await run(packageDir, "install");
+
+          expect(reinstall.stdout).toContain("(no changes)");
+          expect(reinstall.exitCode).toBe(0);
+          expect(await bunLockOf(packageDir)).toBe(migrated);
+          expect(storeEntries(packageDir)).toEqual(store);
+
+          const { packageDir: fresh } = await verdaccio.createTestDir({
+            bunfigOpts: { linker: "isolated" },
+            files: { "package.json": files["package.json"] },
+          });
+
+          const freshInstall = await run(fresh, "install");
+
+          expect(freshInstall.stderr).toContain("Saved lockfile");
+          expect(freshInstall.exitCode).toBe(0);
+          expect(storeEntries(fresh)).toEqual(store);
+        },
+      );
+
+      // The root's and a workspace's own peers come from package.json and are unbound the same way; the
+      // isolated linker links a bound peer into the importer's node_modules.
+      test.concurrent("the root's and a workspace's own peers are linked by the migrating install", async () => {
+        const manifests = {
+          "package.json": JSON.stringify({
+            name: "importer-peers",
+            workspaces: ["apps/*"],
+            dependencies: { "one-dep": "1.0.0" },
+            peerDependencies: { "no-deps": "*" },
+          }),
+          "apps/a/package.json": JSON.stringify({ name: "a", peerDependencies: { "no-deps": "*" } }),
+        };
+        const { packageDir } = await verdaccio.createTestDir({
+          bunfigOpts: { linker: "isolated" },
+          files: {
+            ...manifests,
+            "pnpm-lock.yaml": `lockfileVersion: '9.0'
+
+settings:
+  autoInstallPeers: false
+
+importers:
+
+  .:
+    dependencies:
+      one-dep:
+        specifier: 1.0.0
+        version: 1.0.0
+
+  apps/a: {}
+
+packages:
+
+  no-deps@1.0.1:
+    resolution: {integrity: ${NO_DEPS_1_0_1_INTEGRITY}}
+
+  one-dep@1.0.0:
+    resolution: {integrity: ${ONE_DEP_1_0_0_INTEGRITY}}
+
+snapshots:
+
+  no-deps@1.0.1: {}
+
+  one-dep@1.0.0:
+    dependencies:
+      no-deps: 1.0.1
+`,
+          },
+        });
+        const linked = (dir: string) => ({
+          root: readdirSync(join(dir, "node_modules"))
+            .filter(name => name !== ".bun")
+            .sort(),
+          a: existsSync(join(dir, "apps/a/node_modules")) ? readdirSync(join(dir, "apps/a/node_modules")).sort() : [],
+        });
+
+        const install = await run(packageDir, "install");
+
+        expect(install.stderr).toContain('skipped peer "no-deps" of the root package');
+        expect(install.stderr).toContain('skipped peer "no-deps" of workspace "apps/a"');
+        expect(install.stderr).toContain("migrated lockfile from pnpm-lock.yaml");
+        expect(install.exitCode).toBe(0);
+        const migrated = await bunLockOf(packageDir);
+        expect(linked(packageDir)).toEqual({ root: ["no-deps", "one-dep"], a: ["no-deps"] });
+
+        const reinstall = await run(packageDir, "install");
+
+        expect(reinstall.stdout).toContain("(no changes)");
+        expect(reinstall.exitCode).toBe(0);
+        expect(await bunLockOf(packageDir)).toBe(migrated);
+        expect(linked(packageDir)).toEqual({ root: ["no-deps", "one-dep"], a: ["no-deps"] });
+
+        const { packageDir: fresh } = await verdaccio.createTestDir({
+          bunfigOpts: { linker: "isolated" },
+          files: manifests,
+        });
+
+        const freshInstall = await run(fresh, "install");
+
+        expect(freshInstall.stderr).toContain("Saved lockfile");
+        expect(freshInstall.exitCode).toBe(0);
+        expect(linked(fresh)).toEqual({ root: ["no-deps", "one-dep"], a: ["no-deps"] });
+      });
+    });
+
     const linkedPeerFiles = {
       "package.json": JSON.stringify({
         name: "v9-linked-peer",
diff --git a/test/cli/install/migration/yarn-lock-migration.test.ts b/test/cli/install/migration/yarn-lock-migration.test.ts
index c83cec240d83..bcaa8f63f27d 100644
--- a/test/cli/install/migration/yarn-lock-migration.test.ts
+++ b/test/cli/install/migration/yarn-lock-migration.test.ts
@@ -1,6 +1,6 @@
-import { describe, expect, test } from "bun:test";
+import { afterAll, beforeAll, describe, expect, test } from "bun:test";
 import fs from "fs";
-import { bunEnv, bunExe, tempDir } from "harness";
+import { bunEnv, bunExe, tempDir, VerdaccioRegistry } from "harness";
 import { join } from "path";
 
 describe("yarn.lock migration basic", () => {
@@ -1712,3 +1712,100 @@ uses-foo15@1.0.0:
     });
   });
 });
+
+describe("installing from a migrated yarn.lock", () => {
+  const verdaccio = new VerdaccioRegistry();
+  const REGISTRY_PACKAGES = join(import.meta.dir, "..", "registry", "packages");
+
+  beforeAll(async () => {
+    await verdaccio.start();
+  });
+
+  afterAll(() => {
+    verdaccio.stop();
+  });
+
+  // Keyed by the exact spec that requested it, as yarn writes pinned dependencies.
+  function yarnEntry(name: string, version: string, body = "") {
+    const { shasum, integrity } = JSON.parse(fs.readFileSync(join(REGISTRY_PACKAGES, name, "package.json"), "utf8"))
+      .versions[version].dist;
+    return `${name}@${version}:
+  version "${version}"
+  resolved "${verdaccio.registryUrl()}${name}/-/${name}-${version}.tgz#${shasum}"
+  integrity ${integrity}
+${body}`;
+  }
+
+  async function install(cwd: string) {
+    await using proc = Bun.spawn({
+      cmd: [bunExe(), "install"],
+      cwd,
+      env: bunEnv,
+      stdout: "pipe",
+      stderr: "pipe",
+    });
+    const [stdout, stderr, exitCode] = await Promise.all([proc.stdout.text(), proc.stderr.text(), proc.exited]);
+    return { stdout, stderr, exitCode };
+  }
+
+  const storeEntries = (dir: string) =>
+    fs
+      .readdirSync(join(dir, "node_modules", ".bun"))
+      .filter(name => name !== "node_modules")
+      .sort();
+
+  test("a peer yarn.lock has no entry for is bound by the install that migrates", async () => {
+    // yarn.lock keys entries by the specs that requested them; nothing requested `no-deps@*`, so the
+    // migration cannot bind peer-deps-too's peer from the file. Loading the migrated bun.lock binds it to
+    // the no-deps at the root and the isolated store keys peer-deps-too by that binding, so the migrating
+    // install has to bind it the same way or the next install re-keys the entry.
+    const packageJson = JSON.stringify({
+      name: "unmet-peer",
+      dependencies: { "one-dep": "1.0.0", "peer-deps-too": "1.0.0" },
+    });
+    const { packageDir } = await verdaccio.createTestDir({
+      bunfigOpts: { linker: "isolated" },
+      files: {
+        "package.json": packageJson,
+        "yarn.lock": `# THIS IS AN AUTOGENERATED FILE. DO NOT EDIT THIS FILE DIRECTLY.
+# yarn lockfile v1
+
+
+${yarnEntry("no-deps", "1.0.1")}
+${yarnEntry("one-dep", "1.0.0", `  dependencies:\n    no-deps "1.0.1"\n`)}
+${yarnEntry("peer-deps-too", "1.0.0", `  peerDependencies:\n    no-deps "*"\n`)}`,
+      },
+    });
+
+    const migrating = await install(packageDir);
+
+    expect(migrating.stderr).toContain("migrated lockfile from yarn.lock");
+    expect(migrating.exitCode).toBe(0);
+    const migrated = fs.readFileSync(join(packageDir, "bun.lock"), "utf8");
+    expect(migrated).toContain(`"peerDependencies": { "no-deps": "*" }`);
+    const store = storeEntries(packageDir);
+    expect(store).toEqual([
+      "no-deps@1.0.1",
+      "one-dep@1.0.0",
+      expect.stringMatching(/^peer-deps-too@1\.0\.0\+[0-9a-f]{16}$/),
+    ]);
+
+    const reinstall = await install(packageDir);
+
+    expect(reinstall.stdout).toContain("(no changes)");
+    expect(reinstall.exitCode).toBe(0);
+    expect(fs.readFileSync(join(packageDir, "bun.lock"), "utf8")).toBe(migrated);
+    expect(storeEntries(packageDir)).toEqual(store);
+
+    const { packageDir: fresh } = await verdaccio.createTestDir({
+      bunfigOpts: { linker: "isolated" },
+      files: { "package.json": packageJson },
+    });
+
+    const freshInstall = await install(fresh);
+
+    expect(freshInstall.stderr).toContain("Saved lockfile");
+    expect(freshInstall.exitCode).toBe(0);
+    expect(storeEntries(fresh)).toEqual(store);
+  });
+});

From 86f127bc75f9ccd2e4dfa3207464deac013bf64e Mon Sep 17 00:00:00 2001
From: robobun <117481402+robobun@users.noreply.github.com>
Date: Mon, 17 Aug 2026 01:04:12 +0000
Subject: [PATCH 008/258] install: bind a multi-path package's edges from the
 bun.lock row that prints the binding (#39347)

---
 src/install/lockfile/bun.lock.rs  |  76 ++++++-
 test/cli/install/bun-lock.test.ts | 328 +++++++++++++++++++++++-------
 2 files changed, 329 insertions(+), 75 deletions(-)

diff --git a/src/install/lockfile/bun.lock.rs b/src/install/lockfile/bun.lock.rs
index 086bf9b53d2f..412151d0196b 100644
--- a/src/install/lockfile/bun.lock.rs
+++ b/src/install/lockfile/bun.lock.rs
@@ -1674,6 +1674,51 @@ pub(crate) enum ResolveError {
     Unresolvable,
 }
 
+/// Where `PkgMap::find_resolution` found the entry it returned.
+#[derive(Debug, Clone, Copy, Eq, PartialEq)]
+enum FoundAt {
+    /// `<pkg_path>/<name>`.
+    OwnPath,
+    /// `<some enclosing path>/<name>`.
+    EnclosingPath,
+    /// The top-level `<name>` entry.
+    Root,
+}
+
+/// Which row binds an edge of a package printed at more than one path. `append_package_dedupe`
+/// gives every such row the same package, so each row binds the same edges again, and the
+/// rows can walk into different copies of a peer. A row overwrites an earlier row's binding
+/// only when its find says at least as much about the binding; rows whose finds say the same
+/// keep the last one, and a package printed once binds each edge exactly once, as before.
+///
+/// What a find says follows from where `Tree::hoist_dependency` puts the package an edge is
+/// bound to: nested in the dependent's own path when a copy above blocks it, or at the root
+/// when nothing above holds the name. It never ends up at an enclosing path in between; a copy
+/// found there was placed for another package's edge, and this edge deduped onto it (a peer
+/// the copy satisfies), which says nothing about what the edge is bound to.
+#[derive(Debug, Clone, Copy, Eq, PartialEq, PartialOrd, Ord)]
+enum RowEvidence {
+    Unbound,
+    /// A copy found by walking up. Every walked find of an optional peer ranks here: the
+    /// hoister rebinds those to whatever each placement dedupes onto
+    /// (`HoistDependencyResult::Rebind`), so which copy a row walked into decides nothing.
+    Walked,
+    /// The root's copy, which may be this edge's own binding, placed there from this row.
+    WalkedToRoot,
+    /// The copy printed in the package's own path, which is only there for the package's own edge.
+    OwnEntry,
+}
+
+impl RowEvidence {
+    fn of(found_at: FoundAt, dep: &Dependency) -> RowEvidence {
+        match found_at {
+            FoundAt::OwnPath => RowEvidence::OwnEntry,
+            FoundAt::Root if !dep.behavior.is_optional_peer() => RowEvidence::WalkedToRoot,
+            FoundAt::Root | FoundAt::EnclosingPath => RowEvidence::Walked,
+        }
+    }
+}
+
 impl<T> PkgMap<T> {
     // No `Entry` alias — inherent associated types are
     // unstable; callers name `T` directly.
@@ -1714,7 +1759,7 @@ impl<T> PkgMap<T> {
         dep: &Dependency,
         string_buf: &[u8],
         path_buf: &mut [u8],
-    ) -> Result<&T, ResolveError> {
+    ) -> Result<(&T, FoundAt), ResolveError> {
         self.find_resolution_impl(pkg_path, dep, string_buf, path_buf, None)
     }
 
@@ -1735,7 +1780,7 @@ impl<T> PkgMap<T> {
         string_buf: &[u8],
         path_buf: &mut [u8],
         bundled_pkgs: &PkgPathSet,
-    ) -> Result<&T, ResolveError> {
+    ) -> Result<(&T, FoundAt), ResolveError> {
         self.find_resolution_impl(pkg_path, dep, string_buf, path_buf, Some(bundled_pkgs))
     }
 
@@ -1746,7 +1791,7 @@ impl<T> PkgMap<T> {
         string_buf: &[u8],
         path_buf: &mut [u8],
         bundled_pkgs: Option<&PkgPathSet>,
-    ) -> Result<&T, ResolveError> {
+    ) -> Result<(&T, FoundAt), ResolveError> {
         let dep_name = dep.name.slice(string_buf);
 
         if pkg_path.len() + 1 + dep_name.len() > path_buf.len() {
@@ -1757,6 +1802,7 @@ impl<T> PkgMap<T> {
         path_buf[pkg_path.len()] = b'/';
         let mut offset = pkg_path.len() + 1;
 
+        let mut own_path = true;
         let mut at_bundle_root = false;
         let mut valid = true;
         while valid {
@@ -1764,7 +1810,14 @@ impl<T> PkgMap<T> {
             let res_path = &path_buf[0..offset + dep_name.len()];
 
             if let Some(entry) = self.map.get(res_path) {
-                return Ok(entry);
+                let found_at = if own_path {
+                    FoundAt::OwnPath
+                } else if offset == 0 {
+                    FoundAt::Root
+                } else {
+                    FoundAt::EnclosingPath
+                };
+                return Ok((entry, found_at));
             }
 
             if offset == 0 || at_bundle_root {
@@ -1774,6 +1827,7 @@ impl<T> PkgMap<T> {
             if let Some(bundled_pkgs) = bundled_pkgs {
                 at_bundle_root = bundled_pkgs.contains(&path_buf[0..offset - 1]);
             }
+            own_path = false;
 
             let Some(slash) = strings::last_index_of_char(&path_buf[0..offset - 1], b'/') else {
                 offset = 0;
@@ -3213,6 +3267,11 @@ pub(crate) fn parse_into_binary_lockfile(
         }
 
         // then each package dependency
+        //
+        // A package printed at several paths comes through here once per path; see
+        // `RowEvidence` for which path's find an edge ends up bound to. Edges bound by
+        // version below do not depend on the path, so every row writes them.
+        let mut bound_by: Vec<RowEvidence> = vec![RowEvidence::Unbound; dependencies.len()];
         for row in pkg_rows {
             let pkg_path = row.key.slice();
 
@@ -3264,7 +3323,14 @@ pub(crate) fn parse_into_binary_lockfile(
                             pkg_map.find_resolution(pkg_path, dep, string_buf, &mut path_buf[..])
                         };
                         match found {
-                            Ok(&id) => id,
+                            Ok((&id, found_at)) => {
+                                let evidence = RowEvidence::of(found_at, dep);
+                                if bound_by[dep_id as usize] > evidence {
+                                    continue 'deps;
+                                }
+                                bound_by[dep_id as usize] = evidence;
+                                id
+                            }
                             Err(ResolveError::InvalidPackageKey) => {
                                 log.add_error(Some(source), row.key_loc, b"Invalid package path");
                                 return Err(ParseError::InvalidPackageKey);
diff --git a/test/cli/install/bun-lock.test.ts b/test/cli/install/bun-lock.test.ts
index be0f1d31ad2b..26e808b193d6 100644
--- a/test/cli/install/bun-lock.test.ts
+++ b/test/cli/install/bun-lock.test.ts
@@ -1932,13 +1932,79 @@ it("an optional peer is rebound when another version of its package takes the sl
   expect(await file(join(packageDir, "bun.lock")).text()).toBe(lockfile);
 });
 
+/** `name -> version -> extra package.json fields` for `serveRegistry`. */
+type Manifests = Record<string, Record<string, Record<string, unknown>>>;
+
+// A registry serving exactly `manifests`, each version as a tarball holding just its package.json.
+async function serveRegistry(manifests: Manifests) {
+  const tarballs = new Map<string, Uint8Array>();
+  for (const [name, versions] of Object.entries(manifests)) {
+    for (const [version, extra] of Object.entries(versions)) {
+      const archive = new Bun.Archive(
+        { "package/package.json": JSON.stringify({ name, version, ...extra }) },
+        { compress: "gzip" },
+      );
+      tarballs.set(`/${name}-${version}.tgz`, await archive.bytes());
+    }
+  }
+  const requests: string[] = [];
+  const server = Bun.serve({
+    port: 0,
+    fetch(request) {
+      const { origin, pathname } = new URL(request.url);
+      requests.push(pathname);
+      const tarball = tarballs.get(pathname);
+      if (tarball) return new Response(tarball);
+      const name = pathname.slice(1);
+      const entry = manifests[name];
+      if (!entry) return new Response("not found", { status: 404 });
+      const versions: Record<string, unknown> = {};
+      for (const [version, extra] of Object.entries(entry)) {
+        versions[version] = { name, version, dist: { tarball: `${origin}/${name}-${version}.tgz` }, ...extra };
+      }
+      return Response.json(
+        { name, versions, "dist-tags": { latest: Object.keys(entry).at(-1) } },
+        // Like registry.npmjs.org. Within this window bun resolves from the
+        // manifest cache without going back to the registry.
+        { headers: { "cache-control": "public, max-age=300" } },
+      );
+    },
+  });
+  return {
+    url: server.url.href,
+    origin: server.url.origin,
+    requests,
+    [Symbol.dispose]() {
+      server.stop(true);
+    },
+  };
+}
+
+async function installWithOwnCache(cwd: string, ...args: string[]) {
+  await using proc = spawn({
+    cmd: [bunExe(), "install", ...args],
+    cwd,
+    // Request assertions need a cache of their own per project: the environment's
+    // cache dir takes precedence over bunfig, and a package extracted there by one
+    // of the concurrent tests is not downloaded again.
+    env: { ...env, BUN_INSTALL_CACHE_DIR: join(cwd, ".bun-cache") },
+    stdout: "pipe",
+    stderr: "pipe",
+    // Only matters if an install never returns.
+    timeout: 30_000,
+  });
+  const [out, err, code] = await Promise.all([proc.stdout.text(), proc.stderr.text(), proc.exited]);
+  expect({ args, err, code }).toMatchObject({ args, err: expect.not.stringContaining("error:"), code: 0 });
+  return { out, err };
+}
+
 // https://github.com/oven-sh/bun/issues/26046
 // A required peer that nothing in the tree provides and that no published
 // version satisfies stays unresolved. The bun.lock written afterwards has to
 // load back, and resolving it again with every manifest already in the cache
 // has to finish (it used to retry the cached manifest forever).
 describe.each(["hoisted", "isolated"] as const)("peer no published version satisfies (%s linker)", linker => {
-  const manifests: Record<string, Record<string, Record<string, unknown>>> = {
+  const manifests: Manifests = {
     "has-unmet-peer": { "1.0.0": { peerDependencies: { "peer-target": "^1.0.1" } } },
     "peer-target": { "2.0.1": {} },
   };
@@ -1946,50 +2012,6 @@ describe.each(["hoisted", "isolated"] as const)("peer no published version satis
   const unmetPeerWarning =
     'warn: No version matching "^1.0.1" found for peer dependency "peer-target" (but package exists)';
 
-  async function serveRegistry() {
-    const tarballs = new Map<string, Uint8Array>();
-    for (const [name, versions] of Object.entries(manifests)) {
-      for (const [version, extra] of Object.entries(versions)) {
-        const archive = new Bun.Archive(
-          { "package/package.json": JSON.stringify({ name, version, ...extra }) },
-          { compress: "gzip" },
-        );
-        tarballs.set(`/${name}-${version}.tgz`, await archive.bytes());
-      }
-    }
-    const requests: string[] = [];
-    const server = Bun.serve({
-      port: 0,
-      fetch(request) {
-        const { origin, pathname } = new URL(request.url);
-        requests.push(pathname);
-        const tarball = tarballs.get(pathname);
-        if (tarball) return new Response(tarball);
-        const name = pathname.slice(1);
-        const entry = manifests[name];
-        if (!entry) return new Response("not found", { status: 404 });
-        const versions: Record<string, unknown> = {};
-        for (const [version, extra] of Object.entries(entry)) {
-          versions[version] = { name, version, dist: { tarball: `${origin}/${name}-${version}.tgz` }, ...extra };
-        }
-        return Response.json(
-          { name, versions, "dist-tags": { latest: Object.keys(entry).at(-1) } },
-          // Like registry.npmjs.org. Within this window bun resolves from the
-          // manifest cache without going back to the registry.
-          { headers: { "cache-control": "public, max-age=300" } },
-        );
-      },
-    });
-    return {
-      url: server.url.href,
-      origin: server.url.origin,
-      requests,
-      [Symbol.dispose]() {
-        server.stop(true);
-      },
-    };
-  }
-
   function createProject(registryUrl: string, files: Record<string, string>) {
     return tempDir("unmet-peer-", {
       ...files,
@@ -1997,32 +2019,14 @@ describe.each(["hoisted", "isolated"] as const)("peer no published version satis
     });
   }
 
-  async function install(cwd: string, ...args: string[]) {
-    await using proc = spawn({
-      cmd: [bunExe(), "install", ...args],
-      cwd,
-      // The request assertions below need a cache of their own per project: the
-      // environment's cache dir takes precedence over bunfig, and a package
-      // extracted there by one of the concurrent tests is not downloaded again.
-      env: { ...env, BUN_INSTALL_CACHE_DIR: join(cwd, ".bun-cache") },
-      stdout: "pipe",
-      stderr: "pipe",
-      // Only matters if an install never returns.
-      timeout: 30_000,
-    });
-    const [out, err, code] = await Promise.all([proc.stdout.text(), proc.stderr.text(), proc.exited]);
-    expect({ args, err, code }).toMatchObject({ args, err: expect.not.stringContaining("error:"), code: 0 });
-    return { out, err };
-  }
-
   it.concurrent("declared by a registry package", async () => {
-    using registry = await serveRegistry();
+    using registry = await serveRegistry(manifests);
     using dir = createProject(registry.url, {
       "package.json": JSON.stringify({ name: "app", dependencies: { "has-unmet-peer": "1.0.0" } }),
     });
     const lockfilePath = join(String(dir), "bun.lock");
 
-    let { err } = await install(String(dir));
+    let { err } = await installWithOwnCache(String(dir));
     expect(err).toContain(unmetPeerWarning);
     expect(err).toContain("Saved lockfile");
     expect(registry.requests.toSorted()).toEqual(["/has-unmet-peer", "/has-unmet-peer-1.0.0.tgz", "/peer-target"]);
@@ -2047,7 +2051,7 @@ describe.each(["hoisted", "isolated"] as const)("peer no published version satis
     `);
     expect(await exists(join(String(dir), "node_modules", "peer-target"))).toBeFalse();
 
-    ({ err } = await install(String(dir), "--frozen-lockfile"));
+    ({ err } = await installWithOwnCache(String(dir), "--frozen-lockfile"));
     expect(err).not.toContain("Ignoring lockfile");
     expect(await file(lockfilePath).text()).toBe(lockfile);
 
@@ -2056,14 +2060,14 @@ describe.each(["hoisted", "isolated"] as const)("peer no published version satis
     await rm(lockfilePath);
     await rm(join(String(dir), "node_modules"), { recursive: true });
     registry.requests.length = 0;
-    ({ err } = await install(String(dir)));
+    ({ err } = await installWithOwnCache(String(dir)));
     expect(err).toContain(unmetPeerWarning);
     expect(registry.requests).toEqual([]);
     expect(await file(lockfilePath).text()).toBe(lockfile);
   });
 
   it.concurrent("declared by the root package and a workspace", async () => {
-    using registry = await serveRegistry();
+    using registry = await serveRegistry(manifests);
     using dir = createProject(registry.url, {
       "package.json": JSON.stringify({
         name: "app",
@@ -2074,7 +2078,7 @@ describe.each(["hoisted", "isolated"] as const)("peer no published version satis
     });
     const lockfilePath = join(String(dir), "bun.lock");
 
-    let { err } = await install(String(dir));
+    let { err } = await installWithOwnCache(String(dir));
     expect(err).toContain(unmetPeerWarning);
     expect(err).toContain("Saved lockfile");
     expect(registry.requests).toEqual(["/peer-target"]);
@@ -2104,8 +2108,192 @@ describe.each(["hoisted", "isolated"] as const)("peer no published version satis
       "
     `);
 
-    ({ err } = await install(String(dir), "--frozen-lockfile"));
+    ({ err } = await installWithOwnCache(String(dir), "--frozen-lockfile"));
     expect(err).not.toContain("Ignoring lockfile");
     expect(await file(lockfilePath).text()).toBe(lockfile);
   });
 });
+
+// A package is printed at more than one path when another version of it holds the slot above
+// one of its dependents (here the root holds one version, a parent holds the other, and the
+// dependents under that parent get the root's version printed again next to them). Its edges
+// are in the file once, so loading binds them once per printed path, and the paths can find
+// different copies of a peer; the path printed last used to win, so what an edge loaded as
+// depended on how its dependents' parents happened to sort.
+describe("loading bun.lock binds the edges of a package printed at several paths", () => {
+  /** `path -> "name@version"` for every row of the packages object. */
+  const printedPackages = (lockfile: string) =>
+    Object.fromEntries(Array.from(lockfile.matchAll(/^ {4}"([^"]+)": \["([^"]+)"/gm), m => [m[1], m[2]]));
+
+  const manifests: Manifests = {
+    // star-peer@1.0.0's peer edge is the one being loaded; 2.0.0 exists so mid's copy of 1.0.0 nests.
+    "star-peer": { "1.0.0": { peerDependencies: { "peer-target": "*" } }, "2.0.0": {} },
+    "peer-target": { "1.0.0": {}, "1.1.0": {} },
+    // mid@1.0.0 is the second dependent of star-peer@1.0.0 and holds the other peer-target next to
+    // it; mid@2.0.0 at the root is what keeps mid@1.0.0 nested under parent.
+    "mid": { "1.0.0": { dependencies: { "star-peer": "1.0.0", "peer-target": "1.1.0" } }, "2.0.0": {} },
+    "parent": { "1.0.0": { dependencies: { "star-peer": "2.0.0", "mid": "1.0.0" } } },
+  };
+
+  it.concurrent("a `*` peer is read back from the copy its root-level printing placed at the root", async () => {
+    using registryServer = await serveRegistry(manifests);
+    const packageJson = (dependencies: Record<string, string>) => JSON.stringify({ name: "app", dependencies });
+    using dir = tempDir("bun-lock-several-paths-", {
+      "bunfig.toml": Bun.TOML.stringify({ install: { registry: registryServer.url } }),
+      "package.json": packageJson({ "star-peer": "1.0.0", "peer-target": "1.0.0", "mid": "2.0.0" }),
+    });
+    const cwd = String(dir);
+    const lockfilePath = join(cwd, "bun.lock");
+
+    await installWithOwnCache(cwd);
+    expect(printedPackages(await file(lockfilePath).text())).toEqual({
+      "mid": "mid@2.0.0",
+      "peer-target": "peer-target@1.0.0",
+      "star-peer": "star-peer@1.0.0",
+    });
+
+    // peer-target leaves package.json as parent enters it. star-peer's peer edge is still bound
+    // to peer-target@1.0.0, which keeps it in the file: the edge's own copy is placed at the root
+    // and mid's 1.1.0 is printed next to mid, which is where star-peer's second printing finds
+    // the name first.
+    await write(join(cwd, "package.json"), packageJson({ "star-peer": "1.0.0", "mid": "2.0.0", "parent": "1.0.0" }));
+    await installWithOwnCache(cwd);
+    expect(printedPackages(await file(lockfilePath).text())).toEqual({
+      "mid": "mid@2.0.0",
+      "parent": "parent@1.0.0",
+      "peer-target": "peer-target@1.0.0",
+      "star-peer": "star-peer@1.0.0",
+      "parent/mid": "mid@1.0.0",
+      "parent/star-peer": "star-peer@2.0.0",
+      "parent/mid/peer-target": "peer-target@1.1.0",
+      "parent/mid/star-peer": "star-peer@1.0.0",
+    });
+
+    // Loading used to bind the edge from parent/mid/star-peer, the printing that comes last, to
+    // the 1.1.0 next to it. Nothing held peer-target@1.0.0 any more, so the tree built from the
+    // file differed from the file: --frozen-lockfile rejected it and an install rewrote it.
+    await rm(join(cwd, "node_modules"), { recursive: true });
+    await installWithOwnCache(cwd, "--frozen-lockfile");
+    expect(await file(join(cwd, "node_modules", "peer-target", "package.json")).json()).toMatchObject({
+      version: "1.0.0",
+    });
+    expect(
+      await file(
+        join(cwd, "node_modules", "parent", "node_modules", "mid", "node_modules", "peer-target", "package.json"),
+      ).json(),
+    ).toMatchObject({ version: "1.1.0" });
+  });
+
+  // The shapes below are written by hand so nothing needs to be fetched: every row has an empty
+  // registry URL and integrity, which --lockfile-only and --frozen-lockfile --dry-run never read.
+  const pkg = (nameAndVersion: string, info: object = {}) => [nameAndVersion, "", info, ""];
+  const printedDepth = (path: string) => path.split("/").filter(segment => !segment.startsWith("@")).length;
+
+  async function writeProject(root: Record<string, unknown>, packages: Record<string, unknown[]>) {
+    const { packageDir } = await registry.createTestDir({ bunfigOpts: { saveTextLockfile: true } });
+    // Rows in the order bun prints them (depth, then path), since loading reads them in file order.
+    const rows = Object.entries(packages).sort(([a], [b]) => printedDepth(a) - printedDepth(b) || a.localeCompare(b));
+    await Promise.all([
+      write(join(packageDir, "package.json"), JSON.stringify({ name: "foo", ...root })),
+      write(
+        join(packageDir, "bun.lock"),
+        JSON.stringify({
+          lockfileVersion: 1,
+          configVersion: 0,
+          workspaces: { "": { name: "foo", ...root } },
+          packages: Object.fromEntries(rows),
+        }),
+      ),
+    ]);
+    return { packageDir, run: makeInstallRunner(packageDir) };
+  }
+
+  // dup@1.0.0 is printed under a-parent and under z-parent (the root holds dup@2.0.0). Its
+  // optional peer wants no-deps@1.0.0 exactly; the root's no-deps is one-dep's 1.0.1, which the
+  // edge cannot be deduped onto (out of range, not a root dependency), so the copy the edge is
+  // bound to gets printed next to dup. The file records one such copy, under `holder`; the
+  // printing under the other parent walks up to the root's 1.0.1. An entry in a package's own
+  // path is only ever there for that package's own edge, so the edge has to load as 1.0.0
+  // whichever parent sorts last, and the tree then holds 1.0.0 next to both printings. With the
+  // record under a-parent, binding from the last printing read the root's 1.0.1 instead and the
+  // re-save dropped the record. (uses-old keeps no-deps@1.0.0 in the file: a version held only
+  // by optional peer edges is dropped on save.)
+  it.concurrent.each(["a-parent", "z-parent"])(
+    "an optional peer's copy printed next to its %s printing is read from there",
+    async holder => {
+      const dup = pkg("dup@1.0.0", { peerDependencies: { "no-deps": "1.0.0" }, optionalPeers: ["no-deps"] });
+      const packages: Record<string, unknown[]> = {
+        "a-parent": pkg("a-parent@1.0.0", { dependencies: { "dup": "1.0.0" } }),
+        "dup": pkg("dup@2.0.0"),
+        "no-deps": pkg("no-deps@1.0.1"),
+        "one-dep": pkg("one-dep@1.0.0", { dependencies: { "no-deps": "1.0.1" } }),
+        "uses-old": pkg("uses-old@1.0.0", { dependencies: { "no-deps": "1.0.0" } }),
+        "z-parent": pkg("z-parent@1.0.0", { dependencies: { "dup": "1.0.0" } }),
+        "a-parent/dup": dup,
+        "uses-old/no-deps": pkg("no-deps@1.0.0"),
+        "z-parent/dup": dup,
+        [`${holder}/dup/no-deps`]: pkg("no-deps@1.0.0"),
+      };
+      const { packageDir, run } = await writeProject(
+        {
+          dependencies: {
+            "a-parent": "1.0.0",
+            "dup": "2.0.0",
+            "one-dep": "1.0.0",
+            "uses-old": "1.0.0",
+            "z-parent": "1.0.0",
+          },
+        },
+        packages,
+      );
+
+      await run(["install", "--lockfile-only"]);
+      const saved = await file(join(packageDir, "bun.lock")).text();
+      expect(printedPackages(saved)).toEqual({
+        "a-parent": "a-parent@1.0.0",
+        "dup": "dup@2.0.0",
+        "no-deps": "no-deps@1.0.1",
+        "one-dep": "one-dep@1.0.0",
+        "uses-old": "uses-old@1.0.0",
+        "z-parent": "z-parent@1.0.0",
+        "a-parent/dup": "dup@1.0.0",
+        "uses-old/no-deps": "no-deps@1.0.0",
+        "z-parent/dup": "dup@1.0.0",
+        "a-parent/dup/no-deps": "no-deps@1.0.0",
+        "z-parent/dup/no-deps": "no-deps@1.0.0",
+      });
+
+      await run(["install", "--frozen-lockfile", "--dry-run"]);
+      await run(["install", "--lockfile-only"]);
+      expect(await file(join(packageDir, "bun.lock")).text()).toBe(saved);
+    },
+  );
+
+  // Same two printings of dup@1.0.0, but nothing is printed for its optional peer: the printing
+  // under a-q walks up to the root's no-deps@1.0.0 (b-old's, out of range), the one under z-p
+  // finds z-p's own 1.1.0, which the range accepts. This is the file a fresh install writes, and
+  // it has to keep loading from the printing that comes last (z-p's). The hoister rebinds an
+  // optional peer to whatever copy a printing dedupes onto, so loading it as the root's copy,
+  // the way the `*` peer in the first test is, builds a tree in which a-q's printing dedupes
+  // onto the root copy and z-p's then rebinds the edge to 1.1.0; the tree the save rebuilds
+  // from that binding nests 1.1.0 under a-q/dup, and --frozen-lockfile reports the difference
+  // as a changed lockfile.
+  it.concurrent("an optional peer printed nowhere keeps loading from the last printing", async () => {
+    const dup = pkg("dup@1.0.0", { peerDependencies: { "no-deps": "^1.1.0" }, optionalPeers: ["no-deps"] });
+    const { run } = await writeProject(
+      { dependencies: { "a-q": "1.0.0", "b-old": "1.0.0", "dup": "2.0.0", "z-p": "1.0.0" } },
+      {
+        "a-q": pkg("a-q@1.0.0", { dependencies: { "dup": "1.0.0" } }),
+        "b-old": pkg("b-old@1.0.0", { dependencies: { "no-deps": "1.0.0" } }),
+        "dup": pkg("dup@2.0.0"),
+        "no-deps": pkg("no-deps@1.0.0"),
+        "z-p": pkg("z-p@1.0.0", { dependencies: { "dup": "1.0.0", "no-deps": "1.1.0" } }),
+        "a-q/dup": dup,
+        "z-p/dup": dup,
+        "z-p/no-deps": pkg("no-deps@1.1.0"),
+      },
+    );
+
+    await run(["install", "--frozen-lockfile", "--dry-run"]);
+  });
+});

From f1f8499b8cccb302ea447bbac602fe2ea239bc63 Mon Sep 17 00:00:00 2001
From: robobun <117481402+robobun@users.noreply.github.com>
Date: Mon, 17 Aug 2026 01:04:15 +0000
Subject: [PATCH 009/258] install: only re-resolve rows a package still owns
 when overrides or catalogs change (#38849)

---
 .../PackageManager/install_with_manager.rs    | 118 ++++++++---------
 test/cli/install/catalogs.test.ts             | 107 ++++++++++++++++
 test/cli/install/nested-overrides.test.ts     | 121 +++++++++++++++++-
 3 files changed, 282 insertions(+), 64 deletions(-)

diff --git a/src/install/PackageManager/install_with_manager.rs b/src/install/PackageManager/install_with_manager.rs
index 06c22d2f9a4c..71c9c997d5a6 100644
--- a/src/install/PackageManager/install_with_manager.rs
+++ b/src/install/PackageManager/install_with_manager.rs
@@ -485,70 +485,26 @@ pub fn install_with_manager(
                         pinned_rows = enqueue_transitive(manager, &transitive, invalidates_rows)?;
                     }
 
-                    // `enqueueDependencyWithMain` can reach `Lockfile.Package.fromNPM`,
-                    // which grows `buffers.dependencies` and may reallocate it.
-                    // Iterate by index against a snapshot of the original length and
-                    // copy each entry to the stack so neither the loop nor the callee
-                    // ever reads through a pointer into the old backing storage.
-                    if manager.summary.overrides_changed && !all_name_hashes.is_empty() {
-                        let dependencies_len = manager.lockfile.buffers.dependencies.len();
-                        for dependency_i in 0..dependencies_len {
-                            if pinned_rows.is_set_allow_out_of_bound(dependency_i, false) {
-                                continue;
-                            }
-                            let dependency =
-                                manager.lockfile.buffers.dependencies[dependency_i].clone();
-                            if all_name_hashes.binary_search(&dependency.name_hash).is_ok() {
-                                manager.lockfile.buffers.resolutions[dependency_i] =
-                                    invalid_package_id;
-                                if let Err(err) = enqueue_dependency_with_main(
-                                    manager,
-                                    dependency_i as u32,
-                                    &dependency,
-                                    invalid_package_id,
-                                    false,
-                                ) {
-                                    add_dependency_error(manager, &dependency, err);
-                                }
-                            }
-                        }
-                    }
-
-                    if manager.summary.catalogs_changed {
+                    if invalidates_rows {
+                        let catalogs_changed = manager.summary.catalogs_changed;
                         let mut catalog_overridden: Vec<PackageNameHash> = Vec::new();
-                        manager
-                            .lockfile
-                            .overrides
-                            .append_catalog_valued_name_hashes(&mut catalog_overridden);
-                        catalog_overridden.sort_unstable();
-                        catalog_overridden.dedup();
-                        let dependencies_len = manager.lockfile.buffers.dependencies.len();
-                        for _dep_id in 0..dependencies_len {
-                            let dep_id: DependencyID = u32::try_from(_dep_id).expect("int cast");
-                            if pinned_rows.is_set_allow_out_of_bound(_dep_id, false) {
-                                continue;
-                            }
-                            let dep =
-                                manager.lockfile.buffers.dependencies[dep_id as usize].clone();
-                            if dep.version.tag != DependencyVersionTag::Catalog
-                                && (catalog_overridden.is_empty()
-                                    || catalog_overridden.binary_search(&dep.name_hash).is_err())
-                            {
-                                continue;
-                            }
-
-                            manager.lockfile.buffers.resolutions[dep_id as usize] =
-                                invalid_package_id;
-                            if let Err(err) = enqueue_dependency_with_main(
-                                manager,
-                                dep_id,
-                                &dep,
-                                invalid_package_id,
-                                false,
-                            ) {
-                                add_dependency_error(manager, &dep, err);
-                            }
+                        if catalogs_changed {
+                            manager
+                                .lockfile
+                                .overrides
+                                .append_catalog_valued_name_hashes(&mut catalog_overridden);
+                            catalog_overridden.sort_unstable();
+                            catalog_overridden.dedup();
                         }
+                        // `all_name_hashes` is empty unless the overrides changed.
+                        reresolve_owned_rows(manager, &pinned_rows, |dependency| {
+                            all_name_hashes.binary_search(&dependency.name_hash).is_ok()
+                                || (catalogs_changed
+                                    && dependency.version.tag == DependencyVersionTag::Catalog)
+                                || catalog_overridden
+                                    .binary_search(&dependency.name_hash)
+                                    .is_ok()
+                        });
                     }
 
                     // Split this into two passes because the below may allocate memory or invalidate pointers
@@ -1536,7 +1492,7 @@ fn report_lockfile_load_error(
     Ok(())
 }
 
-/// Returns the rows the plan re-resolved so the overrides/catalogs invalidation loops that follow leave them pinned; only tracked when those loops will run.
+/// Returns the rows the plan re-resolved so the overrides/catalogs invalidation pass that follows leaves them pinned; only tracked when that pass will run.
 fn enqueue_transitive(
     manager: &mut PackageManager,
     transitive: &TransitiveUpdate,
@@ -1549,6 +1505,42 @@ fn enqueue_transitive(
     transitive.enqueue_tracked(manager)
 }
 
+/// Re-resolves the rows `selects`, walking each package's current dependency list in package order. The root's
+/// list (just rebuilt by the differ) goes first because a later row dedupes onto what an earlier one appended
+/// (`Lockfile::get_package_id`); the root's loaded rows, now in no list, would resolve as nobody's and are not
+/// walked, nor are `pinned_rows`, which the update plan just resolved. A workspace the add/update pass is about
+/// to re-read still holds its loaded list here and is walked like any other package.
+fn reresolve_owned_rows(
+    manager: &mut PackageManager,
+    pinned_rows: &DynamicBitSet,
+    selects: impl Fn(&Dependency) -> bool,
+) {
+    // Resolving appends packages and rows; only the lists present now are walked.
+    let lists: Vec<lockfile::DependencySlice> =
+        manager.lockfile.packages.items_dependencies().to_vec();
+    for list in lists {
+        for dep_id in list.begin()..list.end() {
+            if pinned_rows.is_set_allow_out_of_bound(dep_id as usize, false) {
+                continue;
+            }
+            let dependency = manager.lockfile.buffers.dependencies[dep_id as usize].clone();
+            if !selects(&dependency) {
+                continue;
+            }
+            manager.lockfile.buffers.resolutions[dep_id as usize] = invalid_package_id;
+            if let Err(err) = enqueue_dependency_with_main(
+                manager,
+                dep_id,
+                &dependency,
+                invalid_package_id,
+                false,
+            ) {
+                add_dependency_error(manager, &dependency, err);
+            }
+        }
+    }
+}
+
 #[derive(Default)]
 struct NamedUpdates {
     /// Invalidated rows paired with the package they resolved to, for redirect_moved_edges.
diff --git a/test/cli/install/catalogs.test.ts b/test/cli/install/catalogs.test.ts
index 159c6aabe4aa..88fb656a382f 100644
--- a/test/cli/install/catalogs.test.ts
+++ b/test/cli/install/catalogs.test.ts
@@ -259,6 +259,54 @@ describe("basic", () => {
     await runBunInstall(bunEnv, packageDir, { savesLockfile: false });
   });
 
+  // A file: path outside the project is only accepted on a row the root (or a workspace) owns. A catalog change
+  // re-resolves every catalog: row; the rows the root was loaded with have been replaced by then and belong to
+  // nobody, so re-resolving them fails the way an escaping transitive file: dependency does.
+  test.concurrent("changing the entry of a catalog: dependency pointing outside the project", async () => {
+    const packageJson = (xPath: string) =>
+      JSON.stringify({
+        name: "catalog-file-dep",
+        workspaces: { packages: [], catalog: { x: xPath } },
+        dependencies: { x: "catalog:" },
+      });
+    using dir = tempDir("catalog-file-dep", {
+      "x/package.json": JSON.stringify({ name: "x", version: "1.0.0" }),
+      "x2/package.json": JSON.stringify({ name: "x", version: "2.0.0" }),
+      "project/package.json": packageJson("file:../x"),
+    });
+    const packageDir = join(String(dir), "project");
+    const installedVersion = async () =>
+      (await file(join(packageDir, "node_modules", "x", "package.json")).json()).version;
+
+    await runBunInstall(bunEnv, packageDir);
+    expect(await installedVersion()).toBe("1.0.0");
+
+    await write(join(packageDir, "package.json"), packageJson("file:../x2"));
+    await runBunInstall(bunEnv, packageDir);
+    expect(await installedVersion()).toBe("2.0.0");
+    expect(normalizeBunSnapshot(await file(join(packageDir, "bun.lock")).text(), packageDir)).toMatchInlineSnapshot(`
+      "{
+        "lockfileVersion": 2,
+        "configVersion": 1,
+        "workspaces": {
+          "": {
+            "name": "catalog-file-dep",
+            "dependencies": {
+              "x": "catalog:",
+            },
+          },
+        },
+        "catalog": {
+          "x": "file:../x2",
+        },
+        "packages": {
+          "x": ["x@file:../x2", {}],
+        }
+      }"
+    `);
+    await runBunInstall(bunEnv, packageDir, { frozenLockfile: true });
+  });
+
   test.concurrent("catalog and catalogs.default may split different packages between them", async () => {
     const { packageDir } = await registry.createTestDir({
       files: {
@@ -1274,6 +1322,65 @@ describe("peer dependencies", () => {
     expect(await packageKeys(dir)).toStrictEqual(dedupedKeys);
   });
 
+  // When the catalog changes, every row declared through it is re-resolved. The root's rows from bun.lock have
+  // been replaced by then and belong to no package; re-resolving them too bound the peer a second time and
+  // repeated its warning.
+  describe("a root peer whose catalog range stops matching the installed version is checked once", () => {
+    const peerWarning = 'warn: incorrect peer dependency "no-deps@1.0.0"';
+    const peerWarnings = (err: string) => err.split(peerWarning).length - 1;
+
+    function rootWithPeer(peerSpec: string, fields: Record<string, unknown> = {}) {
+      return JSON.stringify({ name: "root", peerDependencies: { "no-deps": peerSpec }, ...fields });
+    }
+
+    async function installedAlone(packageJson: string) {
+      const { packageDir } = await registry.createTestDir({
+        bunfigOpts: { linker: "hoisted" },
+        files: { "package.json": packageJson },
+      });
+      const { err } = await install(packageDir, "hoisted");
+      expect(peerWarnings(err)).toBe(0);
+      expect((await Bun.file(join(packageDir, "node_modules", "no-deps", "package.json")).json()).version).toBe(
+        "1.0.0",
+      );
+      return packageDir;
+    }
+
+    async function reinstall(dir: string, packageJson: string) {
+      await Bun.write(join(dir, "package.json"), packageJson);
+      const { err } = await install(dir, "hoisted");
+      expect(err).toContain("Saved lockfile");
+      return peerWarnings(err);
+    }
+
+    // The inline row is the baseline: it changes itself and is only re-enqueued by the add/update pass.
+    test.concurrent.each([
+      [
+        "through the catalog",
+        (range: string) => rootWithPeer("catalog:", { workspaces: { catalog: { "no-deps": range } } }),
+      ],
+      ["inline", (range: string) => rootWithPeer(range)],
+    ])("declared %s", async (_, packageJson) => {
+      const dir = await installedAlone(packageJson("1.0.0"));
+      expect(await reinstall(dir, packageJson("^1.0.1"))).toBe(1);
+    });
+
+    test.concurrent("overridden to catalog:", async () => {
+      const packageJson = (range: string) =>
+        rootWithPeer("1.0.0", { overrides: { "no-deps": "catalog:" }, workspaces: { catalog: { "no-deps": range } } });
+      const dir = await installedAlone(packageJson("1.0.0"));
+      expect(await reinstall(dir, packageJson("^1.0.1"))).toBe(1);
+    });
+
+    // Selected both as an overridden name and as a catalog: row; one pass handles both.
+    test.concurrent("declared through the catalog while an override of the same name changes too", async () => {
+      const packageJson = (range: string) =>
+        rootWithPeer("catalog:", { overrides: { "no-deps": range }, workspaces: { catalog: { "no-deps": range } } });
+      const dir = await installedAlone(packageJson("1.0.0"));
+      expect(await reinstall(dir, packageJson("^1.0.1"))).toBe(1);
+    });
+  });
+
   // pnpm: deps-installer/test/catalogs.ts "frozen lockfile error is thrown if catalog config changes"
   test.concurrent("--frozen-lockfile fails when only a peer's catalog range changed", async () => {
     const dir = await makeRepo({ catalog: { "no-deps": ">=1.0.0" }, peerSpec: "catalog:", linker: "hoisted" });
diff --git a/test/cli/install/nested-overrides.test.ts b/test/cli/install/nested-overrides.test.ts
index 9308eb302438..43526a00c5d0 100644
--- a/test/cli/install/nested-overrides.test.ts
+++ b/test/cli/install/nested-overrides.test.ts
@@ -2,7 +2,7 @@ import { file, write } from "bun";
 import { afterAll, beforeAll, describe, expect, test } from "bun:test";
 import { existsSync, realpathSync } from "fs";
 import { rm } from "fs/promises";
-import { VerdaccioRegistry, bunEnv, bunExe } from "harness";
+import { VerdaccioRegistry, bunEnv, bunExe, normalizeBunSnapshot, tempDir } from "harness";
 import { join } from "path";
 
 const registry = new VerdaccioRegistry();
@@ -1290,6 +1290,125 @@ describe.concurrent("lockfile", () => {
     await installOk(dir, "--frozen-lockfile");
   });
 
+  // An overrides change re-resolves every row naming a previously or newly overridden package. By then the root's
+  // rows from bun.lock have been replaced by freshly parsed ones and belong to no package; they must not be
+  // re-resolved as well: a range that is no longer in package.json would add a package the current row then dedupes
+  // onto, and a file: path outside the project is only accepted on a row the root (or a workspace) owns. The
+  // root's current rows also have to be resolved before everybody else's, as on a fresh install, since a row
+  // resolved later dedupes onto a same-major package an earlier one added.
+  describe.concurrent("removing a flat rule re-resolves only the root's current rows", () => {
+    test("the root's row resolves before a dependency's row of the same name", async () => {
+      const deps = { "no-deps": "^1.0.0", "one-dep": "1.0.0" }; // one-dep@1.0.0 depends on no-deps@1.0.1
+      const [dir, fresh] = await Promise.all([
+        project({ dependencies: deps, overrides: { "no-deps": "2.0.0" } }),
+        project({ dependencies: deps }),
+      ]);
+      await Promise.all([installOk(dir), installOk(fresh)]);
+      expect(await lock(dir)).toContain("no-deps@2.0.0");
+
+      await write(join(dir, "package.json"), JSON.stringify({ name: "nested-overrides", dependencies: deps }));
+      const { err } = await installOk(dir);
+      expect(err).toContain("Saved lockfile");
+      expect(await versionSeenBy(dir, undefined, "no-deps")).toBe("1.1.0");
+      expect(await versionSeenBy(dir, "one-dep", "no-deps")).toBe("1.0.1");
+      // Same packages as installing this package.json from scratch.
+      expect(await lock(dir)).toBe(await lock(fresh));
+    });
+
+    test("a range changed in the same edit resolves on its own", async () => {
+      const dir = await project({ dependencies: { "no-deps": "~1.0.0" }, overrides: { "no-deps": "2.0.0" } });
+      await installOk(dir);
+      expect(await versionSeenBy(dir, undefined, "no-deps")).toBe("2.0.0");
+
+      await write(
+        join(dir, "package.json"),
+        JSON.stringify({ name: "nested-overrides", dependencies: { "no-deps": "^1.0.0" } }),
+      );
+      const { err } = await installOk(dir);
+      expect(err).toContain("Saved lockfile");
+      // 1.0.1 is what the dropped ~1.0.0 range would pick.
+      expect(await versionSeenBy(dir, undefined, "no-deps")).toBe("1.1.0");
+      const after = await lock(dir);
+      expect(after).not.toContain('"overrides"');
+      expect(after).not.toContain("no-deps@1.0.1");
+      expect(after).not.toContain("no-deps@2.0.0");
+      await installOk(dir, "--frozen-lockfile");
+    });
+
+    const outside = {
+      "x/package.json": JSON.stringify({ name: "x", version: "1.0.0" }),
+      "x2/package.json": JSON.stringify({ name: "x", version: "2.0.0" }),
+      "project/y/package.json": JSON.stringify({ name: "y", version: "1.0.0" }),
+    };
+    const rootPackageJson = (pkg: Record<string, unknown>) => JSON.stringify({ name: "nested-overrides", ...pkg });
+    const before = rootPackageJson({
+      dependencies: { x: "file:../x", y: "file:./y" },
+      overrides: { x: "file:../x2" },
+    });
+
+    test("a file: dependency outside the project re-resolves to its own path", async () => {
+      using root = tempDir("override-removed-file-dep", { ...outside, "project/package.json": before });
+      const dir = join(String(root), "project");
+      await installOk(dir);
+      expect(await versionSeenBy(dir, undefined, "x")).toBe("2.0.0");
+
+      await write(join(dir, "package.json"), rootPackageJson({ dependencies: { x: "file:../x", y: "file:./y" } }));
+      const { err } = await installOk(dir);
+      expect(err).toContain("Saved lockfile");
+      expect(await versionSeenBy(dir, undefined, "x")).toBe("1.0.0");
+      expect(normalizeBunSnapshot(await lock(dir), dir)).toMatchInlineSnapshot(`
+        "{
+          "lockfileVersion": 2,
+          "configVersion": 1,
+          "workspaces": {
+            "": {
+              "name": "nested-overrides",
+              "dependencies": {
+                "x": "file:../x",
+                "y": "file:./y",
+              },
+            },
+          },
+          "packages": {
+            "x": ["x@file:../x", {}],
+
+            "y": ["y@file:y", {}],
+          }
+        }"
+      `);
+      await installOk(dir, "--frozen-lockfile");
+    });
+
+    test("a file: dependency outside the project removed together with its rule", async () => {
+      using root = tempDir("override-and-file-dep-removed", { ...outside, "project/package.json": before });
+      const dir = join(String(root), "project");
+      await installOk(dir);
+      expect(await versionSeenBy(dir, undefined, "x")).toBe("2.0.0");
+
+      await write(join(dir, "package.json"), rootPackageJson({ dependencies: { y: "file:./y" } }));
+      const { err } = await installOk(dir);
+      expect(err).toContain("Saved lockfile");
+      expect(normalizeBunSnapshot(await lock(dir), dir)).toMatchInlineSnapshot(`
+        "{
+          "lockfileVersion": 2,
+          "configVersion": 1,
+          "workspaces": {
+            "": {
+              "name": "nested-overrides",
+              "dependencies": {
+                "y": "file:./y",
+              },
+            },
+          },
+          "packages": {
+            "y": ["y@file:y", {}],
+          }
+        }"
+      `);
+      await installOk(dir, "--frozen-lockfile");
+    });
+  });
+
   test("changing only the parent's range text is a frozen-lockfile change", async () => {
     const dir = await project({ dependencies: twoParents, overrides: { "one-fixed-dep@1": { "no-deps": "1.1.0" } } });
     await installOk(dir);

From 5ff49e05e4aafb2eadd2f19b21ebd7d6fe7dddaa Mon Sep 17 00:00:00 2001
From: robobun <117481402+robobun@users.noreply.github.com>
Date: Mon, 17 Aug 2026 01:04:20 +0000
Subject: [PATCH 010/258] install: print the update row for catalog entries
 moved by bun update (#38763)

---
 src/install/PackageManager.rs                 | 13 +++
 .../PackageManager/PackageJSONEditor.rs       | 64 +++++++++++++--
 .../PackageManager/install_with_manager.rs    | 23 ++----
 src/install/lockfile/printer/tree_printer.rs  | 69 +++++++++++++++-
 src/install/update_transitive.rs              | 12 +--
 test/cli/install/catalogs.test.ts             | 82 ++++++++++++++++++-
 6 files changed, 225 insertions(+), 38 deletions(-)

diff --git a/src/install/PackageManager.rs b/src/install/PackageManager.rs
index e1524675ffb9..9594ec991990 100644
--- a/src/install/PackageManager.rs
+++ b/src/install/PackageManager.rs
@@ -584,10 +584,23 @@ pub struct PackageUpdateInfo {
     pub(crate) original_version_literal: Box<[u8]>,
     // set by the post-install write-back; the install summary still needs the entry
     pub(crate) written_back: bool,
+    /// Registered by `package_json_editor::record_catalog_originals`: the name's `catalog:` rows carry the move, so the install summary reports it through them.
+    pub(crate) catalog_entry: bool,
     pub(crate) original_version_string_buf: Box<[u8]>,
     pub(crate) original_version: Option<Semver::Version>,
 }
 
+impl PackageUpdateInfo {
+    /// `version`'s tag strings live in `buf` (a lockfile string buffer that cleaning rebuilds), so the original keeps its own copy of them.
+    pub(crate) fn set_original_version(&mut self, version: Semver::Version, buf: &[u8]) {
+        let mut tag_buf =
+            vec![0u8; version.tag.pre.len() + version.tag.build.len()].into_boxed_slice();
+        let mut cursor: &mut [u8] = &mut tag_buf;
+        self.original_version = Some(version.clone_into(buf, &mut cursor));
+        self.original_version_string_buf = tag_buf;
+    }
+}
+
 pub struct CatalogUpdateInfo {
     /// Catalog group name; empty for the default catalog.
     pub catalog_name: Box<[u8]>,
diff --git a/src/install/PackageManager/PackageJSONEditor.rs b/src/install/PackageManager/PackageJSONEditor.rs
index 00a19a9c55f3..704181b224a5 100644
--- a/src/install/PackageManager/PackageJSONEditor.rs
+++ b/src/install/PackageManager/PackageJSONEditor.rs
@@ -507,9 +507,7 @@ fn edit_update_entries(
 
                         *entry.value_ptr = PackageUpdateInfo {
                             original_version_literal: version_literal_owned,
-                            written_back: false,
-                            original_version_string_buf: Box::default(),
-                            original_version: None,
+                            ..Default::default()
                         };
 
                         if update_to_latest {
@@ -751,6 +749,62 @@ pub(crate) fn edit_catalogs_before_update(
     Ok(!manager.updating_catalogs.is_empty())
 }
 
+/// Runs on the loaded lockfile, before the differ: every `catalog:` row of an entry recorded by `edit_catalogs_before_update` registers its name in `updating_packages` with the row's locked version as the original, the way the cwd's own dependency lists register theirs, so the install summary prints the entry's move as an update row; a name those lists already registered keeps their original.
+pub(crate) fn record_catalog_originals(
+    manager: &mut PackageManager,
+) -> Result<(), bun_alloc::AllocError> {
+    let infos: &[CatalogUpdateInfo] = &manager.updating_catalogs;
+    if infos.is_empty() {
+        return Ok(());
+    }
+    let by_name = CatalogInfoIndex::init(infos)?;
+    let lockfile: &Lockfile = &manager.lockfile;
+    let updating_packages = &mut manager.updating_packages;
+    let string_buf = lockfile.buffers.string_bytes.as_slice();
+    let package_resolutions = lockfile.packages.items_resolution();
+
+    for (dep, &package_id) in lockfile
+        .buffers
+        .dependencies
+        .iter()
+        .zip(lockfile.buffers.resolutions.iter())
+    {
+        if dep.version.tag != dependency::Tag::Catalog
+            || (package_id as usize) >= package_resolutions.len()
+        {
+            continue;
+        }
+        let resolution = &package_resolutions[package_id as usize];
+        if resolution.tag != resolution::Tag::Npm {
+            continue;
+        }
+        let dep_name = dep.name.slice(string_buf);
+        let catalog_name = dep.version.catalog().slice(string_buf);
+        let Some(info) = by_name
+            .candidates(dep_name)
+            .and_then(|candidates| CatalogInfoIndex::pick(candidates, infos, catalog_name))
+            .map(|i| &infos[i])
+        else {
+            continue;
+        };
+        let entry = updating_packages.get_or_put(dep_name)?;
+        if entry.found_existing {
+            continue;
+        }
+        *entry.value_ptr = PackageUpdateInfo {
+            original_version_literal: info.original_version_literal.clone(),
+            // The entry is written by `edit_catalogs_after_update`; `edit_update_entries` has nothing of it to write into the cwd's dependency lists.
+            written_back: true,
+            catalog_entry: true,
+            ..Default::default()
+        };
+        entry
+            .value_ptr
+            .set_original_version(resolution.npm().version, string_buf);
+    }
+    Ok(())
+}
+
 /// Writes each recorded catalog entry's resolved literal (unresolved ones are restored) into the root AST; returns `changed`.
 pub(crate) fn edit_catalogs_after_update(
     manager: &mut PackageManager,
@@ -1041,9 +1095,7 @@ pub(crate) fn edit(
 
                                                 *entry.value_ptr = PackageUpdateInfo {
                                                     original_version_literal: version_literal_owned,
-                                                    written_back: false,
-                                                    original_version_string_buf: Box::default(),
-                                                    original_version: None,
+                                                    ..Default::default()
                                                 };
                                             }
                                         }
diff --git a/src/install/PackageManager/install_with_manager.rs b/src/install/PackageManager/install_with_manager.rs
index 71c9c997d5a6..851724b25158 100644
--- a/src/install/PackageManager/install_with_manager.rs
+++ b/src/install/PackageManager/install_with_manager.rs
@@ -24,7 +24,7 @@ use crate::{
 };
 // Bring the typed `items_<field>()` column accessors into scope for
 // `MultiArrayList<Package>` / `Slice<Package>`.
-use super::Command;
+use super::{Command, PackageJSONEditor};
 use crate::PackageManager;
 use crate::config_version::ConfigVersion;
 use crate::hoisted_install::install_hoisted_packages;
@@ -1844,24 +1844,13 @@ fn record_updating_package_versions(manager: &mut PackageManager) {
             if original_resolution.tag != ResolutionTag::Npm {
                 continue;
             }
-
-            let mut original = original_resolution.npm().version;
-            let tag_total = original.tag.pre.len() + original.tag.build.len();
-            if tag_total > 0 {
-                let mut tag_buf = vec![0u8; tag_total].into_boxed_slice();
-                let mut ptr = &mut tag_buf[..];
-                original.tag = original_resolution
-                    .npm()
-                    .version
-                    .tag
-                    .clone_into(&lockfile.buffers.string_bytes, &mut ptr);
-
-                entry_ptr.original_version_string_buf = tag_buf;
-            }
-
-            entry_ptr.original_version = Some(original);
+            entry_ptr.set_original_version(
+                original_resolution.npm().version,
+                &lockfile.buffers.string_bytes,
+            );
         }
     }
+    PackageJSONEditor::record_catalog_originals(manager).unwrap_or_oom();
 }
 
 fn root_package_json_source(
diff --git a/src/install/lockfile/printer/tree_printer.rs b/src/install/lockfile/printer/tree_printer.rs
index 4c7385b7748c..3bf736768cb6 100644
--- a/src/install/lockfile/printer/tree_printer.rs
+++ b/src/install/lockfile/printer/tree_printer.rs
@@ -7,8 +7,8 @@ use crate::package_manager_real::TrackInstalledBin;
 use bun_core::fmt::PathSep;
 use bun_install::lockfile::{Printer, package::Meta as PackageMeta};
 use bun_install::{
-    self as install, Bin, Dependency, DependencyID, INVALID_PACKAGE_ID, PackageID, PackageManager,
-    PackageNameHash, Resolution, Subcommand, bin, resolution,
+    self as install, Bin, Dependency, DependencyID, DependencyVersionTag, INVALID_PACKAGE_ID,
+    PackageID, PackageManager, PackageNameHash, Resolution, Subcommand, bin, resolution,
 };
 use bun_sys::Fd;
 
@@ -27,6 +27,8 @@ fn print_installed_workspace_section<
     printed_new_install: &mut bool,
     id_map: Option<&mut [DependencyID]>,
     update_owners: &[PackageID],
+    // The summary has no other sections, so `print_catalog_entry_updates` runs here.
+    sole_section: bool,
 ) -> Result<(), crate::Error>
 where
     W: Write,
@@ -114,6 +116,19 @@ where
     }
 
     if !PRINT_SECTION_HEADER {
+        if sole_section
+            && print_catalog_entry_updates::<W, ENABLE_ANSI_COLORS>(
+                this,
+                manager,
+                installed,
+                pkg_metas,
+                &mut update_dedupe,
+                writer,
+            )?
+        {
+            *printed_new_install = true;
+            printed_update = true;
+        }
         if print_transitive_updates::<W, ENABLE_ANSI_COLORS>(
             this,
             manager,
@@ -375,6 +390,53 @@ where
     Ok(())
 }
 
+/// A bare `bun update` moves the root's catalog entries for every importer at once, but the summary's one section only walks the rows of `update_owners` (above, hence the shared `update_dedupe`), so the entries consumed elsewhere are reported through whichever `catalog:` row names them. The verbose summary prints a section per importer, each reporting its own `catalog:` rows, and skips this. Like a direct dependency's row, a row prints whether or not its new version had to be installed.
+fn print_catalog_entry_updates<W, const ENABLE_ANSI_COLORS: bool>(
+    this: &Printer,
+    manager: &mut PackageManager,
+    installed: &Bitset,
+    pkg_metas: &[PackageMeta],
+    update_dedupe: &mut HashMap<PackageNameHash, ()>,
+    writer: &mut W,
+) -> Result<bool, crate::Error>
+where
+    W: Write,
+{
+    if !manager
+        .updating_packages
+        .values()
+        .iter()
+        .any(|info| info.catalog_entry)
+    {
+        return Ok(false);
+    }
+    let string_buf = this.lockfile.buffers.string_bytes.as_slice();
+    let dependencies = this.lockfile.buffers.dependencies.as_slice();
+    let mut printed = false;
+    for (dep_id, dep) in dependencies.iter().enumerate() {
+        if dep.version.tag != DependencyVersionTag::Catalog
+            || !manager
+                .updating_packages
+                .get(dep.name.slice(string_buf))
+                .is_some_and(|info| info.catalog_entry)
+        {
+            continue;
+        }
+        let dep_id = DependencyID::try_from(dep_id).expect("int cast");
+        let ShouldPrintPackageInstallResult::Update(update_info) =
+            should_print_package_install(this, manager, dep_id, installed, None, pkg_metas)
+        else {
+            continue;
+        };
+        if update_dedupe.get_or_put(dep.name_hash)?.found_existing {
+            continue;
+        }
+        print_updated_package::<W, ENABLE_ANSI_COLORS>(this, manager, &update_info, writer)?;
+        printed = true;
+    }
+    Ok(printed)
+}
+
 /// Packages registered by the transitive half of `bun update` are not rows of the walked workspaces, so the walk above never reaches them; the walked workspaces' own targets stay with them.
 fn print_transitive_updates<W, const ENABLE_ANSI_COLORS: bool>(
     this: &Printer,
@@ -629,6 +691,7 @@ where
                 &mut had_printed_new_install,
                 None,
                 &[0],
+                false,
             )?;
 
             for &workspace_dep_id in &workspaces_to_print {
@@ -642,6 +705,7 @@ where
                     &mut had_printed_new_install,
                     None,
                     &[workspace_package_id],
+                    false,
                 )?;
             }
         } else {
@@ -693,6 +757,7 @@ where
                 &mut had_printed_new_install,
                 Some(&mut id_map),
                 &update_owners,
+                true,
             )?;
         }
     } else {
diff --git a/src/install/update_transitive.rs b/src/install/update_transitive.rs
index 9492b81a4401..b5358524a658 100644
--- a/src/install/update_transitive.rs
+++ b/src/install/update_transitive.rs
@@ -654,16 +654,8 @@ pub(crate) fn register_moved(
                 continue;
             }
         }
-        let mut tag_buf =
-            vec![0u8; current.tag.pre.len() + current.tag.build.len()].into_boxed_slice();
-        let mut cursor: &mut [u8] = &mut tag_buf;
-        let original = current.clone_into(buf, &mut cursor);
-        *entry.value_ptr = PackageUpdateInfo {
-            original_version_literal: Box::default(),
-            written_back: false,
-            original_version_string_buf: tag_buf,
-            original_version: Some(original),
-        };
+        *entry.value_ptr = PackageUpdateInfo::default();
+        entry.value_ptr.set_original_version(current, buf);
     }
     Ok(())
 }
diff --git a/test/cli/install/catalogs.test.ts b/test/cli/install/catalogs.test.ts
index 88fb656a382f..c06304ed2474 100644
--- a/test/cli/install/catalogs.test.ts
+++ b/test/cli/install/catalogs.test.ts
@@ -400,9 +400,14 @@ describe("update", () => {
       await createUpdateMonorepo(packageDir, `catalog-update-latest-${label.replace(/\W+/g, "-")}`, isTopLevel);
       await runBunInstall(bunEnv, packageDir);
 
-      const { err, exitCode } = await runUpdate(packageDir, ...flags);
+      const { out, err, exitCode } = await runUpdate(packageDir, ...flags);
       expect(err).not.toContain("error:");
 
+      // The moved entry is reported like a direct dependency of the root, even though only pkg1 depends on it.
+      // a-dep still resolves to 1.0.10 (only its literal changes), so it gets no row.
+      expect(out.match(/^.*no-deps.*$/gm)).toStrictEqual(["^ no-deps 1.1.0 -> 2.0.0"]);
+      expect(out.match(/^.*a-dep.*$/gm)).toBeNull();
+
       // catalog entries are updated, preserving the pinning style
       const root = await file(join(packageDir, "package.json")).json();
       const { catalog, catalogs } = isTopLevel ? root : root.workspaces;
@@ -453,9 +458,12 @@ describe("update", () => {
     await createUpdateMonorepo(packageDir, "catalog-update-in-workspace");
     await runBunInstall(bunEnv, packageDir);
 
-    const { err, exitCode } = await runUpdate(join(packageDir, "packages", "pkg1"), "--latest");
+    const { out, err, exitCode } = await runUpdate(join(packageDir, "packages", "pkg1"), "--latest");
     expect(err).not.toContain("error:");
 
+    // pkg1's own `catalog:` row is an update row, not a `+ no-deps@2.0.0` install row.
+    expect(out.match(/^.*no-deps.*$/gm)).toStrictEqual(["^ no-deps 1.1.0 -> 2.0.0"]);
+
     const root = await file(join(packageDir, "package.json")).json();
     expect(root.workspaces.catalog).toEqual({ "no-deps": "^2.0.0" });
     expect(root.workspaces.catalogs).toEqual({ a: { "a-dep": "~1.0.10" } });
@@ -467,6 +475,73 @@ describe("update", () => {
     expect(exitCode).toBe(0);
   });
 
+  test("--latest reports a catalog entry the root itself depends on once", async () => {
+    const { packageDir } = await registry.createTestDir();
+    await Promise.all([
+      write(
+        join(packageDir, "package.json"),
+        JSON.stringify({
+          name: "catalog-update-root-consumer",
+          workspaces: { packages: ["packages/*"], catalog: { "no-deps": "^1.0.0" } },
+          dependencies: { "no-deps": "catalog:" },
+        }),
+      ),
+      write(
+        join(packageDir, "packages", "pkg1", "package.json"),
+        JSON.stringify({ name: "pkg1", dependencies: { "no-deps": "catalog:" } }),
+      ),
+    ]);
+    await runBunInstall(bunEnv, packageDir);
+
+    const { out, err, exitCode } = await runUpdate(packageDir, "--latest");
+    expect(err).not.toContain("error:");
+    expect(out.match(/^.*no-deps.*$/gm)).toStrictEqual(["^ no-deps 1.1.0 -> 2.0.0"]);
+
+    const root = await file(join(packageDir, "package.json")).json();
+    expect(root.workspaces.catalog).toEqual({ "no-deps": "^2.0.0" });
+    expect(root.dependencies).toEqual({ "no-deps": "catalog:" });
+    expect(exitCode).toBe(0);
+  });
+
+  test("--latest --verbose reports a catalog entry once, under the workspace that depends on it", async () => {
+    const { packageDir } = await registry.createTestDir();
+    await createUpdateMonorepo(packageDir, "catalog-update-verbose");
+    await runBunInstall(bunEnv, packageDir);
+
+    const { out, err, exitCode } = await runUpdate(packageDir, "--latest", "--verbose");
+    expect(err).not.toContain("error:");
+    const lines = out.split(/\r?\n/);
+    expect(lines.filter(line => line.includes("no-deps"))).toStrictEqual(["^ no-deps 1.1.0 -> 2.0.0"]);
+    expect(lines[lines.indexOf("pkg1:") + 1]).toBe("^ no-deps 1.1.0 -> 2.0.0");
+    expect(exitCode).toBe(0);
+  });
+
+  test("--latest reports a catalog entry whose new version needs no install (isolated store already has it)", async () => {
+    const { packageDir } = await registry.createTestDir({ bunfigOpts: { linker: "isolated" } });
+    await createUpdateMonorepo(packageDir, "catalog-update-isolated-rerun");
+    await runBunInstall(bunEnv, packageDir);
+    const rootBefore = await file(join(packageDir, "package.json")).text();
+    const lockBefore = await file(join(packageDir, "bun.lock")).text();
+
+    const first = await runUpdate(packageDir, "--latest");
+    expect(first.err).not.toContain("error:");
+    expect(first.out.match(/^.*no-deps.*$/gm)).toStrictEqual(["^ no-deps 1.1.0 -> 2.0.0"]);
+    expect(first.exitCode).toBe(0);
+
+    // Like `git checkout .` followed by `bun install`: the project is back on 1.1.0 while node_modules/.bun keeps no-deps@2.0.0.
+    await Promise.all([
+      write(join(packageDir, "package.json"), rootBefore),
+      write(join(packageDir, "bun.lock"), lockBefore),
+    ]);
+    await runBunInstall(bunEnv, packageDir, { savesLockfile: false });
+
+    const second = await runUpdate(packageDir, "--latest");
+    expect(second.err).not.toContain("error:");
+    expect(second.out.match(/^.*no-deps.*$/gm)).toStrictEqual(["^ no-deps 1.1.0 -> 2.0.0"]);
+    expect((await file(join(packageDir, "package.json")).json()).workspaces.catalog).toEqual({ "no-deps": "^2.0.0" });
+    expect(second.exitCode).toBe(0);
+  });
+
   test("--latest updates the same package independently per catalog", async () => {
     const { packageDir } = await registry.createTestDir();
     await Promise.all([
@@ -590,8 +665,9 @@ describe("update", () => {
         ),
       ]);
 
-      const { err, exitCode } = await runUpdate(packageDir, ...args);
+      const { out, err, exitCode } = await runUpdate(packageDir, ...args);
       expect(err).not.toContain("error:");
+      expect(out.match(/^.*no-deps.*$/gm)).toStrictEqual(["^ no-deps 1.0.0 -> 1.1.0 (v2.0.0 available)"]);
 
       const root = await file(join(packageDir, "package.json")).json();
       expect(root.workspaces.catalog).toEqual({ "no-deps": "^1.1.0" });

From 28bd7ed4a729a516ba4684507bb7cc42df7648ca Mon Sep 17 00:00:00 2001
From: robobun <117481402+robobun@users.noreply.github.com>
Date: Mon, 17 Aug 2026 01:04:23 +0000
Subject: [PATCH 011/258] install: keep workspace and other non-registry
 entries as written on bun update <name> (#38847)

---
 .../PackageManager/PackageJSONEditor.rs       |  6 +-
 src/install/lockfile.rs                       |  4 ++
 .../install/bun-update-lockfile-sync.test.ts  | 65 +++++++++++++++++++
 3 files changed, 73 insertions(+), 2 deletions(-)

diff --git a/src/install/PackageManager/PackageJSONEditor.rs b/src/install/PackageManager/PackageJSONEditor.rs
index 704181b224a5..4c3250ccfafe 100644
--- a/src/install/PackageManager/PackageJSONEditor.rs
+++ b/src/install/PackageManager/PackageJSONEditor.rs
@@ -1384,9 +1384,9 @@ pub(crate) fn edit(
             // derived from a `StoreRef` to the same `E::EString` is live inside this loop body,
             // so this is the sole mutable borrow.
             let e_string = unsafe { &mut *e_string };
-            // `bun update <pkg>` keeps a `catalog:` reference; `bun add` still replaces it.
+            // `bun update <pkg>` only moves registry entries, like `edit_update_entries`; `bun add` still replaces any entry.
             if manager.subcommand == Subcommand::Update
-                && dependency::Tag::infer(e_string.data.slice()) == dependency::Tag::Catalog
+                && !dependency::Tag::infer(e_string.data.slice()).is_npm()
             {
                 continue;
             }
@@ -1499,6 +1499,8 @@ pub(crate) fn edit(
                     arena_dup(arena, installed)
                 }
 
+                // A range that linked a workspace member has nothing to move to; `workspace:*` is what `bun add` writes.
+                resolution::Tag::Workspace if manager.subcommand == Subcommand::Update => continue,
                 resolution::Tag::Workspace => b"workspace:*",
                 _ => arena_dup(arena, request.version.literal.slice(request.version_buf())),
             };
diff --git a/src/install/lockfile.rs b/src/install/lockfile.rs
index f97520b42842..ff3f5bcc5ff5 100644
--- a/src/install/lockfile.rs
+++ b/src/install/lockfile.rs
@@ -910,6 +910,10 @@ impl Lockfile {
                 let resolved_ids: &[PackageID] = res_list.get(self.buffers.resolutions.as_slice());
                 debug_assert_eq!(resolved_ids.len(), workspace_deps.len());
                 for (&package_id, dep) in resolved_ids.iter().zip(workspace_deps.iter()) {
+                    // The root's implicit `workspaces` rows are not package.json entries; bind to the entry naming the package.
+                    if dep.behavior.is_workspace() {
+                        continue;
+                    }
                     if update.matches(dep, string_buf) {
                         if package_id as usize > self.packages.len() {
                             continue;
diff --git a/test/cli/install/bun-update-lockfile-sync.test.ts b/test/cli/install/bun-update-lockfile-sync.test.ts
index d83f6eb72cf7..1064a9671139 100644
--- a/test/cli/install/bun-update-lockfile-sync.test.ts
+++ b/test/cli/install/bun-update-lockfile-sync.test.ts
@@ -280,6 +280,71 @@ describe.concurrent("bun update rewrites bun.lock together with package.json", (
     await expectInSync(dir);
   });
 
+  // Naming a workspace member used to rewrite the entry linking it to `workspace:*` (or, with --latest / an explicit
+  // range, to send the name to the registry), and to add an entry to a root that did not declare the member.
+  test.each([
+    ["workspace:^", ["pkg1"]],
+    ["workspace:~", ["pkg1"]],
+    ["workspace:1.0.0", ["pkg1"]],
+    ["^1.0.0", ["pkg1"]],
+    ["workspace:^", ["pkg1", "--latest"]],
+    ["workspace:^", ["pkg1@^1.0.0"]],
+    ["workspace:^", ["pkg1@latest"]],
+  ])("a %s entry linking a workspace member is kept as written by bun update %j", async (literal, args) => {
+    const dir = await setup(MONOREPO({}, { dependencies: { pkg1: literal } }));
+    const [pkgBefore, lockBefore] = await Promise.all([pkgText(dir), lockText(dir)]);
+    await run(dir, "update", ...args);
+    expect(await pkgText(dir)).toBe(pkgBefore);
+    expect(await lockText(dir)).toBe(lockBefore);
+  });
+
+  // Same rule for the other non-registry kinds: the registry has a no-deps, so naming this entry with --latest or an
+  // explicit spec used to replace the folder with the registry package (exit 0).
+  test.each([[["no-deps"]], [["no-deps", "--latest"]], [["no-deps@^1.0.0"]], [["no-deps@latest"]]])(
+    "a file: entry is kept as written by bun update %j",
+    async args => {
+      const dir = await setup({
+        "package.json": root({ dependencies: { "no-deps": "file:./local-no-deps" } }),
+        "local-no-deps/package.json": { name: "no-deps", version: "1.0.0" },
+      });
+      const [pkgBefore, lockBefore] = await Promise.all([pkgText(dir), lockText(dir)]);
+      await run(dir, "update", ...args);
+      expect(await pkgText(dir)).toBe(pkgBefore);
+      expect(await lockText(dir)).toBe(lockBefore);
+      expect(await installed(dir, "no-deps")).toMatchObject({ version: "1.0.0" });
+    },
+  );
+
+  test("bun update <workspace member> from a member declaring it keeps the entry as written", async () => {
+    const dir = await setup(WORKSPACES({}, { pkg1: {}, pkg2: { dependencies: { pkg1: "workspace:~" } } }));
+    const [pkgBefore, lockBefore] = await Promise.all([pkgText(dir, PKG2), lockText(dir)]);
+    await runIn(dir, PKG2, "update", "pkg1");
+    expect(await pkgText(dir, PKG2)).toBe(pkgBefore);
+    expect(await lockText(dir)).toBe(lockBefore);
+  });
+
+  test("bun update <workspace member> -r keeps every workspace's entry as written", async () => {
+    const dir = await setup(
+      WORKSPACES(
+        { dependencies: { pkg1: "workspace:^" } },
+        { pkg1: {}, pkg2: { dependencies: { pkg1: "workspace:1.0.0" } } },
+      ),
+    );
+    const [rootBefore, pkg2Before, lockBefore] = await Promise.all([pkgText(dir), pkgText(dir, PKG2), lockText(dir)]);
+    await run(dir, "update", "pkg1", "-r");
+    expect(await pkgText(dir)).toBe(rootBefore);
+    expect(await pkgText(dir, PKG2)).toBe(pkg2Before);
+    expect(await lockText(dir)).toBe(lockBefore);
+  });
+
+  test("bun update <workspace member> does not add it to a root that does not declare it", async () => {
+    const dir = await setup(MONOREPO());
+    const [pkgBefore, lockBefore] = await Promise.all([pkgText(dir), lockText(dir)]);
+    await run(dir, "update", "pkg1");
+    expect(await pkgText(dir)).toBe(pkgBefore);
+    expect(await lockText(dir)).toBe(lockBefore);
+  });
+
   test.each([[[]], [["--latest"]]])("bun update %j leaves folder, tarball and workspace literals alone", async args => {
     const dependencies = {
       "no-deps": "^1.0.0",

From d551e67dc2a6ea9434eb08e0a7c30ca89fcf1357 Mon Sep 17 00:00:00 2001
From: robobun <117481402+robobun@users.noreply.github.com>
Date: Mon, 17 Aug 2026 01:04:27 +0000
Subject: [PATCH 012/258] Report package.json sync in the bun update summary
 instead of (no changes) (#38918)

---
 src/install/PackageManager.rs                 |  5 ++++
 .../PackageManager/install_with_manager.rs    | 12 ++++++--
 .../PackageManager/package_json_write_back.rs |  6 +++-
 test/cli/install/bun-install-registry.test.ts | 11 +++----
 test/cli/install/bun-update.test.ts           | 30 +++++++++++++++++++
 5 files changed, 56 insertions(+), 8 deletions(-)

diff --git a/src/install/PackageManager.rs b/src/install/PackageManager.rs
index 9594ec991990..39599591b2ec 100644
--- a/src/install/PackageManager.rs
+++ b/src/install/PackageManager.rs
@@ -447,6 +447,9 @@ pub struct PackageManager {
     // package.json cache entries that differ from disk; written by package_json_write_back::flush.
     pub(crate) edited_package_jsons: Vec<package_json_write_back::EditedPackageJson>,
 
+    // Set by package_json_write_back::flush when it rewrites a file; read by the install summary.
+    pub(crate) wrote_package_json: bool,
+
     // bun add: catalog references decided per target and the root entries they need; see add_catalog.rs
     pub(crate) catalog_add: add_catalog::State,
 
@@ -2133,6 +2136,7 @@ pub fn init(
         wr!(filtered_link_targets, None);
         wr!(pending_filtered_write, None);
         wr!(edited_package_jsons, Vec::new());
+        wr!(wrote_package_json, false);
         wr!(catalog_add, add_catalog::State::default());
         wr!(patched_dependencies_to_remove, ArrayHashMap::default());
         wr!(last_reported_slow_lifecycle_script_at, 0);
@@ -2582,6 +2586,7 @@ fn init_with_runtime_once(
         wr!(filtered_link_targets, None);
         wr!(pending_filtered_write, None);
         wr!(edited_package_jsons, Vec::new());
+        wr!(wrote_package_json, false);
         wr!(catalog_add, add_catalog::State::default());
         wr!(patched_dependencies_to_remove, ArrayHashMap::default());
         wr!(last_reported_slow_lifecycle_script_at, 0);
diff --git a/src/install/PackageManager/install_with_manager.rs b/src/install/PackageManager/install_with_manager.rs
index 851724b25158..ecb78304ec88 100644
--- a/src/install/PackageManager/install_with_manager.rs
+++ b/src/install/PackageManager/install_with_manager.rs
@@ -1134,9 +1134,15 @@ fn print_install_summary(
         {
             // Hot no-op path (install/fastify bench): kept inline.
             let count = this.lockfile.packages.len() as PackageID;
+            // "(no changes)" would misreport an update that rewrote package.json.
+            let note = if this.subcommand == Subcommand::Update && this.wrote_package_json {
+                "up to date, package.json synced"
+            } else {
+                "no changes"
+            };
             if count != install_summary.skipped {
                 bun_core::pretty!(
-                    "Checked <green>{} install{}<r> across {} package{} <d>(no changes)<r> ",
+                    "Checked <green>{} install{}<r> across {} package{} <d>({})<r> ",
                     install_summary.skipped,
                     if install_summary.skipped == 1 {
                         ""
@@ -1145,19 +1151,21 @@ fn print_install_summary(
                     },
                     count,
                     if count == 1 { "" } else { "s" },
+                    note,
                 );
                 Output::print_start_end_stdout(ctx.start_time, nano_timestamp());
                 printed_timestamp = true;
                 print_blocked_packages_info(install_summary, this.options.global);
             } else {
                 bun_core::pretty!(
-                    "<r><green>Done<r>! Checked {} package{}<r> <d>(no changes)<r> ",
+                    "<r><green>Done<r>! Checked {} package{}<r> <d>({})<r> ",
                     install_summary.skipped,
                     if install_summary.skipped == 1 {
                         ""
                     } else {
                         "s"
                     },
+                    note,
                 );
                 Output::print_start_end_stdout(ctx.start_time, nano_timestamp());
                 printed_timestamp = true;
diff --git a/src/install/PackageManager/package_json_write_back.rs b/src/install/PackageManager/package_json_write_back.rs
index becf4d246f84..7b24882fea36 100644
--- a/src/install/PackageManager/package_json_write_back.rs
+++ b/src/install/PackageManager/package_json_write_back.rs
@@ -406,7 +406,11 @@ pub(crate) fn flush(manager: &mut PackageManager) -> Result<(), crate::Error> {
         if unchanged_on_disk(manager, &e.target) {
             continue;
         }
-        any_failed |= !write_target(manager, &e.target);
+        if write_target(manager, &e.target) {
+            manager.wrote_package_json = true;
+        } else {
+            any_failed = true;
+        }
     }
     if any_failed {
         Global::exit(1);
diff --git a/test/cli/install/bun-install-registry.test.ts b/test/cli/install/bun-install-registry.test.ts
index 4d2d41384e27..dcf5c47fb38c 100644
--- a/test/cli/install/bun-install-registry.test.ts
+++ b/test/cli/install/bun-install-registry.test.ts
@@ -5473,7 +5473,7 @@ describe("update", () => {
       expect(out).toEqual([
         expect.stringContaining("bun update v1."),
         "",
-        "Checked 1 install across 2 packages (no changes)",
+        "Checked 1 install across 2 packages (up to date, package.json synced)",
       ]);
       expect(await file(packageJson).json()).toEqual({
         name: "foo",
@@ -5632,7 +5632,7 @@ describe("update", () => {
       expect(out).toStrictEqual([
         expect.stringContaining("bun update v1."),
         "",
-        "Checked 2 installs across 3 packages (no changes)",
+        "Checked 2 installs across 3 packages (up to date, package.json synced)",
       ]);
       expect(await file(packageJson).json()).toStrictEqual({
         name: "foo",
@@ -5819,7 +5819,7 @@ describe("update", () => {
     expect(out).toEqual([
       expect.stringContaining("bun update v1."),
       "",
-      "Checked 1 install across 2 packages (no changes)",
+      "Checked 1 install across 2 packages (up to date, package.json synced)",
     ]);
     expect(await file(packageJson).json()).toEqual({
       name: "foo",
@@ -6139,14 +6139,15 @@ describe("update", () => {
       version: "1.0.0",
     });
 
-    // update no-deps, no range, no change
+    // update no-deps, no range, no change to the resolved version (the re-printed
+    // package.json is still written back, which the summary reports)
     let { out } = await runBunUpdate(env, packageDir, ["no-deps"]);
     assertManifestsPopulated(join(packageDir, ".bun-cache"), registryUrl());
 
     expect(out).toStrictEqual([
       expect.stringContaining("bun update v1."),
       "",
-      "Checked 5 installs across 6 packages (no changes)",
+      "Checked 5 installs across 6 packages (up to date, package.json synced)",
     ]);
     expect(await file(join(packageDir, "node_modules", "no-deps", "package.json")).json()).toMatchObject({
       version: "1.0.0",
diff --git a/test/cli/install/bun-update.test.ts b/test/cli/install/bun-update.test.ts
index b39b59d8c5f4..21a0a9e23553 100644
--- a/test/cli/install/bun-update.test.ts
+++ b/test/cli/install/bun-update.test.ts
@@ -1814,6 +1814,36 @@ describe("bun update <name> semantics", () => {
     });
   }
 
+  // https://github.com/oven-sh/bun/issues/38908
+  it.concurrent("bun update that only rewrites package.json reports the sync instead of (no changes)", async () => {
+    const dir = await setup({ "a-dep": "^1.0.1" });
+    // install already resolved the newest match, so update only moves the declared range
+    expect(await installedVersion(dir, "a-dep")).toBe("1.0.10");
+    const first = await update(dir);
+    expect(first.stdout).toContain("(up to date, package.json synced)");
+    expect(first.stdout).not.toContain("(no changes)");
+    await expectInSync(dir, { "a-dep": "^1.0.10" });
+    const second = await update(dir);
+    expect(second.stdout).toContain("(no changes)");
+    expect(second.stdout).not.toContain("package.json synced");
+  });
+
+  // https://github.com/oven-sh/bun/issues/38908
+  it.concurrent("bun update syncing a catalog range reports the package.json write", async () => {
+    const dir = await createDir({
+      "package.json": { name: "mono", private: true, workspaces: ["packages/*"], catalog: { "a-dep": "^1.0.1" } },
+      "packages/web/package.json": { name: "web", version: "1.0.0", dependencies: { "a-dep": "catalog:" } },
+    });
+    await install(dir);
+    const first = await update(dir);
+    expect(first.stdout).toContain("(up to date, package.json synced)");
+    expect(first.stdout).not.toContain("(no changes)");
+    expect((await packageJsonOf(dir)).catalog).toEqual({ "a-dep": "^1.0.10" });
+    const second = await update(dir);
+    expect(second.stdout).toContain("(no changes)");
+    expect(second.stdout).not.toContain("package.json synced");
+  });
+
   it.concurrent("bun update <name> keeps a dist-tag literal as written", async () => {
     const dir = await setup({ "dep-with-tags": "pre-2" });
     expect(await installedVersion(dir, "dep-with-tags")).toBe("2.0.1");

From 027faccb94ab0df1aca740198b68756469a7e181 Mon Sep 17 00:00:00 2001
From: robobun <117481402+robobun@users.noreply.github.com>
Date: Mon, 17 Aug 2026 01:04:32 +0000
Subject: [PATCH 013/258] install: ignore leading whitespace in dist-tag, bare
 folder and local tarball versions (#38331)

---
 src/install/dependency.rs            | 20 ++++--
 test/cli/install/bun-install.test.ts | 96 ++++++++++++++++++++++++++++
 2 files changed, 110 insertions(+), 6 deletions(-)

diff --git a/src/install/dependency.rs b/src/install/dependency.rs
index 2f5b38f9b895..954735c4c116 100644
--- a/src/install/dependency.rs
+++ b/src/install/dependency.rs
@@ -1154,6 +1154,12 @@ pub(crate) fn is_windows_abs_path_with_leading_slashes(dep: &[u8]) -> Option<&[u
     None
 }
 
+/// Literals may carry leading whitespace; classify and parse these bytes, not the raw literal.
+#[inline]
+pub fn trim_literal(literal: &[u8]) -> &[u8] {
+    strings::trim_left(literal, b" \t\n\r")
+}
+
 #[inline]
 pub fn parse<'a, 'b>(
     alias: String,
@@ -1163,7 +1169,7 @@ pub fn parse<'a, 'b>(
     log: impl Into<Option<&'a mut bun_ast::Log>>,
     manager: impl Into<Option<&'b mut PackageManager>>,
 ) -> Option<Version> {
-    let dep = strings::trim_left(dependency, b" \t\n\r");
+    let dep = trim_literal(dependency);
     parse_with_tag(
         alias,
         alias_hash.into(),
@@ -1184,7 +1190,7 @@ pub(crate) fn parse_with_optional_tag<'a, 'b>(
     log: impl Into<Option<&'a mut bun_ast::Log>>,
     package_manager: impl Into<Option<&'b mut PackageManager>>,
 ) -> Option<Version> {
-    let dep = strings::trim_left(dependency, b" \t\n\r");
+    let dep = trim_literal(dependency);
     parse_with_tag(
         alias,
         alias_hash.into(),
@@ -1207,6 +1213,8 @@ pub(crate) fn parse_with_tag(
     log_: Option<&mut bun_ast::Log>,
     package_manager: Option<&mut dyn NpmAliasRegistry>,
 ) -> Option<Version> {
+    // `to_version` (bun.lockb) and `clone_with_different_buffers` pass the stored literal untrimmed.
+    let dependency = trim_literal(dependency);
     match tag {
         Tag::Npm => {
             let mut input = dependency;
@@ -1272,7 +1280,7 @@ pub(crate) fn parse_with_tag(
             Some(result)
         }
         Tag::DistTag => {
-            let mut tag_to_use = sliced.value();
+            let mut tag_to_use = sliced.sub(dependency).value();
 
             let actual = if dependency.starts_with(b"npm:") && dependency.len() > b"npm:".len() {
                 // npm:@foo/bar@latest
@@ -1457,7 +1465,7 @@ pub(crate) fn parse_with_tag(
                 literal: sliced.value(),
                 value: Value {
                     tarball: TarballInfo {
-                        uri: URI::Local(sliced.value()),
+                        uri: URI::Local(sliced.sub(dependency).value()),
                         package_name: String::default(),
                     },
                 },
@@ -1574,7 +1582,7 @@ pub(crate) fn parse_with_tag(
 
             Some(Version {
                 value: Value {
-                    folder: sliced.value(),
+                    folder: sliced.sub(dependency).value(),
                 },
                 tag: Tag::Folder,
                 literal: sliced.value(),
@@ -1598,7 +1606,7 @@ pub(crate) fn parse_with_tag(
 
             Some(Version {
                 value: Value {
-                    symlink: sliced.value(),
+                    symlink: sliced.sub(dependency).value(),
                 },
                 tag: Tag::Symlink,
                 literal: sliced.value(),
diff --git a/test/cli/install/bun-install.test.ts b/test/cli/install/bun-install.test.ts
index 583fceefe6c7..737ddfce3513 100644
--- a/test/cli/install/bun-install.test.ts
+++ b/test/cli/install/bun-install.test.ts
@@ -6347,6 +6347,102 @@ describe.concurrent("bun-install", () => {
     });
   });
 
+  describe("leading whitespace in the version literal", () => {
+    // Leading whitespace is ignored when a version literal is classified, so each of these has to
+    // install what the literal without the whitespace installs. The second install re-parses the
+    // literal stored in the lockfile (bun.lockb unless told otherwise) and has to agree with the first.
+    async function installTwice(
+      ctx: TestContext,
+      installed: { name: string; version: string },
+      lockfile: "bun.lockb" | "bun.lock" = "bun.lockb",
+    ) {
+      const firstInstall = lockfile === "bun.lock" ? ["--save-text-lockfile"] : [];
+      for (const args of [firstInstall, ["--frozen-lockfile"]]) {
+        await rm(join(ctx.package_dir, "node_modules"), { recursive: true, force: true });
+        await using proc = spawn({
+          cmd: [bunExe(), "install", ...args],
+          cwd: ctx.package_dir,
+          stdout: "pipe",
+          stdin: "ignore",
+          stderr: "pipe",
+          env,
+        });
+        const [err, out, exitCode] = await Promise.all([proc.stderr.text(), proc.stdout.text(), proc.exited]);
+        expect(err).not.toContain("error:");
+        expect(out).toContain("1 package installed");
+        expect(exitCode).toBe(0);
+        expect(await file(join(ctx.package_dir, "node_modules", installed.name, "package.json")).json()).toMatchObject(
+          installed,
+        );
+      }
+      await access(join(ctx.package_dir, lockfile));
+    }
+
+    for (const version of [" latest", "\tlatest"]) {
+      it(`installs the dist-tag ${JSON.stringify(version)}`, async () => {
+        await withContext(defaultOpts, async ctx => {
+          const urls: string[] = [];
+          setContextHandler(ctx, dummyRegistryForContext(ctx, urls));
+          await writeFile(
+            join(ctx.package_dir, "package.json"),
+            JSON.stringify({ name: "foo", version: "0.0.1", dependencies: { bar: version } }),
+          );
+
+          await installTwice(ctx, { name: "bar", version: "0.0.2" });
+          expect(urls.slice(0, 2)).toEqual([`${ctx.registry_url}bar`, `${ctx.registry_url}bar-0.0.2.tgz`]);
+        });
+      });
+    }
+
+    it("keeps the literal as written in bun.lock", async () => {
+      await withContext(defaultOpts, async ctx => {
+        setContextHandler(ctx, dummyRegistryForContext(ctx, []));
+        await writeFile(
+          join(ctx.package_dir, "package.json"),
+          JSON.stringify({ name: "foo", version: "0.0.1", dependencies: { bar: " latest" } }),
+        );
+
+        await installTwice(ctx, { name: "bar", version: "0.0.2" }, "bun.lock");
+        expect(await file(join(ctx.package_dir, "bun.lock")).text()).toContain('"bar": " latest"');
+      });
+    });
+
+    it('installs the folder " ./pkg"', async () => {
+      await withContext(defaultOpts, async ctx => {
+        await mkdir(join(ctx.package_dir, "pkg"));
+        await Promise.all([
+          writeFile(
+            join(ctx.package_dir, "package.json"),
+            JSON.stringify({ name: "foo", version: "0.0.1", dependencies: { pkg: " ./pkg" } }),
+          ),
+          writeFile(join(ctx.package_dir, "pkg", "package.json"), JSON.stringify({ name: "pkg", version: "1.0.0" })),
+        ]);
+
+        await installTwice(ctx, { name: "pkg", version: "1.0.0" });
+        expect(ctx.requested).toBe(0);
+      });
+    });
+
+    // " file:./x.tgz" resolves on the first install either way; it is here for the second one, which
+    // re-parses the literal stored in bun.lockb with the tag the first install gave it.
+    for (const version of [" ./baz-0.0.3.tgz", " file:./baz-0.0.3.tgz"]) {
+      it(`installs the local tarball ${JSON.stringify(version)}`, async () => {
+        await withContext(defaultOpts, async ctx => {
+          await Promise.all([
+            writeFile(
+              join(ctx.package_dir, "package.json"),
+              JSON.stringify({ name: "foo", version: "0.0.1", dependencies: { baz: version } }),
+            ),
+            cp(join(import.meta.dir, "baz-0.0.3.tgz"), join(ctx.package_dir, "baz-0.0.3.tgz")),
+          ]);
+
+          await installTwice(ctx, { name: "baz", version: "0.0.3" });
+          expect(ctx.requested).toBe(0);
+        });
+      });
+    }
+  });
+
   it("should de-duplicate dependencies alongside tarball URL", async () => {
     await withContext(defaultOpts, async ctx => {
       const urls: string[] = [];

From ca6507875faf91ebfc862f0f9d4de46850a53e74 Mon Sep 17 00:00:00 2001
From: robobun <117481402+robobun@users.noreply.github.com>
Date: Mon, 17 Aug 2026 01:04:35 +0000
Subject: [PATCH 014/258] install: apply both "overrides" and "resolutions"
 when package.json has both (#38811)

---
 docs/pm/overrides.mdx                         |   2 +-
 .../PackageManager/install_with_manager.rs    |  11 +-
 src/install/lockfile/OverrideMap.rs           | 153 +++++++++++-----
 test/cli/install/nested-overrides.test.ts     | 163 ++++++++++++++++++
 4 files changed, 277 insertions(+), 52 deletions(-)

diff --git a/docs/pm/overrides.mdx b/docs/pm/overrides.mdx
index ee4357e3ac24..40f5b7b2a335 100644
--- a/docs/pm/overrides.mdx
+++ b/docs/pm/overrides.mdx
@@ -62,7 +62,7 @@ Bun only reads overrides from the root `package.json`, not from workspace packag
 
 ## `"resolutions"`
 
-`"resolutions"` is Yarn's alternative to `"overrides"`, with similar syntax. Bun supports it to help projects migrate from Yarn.
+`"resolutions"` is Yarn's alternative to `"overrides"`, with similar syntax. Bun supports it to help projects migrate from Yarn. When a `package.json` has both fields, Bun applies the rules from both. If the same package (or the same nested selector) appears in both, the `"overrides"` rule wins.
 
 {/* prettier-ignore */}
 ```json package.json icon="file-json"
diff --git a/src/install/PackageManager/install_with_manager.rs b/src/install/PackageManager/install_with_manager.rs
index ecb78304ec88..280fcddd91cb 100644
--- a/src/install/PackageManager/install_with_manager.rs
+++ b/src/install/PackageManager/install_with_manager.rs
@@ -1401,10 +1401,13 @@ fn overrides_field_name(
         return "overrides";
     };
     let root = entry.root;
-    if root.as_property(b"overrides").is_none() && root.as_property(b"resolutions").is_some() {
-        "resolutions"
-    } else {
-        "overrides"
+    match (
+        root.as_property(b"overrides").is_some(),
+        root.as_property(b"resolutions").is_some(),
+    ) {
+        (false, true) => "resolutions",
+        (true, true) => "overrides or resolutions",
+        _ => "overrides",
     }
 }
 
diff --git a/src/install/lockfile/OverrideMap.rs b/src/install/lockfile/OverrideMap.rs
index 4ac9fffab6a3..58188dbece3b 100644
--- a/src/install/lockfile/OverrideMap.rs
+++ b/src/install/lockfile/OverrideMap.rs
@@ -128,8 +128,16 @@ fn is_comment_key(key: &[u8]) -> bool {
     key.starts_with(b"//")
 }
 
+/// Parsing only appends or replaces in place, so the rules `"overrides"` produced are the first `flat` entries of `map` and the first `scoped` entries of `scoped`.
+#[derive(Clone, Copy, Default)]
+struct RuleCount {
+    flat: usize,
+    scoped: usize,
+}
+
 struct ParseContext<'a, 'b> {
     field: Field,
+    from_overrides: RuleCount,
     pm: &'a mut PackageManager,
     lockfile_dependencies: &'a [Dependency],
     root_package: &'a Package,
@@ -488,29 +496,40 @@ impl OverrideMap {
 
     /// Replaces the rule with the same (parent, parent range, target, target range); `buf` is the buffer `rule` was appended into.
     pub(crate) fn push_scoped(&mut self, rule: ScopedOverride, buf: &[u8]) {
-        if self.scoped_names.contains(&rule.dep.name_hash) {
-            if let Some(existing) = self.scoped.iter_mut().find(|existing| {
-                existing.dep.name_hash == rule.dep.name_hash
-                    && match (&existing.parent, &rule.parent) {
-                        (None, None) => true,
-                        (Some(a), Some(b)) => {
-                            a.name_hash == b.name_hash
-                                && a.version.literal.eql(b.version.literal, buf, buf)
-                        }
-                        _ => false,
-                    }
-                    && existing
-                        .target_range
-                        .literal
-                        .eql(rule.target_range.literal, buf, buf)
-            }) {
-                *existing = rule;
-                return;
+        self.put_scoped(rule, buf, 0);
+    }
+
+    /// Like `push_scoped`, except that a matching rule at a position below `keep` is kept and `rule` is dropped.
+    fn put_scoped(&mut self, rule: ScopedOverride, buf: &[u8], keep: usize) {
+        match self.scoped_position(&rule, buf) {
+            Some(index) if index < keep => {}
+            Some(index) => self.scoped[index] = rule,
+            None => {
+                self.scoped_names.insert(rule.dep.name_hash, ());
+                self.scoped.push(rule);
             }
-        } else {
-            self.scoped_names.insert(rule.dep.name_hash, ());
         }
-        self.scoped.push(rule);
+    }
+
+    fn scoped_position(&self, rule: &ScopedOverride, buf: &[u8]) -> Option<usize> {
+        if !self.scoped_names.contains(&rule.dep.name_hash) {
+            return None;
+        }
+        self.scoped.iter().position(|existing| {
+            existing.dep.name_hash == rule.dep.name_hash
+                && match (&existing.parent, &rule.parent) {
+                    (None, None) => true,
+                    (Some(a), Some(b)) => {
+                        a.name_hash == b.name_hash
+                            && a.version.literal.eql(b.version.literal, buf, buf)
+                    }
+                    _ => false,
+                }
+                && existing
+                    .target_range
+                    .literal
+                    .eql(rule.target_range.literal, buf, buf)
+        })
     }
 
     /// Row constructor for bun.lock / pnpm-lock.yaml; `Ok(false)` when `value`, the parent range or the target range does not parse.
@@ -589,14 +608,32 @@ impl OverrideMap {
         expr: Expr,
         builder: &mut StringBuilder,
     ) {
-        let (field, field_expr) = if let Some(overrides) = expr.as_property(b"overrides") {
-            (Field::Overrides, overrides.expr)
-        } else if let Some(resolutions) = expr.as_property(b"resolutions") {
-            (Field::Resolutions, resolutions.expr)
-        } else {
-            return;
-        };
+        for field in [Field::Overrides, Field::Resolutions] {
+            if let Some(property) = expr.as_property(field.json_name().as_bytes()) {
+                Self::count_field(
+                    pm,
+                    log,
+                    json_source,
+                    workspace_names,
+                    &expr,
+                    field,
+                    property.expr,
+                    builder,
+                );
+            }
+        }
+    }
 
+    fn count_field(
+        pm: &mut PackageManager,
+        log: &mut bun_ast::Log,
+        json_source: &bun_ast::Source,
+        workspace_names: &WorkspaceMap,
+        root_json: &Expr,
+        field: Field,
+        field_expr: Expr,
+        builder: &mut StringBuilder,
+    ) {
         field_expr.for_each_property(|key, _key_loc, value| {
             if is_comment_key(key) {
                 return;
@@ -612,7 +649,15 @@ impl OverrideMap {
                     }
                 }
                 builder.count(value);
-                count_ref_value(pm, log, json_source, workspace_names, &expr, value, builder);
+                count_ref_value(
+                    pm,
+                    log,
+                    json_source,
+                    workspace_names,
+                    root_json,
+                    value,
+                    builder,
+                );
                 return;
             }
             if field != Field::Overrides || !value.is_object() {
@@ -637,7 +682,7 @@ impl OverrideMap {
                         log,
                         json_source,
                         workspace_names,
-                        &expr,
+                        root_json,
                         child_value,
                         builder,
                     );
@@ -646,8 +691,8 @@ impl OverrideMap {
         });
     }
 
-    /// Given a package json expression, detect and parse override configuration into the given override map.
-    /// It is assumed the input map is uninitialized (zero entries)
+    /// Parses the root package.json's `"overrides"` and `"resolutions"` into this (empty) map.
+    /// Both fields apply; where they define the same selector the `"overrides"` rule wins.
     pub(crate) fn parse_append(
         &mut self,
         pm: &mut PackageManager,
@@ -660,15 +705,9 @@ impl OverrideMap {
         builder: &mut StringBuilder,
     ) -> Result<(), Error> {
         debug_assert!(self.map.count() == 0 && self.scoped.is_empty()); // only call parse once
-        let (field, field_expr) = if let Some(overrides) = expr.as_property(b"overrides") {
-            (Field::Overrides, overrides.expr)
-        } else if let Some(resolutions) = expr.as_property(b"resolutions") {
-            (Field::Resolutions, resolutions.expr)
-        } else {
-            return Ok(());
-        };
         let mut ctx = ParseContext {
-            field,
+            field: Field::Overrides,
+            from_overrides: RuleCount::default(),
             pm,
             lockfile_dependencies,
             root_package,
@@ -677,9 +716,16 @@ impl OverrideMap {
             workspace_names,
             builder,
         };
-        match field {
-            Field::Overrides => self.parse_from_overrides(&mut ctx, field_expr)?,
-            Field::Resolutions => self.parse_from_resolutions(&mut ctx, field_expr)?,
+        if let Some(overrides) = expr.as_property(b"overrides") {
+            self.parse_from_overrides(&mut ctx, overrides.expr)?;
+            ctx.from_overrides = RuleCount {
+                flat: self.map.count(),
+                scoped: self.scoped.len(),
+            };
+        }
+        if let Some(resolutions) = expr.as_property(b"resolutions") {
+            ctx.field = Field::Resolutions;
+            self.parse_from_resolutions(&mut ctx, resolutions.expr)?;
         }
         scoped_log!(
             OverrideMap,
@@ -898,24 +944,37 @@ impl OverrideMap {
             return Ok(());
         }
 
+        let name_hash = SemverBuilder::string_hash(target.name);
         let is_flat = parent.is_none() && target.range.is_empty();
-        let Some(dep) = parse_override_value(ctx, value_loc, target.name, value, is_flat)? else {
+        // Checked before the value is parsed: a flat `npm:` value also registers an alias, which a skipped rule must not do.
+        if is_flat
+            && self
+                .map
+                .get_index(&name_hash)
+                .is_some_and(|index| index < ctx.from_overrides.flat)
+        {
+            return Ok(());
+        }
+        let Some(dep) =
+            parse_override_value(ctx, value_loc, target.name, name_hash, value, is_flat)?
+        else {
             return Ok(());
         };
         let Some(target_range) = parse_range(ctx, key_loc, dep.name, dep.name_hash, target.range)
         else {
             return Ok(());
         };
-        if parent.is_none() && target_range.tag != VersionTag::Npm {
+        if is_flat {
             self.map.put_assume_capacity(dep.name_hash, dep);
         } else {
-            self.push_scoped(
+            self.put_scoped(
                 ScopedOverride {
                     parent: parent.cloned(),
                     target_range,
                     dep,
                 },
                 ctx.builder.string_bytes.as_slice(),
+                ctx.from_overrides.scoped,
             );
         }
         Ok(())
@@ -1063,6 +1122,7 @@ fn parse_override_value(
     ctx: &mut ParseContext<'_, '_>,
     loc: bun_ast::Loc,
     key: &[u8],
+    name_hash: PackageNameHash,
     value: &[u8],
     register_aliases: bool,
 ) -> Result<Option<Dependency>, Error> {
@@ -1087,7 +1147,6 @@ fn parse_override_value(
         return Ok(None);
     }
 
-    let name_hash = SemverBuilder::string_hash(key);
     let name = ctx.builder.append_with_hash::<SemverString>(key, name_hash);
 
     // https://docs.npmjs.com/cli/v9/configuring-npm/package-json#overrides
diff --git a/test/cli/install/nested-overrides.test.ts b/test/cli/install/nested-overrides.test.ts
index 43526a00c5d0..1cba002e7b9d 100644
--- a/test/cli/install/nested-overrides.test.ts
+++ b/test/cli/install/nested-overrides.test.ts
@@ -557,6 +557,128 @@ describe.concurrent("syntax", () => {
   });
 });
 
+// two-range-deps declares no-deps ^1.0.0 (1.1.0 without a rule) and @types/is-number >=1.0.0 (2.0.0 without a rule).
+describe.concurrent("overrides and resolutions in the same package.json", () => {
+  test("rules from both fields apply", async () => {
+    const dir = await project({
+      dependencies: { "two-range-deps": "1.0.0" },
+      overrides: { "no-deps": "1.0.0" },
+      resolutions: { "@types/is-number": "1.0.0" },
+    });
+    const { err } = await installOk(dir);
+    expect(err).not.toContain("warn:");
+    expect(await versionSeenBy(dir, "two-range-deps", "no-deps")).toBe("1.0.0");
+    expect(await versionSeenBy(dir, "two-range-deps", "@types/is-number")).toBe("1.0.0");
+    const first = await lock(dir);
+    expect(overridesSection(first)).toMatchInlineSnapshot(`
+      ""overrides": {
+        "@types/is-number": "1.0.0",
+        "no-deps": "1.0.0",
+      },"
+    `);
+    await installOk(dir, "--frozen-lockfile");
+    const again = await installOk(dir);
+    expect(again.err).not.toContain("Saved lockfile");
+    expect(await lock(dir)).toBe(first);
+  });
+
+  test("a scoped rule in resolutions applies next to a flat rule in overrides", async () => {
+    const dir = await project({
+      dependencies: { "two-range-deps": "1.0.0", "one-range-dep": "1.0.0" },
+      overrides: { "@types/is-number": "1.0.0" },
+      resolutions: { "one-range-dep/no-deps": "2.0.0" },
+    });
+    const { err } = await installOk(dir);
+    expect(err).not.toContain("warn:");
+    expect(await versionSeenBy(dir, "two-range-deps", "@types/is-number")).toBe("1.0.0");
+    expect(await versionSeenBy(dir, "one-range-dep", "no-deps")).toBe("2.0.0");
+    expect(await versionSeenBy(dir, "two-range-deps", "no-deps")).toBe("1.1.0");
+    expect(overridesSection(await lock(dir))).toMatchInlineSnapshot(`
+      ""overrides": {
+        "@types/is-number": "1.0.0",
+        "one-range-dep": {
+          "no-deps": "2.0.0",
+        },
+      },"
+    `);
+    await installOk(dir, "--frozen-lockfile");
+  });
+
+  test("the same name in both fields: overrides wins", async () => {
+    const dir = await project({
+      dependencies: { "one-range-dep": "1.0.0" },
+      overrides: { "no-deps": "1.0.0" },
+      resolutions: { "no-deps": "1.0.1" },
+    });
+    await installOk(dir);
+    expect(await versionSeenBy(dir, "one-range-dep", "no-deps")).toBe("1.0.0");
+    expect(overridesSection(await lock(dir))).toMatchInlineSnapshot(`
+      ""overrides": {
+        "no-deps": "1.0.0",
+      },"
+    `);
+  });
+
+  // A flat `npm:` rule also registers an alias that redirects matching edges before overrides are consulted,
+  // so a resolutions rule that loses to overrides must not be parsed at all.
+  test("a losing resolutions rule with an npm: value does not redirect the edge", async () => {
+    const dir = await project({
+      dependencies: { "one-range-dep": "1.0.0" },
+      overrides: { "no-deps": "1.0.0" },
+      resolutions: { "no-deps": "npm:a-dep@1.0.1" },
+    });
+    await installOk(dir);
+    expect(await packageSeenBy(dir, "one-range-dep", "no-deps")).toBe("no-deps@1.0.0");
+    expect(await lock(dir)).not.toContain("a-dep");
+  });
+
+  test("the same scoped selector in both fields: overrides wins", async () => {
+    const dir = await project({
+      dependencies: { "one-range-dep": "1.0.0" },
+      overrides: { "one-range-dep": { "no-deps": "1.0.0" } },
+      resolutions: { "one-range-dep/no-deps": "1.0.1" },
+    });
+    await installOk(dir);
+    expect(await versionSeenBy(dir, "one-range-dep", "no-deps")).toBe("1.0.0");
+    expect(overridesSection(await lock(dir))).toMatchInlineSnapshot(`
+      ""overrides": {
+        "one-range-dep": {
+          "no-deps": "1.0.0",
+        },
+      },"
+    `);
+  });
+
+  test("within resolutions the last spelling of a rule still wins", async () => {
+    const dir = await project({
+      dependencies: { "two-range-deps": "1.0.0" },
+      overrides: { "@types/is-number": "1.0.0" },
+      resolutions: { "**/no-deps": "1.0.0", "no-deps": "1.0.1" },
+    });
+    await installOk(dir);
+    expect(await versionSeenBy(dir, "two-range-deps", "no-deps")).toBe("1.0.1");
+    expect(await versionSeenBy(dir, "two-range-deps", "@types/is-number")).toBe("1.0.0");
+  });
+
+  test("editing resolutions is a frozen-lockfile change that names both fields", async () => {
+    const pkg = {
+      dependencies: { "two-range-deps": "1.0.0" },
+      overrides: { "no-deps": "1.0.0" },
+      resolutions: { "@types/is-number": "1.0.0" },
+    };
+    const dir = await project(pkg);
+    await installOk(dir);
+    pkg.resolutions["@types/is-number"] = "2.0.0";
+    await write(join(dir, "package.json"), JSON.stringify({ name: "nested-overrides", ...pkg }));
+    const frozen = await install(dir, "--frozen-lockfile");
+    expect(frozen.err).toContain("error: lockfile had changes, but lockfile is frozen");
+    expect(frozen.err).toContain("note: overrides or resolutions in package.json changed since bun.lock was saved");
+    expect(frozen.exitCode).toBe(1);
+    await installOk(dir);
+    expect(await versionSeenBy(dir, "two-range-deps", "@types/is-number")).toBe("2.0.0");
+  });
+});
+
 // The selector range is matched against the range the dependent declares; a rule applies when the two intersect.
 describe.concurrent("version-scoped targets", () => {
   test("a flat name@range rule applies to edges whose declared range intersects it", async () => {
@@ -1632,6 +1754,47 @@ one-dep@1.0.0:
     expect(await versionSeenBy(dir, "one-dep", "no-deps")).toBe("2.0.0");
   });
 
+  test("yarn.lock migration carries both overrides and resolutions", async () => {
+    const url = registry.registryUrl();
+    const [aDep, noDeps] = await Promise.all([integrityOf("a-dep", "1.0.2"), integrityOf("no-deps", "1.0.0")]);
+    const dir = await project(
+      {
+        dependencies: { "a-dep": "^1.0.1", "no-deps": "^1.0.0" },
+        overrides: { "no-deps": "1.0.0" },
+        resolutions: { "a-dep": "1.0.2" },
+      },
+      "hoisted",
+      {
+        "yarn.lock": `# THIS IS AN AUTOGENERATED FILE. DO NOT EDIT THIS FILE DIRECTLY.
+# yarn lockfile v1
+
+
+a-dep@^1.0.1:
+  version "1.0.2"
+  resolved "${url}a-dep/-/a-dep-1.0.2.tgz"
+  integrity ${aDep}
+
+no-deps@^1.0.0:
+  version "1.0.0"
+  resolved "${url}no-deps/-/no-deps-1.0.0.tgz"
+  integrity ${noDeps}
+`,
+      },
+    );
+    const migrated = await migrate(dir);
+    expect(migrated.err).not.toContain("error:");
+    expect(migrated.exitCode).toBe(0);
+    expect(overridesSection(await lock(dir))).toMatchInlineSnapshot(`
+      ""overrides": {
+        "a-dep": "1.0.2",
+        "no-deps": "1.0.0",
+      },"
+    `);
+    await installOk(dir, "--frozen-lockfile");
+    expect(await versionSeenBy(dir, undefined, "a-dep")).toBe("1.0.2");
+    expect(await versionSeenBy(dir, undefined, "no-deps")).toBe("1.0.0");
+  });
+
   // one-dep@1.0.0 declares no-deps@1.0.1; a lockfile snapshot on 2.0.0 is only consistent with an override.
   async function pnpmLock({ overrides, noDepsVersion = "2.0.0" }: { overrides?: string[]; noDepsVersion?: string }) {
     const [oneDep, noDeps] = await Promise.all([

From e0ebdb4b2da39f1ec6f2609f50f3d2863ff99787 Mon Sep 17 00:00:00 2001
From: robobun <117481402+robobun@users.noreply.github.com>
Date: Mon, 17 Aug 2026 01:04:39 +0000
Subject: [PATCH 015/258] Fix package-lock.json migration for scope registries
 configured without a trailing slash (#38698)

---
 src/install/migration/npm_lock.rs          |  5 +-
 test/cli/install/migration/migrate.test.ts | 59 ++++++++++++++++++++++
 2 files changed, 63 insertions(+), 1 deletion(-)

diff --git a/src/install/migration/npm_lock.rs b/src/install/migration/npm_lock.rs
index 263077dfa258..6acbcf2dcce2 100644
--- a/src/install/migration/npm_lock.rs
+++ b/src/install/migration/npm_lock.rs
@@ -591,11 +591,13 @@ impl<'a> Migrator<'a> {
         } else {
             name
         };
-        let href: &[u8] = self.manager.scope_for_package_name(name).url.href();
+        let href: &[u8] =
+            strings::without_trailing_slash(self.manager.scope_for_package_name(name).url.href());
         let url = &mut self.url;
         url.clear();
         url.reserve(
             href.len()
+                + 1
                 + name.len()
                 + b"/-/".len()
                 + unscoped.len()
@@ -604,6 +606,7 @@ impl<'a> Migrator<'a> {
                 + b".tgz".len(),
         );
         url.extend_from_slice(href);
+        url.push(b'/');
         url.extend_from_slice(name);
         url.extend_from_slice(b"/-/");
         url.extend_from_slice(unscoped);
diff --git a/test/cli/install/migration/migrate.test.ts b/test/cli/install/migration/migrate.test.ts
index 8bb11fffa225..9cdcf8023fbf 100644
--- a/test/cli/install/migration/migrate.test.ts
+++ b/test/cli/install/migration/migrate.test.ts
@@ -109,6 +109,65 @@ test("migrate from npm lockfile that is missing `resolved` properties", async ()
   expect(exitCode).toBe(0);
 });
 
+// https://github.com/oven-sh/bun/issues/38668
+test.concurrent("migrate npm lockfile with missing `resolved` when scope registry has no trailing slash", async () => {
+  using dir = tempDir("migrate-scope-no-slash", {
+    "package.json": JSON.stringify({
+      name: "repro",
+      version: "1.0.0",
+      dependencies: {
+        "@myscope/a": "1.0.0",
+        "@myscope/b": "2.0.0",
+      },
+    }),
+    "bunfig.toml": `
+[install.scopes]
+"@myscope" = { url = "https://example-registry.invalid" }
+`,
+    "package-lock.json": JSON.stringify({
+      name: "repro",
+      version: "1.0.0",
+      lockfileVersion: 3,
+      requires: true,
+      packages: {
+        "": {
+          name: "repro",
+          version: "1.0.0",
+          dependencies: {
+            "@myscope/a": "1.0.0",
+            "@myscope/b": "2.0.0",
+          },
+        },
+        // without `integrity` the malformed URL failed the whole migration
+        "node_modules/@myscope/a": { version: "1.0.0" },
+        // with `integrity` the malformed URL was written into bun.lock
+        "node_modules/@myscope/b": {
+          version: "2.0.0",
+          integrity: "sha512-v2kDEe57lecTulaDIuNTPy3Ry4gLGJ6Z1O3vE1krgXZNrsQ+LFTGHVxVjcXPs17LhbZVGedAJv8XZ1tvj5FvSg==",
+        },
+      },
+    }),
+  });
+
+  // `bun pm migrate` never touches the network, so the unresolvable registry host is fine
+  await using proc = Bun.spawn({
+    cmd: [bunExe(), "pm", "migrate"],
+    env: bunEnv,
+    cwd: String(dir),
+    stdout: "ignore",
+    stderr: "pipe",
+  });
+  const [stderr, exitCode] = await Promise.all([proc.stderr.text(), proc.exited]);
+
+  expect(stderr).not.toContain("InvalidNPMLockfile");
+  expect(exitCode).toBe(0);
+
+  const lock = await Bun.file(join(String(dir), "bun.lock")).text();
+  expect(lock).toContain("https://example-registry.invalid/@myscope/a/-/a-1.0.0.tgz");
+  expect(lock).toContain("https://example-registry.invalid/@myscope/b/-/b-2.0.0.tgz");
+  expect(lock).not.toContain("invalid@myscope");
+});
+
 test("npm lockfile with relative workspaces", async () => {
   const testDir = tmpdirSync();
   fs.cpSync(join(import.meta.dir, "lockfile-with-workspaces"), testDir, { recursive: true });

From 3792fb16e7656c8c2ac82998f491afe29bc9617d Mon Sep 17 00:00:00 2001
From: robobun <117481402+robobun@users.noreply.github.com>
Date: Mon, 17 Aug 2026 01:04:43 +0000
Subject: [PATCH 016/258] install: record package.json trustedDependencies when
 migrating a lockfile (#38773)

---
 src/install/lockfile/Package.rs               |  62 ++++--
 src/install/migration.rs                      | 106 ++++++++--
 .../bun-install-lifecycle-scripts.test.ts     | 199 ++++++++++++++++++
 3 files changed, 324 insertions(+), 43 deletions(-)

diff --git a/src/install/lockfile/Package.rs b/src/install/lockfile/Package.rs
index 767c6aa80c1f..0b4ed4b1ca4a 100644
--- a/src/install/lockfile/Package.rs
+++ b/src/install/lockfile/Package.rs
@@ -126,6 +126,38 @@ fn invalid_trusted_dependencies(
     crate::Error::InvalidPackageJSON
 }
 
+/// A declared `trustedDependencies` (even `[]`) replaces the default list, so the set becomes `Some` as soon as the field exists.
+pub(crate) fn parse_append_trusted_dependencies(
+    trusted_dependencies: &mut Option<TrustedDependenciesSet>,
+    log: &mut bun_ast::Log,
+    source: &bun_ast::Source,
+    json: Expr,
+    bump: &bun_alloc::Arena,
+) -> crate::Result<()> {
+    let Some(q) = json.as_property(b"trustedDependencies") else {
+        return Ok(());
+    };
+    let count = match &q.expr.data {
+        ExprData::EArray(arr) => arr.items.len_u32() as usize,
+        ExprData::EArrayJSON(arr) => arr.get().items().len(),
+        _ => return Err(invalid_trusted_dependencies(log, source, q.loc)),
+    };
+    let trusted = trusted_dependencies.get_or_insert_with(Default::default);
+    trusted.ensure_unused_capacity(count)?;
+    if let Some(mut items) = q.expr.as_array() {
+        while let Some(item) = items.next() {
+            let Some(name) = item.as_string(bump) else {
+                return Err(invalid_trusted_dependencies(log, source, q.loc));
+            };
+            trusted.put_assume_capacity(
+                semver::string::Builder::string_hash(name) as TruncatedPackageNameHash,
+                Box::<[u8]>::from(name),
+            );
+        }
+    }
+    Ok(())
+}
+
 // `SemverIntType` defaults to `u64`, the only instantiation the lockfile/PM
 // call sites name unqualified.
 //
@@ -2472,29 +2504,13 @@ impl Package<u64> {
         }
 
         if FEATURES.trusted_dependencies {
-            if let Some(q) = json.as_property(b"trustedDependencies") {
-                let count = match &q.expr.data {
-                    ExprData::EArray(arr) => arr.items.len_u32() as usize,
-                    ExprData::EArrayJSON(arr) => arr.get().items().len(),
-                    _ => return Err(invalid_trusted_dependencies(log, source, q.loc)),
-                };
-                if lockfile.trusted_dependencies.is_none() {
-                    lockfile.trusted_dependencies = Some(Default::default());
-                }
-                let trusted = lockfile.trusted_dependencies.as_mut().unwrap();
-                trusted.ensure_unused_capacity(count)?;
-                if let Some(mut items) = q.expr.as_array() {
-                    while let Some(item) = items.next() {
-                        let Some(name) = item.as_string(&bump) else {
-                            return Err(invalid_trusted_dependencies(log, source, q.loc));
-                        };
-                        trusted.put_assume_capacity(
-                            semver::string::Builder::string_hash(name) as TruncatedPackageNameHash,
-                            Box::<[u8]>::from(name),
-                        );
-                    }
-                }
-            }
+            parse_append_trusted_dependencies(
+                &mut lockfile.trusted_dependencies,
+                log,
+                source,
+                json,
+                &bump,
+            )?;
         }
 
         if FEATURES.is_main {
diff --git a/src/install/migration.rs b/src/install/migration.rs
index dd5270fe8424..172b5661560d 100644
--- a/src/install/migration.rs
+++ b/src/install/migration.rs
@@ -1,8 +1,8 @@
 use crate::Error;
 use bun_ast::{E, ExprData};
 use bun_core::strings;
-use bun_core::{Output, zstr};
-use bun_paths::PathBuffer;
+use bun_core::{Output, ZStr, zstr};
+use bun_paths::{AutoAbsPath, PathBuffer};
 use bun_semver::query::token::Wildcard;
 use bun_semver::{self as Semver, SlicedString};
 use bun_sys::{self, Fd, File, O};
@@ -11,8 +11,8 @@ use crate::install::{self as Install, PackageManager, Subcommand};
 use crate::lockfile::{
     Format as LockfileFormat, LoadResult, LoadResultErr, LoadResultOk, LoadStep, Lockfile, Migrated,
 };
-use crate::lockfile_real::package::PackageColumns as _;
 use crate::lockfile_real::package::workspace_map::{MissingWorkspace, NamesArray, WorkspaceMap};
+use crate::lockfile_real::package::{PackageColumns as _, parse_append_trusted_dependencies};
 use crate::npm::{self as Npm};
 use crate::pnpm;
 use crate::pnpm::MigratePnpmLockfileError;
@@ -64,11 +64,13 @@ pub fn detect_and_load_other_lockfile<'a>(
                 }
             };
 
-        if matches!(migrate_result, LoadResult::Ok { .. }) {
-            report_migrated(manager, log, &timer, "package-lock.json");
-        }
-
-        return migrate_result;
+        return finish_migration(
+            migrate_result,
+            manager,
+            log,
+            &timer,
+            zstr!("package-lock.json"),
+        );
     }
 
     'yarn: {
@@ -88,11 +90,7 @@ pub fn detect_and_load_other_lockfile<'a>(
             }
         };
 
-        if matches!(migrate_result, LoadResult::Ok { .. }) {
-            report_migrated(manager, log, &timer, "yarn.lock");
-        }
-
-        return migrate_result;
+        return finish_migration(migrate_result, manager, log, &timer, zstr!("yarn.lock"));
     }
 
     'pnpm: {
@@ -155,16 +153,81 @@ pub fn detect_and_load_other_lockfile<'a>(
             }
         };
 
-        if matches!(migrate_result, LoadResult::Ok { .. }) {
-            report_migrated(manager, log, &timer, "pnpm-lock.yaml");
-        }
-
-        return migrate_result;
+        return finish_migration(
+            migrate_result,
+            manager,
+            log,
+            &timer,
+            zstr!("pnpm-lock.yaml"),
+        );
     }
 
     LoadResult::NotFound
 }
 
+fn finish_migration<'a>(
+    migrate_result: LoadResult<'a>,
+    manager: &mut PackageManager,
+    log: &mut bun_ast::Log,
+    timer: &std::time::Instant,
+    lockfile_name: &'static ZStr,
+) -> LoadResult<'a> {
+    let ok = match migrate_result {
+        LoadResult::Ok(ok) => ok,
+        other => return other,
+    };
+    if let Err(err) = record_trusted_dependencies(&mut *ok.lockfile, manager, log) {
+        if !manager.options.log_level.is_silent() && log.has_errors() {
+            let _ = log.print(std::ptr::from_mut(Output::error_writer()));
+            Output::flush();
+        }
+        log.reset();
+        return LoadResult::Err(LoadResultErr {
+            step: LoadStep::Migrating,
+            value: err,
+            lockfile_path: lockfile_name,
+            format: LockfileFormat::Text,
+        });
+    }
+    report_migrated(manager, log, timer, lockfile_name);
+    LoadResult::Ok(ok)
+}
+
+/// Other lockfiles have no `trustedDependencies`; read the root's and the members' from package.json like `Package::parse_with_json` does, since `bun pm migrate` saves this lockfile as-is.
+fn record_trusted_dependencies(
+    lockfile: &mut Lockfile,
+    manager: &mut PackageManager,
+    log: &mut bun_ast::Log,
+) -> Result<(), Error> {
+    let bump = bun_alloc::Arena::new();
+    let string_bytes = lockfile.buffers.string_bytes.as_slice();
+    let root: &[u8] = b"";
+    let members = lockfile
+        .workspace_paths
+        .values()
+        .iter()
+        .map(|path| path.slice(string_bytes));
+    for relative_dir in core::iter::once(root).chain(members) {
+        let mut package_json_path = AutoAbsPath::init_top_level_dir();
+        let _ = package_json_path.append(relative_dir);
+        let _ = package_json_path.append(b"package.json");
+        let crate::GetJsonResult::Entry(entry) = manager
+            .workspace_package_json_cache
+            .get_with_path(log, package_json_path.slice(), Default::default())
+        else {
+            continue;
+        };
+        parse_append_trusted_dependencies(
+            &mut lockfile.trusted_dependencies,
+            log,
+            &entry.source,
+            entry.root,
+            &bump,
+        )?;
+    }
+    Ok(())
+}
+
 /// True when the migrator already printed the version warn/error + upgrade note, so lockfile-load reporters must stay quiet.
 pub fn reported_unsupported_lockfile_version(err: &LoadResultErr) -> bool {
     err.step == LoadStep::Migrating && matches!(err.value, Error::UnexpectedLockfileVersion)
@@ -229,7 +292,7 @@ fn report_migrated(
     manager: &PackageManager,
     log: &mut bun_ast::Log,
     timer: &std::time::Instant,
-    lockfile_name: &str,
+    lockfile_name: &ZStr,
 ) {
     if manager.options.log_level.is_silent() {
         log.reset();
@@ -240,7 +303,10 @@ fn report_migrated(
         log.reset();
     }
     Output::print_elapsed(timer.elapsed().as_nanos() as f64 / 1_000_000.0);
-    bun_core::pretty_errorln!(" <d>migrated lockfile from <r><green>{}<r>", lockfile_name);
+    bun_core::pretty_errorln!(
+        " <d>migrated lockfile from <r><green>{}<r>",
+        bstr::BStr::new(lockfile_name.as_bytes())
+    );
     Output::flush();
 }
 
diff --git a/test/cli/install/bun-install-lifecycle-scripts.test.ts b/test/cli/install/bun-install-lifecycle-scripts.test.ts
index aea7f38ebec4..bd4989773c04 100644
--- a/test/cli/install/bun-install-lifecycle-scripts.test.ts
+++ b/test/cli/install/bun-install-lifecycle-scripts.test.ts
@@ -259,6 +259,205 @@ test.concurrent(
   },
 );
 
+describe("trustedDependencies survive lockfile migration", () => {
+  // `electron` is on the default trusted list, `uses-what-bin` is not. Declaring
+  // `trustedDependencies: ["uses-what-bin"]` therefore has to flip both: the
+  // migrated lockfile must run uses-what-bin's install script and block electron's.
+  const integrity = {
+    "electron": "sha512-GkuwCdn6o8Krsxb3DIIqYP+TAi8Y5jYUadmseZ6nR2op2k5ssdKRYo4JjYDGopa1ACrGAcQuWViz/+vX/WjYnA==",
+    "uses-what-bin": "sha512-EI+uMDESinRewWTFhsyzibkzFV+j5LmLM7T1jEpb2X82TmzhSQRzCBTBURflt5dGvNEIY7l563P9Su01Tpe++g==",
+    "what-bin": "sha512-mbvEObM9mSliIzNJ4lJHfx8Zzdcf3v8PCIanJyIbXv6AFuuipK5tirQuM9Oi1yFXgO/YxI1W5zt4AwwLGxmaPA==",
+  };
+  const shasum = {
+    "electron": "f1b8bc2c23cd7e4f1500669dfaf8757578d2e391",
+    "uses-what-bin": "78dea365c24435c0faa99dca78ed44c42273b84a",
+    "what-bin": "934dc0859a1a9ccf90ac341b1d4867f94d8e4d11",
+  };
+  const dependencies = { "electron": "1.0.0", "uses-what-bin": "1.5.0" };
+
+  function tarball(name: keyof typeof integrity, version: string) {
+    return `http://localhost:${verdaccio.port}/${name}/-/${name}-${version}.tgz`;
+  }
+
+  function packageLock() {
+    return JSON.stringify({
+      name: "foo",
+      version: "1.0.0",
+      lockfileVersion: 3,
+      requires: true,
+      packages: {
+        "": { name: "foo", version: "1.0.0", dependencies },
+        "node_modules/electron": {
+          version: "1.0.0",
+          resolved: tarball("electron", "1.0.0"),
+          integrity: integrity["electron"],
+          hasInstallScript: true,
+        },
+        "node_modules/uses-what-bin": {
+          version: "1.5.0",
+          resolved: tarball("uses-what-bin", "1.5.0"),
+          integrity: integrity["uses-what-bin"],
+          hasInstallScript: true,
+          dependencies: { "what-bin": "1.5.0" },
+        },
+        "node_modules/what-bin": {
+          version: "1.5.0",
+          resolved: tarball("what-bin", "1.5.0"),
+          integrity: integrity["what-bin"],
+          bin: { "what-bin": "what-bin.js" },
+        },
+      },
+    });
+  }
+
+  function yarnLock() {
+    return `# THIS IS AN AUTOGENERATED FILE. DO NOT EDIT THIS FILE DIRECTLY.
+# yarn lockfile v1
+
+
+electron@1.0.0:
+  version "1.0.0"
+  resolved "${tarball("electron", "1.0.0")}#${shasum["electron"]}"
+  integrity ${integrity["electron"]}
+
+uses-what-bin@1.5.0:
+  version "1.5.0"
+  resolved "${tarball("uses-what-bin", "1.5.0")}#${shasum["uses-what-bin"]}"
+  integrity ${integrity["uses-what-bin"]}
+  dependencies:
+    what-bin "1.5.0"
+
+what-bin@1.5.0:
+  version "1.5.0"
+  resolved "${tarball("what-bin", "1.5.0")}#${shasum["what-bin"]}"
+  integrity ${integrity["what-bin"]}
+`;
+  }
+
+  function pnpmLock(importer: string) {
+    return `lockfileVersion: '9.0'
+
+settings:
+  autoInstallPeers: true
+  excludeLinksFromLockfile: false
+
+importers:
+${importer}
+packages:
+
+  electron@1.0.0:
+    resolution: {integrity: ${integrity["electron"]}}
+
+  uses-what-bin@1.5.0:
+    resolution: {integrity: ${integrity["uses-what-bin"]}}
+
+  what-bin@1.5.0:
+    resolution: {integrity: ${integrity["what-bin"]}}
+    hasBin: true
+
+snapshots:
+
+  electron@1.0.0: {}
+
+  uses-what-bin@1.5.0:
+    dependencies:
+      what-bin: 1.5.0
+
+  what-bin@1.5.0: {}
+`;
+  }
+
+  const importerDependencies = `
+    dependencies:
+      electron:
+        specifier: 1.0.0
+        version: 1.0.0
+      uses-what-bin:
+        specifier: 1.5.0
+        version: 1.5.0
+`;
+
+  async function runBunPm(env: Record<string, string>, packageDir: string, subcommand: string) {
+    const { stdout, stderr, exited } = spawn({
+      cmd: [bunExe(), "pm", subcommand],
+      cwd: packageDir,
+      stdout: "pipe",
+      stdin: "ignore",
+      stderr: "pipe",
+      env,
+    });
+    const [out, err, exitCode] = await Promise.all([stdout.text(), stderr.text(), exited]);
+    expect(err).not.toContain("error:");
+    expect(exitCode).toBe(0);
+    return { out, err };
+  }
+
+  // The migrated bun.lock is what gets committed and installed from with
+  // --frozen-lockfile, which never writes it back, so everything package.json
+  // declares has to be in it when `bun pm migrate` returns.
+  async function expectMigrationKeepsTrust(env: Record<string, string>, packageDir: string, lockfileName: string) {
+    const { err: migrateErr } = await runBunPm(env, packageDir, "migrate");
+    expect(migrateErr).toContain(`migrated lockfile from ${lockfileName}`);
+    expect(await file(join(packageDir, "bun.lock")).text()).toMatch(
+      /"trustedDependencies": \[\s*"uses-what-bin",\s*\]/,
+    );
+
+    await runBunInstall(env, packageDir, { frozenLockfile: true });
+    expect(
+      await Promise.all([
+        exists(join(packageDir, "node_modules", "uses-what-bin", "what-bin.txt")),
+        exists(join(packageDir, "node_modules", "electron", "preinstall.txt")),
+      ]),
+    ).toEqual([true, false]);
+
+    const { out } = await runBunPm(env, packageDir, "untrusted");
+    expect(out).toContain("./node_modules/electron @1.0.0".replaceAll("/", sep));
+    expect(out).not.toContain("uses-what-bin");
+  }
+
+  const rootLockfiles: Record<string, () => string> = {
+    "package-lock.json": packageLock,
+    "yarn.lock": yarnLock,
+    "pnpm-lock.yaml": () => pnpmLock(`\n  .:${importerDependencies}`),
+  };
+
+  for (const [lockfileName, contents] of Object.entries(rootLockfiles)) {
+    test.concurrent(`bun pm migrate from ${lockfileName} keeps the root's trustedDependencies`, async () => {
+      using ctx = await setupTest();
+      const { packageDir, packageJson, env } = ctx;
+
+      await Promise.all([
+        write(
+          packageJson,
+          JSON.stringify({ name: "foo", version: "1.0.0", dependencies, trustedDependencies: ["uses-what-bin"] }),
+        ),
+        write(join(packageDir, lockfileName), contents()),
+      ]);
+
+      await expectMigrationKeepsTrust(env, packageDir, lockfileName);
+    });
+  }
+
+  test.concurrent("bun pm migrate from pnpm-lock.yaml keeps a workspace member's trustedDependencies", async () => {
+    using ctx = await setupTest();
+    const { packageDir, packageJson, env } = ctx;
+
+    // Like `bun install`, a list declared by a member counts for the whole
+    // install: it is recorded and it turns the default trusted list off.
+    await Promise.all([
+      write(packageJson, JSON.stringify({ name: "foo", version: "1.0.0", workspaces: ["packages/*"] })),
+      write(join(packageDir, "pnpm-workspace.yaml"), "packages:\n  - packages/*\n"),
+      write(
+        join(packageDir, "packages", "app", "package.json"),
+        JSON.stringify({ name: "app", version: "1.0.0", dependencies, trustedDependencies: ["uses-what-bin"] }),
+      ),
+      write(join(packageDir, "pnpm-lock.yaml"), pnpmLock(`\n  .: {}\n\n  packages/app:${importerDependencies}`)),
+    ]);
+
+    await expectMigrationKeepsTrust(env, packageDir, "pnpm-lock.yaml");
+  });
+});
+
 test.concurrent("node-gyp shim directory added to lifecycle script PATH gets a randomized name", async () => {
   using ctx = await setupTest();
   const { packageDir, packageJson, env } = ctx;

From d18e84cdf941a0301a517843eb26b523656572df Mon Sep 17 00:00:00 2001
From: robobun <117481402+robobun@users.noreply.github.com>
Date: Mon, 17 Aug 2026 01:04:47 +0000
Subject: [PATCH 017/258] install: keep the pnpm block in package.json when
 migrating from pnpm (#38775)

---
 docs/pm/cli/install.mdx                       |  12 +-
 src/install/pnpm.rs                           | 291 +++++-------------
 .../install/migration/pnpm-lock-v9.test.ts    | 227 +++++++++++++-
 test/cli/install/nested-overrides.test.ts     |  20 +-
 4 files changed, 319 insertions(+), 231 deletions(-)

diff --git a/docs/pm/cli/install.mdx b/docs/pm/cli/install.mdx
index bdf55958b896..08f526a04126 100644
--- a/docs/pm/cli/install.mdx
+++ b/docs/pm/cli/install.mdx
@@ -583,11 +583,13 @@ Bun preserves dependencies that use pnpm's `catalog:` protocol:
 
 ### Configuration Migration
 
-Bun migrates the following pnpm configuration from both `pnpm-lock.yaml` and `pnpm-workspace.yaml`:
+Bun copies the following pnpm configuration into the root `package.json`:
 
-- **Overrides**: Moved from `pnpm.overrides` to root-level `overrides` in `package.json`
-- **Patched Dependencies**: Moved from `pnpm.patchedDependencies` to root-level `patchedDependencies` in `package.json`
-- **Workspace Overrides**: Applied from `pnpm-workspace.yaml` to root `package.json`
+- **Overrides**: Copied from `pnpm.overrides` to root-level `overrides` in `package.json`
+- **Patched Dependencies**: Copied from `pnpm.patchedDependencies` to root-level `patchedDependencies` in `package.json`
+- **Workspace Overrides**: Copied from `overrides` and `patchedDependencies` in `pnpm-workspace.yaml` to the same root-level fields
+
+Bun leaves the `pnpm` field of `package.json` as it is. pnpm reads its configuration from that field and ignores the root-level fields, so `pnpm install --frozen-lockfile` keeps working for teammates who still use pnpm. Bun reads the root-level fields and ignores the `pnpm` field.
 
 ### Requirements and limitations
 
@@ -598,7 +600,7 @@ Bun migrates the following pnpm configuration from both `pnpm-lock.yaml` and `pn
 - Relative `link:` dependencies and git dependencies with a sub-directory (`resolution.path`) are not supported
 - If migration fails for any of these reasons, Bun prints why and resolves from scratch instead
 
-After migration, you can safely remove `pnpm-lock.yaml` and `pnpm-workspace.yaml` files.
+Once nobody on the repository uses pnpm anymore, you can remove `pnpm-lock.yaml`, `pnpm-workspace.yaml`, and the `pnpm` field of `package.json`.
 
 ---
 
diff --git a/src/install/pnpm.rs b/src/install/pnpm.rs
index e14532accf02..ed086e505dce 100644
--- a/src/install/pnpm.rs
+++ b/src/install/pnpm.rs
@@ -17,6 +17,7 @@ use crate::external_slice::ExternalSlice;
 use crate::integrity::Integrity;
 use crate::lockfile::{self, LoadResult, LoadResultOk, Lockfile};
 use crate::npm::{self};
+use crate::package_manager_real::update_package_json_and_install::print_package_json_into_cache_entry;
 use crate::repository::Repository;
 use crate::resolution::{self, Resolution, TaggedValue};
 use crate::{DependencyID, INVALID_PACKAGE_ID, PackageID, PackageManager};
@@ -2364,140 +2365,28 @@ fn update_package_json_after_migration(
         return Ok(());
     }
 
-    let mut needs_update = false;
-    let mut moved_overrides = false;
-    let mut moved_patched_deps = false;
-    let mut moved: Vec<&'static str> = Vec::new();
+    let mut copied: Vec<&'static str> = Vec::new();
 
-    if let Some(mut pnpm_prop) = json.as_property(b"pnpm") {
+    // Copied, not moved: pnpm keeps reading this block, bun only reads the root-level fields.
+    if let Some(pnpm_prop) = json.as_property(b"pnpm") {
         if pnpm_prop.expr.is_object() {
-            let pnpm_obj = e_object_mut(&mut pnpm_prop.expr);
-
-            if let Some(overrides_field) = pnpm_obj.get(b"overrides") {
-                if is_non_empty_object(&overrides_field) {
-                    if let Some(mut existing_prop) = json.as_property(b"overrides") {
-                        if existing_prop.expr.is_object() {
-                            let existing_overrides = e_object_mut(&mut existing_prop.expr);
-                            for prop in e_object(&overrides_field).properties.slice() {
-                                let Some(key) =
-                                    as_string(prop.key.as_ref().expect("infallible: prop has key"))
-                                else {
-                                    continue;
-                                };
-                                existing_overrides.put(
-                                    &bump,
-                                    key,
-                                    prop.value.expect("infallible: prop has value"),
-                                )?;
-                            }
-                        }
-                    } else {
-                        e_object_mut(&mut json).put(&bump, b"overrides", overrides_field)?;
-                    }
-                    moved_overrides = true;
-                    needs_update = true;
-                    moved.push("pnpm.overrides to overrides");
-                }
-            }
+            let pnpm_obj = e_object(&pnpm_prop.expr);
 
-            if let Some(mut patched_field) = pnpm_obj.get(b"patchedDependencies") {
-                if is_non_empty_object(&patched_field) {
-                    rewrite_bare_patch_keys(&mut patched_field, patches)?;
-                    if let Some(mut existing_prop) = json.as_property(b"patchedDependencies") {
-                        if existing_prop.expr.is_object() {
-                            let existing_patches = e_object_mut(&mut existing_prop.expr);
-                            for prop in e_object(&patched_field).properties.slice() {
-                                let Some(key) =
-                                    as_string(prop.key.as_ref().expect("infallible: prop has key"))
-                                else {
-                                    continue;
-                                };
-                                existing_patches.put(
-                                    &bump,
-                                    key,
-                                    prop.value.expect("infallible: prop has value"),
-                                )?;
-                            }
-                        }
-                    } else {
-                        e_object_mut(&mut json).put(
-                            &bump,
-                            b"patchedDependencies",
-                            patched_field,
-                        )?;
-                    }
-                    moved_patched_deps = true;
-                    needs_update = true;
-                    moved.push("pnpm.patchedDependencies to patchedDependencies");
+            if let Some(overrides) = pnpm_obj.get(b"overrides").filter(is_non_empty_object) {
+                if copy_into_root(&mut json, &bump, b"overrides", copy_object(&overrides))? {
+                    copied.push("pnpm.overrides to overrides");
                 }
             }
 
-            if moved_overrides || moved_patched_deps {
-                let mut remaining_count: usize = 0;
-                for prop in pnpm_obj.properties.slice() {
-                    let Some(key) = as_string(prop.key.as_ref().expect("infallible: prop has key"))
-                    else {
-                        remaining_count += 1;
-                        continue;
-                    };
-                    if moved_overrides && key == b"overrides" {
-                        continue;
-                    }
-                    if moved_patched_deps && key == b"patchedDependencies" {
-                        continue;
-                    }
-                    remaining_count += 1;
-                }
-
-                if remaining_count == 0 {
-                    let mut new_root_count: usize = 0;
-                    for prop in e_object(&json).properties.slice() {
-                        let Some(key) =
-                            as_string(prop.key.as_ref().expect("infallible: prop has key"))
-                        else {
-                            new_root_count += 1;
-                            continue;
-                        };
-                        if key != b"pnpm" {
-                            new_root_count += 1;
-                        }
-                    }
-
-                    let mut new_root_props = G::PropertyList::init_capacity(new_root_count);
-                    for prop in e_object(&json).properties.slice() {
-                        let Some(key) =
-                            as_string(prop.key.as_ref().expect("infallible: prop has key"))
-                        else {
-                            VecExt::append(&mut new_root_props, shallow_clone_prop(prop));
-                            continue;
-                        };
-                        if key != b"pnpm" {
-                            VecExt::append(&mut new_root_props, shallow_clone_prop(prop));
-                        }
-                    }
-
-                    e_object_mut(&mut json).properties = new_root_props;
-                } else {
-                    let mut new_pnpm_props = G::PropertyList::init_capacity(remaining_count);
-                    for prop in pnpm_obj.properties.slice() {
-                        let Some(key) =
-                            as_string(prop.key.as_ref().expect("infallible: prop has key"))
-                        else {
-                            VecExt::append(&mut new_pnpm_props, shallow_clone_prop(prop));
-                            continue;
-                        };
-                        if moved_overrides && key == b"overrides" {
-                            continue;
-                        }
-                        if moved_patched_deps && key == b"patchedDependencies" {
-                            continue;
-                        }
-                        VecExt::append(&mut new_pnpm_props, shallow_clone_prop(prop));
-                    }
-
-                    pnpm_obj.properties = new_pnpm_props;
+            if let Some(patched) = pnpm_obj
+                .get(b"patchedDependencies")
+                .filter(is_non_empty_object)
+            {
+                let mut patched = copy_object(&patched);
+                rewrite_bare_patch_keys(&mut patched, patches)?;
+                if copy_into_root(&mut json, &bump, b"patchedDependencies", patched)? {
+                    copied.push("pnpm.patchedDependencies to patchedDependencies");
                 }
-                needs_update = true;
             }
         }
     }
@@ -2522,11 +2411,11 @@ fn update_package_json_after_migration(
             // `Expr::data_store_reset`).
             let contents: &'static [u8] = js_ast::data_store_dupe_str(&contents);
             let yaml_source = bun_ast::Source::init_path_string(b"pnpm-workspace.yaml", contents);
-            let arena = bun_alloc::Arena::new();
+            // Quoted scalars are copied into the arena; `bump` lives until the print below.
             let Ok(ws_root) = bun_parsers::yaml::YAML::parse(
                 &yaml_source,
                 log,
-                &arena,
+                &bump,
                 bun_parsers::yaml::CyclicAliases::Reject,
             ) else {
                 break 'read_pnpm_workspace_yaml;
@@ -2655,108 +2544,42 @@ fn update_package_json_after_migration(
         }
     }
     if wrote_workspaces {
-        needs_update = true;
-        moved.push("pnpm-workspace.yaml to workspaces");
-    }
-
-    // Handle overrides from pnpm-workspace.yaml
-    if let Some(ws_overrides) = &workspace_overrides_obj {
-        if ws_overrides.is_object() {
-            if let Some(mut existing_prop) = json.as_property(b"overrides") {
-                if existing_prop.expr.is_object() {
-                    let existing_overrides = e_object_mut(&mut existing_prop.expr);
-                    for prop in e_object(ws_overrides).properties.slice() {
-                        let Some(key) =
-                            as_string(prop.key.as_ref().expect("infallible: prop has key"))
-                        else {
-                            continue;
-                        };
-                        existing_overrides.put(
-                            &bump,
-                            key,
-                            prop.value.expect("infallible: prop has value"),
-                        )?;
-                    }
-                }
-            } else {
-                e_object_mut(&mut json).put(&bump, b"overrides", *ws_overrides)?;
-            }
-            needs_update = true;
-            moved.push("pnpm-workspace.yaml overrides to overrides");
-        }
+        copied.push("pnpm-workspace.yaml to workspaces");
     }
 
-    // Handle patchedDependencies from pnpm-workspace.yaml
-    if let Some(ws_patched) = &mut workspace_patched_deps_obj {
-        if ws_patched.is_object() {
-            rewrite_bare_patch_keys(ws_patched, patches)?;
-            if let Some(mut existing_prop) = json.as_property(b"patchedDependencies") {
-                if existing_prop.expr.is_object() {
-                    let existing_patches = e_object_mut(&mut existing_prop.expr);
-                    for prop in e_object(ws_patched).properties.slice() {
-                        let Some(key) =
-                            as_string(prop.key.as_ref().expect("infallible: prop has key"))
-                        else {
-                            continue;
-                        };
-                        existing_patches.put(
-                            &bump,
-                            key,
-                            prop.value.expect("infallible: prop has value"),
-                        )?;
-                    }
-                }
-            } else {
-                e_object_mut(&mut json).put(&bump, b"patchedDependencies", *ws_patched)?;
-            }
-            needs_update = true;
-            moved.push("pnpm-workspace.yaml patchedDependencies to patchedDependencies");
+    if let Some(ws_overrides) = workspace_overrides_obj {
+        if copy_into_root(&mut json, &bump, b"overrides", ws_overrides)? {
+            copied.push("pnpm-workspace.yaml overrides to overrides");
         }
     }
 
-    if needs_update {
-        let mut buffer_writer = bun_js_printer::BufferWriter::init();
-        buffer_writer.append_newline = !root_pkg_json.source.contents().is_empty()
-            && root_pkg_json.source.contents()[root_pkg_json.source.contents().len() - 1] == b'\n';
-        let mut package_json_writer = bun_js_printer::BufferPrinter::init(buffer_writer);
-
-        if bun_js_printer::print_json(
-            &mut package_json_writer,
-            json,
-            &root_pkg_json.source,
-            bun_js_printer::PrintJsonOptions {
-                indent: root_pkg_json.indentation,
-                mangled_props: None,
-                ..Default::default()
-            },
-        )
-        .is_err()
-        {
-            return Ok(());
+    if let Some(mut ws_patched) = workspace_patched_deps_obj {
+        rewrite_bare_patch_keys(&mut ws_patched, patches)?;
+        if copy_into_root(&mut json, &bump, b"patchedDependencies", ws_patched)? {
+            copied.push("pnpm-workspace.yaml patchedDependencies to patchedDependencies");
         }
+    }
 
-        if package_json_writer.flush().is_err() {
-            return Err(AllocError);
+    if !copied.is_empty() {
+        print_package_json_into_cache_entry(root_pkg_json, json);
+        // The printed tree borrows from the replaced contents; `bun update` edits this entry next.
+        if let Err(err) = root_pkg_json.reparse_root(log) {
+            bun_core::pretty_errorln!("package.json failed to parse due to error {}", err.name());
+            bun_core::Global::crash();
         }
 
-        root_pkg_json.source.contents = std::borrow::Cow::Owned(
-            package_json_writer
-                .ctx
-                .written_without_trailing_zero()
-                .to_vec(),
-        );
-
-        // Write the updated package.json
         if sys::File::write_file(
             dir,
             bun_core::zstr!("package.json"),
             root_pkg_json.source.contents(),
         )
         .is_ok()
-            && !moved.is_empty()
             && !silent
         {
-            bun_core::pretty_errorln!("<d>moved {} in <r><green>package.json<r>", moved.join(", "));
+            bun_core::pretty_errorln!(
+                "<d>copied {} in <r><green>package.json<r>",
+                copied.join(", ")
+            );
         }
     }
 
@@ -2767,6 +2590,46 @@ fn is_non_empty_object(expr: &Expr) -> bool {
     matches!(&expr.data, ExprData::EObject(o) if !o.properties.is_empty())
 }
 
+/// The root-level copy gets edited further; an `Expr` from `get` would alias the `pnpm` block.
+fn copy_object(src: &Expr) -> Expr {
+    let src_props = e_object(src).properties.slice();
+    let mut properties = G::PropertyList::init_capacity(src_props.len());
+    for prop in src_props {
+        VecExt::append(&mut properties, shallow_clone_prop(prop));
+    }
+    Expr::init(
+        E::Object {
+            properties,
+            ..Default::default()
+        },
+        bun_ast::Loc::EMPTY,
+    )
+}
+
+/// Merges `src` into the root-level `field` (created when absent); `false` if it is not an object.
+fn copy_into_root(
+    json: &mut Expr,
+    bump: &bun_alloc::Arena,
+    field: &[u8],
+    src: Expr,
+) -> Result<bool, AllocError> {
+    let Some(mut existing) = json.as_property(field) else {
+        e_object_mut(json).put(bump, field, src)?;
+        return Ok(true);
+    };
+    if !existing.expr.is_object() {
+        return Ok(false);
+    }
+    let existing_obj = e_object_mut(&mut existing.expr);
+    for prop in e_object(&src).properties.slice() {
+        let Some(key) = as_string(prop.key.as_ref().expect("infallible: prop has key")) else {
+            continue;
+        };
+        existing_obj.put(bump, key, prop.value.expect("infallible: prop has value"))?;
+    }
+    Ok(true)
+}
+
 fn paths_array(paths: &[&'static [u8]]) -> Expr {
     let mut items = js_ast::ExprNodeList::init_capacity(paths.len());
     for path in paths {
diff --git a/test/cli/install/migration/pnpm-lock-v9.test.ts b/test/cli/install/migration/pnpm-lock-v9.test.ts
index 972eaf3aebd1..dc80656b10eb 100644
--- a/test/cli/install/migration/pnpm-lock-v9.test.ts
+++ b/test/cli/install/migration/pnpm-lock-v9.test.ts
@@ -791,16 +791,19 @@ snapshots:
       const { stderr, exitCode } = await migrate(packageDir);
 
       expect(stderr).not.toContain("is not in patchedDependencies");
+      expect(stderr).toContain("copied pnpm.patchedDependencies to patchedDependencies in package.json");
       expect(stderr).toContain("migrated lockfile from pnpm-lock.yaml");
       expect(exitCode).toBe(0);
 
       const bunLock = await bunLockOf(packageDir);
       expect(bunLock).toContain(`"patchedDependencies": {\n    "no-deps@1.0.1": "patches/no-deps.patch",\n  }`);
 
+      // The versioned key only goes to the root; pnpm keeps reading the bare key from its own block.
       const packageJson = await Bun.file(join(packageDir, "package.json")).json();
       expect(packageJson).toStrictEqual({
         name: "patch-path-in-package-json",
         dependencies: { "no-deps": "^1.0.0" },
+        pnpm: { patchedDependencies: { "no-deps": "patches/no-deps.patch" } },
         patchedDependencies: { "no-deps@1.0.1": "patches/no-deps.patch" },
       });
 
@@ -813,6 +816,55 @@ snapshots:
       );
     });
 
+    // `bun update` migrates, then edits the cached root package.json that the migration rewrote, so the cached
+    // copy has to be re-read from the rewritten contents (a stale copy pointed into the freed previous contents).
+    test("bun update straight from pnpm-lock.yaml edits the package.json the migration rewrote", async () => {
+      const pnpm = {
+        patchedDependencies: { "no-deps": "patches/no-deps.patch" },
+        overrides: { "a-dep": "1.0.1" },
+      };
+      const { packageDir } = await verdaccio.createTestDir({
+        bunfigOpts: { linker: "hoisted" },
+        files: {
+          "package.json": JSON.stringify({
+            name: "update-after-migration",
+            dependencies: { "no-deps": "^1.0.0" },
+            pnpm,
+          }),
+          "patches/no-deps.patch": NO_DEPS_INDEX_PATCH,
+          "pnpm-lock.yaml": bareHashNoDepsLockfile("no-deps").replace(
+            "importers:",
+            "overrides:\n  a-dep: 1.0.1\n\nimporters:",
+          ),
+        },
+      });
+
+      const update = await run(packageDir, "update");
+
+      expect(update.stderr).toContain(
+        "copied pnpm.overrides to overrides, pnpm.patchedDependencies to patchedDependencies in package.json",
+      );
+      expect(update.stderr).toContain("migrated lockfile from pnpm-lock.yaml");
+      expect(update.stderr).not.toContain("error:");
+      expect(update.stdout).toContain("no-deps@1.0.1");
+      expect(update.exitCode).toBe(0);
+      expect(await Bun.file(join(packageDir, "package.json")).json()).toStrictEqual({
+        name: "update-after-migration",
+        dependencies: { "no-deps": "^1.0.1" },
+        pnpm,
+        overrides: pnpm.overrides,
+        patchedDependencies: { "no-deps@1.0.1": "patches/no-deps.patch" },
+      });
+      expect(await Bun.file(join(packageDir, "node_modules/no-deps/index.js")).text()).toStartWith(
+        "globalThis.patchedByMigration = true;\n",
+      );
+
+      const frozen = await run(packageDir, "install", "--frozen-lockfile");
+
+      expect(frozen.stderr).not.toContain("error:");
+      expect(frozen.exitCode).toBe(0);
+    });
+
     test("versioned lockfile key falls back to the bare config key", async () => {
       const { packageDir } = await verdaccio.createTestDir({
         bunfigOpts: { linker: "hoisted" },
@@ -2878,6 +2930,77 @@ snapshots:
     });
   });
 
+  // #23694: `bun update -i` migrates once to list the outdated packages, edits the root package.json through the
+  // cache, then installs, which migrates again because bun.lock is still not on disk. The editor and the second
+  // migration both used the tree the first migration had edited, which pointed into the contents it had freed.
+  test("bun update -i in a pnpm workspace migrates twice and keeps package.json intact", async () => {
+    const { packageDir } = await verdaccio.createTestDir({
+      bunfigOpts: { linker: "hoisted" },
+      files: {
+        "package.json": JSON.stringify({
+          name: "update-interactive",
+          dependencies: { "no-deps": "^1.0.0" },
+          pnpm: { overrides: { "a-dep": "1.0.1" } },
+        }),
+        "packages/a/package.json": JSON.stringify({ name: "a" }),
+        "pnpm-workspace.yaml": "packages:\n  - packages/*\n",
+        "pnpm-lock.yaml": `lockfileVersion: '9.0'
+
+overrides:
+  a-dep: 1.0.1
+
+importers:
+
+  .:
+    dependencies:
+      no-deps:
+        specifier: ^1.0.0
+        version: 1.0.0
+
+  packages/a: {}
+
+packages:
+
+  no-deps@1.0.0:
+    resolution: {integrity: ${NO_DEPS_1_0_0_INTEGRITY}}
+
+snapshots:
+
+  no-deps@1.0.0: {}
+`,
+      },
+    });
+
+    await using proc = Bun.spawn({
+      cmd: [bunExe(), "update", "-i"],
+      cwd: packageDir,
+      env: { ...bunEnv, BUN_INSTALL_CACHE_DIR: join(packageDir, ".bun-cache") },
+      stdin: "pipe",
+      stdout: "pipe",
+      stderr: "pipe",
+    });
+    proc.stdin.write("a\r");
+    proc.stdin.end();
+    const [stdout, stderr, exitCode] = await Promise.all([proc.stdout.text(), proc.stderr.text(), proc.exited]);
+
+    expect(stderr).not.toContain("error:");
+    expect(stdout).toContain("no-deps");
+    expect(exitCode).toBe(0);
+    expect(await Bun.file(join(packageDir, "package.json")).json()).toStrictEqual({
+      name: "update-interactive",
+      dependencies: { "no-deps": "^1.1.0" },
+      pnpm: { overrides: { "a-dep": "1.0.1" } },
+      overrides: { "a-dep": "1.0.1" },
+      workspaces: ["packages/*"],
+    });
+    expect(existsSync(join(packageDir, "bun.lock"))).toBe(true);
+
+    const frozen = await run(packageDir, "install", "--frozen-lockfile");
+
+    expect(frozen.stderr).not.toContain("error:");
+    expect(frozen.exitCode).toBe(0);
+  });
+
   describe("overrides", () => {
     function overridesLockfile(overrides: string) {
       return `lockfileVersion: '9.0'
@@ -2899,7 +3022,7 @@ importers:
       return bunLock.slice(start, end + "\n  },".length);
     }
 
-    // pnpm/pnpm#5928 (`-` removes the dependency) is warned once, with a location, when bun install reads the moved package.json overrides; pnpm/pnpm#6774 (`name@range` keys) migrates as ranged rules
+    // pnpm/pnpm#5928 (`-` removes the dependency) is warned once, with a location, when bun install reads the copied package.json overrides; pnpm/pnpm#6774 (`name@range` keys) migrates as ranged rules
     test.concurrent("removal values are dropped; name@range keys migrate as ranged rules", async () => {
       const overrides = {
         "left-pad": "-",
@@ -2922,12 +3045,13 @@ importers:
       const { stderr, exitCode } = await migrate(String(dir));
 
       expect(stderr).not.toContain("warn:");
-      expect(stderr).toContain("moved pnpm.overrides to overrides in package.json");
+      expect(stderr).toContain("copied pnpm.overrides to overrides in package.json");
       expect(stderr).toContain("migrated lockfile from pnpm-lock.yaml");
       expect(exitCode).toBe(0);
 
       expect(await Bun.file(join(String(dir), "package.json")).json()).toStrictEqual({
         name: "overrides-unsupported",
+        pnpm: { overrides },
         overrides,
       });
 
@@ -2958,6 +3082,103 @@ importers:
       expect(install.exitCode).toBe(0);
     });
 
+    // pnpm reads `pnpm.overrides` and `pnpm.patchedDependencies` from package.json and ignores the root-level
+    // fields, so removing them from the `pnpm` block breaks `pnpm install --frozen-lockfile` for everyone still on
+    // pnpm (ERR_PNPM_LOCKFILE_CONFIG_MISMATCH). The block has to survive the migration as it was.
+    test.concurrent("the pnpm block in package.json is left as it was", async () => {
+      const pnpm = {
+        overrides: { "no-deps": "1.0.0" },
+        patchedDependencies: { "one-dep@1.0.0": "patches/one-dep.patch" },
+        onlyBuiltDependencies: ["one-dep"],
+      };
+      using dir = tempDir("pnpm-v9-pnpm-block-kept", {
+        "package.json": JSON.stringify({ name: "pnpm-block-kept", private: true, pnpm }),
+        "pnpm-lock.yaml": overridesLockfile("  no-deps: 1.0.0"),
+      });
+      using onlyMigratedKeys = tempDir("pnpm-v9-pnpm-block-only-migrated-keys", {
+        "package.json": JSON.stringify({ name: "pnpm-block-only-migrated-keys", pnpm: { overrides: pnpm.overrides } }),
+        "pnpm-lock.yaml": overridesLockfile("  no-deps: 1.0.0"),
+      });
+
+      const { stderr, exitCode } = await migrate(String(dir));
+
+      expect(stderr).not.toContain("warn:");
+      expect(stderr).toContain(
+        "copied pnpm.overrides to overrides, pnpm.patchedDependencies to patchedDependencies in package.json",
+      );
+      expect(exitCode).toBe(0);
+      expect(await Bun.file(join(String(dir), "package.json")).json()).toStrictEqual({
+        name: "pnpm-block-kept",
+        private: true,
+        pnpm,
+        overrides: pnpm.overrides,
+        patchedDependencies: pnpm.patchedDependencies,
+      });
+
+      const onlyMigrated = await migrate(String(onlyMigratedKeys));
+
+      expect(onlyMigrated.stderr).toContain("copied pnpm.overrides to overrides in package.json");
+      expect(onlyMigrated.exitCode).toBe(0);
+      expect(await Bun.file(join(String(onlyMigratedKeys), "package.json")).json()).toStrictEqual({
+        name: "pnpm-block-only-migrated-keys",
+        pnpm: { overrides: pnpm.overrides },
+        overrides: pnpm.overrides,
+      });
+    });
+
+    // pnpm 10 merges `pnpm.overrides` with the `overrides` of pnpm-workspace.yaml, and the lockfile records the
+    // merged set. The yaml entries belong in the root-level copy only.
+    test.concurrent("pnpm-workspace.yaml overrides go into the root copy, not into the pnpm block", async () => {
+      using dir = tempDir("pnpm-v9-overrides-package-json-and-workspace-yaml", {
+        "package.json": JSON.stringify({
+          name: "overrides-package-json-and-workspace-yaml",
+          pnpm: { overrides: { "no-deps": "1.0.0" } },
+        }),
+        "pnpm-workspace.yaml": "overrides:\n  a-dep: 1.0.1\n",
+        "pnpm-lock.yaml": overridesLockfile("  no-deps: 1.0.0\n  a-dep: 1.0.1"),
+      });
+
+      const { stderr, exitCode } = await migrate(String(dir));
+
+      expect(stderr).not.toContain("warn:");
+      expect(stderr).toContain(
+        "copied pnpm.overrides to overrides, pnpm-workspace.yaml overrides to overrides in package.json",
+      );
+      expect(exitCode).toBe(0);
+      expect(await Bun.file(join(String(dir), "package.json")).json()).toStrictEqual({
+        name: "overrides-package-json-and-workspace-yaml",
+        pnpm: { overrides: { "no-deps": "1.0.0" } },
+        overrides: { "no-deps": "1.0.0", "a-dep": "1.0.1" },
+      });
+    });
+
+    // Unquoted yaml scalars point into the file contents; quoted ones (the usual spelling for scoped names) are
+    // copied into the arena the yaml was parsed with, which has to stay alive until package.json is printed.
+    test.concurrent("quoted pnpm-workspace.yaml scalars are written to package.json", async () => {
+      using dir = tempDir("pnpm-v9-workspace-yaml-quoted", {
+        "package.json": JSON.stringify({ name: "workspace-yaml-quoted" }),
+        "pnpm-workspace.yaml": `overrides:
+  '@scope/pkg': "1.0.0"
+catalog:
+  '@scope/other': '^2.0.0'
+`,
+        "pnpm-lock.yaml": overridesLockfile("  '@scope/pkg': 1.0.0"),
+      });
+
+      const { stderr, exitCode } = await migrate(String(dir));
+
+      expect(stderr).not.toContain("warn:");
+      expect(stderr).toContain(
+        "copied pnpm-workspace.yaml to workspaces, pnpm-workspace.yaml overrides to overrides in package.json",
+      );
+      expect(exitCode).toBe(0);
+      expect(await Bun.file(join(String(dir), "package.json")).json()).toStrictEqual({
+        name: "workspace-yaml-quoted",
+        workspaces: { catalog: { "@scope/other": "^2.0.0" } },
+        overrides: { "@scope/pkg": "1.0.0" },
+      });
+    });
+
     test.concurrent("parent selectors become nested rules", async () => {
       using dir = tempDir("pnpm-v9-overrides-nested", {
         "package.json": JSON.stringify({ name: "overrides-nested" }),
@@ -2995,7 +3216,7 @@ importers:
       const deep = await migrate(String(tooDeep));
 
       expect(deep.stderr).not.toContain("warn:");
-      expect(deep.stderr).toContain("moved pnpm.overrides to overrides in package.json");
+      expect(deep.stderr).toContain("copied pnpm.overrides to overrides in package.json");
       expect(deep.stderr).toContain("migrated lockfile from pnpm-lock.yaml");
       expect(deep.exitCode).toBe(0);
       expect(await bunLockOf(String(tooDeep))).not.toContain("a>b");
diff --git a/test/cli/install/nested-overrides.test.ts b/test/cli/install/nested-overrides.test.ts
index 1cba002e7b9d..4a94485c15e5 100644
--- a/test/cli/install/nested-overrides.test.ts
+++ b/test/cli/install/nested-overrides.test.ts
@@ -1835,7 +1835,7 @@ snapshots:
   }
 
   const migratedLine = /\[[\d.]+m?s\] migrated lockfile from pnpm-lock\.yaml\n/;
-  const movedOverridesLine = "moved pnpm.overrides to overrides in package.json";
+  const copiedOverridesLine = "copied pnpm.overrides to overrides in package.json";
 
   test("pnpm-lock.yaml parent>child overrides become nested rules that package.json agrees with", async () => {
     const dir = await project(
@@ -1847,7 +1847,7 @@ snapshots:
     expect(migrated.err).not.toContain("warn:");
     expect(migrated.err).not.toContain("error:");
     expect(migrated.err).toMatch(migratedLine);
-    expect(occurrences(migrated.err, movedOverridesLine)).toBe(1);
+    expect(occurrences(migrated.err, copiedOverridesLine)).toBe(1);
     expect(migrated.exitCode).toBe(0);
     const text = await lock(dir);
     expect(text).toContain('"one-dep": {');
@@ -1857,6 +1857,7 @@ snapshots:
     expect(JSON.parse(packageJson)).toStrictEqual({
       name: "nested-overrides",
       dependencies: { "one-dep": "1.0.0" },
+      pnpm: { overrides: { "one-dep>no-deps": "2.0.0" } },
       overrides: { "one-dep>no-deps": "2.0.0" },
     });
     await installOk(dir, "--frozen-lockfile");
@@ -1871,7 +1872,7 @@ snapshots:
     const migrated = await migrate(dir);
     expect(migrated.err).not.toContain("warn:");
     expect(migrated.err).not.toContain("error:");
-    expect(occurrences(migrated.err, movedOverridesLine)).toBe(1);
+    expect(occurrences(migrated.err, copiedOverridesLine)).toBe(1);
     expect(migrated.exitCode).toBe(0);
     const text = await lock(dir);
     expect(text).toContain('"one-dep": {');
@@ -1889,7 +1890,7 @@ snapshots:
     const migrated = await migrate(dir);
     expect(migrated.err).not.toContain("warn:");
     expect(migrated.err).not.toContain("error:");
-    expect(occurrences(migrated.err, movedOverridesLine)).toBe(1);
+    expect(occurrences(migrated.err, copiedOverridesLine)).toBe(1);
     expect(migrated.exitCode).toBe(0);
     const text = await lock(dir);
     expect(text).toContain('"lockfileVersion": 3');
@@ -1920,7 +1921,7 @@ snapshots:
       })
       .then(({ packageDir }) => packageDir);
     const migrated = await migrate(dir);
-    expect(occurrences(migrated.err, movedOverridesLine)).toBe(1);
+    expect(occurrences(migrated.err, copiedOverridesLine)).toBe(1);
     expect(migrated.err).not.toContain("error:");
     expect(migrated.exitCode).toBe(0);
     const packageJson = await packageJsonText(dir);
@@ -1931,10 +1932,11 @@ snapshots:
       name: "nested-overrides",
       dependencies: { "one-dep": "1.0.0" },
       overrides: { "a-dep": "1.0.1", "one-dep>no-deps": "2.0.0" },
+      pnpm: { overrides: { "one-dep>no-deps": "2.0.0" } },
     });
   });
 
-  test("an empty pnpm.overrides is not moved and package.json is not announced as modified", async () => {
+  test("an empty pnpm.overrides is not copied and package.json is not announced as modified", async () => {
     const dir = await project({ dependencies: { "one-dep": "1.0.0" }, pnpm: { overrides: {} } }, "hoisted", {
       "pnpm-lock.yaml": await pnpmLock({ noDepsVersion: "1.0.1" }),
     });
@@ -1942,7 +1944,7 @@ snapshots:
     const migrated = await migrate(dir);
     expect(migrated.err).not.toContain("warn:");
     expect(migrated.err).not.toContain("error:");
-    expect(migrated.err).not.toContain(movedOverridesLine);
+    expect(migrated.err).not.toContain(copiedOverridesLine);
     expect(migrated.err).toMatch(migratedLine);
     expect(migrated.exitCode).toBe(0);
     expect(await packageJsonText(dir)).toBe(before);
@@ -1978,14 +1980,14 @@ snapshots:
       ),
     );
 
-  test("bun install warns once per rejected rule that the migration moved into package.json", async () => {
+  test("bun install warns once per rejected rule that the migration copied into package.json", async () => {
     const dir = await rejectedRulesProject();
     const { err, exitCode } = await install(dir);
     expect(occurrences(err, 'warn: Removing "left-pad" with "-" is not supported')).toBe(1);
     expect(occurrences(err, 'warn: Bun currently only supports one level of nested "overrides"')).toBe(1);
     expect(occurrences(err, "warn:")).toBe(2);
     expect(err).toMatch(migratedLine);
-    expect(occurrences(err, movedOverridesLine)).toBe(1);
+    expect(occurrences(err, copiedOverridesLine)).toBe(1);
     expect(err).not.toContain("error:");
     expect(exitCode).toBe(0);
     expect((await file(join(dir, "package.json")).json()).overrides).toStrictEqual({

From 50c0b934b80599a81d4cc6d0335b38bf25096a76 Mon Sep 17 00:00:00 2001
From: robobun <117481402+robobun@users.noreply.github.com>
Date: Mon, 17 Aug 2026 01:04:52 +0000
Subject: [PATCH 018/258] install: fix default-trusted lifecycle scripts being
 blocked after yarn.lock migration (#38795)

---
 src/install/dependency.rs                     |   2 +-
 src/install/lockfile.rs                       |   4 +-
 src/install/yarn.rs                           |  66 ++++---
 .../bun-install-lifecycle-scripts.test.ts     | 173 ++++++++++++++++++
 .../yarn-lock-migration.test.ts.snap          |   4 +-
 .../migration/yarn-lock-migration.test.ts     | 120 ++++++++++++
 6 files changed, 336 insertions(+), 33 deletions(-)

diff --git a/src/install/dependency.rs b/src/install/dependency.rs
index 954735c4c116..8e3b39faad9f 100644
--- a/src/install/dependency.rs
+++ b/src/install/dependency.rs
@@ -417,7 +417,7 @@ pub(crate) fn is_scp_like_path(dependency: &[u8]) -> bool {
 ///
 /// This also checks for a github url that ends with ".tar.gz"
 #[inline]
-fn is_github_tarball_path(dependency: &[u8]) -> bool {
+pub(crate) fn is_github_tarball_path(dependency: &[u8]) -> bool {
     if is_tarball(dependency) {
         return true;
     }
diff --git a/src/install/lockfile.rs b/src/install/lockfile.rs
index ff3f5bcc5ff5..917c025518f9 100644
--- a/src/install/lockfile.rs
+++ b/src/install/lockfile.rs
@@ -3254,7 +3254,9 @@ impl Lockfile {
         ) else {
             return false;
         };
-        url == canonical_url.as_slice()
+        // Older yarn.lock migrations stored yarn's `#<sha1>` on the URL. A fragment is
+        // never sent to the registry, so it cannot change which tarball is downloaded.
+        crate::yarn::Entry::url_without_hash(url) == canonical_url.as_slice()
     }
 
     fn declared_by_root_or_workspace(&self, alias: &[u8], resolution: &Resolution) -> bool {
diff --git a/src/install/yarn.rs b/src/install/yarn.rs
index 5dfb95a04f08..da1e1c5dab41 100644
--- a/src/install/yarn.rs
+++ b/src/install/yarn.rs
@@ -129,10 +129,13 @@ impl<'a> Entry<'a> {
     }
 
     pub(crate) fn is_git_dependency(version: &[u8]) -> bool {
+        if let Some(github_path) = version.strip_prefix(b"https://github.com/") {
+            // An archive download's `#` is yarn's tarball hash, not a commit.
+            return !dependency::is_github_tarball_path(Entry::url_without_hash(github_path));
+        }
         version.starts_with(b"git+")
             || version.starts_with(b"git://")
             || version.starts_with(b"github:")
-            || version.starts_with(b"https://github.com/")
     }
 
     pub(crate) fn is_npm_alias(version: &[u8]) -> bool {
@@ -143,6 +146,14 @@ impl<'a> Entry<'a> {
         version.starts_with(b"https://") && version.ends_with(b".tgz")
     }
 
+    /// yarn v1 writes tarball `resolved` fields as `<url>#<sha1 of the tarball>`.
+    pub(crate) fn url_without_hash(resolved: &[u8]) -> &[u8] {
+        match strings::index_of_char_usize(resolved, b'#') {
+            Some(hash_idx) => &resolved[..hash_idx],
+            None => resolved,
+        }
+    }
+
     pub(crate) fn is_workspace_dependency(version: &[u8]) -> bool {
         version.starts_with(b"workspace:") || version == b"*"
     }
@@ -939,31 +950,26 @@ pub(crate) fn migrate_yarn_lockfile<'a>(
 
         package_id_to_yarn_idx[package_id as usize] = yarn_idx;
 
+        let resolved_url: Option<&[u8]> = entry.resolved.as_deref().map(Entry::url_without_hash);
+
         let name_to_use: &[u8] = 'blk: {
             if entry.commit.is_some() && entry.git_repo_name.is_some() {
                 break 'blk entry.git_repo_name.as_deref().unwrap();
-            } else if let Some(resolved) = entry.resolved.as_deref() {
-                if is_direct_url_dep
-                    || Entry::is_remote_tarball(resolved)
-                    || resolved.ends_with(b".tgz")
+            } else if let (true, Some(resolved)) = (is_direct_url_dep, resolved_url) {
+                // https://registry.npmjs.org/package/-/package-version.tgz
+                if strings::index_of(resolved, b"registry.npmjs.org/").is_some()
+                    || strings::index_of(resolved, b"registry.yarnpkg.com/").is_some()
                 {
-                    // https://registry.npmjs.org/package/-/package-version.tgz
-                    if strings::index_of(resolved, b"registry.npmjs.org/").is_some()
-                        || strings::index_of(resolved, b"registry.yarnpkg.com/").is_some()
-                    {
-                        if let Some(separator_idx) = strings::index_of(resolved, b"/-/") {
-                            if let Some(registry_idx) = strings::index_of(resolved, b"registry.") {
-                                let after_registry = &resolved[registry_idx..];
-                                if let Some(domain_slash) = strings::index_of(after_registry, b"/")
-                                {
-                                    let package_start = registry_idx + domain_slash + 1;
-                                    let extracted_name = &resolved[package_start..separator_idx];
-                                    break 'blk extracted_name;
-                                }
+                    if let Some(separator_idx) = strings::index_of(resolved, b"/-/") {
+                        if let Some(registry_idx) = strings::index_of(resolved, b"registry.") {
+                            let after_registry = &resolved[registry_idx..];
+                            if let Some(domain_slash) = strings::index_of(after_registry, b"/") {
+                                let package_start = registry_idx + domain_slash + 1;
+                                let extracted_name = &resolved[package_start..separator_idx];
+                                break 'blk extracted_name;
                             }
                         }
                     }
-                    break 'blk base_name;
                 }
             }
             break 'blk base_name;
@@ -1033,29 +1039,31 @@ pub(crate) fn migrate_yarn_lockfile<'a>(
                     }
                 }
                 break 'blk Resolution::default();
-            } else if let Some(resolved) = entry.resolved.as_deref() {
+            } else if let Some(resolved) = resolved_url {
                 if is_direct_url_dep {
                     break 'blk Resolution::init(ResolutionValue::RemoteTarball(
                         sbuf!().append(resolved)?,
                     ));
                 }
 
-                // Yarn v1 lockfiles legitimately contain entries without an integrity field
-                // (workspace deps, file:, codeload tarballs), so migration intentionally
-                // accepts off-registry tarball URLs without integrity instead of failing.
-                if Entry::is_remote_tarball(resolved) || resolved.ends_with(b".tgz") {
-                    break 'blk Resolution::init(ResolutionValue::RemoteTarball(
-                        sbuf!().append(resolved)?,
-                    ));
-                }
-
                 let version = sbuf!().append(entry.version)?;
                 let result =
                     Semver::Version::parse(version.sliced(this.buffers.string_bytes.as_slice()));
                 if !result.valid {
+                    // Yarn v1 lockfiles legitimately contain entries without an integrity field
+                    // (workspace deps, file:, codeload tarballs), so migration intentionally
+                    // accepts off-registry tarball URLs without integrity instead of failing.
+                    if Entry::is_remote_tarball(resolved) || resolved.ends_with(b".tgz") {
+                        break 'blk Resolution::init(ResolutionValue::RemoteTarball(
+                            sbuf!().append(resolved)?,
+                        ));
+                    }
                     break 'blk Resolution::default();
                 }
 
+                // `has_trusted_dependency` compares this URL with the canonical registry
+                // tarball URL, so it must be the bare URL a fresh install records: no
+                // `#sha1`, and no RemoteTarball just because the URL ends in `.tgz`.
                 let is_default_registry = resolved.starts_with(b"https://registry.yarnpkg.com/")
                     || resolved.starts_with(b"https://registry.npmjs.org/");
 
diff --git a/test/cli/install/bun-install-lifecycle-scripts.test.ts b/test/cli/install/bun-install-lifecycle-scripts.test.ts
index bd4989773c04..d641b05600a8 100644
--- a/test/cli/install/bun-install-lifecycle-scripts.test.ts
+++ b/test/cli/install/bun-install-lifecycle-scripts.test.ts
@@ -617,6 +617,179 @@ test.concurrent("default trusted dependencies require the canonical registry tar
   expect(await exited).toBe(0);
 });
 
+describe("default trusted dependencies after yarn.lock migration", () => {
+  const electronIntegrity =
+    "sha512-GkuwCdn6o8Krsxb3DIIqYP+TAi8Y5jYUadmseZ6nR2op2k5ssdKRYo4JjYDGopa1ACrGAcQuWViz/+vX/WjYnA==";
+  // `all-lifecycle-scripts@1.0.0`: a different package with preinstall, install
+  // and postinstall scripts of its own, used to record a tarball that is not
+  // electron's under the default-trusted name `electron`.
+  const otherIntegrity =
+    "sha512-hgU56juWYnFOQ3byQuydEgugxd+iWvaWfaoGvly4k/AxehC3dhM6IhXoDc3K7b/n1mP/II8hGIjI+LmxXFNMlw==";
+
+  // Installs `electron@1.0.0` (on the default trusted list) from a yarn.lock
+  // that resolves it to `resolved`, and returns the migrated bun.lock.
+  async function installFromYarnLock(ctx: TestCtx, resolved: string, integrity: string) {
+    const { packageDir, packageJson, env } = ctx;
+    await Promise.all([
+      writeFile(
+        packageJson,
+        JSON.stringify({
+          name: "foo",
+          version: "1.0.0",
+          dependencies: {
+            "electron": "1.0.0",
+          },
+        }),
+      ),
+      writeFile(
+        join(packageDir, "yarn.lock"),
+        `# THIS IS AN AUTOGENERATED FILE. DO NOT EDIT THIS FILE DIRECTLY.
+# yarn lockfile v1
+
+
+electron@1.0.0:
+  version "1.0.0"
+  resolved "${resolved}"
+  integrity ${integrity}
+`,
+      ),
+    ]);
+
+    await using proc = spawn({
+      cmd: [bunExe(), "install"],
+      cwd: packageDir,
+      stdout: "pipe",
+      stdin: "ignore",
+      stderr: "pipe",
+      env,
+    });
+
+    const [out, err, exitCode] = await Promise.all([proc.stdout.text(), proc.stderr.text(), proc.exited]);
+    expect(err).toContain("migrated lockfile from yarn.lock");
+    expect(err).not.toContain("error:");
+    expect(await exists(join(packageDir, "node_modules", "electron", "package.json"))).toBeTrue();
+    expect(exitCode).toBe(0);
+    return { out, lockfile: await file(join(packageDir, "bun.lock")).text() };
+  }
+
+  // yarn v1 writes the tarball's sha1 as a URL fragment after registry tarball
+  // URLs. Other producers of the format (bun's own `--yarn` output, registries
+  // without a shasum) omit it. Both shapes describe the canonical registry
+  // tarball for electron@1.0.0, so both must keep the default-trusted grant
+  // after migration, exactly like an install that never had a yarn.lock.
+  test.concurrent.each([
+    ["with a sha1 fragment", "#f1b8bc2c23cd7e4f1500669dfaf8757578d2e391"],
+    ["without a fragment", ""],
+  ])("scripts run for the canonical registry tarball URL %s", async (_, fragment) => {
+    using ctx = await setupTest();
+    const canonicalUrl = `http://localhost:${verdaccio.port}/electron/-/electron-1.0.0.tgz`;
+
+    const { out, lockfile } = await installFromYarnLock(ctx, `${canonicalUrl}${fragment}`, electronIntegrity);
+
+    expect(out).not.toContain("Blocked");
+    expect(await exists(join(ctx.packageDir, "node_modules", "electron", "preinstall.txt"))).toBeTrue();
+    // The migrated entry is an npm package whose tarball URL is the canonical
+    // one for the configured registry, with yarn's fragment dropped.
+    expect(lockfile).toContain(`"electron": ["electron@1.0.0", "${canonicalUrl}", {}, "${electronIntegrity}"]`);
+  });
+
+  test.concurrent("scripts stay blocked when the yarn.lock points the name at another tarball", async () => {
+    using ctx = await setupTest();
+    // Same registry, but another package's tarball recorded under the
+    // default-trusted name. Migration must keep that URL, so the canonical URL
+    // check still denies the default grant.
+    const otherUrl = `http://localhost:${verdaccio.port}/all-lifecycle-scripts/-/all-lifecycle-scripts-1.0.0.tgz`;
+
+    const { lockfile } = await installFromYarnLock(
+      ctx,
+      `${otherUrl}#91cd0bd6a450b21db0078b9118c54bc0a27fccb7`,
+      otherIntegrity,
+    );
+
+    expect(lockfile).toContain(`"electron": ["electron@1.0.0", "${otherUrl}", {}, "${otherIntegrity}"]`);
+    const electronDir = join(ctx.packageDir, "node_modules", "electron");
+    expect(
+      await Promise.all([
+        exists(join(electronDir, "install.js")),
+        exists(join(electronDir, "preinstall.txt")),
+        exists(join(electronDir, "install.txt")),
+        exists(join(electronDir, "postinstall.txt")),
+      ]),
+    ).toEqual([true, false, false, false]);
+  });
+
+  // Earlier versions of the migrator wrote yarn's `#sha1` into bun.lock itself.
+  // Those lockfiles are still out there, so the canonical URL check has to look
+  // past the fragment (which never reaches the registry) while still rejecting
+  // a URL whose path is not electron's tarball.
+  test.concurrent.each([
+    [
+      "runs scripts for the canonical tarball",
+      "electron/-/electron-1.0.0.tgz#f1b8bc2c23cd7e4f1500669dfaf8757578d2e391",
+      electronIntegrity,
+      true,
+    ],
+    [
+      "keeps blocking another tarball",
+      "all-lifecycle-scripts/-/all-lifecycle-scripts-1.0.0.tgz#91cd0bd6a450b21db0078b9118c54bc0a27fccb7",
+      otherIntegrity,
+      false,
+    ],
+  ])("a bun.lock already migrated with the #sha1 suffix %s", async (_, tarball, integrity, scriptsRun) => {
+    using ctx = await setupTest();
+    const { packageDir, packageJson, env } = ctx;
+    const url = `http://localhost:${verdaccio.port}/${tarball}`;
+
+    await Promise.all([
+      writeFile(
+        packageJson,
+        JSON.stringify({
+          name: "foo",
+          version: "1.0.0",
+          dependencies: {
+            "electron": "1.0.0",
+          },
+        }),
+      ),
+      writeFile(
+        join(packageDir, "bun.lock"),
+        `{
+  "lockfileVersion": 1,
+  "workspaces": {
+    "": {
+      "name": "foo",
+      "dependencies": {
+        "electron": "1.0.0",
+      },
+    },
+  },
+  "packages": {
+    "electron": ["electron@1.0.0", "${url}", {}, "${integrity}"],
+  }
+}
+`,
+      ),
+    ]);
+
+    await using proc = spawn({
+      cmd: [bunExe(), "install"],
+      cwd: packageDir,
+      stdout: "pipe",
+      stdin: "ignore",
+      stderr: "pipe",
+      env,
+    });
+
+    const [err, exitCode] = await Promise.all([proc.stderr.text(), proc.exited, proc.stdout.text()]);
+    expect(err).not.toContain("error:");
+    const electronDir = join(packageDir, "node_modules", "electron");
+    expect(
+      await Promise.all([exists(join(electronDir, "package.json")), exists(join(electronDir, "preinstall.txt"))]),
+    ).toEqual([true, scriptsRun]);
+    expect(exitCode).toBe(0);
+  });
+});
+
 test.concurrent("binary lockfile trusted dependency entries require an exact name match", async () => {
   using ctx = await setupTest();
   const { packageDir, packageJson, env } = ctx;
diff --git a/test/cli/install/migration/__snapshots__/yarn-lock-migration.test.ts.snap b/test/cli/install/migration/__snapshots__/yarn-lock-migration.test.ts.snap
index b52a34874284..c0e389462c75 100644
--- a/test/cli/install/migration/__snapshots__/yarn-lock-migration.test.ts.snap
+++ b/test/cli/install/migration/__snapshots__/yarn-lock-migration.test.ts.snap
@@ -2935,7 +2935,7 @@ exports[`bun pm migrate for existing yarn.lock yarn-cli-repo: yarn-cli-repo 1`]
 
     "class-utils/define-property/is-descriptor/is-data-descriptor/kind-of": ["kind-of@3.2.2", "", { "dependencies": { "is-buffer": "^1.1.5" } }, "sha1-MeohpzS6ubuw8yRm2JOupR5KPGQ="],
 
-    "commitizen/inquirer/cli-cursor/restore-cursor/onetime": ["onetime@1.1.0", "http://registry.npmjs.org/onetime/-/onetime-1.1.0.tgz#a1f7838f8314c516f05ecefcbc4ccfe04b4ed789", {}, "sha1-ofeDj4MUxRbwXs78vEzP4EtO14k="],
+    "commitizen/inquirer/cli-cursor/restore-cursor/onetime": ["onetime@1.1.0", "http://registry.npmjs.org/onetime/-/onetime-1.1.0.tgz", {}, "sha1-ofeDj4MUxRbwXs78vEzP4EtO14k="],
 
     "eslint/inquirer/chalk/supports-color/has-flag": ["has-flag@3.0.0", "", {}, "sha1-tdRU3CGZriJWmfNGfloH87lVuv0="],
 
@@ -3154,7 +3154,7 @@ exports[`bun pm migrate for existing yarn.lock yarn-stuff: yarn-stuff 1`] = `
 
     "reg": ["abbrev@1.1.1", "", {}, "sha512-nne9/IiQ/hzIhY6pdDnbBtz7DjPTKrY00P/zvPSm5pOFkl6xuGrGnXn/VtTNNfNtAfZ9/1RtehkszU9qcTii0Q=="],
 
-    "remote": ["abbrev@https://registry.npmjs.org/abbrev/-/abbrev-1.1.1.tgz#f8f2c887ad10bf67f634f005b6987fed3179aac8", {}],
+    "remote": ["abbrev@https://registry.npmjs.org/abbrev/-/abbrev-1.1.1.tgz", {}],
 
     "symlink": ["symlink@file:abbrev-link-target", {}],
 
diff --git a/test/cli/install/migration/yarn-lock-migration.test.ts b/test/cli/install/migration/yarn-lock-migration.test.ts
index bcaa8f63f27d..83fe9cd28754 100644
--- a/test/cli/install/migration/yarn-lock-migration.test.ts
+++ b/test/cli/install/migration/yarn-lock-migration.test.ts
@@ -1809,3 +1809,123 @@ ${yarnEntry("peer-deps-too", "1.0.0", `  peerDependencies:\n    no-deps "*"\n`)}
     expect(storeEntries(fresh)).toEqual(store);
   });
 });
+
+describe.concurrent("yarn.lock migration of registry tarball URLs", () => {
+  const integrity = {
+    parent: "sha512-nne9/IiQ/hzIhY6pdDnbBtz7DjPTKrY00P/zvPSm5pOFkl6xuGrGnXn/VtTNNfNtAfZ9/1RtehkszU9qcTii0Q==",
+    leaf: "sha512-LEyx4aLEC3x6T0UguF6YILf+ntvmOaWsVfENmIW0E9H09vKlLDGelMjjSm0jkDHALj8A8quZ/HapKNigzwge+Q==",
+  };
+
+  async function migrate(dependencies: Record<string, string>, yarnLockEntries: string) {
+    // After migrating, bun fetches manifests from the configured registry to
+    // fill in bin/os/cpu. Point it at a local server that has nothing so the
+    // test stays off the network; the migrated resolutions don't depend on it.
+    using registry = Bun.serve({
+      port: 0,
+      fetch: () => new Response("not found", { status: 404 }),
+    });
+    await using dir = tempDir("yarn-migration-registry-urls", {
+      "package.json": JSON.stringify({ name: "registry-urls", version: "1.0.0", dependencies }),
+      "yarn.lock": `# THIS IS AN AUTOGENERATED FILE. DO NOT EDIT THIS FILE DIRECTLY.
+# yarn lockfile v1
+
+
+${yarnLockEntries}`,
+    });
+
+    await using proc = Bun.spawn({
+      cmd: [bunExe(), "pm", "migrate", "-f"],
+      cwd: String(dir),
+      env: { ...bunEnv, BUN_CONFIG_REGISTRY: registry.url.href },
+      stdout: "pipe",
+      stderr: "pipe",
+      stdin: "ignore",
+    });
+    const [stdout, stderr, exitCode] = await Promise.all([proc.stdout.text(), proc.stderr.text(), proc.exited]);
+    expect(stdout + stderr).toContain("migrated lockfile from yarn.lock");
+    expect(exitCode).toBe(0);
+    return fs.readFileSync(join(String(dir), "bun.lock"), "utf8");
+  }
+
+  test("private registry: yarn's #sha1 suffix is dropped and suffix-less URLs stay npm packages", async () => {
+    const registry = "https://npm.example.com";
+    const bunLock = await migrate(
+      { parent: "^1.0.0" },
+      `parent@^1.0.0:
+  version "1.2.3"
+  resolved "${registry}/parent/-/parent-1.2.3.tgz#f8f2c887ad10bf67f634f005b6987fed3179aac8"
+  integrity ${integrity.parent}
+  dependencies:
+    "@scope/leaf" "~2.0.0"
+
+"@scope/leaf@~2.0.0":
+  version "2.0.1"
+  resolved "${registry}/@scope/leaf/-/leaf-2.0.1.tgz"
+  integrity ${integrity.leaf}
+`,
+    );
+
+    // Both entries are npm packages whose tarball URL is exactly what the
+    // registry would hand a fresh install: no `#sha1`, and no remote tarball
+    // entry (`parent@https://...`) just because yarn omitted the suffix.
+    expect(bunLock).toContain(
+      `"parent": ["parent@1.2.3", "${registry}/parent/-/parent-1.2.3.tgz", { "dependencies": { "@scope/leaf": "~2.0.0" } }, "${integrity.parent}"]`,
+    );
+    expect(bunLock).toContain(
+      `"@scope/leaf": ["@scope/leaf@2.0.1", "${registry}/@scope/leaf/-/leaf-2.0.1.tgz", {}, "${integrity.leaf}"]`,
+    );
+  });
+
+  test("default registry: a URL without yarn's #sha1 suffix is still the default registry", async () => {
+    // This is the shape `bun install --yarn` itself writes.
+    const bunLock = await migrate(
+      { "@scope/leaf": "~2.0.0", "leaf-alias": "npm:leaf@^1.0.0" },
+      `"@scope/leaf@~2.0.0":
+  version "2.0.1"
+  resolved "https://registry.yarnpkg.com/@scope/leaf/-/leaf-2.0.1.tgz"
+  integrity ${integrity.leaf}
+
+"leaf-alias@npm:leaf@^1.0.0":
+  version "1.0.0"
+  resolved "https://registry.npmjs.org/leaf/-/leaf-1.0.0.tgz"
+  integrity ${integrity.parent}
+`,
+    );
+
+    expect(bunLock).toContain(`"@scope/leaf": ["@scope/leaf@2.0.1", "", {}, "${integrity.leaf}"]`);
+    expect(bunLock).toContain(`"leaf-alias": ["leaf@1.0.0", "", {}, "${integrity.parent}"]`);
+  });
+
+  test("a dependency declared as a tarball URL stays a remote tarball, without yarn's #sha1 suffix", async () => {
+    const registryUrl = "https://npm.example.com/leaf/-/leaf-2.0.1.tgz";
+    // yarn puts the same `#sha1` after a GitHub archive download, where it must
+    // not be mistaken for the commit of a git dependency.
+    const githubUrl = "https://github.com/isaacs/abbrev-js/archive/refs/tags/v1.1.1.tar.gz";
+    const bunLock = await migrate(
+      { "leaf": registryUrl, "gh-tar": githubUrl },
+      `"leaf@${registryUrl}":
+  version "2.0.1"
+  resolved "${registryUrl}#f8f2c887ad10bf67f634f005b6987fed3179aac8"
+
+"gh-tar@${githubUrl}":
+  version "1.1.1"
+  resolved "${githubUrl}#f8f2c887ad10bf67f634f005b6987fed3179aac8"
+`,
+    );
+
+    expect(bunLock).toContain(`"leaf": ["leaf@${registryUrl}", {}]`);
+    expect(bunLock).toContain(`"gh-tar": ["gh-tar@${githubUrl}", {}]`);
+  });
+
+  test("a git dependency hosted on github.com is still migrated as git", async () => {
+    const bunLock = await migrate(
+      { abbrev: "https://github.com/isaacs/abbrev-js.git" },
+      `"abbrev@https://github.com/isaacs/abbrev-js.git":
+  version "1.1.1"
+  resolved "https://github.com/isaacs/abbrev-js.git#3f9802e56ff878761a338e43ecacbfed39d2181d"
+`,
+    );
+
+    expect(bunLock).toContain(`"abbrev": ["abbrev-js@github:isaacs/abbrev-js#3f9802e", {}, ""]`);
+  });
+});

From de8bd474c95155764bfb147eaff46b0f25e49a6a Mon Sep 17 00:00:00 2001
From: robobun <117481402+robobun@users.noreply.github.com>
Date: Mon, 17 Aug 2026 01:04:57 +0000
Subject: [PATCH 019/258] install: migrate the whole pnpm-workspace.yaml
 catalog into bun.lock (#38829)

---
 docs/pm/cli/install.mdx                       |   1 +
 src/install/lockfile/CatalogMap.rs            | 140 ++++++--
 src/install/pnpm.rs                           |  10 +-
 .../pnpm-migration-complete.test.ts.snap      |   2 +
 .../install/migration/pnpm-lock-v9.test.ts    | 308 +++++++++++++++++-
 5 files changed, 429 insertions(+), 32 deletions(-)

diff --git a/docs/pm/cli/install.mdx b/docs/pm/cli/install.mdx
index 08f526a04126..f698ef57b4ea 100644
--- a/docs/pm/cli/install.mdx
+++ b/docs/pm/cli/install.mdx
@@ -523,6 +523,7 @@ The migration process handles:
 - Converts `pnpm-lock.yaml` (lockfile versions 7–9, including pnpm 11's multi-document files) to `bun.lock`
 - Preserves resolved versions and integrity hashes
 - Preserves peer dependency ranges and `peerDependenciesMeta`, so the next `bun install` leaves the migrated lockfile unchanged
+- Writes every catalog entry declared in `pnpm-workspace.yaml` to `bun.lock`, including entries no workspace uses yet (`pnpm-lock.yaml` lists only the entries in use), so the next `bun install` leaves the catalog unchanged
 - Migrates git, GitHub, tarball URL, `file:`, and `npm:` alias dependencies, including transitive ones
 - Resolves pnpm named registries (`name@registry:version`) via `namedRegistries` in `pnpm-workspace.yaml`
 - Converts injected workspace packages (`dependenciesMeta.*.injected`) to ordinary workspace dependencies
diff --git a/src/install/lockfile/CatalogMap.rs b/src/install/lockfile/CatalogMap.rs
index d54a7b0d728f..e7e5be2183fb 100644
--- a/src/install/lockfile/CatalogMap.rs
+++ b/src/install/lockfile/CatalogMap.rs
@@ -10,7 +10,7 @@ use bun_install::dependency::{
     Version as DependencyVersion,
 };
 use bun_install::lockfile::{Buffers, StringBuilder};
-use bun_install::{Behavior, Dependency, Lockfile, PackageManager};
+use bun_install::{Behavior, Dependency, Lockfile, PackageManager, PackageNameHash};
 use bun_semver::SlicedString;
 use core::mem::ManuallyDrop;
 // Layering: every install-side caller (Package.rs / pnpm.rs) parses JSON/YAML
@@ -206,14 +206,7 @@ impl CatalogMap {
         if catalog_name.is_empty() {
             return Ok(&mut self.default);
         }
-
-        let entry = self.groups.get_or_put_adapted(&catalog_name, &ctx(buf))?;
-        if !entry.found_existing {
-            *entry.key_ptr = catalog_name;
-            *entry.value_ptr = Map::default();
-        }
-
-        Ok(entry.value_ptr)
+        get_or_put_named_group(&mut self.groups, buf, catalog_name)
     }
 
     // Deliberately takes no `Lockfile` param so `lockfile.catalogs.parse_count`
@@ -395,6 +388,31 @@ impl CatalogMap {
         Ok(())
     }
 
+    /// `catalog_obj`/`catalogs_obj` are the pnpm-workspace.yaml objects the migration writes into package.json for `parse_append` to read back, so the map takes their shape: pnpm-lock.yaml's section has only the entries in use and spells every default catalog `default`, while entries it does record keep its specifier, which their resolutions were made with.
+    pub(crate) fn put_missing_from_pnpm_workspace(
+        catalogs: &mut CatalogMap,
+        catalog_obj: Option<Expr>,
+        catalogs_obj: Option<Expr>,
+        string_buf: &mut StringBuf,
+    ) -> Result<(), AllocError> {
+        if let Some(declared) = catalog_obj {
+            put_declared_entries(&mut catalogs.default, None, &declared, string_buf)?;
+        }
+        let Some(declared_groups) = catalogs_obj else {
+            return Ok(());
+        };
+        declared_groups.try_for_each_property(|group_name_str, _, declared| {
+            let group_name = string_buf.append(group_name_str)?;
+            if group_name_str != b"default" {
+                let group = catalogs.get_or_put_group(string_buf.bytes.as_slice(), group_name)?;
+                return put_declared_entries(group, None, &declared, string_buf);
+            }
+            let CatalogMap { default, groups } = &mut *catalogs;
+            let group = get_or_put_named_group(groups, string_buf.bytes.as_slice(), group_name)?;
+            put_declared_entries(group, Some(default), &declared, string_buf)
+        })
+    }
+
     // Takes `buffers: &Buffers` rather than the whole `Lockfile` so the call
     // site can hold `&mut lockfile.catalogs` while only borrowing
     // `lockfile.buffers` immutably (disjoint fields), instead of forcing a
@@ -541,28 +559,17 @@ fn put_entries_from_pnpm_lockfile(
         let Some(version_str) = specifier.as_utf8_string_literal() else {
             return Err(FromPnpmLockfileError::InvalidPnpmLockfile);
         };
-        let version_hash = StringBuilderNs::string_hash(version_str);
-        let version = string_buf.append_with_hash(version_str, version_hash)?;
-        let version_sliced = version.sliced(string_buf.bytes.as_slice());
-
-        let Some(parsed_version) = Dependency::parse(
+        let Some(dep) = parse_entry(
             dep_name,
             dep_name_hash,
-            version_sliced.slice,
-            &version_sliced,
+            version_str,
             Some(&mut *log),
-            None,
-        ) else {
+            string_buf,
+        )?
+        else {
             return Err(FromPnpmLockfileError::InvalidPnpmLockfile);
         };
 
-        let dep = Dependency {
-            name: dep_name,
-            name_hash: dep_name_hash,
-            version: parsed_version,
-            ..Dependency::default()
-        };
-
         let buf = string_buf.bytes.as_slice();
         let entry = catalog_map.get_or_put_adapted(&dep_name, &ctx(buf))?;
 
@@ -575,3 +582,86 @@ fn put_entries_from_pnpm_lockfile(
     }
     Ok(())
 }
+
+/// Entries `group` records stay as recorded, ones `lockfile_default` recorded move into `group`, the rest are added; an entry that does not parse is left out silently because `parse_append_group` leaves it out and reports it when the next install reads package.json.
+fn put_declared_entries(
+    group: &mut Map,
+    mut lockfile_default: Option<&mut Map>,
+    declared: &Expr,
+    string_buf: &mut StringBuf,
+) -> Result<(), AllocError> {
+    declared.try_for_each_property(|dep_name_str, _, specifier| {
+        let dep_name_hash = StringBuilderNs::string_hash(dep_name_str);
+        let dep_name = string_buf.append_with_hash(dep_name_str, dep_name_hash)?;
+        let buf = string_buf.bytes.as_slice();
+        if group.contains_adapted(&dep_name, &ctx(buf)) {
+            return Ok(());
+        }
+        let recorded = lockfile_default
+            .as_deref_mut()
+            .and_then(|lockfile_default| {
+                let i = lockfile_default.get_index_adapted(&dep_name, &ctx(buf))?;
+                Some(lockfile_default.swap_remove_at(i).1)
+            });
+        let dep = match recorded {
+            Some(dep) => dep,
+            None => {
+                let Some(specifier_str) = specifier.as_utf8_string_literal() else {
+                    return Ok(());
+                };
+                let Some(dep) =
+                    parse_entry(dep_name, dep_name_hash, specifier_str, None, string_buf)?
+                else {
+                    return Ok(());
+                };
+                dep
+            }
+        };
+        let buf = string_buf.bytes.as_slice();
+        let entry = group.get_or_put_adapted(&dep_name, &ctx(buf))?;
+        *entry.key_ptr = dep_name;
+        *entry.value_ptr = dep;
+        Ok(())
+    })
+}
+
+/// `dep_name` is already in `string_buf`; `None` means `specifier` is not a dependency version.
+fn parse_entry(
+    dep_name: String,
+    dep_name_hash: PackageNameHash,
+    specifier: &[u8],
+    log: Option<&mut Log>,
+    string_buf: &mut StringBuf,
+) -> Result<Option<Dependency>, AllocError> {
+    let version = string_buf.append(specifier)?;
+    let version_sliced = version.sliced(string_buf.bytes.as_slice());
+    let Some(version) = Dependency::parse(
+        dep_name,
+        dep_name_hash,
+        version_sliced.slice,
+        &version_sliced,
+        log,
+        None,
+    ) else {
+        return Ok(None);
+    };
+    Ok(Some(Dependency {
+        name: dep_name,
+        name_hash: dep_name_hash,
+        version,
+        ..Dependency::default()
+    }))
+}
+
+fn get_or_put_named_group<'a>(
+    groups: &'a mut ArrayHashMap<String, Map>,
+    buf: &[u8],
+    catalog_name: String,
+) -> Result<&'a mut Map, AllocError> {
+    let entry = groups.get_or_put_adapted(&catalog_name, &ctx(buf))?;
+    if !entry.found_existing {
+        *entry.key_ptr = catalog_name;
+        *entry.value_ptr = Map::default();
+    }
+    Ok(entry.value_ptr)
+}
diff --git a/src/install/pnpm.rs b/src/install/pnpm.rs
index ed086e505dce..479beef92007 100644
--- a/src/install/pnpm.rs
+++ b/src/install/pnpm.rs
@@ -1626,7 +1626,7 @@ pub(crate) fn migrate_pnpm_lockfile<'a>(
 
     lockfile.fetch_necessary_package_metadata_after_yarn_or_pnpm_migration::<false>(manager)?;
 
-    update_package_json_after_migration(manager, log, dir, &found_patches)?;
+    update_package_json_after_migration(lockfile, manager, log, dir, &found_patches)?;
 
     Ok(LoadResult::Ok(LoadResultOk {
         lockfile,
@@ -2333,6 +2333,7 @@ fn rewrite_bare_patch_keys(
 
 /// Updates package.json with workspace and catalog information after migration
 fn update_package_json_after_migration(
+    lockfile: &mut Lockfile,
     manager: &mut PackageManager,
     log: &mut bun_ast::Log,
     dir: Fd,
@@ -2441,6 +2442,13 @@ fn update_package_json_after_migration(
 
             catalog_obj = ws_root.get_object(b"catalog").filter(is_non_empty_object);
             catalogs_obj = ws_root.get_object(b"catalogs").filter(is_non_empty_object);
+            // The migrated root skips `Package::parse`, so the catalog these declare is recorded in the lockfile here.
+            crate::lockfile_real::CatalogMap::put_missing_from_pnpm_workspace(
+                &mut lockfile.catalogs,
+                catalog_obj,
+                catalogs_obj,
+                &mut sbuf!(lockfile),
+            )?;
             workspace_overrides_obj = ws_root.get_object(b"overrides").filter(is_non_empty_object);
             workspace_patched_deps_obj = ws_root
                 .get_object(b"patchedDependencies")
diff --git a/test/cli/install/migration/__snapshots__/pnpm-migration-complete.test.ts.snap b/test/cli/install/migration/__snapshots__/pnpm-migration-complete.test.ts.snap
index 58de333615b4..51f7da457372 100644
--- a/test/cli/install/migration/__snapshots__/pnpm-migration-complete.test.ts.snap
+++ b/test/cli/install/migration/__snapshots__/pnpm-migration-complete.test.ts.snap
@@ -255,9 +255,11 @@ exports[`PNPM Migration Complete Test Suite comprehensive PNPM migration with al
   },
   "catalog": {
     "react": "18.2.0",
+    "react-dom": "18.2.0",
   },
   "catalogs": {
     "tools": {
+      "eslint": "8.56.0",
       "lodash": "4.17.21",
     },
   },
diff --git a/test/cli/install/migration/pnpm-lock-v9.test.ts b/test/cli/install/migration/pnpm-lock-v9.test.ts
index dc80656b10eb..a08d0dbe23cd 100644
--- a/test/cli/install/migration/pnpm-lock-v9.test.ts
+++ b/test/cli/install/migration/pnpm-lock-v9.test.ts
@@ -39,6 +39,16 @@ async function bunLockOf(dir: string) {
   return await Bun.file(join(dir, "bun.lock")).text();
 }
 
+// A migrated bun.lock is complete when the install after it finds nothing to save.
+async function expectInstallToLeaveUnchanged(dir: string, migratedBunLock: string) {
+  const install = await run(dir, "install");
+
+  expect(install.stderr).not.toContain("Saved lockfile");
+  expect(install.stderr).not.toContain("error:");
+  expect(install.exitCode).toBe(0);
+  expect(await bunLockOf(dir)).toBe(migratedBunLock);
+}
+
 function workspacesSection(bunLock: string) {
   const start = bunLock.indexOf(`  "workspaces": {`);
   const end = bunLock.indexOf(`  "packages": {`);
@@ -47,6 +57,15 @@ function workspacesSection(bunLock: string) {
   return bunLock.slice(start, end);
 }
 
+// bun.lock writes `catalog` and `catalogs` between the workspaces and packages sections.
+function catalogSections(bunLock: string) {
+  const workspacesEnd = bunLock.indexOf("\n  },\n", bunLock.indexOf(`  "workspaces": {`));
+  const packagesStart = bunLock.indexOf(`  "packages": {`);
+  expect(workspacesEnd).not.toBe(-1);
+  expect(packagesStart).not.toBe(-1);
+  return bunLock.slice(workspacesEnd + "\n  },\n".length, packagesStart);
+}
+
 function workspaceBlock(bunLock: string, key: string) {
   const start = bunLock.indexOf(`    "${key}": {\n`);
   expect(start).not.toBe(-1);
@@ -2580,12 +2599,7 @@ snapshots:
       expect(root).toContain(`      "dependencies": {\n        "no-deps": "~1.0.0",\n      },`);
       expect(root.split(`"a-dep"`).length - 1).toBe(1);
 
-      const install = await run(packageDir, "install");
-
-      expect(install.stderr).not.toContain("Saved lockfile");
-      expect(install.stderr).not.toContain("error:");
-      expect(install.exitCode).toBe(0);
-      expect(await bunLockOf(packageDir)).toBe(migrated);
+      await expectInstallToLeaveUnchanged(packageDir, migrated);
       expect(await installedPackageJson(packageDir, "", "a-dep")).toStrictEqual({ name: "a-dep", version: "1.0.1" });
     });
 
@@ -3330,6 +3344,288 @@ catalog:
       expect(bunLock).toContain(`"no-deps@1.0.1"`);
     });
 
+    // pnpm-lock.yaml only records the catalog entries some importer uses; the migration copies the whole
+    // pnpm-workspace.yaml catalog into package.json, so bun.lock has to get the whole catalog too or the
+    // next `bun install` sees a catalog change and rewrites it.
+    test("entries no importer uses are migrated into bun.lock", async () => {
+      const { packageDir } = await verdaccio.createTestDir({
+        bunfigOpts: { linker: "hoisted" },
+        files: {
+          "package.json": JSON.stringify({ name: "unused-catalog", dependencies: { "no-deps": "^1.0.0" } }),
+          "pnpm-workspace.yaml": `catalog:
+  unused-default: ^9.0.0
+
+catalogs:
+  tools:
+    unused-tool: ^8.0.0
+`,
+          "pnpm-lock.yaml": `lockfileVersion: '9.0'
+
+importers:
+
+  .:
+    dependencies:
+      no-deps:
+        specifier: ^1.0.0
+        version: 1.0.1
+
+packages:
+
+  no-deps@1.0.1:
+    resolution: {integrity: ${NO_DEPS_1_0_1_INTEGRITY}}
+
+snapshots:
+
+  no-deps@1.0.1: {}
+`,
+        },
+      });
+
+      const { stderr, exitCode } = await migrate(packageDir);
+
+      expect(stderr).toContain("migrated lockfile from pnpm-lock.yaml");
+      expect(exitCode).toBe(0);
+
+      const migrated = await bunLockOf(packageDir);
+      expect(catalogSections(migrated)).toBe(
+        [
+          `  "catalog": {`,
+          `    "unused-default": "^9.0.0",`,
+          `  },`,
+          `  "catalogs": {`,
+          `    "tools": {`,
+          `      "unused-tool": "^8.0.0",`,
+          `    },`,
+          `  },`,
+          ``,
+        ].join("\n"),
+      );
+      expect((await Bun.file(join(packageDir, "package.json")).json()).workspaces).toEqual({
+        catalog: { "unused-default": "^9.0.0" },
+        catalogs: { tools: { "unused-tool": "^8.0.0" } },
+      });
+
+      await expectInstallToLeaveUnchanged(packageDir, migrated);
+    });
+
+    // Peers keep their catalog: reference through the migration, so the install afterwards is a no-op
+    // exactly when the catalog sections match what package.json declares.
+    test("declared entries are merged into the groups the lockfile recorded", async () => {
+      const { packageDir } = await verdaccio.createTestDir({
+        bunfigOpts: { linker: "hoisted" },
+        files: {
+          "package.json": JSON.stringify({
+            name: "merged-catalog",
+            peerDependencies: { "a-dep": "catalog:tools", "no-deps": "catalog:" },
+          }),
+          "pnpm-workspace.yaml": `catalog:
+  no-deps: ^1.0.0
+  unused-default: ^9.0.0
+
+catalogs:
+  tools:
+    a-dep: ^1.0.0
+    unused-tool: ^8.0.0
+`,
+          "pnpm-lock.yaml": `lockfileVersion: '9.0'
+
+settings:
+  autoInstallPeers: true
+
+catalogs:
+  default:
+    no-deps:
+      specifier: ^1.0.0
+      version: 1.0.1
+  tools:
+    a-dep:
+      specifier: ^1.0.0
+      version: 1.0.1
+
+importers:
+
+  .:
+    dependencies:
+      a-dep:
+        specifier: catalog:tools
+        version: 1.0.1
+      no-deps:
+        specifier: 'catalog:'
+        version: 1.0.1
+
+packages:
+
+  a-dep@1.0.1:
+    resolution: {integrity: ${A_DEP_1_0_1_INTEGRITY}}
+
+  no-deps@1.0.1:
+    resolution: {integrity: ${NO_DEPS_1_0_1_INTEGRITY}}
+
+snapshots:
+
+  a-dep@1.0.1: {}
+
+  no-deps@1.0.1: {}
+`,
+        },
+      });
+
+      const { stderr, exitCode } = await migrate(packageDir);
+
+      expect(stderr).not.toContain("missing entry");
+      expect(stderr).toContain("migrated lockfile from pnpm-lock.yaml");
+      expect(exitCode).toBe(0);
+
+      const migrated = await bunLockOf(packageDir);
+      expect(catalogSections(migrated)).toBe(
+        [
+          `  "catalog": {`,
+          `    "no-deps": "^1.0.0",`,
+          `    "unused-default": "^9.0.0",`,
+          `  },`,
+          `  "catalogs": {`,
+          `    "tools": {`,
+          `      "a-dep": "^1.0.0",`,
+          `      "unused-tool": "^8.0.0",`,
+          `    },`,
+          `  },`,
+          ``,
+        ].join("\n"),
+      );
+      expect(workspaceBlock(migrated, "")).toContain(
+        `      "peerDependencies": {\n        "a-dep": "catalog:tools",\n        "no-deps": "catalog:",\n      },`,
+      );
+
+      await expectInstallToLeaveUnchanged(packageDir, migrated);
+      expect(await installedPackageJson(packageDir, "", "a-dep")).toStrictEqual({ name: "a-dep", version: "1.0.1" });
+    });
+
+    // pnpm-lock.yaml records the default catalog as `catalogs.default` whether pnpm-workspace.yaml spelled it
+    // `catalog:` or `catalogs.default:`; bun.lock and package.json keep the two spellings apart.
+    test("a default catalog declared as catalogs.default stays catalogs.default", async () => {
+      const { packageDir } = await verdaccio.createTestDir({
+        bunfigOpts: { linker: "hoisted" },
+        files: {
+          "package.json": JSON.stringify({ name: "catalogs-default", peerDependencies: { "no-deps": "catalog:" } }),
+          "pnpm-workspace.yaml": `catalogs:
+  default:
+    no-deps: ^1.0.0
+    unused-default: ^9.0.0
+`,
+          "pnpm-lock.yaml": `lockfileVersion: '9.0'
+
+settings:
+  autoInstallPeers: true
+
+catalogs:
+  default:
+    no-deps:
+      specifier: ^1.0.0
+      version: 1.0.1
+
+importers:
+
+  .:
+    dependencies:
+      no-deps:
+        specifier: 'catalog:'
+        version: 1.0.1
+
+packages:
+
+  no-deps@1.0.1:
+    resolution: {integrity: ${NO_DEPS_1_0_1_INTEGRITY}}
+
+snapshots:
+
+  no-deps@1.0.1: {}
+`,
+        },
+      });
+
+      const { stderr, exitCode } = await migrate(packageDir);
+
+      expect(stderr).not.toContain("missing entry");
+      expect(stderr).toContain("migrated lockfile from pnpm-lock.yaml");
+      expect(exitCode).toBe(0);
+
+      const migrated = await bunLockOf(packageDir);
+      expect(catalogSections(migrated)).toBe(
+        [
+          `  "catalogs": {`,
+          `    "default": {`,
+          `      "no-deps": "^1.0.0",`,
+          `      "unused-default": "^9.0.0",`,
+          `    },`,
+          `  },`,
+          ``,
+        ].join("\n"),
+      );
+      expect((await Bun.file(join(packageDir, "package.json")).json()).workspaces).toEqual({
+        catalogs: { default: { "no-deps": "^1.0.0", "unused-default": "^9.0.0" } },
+      });
+
+      await expectInstallToLeaveUnchanged(packageDir, migrated);
+    });
+
+    // The lockfile's specifier is the one its resolutions were made with: taking the yaml's would hide the
+    // edit from the next install and leave no-deps@1.0.0 locked under a range it does not satisfy.
+    test("an entry edited in pnpm-workspace.yaml after the last pnpm install keeps the lockfile's specifier", async () => {
+      const { packageDir } = await verdaccio.createTestDir({
+        bunfigOpts: { linker: "hoisted" },
+        files: {
+          "package.json": JSON.stringify({ name: "edited-catalog", dependencies: { "no-deps": "catalog:" } }),
+          "pnpm-workspace.yaml": `catalog:
+  no-deps: ^1.0.1
+`,
+          "pnpm-lock.yaml": `lockfileVersion: '9.0'
+
+catalogs:
+  default:
+    no-deps:
+      specifier: ^1.0.0
+      version: 1.0.0
+
+importers:
+
+  .:
+    dependencies:
+      no-deps:
+        specifier: 'catalog:'
+        version: 1.0.0
+
+packages:
+
+  no-deps@1.0.0:
+    resolution: {integrity: ${NO_DEPS_1_0_0_INTEGRITY}}
+
+snapshots:
+
+  no-deps@1.0.0: {}
+`,
+        },
+      });
+
+      const { stderr, exitCode } = await migrate(packageDir);
+
+      expect(stderr).toContain("migrated lockfile from pnpm-lock.yaml");
+      expect(exitCode).toBe(0);
+
+      const migrated = await bunLockOf(packageDir);
+      expect(catalogSections(migrated)).toBe(`  "catalog": {\n    "no-deps": "^1.0.0",\n  },\n`);
+      expect(migrated).toContain(`"no-deps@1.0.0"`);
+
+      const install = await run(packageDir, "install");
+
+      expect(install.stderr).toContain("Saved lockfile");
+      expect(install.stderr).not.toContain("error:");
+      expect(install.exitCode).toBe(0);
+      const updated = await bunLockOf(packageDir);
+      expect(catalogSections(updated)).toBe(`  "catalog": {\n    "no-deps": "^1.0.1",\n  },\n`);
+      expect(updated).toContain(`"no-deps@1.1.0"`);
+      expect(updated).not.toContain(`"no-deps@1.0.0"`);
+    });
+
     // pnpm/pnpm#10456: `pnpm remove` can drop the catalogs: section while importers still say catalog:
     test.concurrent("importer catalog: reference without a catalogs: section is reported", async () => {
       using dir = fixture("v9-catalog-default");

From aa8ac2621f113961c624b7f0f5a459dd48dd78b2 Mon Sep 17 00:00:00 2001
From: robobun <117481402+robobun@users.noreply.github.com>
Date: Mon, 17 Aug 2026 01:05:02 +0000
Subject: [PATCH 020/258] install: migrate a package's own file: directories
 from package-lock.json relative to the package (#38990)

---
 src/install/migration/npm_lock.rs          |  66 +++++-
 test/cli/install/migration/migrate.test.ts | 261 +++++++++++++++++++++
 2 files changed, 317 insertions(+), 10 deletions(-)

diff --git a/src/install/migration/npm_lock.rs b/src/install/migration/npm_lock.rs
index 6acbcf2dcce2..82836eaa6d02 100644
--- a/src/install/migration/npm_lock.rs
+++ b/src/install/migration/npm_lock.rs
@@ -99,6 +99,21 @@ fn parent_dir(dir: &[u8]) -> &[u8] {
     }
 }
 
+/// The part of package-lock key `path` below key `dir`, if it is strictly inside it.
+fn path_inside<'k>(dir: &[u8], path: &'k [u8]) -> Option<&'k [u8]> {
+    path.strip_prefix(dir)?
+        .strip_prefix(b"/")
+        .filter(|rest| !rest.is_empty())
+}
+
+/// Folder inside a cache-installed dependent; the installer reads its row relative to the package.
+#[derive(Clone, Copy)]
+struct FolderInDependent<'k> {
+    path: &'k [u8],
+    /// Fallback name, as in a fresh resolve; npm writes these entries without one.
+    alias: &'k [u8],
+}
+
 struct Migrator<'a> {
     this: &'a mut Lockfile,
     manager: &'a mut PackageManager,
@@ -152,7 +167,7 @@ pub(super) fn migrate_packages(
 
     migrator.build_index()?;
 
-    let root_id = migrator.build_package(0, false, DepTag::Npm)?;
+    let root_id = migrator.build_package(0, false, DepTag::Npm, None)?;
     debug_assert_eq!(root_id, 0);
 
     let mut cursor = 0;
@@ -265,10 +280,16 @@ impl<'a> Migrator<'a> {
         if existing != INVALID_PACKAGE_ID {
             return Ok(existing);
         }
-        self.build_package(j, via_link, hint)
+        self.build_package(j, via_link, hint, None)
     }
 
-    fn build_package(&mut self, j: u32, via_link: bool, hint: DepTag) -> Result<PackageID, Error> {
+    fn build_package(
+        &mut self,
+        j: u32,
+        via_link: bool,
+        hint: DepTag,
+        folder_in_dependent: Option<FolderInDependent<'_>>,
+    ) -> Result<PackageID, Error> {
         let entries = self.entries;
         let entry = &entries[j as usize];
         let pkg = entry_object(entry);
@@ -283,6 +304,8 @@ impl<'a> Migrator<'a> {
             &ws.name
         } else if let Some(set_name) = pkg.get(b"name").and_then(|n| n.as_str()) {
             set_name
+        } else if let Some(folder) = folder_in_dependent {
+            folder.alias
         } else {
             package_name_from_path(key)
         };
@@ -385,6 +408,7 @@ impl<'a> Migrator<'a> {
             workspace_entry.is_some(),
             via_link,
             hint,
+            folder_in_dependent.map(|folder| folder.path),
         )?;
         debug!(
             "{} -> {}",
@@ -422,7 +446,9 @@ impl<'a> Migrator<'a> {
                         self.this.packages.items_resolution_mut()[existing as usize] = res;
                     }
                 }
-                self.entry_package_ids[j as usize] = existing;
+                if folder_in_dependent.is_none() {
+                    self.entry_package_ids[j as usize] = existing;
+                }
                 self.shadow(j);
                 return Ok(existing);
             }
@@ -443,8 +469,12 @@ impl<'a> Migrator<'a> {
             scripts: Default::default(),
         })?;
         self.this.get_or_put_id(id, name_hash)?;
-        self.entry_package_ids[j as usize] = id;
         self.queue.push((j, id));
+        // `build_or_get` must keep handing other dependents the entry-key build.
+        match folder_in_dependent {
+            None => self.entry_package_ids[j as usize] = id,
+            Some(_) => self.shadowed.set(j as usize),
+        }
         Ok(id)
     }
 
@@ -512,6 +542,7 @@ impl<'a> Migrator<'a> {
         is_workspace: bool,
         via_link: bool,
         hint: DepTag,
+        path_in_dependent: Option<&[u8]>,
     ) -> Result<Resolution, Error> {
         if j == 0 {
             return Ok(Resolution::init(ResTagged::Root));
@@ -558,7 +589,10 @@ impl<'a> Migrator<'a> {
             }
         }
 
-        let path = self.this.string_buf().append(key)?;
+        let path = self
+            .this
+            .string_buf()
+            .append(path_in_dependent.unwrap_or(key))?;
         Ok(Resolution::init(ResTagged::Folder(path)))
     }
 
@@ -687,6 +721,7 @@ impl<'a> Migrator<'a> {
         };
         let replace_optional_dups = matches!(res_tag, resolution::Tag::Root | resolution::Tag::Npm);
         let skip_peer_dups = res_tag == resolution::Tag::Npm;
+        let installed_from_cache = res_tag.can_enqueue_install_task();
 
         if j == 0 {
             self.link_workspaces()?;
@@ -769,15 +804,26 @@ impl<'a> Migrator<'a> {
 
                 let version_tag = version.tag;
                 let mut found = self.find_target(key, name);
+                let mut folder_in_dependent: Option<FolderInDependent<'_>> = None;
                 if let Some((t, through_link)) = found
                     && !is_local
-                    && self.is_external_folder(t, through_link)
                 {
-                    self.skip_external(t, name);
-                    found = None;
+                    if through_link && installed_from_cache {
+                        folder_in_dependent = path_inside(key, entries[t as usize].key.slice())
+                            .map(|path| FolderInDependent { path, alias: name });
+                    }
+                    if folder_in_dependent.is_none() && self.is_external_folder(t, through_link) {
+                        self.skip_external(t, name);
+                        found = None;
+                    }
                 }
                 let target = match found {
-                    Some((t, through_link)) => self.build_or_get(t, through_link, version_tag)?,
+                    Some((t, through_link)) => match folder_in_dependent {
+                        Some(folder) => {
+                            self.build_package(t, through_link, version_tag, Some(folder))?
+                        }
+                        None => self.build_or_get(t, through_link, version_tag)?,
+                    },
                     None if behavior.is_peer() || behavior.contains(Behavior::OPTIONAL) => {
                         INVALID_PACKAGE_ID
                     }
diff --git a/test/cli/install/migration/migrate.test.ts b/test/cli/install/migration/migrate.test.ts
index 9cdcf8023fbf..d89f2ce91783 100644
--- a/test/cli/install/migration/migrate.test.ts
+++ b/test/cli/install/migration/migrate.test.ts
@@ -1651,6 +1651,267 @@ describe("package-lock.json migration fixes", () => {
     expect(storeEntries(project.dir)).toStrictEqual(linker === "isolated" ? [project.o.replaceAll(/[/:]/g, "+")] : []);
   });
 
+  // npm resolves a `file:` directory declared by a registry package against the package itself and keys the
+  // target entry by its project-relative path (`node_modules/<pkg>/<dir>`). bun installs a folder declared by a
+  // registry package from inside that package, so the migrated row has to be the path inside the package.
+  describe("file: directory inside a registry package", () => {
+    function project(
+      name: string,
+      registry: ReturnType<typeof localRegistry>,
+      pkg: "file-dep" | "missing-file-dep",
+      folder: string,
+      linkKey: string,
+    ) {
+      const dependencies = { [pkg]: "1.0.0" };
+      return synthetic(
+        name,
+        {
+          "package.json": JSON.stringify({ name, dependencies }),
+          "package-lock.json": npmLock(name, {
+            "": { name, dependencies },
+            [`node_modules/${pkg}`]: {
+              version: "1.0.0",
+              resolved: registry.tarball(pkg, "1.0.0"),
+              integrity: registry.integrity(pkg, "1.0.0"),
+              dependencies: { files: `file:./${folder}` },
+            },
+            [`node_modules/${pkg}/${folder}`]: {},
+            [linkKey]: { resolved: `node_modules/${pkg}/${folder}`, link: true },
+          }),
+        },
+        registry.url,
+      );
+    }
+
+    test.concurrent.each([
+      ["node_modules/files", "hoisted"],
+      ["node_modules/file-dep/node_modules/files", "nested"],
+    ])("is recorded relative to the package and installed from it (link at %s)", async (linkKey, slug) => {
+      using registry = localRegistry();
+      using dir = project(`npm-migrate-folder-in-package-${slug}`, registry, "file-dep", "the-files", linkKey);
+
+      const { text, lock } = await migrate(dir);
+      expect(lock.packages).toStrictEqual({
+        "file-dep": [
+          "file-dep@1.0.0",
+          registry.tarball("file-dep", "1.0.0"),
+          { dependencies: { files: "file:./the-files" } },
+          registry.integrity("file-dep", "1.0.0"),
+        ],
+        "file-dep/files": ["files@file:the-files", {}],
+      });
+      expect(text).not.toContain("node_modules/file-dep/the-files");
+      await frozen(dir);
+
+      const install = await run(dir, "install", "--linker", "hoisted");
+      expect(install.stderr).not.toContain("error");
+      expect(install.exitCode).toBe(0);
+      expect(
+        await Bun.file(join(String(dir), "node_modules", "file-dep", "node_modules", "files", "package.json")).json(),
+      ).toHaveProperty("name", "files");
+      const resolve = await run(join(String(dir), "node_modules", "file-dep"), "-e", `require("files")`);
+      expect(resolve.stdout).toBe("hello files\n");
+      expect(resolve.exitCode).toBe(0);
+      expect(registry.requests).toStrictEqual(["/file-dep/-/file-dep-1.0.0.tgz"]);
+    });
+
+    test.concurrent("a directory the package does not ship installs nothing, like a fresh resolve", async () => {
+      using registry = localRegistry();
+      using dir = project(
+        "npm-migrate-folder-in-package-missing",
+        registry,
+        "missing-file-dep",
+        "missing-folder",
+        "node_modules/files",
+      );
+
+      const { lock } = await migrate(dir);
+      expect(lock.packages["missing-file-dep/files"]).toStrictEqual(["files@file:missing-folder", {}]);
+      await frozen(dir);
+
+      const install = await run(dir, "install", "--linker", "hoisted");
+      expect(install.stderr).not.toContain("error");
+      expect(install.exitCode).toBe(0);
+      expect(fs.existsSync(join(String(dir), "node_modules", "missing-file-dep", "node_modules", "files"))).toBeFalse();
+    });
+
+    // `file:.` links back to the package's own entry, which is not inside itself, so the edge resolves to the package.
+    test.concurrent("a package depending on itself with file:. keeps resolving to itself", async () => {
+      using registry = localRegistry();
+      const dependencies = { "self-file-dep": "1.0.0" };
+      using dir = synthetic(
+        "npm-migrate-folder-self",
+        {
+          "package.json": JSON.stringify({ name: "folder-self", dependencies }),
+          "package-lock.json": npmLock("folder-self", {
+            "": { name: "folder-self", dependencies },
+            "node_modules/self-file-dep": {
+              version: "1.0.0",
+              resolved: registry.tarball("self-file-dep", "1.0.0"),
+              integrity: registry.integrity("self-file-dep", "1.0.0"),
+              dependencies: { "self-file-dep": "file:." },
+            },
+            "node_modules/self-file-dep/node_modules/self-file-dep": {
+              resolved: "node_modules/self-file-dep",
+              link: true,
+            },
+          }),
+        },
+        registry.url,
+      );
+
+      const { lock } = await migrate(dir);
+      expect(lock.packages).toStrictEqual({
+        "self-file-dep": [
+          "self-file-dep@1.0.0",
+          registry.tarball("self-file-dep", "1.0.0"),
+          { dependencies: { "self-file-dep": "file:." } },
+          registry.integrity("self-file-dep", "1.0.0"),
+        ],
+      });
+      await frozen(dir);
+
+      const install = await run(dir, "install", "--linker", "hoisted");
+      expect(install.stderr).not.toContain("error");
+      expect(install.exitCode).toBe(0);
+      const resolve = await run(
+        join(String(dir), "node_modules", "self-file-dep"),
+        "-e",
+        `console.log(require("self-file-dep/package.json").version)`,
+      );
+      expect(resolve.stdout).toBe("1.0.0\n");
+      expect(resolve.exitCode).toBe(0);
+    });
+
+    test.concurrent("a directory inside a folder the root declares stays relative to the project", async () => {
+      const dependencies = { a: "file:vendor/a" };
+      using dir = synthetic("npm-migrate-folder-in-local-folder", {
+        "package.json": JSON.stringify({ name: "folder-in-local-folder", dependencies }),
+        "vendor/a/package.json": JSON.stringify({ name: "a", version: "1.0.0", dependencies: { b: "file:./b" } }),
+        "vendor/a/b/package.json": JSON.stringify({ name: "b", version: "1.0.0" }),
+        "package-lock.json": npmLock("folder-in-local-folder", {
+          "": { name: "folder-in-local-folder", dependencies },
+          "node_modules/a": { resolved: "vendor/a", link: true },
+          "vendor/a": { version: "1.0.0", dependencies: { b: "file:./b" } },
+          "vendor/a/b": { version: "1.0.0" },
+          "vendor/a/node_modules/b": { resolved: "vendor/a/b", link: true },
+        }),
+      });
+
+      const { lock } = await migrate(dir);
+      expect(lock.packages).toStrictEqual({
+        a: ["a@file:vendor/a", { dependencies: { b: "file:./b" } }],
+        "a/b": ["b@file:vendor/a/b", {}],
+      });
+      await frozen(dir);
+
+      const install = await run(dir, "install", "--linker", "hoisted");
+      expect(install.stderr).not.toContain("error");
+      expect(install.exitCode).toBe(0);
+      expect(
+        await Bun.file(join(String(dir), "node_modules", "a", "node_modules", "b", "package.json")).json(),
+      ).toStrictEqual({ name: "b", version: "1.0.0" });
+    });
+
+    // npm deduplicated a local folder's `files` onto the hoisted link into file-dep. Each dependent needs its own
+    // form of the row: file-dep's is read relative to file-dep, the local folder's relative to the project.
+    test.concurrent.each([
+      ["file-dep", "local"],
+      ["local", "file-dep"],
+    ])("a local folder sharing the directory gets the project-relative row (%s linked first)", async (...order) => {
+      using registry = localRegistry();
+      const specs: Record<string, string> = { "file-dep": "1.0.0", local: "file:vendor/local" };
+      const dependencies = Object.fromEntries(order.map(name => [name, specs[name]]));
+      const name = `npm-migrate-folder-shared-${order[0]}-first`;
+      using dir = synthetic(
+        name,
+        {
+          "package.json": JSON.stringify({ name, dependencies }),
+          "vendor/local/package.json": JSON.stringify({
+            name: "local",
+            version: "1.0.0",
+            dependencies: { files: "*" },
+          }),
+          "package-lock.json": npmLock(name, {
+            "": { name, dependencies },
+            "node_modules/file-dep": {
+              version: "1.0.0",
+              resolved: registry.tarball("file-dep", "1.0.0"),
+              integrity: registry.integrity("file-dep", "1.0.0"),
+              dependencies: { files: "file:./the-files" },
+            },
+            "node_modules/file-dep/the-files": { name: "files", version: "1.1.1" },
+            "node_modules/files": { resolved: "node_modules/file-dep/the-files", link: true },
+            "node_modules/local": { resolved: "vendor/local", link: true },
+            "vendor/local": { version: "1.0.0", dependencies: { files: "*" } },
+          }),
+        },
+        registry.url,
+      );
+
+      const { lock } = await migrate(dir);
+      expect(lock.packages["file-dep/files"]).toStrictEqual(["files@file:the-files", {}]);
+      expect(lock.packages["local/files"]).toStrictEqual(["files@file:node_modules/file-dep/the-files", {}]);
+      await frozen(dir);
+
+      const install = await run(dir, "install", "--linker", "hoisted");
+      expect(install.stderr).not.toContain("error");
+      expect(install.exitCode).toBe(0);
+      for (const dependent of ["file-dep", "local"]) {
+        expect(
+          await Bun.file(join(String(dir), "node_modules", dependent, "node_modules", "files", "package.json")).json(),
+        ).toHaveProperty("name", "files");
+      }
+    });
+
+    test.concurrent(
+      "a registry package deduplicated onto a folder the root declares keeps the root's row",
+      async () => {
+        using registry = localRegistry();
+        const dependencies = { "dep-file-dep": "1.0.0", "file-dep": "file:vendor/file-dep" };
+        using dir = synthetic(
+          "npm-migrate-folder-dedupe",
+          {
+            "package.json": JSON.stringify({ name: "folder-dedupe", dependencies }),
+            "vendor/file-dep/package.json": JSON.stringify({ name: "file-dep", version: "1.0.0" }),
+            "package-lock.json": npmLock("folder-dedupe", {
+              "": { name: "folder-dedupe", dependencies },
+              "node_modules/dep-file-dep": {
+                version: "1.0.0",
+                resolved: registry.tarball("dep-file-dep", "1.0.0"),
+                integrity: registry.integrity("dep-file-dep", "1.0.0"),
+                dependencies: { "file-dep": "1.0.0" },
+              },
+              "node_modules/file-dep": { resolved: "vendor/file-dep", link: true },
+              "vendor/file-dep": { version: "1.0.0" },
+            }),
+          },
+          registry.url,
+        );
+
+        const { lock } = await migrate(dir);
+        expect(lock.packages["file-dep"]).toStrictEqual(["file-dep@file:vendor/file-dep", {}]);
+        expect(lock.packages["dep-file-dep/file-dep"]).toStrictEqual(["file-dep@file:vendor/file-dep", {}]);
+        await frozen(dir);
+
+        const install = await run(dir, "install", "--linker", "hoisted");
+        expect(install.stderr).not.toContain("error");
+        expect(install.exitCode).toBe(0);
+        // The copy under dep-file-dep has nothing to install from; the root's copy in node_modules serves it.
+        expect(
+          fs.existsSync(join(String(dir), "node_modules", "dep-file-dep", "node_modules", "file-dep")),
+        ).toBeFalse();
+        const resolve = await run(
+          join(String(dir), "node_modules", "dep-file-dep"),
+          "-e",
+          `console.log(require("file-dep/package.json").name)`,
+        );
+        expect(resolve.stdout).toBe("file-dep\n");
+        expect(resolve.exitCode).toBe(0);
+      },
+    );
+  });
+
   test.concurrent("lockfileVersion 5 is refused, and install falls back to a fresh resolve", async () => {
     using dir = synthetic("npm-migrate-v5", {
       "package.json": JSON.stringify({ name: "v5", dependencies: { "dep-1": "file:dep-1" } }),

From a0c28d1f59c403226cbb31e06de2175847364ae9 Mon Sep 17 00:00:00 2001
From: robobun <117481402+robobun@users.noreply.github.com>
Date: Mon, 17 Aug 2026 01:05:06 +0000
Subject: [PATCH 021/258] install: fail the isolated install when a link:
 dependency's target is missing (#38045)

---
 src/install/isolated_install.rs           | 21 ++++++-
 test/cli/install/isolated-install.test.ts | 76 +++++++++++++++++++++++
 2 files changed, 96 insertions(+), 1 deletion(-)

diff --git a/src/install/isolated_install.rs b/src/install/isolated_install.rs
index 26f662acfc4c..71464543f8a2 100644
--- a/src/install/isolated_install.rs
+++ b/src/install/isolated_install.rs
@@ -2191,7 +2191,26 @@ pub(crate) fn install_isolated_packages(
                     // .monotonic is okay because the task isn't running on another thread.
                     entry_steps[entry_id.get() as usize]
                         .store(installer::Step::Done as u32, Ordering::Relaxed);
-                    installer.on_task_complete(entry_id, installer::CompleteState::Skipped);
+
+                    // Same target check as the hoisted linker's `install_from_link`.
+                    let mut link_target: AbsPath = AbsPath::init_top_level_dir();
+                    installer.append_store_path(&mut link_target, entry_id);
+                    match sys::openat(
+                        Fd::cwd(),
+                        link_target.slice_z(),
+                        sys::O::RDONLY | sys::O::DIRECTORY,
+                        0,
+                    ) {
+                        Ok(fd) => {
+                            use bun_sys::FdExt as _;
+                            fd.close();
+                            installer.on_task_complete(entry_id, installer::CompleteState::Skipped);
+                        }
+                        Err(err) => {
+                            installer
+                                .on_task_fail(entry_id, &installer::TaskError::LinkPackage(err));
+                        }
+                    }
                     continue;
                 }
                 ResolutionTag::Folder => {
diff --git a/test/cli/install/isolated-install.test.ts b/test/cli/install/isolated-install.test.ts
index 1e9a6aa5df67..97263adb6893 100644
--- a/test/cli/install/isolated-install.test.ts
+++ b/test/cli/install/isolated-install.test.ts
@@ -373,6 +373,82 @@ test("can install folder dependencies on root package", async () => {
   ]);
 });
 
+describe("link: dependencies", () => {
+  async function runBun(args: string[], cwd: string, env: NodeJS.Dict<string>) {
+    await using proc = spawn({
+      cmd: [bunExe(), ...args],
+      cwd,
+      env,
+      stdout: "pipe",
+      stderr: "pipe",
+    });
+    const [stdout, stderr, exitCode] = await Promise.all([proc.stdout.text(), proc.stderr.text(), proc.exited]);
+    return { stdout, stderr, exitCode };
+  }
+
+  // The lockfile records a `link:` dependency by name only, so the `bun link`
+  // registration behind that name can be gone by the time the lockfile is
+  // installed: `bun unlink` removes the global link dir entry, deleting the
+  // package leaves the entry dangling.
+  test.concurrent.each([
+    {
+      name: "linked-pkg",
+      gone: "the package was unlinked",
+      async remove(pkgDir: string, env: NodeJS.Dict<string>) {
+        const result = await runBun(["unlink"], pkgDir, env);
+        expect(result.stdout).toContain(`success: unlinked package "linked-pkg"`);
+        expect(result.exitCode).toBe(0);
+      },
+    },
+    {
+      name: "@scope/linked-pkg",
+      gone: "the linked directory was deleted",
+      async remove(pkgDir: string) {
+        await rm(pkgDir, { recursive: true, force: true });
+      },
+    },
+  ])("installing from the lockfile fails when $gone", async ({ name, remove }) => {
+    using dir = tempDir("isolated-link-target", {
+      "pkg/package.json": JSON.stringify({ name, version: "1.0.0" }),
+      "app/package.json": JSON.stringify({ name: "app", dependencies: { [name]: `link:${name}` } }),
+      "app/bunfig.toml": `[install]\nlinker = "isolated"\n`,
+    });
+    const pkgDir = join(String(dir), "pkg");
+    const appDir = join(String(dir), "app");
+    // `bun link` registers into $BUN_INSTALL/install/global; keep it private to this test.
+    const env = { ...bunEnv, BUN_INSTALL: join(String(dir), "bun-install") };
+
+    let result = await runBun(["link"], pkgDir, env);
+    expect(result.stdout).toContain(`Success! Registered "${name}"`);
+    expect(result.exitCode).toBe(0);
+
+    result = await runBun(["install"], appDir, env);
+    expect(result.stderr).toContain("Saved lockfile");
+    expect(result.exitCode).toBe(0);
+    expect(await file(join(appDir, "node_modules", name, "package.json")).json()).toEqual({ name, version: "1.0.0" });
+
+    await remove(pkgDir, env);
+
+    // Both reinstalling over the existing node_modules and installing into a
+    // fresh one (a clone with the lockfile checked in) must report the missing
+    // package and exit 1 instead of silently succeeding. As with every other
+    // failed entry, node_modules/<name> still points at the registration and
+    // resolves again once the package is re-linked.
+    result = await runBun(["install"], appDir, env);
+    expect(result.stderr).toContain("ENOENT");
+    expect(result.stderr).toContain(`failed to link package: ${name}@link:`);
+    expect(result.stdout).toContain("Failed to install 1 package");
+    expect(result.exitCode).toBe(1);
+
+    await rm(join(appDir, "node_modules"), { recursive: true, force: true });
+    result = await runBun(["install"], appDir, env);
+    expect(result.stderr).toContain("ENOENT");
+    expect(result.stderr).toContain(`failed to link package: ${name}@link:`);
+    expect(result.stdout).toContain("Failed to install 1 package");
+    expect(result.exitCode).toBe(1);
+  });
+});
+
 describe("isolated workspaces", () => {
   test("basic", async () => {
     const { packageJson, packageDir } = await registry.createTestDir({ bunfigOpts: { linker: "isolated" } });

From b1ebbec7a2fcc2cee30b84deae9f03852a73c4ce Mon Sep 17 00:00:00 2001
From: robobun <117481402+robobun@users.noreply.github.com>
Date: Mon, 17 Aug 2026 01:05:11 +0000
Subject: [PATCH 022/258] install: read the package.json of a file: dependency
 declared by a local file: package (#38814)

---
 .../PackageManager/PackageManagerEnqueue.rs   |  37 +--
 .../PackageManagerResolution.rs               |   9 +-
 src/install/lockfile.rs                       |  25 ++
 src/install/lockfile/Tree.rs                  |   9 +-
 src/install/resolution.rs                     |   7 +
 test/cli/install/bun-install-registry.test.ts |  91 +++++++
 test/cli/install/bun-install.test.ts          | 224 ++++++++++++++++--
 7 files changed, 355 insertions(+), 47 deletions(-)

diff --git a/src/install/PackageManager/PackageManagerEnqueue.rs b/src/install/PackageManager/PackageManagerEnqueue.rs
index f38b7acb3cde..79caa72f7e3a 100644
--- a/src/install/PackageManager/PackageManagerEnqueue.rs
+++ b/src/install/PackageManager/PackageManagerEnqueue.rs
@@ -2582,7 +2582,24 @@ fn get_or_put_resolved_package(
         dependency::version::Tag::Folder => {
             let folder = *version.folder();
             let res: FolderResolutionValue = 'res: {
-                if this.lockfile.is_workspace_dependency(dependency_id) {
+                if !this.lockfile.is_workspace_dependency(dependency_id)
+                    && crate::bin::bin_target_escapes_package_dir(this.lockfile.str(&folder))
+                {
+                    // overrides/resolutions are only ever parsed from the root
+                    // package.json, so a folder path that reached here via an
+                    // override was written by the user and is trusted the same
+                    // as a direct dependency of the root.
+                    let buf = this.lockfile.buffers.string_bytes.as_slice();
+                    if !this.lockfile.overrides.contains_name(
+                        dependency.name_hash,
+                        dependency.name.slice(buf),
+                        buf,
+                    ) {
+                        break 'res FolderResolutionValue::Err(crate::Error::MissingPackageJSON);
+                    }
+                }
+
+                if this.lockfile.is_dependency_of_local_package(dependency_id) {
                     // relative to cwd
                     // reshaped for borrowck — `folder_path` borrows
                     // `string_bytes`; detach the slice lifetime so the
@@ -2616,22 +2633,8 @@ fn get_or_put_resolved_package(
                     );
                 }
 
-                // transitive folder dependencies do not have their dependencies resolved
-                if crate::bin::bin_target_escapes_package_dir(this.lockfile.str(&folder)) {
-                    // overrides/resolutions are only ever parsed from the root
-                    // package.json, so a folder path that reached here via an
-                    // override was written by the user and is trusted the same
-                    // as a direct dependency of the root.
-                    let buf = this.lockfile.buffers.string_bytes.as_slice();
-                    if !this.lockfile.overrides.contains_name(
-                        dependency.name_hash,
-                        dependency.name.slice(buf),
-                        buf,
-                    ) {
-                        break 'res FolderResolutionValue::Err(crate::Error::MissingPackageJSON);
-                    }
-                }
-
+                // Declared by a registry package: `Package::from_npm` keeps the path
+                // relative to that package, which is not on disk until it is installed.
                 let mut package = Package::default();
 
                 {
diff --git a/src/install/PackageManager/PackageManagerResolution.rs b/src/install/PackageManager/PackageManagerResolution.rs
index 1f1b0b65edf0..dede07e3df35 100644
--- a/src/install/PackageManager/PackageManagerResolution.rs
+++ b/src/install/PackageManager/PackageManagerResolution.rs
@@ -330,11 +330,10 @@ impl PackageManager {
                     continue;
                 }
 
-                let features = match pkg_resolutions[parent_id].tag {
-                    ResolutionTag::Root | ResolutionTag::Workspace | ResolutionTag::Folder => {
-                        self.options.local_package_features
-                    }
-                    _ => self.options.remote_package_features,
+                let features = if pkg_resolutions[parent_id].tag.is_local_package() {
+                    self.options.local_package_features
+                } else {
+                    self.options.remote_package_features
                 };
                 // even if optional dependencies are enabled, it's still allowed to fail
                 if failed_dep.behavior.is_optional() || !failed_dep.behavior.is_enabled(features) {
diff --git a/src/install/lockfile.rs b/src/install/lockfile.rs
index 917c025518f9..bc95c237a84d 100644
--- a/src/install/lockfile.rs
+++ b/src/install/lockfile.rs
@@ -832,6 +832,31 @@ impl Lockfile {
         invalid_package_id
     }
 
+    /// The package whose dependency list contains `id`, or `invalid_package_id` when
+    /// no package declares it.
+    pub(crate) fn get_parent_pkg_of_dependency(&self, id: DependencyID) -> PackageID {
+        self.packages
+            .items_dependencies()
+            .iter()
+            .position(|dependencies| dependencies.contains(id))
+            .map_or(invalid_package_id, |pkg_id| {
+                PackageID::try_from(pkg_id).expect("int cast")
+            })
+    }
+
+    /// Is this a direct dependency of a local package (`resolution::Tag::is_local_package`)?
+    ///
+    /// A folder package declared by a registry package gets no dependency list (see the
+    /// Folder arm of `get_or_put_resolved_package`), so every folder package that
+    /// declares anything is reached from the root through local packages only.
+    pub(crate) fn is_dependency_of_local_package(&self, id: DependencyID) -> bool {
+        let parent_id = self.get_parent_pkg_of_dependency(id);
+        parent_id != invalid_package_id
+            && self.packages.items_resolution()[parent_id as usize]
+                .tag
+                .is_local_package()
+    }
+
     /// Does this tree id belong to a workspace (including workspace root)?
     /// TODO(dylan-conway) fix!
     pub(crate) fn is_workspace_tree_id(&self, id: tree::Id) -> bool {
diff --git a/src/install/lockfile/Tree.rs b/src/install/lockfile/Tree.rs
index 1a959cda7efa..84307e85cd52 100644
--- a/src/install/lockfile/Tree.rs
+++ b/src/install/lockfile/Tree.rs
@@ -620,11 +620,10 @@ pub(crate) fn is_filtered_dependency_or_workspace(
         return true;
     }
 
-    let dep_features = match parent_res.tag {
-        crate::resolution::Tag::Root
-        | crate::resolution::Tag::Workspace
-        | crate::resolution::Tag::Folder => manager.options.local_package_features,
-        _ => manager.options.remote_package_features,
+    let dep_features = if parent_res.tag.is_local_package() {
+        manager.options.local_package_features
+    } else {
+        manager.options.remote_package_features
     };
 
     if !dep.behavior.is_enabled(dep_features) {
diff --git a/src/install/resolution.rs b/src/install/resolution.rs
index d1e6fa7424e4..bd665fdd674c 100644
--- a/src/install/resolution.rs
+++ b/src/install/resolution.rs
@@ -1014,6 +1014,13 @@ impl Tag {
         self == Tag::Git || self == Tag::Github
     }
 
+    /// The root, a workspace, or a `file:` folder: a package.json of the project's own,
+    /// so its dependencies get `local_package_features` and `Package::parse` stored its
+    /// `file:` paths relative to the top-level dir.
+    pub(crate) fn is_local_package(self) -> bool {
+        self == Tag::Root || self == Tag::Workspace || self == Tag::Folder
+    }
+
     pub(crate) fn can_enqueue_install_task(self) -> bool {
         self == Tag::Npm
             || self == Tag::LocalTarball
diff --git a/test/cli/install/bun-install-registry.test.ts b/test/cli/install/bun-install-registry.test.ts
index dcf5c47fb38c..be638966e2f6 100644
--- a/test/cli/install/bun-install-registry.test.ts
+++ b/test/cli/install/bun-install-registry.test.ts
@@ -5286,6 +5286,97 @@ describe("transitive file dependencies", () => {
       version: "1.1.1",
     });
   });
+
+  // Unlike the registry packages above, whose file: targets only exist once the
+  // package is installed, a local file: package's own file: dependency is on
+  // disk while resolving, so it is read like one declared by the root.
+  for (const linker of ["hoisted", "isolated"] as const) {
+    test(`${linker}: a file: dependency of a local file: package is resolved like a root one`, async () => {
+      const { packageDir } = await registry.createTestDir({
+        bunfigOpts: { linker },
+        files: {
+          "package.json": JSON.stringify({
+            name: "foo",
+            dependencies: {
+              lib: "file:./vendor/lib",
+            },
+          }),
+          "vendor/lib/package.json": JSON.stringify({
+            name: "lib",
+            version: "1.0.0",
+            dependencies: {
+              tool: "file:../tool",
+            },
+          }),
+          "vendor/lib/index.js": `module.exports = "lib->" + require("tool");`,
+          "vendor/tool/package.json": JSON.stringify({
+            name: "tool",
+            version: "1.0.0",
+            bin: { tool: "cli.js" },
+            dependencies: {
+              "no-deps": "1.0.0",
+            },
+          }),
+          "vendor/tool/cli.js": `#!/usr/bin/env node\nconsole.log("tool");`,
+          "vendor/tool/index.js": `module.exports = "tool->no-deps@" + require("no-deps").version;`,
+        },
+      });
+      const libNodeModules =
+        linker === "hoisted"
+          ? join(packageDir, "node_modules", "lib", "node_modules")
+          : join(packageDir, "node_modules", ".bun", "lib@file+vendor+lib", "node_modules");
+
+      let { out } = await runBunInstall(env, packageDir);
+      expect(out).toContain("3 packages installed");
+
+      const lock = (await file(join(packageDir, "bun.lock")).text()).replaceAll(/localhost:\d+/g, "localhost:1234");
+      expect(normalizeBunSnapshot(lock)).toMatchInlineSnapshot(`
+        "{
+          "lockfileVersion": 2,
+          "configVersion": 1,
+          "workspaces": {
+            "": {
+              "name": "foo",
+              "dependencies": {
+                "lib": "file:./vendor/lib",
+              },
+            },
+          },
+          "packages": {
+            "lib": ["lib@file:vendor/lib", { "dependencies": { "tool": "file:../tool" } }],
+
+            "no-deps": ["no-deps@1.0.0", "http://localhost:1234/no-deps/-/no-deps-1.0.0.tgz", {}, "sha512-v4w12JRjUGvfHDUP8vFDwu0gUWu04j0cv9hLb1Abf9VdaXu4XcrddYFTMVBVvmldKViGWH7jrb6xPJRF0wq6gw=="],
+
+            "lib/tool": ["tool@file:vendor/tool", { "dependencies": { "no-deps": "1.0.0" }, "bin": { "tool": "cli.js" } }],
+          }
+        }"
+      `);
+
+      // Once from the package.json files, once from the lockfile they produced.
+      for (const frozenLockfile of [false, true]) {
+        if (frozenLockfile) {
+          await rm(join(packageDir, "node_modules"), { recursive: true, force: true });
+          ({ out } = await runBunInstall(env, packageDir, { frozenLockfile }));
+          expect(out).toContain("3 packages installed");
+        }
+
+        expect(await readdirSorted(join(libNodeModules, ".bin"))).toHaveBins(["tool"]);
+        expect(join(libNodeModules, ".bin", "tool")).toBeValidBin(join("..", "tool", "cli.js"));
+
+        await using proc = spawn({
+          cmd: [bunExe(), "-e", `console.log(require("lib"))`],
+          cwd: packageDir,
+          env,
+          stdout: "pipe",
+          stderr: "pipe",
+        });
+        const [runOut, runErr, runExit] = await Promise.all([proc.stdout.text(), proc.stderr.text(), proc.exited]);
+        expect(runErr).toBe("");
+        expect(runOut).toBe("lib->tool->no-deps@1.0.0\n");
+        expect(runExit).toBe(0);
+      }
+    });
+  }
 });
 
 test("name from manifest is scoped and url encoded", async () => {
diff --git a/test/cli/install/bun-install.test.ts b/test/cli/install/bun-install.test.ts
index 737ddfce3513..360a93010395 100644
--- a/test/cli/install/bun-install.test.ts
+++ b/test/cli/install/bun-install.test.ts
@@ -1,7 +1,7 @@
 import { file, listen, Socket, spawn, write } from "bun";
 import { afterAll, beforeAll, describe, expect, it, jest, setDefaultTimeout, test } from "bun:test";
 import { readFileSync, readlinkSync, realpathSync, statSync } from "fs";
-import { access, cp, exists, mkdir, readlink, rm, stat, writeFile } from "fs/promises";
+import { access, chmod, cp, exists, mkdir, readlink, rm, stat, writeFile } from "fs/promises";
 import {
   bunEnv,
   bunExe,
@@ -10492,7 +10492,7 @@ for (const field of ["resolutions", "overrides"]) {
         "packages": {
           "pkg-a": ["pkg-a@file:pkg-a", { "dependencies": { "shared": "1.0.0" } }],
 
-          "pkg-a/shared": ["shared@file:./vendor/shared", {}],
+          "pkg-a/shared": ["shared@file:vendor/shared", {}],
         }
       }"
     `);
@@ -10559,6 +10559,152 @@ it("installs the transitive file: dependency of a file: dependency", async () =>
   }
 });
 
+// Where each linker puts the `node_modules` of the two file: packages that have
+// dependencies. Folder packages are never hoisted, so `tool` lives under `lib`.
+// (bun-install-registry.test.ts covers requiring a registry dependency of such a
+// package at runtime.)
+for (const [linker, libNodeModules, toolNodeModules, toolNodeModulesEntries] of [
+  [
+    "hoisted",
+    join("node_modules", "lib", "node_modules"),
+    join("node_modules", "lib", "node_modules", "tool", "node_modules"),
+    [".bin", "dev-only", "helper"],
+  ],
+  [
+    "isolated",
+    join("node_modules", ".bun", "lib@file+vendor+lib", "node_modules"),
+    join("node_modules", ".bun", "tool@file+vendor+tool", "node_modules"),
+    // the isolated store also links a package's own bins into its own entry
+    [".bin", "dev-only", "helper", "tool"],
+  ],
+] as const) {
+  it.concurrent(`${linker}: nested file: dependencies are installed with their dependencies and bins`, async () => {
+    using dir = tempDir("nested-file-dep-bins", {
+      "package.json": JSON.stringify({
+        name: "my-app",
+        version: "1.0.0",
+        dependencies: {
+          lib: "file:./vendor/lib",
+        },
+      }),
+      "vendor/lib/package.json": JSON.stringify({
+        name: "lib",
+        version: "1.0.0",
+        dependencies: {
+          tool: "file:../tool",
+        },
+      }),
+      "vendor/tool/package.json": JSON.stringify({
+        name: "tool",
+        version: "1.0.0",
+        bin: { tool: "cli.js" },
+        dependencies: {
+          helper: "file:../helper",
+        },
+        devDependencies: {
+          "dev-only": "file:../dev-only",
+        },
+      }),
+      "vendor/tool/cli.js": "#!/bin/sh\necho tool\n",
+      "vendor/helper/package.json": JSON.stringify({
+        name: "helper",
+        version: "1.0.0",
+        bin: { helper: "cli.js" },
+      }),
+      "vendor/helper/cli.js": "#!/bin/sh\necho helper\n",
+      "vendor/dev-only/package.json": JSON.stringify({
+        name: "dev-only",
+        version: "1.0.0",
+      }),
+    });
+    const projectDir = String(dir);
+    const locks: string[] = [];
+
+    // The hoisted linker installs these packages as per-file symlinks and its bin
+    // chmod does not reach through them (#38777), so the scripts are made
+    // executable up front; what is checked below is that each .bin link runs
+    // the right script.
+    if (!isWindows) {
+      await chmod(join(projectDir, "vendor", "tool", "cli.js"), 0o755);
+      await chmod(join(projectDir, "vendor", "helper", "cli.js"), 0o755);
+    }
+
+    // The first pass resolves from the package.json files, the second installs
+    // what the first one recorded in bun.lock.
+    for (const args of [["install"], ["install", "--frozen-lockfile"]]) {
+      await rm(join(projectDir, "node_modules"), { recursive: true, force: true });
+
+      await using proc = spawn({
+        cmd: [bunExe(), ...args, `--linker=${linker}`],
+        cwd: projectDir,
+        stdout: "pipe",
+        stdin: "ignore",
+        stderr: "pipe",
+        env,
+      });
+      const [err, out, exitCode] = await Promise.all([proc.stderr.text(), proc.stdout.text(), proc.exited]);
+
+      expect(err).not.toContain("error:");
+      expect(out).toContain("4 packages installed");
+      expect(exitCode).toBe(0);
+
+      locks.push(await file(join(projectDir, "bun.lock")).text());
+
+      expect(await readdirSorted(join(projectDir, libNodeModules, ".bin"))).toHaveBins(["tool"]);
+      expect(join(projectDir, libNodeModules, ".bin", "tool")).toBeValidBin(join("..", "tool", "cli.js"));
+      expect(await readdirSorted(join(projectDir, toolNodeModules))).toEqual(toolNodeModulesEntries);
+      expect(join(projectDir, toolNodeModules, ".bin", "helper")).toBeValidBin(join("..", "helper", "cli.js"));
+
+      if (!isWindows) {
+        for (const [bin, expected] of [
+          [join(libNodeModules, ".bin", "tool"), "tool\n"],
+          [join(toolNodeModules, ".bin", "helper"), "helper\n"],
+        ]) {
+          await using binProc = spawn({
+            cmd: [join(projectDir, bin)],
+            cwd: projectDir,
+            stdout: "pipe",
+            stderr: "pipe",
+          });
+          const [binOut, binErr, binExit] = await Promise.all([
+            binProc.stdout.text(),
+            binProc.stderr.text(),
+            binProc.exited,
+          ]);
+          expect(binErr).toBe("");
+          expect(binOut).toBe(expected);
+          expect(binExit).toBe(0);
+        }
+      }
+    }
+
+    expect(locks[1]).toBe(locks[0]);
+    expect(normalizeBunSnapshot(locks[0], projectDir)).toMatchInlineSnapshot(`
+      "{
+        "lockfileVersion": 2,
+        "configVersion": 1,
+        "workspaces": {
+          "": {
+            "name": "my-app",
+            "dependencies": {
+              "lib": "file:./vendor/lib",
+            },
+          },
+        },
+        "packages": {
+          "lib": ["lib@file:vendor/lib", { "dependencies": { "tool": "file:../tool" } }],
+
+          "lib/tool": ["tool@file:vendor/tool", { "dependencies": { "helper": "file:../helper" }, "devDependencies": { "dev-only": "file:../dev-only" }, "bin": { "tool": "cli.js" } }],
+
+          "lib/tool/dev-only": ["dev-only@file:vendor/dev-only", {}],
+
+          "lib/tool/helper": ["helper@file:vendor/helper", { "bin": { "helper": "cli.js" } }],
+        }
+      }"
+    `);
+  });
+}
+
 const fileDepCycleFixture = {
   "package.json": JSON.stringify({
     name: "my-app",
@@ -10655,9 +10801,9 @@ it("installs file: dependencies that depend on each other", async () => {
 
         "b": ["b@file:packages/b", { "dependencies": { "a": "file:../a" } }],
 
-        "a/b": ["b@file:packages/b", {}],
+        "a/b": ["b@file:packages/b", { "dependencies": { "a": "file:../a" } }],
 
-        "b/a": ["a@file:packages/a", {}],
+        "b/a": ["a@file:packages/a", { "dependencies": { "b": "file:../b" } }],
       }
     }"
   `);
@@ -10706,33 +10852,71 @@ it("installs file: dependencies that depend on each other from a lockfile that o
   `);
 });
 
-it("fails when a transitive file: dependency's folder does not exist", async () => {
-  using dir = tempDir("transitive-file-dep-missing", {
-    "package.json": JSON.stringify({
-      name: "my-app",
-      version: "1.0.0",
-      dependencies: {
-        lib: "file:./vendor/lib",
+const missingTransitiveFileDepFixture = {
+  "package.json": JSON.stringify({
+    name: "my-app",
+    version: "1.0.0",
+    dependencies: {
+      lib: "file:./vendor/lib",
+    },
+  }),
+  "vendor/lib/package.json": JSON.stringify({
+    name: "lib",
+    version: "1.0.0",
+    dependencies: {
+      nested: "file:../nested",
+    },
+  }),
+  "vendor/lib/index.js": `module.exports = require("nested");`,
+};
+
+it.concurrent("fails to resolve when a transitive file: dependency's folder does not exist", async () => {
+  using dir = tempDir("transitive-file-dep-missing", missingTransitiveFileDepFixture);
+
+  await using proc = spawn({
+    cmd: [bunExe(), "install"],
+    cwd: String(dir),
+    stdout: "pipe",
+    stderr: "pipe",
+    env,
+  });
+  const [err, out, exitCode] = await Promise.all([proc.stderr.text(), proc.stdout.text(), proc.exited]);
+
+  // Same failure as a missing file: dependency of the root: the folder is read
+  // while resolving, so nothing is installed and no lockfile is written.
+  expect(normalizeBunSnapshot(err, String(dir))).toMatchInlineSnapshot(`
+    "error: Could not find package.json for "file:vendor/nested" dependency "nested"
+    error: nested@file:../nested failed to resolve"
+  `);
+  expect(out).not.toContain("packages installed");
+  expect(await exists(join(String(dir), "bun.lock"))).toBe(false);
+  expect(await exists(join(String(dir), "node_modules"))).toBe(false);
+  expect(exitCode).toBe(1);
+});
+
+it.concurrent("fails to install a lockfile's transitive file: dependency whose folder is missing", async () => {
+  using dir = tempDir("transitive-file-dep-missing-lock", {
+    ...missingTransitiveFileDepFixture,
+    "bun.lock": JSON.stringify({
+      lockfileVersion: 1,
+      workspaces: {
+        "": { name: "my-app", dependencies: { lib: "file:./vendor/lib" } },
       },
-    }),
-    "vendor/lib/package.json": JSON.stringify({
-      name: "lib",
-      version: "1.0.0",
-      dependencies: {
-        nested: "file:../nested",
+      packages: {
+        "lib": ["lib@file:vendor/lib", { dependencies: { nested: "file:../nested" } }],
+        "lib/nested": ["nested@file:vendor/nested", {}],
       },
     }),
-    "vendor/lib/index.js": `module.exports = require("nested");`,
   });
 
-  const { stdout, stderr, exited } = spawn({
+  await using proc = spawn({
     cmd: [bunExe(), "install"],
     cwd: String(dir),
     stdout: "pipe",
     stderr: "pipe",
     env,
   });
-  const [err, out, exitCode] = await Promise.all([stderr.text(), stdout.text(), exited]);
+  const [err, out, exitCode] = await Promise.all([proc.stderr.text(), proc.stdout.text(), proc.exited]);
 
   // The printed folder path uses the platform separator on Windows.
   expect(err.replaceAll(sep, "/")).toContain('Could not find folder "file:vendor/nested" for dependency "nested"');

From 66fd8c11bf5e77050ee765a8c26e06d318db4fd6 Mon Sep 17 00:00:00 2001
From: robobun <117481402+robobun@users.noreply.github.com>
Date: Mon, 17 Aug 2026 01:05:14 +0000
Subject: [PATCH 023/258] install: keep file: folder paths declared by git and
 tarball packages relative to the package (#38816)

---
 src/install/PackageInstaller.rs               |   6 +-
 src/install/lockfile.rs                       |   5 +-
 src/install/lockfile/Package.rs               |   5 +-
 src/install_types/resolver_hooks.rs           |   4 +
 test/cli/install/bun-install-git-deps.test.ts | 177 ++++++++++++++++--
 5 files changed, 179 insertions(+), 18 deletions(-)

diff --git a/src/install/PackageInstaller.rs b/src/install/PackageInstaller.rs
index 6c96867f593b..994f4ec17c65 100644
--- a/src/install/PackageInstaller.rs
+++ b/src/install/PackageInstaller.rs
@@ -1847,9 +1847,9 @@ impl<'a> PackageInstaller<'a> {
                             );
                         }
 
-                        // One declared by an npm manifest (`Package::from_npm`) is verbatim,
-                        // i.e. relative to the declaring package, which installs at
-                        // `dirname(node_modules.path)` because transitive folders never hoist.
+                        // One declared by a cache package (`from_npm`, `Features::NPM`) is
+                        // relative to that package, which installs at `dirname(node_modules.path)`
+                        // because transitive folders never hoist.
                         let dir_name = {
                             let d = dirname::<platform::Auto>(self.node_modules.path.as_slice());
                             if d.is_empty() {
diff --git a/src/install/lockfile.rs b/src/install/lockfile.rs
index bc95c237a84d..71018aac06a9 100644
--- a/src/install/lockfile.rs
+++ b/src/install/lockfile.rs
@@ -866,9 +866,8 @@ impl Lockfile {
                 .is_workspace()
     }
 
-    /// Is the package whose `node_modules` this tree represents resolved from a
-    /// local `file:` folder? Its `Resolution::Folder` dependencies were normalized
-    /// relative to the top-level dir (`Package::parse`), unlike npm's (`Package::from_npm`).
+    /// Is the package whose `node_modules` this tree represents a local `file:` folder? Its
+    /// folder dependencies are top-level-dir relative; a cache package's are package-relative.
     pub(crate) fn is_folder_tree_id(&self, id: tree::Id) -> bool {
         if id == 0 {
             return false;
diff --git a/src/install/lockfile/Package.rs b/src/install/lockfile/Package.rs
index 0b4ed4b1ca4a..e175f2c58f9e 100644
--- a/src/install/lockfile/Package.rs
+++ b/src/install/lockfile/Package.rs
@@ -1881,7 +1881,10 @@ impl Package<u64> {
         }
 
         match dependency_version.tag {
-            dependency::version::Tag::Folder => {
+            // Cache packages (`Features::NPM`) keep these package-relative, like `from_npm`.
+            dependency::version::Tag::Folder
+                if features.is_main || features.is_workspace || features.is_folder =>
+            {
                 let folder = *dependency_version.folder();
                 let mut folder_buf = PathBuffer::uninit();
                 let Some(joined) = resolve_path::join_abs_string_buf_checked::<path::platform::Auto>(
diff --git a/src/install_types/resolver_hooks.rs b/src/install_types/resolver_hooks.rs
index 902921588134..2878b87bd28c 100644
--- a/src/install_types/resolver_hooks.rs
+++ b/src/install_types/resolver_hooks.rs
@@ -1204,6 +1204,7 @@ pub struct Features {
     pub dev_dependencies: bool,
     pub is_main: bool,
     pub is_workspace: bool,
+    pub is_folder: bool,
     pub optional_dependencies: bool,
     pub peer_dependencies: bool,
     pub trusted_dependencies: bool,
@@ -1218,6 +1219,7 @@ impl Default for Features {
             dev_dependencies: false,
             is_main: false,
             is_workspace: false,
+            is_folder: false,
             optional_dependencies: false,
             peer_dependencies: true,
             trusted_dependencies: false,
@@ -1240,6 +1242,7 @@ impl Features {
             dev_dependencies: false,
             is_main: false,
             is_workspace: false,
+            is_folder: false,
             optional_dependencies: false,
             peer_dependencies: true,
             trusted_dependencies: false,
@@ -1262,6 +1265,7 @@ impl Features {
 
     pub const FOLDER: Self = Self {
         dev_dependencies: true,
+        is_folder: true,
         optional_dependencies: true,
         ..Self::base()
     };
diff --git a/test/cli/install/bun-install-git-deps.test.ts b/test/cli/install/bun-install-git-deps.test.ts
index 76997319f218..e68d82e08421 100644
--- a/test/cli/install/bun-install-git-deps.test.ts
+++ b/test/cli/install/bun-install-git-deps.test.ts
@@ -1,13 +1,15 @@
 // Tests for installing git dependencies that live in ONE repository as
-// multiple branches (issue #35420), `git+file://` dependencies, and
+// multiple branches (issue #35420), `git+file://` dependencies,
 // tarball-URL / `github:` dependencies that appear both directly and
-// transitively (issues #10915, #8501, #11348, #28284). Everything is local:
-// a bare repo on disk (served over git's dumb HTTP protocol by Bun.serve
-// when an http URL is needed) or static tarballs.
+// transitively (issues #10915, #8501, #11348, #28284), and git / tarball
+// packages whose own package.json declares `file:` folder dependencies.
+// Everything is local: a bare repo on disk (served over git's dumb HTTP
+// protocol by Bun.serve when an http URL is needed) or static tarballs.
 import { expect, test } from "bun:test";
-import { mkdirSync, writeFileSync } from "fs";
+import { mkdirSync, rmSync, writeFileSync } from "fs";
+import { lstat, readdir, readlink } from "fs/promises";
 import { bunEnv, bunExe, tempDir } from "harness";
-import { join } from "path";
+import { dirname, join, resolve } from "path";
 import { pathToFileURL } from "url";
 
 const gitEnv = {
@@ -35,6 +37,8 @@ interface BranchPackage {
   name: string;
   branch: string;
   dependencies?: Record<string, string>;
+  /** Files committed next to package.json; an `index.js` entry replaces the default one. */
+  files?: Record<string, string>;
 }
 
 // Creates `<root>/shared-repo.git`, a bare repo with one orphan branch per
@@ -47,14 +51,21 @@ async function makeSharedRepo(root: string, packages: BranchPackage[]): Promise<
   await git(work, "init", "-q");
   for (const pkg of packages) {
     await git(work, "checkout", "-q", "--orphan", pkg.branch);
-    writeFileSync(
-      join(work, "package.json"),
-      JSON.stringify({ name: pkg.name, version: "1.0.0", dependencies: pkg.dependencies }, null, 2),
-    );
-    writeFileSync(join(work, "index.js"), `module.exports = ${JSON.stringify(pkg.branch)};\n`);
+    const files: Record<string, string> = {
+      "package.json": JSON.stringify({ name: pkg.name, version: "1.0.0", dependencies: pkg.dependencies }, null, 2),
+      "index.js": `module.exports = ${JSON.stringify(pkg.branch)};\n`,
+      ...pkg.files,
+    };
+    for (const [path, contents] of Object.entries(files)) {
+      mkdirSync(dirname(join(work, path)), { recursive: true });
+      writeFileSync(join(work, path), contents);
+    }
     await git(work, "add", "-A");
     await git(work, "commit", "-q", "-m", pkg.branch, "--no-gpg-sign");
     await git(work, "push", "-q", bare, pkg.branch);
+    // `checkout --orphan` keeps the working tree, so the next branch would
+    // otherwise inherit this one's files.
+    for (const path of Object.keys(files)) rmSync(join(work, path), { force: true });
   }
   // dumb HTTP clients read the static files this generates
   await git(bare, "update-server-info");
@@ -423,3 +434,147 @@ test.concurrent("installs a git+file:// dependency", async () => {
   expect(await installedVersionOf(project, "@scope/pkg-b")).toBe("pkg-b");
   expect(exitCode).toBe(0);
 });
+
+// `file:` folder dependencies declared by a git or tarball package are relative
+// to that package, like a registry package's (registry/packages/file-dep). They
+// used to be resolved against the project dir, which pointed them into the cache
+// and failed the install with `sub@file:./sub failed to resolve`.
+const FILE_DEPS_NAME = "has-file-deps";
+
+// `file:` folder dependencies on a subfolder, on the package itself, and on a
+// folder that is not part of the package.
+const fileDepsManifest = {
+  name: FILE_DEPS_NAME,
+  version: "1.0.0",
+  dependencies: {
+    "sub": "file:./sub",
+    [`${FILE_DEPS_NAME}-self`]: "file:.",
+    "gone": "file:./not-in-package",
+  },
+};
+
+const fileDepsFiles = {
+  "index.js": `module.exports = require("sub");\n`,
+  "sub/package.json": JSON.stringify({ name: "sub", version: "1.0.0" }),
+  "sub/index.js": `module.exports = "sub-ok";\n`,
+};
+
+// Writes `<root>/work/package/` and packs it into `tarball`, a `.tgz` path.
+async function packTarball(root: string, tarball: string, manifest: object, files: Record<string, string>) {
+  const pkgDir = join(root, "work", "package");
+  for (const [path, contents] of Object.entries({ "package.json": JSON.stringify(manifest), ...files })) {
+    mkdirSync(dirname(join(pkgDir, path)), { recursive: true });
+    writeFileSync(join(pkgDir, path), contents);
+  }
+  mkdirSync(dirname(tarball), { recursive: true });
+  await run(root, ["tar", "-czf", tarball, "-C", join(root, "work"), "package"], "tar");
+}
+
+function writeProject(root: string, dependencies: Record<string, string>): string {
+  const project = join(root, "project");
+  mkdirSync(project, { recursive: true });
+  writeFileSync(join(project, "package.json"), JSON.stringify({ name: "project", version: "1.0.0", dependencies }));
+  return project;
+}
+
+async function linkedJson(link: string) {
+  expect((await lstat(link)).isSymbolicLink()).toBe(true);
+  return Bun.file(resolve(dirname(link), await readlink(link))).json();
+}
+
+async function expectFileDepsInstalled(project: string) {
+  const name = FILE_DEPS_NAME;
+  const nested = join(project, "node_modules", name, "node_modules");
+  const lockfile = await Bun.file(join(project, "bun.lock")).text();
+  expect(lockfile).toContain(`"${name}/sub": ["sub@file:./sub", {}]`);
+  expect(lockfile).toContain(`"${name}/${name}-self": ["${name}-self@file:.", {}]`);
+  expect(lockfile).toContain(`"${name}/gone": ["gone@file:./not-in-package", {}]`);
+
+  // Transitive folder dependencies are not hoisted: each one is linked file by
+  // file into the declaring package's own node_modules, relative to that
+  // package. The folder missing from the package is skipped, as it is for a
+  // registry package.
+  expect((await readdir(nested)).sort()).toEqual([`${name}-self`, "sub"]);
+  expect(await linkedJson(join(nested, "sub", "package.json"))).toEqual({ name: "sub", version: "1.0.0" });
+  expect(await linkedJson(join(nested, `${name}-self`, "package.json"))).toEqual(fileDepsManifest);
+
+  await using proc = Bun.spawn({
+    cmd: [bunExe(), "-e", `console.log(require(${JSON.stringify(name)}))`],
+    cwd: project,
+    env: bunEnv,
+    stdout: "pipe",
+    stderr: "pipe",
+  });
+  const [stdout, stderr, exitCode] = await Promise.all([proc.stdout.text(), proc.stderr.text(), proc.exited]);
+  expect({ stdout, stderr, exitCode }).toEqual({ stdout: "sub-ok\n", stderr: "", exitCode: 0 });
+}
+
+for (const spec of ["file: path", "http url"] as const) {
+  test.concurrent(`installs the file: folder dependencies declared by a tarball package (${spec})`, async () => {
+    using dir = tempDir("tarball-file-deps", {});
+    const root = String(dir);
+    const tarballs = join(root, "tarballs");
+    await packTarball(root, join(tarballs, `${FILE_DEPS_NAME}.tgz`), fileDepsManifest, fileDepsFiles);
+    await using server = serveStatic(tarballs);
+    const project = writeProject(root, {
+      [FILE_DEPS_NAME]:
+        spec === "file: path"
+          ? `file:../tarballs/${FILE_DEPS_NAME}.tgz`
+          : `http://localhost:${server.port}/${FILE_DEPS_NAME}.tgz`,
+    });
+
+    const { stderr, exitCode } = await runInstall(project, join(root, "cache"), {});
+    expect(stderr).not.toContain("error:");
+    expect(exitCode).toBe(0);
+    await expectFileDepsInstalled(project);
+
+    // The stub rows written to bun.lock install again without re-resolving.
+    rmSync(join(project, "node_modules"), { recursive: true });
+    const frozen = await runInstall(project, join(root, "cache"), {}, "--frozen-lockfile");
+    expect(frozen.stderr).not.toContain("error:");
+    expect(frozen.exitCode).toBe(0);
+    await expectFileDepsInstalled(project);
+  });
+}
+
+test.concurrent(
+  "installs the file: folder dependencies declared by a git dependency",
+  async () => {
+    using dir = tempDir("git-dep-file-deps", {});
+    const root = String(dir);
+    const bare = await makeSharedRepo(root, [
+      { name: FILE_DEPS_NAME, branch: "main", dependencies: fileDepsManifest.dependencies, files: fileDepsFiles },
+    ]);
+    const project = writeProject(root, { [FILE_DEPS_NAME]: `git+${pathToFileURL(bare)}#main` });
+
+    const { stderr, exitCode } = await runInstall(project, join(root, "cache"), {});
+    expect(stderr).not.toContain("error:");
+    expect(exitCode).toBe(0);
+    await expectFileDepsInstalled(project);
+  },
+  30_000,
+);
+
+test.concurrent("rejects a file: folder dependency of a tarball package that points outside of it", async () => {
+  using dir = tempDir("tarball-escaping-file-dep", {
+    "outside/package.json": JSON.stringify({ name: "outside", version: "1.0.0" }),
+  });
+  const root = String(dir);
+  const tarball = join(root, "tarballs", "escaping.tgz");
+  await packTarball(
+    root,
+    tarball,
+    { name: "escaping", version: "1.0.0", dependencies: { outside: "file:../outside" } },
+    {},
+  );
+  const project = writeProject(root, { escaping: `file:../tarballs/escaping.tgz` });
+
+  const { stderr, exitCode } = await runInstall(project, join(root, "cache"), {});
+  expect(stderr).toContain('error: Could not find package.json for "file:../outside" dependency "outside"');
+  expect(stderr).toContain("error: outside@file:../outside failed to resolve");
+  expect(await Bun.file(join(project, "node_modules", "outside", "package.json")).exists()).toBe(false);
+  expect(
+    await Bun.file(join(project, "node_modules", "escaping", "node_modules", "outside", "package.json")).exists(),
+  ).toBe(false);
+  expect(exitCode).toBe(1);
+});

From ceec1c9de666f3e27271e5045589d2a29655f29f Mon Sep 17 00:00:00 2001
From: robobun <117481402+robobun@users.noreply.github.com>
Date: Mon, 17 Aug 2026 01:05:20 +0000
Subject: [PATCH 024/258] install: drop the query string and fragment from a
 tarball URL's extraction folder name (#39011)

---
 src/install/extract_tarball.rs   |  39 +++++++----
 test/cli/install/bun-add.test.ts | 113 +++++++++++++++++++++++++++++++
 2 files changed, 138 insertions(+), 14 deletions(-)

diff --git a/src/install/extract_tarball.rs b/src/install/extract_tarball.rs
index b8d3a8b091b5..e3cec500e2ed 100644
--- a/src/install/extract_tarball.rs
+++ b/src/install/extract_tarball.rs
@@ -198,30 +198,41 @@ impl ExtractTarball {
             debug_assert!(false);
             b"unnamed-package"
         };
-        let basename: &[u8] = 'brk: {
-            let mut tmp = name;
-            if strings::has_prefix(tmp, b"https://") || strings::has_prefix(tmp, b"http://") {
+        let basename: &[u8] =
+            if strings::has_prefix(name, b"https://") || strings::has_prefix(name, b"http://") {
+                // A URL name is the placeholder `bun add <url>` uses until package.json is read.
+                let mut tmp = name;
+                if let Some(i) = strings::index_of_any(tmp, b"?#") {
+                    tmp = &tmp[0..i];
+                }
                 tmp = bun_paths::basename(tmp);
                 if strings::ends_with(tmp, b".tgz") {
                     tmp = &tmp[0..tmp.len() - 4];
                 } else if strings::ends_with(tmp, b".tar.gz") {
                     tmp = &tmp[0..tmp.len() - 7];
                 }
-            } else if tmp[0] == b'@' {
-                if let Some(i) = strings::index_of_char(tmp, b'/') {
-                    tmp = &tmp[i as usize + 1..];
+                if bun_install::dependency::is_safe_install_folder_name(tmp) {
+                    tmp
+                } else {
+                    b"package"
+                }
+            } else {
+                let mut tmp = name;
+                if tmp[0] == b'@' {
+                    if let Some(i) = strings::index_of_char(tmp, b'/') {
+                        tmp = &tmp[i as usize + 1..];
+                    }
                 }
-            }
 
-            #[cfg(windows)]
-            {
-                if let Some(i) = strings::last_index_of_char(tmp, b':') {
-                    tmp = &tmp[i + 1..];
+                #[cfg(windows)]
+                {
+                    if let Some(i) = strings::last_index_of_char(tmp, b':') {
+                        tmp = &tmp[i + 1..];
+                    }
                 }
-            }
 
-            break 'brk tmp;
-        };
+                tmp
+            };
         (name, basename)
     }
 
diff --git a/test/cli/install/bun-add.test.ts b/test/cli/install/bun-add.test.ts
index 423a7fbb8e4a..a399f6b8f6d5 100644
--- a/test/cli/install/bun-add.test.ts
+++ b/test/cli/install/bun-add.test.ts
@@ -1,8 +1,11 @@
 import type { BunLockFile } from "bun";
 import { file, spawn } from "bun";
 import { afterAll, afterEach, beforeAll, beforeEach, describe, expect, it, setDefaultTimeout, test } from "bun:test";
+import { randomBytes } from "crypto";
 import { access, appendFile, copyFile, mkdir, readlink, rm, writeFile } from "fs/promises";
 import { bunExe, bunEnv as env, readdirSorted, tmpdirSync, toBeValidBin, toBeWorkspaceLink, toHaveBins } from "harness";
+import { createServer } from "http";
+import type { AddressInfo } from "net";
 import { join, relative, resolve } from "path";
 import {
   check_npm_auth_type,
@@ -2665,6 +2668,116 @@ it("should not add duplicate package.json entries when installing the same tarba
   });
 });
 
+// `bun add <url>` names the dependency after the URL until the tarball's package.json has been read,
+// and the URL's basename labels the directory the tarball is extracted into. The query string and
+// fragment used to end up in that label: `?` cannot appear in a directory name on Windows, and a `:`
+// within the first 32 bytes of the label (it is truncated to that) fails the install folder name
+// check on every platform with "Refusing to install package with invalid name". A URL without a path
+// has nothing usable left once the query is gone (its basename is the `host:port`), so the label
+// falls back to "package" instead.
+describe("should add a tarball URL with a query string or fragment", () => {
+  const paths = [
+    ["query string", "/qs-pkg-1.0.0.tgz?token=abc"],
+    ["query string containing a colon", "/qs-pkg-1.0.0.tgz?expires=12:00"],
+    ["fragment containing a colon", "/qs-pkg-1.0.0.tgz#ref:main"],
+    ["query string on a URL without a path", "/?file=qs-pkg-1.0.0.tgz"],
+  ] as const;
+
+  let tarball: Uint8Array;
+  beforeAll(async () => {
+    tarball = await new Bun.Archive(
+      {
+        "package/package.json": JSON.stringify({ name: "qs-pkg", version: "1.0.0" }),
+        // Incompressible padding so the drip-fed response below arrives in many socket reads, which
+        // is what commits the install to the streaming extractor.
+        "package/pad.bin": randomBytes(256 * 1024),
+      },
+      { compress: "gzip" },
+    ).bytes();
+  });
+
+  // The tarball is extracted either from the fully buffered response body or, when the body is
+  // large enough and arrives in several reads, by the streaming extractor; both pick the extraction
+  // directory name the same way.
+  async function serveTarball(mode: "buffered" | "streaming") {
+    if (mode === "buffered") {
+      const server = Bun.serve({
+        port: 0,
+        fetch: () => new Response(tarball),
+      });
+      return {
+        origin: server.url.origin,
+        [Symbol.asyncDispose]: () => server.stop(true),
+      };
+    }
+
+    // node:http so the response carries a Content-Length and can still be written 1 KiB at a time.
+    const server = createServer((req, res) => {
+      res.setHeader("Content-Type", "application/gzip");
+      res.setHeader("Content-Length", String(tarball.length));
+      req.socket.setNoDelay(true);
+      let offset = 0;
+      const step = () => {
+        if (offset >= tarball.length) {
+          res.end();
+          return;
+        }
+        res.write(tarball.subarray(offset, offset + 1024));
+        offset += 1024;
+        setImmediate(step);
+      };
+      step();
+    });
+    await new Promise<void>(resolve => server.listen(0, "127.0.0.1", resolve));
+    const { port } = server.address() as AddressInfo;
+    return {
+      origin: `http://127.0.0.1:${port}`,
+      [Symbol.asyncDispose]: () => {
+        server.closeAllConnections();
+        return new Promise<void>(resolve => server.close(() => resolve()));
+      },
+    };
+  }
+
+  describe.each(["buffered", "streaming"] as const)("%s extraction", mode => {
+    test.each(paths)("%s", async (_, path) => {
+      await using server = await serveTarball(mode);
+      const url = `${server.origin}${path}`;
+      await writeFile(join(package_dir, "package.json"), JSON.stringify({ name: "foo", version: "0.0.1" }));
+
+      const { stdout, stderr, exited } = spawn({
+        cmd: [bunExe(), "add", url, "--verbose"],
+        cwd: package_dir,
+        stdout: "pipe",
+        stdin: "pipe",
+        stderr: "pipe",
+        env: mode === "streaming" ? { ...env, BUN_INSTALL_STREAMING_MIN_SIZE: "1024" } : env,
+      });
+      const [out, err, exitCode] = await Promise.all([stdout.text(), stderr.text(), exited]);
+      expect(err).not.toContain("error:");
+      // Printed by the streaming extractor only, so each mode is known to have taken its own path.
+      if (mode === "streaming") {
+        expect(err).toContain("Streamed ");
+      } else {
+        expect(err).not.toContain("Streamed ");
+      }
+      expect(out).toContain(`+ qs-pkg@${url}`);
+      expect(exitCode).toBe(0);
+      expect(await file(join(package_dir, "package.json")).json()).toStrictEqual({
+        name: "foo",
+        version: "0.0.1",
+        dependencies: {
+          "qs-pkg": url,
+        },
+      });
+      expect(await file(join(package_dir, "node_modules", "qs-pkg", "package.json")).json()).toEqual({
+        name: "qs-pkg",
+        version: "1.0.0",
+      });
+    });
+  });
+});
+
 it("should add multiple dependencies specified on command line", async () => {
   expect(check_npm_auth_type.check).toBe(true);
   using server = Bun.serve({

From f5dc5bc7027193991cd9f82004a336531da0fa2a Mon Sep 17 00:00:00 2001
From: robobun <117481402+robobun@users.noreply.github.com>
Date: Mon, 17 Aug 2026 01:05:24 +0000
Subject: [PATCH 025/258] install: cache file: tarballs under the integrity the
 lockfile pins (#39016)

---
 src/install/PackageInstall.rs                 |   5 +
 src/install/PackageInstaller.rs               |   8 +-
 src/install/PackageManager.rs                 |   3 +-
 .../PackageManagerDirectories.rs              |  66 ++++++++-
 .../PackageManager/PackageManagerLifecycle.rs |   5 +-
 src/install/PackageManager/patchPackage.rs    |  13 +-
 src/install/PackageManager/runTasks.rs        |  14 +-
 src/install/TarballStream.rs                  |  16 +--
 src/install/extract_tarball.rs                |  64 +++++----
 src/install/integrity.rs                      |  23 +++-
 src/install/isolated_install.rs               |  54 ++++----
 src/install/isolated_install/Installer.rs     |  63 ++++++++-
 src/install/patch_install.rs                  |   4 +-
 .../bun-install-tarball-integrity.test.ts     | 126 ++++++++++++++++++
 14 files changed, 374 insertions(+), 90 deletions(-)

diff --git a/src/install/PackageInstall.rs b/src/install/PackageInstall.rs
index 6adf994d1ad9..0e890e476c6c 100644
--- a/src/install/PackageInstall.rs
+++ b/src/install/PackageInstall.rs
@@ -2248,6 +2248,11 @@ impl<'a> PackageInstall<'a> {
         package_id: PackageID,
         resolution_tag: resolution::Tag,
     ) -> bool {
+        // No entry can be named yet (a local tarball whose integrity the
+        // lockfile does not record); extracting it is what names one.
+        if self.cache_dir_subpath.is_empty() {
+            return true;
+        }
         let state = manager.get_preinstall_state(package_id);
         match state {
             crate::PreinstallState::Done => false,
diff --git a/src/install/PackageInstaller.rs b/src/install/PackageInstaller.rs
index 994f4ec17c65..d634d960b960 100644
--- a/src/install/PackageInstaller.rs
+++ b/src/install/PackageInstaller.rs
@@ -1117,7 +1117,8 @@ impl<'a> PackageInstaller<'a> {
 
         // If a newly computed integrity hash is available (e.g. for a GitHub
         // tarball) and the lockfile doesn't already have one, persist it so
-        // the lockfile gets re-saved with the hash.
+        // the lockfile gets re-saved with the hash. Must happen before the
+        // callbacks below: a local tarball's cache entry is named after it.
         if data.integrity.tag.is_supported() {
             let pkg_metas = self.lockfile_mut().packages.items_meta_mut();
             if !pkg_metas[package_id as usize].integrity.tag.is_supported() {
@@ -1523,9 +1524,8 @@ impl<'a> PackageInstaller<'a> {
                 }
             }
             resolution::Tag::LocalTarball => {
-                installer.cache_dir_subpath = package_manager::cached_tarball_folder_name(
-                    self.manager_mut(),
-                    *resolution.local_tarball(),
+                installer.cache_dir_subpath = package_manager::cached_local_tarball_folder_name(
+                    &self.metas[package_id as usize].integrity,
                     patch_contents_hash,
                 );
                 installer.cache_dir = package_manager::get_cache_directory(self.manager_mut());
diff --git a/src/install/PackageManager.rs b/src/install/PackageManager.rs
index 39599591b2ec..1379fe74aec3 100644
--- a/src/install/PackageManager.rs
+++ b/src/install/PackageManager.rs
@@ -203,7 +203,8 @@ use directories::attempt_to_create_package_json_and_open;
 pub use directories::{
     attempt_to_create_package_json, cached_git_folder_name, cached_git_folder_name_print,
     cached_git_folder_name_print_auto, cached_github_folder_name, cached_github_folder_name_print,
-    cached_github_folder_name_print_auto, cached_npm_package_folder_name,
+    cached_github_folder_name_print_auto, cached_local_tarball_folder_name,
+    cached_local_tarball_folder_name_print, cached_npm_package_folder_name,
     cached_npm_package_folder_name_print, cached_npm_package_folder_print_basename,
     cached_tarball_folder_name, cached_tarball_folder_name_print, compute_cache_dir_and_subpath,
     fetch_cache_directory_path, get_cache_directory, get_cache_directory_and_abs_path,
diff --git a/src/install/PackageManager/PackageManagerDirectories.rs b/src/install/PackageManager/PackageManagerDirectories.rs
index 4861484c4b21..8b4c09be09ca 100644
--- a/src/install/PackageManager/PackageManagerDirectories.rs
+++ b/src/install/PackageManager/PackageManagerDirectories.rs
@@ -11,7 +11,7 @@ use bun_core::{Global, Output, ZBox, env_var, fmt as bun_fmt};
 use bun_dotenv::Loader as DotEnvLoader;
 use bun_install::lockfile::{Format as LockfileFormat, LoadResult, Lockfile};
 use bun_install::resolution::Tag as ResolutionTag;
-use bun_install::{PackageID, Resolution};
+use bun_install::{Integrity, PackageID, Resolution};
 use bun_paths::{self as path, AbsPath, PathBuffer, SEP};
 use bun_semver::{self as Semver, String as SemverString};
 #[cfg(windows)]
@@ -487,6 +487,14 @@ impl<'a> ByteCursor<'a> {
         self.put(bun_fmt::u64_hex_var_lower(&mut tmp, n));
     }
 
+    /// Two lower-hex digits per byte.
+    #[inline(always)]
+    fn put_hex_bytes(&mut self, bytes: &[u8]) {
+        let end = self.at + bytes.len() * 2;
+        bun_fmt::bytes_to_hex_lower(bytes, &mut self.buf[self.at..end]);
+        self.at = end;
+    }
+
     /// `@@@{d}` when set.
     #[inline(always)]
     fn put_cache_version(&mut self, v: Option<usize>) {
@@ -725,6 +733,8 @@ pub fn cached_npm_package_folder_print_basename<'a>(
     w.finish_z()
 }
 
+/// `@T@<hash of the URL>@@@1`, for URL tarballs. `file:` tarballs use
+/// `cached_local_tarball_folder_name_print`.
 pub fn cached_tarball_folder_name_print<'a>(
     buf: &'a mut [u8],
     url: &[u8],
@@ -750,6 +760,43 @@ pub fn cached_tarball_folder_name(
     )
 }
 
+/// `@T@sha512-<first 16 digest bytes as hex>@@@1`.
+///
+/// A `file:` tarball's resolution is the path as written in package.json
+/// (`pkg.tgz`), which names a different tarball in every project sharing the
+/// cache, so unlike a URL tarball it is cached under the integrity bun.lock
+/// pins for it: the entry is only reused for the bytes it was extracted from.
+///
+/// Empty when the integrity is not known yet (lockfile written before tarball
+/// integrity was recorded). Callers treat that like a cache miss: extracting the
+/// tarball computes the integrity, and the install callbacks record it in the
+/// lockfile before installing from the entry named after it.
+pub fn cached_local_tarball_folder_name_print<'a>(
+    buf: &'a mut [u8],
+    integrity: &Integrity,
+    patch_hash: Option<u64>,
+) -> &'a ZStr {
+    let Some(algorithm) = integrity.tag.name() else {
+        return ZStr::EMPTY;
+    };
+    let digest = integrity.slice();
+    let mut w = ByteCursor::new(buf);
+    w.put(b"@T@");
+    w.put(algorithm.as_bytes());
+    w.put_byte(b'-');
+    w.put_hex_bytes(&digest[..digest.len().min(16)]);
+    w.put_cache_version(Some(CacheVersion::CURRENT));
+    w.put_patch_hash(patch_hash);
+    w.finish_z()
+}
+
+pub fn cached_local_tarball_folder_name(
+    integrity: &Integrity,
+    patch_hash: Option<u64>,
+) -> &'static ZStr {
+    cached_local_tarball_folder_name_print(cached_package_folder_name_buf(), integrity, patch_hash)
+}
+
 pub fn is_folder_in_cache(this: &mut PackageManager, folder_path: &ZStr) -> bool {
     sys::directory_exists_at(get_cache_directory(this), folder_path).unwrap_or(false)
 }
@@ -947,6 +994,7 @@ pub fn compute_cache_dir_and_subpath<'a>(
     manager: &mut PackageManager,
     pkg_name: &[u8],
     resolution: &Resolution,
+    integrity: &Integrity,
     folder_path_buf: &'a mut PathBuffer,
     patch_hash: Option<u64>,
 ) -> CacheDirAndSubpath<'a> {
@@ -986,8 +1034,20 @@ pub fn compute_cache_dir_and_subpath<'a>(
             cache_dir = Fd::cwd();
         }
         ResolutionTag::LocalTarball => {
-            let tarball = *resolution.local_tarball();
-            cache_dir_subpath = cached_tarball_folder_name(manager, tarball, patch_hash);
+            cache_dir_subpath = cached_local_tarball_folder_name(integrity, patch_hash);
+            if cache_dir_subpath.is_empty() {
+                Output::err_generic(
+                    "the lockfile does not record an integrity for <b>{}@{}<r>, run <cyan>bun install<r> first",
+                    (
+                        bun_fmt::s(name),
+                        resolution.fmt(
+                            manager.lockfile.buffers.string_bytes.as_slice(),
+                            bun_fmt::PathSep::Posix,
+                        ),
+                    ),
+                );
+                Global::exit(1);
+            }
             cache_dir = get_cache_directory(manager);
         }
         ResolutionTag::RemoteTarball => {
diff --git a/src/install/PackageManager/PackageManagerLifecycle.rs b/src/install/PackageManager/PackageManagerLifecycle.rs
index 63730f9876a4..ede34ff115b8 100644
--- a/src/install/PackageManager/PackageManagerLifecycle.rs
+++ b/src/install/PackageManager/PackageManagerLifecycle.rs
@@ -140,9 +140,8 @@ impl PackageManager {
                             patch_hash,
                         )
                     }
-                    ResolutionTag::LocalTarball => directories::cached_tarball_folder_name(
-                        self,
-                        *pkg.resolution.local_tarball(),
+                    ResolutionTag::LocalTarball => directories::cached_local_tarball_folder_name(
+                        &pkg.meta.integrity,
                         patch_hash,
                     ),
                     ResolutionTag::RemoteTarball => directories::cached_tarball_folder_name(
diff --git a/src/install/PackageManager/patchPackage.rs b/src/install/PackageManager/patchPackage.rs
index 49029f7cd401..8709f93b8596 100644
--- a/src/install/PackageManager/patchPackage.rs
+++ b/src/install/PackageManager/patchPackage.rs
@@ -270,8 +270,14 @@ pub fn do_patch_commit(
     // `compute_cache_dir_and_subpath` resolves `pkg.resolution`'s strings against `manager.lockfile`.
     manager.lockfile = lockfile;
     let name = manager.lockfile.str(&pkg.name).to_vec();
-    let cache_result =
-        compute_cache_dir_and_subpath(manager, &name, &pkg.resolution, &mut folder_path_buf, None);
+    let cache_result = compute_cache_dir_and_subpath(
+        manager,
+        &name,
+        &pkg.resolution,
+        &pkg.meta.integrity,
+        &mut folder_path_buf,
+        None,
+    );
     let cache_dir: Fd = cache_result.cache_dir;
     let cache_dir_subpath: &ZStr = cache_result.cache_dir_subpath;
     let changes_dir: &[u8] = &changes_dir;
@@ -858,6 +864,7 @@ pub fn prepare_patch(manager: &mut PackageManager) -> Result<(), crate::Error> {
                     manager,
                     &name,
                     &actual_package.resolution,
+                    &actual_package.meta.integrity,
                     &mut folder_path_buf,
                     existing_patchfile_hash,
                 );
@@ -914,10 +921,12 @@ pub fn prepare_patch(manager: &mut PackageManager) -> Result<(), crate::Error> {
                 };
 
                 let pkg_resolution = pkg.resolution;
+                let pkg_integrity = pkg.meta.integrity;
                 let cache_result = compute_cache_dir_and_subpath(
                     manager,
                     &pkg_name,
                     &pkg_resolution,
+                    &pkg_integrity,
                     &mut folder_path_buf,
                     existing_patchfile_hash,
                 );
diff --git a/src/install/PackageManager/runTasks.rs b/src/install/PackageManager/runTasks.rs
index 05c3c87d1002..dd674fb65f00 100644
--- a/src/install/PackageManager/runTasks.rs
+++ b/src/install/PackageManager/runTasks.rs
@@ -110,7 +110,11 @@ pub trait RunTasksCallbacks {
     ) {
         unreachable!()
     }
-    fn on_extract_store_installer(_ctx: &mut Self::Ctx, _task_id: Task::Id) {
+    fn on_extract_store_installer(
+        _ctx: &mut Self::Ctx,
+        _task_id: Task::Id,
+        _data: &bun_install::ExtractData,
+    ) {
         unreachable!()
     }
 
@@ -1146,7 +1150,7 @@ pub fn run_tasks<C: RunTasksCallbacks>(
                             log_level,
                         );
                     } else if C::IS_STORE_INSTALLER {
-                        C::on_extract_store_installer(extract_ctx, task.id);
+                        C::on_extract_store_installer(extract_ctx, task.id, task.data_extract());
                     } else {
                         unreachable!("unexpected context type");
                     }
@@ -1475,7 +1479,11 @@ pub fn run_tasks<C: RunTasksCallbacks>(
                             log_level,
                         );
                     } else if C::IS_STORE_INSTALLER {
-                        C::on_extract_store_installer(extract_ctx, task.id);
+                        C::on_extract_store_installer(
+                            extract_ctx,
+                            task.id,
+                            task.data_git_checkout(),
+                        );
                     } else {
                         unreachable!("unexpected context type");
                     }
diff --git a/src/install/TarballStream.rs b/src/install/TarballStream.rs
index 7ae9f698469b..b30138842632 100644
--- a/src/install/TarballStream.rs
+++ b/src/install/TarballStream.rs
@@ -1153,12 +1153,14 @@ impl TarballStream {
 
             let (name, basename) = tarball.name_and_basename();
 
+            let integrity = tarball.lockfile_integrity(|| self.hasher.final_());
             let mut result = match tarball.move_to_cache_directory(
                 &mut (*task).log,
                 self.tmpname.as_zstr(),
                 name,
                 basename,
                 self.resolved_github_dirname,
+                &integrity,
             ) {
                 Ok(r) => r,
                 Err(err) => {
@@ -1167,19 +1169,7 @@ impl TarballStream {
                     return;
                 }
             };
-
-            match tarball.resolution.tag {
-                ResolutionTag::Github
-                | ResolutionTag::RemoteTarball
-                | ResolutionTag::LocalTarball => {
-                    if tarball.integrity.tag.is_supported() {
-                        result.integrity = tarball.integrity;
-                    } else {
-                        result.integrity = self.hasher.final_();
-                    }
-                }
-                _ => {}
-            }
+            result.integrity = integrity;
 
             if PackageManager::verbose_install() {
                 bun_core::pretty_errorln!(
diff --git a/src/install/extract_tarball.rs b/src/install/extract_tarball.rs
index e3cec500e2ed..7f7e49125df5 100644
--- a/src/install/extract_tarball.rs
+++ b/src/install/extract_tarball.rs
@@ -57,28 +57,30 @@ impl ExtractTarball {
                 return Err(crate::Error::IntegrityCheckFailed);
             }
         }
-        let mut result = self.extract(log, bytes)?;
+        let integrity = self.lockfile_integrity(|| Integrity::for_bytes(bytes));
+        let mut result = self.extract(log, bytes, &integrity)?;
+        result.integrity = integrity;
+        Ok(result)
+    }
 
-        // Compute and store SHA-512 integrity hash for GitHub / URL / local tarballs
-        // so the lockfile can pin the exact tarball content. On subsequent installs
-        // the hash stored in the lockfile is forwarded via this.integrity and verified
-        // above, preventing a compromised server from silently swapping the tarball.
+    /// The integrity the lockfile records for a GitHub / URL / local tarball, so
+    /// later installs verify the same bytes (see `run`). That is the value the
+    /// lockfile already pins (verified before extraction), or else `compute` from
+    /// the bytes on the first install. A local tarball's cache entry is named
+    /// after it (`move_to_cache_directory`), which is why it is settled before
+    /// extracting. Unknown for npm packages, whose integrity comes from the
+    /// registry manifest.
+    pub(crate) fn lockfile_integrity(&self, compute: impl FnOnce() -> Integrity) -> Integrity {
         match self.resolution.tag {
             ResolutionTag::Github | ResolutionTag::RemoteTarball | ResolutionTag::LocalTarball => {
                 if self.integrity.tag.is_supported() {
-                    // Re-installing with an existing lockfile: integrity was already
-                    // verified above, propagate the known value to ExtractData so that
-                    // the lockfile keeps it on re-serialisation.
-                    result.integrity = self.integrity;
+                    self.integrity
                 } else {
-                    // First install (no integrity in the lockfile yet): compute it.
-                    result.integrity = Integrity::for_bytes(bytes);
+                    compute()
                 }
             }
-            _ => {}
+            _ => Integrity::default(),
         }
-
-        Ok(result)
     }
 }
 
@@ -236,7 +238,12 @@ impl ExtractTarball {
         (name, basename)
     }
 
-    fn extract(&self, log: &mut bun_ast::Log, tgz_bytes: &[u8]) -> Result<ExtractData, Error> {
+    fn extract(
+        &self,
+        log: &mut bun_ast::Log,
+        tgz_bytes: &[u8],
+        integrity: &Integrity,
+    ) -> Result<ExtractData, Error> {
         let _tracer = bun_core::perf::trace("ExtractTarball.extract");
 
         let tmpdir = Dir::borrow(&self.temp_dir);
@@ -450,12 +457,16 @@ impl ExtractTarball {
             }
         }
 
-        self.move_to_cache_directory(log, tmpname, name, basename, resolved)
+        self.move_to_cache_directory(log, tmpname, name, basename, resolved, integrity)
     }
 
     /// Rename the freshly-extracted temp directory into the cache, read
     /// `package.json` if required, and build the `ExtractData` result. Shared
     /// between the buffered and streaming extraction paths.
+    ///
+    /// `resolved` (GitHub) and `integrity` (local tarballs, see
+    /// `lockfile_integrity`) name the cache entry for the resolutions whose
+    /// entries are keyed by content rather than by the resolution string.
     pub(crate) fn move_to_cache_directory(
         &self,
         log: &mut bun_ast::Log,
@@ -463,6 +474,7 @@ impl ExtractTarball {
         name: &[u8],
         basename: &[u8],
         resolved: &[u8],
+        integrity: &Integrity,
     ) -> Result<ExtractData, Error> {
         let package_manager = self.package_manager.get();
 
@@ -511,14 +523,18 @@ impl ExtractTarball {
                     )
                     .as_bytes()
                 }
-                ResolutionTag::LocalTarball | ResolutionTag::RemoteTarball => {
-                    directories::cached_tarball_folder_name_print(
-                        &mut bufs.folder_name_buf,
-                        self.url.slice(),
-                        None,
-                    )
-                    .as_bytes()
-                }
+                ResolutionTag::LocalTarball => directories::cached_local_tarball_folder_name_print(
+                    &mut bufs.folder_name_buf,
+                    integrity,
+                    None,
+                )
+                .as_bytes(),
+                ResolutionTag::RemoteTarball => directories::cached_tarball_folder_name_print(
+                    &mut bufs.folder_name_buf,
+                    self.url.slice(),
+                    None,
+                )
+                .as_bytes(),
                 _ => unreachable!(),
             };
             if folder_name.is_empty() || (folder_name.len() == 1 && folder_name[0] == b'/') {
diff --git a/src/install/integrity.rs b/src/install/integrity.rs
index e5ae223d335e..12e459448358 100644
--- a/src/install/integrity.rs
+++ b/src/install/integrity.rs
@@ -243,13 +243,11 @@ impl Integrity {
 
 impl fmt::Display for Integrity {
     fn fmt(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result {
-        match self.tag {
-            Tag::SHA1 => f.write_str("sha1-")?,
-            Tag::SHA256 => f.write_str("sha256-")?,
-            Tag::SHA384 => f.write_str("sha384-")?,
-            Tag::SHA512 => f.write_str("sha512-")?,
-            _ => return Ok(()),
-        }
+        let Some(algorithm) = self.tag.name() else {
+            return Ok(());
+        };
+        f.write_str(algorithm)?;
+        f.write_str("-")?;
 
         let mut base64_buf = [0u8; 512];
         let bytes = self.slice();
@@ -293,6 +291,17 @@ impl Tag {
         self.0 >= Tag::SHA1.0 && self.0 <= Tag::SHA512.0
     }
 
+    /// The algorithm part of the SRI string (`sha512` in `sha512-...`); `None` for `UNKNOWN`.
+    pub(crate) fn name(self) -> Option<&'static str> {
+        Some(match self {
+            Tag::SHA1 => "sha1",
+            Tag::SHA256 => "sha256",
+            Tag::SHA384 => "sha384",
+            Tag::SHA512 => "sha512",
+            _ => return None,
+        })
+    }
+
     pub(crate) fn parse(buf: &[u8]) -> (Tag, usize) {
         let Some(i) = strings::index_of_char(&buf[0..buf.len().min(7)], b'-') else {
             return (Tag::UNKNOWN, 0);
diff --git a/src/install/isolated_install.rs b/src/install/isolated_install.rs
index 71464543f8a2..78dc5b444a01 100644
--- a/src/install/isolated_install.rs
+++ b/src/install/isolated_install.rs
@@ -144,8 +144,12 @@ impl<'a> run_tasks::RunTasksCallbacks for StoreRunTasksCallbacks<'a> {
     const HAS_ON_PACKAGE_DOWNLOAD_ERROR: bool = true;
     const IS_STORE_INSTALLER: bool = true;
 
-    fn on_extract_store_installer(ctx: &mut Self::Ctx, task_id: Task::Id) {
-        ctx.on_package_extracted(task_id);
+    fn on_extract_store_installer(
+        ctx: &mut Self::Ctx,
+        task_id: Task::Id,
+        data: &install::ExtractData,
+    ) {
+        ctx.on_package_extracted(task_id, data);
     }
 
     fn on_package_download_error_store(
@@ -2366,11 +2370,12 @@ pub(crate) fn install_isolated_packages(
                             pkg_res.github(),
                             None,
                         ),
-                        ResolutionTag::LocalTarball => package_manager::cached_tarball_folder_name(
-                            installer.manager(),
-                            *pkg_res.local_tarball(),
-                            None,
-                        ),
+                        ResolutionTag::LocalTarball => {
+                            package_manager::cached_local_tarball_folder_name(
+                                &pkgs.items_meta()[pkg_id as usize].integrity,
+                                None,
+                            )
+                        }
                         ResolutionTag::RemoteTarball => {
                             package_manager::cached_tarball_folder_name(
                                 installer.manager(),
@@ -2385,23 +2390,26 @@ pub(crate) fn install_isolated_packages(
                         installer.manager_mut().get_cache_directory_and_abs_path();
                     let _ = &cache_dir_path; // dropped at scope exit
 
-                    let missing_from_cache = match installer.manager().get_preinstall_state(pkg_id)
-                    {
-                        install::PreinstallState::Done => false,
-                        _ => {
-                            let exists = package_manager::directories::is_package_in_cache_at(
-                                cache_dir,
-                                cache_subpath_z,
-                                pkg_res_tag,
-                            );
-                            if exists {
-                                installer
-                                    .manager_mut()
-                                    .set_preinstall_state(pkg_id, install::PreinstallState::Done);
+                    // An empty name is a local tarball whose integrity the lockfile
+                    // does not record; extracting it is what names its entry.
+                    let missing_from_cache = cache_subpath_z.is_empty()
+                        || match installer.manager().get_preinstall_state(pkg_id) {
+                            install::PreinstallState::Done => false,
+                            _ => {
+                                let exists = package_manager::directories::is_package_in_cache_at(
+                                    cache_dir,
+                                    cache_subpath_z,
+                                    pkg_res_tag,
+                                );
+                                if exists {
+                                    installer.manager_mut().set_preinstall_state(
+                                        pkg_id,
+                                        install::PreinstallState::Done,
+                                    );
+                                }
+                                !exists
                             }
-                            !exists
-                        }
-                    };
+                        };
 
                     if !missing_from_cache {
                         if let installer::PatchInfo::Patch(patch) = &patch_info {
diff --git a/src/install/isolated_install/Installer.rs b/src/install/isolated_install/Installer.rs
index ce346a116b37..12383a8c66a8 100644
--- a/src/install/isolated_install/Installer.rs
+++ b/src/install/isolated_install/Installer.rs
@@ -36,7 +36,7 @@ use super::symlinker::{self, Symlinker};
 use crate::bun_fs;
 use crate::lockfile_real::package::PackageColumns as _;
 use crate::package_manager_real::directories;
-use crate::package_manager_real::package_manager_options::Do;
+use crate::package_manager_real::package_manager_options::{Do, Enable};
 
 /// The enum lives at module level in `crate::resolution`.
 type ResolutionTag = resolution::Tag;
@@ -70,7 +70,9 @@ pub struct Installer<'a> {
     /// pool and each task derefs this field; a `&'a mut` would assert
     /// exclusivity every concurrent task violates. Mutated only for
     /// `lockfile.trusted_dependencies` (under `trusted_dependencies_mutex`,
-    /// narrowed via `addr_of_mut!`). Never null. Read via `lockfile()`.
+    /// narrowed via `addr_of_mut!`) and, on the main thread, a not-yet-started
+    /// package's `meta.integrity` (`record_extracted_integrity`, one row via
+    /// the raw column pointer). Never null. Read via `lockfile()`.
     pub lockfile: *mut Lockfile,
 
     pub(crate) summary: InstallSummary,
@@ -181,7 +183,11 @@ impl<'a> Installer<'a> {
         self.start_task(entry_id);
     }
 
-    pub(crate) fn on_package_extracted(&mut self, task_id: crate::package_manager_task::Id) {
+    pub(crate) fn on_package_extracted(
+        &mut self,
+        task_id: crate::package_manager_task::Id,
+        data: &install::ExtractData,
+    ) {
         if let Some(removed) = self.manager_mut().task_queue.remove(&task_id) {
             let store = self.store;
 
@@ -205,6 +211,11 @@ impl<'a> Installer<'a> {
 
                 let node_id = entry_node_ids[entry_id.get() as usize];
                 let pkg_id = node_pkg_ids[node_id.get() as usize];
+
+                if data.integrity.tag.is_supported() {
+                    self.record_extracted_integrity(pkg_id, &data.integrity);
+                }
+
                 let pkg_name = pkg_names[pkg_id as usize];
                 let pkg_name_hash = pkg_name_hashes[pkg_id as usize];
                 let pkg_res = &pkg_resolutions[pkg_id as usize];
@@ -230,6 +241,42 @@ impl<'a> Installer<'a> {
         }
     }
 
+    /// Main thread, before the package's tasks start. The counterpart of the
+    /// integrity write-back in `PackageInstaller::install_enqueued_packages_after_extraction`:
+    /// a lockfile written before tarball integrity was recorded has none for the
+    /// package, so the extraction computed it. A local tarball's cache entry is
+    /// named after it (`cached_local_tarball_folder_name`), so the tasks need it
+    /// in place, and the lockfile is re-saved with it.
+    fn record_extracted_integrity(&mut self, pkg_id: PackageID, integrity: &install::Integrity) {
+        let pkgs = self.lockfile().packages.slice();
+        assert!((pkg_id as usize) < pkgs.len());
+        // SAFETY: `items_raw` carries the column's root provenance, so this
+        // field access needs no `&mut Lockfile`. Only a package's own tasks
+        // read its `integrity` (to name the cache entry), and none of this
+        // package's tasks have started: every entry of it waited on the
+        // extraction being reported. Tasks of other packages running on the
+        // pool hold `&[Meta]` over the column but only touch other bytes.
+        // `pkg_id` is in bounds per the assert above.
+        let recorded = unsafe {
+            core::ptr::addr_of_mut!(
+                (*pkgs
+                    .items_raw::<"meta", package::Meta>()
+                    .add(pkg_id as usize))
+                .integrity
+            )
+        };
+        // SAFETY: see above.
+        if unsafe { (*recorded).tag.is_supported() } {
+            return;
+        }
+        // SAFETY: see above.
+        unsafe { recorded.write(*integrity) };
+        self.manager_mut()
+            .options
+            .enable
+            .set(Enable::FORCE_SAVE_LOCKFILE, true);
+    }
+
     /// Called from main thread when a tarball download or extraction fails.
     /// Without this, the upfront pending-task slot for each waiting entry is
     /// never released and the install loop blocks forever on
@@ -1132,9 +1179,13 @@ impl Task {
                                     patch_info.contents_hash(),
                                 ),
                                 ResolutionTag::LocalTarball => {
-                                    directories::cached_tarball_folder_name(
-                                        manager,
-                                        *pkg_res.local_tarball(),
+                                    // Recorded by the lockfile or by
+                                    // `on_package_extracted` before this task started.
+                                    debug_assert!(
+                                        pkg_metas[pkg_id as usize].integrity.tag.is_supported()
+                                    );
+                                    directories::cached_local_tarball_folder_name(
+                                        &pkg_metas[pkg_id as usize].integrity,
                                         patch_info.contents_hash(),
                                     )
                                 }
diff --git a/src/install/patch_install.rs b/src/install/patch_install.rs
index c5162af3567d..cffe4e4470e0 100644
--- a/src/install/patch_install.rs
+++ b/src/install/patch_install.rs
@@ -760,16 +760,18 @@ impl PatchTask {
         let pkg_name_slice = pkg_name
             .slice(&pkg_manager.lockfile.buffers.string_bytes)
             .to_vec();
-        // `Resolution` is `Copy`; copy out so the lockfile borrow ends
+        // `Resolution` and `Integrity` are `Copy`; copy out so the lockfile borrow ends
         // before `compute_cache_dir_and_subpath` reborrows `pkg_manager` mutably.
         let resolution_clone: Resolution =
             pkg_manager.lockfile.packages.items_resolution()[pkg_id as usize];
+        let integrity = pkg_manager.lockfile.packages.items_meta()[pkg_id as usize].integrity;
 
         let mut folder_path_buf = PathBuffer::uninit();
         let stuff = package_manager::compute_cache_dir_and_subpath(
             pkg_manager,
             &pkg_name_slice,
             &resolution_clone,
+            &integrity,
             &mut folder_path_buf,
             Some(patch_hash),
         );
diff --git a/test/cli/install/bun-install-tarball-integrity.test.ts b/test/cli/install/bun-install-tarball-integrity.test.ts
index 422352e6a667..35e208458ea2 100644
--- a/test/cli/install/bun-install-tarball-integrity.test.ts
+++ b/test/cli/install/bun-install-tarball-integrity.test.ts
@@ -493,6 +493,132 @@ describe.concurrent("tarball integrity", () => {
   });
 });
 
+// A `file:` tarball's resolution is the path written in package.json (`pkg.tgz`),
+// which names a different tarball in every project sharing the cache, and an
+// install from a lockfile never reads the tarball itself. So the cache entry is
+// keyed by the integrity the lockfile pins, not by that path: two projects (or two
+// branches of one project) with different tarballs at the same path get separate
+// entries, and a lockfile that does not pin an integrity cannot name an entry and
+// has the tarball read instead.
+describe.concurrent.each(["hoisted", "isolated"] as const)("local tarball cache entries (%s)", linker => {
+  async function tarball(exported: string) {
+    const tgz = await new Bun.Archive(
+      {
+        "package/package.json": JSON.stringify({ name: "pkg", version: "1.0.0" }),
+        "package/index.js": `module.exports = ${JSON.stringify(exported)};\n`,
+      },
+      { compress: "gzip" },
+    ).bytes();
+    const digest = createHash("sha512").update(tgz).digest();
+    return {
+      file: Buffer.from(tgz),
+      integrity: "sha512-" + digest.toString("base64"),
+      cacheEntry: `@T@sha512-${digest.subarray(0, 16).toString("hex")}@@@1`,
+    };
+  }
+
+  function project(tgz: Buffer, extraFiles: Record<string, string> = {}) {
+    return {
+      "package.json": JSON.stringify({ name: "app", dependencies: { pkg: "file:pkg.tgz" } }),
+      "pkg.tgz": tgz,
+      "bunfig.toml": Bun.TOML.stringify({ install: { linker } }),
+      ...extraFiles,
+    };
+  }
+
+  // The projects under `root` share `root/cache`.
+  async function install(root: string, name: string, ...args: string[]) {
+    await using proc = spawn({
+      cmd: [bunExe(), "install", ...args],
+      cwd: join(root, name),
+      env: { ...env, BUN_INSTALL_CACHE_DIR: join(root, "cache") },
+      stdout: "ignore",
+      stderr: "pipe",
+    });
+    const [stderr, exitCode] = await Promise.all([proc.stderr.text(), proc.exited]);
+    expect(stderr).not.toContain("error:");
+    expect(exitCode).toBe(0);
+  }
+
+  const installedExport = (root: string, name: string) =>
+    file(join(root, name, "node_modules", "pkg", "index.js")).text();
+  const lockfile = (root: string, name: string) => file(join(root, name, "bun.lock")).text();
+  const reinstall = (root: string, name: string, ...args: string[]) =>
+    rm(join(root, name, "node_modules"), { recursive: true }).then(() => install(root, name, ...args));
+  const cacheEntries = async (root: string) =>
+    (await readdirSorted(join(root, "cache"))).filter(entry => entry.startsWith("@T@"));
+
+  it("keeps the tarballs of two projects that both depend on file:pkg.tgz apart", async () => {
+    const one = await tarball("one");
+    const two = await tarball("two");
+    using root = tempDir("local-tarball-two-projects", { one: project(one.file), two: project(two.file) });
+
+    await install(String(root), "one");
+    await install(String(root), "two");
+    expect(await lockfile(String(root), "one")).toContain(one.integrity);
+
+    await reinstall(String(root), "one");
+    expect(await installedExport(String(root), "one")).toBe('module.exports = "one";\n');
+    expect(await installedExport(String(root), "two")).toBe('module.exports = "two";\n');
+    expect(await cacheEntries(String(root))).toEqual([one.cacheEntry, two.cacheEntry].sort());
+  });
+
+  it("installs the tarball the lockfile pins after another build of it was extracted from the same path", async () => {
+    const v1 = await tarball("v1");
+    const v2 = await tarball("v2");
+    using root = tempDir("local-tarball-two-builds", { app: project(v1.file) });
+    const app = join(String(root), "app");
+
+    await install(String(root), "app");
+    const v1Lockfile = await lockfile(String(root), "app");
+    expect(v1Lockfile).toContain(v1.integrity);
+
+    // Like checking out a branch that ships v2: the rebuilt tarball is resolved and extracted.
+    await writeFile(join(app, "pkg.tgz"), v2.file);
+    await rm(join(app, "bun.lock"));
+    await reinstall(String(root), "app");
+    expect(await installedExport(String(root), "app")).toBe('module.exports = "v2";\n');
+    expect(await lockfile(String(root), "app")).toContain(v2.integrity);
+
+    // Back on the v1 branch, pkg.tgz and bun.lock are v1's again.
+    await writeFile(join(app, "pkg.tgz"), v1.file);
+    await writeFile(join(app, "bun.lock"), v1Lockfile);
+    await reinstall(String(root), "app");
+    expect(await installedExport(String(root), "app")).toBe('module.exports = "v1";\n');
+    expect(await cacheEntries(String(root))).toEqual([v1.cacheEntry, v2.cacheEntry].sort());
+  });
+
+  it("reads the tarball when the lockfile does not record its integrity, then records it", async () => {
+    const other = await tarball("other");
+    const mine = await tarball("mine");
+    using root = tempDir("local-tarball-unpinned", {
+      other: project(other.file),
+      app: project(mine.file, {
+        // Written before bun recorded the integrity of tarball packages.
+        "bun.lock": JSON.stringify({
+          lockfileVersion: 1,
+          configVersion: 1,
+          workspaces: { "": { name: "app", dependencies: { pkg: "file:pkg.tgz" } } },
+          packages: { pkg: ["pkg@pkg.tgz", {}] },
+        }),
+      }),
+    });
+
+    await install(String(root), "other");
+    await install(String(root), "app");
+    expect(await installedExport(String(root), "app")).toBe('module.exports = "mine";\n');
+    expect(await lockfile(String(root), "app")).toContain(mine.integrity);
+    expect(await cacheEntries(String(root))).toEqual([mine.cacheEntry, other.cacheEntry].sort());
+
+    // The recorded integrity names the entry that extraction created: this
+    // install is served from it without reading pkg.tgz (which would no longer
+    // match the pin).
+    await writeFile(join(String(root), "app", "pkg.tgz"), other.file);
+    await reinstall(String(root), "app");
+    expect(await installedExport(String(root), "app")).toBe('module.exports = "mine";\n');
+  });
+});
+
 describe.concurrent.each(["hoisted", "isolated"] as const)("tarball integrity mismatch (%s)", linker => {
   // Regression test for #29646 — with the isolated linker, a SHA-512 mismatch
   // during the resolve-phase tarball extract left `task_queue` /

From 3050b8067c887d50b30855e4d75ae9350659964a Mon Sep 17 00:00:00 2001
From: robobun <117481402+robobun@users.noreply.github.com>
Date: Mon, 17 Aug 2026 01:05:28 +0000
Subject: [PATCH 026/258] install: reject tarball, folder and git packages
 whose package.json name is invalid (#38633)

---
 .../PackageManager/processDependencyList.rs   |   4 +-
 src/install/lockfile/Package.rs               |  10 ++
 test/cli/install/bun-install.test.ts          | 143 ++++++++++++++++++
 3 files changed, 155 insertions(+), 2 deletions(-)

diff --git a/src/install/PackageManager/processDependencyList.rs b/src/install/PackageManager/processDependencyList.rs
index 7fdd1f654dac..492110ad87af 100644
--- a/src/install/PackageManager/processDependencyList.rs
+++ b/src/install/PackageManager/processDependencyList.rs
@@ -167,7 +167,7 @@ impl PackageManager {
                                     format_args!("{}", resolution.fmt_url(string_buf)),
                                 );
                             }
-                            Global::crash();
+                            self.crash();
                         }
 
                         let has_scripts = pkg.scripts.has_any() || {
@@ -264,7 +264,7 @@ impl PackageManager {
                             err.name(),
                         );
                     }
-                    Global::crash();
+                    self.crash();
                 }
 
                 let has_scripts = package.scripts.has_any() || {
diff --git a/src/install/lockfile/Package.rs b/src/install/lockfile/Package.rs
index e175f2c58f9e..0582474b998b 100644
--- a/src/install/lockfile/Package.rs
+++ b/src/install/lockfile/Package.rs
@@ -2231,6 +2231,16 @@ impl Package<u64> {
             if let Some(name_q) = json.as_property(b"name") {
                 if let Some(name) = name_q.expr.as_utf8(&bump) {
                     if !name.is_empty() {
+                        // Non-root names become bun.lock `packages` entries, which the
+                        // lockfile parser rejects with the same check (see bun.lock.rs).
+                        if !FEATURES.is_main && !dependency::is_safe_install_folder_name(name) {
+                            log.add_error_fmt(
+                                source,
+                                value_loc_of(source, name_q.loc),
+                                format_args!("Invalid package name {}", bun_core::fmt::quote(name)),
+                            );
+                            return Err(crate::Error::InvalidPackageJSON);
+                        }
                         string_builder.count(name);
                         break 'name;
                     }
diff --git a/test/cli/install/bun-install.test.ts b/test/cli/install/bun-install.test.ts
index 360a93010395..c7d98aab03f0 100644
--- a/test/cli/install/bun-install.test.ts
+++ b/test/cli/install/bun-install.test.ts
@@ -10138,6 +10138,149 @@ it("does not install transitive file: dependencies that point outside their pack
   expect(exitCode).toBe(1);
 });
 
+describe.concurrent("a dependency whose own package.json has an invalid name", () => {
+  // The name inside a tarball, folder or git dependency's package.json is written
+  // to bun.lock as `name@resolution`, and the bun.lock parser rejects names that
+  // are not safe install folder names. Saving such a name used to succeed and
+  // leave behind a lockfile that every later `bun install` ignored, so the
+  // install has to fail before the lockfile is saved.
+  async function install(root: string, ...args: string[]) {
+    await using proc = spawn({
+      cmd: [bunExe(), "install", ...args],
+      cwd: join(root, "project"),
+      env: { ...env, BUN_INSTALL_CACHE_DIR: join(root, "cache") },
+      stdout: "pipe",
+      stderr: "pipe",
+    });
+    const [out, err, exitCode] = await Promise.all([proc.stdout.text(), proc.stderr.text(), proc.exited]);
+    return { out, err, exitCode };
+  }
+
+  async function expectRejected(root: string, quotedName: string) {
+    const { out, err, exitCode } = await install(root);
+    expect(err).toContain(`error: Invalid package name ${quotedName}`);
+    expect(out).not.toContain("1 package installed");
+    expect(await exists(join(root, "project", "bun.lock"))).toBe(false);
+    expect(await exists(join(root, "project", "node_modules", "dep"))).toBe(false);
+    expect(exitCode).toBe(1);
+    return err;
+  }
+
+  it("fails to install a local tarball", async () => {
+    using dir = tempDir("invalid-name-tarball", {
+      "project/package.json": JSON.stringify({
+        name: "foo",
+        version: "0.0.1",
+        dependencies: { dep: "file:../dep.tgz" },
+      }),
+    });
+    await Bun.Archive.write(
+      join(String(dir), "dep.tgz"),
+      { "package/package.json": JSON.stringify({ name: "a:b", version: "1.0.0" }) },
+      { compress: "gzip" },
+    );
+
+    await expectRejected(String(dir), '"a:b"');
+  });
+
+  it("fails to install a file: folder and points at the offending package.json", async () => {
+    using dir = tempDir("invalid-name-folder", {
+      "project/package.json": JSON.stringify({
+        name: "foo",
+        version: "0.0.1",
+        dependencies: { dep: "file:../lib" },
+      }),
+      "lib/package.json": JSON.stringify({ name: "lib/..", version: "1.0.0" }),
+    });
+
+    const err = await expectRejected(String(dir), '"lib/.."');
+    expect(err).toMatch(/ at .*lib[\\/]package\.json:1:9\s/);
+  });
+
+  it("escapes the rejected name in the error message", async () => {
+    using dir = tempDir("invalid-name-escaped", {
+      "project/package.json": JSON.stringify({
+        name: "foo",
+        version: "0.0.1",
+        dependencies: { dep: "file:../lib" },
+      }),
+      "lib/package.json": JSON.stringify({ name: "a\0b", version: "1.0.0" }),
+    });
+
+    await expectRejected(String(dir), '"a\\u0000b"');
+  });
+
+  it("fails to install a git dependency", async () => {
+    using dir = tempDir("invalid-name-git", {
+      "work/package.json": JSON.stringify({ name: "a\\b", version: "1.0.0" }),
+    });
+    await createDumbHttpGitRepo(String(dir), {});
+    using server = serveDirectory(String(dir));
+    await write(
+      join(String(dir), "project", "package.json"),
+      JSON.stringify({
+        name: "foo",
+        version: "0.0.1",
+        dependencies: { dep: `git+http://localhost:${server.port}/repo.git` },
+      }),
+    );
+
+    await expectRejected(String(dir), '"a\\b"');
+  });
+
+  it("still installs scoped names and writes a lockfile the next install loads", async () => {
+    using dir = tempDir("valid-scoped-name-tarball", {
+      "project/package.json": JSON.stringify({
+        name: "foo",
+        version: "0.0.1",
+        dependencies: { dep: "file:../dep.tgz" },
+      }),
+    });
+    await Bun.Archive.write(
+      join(String(dir), "dep.tgz"),
+      { "package/package.json": JSON.stringify({ name: "@scope/dep", version: "1.0.0" }) },
+      { compress: "gzip" },
+    );
+
+    const first = await install(String(dir));
+    expect(first.err).not.toContain("error:");
+    expect(first.out).toContain("1 package installed");
+    expect(first.exitCode).toBe(0);
+    expect(await file(join(String(dir), "project", "bun.lock")).text()).toContain('"dep": ["@scope/dep@../dep.tgz"');
+
+    const second = await install(String(dir), "--frozen-lockfile");
+    expect(second.err).not.toContain("Ignoring lockfile");
+    expect(second.err).not.toContain("error:");
+    expect(second.exitCode).toBe(0);
+  });
+
+  it("does not apply to the root package's own name", async () => {
+    // The root is not a bun.lock `packages` entry; its name only appears in the
+    // `workspaces` section, which accepts it as-is.
+    using dir = tempDir("invalid-name-root", {
+      "project/package.json": JSON.stringify({
+        name: "a:b",
+        version: "0.0.1",
+        dependencies: { dep: "file:../lib" },
+      }),
+      "lib/package.json": JSON.stringify({ name: "lib", version: "1.0.0" }),
+    });
+
+    const first = await install(String(dir));
+    expect(first.err).not.toContain("error:");
+    expect(first.out).toContain("1 package installed");
+    expect(first.exitCode).toBe(0);
+    const lockfile = await file(join(String(dir), "project", "bun.lock")).text();
+    expect(lockfile).toContain('"name": "a:b"');
+    expect(lockfile).toContain('"dep": ["lib@file:../lib", {}]');
+
+    const second = await install(String(dir), "--frozen-lockfile");
+    expect(second.err).not.toContain("Ignoring lockfile");
+    expect(second.err).not.toContain("error:");
+    expect(second.exitCode).toBe(0);
+  });
+});
+
 it("does not install transitive file: dependencies with overlong folder targets", async () => {
   const overlongTarget = "file:./" + Buffer.alloc(120000, "a").toString();
   using dir = tempDir("transitive-file-dep-overlong", {

From 2e280b9c46ad0453056f8162e34073330e449f59 Mon Sep 17 00:00:00 2001
From: robobun <117481402+robobun@users.noreply.github.com>
Date: Mon, 17 Aug 2026 01:05:33 +0000
Subject: [PATCH 027/258] install: read git+git:// resolutions back from
 bun.lock (#38798)

---
 src/install/dependency.rs                  |  7 +++++-
 test/cli/install/migration/migrate.test.ts | 25 ++++++++++++++++++++++
 2 files changed, 31 insertions(+), 1 deletion(-)

diff --git a/src/install/dependency.rs b/src/install/dependency.rs
index 8e3b39faad9f..a5557f315caf 100644
--- a/src/install/dependency.rs
+++ b/src/install/dependency.rs
@@ -871,7 +871,12 @@ impl TagExt for Tag {
                                 }
                             }
                             b'+' => {
-                                if url.starts_with(b"+ssh:") || url.starts_with(b"+file:") {
+                                // `git+git:` is how a Git resolution of a `git://` dependency is
+                                // written back to bun.lock (`git+` label + the original URL).
+                                if url.starts_with(b"+ssh:")
+                                    || url.starts_with(b"+file:")
+                                    || url.starts_with(b"+git:")
+                                {
                                     return Tag::Git;
                                 }
                                 if url.starts_with(b"+http") {
diff --git a/test/cli/install/migration/migrate.test.ts b/test/cli/install/migration/migrate.test.ts
index d89f2ce91783..9d196aca88bf 100644
--- a/test/cli/install/migration/migrate.test.ts
+++ b/test/cli/install/migration/migrate.test.ts
@@ -917,6 +917,31 @@ describe("package-lock.json migration fixes", () => {
     await frozen(dir);
   });
 
+  // A git resolution is written to bun.lock as "git+" + the repository URL, so a
+  // dependency on a plain git:// host comes back as "git+git://...". The lockfile
+  // parser has to accept that spelling, otherwise every later install throws the
+  // lockfile away ("Unexpected resolution") and --frozen-lockfile can never pass.
+  test.concurrent("git:// hosts round-trip through bun.lock", async () => {
+    const dependencies = {
+      g: "git://example.com/user/g.git",
+      h: "git://example.com/user/h.git#v1",
+    };
+    using dir = synthetic("npm-migrate-git-protocol", {
+      "package.json": JSON.stringify({ name: "git-protocol", dependencies }),
+      "package-lock.json": npmLock("git-protocol", {
+        "": { name: "git-protocol", dependencies },
+        "node_modules/g": { version: "1.0.0", resolved: `git://example.com/user/g.git#${sha(1)}` },
+        "node_modules/h": { version: "1.0.0", resolved: `git://example.com/user/h.git#${sha(2)}` },
+      }),
+    });
+
+    const { lock } = await migrate(dir);
+    expect(lock.workspaces[""].dependencies).toStrictEqual(dependencies);
+    expect(lock.packages.g[0]).toBe(`g@git+git://example.com/user/g.git#${sha(1)}`);
+    expect(lock.packages.h[0]).toBe(`h@git+git://example.com/user/h.git#${sha(2)}`);
+    await frozen(dir);
+  });
+
   test.concurrent("root bundleDependencies keeps its subtree (B2)", async () => {
     using dir = fixture("testing-rebuild-bundle--a");
     const { text, lock } = await migrate(dir);

From c4681f4ce2541d9a86446be20a83cae9380f6edd Mon Sep 17 00:00:00 2001
From: robobun <117481402+robobun@users.noreply.github.com>
Date: Mon, 17 Aug 2026 01:05:36 +0000
Subject: [PATCH 028/258] install: stop aborting on link: specifiers and patch
 paths longer than the path buffers (#38359)

---
 src/install/PackageInstaller.rs            |  31 +++-
 src/install/patch_install.rs               |  14 +-
 src/install/resolvers/folder_resolver.rs   | 171 ++++++++++-----------
 src/resolver/lib.rs                        |   8 -
 test/cli/install/bun-install-patch.test.ts |  35 ++++-
 test/cli/install/bun-install.test.ts       |  59 +++++++
 test/cli/install/bun-link.test.ts          |  88 ++++++++++-
 test/cli/install/bun-workspaces.test.ts    |   1 +
 8 files changed, 297 insertions(+), 110 deletions(-)

diff --git a/src/install/PackageInstaller.rs b/src/install/PackageInstaller.rs
index d634d960b960..39f28b69a28e 100644
--- a/src/install/PackageInstaller.rs
+++ b/src/install/PackageInstaller.rs
@@ -1568,16 +1568,31 @@ impl<'a> PackageInstaller<'a> {
                     installer.cache_dir = Fd::cwd();
                 } else {
                     let global_link_dir = package_manager::global_link_dir_path(self.manager_mut());
+                    let sep_len = (global_link_dir[global_link_dir.len() - 1] != SEP) as usize;
+                    let len = global_link_dir.len() + sep_len + folder.len();
+                    // `folder` is the `link:` specifier as written in package.json.
+                    if len >= self.folder_path_buf.len() {
+                        if log_level != Options::LogLevel::Silent {
+                            Output::err(
+                                "ENAMETOOLONG",
+                                "link path for package <b>{}<r> is too long",
+                                (bstr::BStr::new(pkg_name.slice(string_buf!())),),
+                            );
+                        }
+                        self.summary.fail += 1;
+                        self.increment_tree_install_count(
+                            !IS_PENDING_PACKAGE_INSTALL,
+                            self.current_tree_id,
+                            log_level,
+                        );
+                        return;
+                    }
                     let buf = self.folder_path_buf.as_mut_slice();
-                    let mut len = 0usize;
-                    buf[len..len + global_link_dir.len()].copy_from_slice(global_link_dir);
-                    len += global_link_dir.len();
-                    if global_link_dir[global_link_dir.len() - 1] != SEP {
-                        buf[len] = SEP;
-                        len += 1;
+                    buf[..global_link_dir.len()].copy_from_slice(global_link_dir);
+                    if sep_len != 0 {
+                        buf[global_link_dir.len()] = SEP;
                     }
-                    buf[len..len + folder.len()].copy_from_slice(folder);
-                    len += folder.len();
+                    buf[global_link_dir.len() + sep_len..len].copy_from_slice(folder);
                     buf[len] = 0;
                     // SAFETY: buf[len] == 0 written above
                     installer.cache_dir_subpath = ZStr::from_buf(&self.folder_path_buf, len);
diff --git a/src/install/patch_install.rs b/src/install/patch_install.rs
index cffe4e4470e0..ded1c8904195 100644
--- a/src/install/patch_install.rs
+++ b/src/install/patch_install.rs
@@ -393,9 +393,11 @@ impl PatchTask {
         let patchfile_path = &patch.patchfilepath;
 
         let mut absolute_patchfile_path_buf = PathBuffer::uninit();
+        let mut absolute_patchfile_path_spill = Vec::new();
         // 1. Parse the patch file
-        let absolute_patchfile_path = path::resolve_path::join_z_buf::<path::platform::Auto>(
+        let absolute_patchfile_path = path::resolve_path::join_z_buf_spill::<path::platform::Auto>(
             &mut absolute_patchfile_path_buf.0,
+            &mut absolute_patchfile_path_spill,
             &[dir, patchfile_path],
         );
         // TODO: can the patch file be anything other than utf-8?
@@ -608,9 +610,11 @@ impl PatchTask {
         let patchfile_path = &calc_hash.patchfile_path;
 
         let mut absolute_patchfile_path_buf = PathBuffer::uninit();
+        let mut absolute_patchfile_path_spill = Vec::new();
         // parse the patch file
-        let absolute_patchfile_path = path::resolve_path::join_z_buf::<path::platform::Auto>(
+        let absolute_patchfile_path = path::resolve_path::join_z_buf_spill::<path::platform::Auto>(
             &mut absolute_patchfile_path_buf.0,
+            &mut absolute_patchfile_path_spill,
             &[dir, patchfile_path],
         );
 
@@ -638,12 +642,10 @@ impl PatchTask {
                     );
                     return None;
                 }
-                bun_ast::add_warning_pretty!(
-                    log,
+                log.add_error_fmt(
                     None,
                     Loc::EMPTY,
-                    "patchfile <b>{}<r> is empty, please restore or delete it.",
-                    BStr::new(absolute_patchfile_path.as_bytes()),
+                    format_args!("failed to read patch file: {}", e),
                 );
                 return None;
             }
diff --git a/src/install/resolvers/folder_resolver.rs b/src/install/resolvers/folder_resolver.rs
index d75d0c9c96df..e81504332ad2 100644
--- a/src/install/resolvers/folder_resolver.rs
+++ b/src/install/resolvers/folder_resolver.rs
@@ -2,7 +2,7 @@ use core::fmt;
 
 use bun_core::fmt::QuotedFormatter;
 use bun_core::{ZStr, strings};
-use bun_paths::{self, MAX_PATH_BYTES, PathBuffer, SEP, SEP_STR};
+use bun_paths::{self, PathBuffer, SEP, SEP_STR, resolve_path};
 use bun_resolver::fs::FileSystem;
 use bun_semver::{self as semver, String as SemverString};
 use bun_sys::{self, Fd, File, O};
@@ -35,7 +35,6 @@ pub(crate) struct PackageWorkspaceSearchPathFormatter<'a> {
 
 impl<'a> fmt::Display for PackageWorkspaceSearchPathFormatter<'a> {
     fn fmt(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result {
-        let mut joined = [0u8; MAX_PATH_BYTES + 2];
         // Caller constructs this formatter only when
         // `self.version.tag == .workspace`.
         let workspace = self.version.workspace();
@@ -48,34 +47,38 @@ impl<'a> fmt::Display for PackageWorkspaceSearchPathFormatter<'a> {
             ))
             .unwrap_or(workspace);
 
-        // SAFETY: joined[2..] is exactly MAX_PATH_BYTES bytes long.
-        let joined_path: &mut PathBuffer =
-            unsafe { &mut *joined.as_mut_ptr().add(2).cast::<PathBuffer>() };
-        let mut paths = normalize_package_json_path(
-            GlobalOrRelative::Relative(dependency::version::Tag::Workspace),
-            joined_path,
-            self.manager.lockfile.str(str_to_use),
-        );
+        let search_path = self.manager.lockfile.str(str_to_use);
 
-        if !strings::starts_with_char(paths.rel, b'.') && !strings::starts_with_char(paths.rel, SEP)
-        {
-            joined[0] = b'.';
-            joined[1] = SEP;
-            // `paths.rel` points into `joined[2..]`; extend the view backward
-            // by the two bytes just written via safe slicing of `joined`.
-            let n = paths.rel.len() + 2;
-            paths.rel = &joined[..n];
-        }
+        let mut joined = PathBuffer::uninit();
+        let mut dot_slash_rel = Vec::new();
+        let rel: &[u8] = match normalize_package_json_path(
+            GlobalOrRelative::Relative(dependency::version::Tag::Workspace),
+            &mut joined,
+            search_path,
+        ) {
+            Some(paths)
+                if !strings::starts_with_char(paths.rel, b'.')
+                    && !strings::starts_with_char(paths.rel, SEP) =>
+            {
+                dot_slash_rel.push(b'.');
+                dot_slash_rel.push(SEP);
+                dot_slash_rel.extend_from_slice(paths.rel);
+                dot_slash_rel.as_slice()
+            }
+            Some(paths) => paths.rel,
+            // Too long to be a path; show it as written.
+            None => search_path,
+        };
 
         if self.quoted {
-            let quoted = QuotedFormatter { text: paths.rel };
+            let quoted = QuotedFormatter { text: rel };
             fmt::Display::fmt(&quoted, f)
         } else {
             // `fmt::Formatter` only accepts `&str`, so non-UTF-8 path bytes are emitted lossily
             // (U+FFFD) via `bstr::BStr`'s Display. Both current callers pass
             // `quoted = true`, so this branch is unreached today; if a future
             // caller needs byte-exact output it must use an `io::Write` sink.
-            write!(f, "{}", bstr::BStr::new(paths.rel))
+            write!(f, "{}", bstr::BStr::new(rel))
         }
     }
 }
@@ -92,10 +95,6 @@ pub struct Entry {
 // bun_collections::HashMap currently ignores the context/load-factor
 // type params (backed by std HashMap); identity hashing is a TODO(perf).
 
-fn normalize(path: &[u8]) -> &[u8] {
-    FileSystem::instance().normalize(path)
-}
-
 pub(crate) fn hash(normalized_path: &[u8]) -> u64 {
     bun_wyhash::hash(normalized_path)
 }
@@ -177,84 +176,80 @@ struct Paths<'a> {
     rel: &'a [u8],
 }
 
+/// Returns `None` when the `package.json` path does not fit `joined`.
 fn normalize_package_json_path<'a>(
     global_or_relative: GlobalOrRelative<'_>,
     joined: &'a mut PathBuffer,
     non_normalized_path: &[u8],
-) -> Paths<'a> {
-    let abs: &[u8];
-
+) -> Option<Paths<'a>> {
+    let mut normalize_spill = Vec::new();
     // We consider it valid if there is a package.json in the folder
-    let normalized: &[u8] = if non_normalized_path.len() == 1 && non_normalized_path[0] == b'.' {
+    let normalized: &[u8] = if non_normalized_path == b"." {
         non_normalized_path
     } else if bun_paths::is_absolute(non_normalized_path) {
         strings::trim_right(non_normalized_path, SEP_STR.as_bytes())
     } else {
-        strings::trim_right(normalize(non_normalized_path), SEP_STR.as_bytes())
+        strings::trim_right(
+            resolve_path::normalize_string_spill::<true, bun_paths::platform::Auto>(
+                &mut normalize_spill,
+                non_normalized_path,
+            ),
+            SEP_STR.as_bytes(),
+        )
     };
 
     const PACKAGE_JSON_LEN: usize = "/package.json".len();
 
-    let rel: &[u8] = if strings::starts_with_char(normalized, b'.') {
-        let mut tempcat = PathBuffer::uninit();
-
-        tempcat[..normalized.len()].copy_from_slice(normalized);
-        tempcat[normalized.len()] = SEP;
-        tempcat[normalized.len() + 1..normalized.len() + PACKAGE_JSON_LEN]
-            .copy_from_slice(b"package.json");
-        let parts: [&[u8]; 2] = [
-            FileSystem::instance().top_level_dir(),
-            &tempcat[0..normalized.len() + PACKAGE_JSON_LEN],
-        ];
-        abs = FileSystem::instance().abs_buf(&parts, joined);
-        FileSystem::instance().relative(
-            FileSystem::instance().top_level_dir(),
-            &abs[0..abs.len() - PACKAGE_JSON_LEN],
-        )
+    // The last byte of `joined` is reserved for the NUL terminator.
+    let capacity = joined.len() - 1;
+
+    let abs_len = if strings::starts_with_char(normalized, b'.') {
+        let parts: [&[u8]; 2] = [normalized, b"package.json"];
+        FileSystem::instance()
+            .abs_buf_checked(&parts, &mut joined[..capacity])?
+            .len()
     } else {
-        let joined_len = joined.len();
-        let mut remain: &mut [u8] = &mut joined[..];
-        match &global_or_relative {
-            GlobalOrRelative::Global(path) | GlobalOrRelative::CacheFolder(path) => {
-                if !path.is_empty() {
-                    let offset = path
-                        .len()
-                        .saturating_sub((path[path.len().saturating_sub(1)] == SEP) as usize);
-                    if offset > 0 {
-                        remain[0..offset].copy_from_slice(&path[0..offset]);
-                    }
-                    remain = &mut remain[offset..];
-                    if !normalized.is_empty() {
-                        if (path[path.len() - 1] != SEP) && (normalized[0] != SEP) {
-                            remain[0] = SEP;
-                            remain = &mut remain[1..];
-                        }
-                    }
-                }
+        let (prefix, needs_sep): (&[u8], bool) = match global_or_relative {
+            GlobalOrRelative::Global(path) | GlobalOrRelative::CacheFolder(path)
+                if !path.is_empty() =>
+            {
+                let ends_with_sep = path[path.len() - 1] == SEP;
+                (
+                    &path[..path.len() - ends_with_sep as usize],
+                    !normalized.is_empty() && !ends_with_sep && normalized[0] != SEP,
+                )
             }
-            GlobalOrRelative::Relative(_) => {}
+            _ => (b"", false),
+        };
+        let abs_len = prefix.len() + needs_sep as usize + normalized.len() + PACKAGE_JSON_LEN;
+        if abs_len > capacity {
+            return None;
         }
-        remain[..normalized.len()].copy_from_slice(normalized);
-        remain[normalized.len()] = SEP;
-        remain[normalized.len() + 1..normalized.len() + PACKAGE_JSON_LEN]
-            .copy_from_slice(b"package.json");
-        let remain_after = remain.len() - (normalized.len() + PACKAGE_JSON_LEN);
-        // Compute abs len from remaining capacity.
-        let abs_len = joined_len - remain_after;
-        abs = &joined[0..abs_len];
-        // We store the folder name without package.json
-        FileSystem::instance().relative(
-            FileSystem::instance().top_level_dir(),
-            &abs[0..abs.len() - PACKAGE_JSON_LEN],
-        )
+
+        let mut len = prefix.len();
+        joined[..len].copy_from_slice(prefix);
+        if needs_sep {
+            joined[len] = SEP;
+            len += 1;
+        }
+        joined[len..len + normalized.len()].copy_from_slice(normalized);
+        len += normalized.len();
+        joined[len] = SEP;
+        joined[len + 1..len + PACKAGE_JSON_LEN].copy_from_slice(b"package.json");
+        abs_len
     };
-    let abs_len = abs.len();
+
+    // We store the folder name without package.json
+    let rel = FileSystem::instance().relative(
+        FileSystem::instance().top_level_dir(),
+        &joined[..abs_len - PACKAGE_JSON_LEN],
+    );
     joined[abs_len] = 0;
 
-    Paths {
+    Some(Paths {
         abs: ZStr::from_buf(joined, abs_len),
         rel,
-    }
+    })
 }
 
 fn read_package_json_from_disk<R: FolderResolverImpl>(
@@ -386,7 +381,11 @@ pub(crate) fn get_or_put(
     let mut joined = PathBuffer::uninit();
     #[cfg(windows)]
     let mut rel_buf = PathBuffer::uninit();
-    let paths = normalize_package_json_path(global_or_relative, &mut joined, non_normalized_path);
+    let Some(paths) =
+        normalize_package_json_path(global_or_relative, &mut joined, non_normalized_path)
+    else {
+        return FolderResolution::Err(crate::Error::Sys(bun_errno::SystemErrno::ENAMETOOLONG));
+    };
 
     #[cfg(not(windows))]
     let abs = paths.abs;
@@ -435,10 +434,10 @@ pub(crate) fn get_or_put(
 
     let result: crate::Result<LockfilePackage> = match global_or_relative {
         GlobalOrRelative::Global(_) => 'global: {
-            let mut path = PathBuffer::uninit();
-            path[..non_normalized_path.len()].copy_from_slice(non_normalized_path);
+            // `non_normalized_path` may alias the lockfile string buffer, which grows below.
+            let folder_path: Box<[u8]> = Box::from(non_normalized_path);
             let mut resolver: SymlinkResolver = NewResolver {
-                folder_path: &path[0..non_normalized_path.len()],
+                folder_path: &folder_path,
             };
             break 'global read_package_json_from_disk(
                 manager,
diff --git a/src/resolver/lib.rs b/src/resolver/lib.rs
index 208c1678127e..b9ef626b8bd1 100644
--- a/src/resolver/lib.rs
+++ b/src/resolver/lib.rs
@@ -427,14 +427,6 @@ pub mod fs {
             }
         }
 
-        /// Normalizes `str` in the shared scratch space, returning the input
-        /// unchanged when already normalized.
-        #[inline]
-        pub fn normalize<'a>(&self, str: &'a [u8]) -> &'a [u8] {
-            use bun_paths::resolve_path::{normalize_string, platform};
-            normalize_string::<true, platform::Auto>(str)
-        }
-
         /// The process-global directory-name interning store.
         #[inline]
         pub fn dirname_store(&self) -> &'static DirnameStore {
diff --git a/test/cli/install/bun-install-patch.test.ts b/test/cli/install/bun-install-patch.test.ts
index 663a31dd7eb3..b79de709cf38 100644
--- a/test/cli/install/bun-install-patch.test.ts
+++ b/test/cli/install/bun-install-patch.test.ts
@@ -1,7 +1,7 @@
 import { $ } from "bun";
 import { describe, expect, it, setDefaultTimeout, test } from "bun:test";
 import { rmSync } from "fs";
-import { bunEnv, bunExe, normalizeBunSnapshot as normalizeBunSnapshot_, tempDir } from "harness";
+import { bunEnv, bunExe, isWindows, normalizeBunSnapshot as normalizeBunSnapshot_, tempDir } from "harness";
 import { join } from "path";
 
 const normalizeBunSnapshot = (str: string) => {
@@ -1119,3 +1119,36 @@ describe("patchedDependencies contents_hash", () => {
     expect({ hasB: mB.includes("TAIL_BBBB"), hasA: mB.includes("TAIL_AAAA") }).toEqual({ hasB: true, hasA: false });
   });
 });
+
+describe("patchedDependencies path longer than the path buffer", () => {
+  // Hashing a patch joins its path onto the project directory in a path buffer
+  // (4096 bytes on Linux, 1024 on macOS, ~96 KiB on Windows). The join used to
+  // write past the buffer for a path that did not fit, aborting the install.
+  const longName = Buffer.alloc(100_000, "p").toString();
+
+  test("install reports the path instead of crashing", async () => {
+    using dir = tempDir("patch-path-too-long", {
+      "package.json": JSON.stringify({
+        name: "patch-path-too-long",
+        patchedDependencies: { "is-odd@3.0.1": `patches/${longName}.patch` },
+      }),
+    });
+
+    await using proc = Bun.spawn({
+      cmd: [bunExe(), "install"],
+      cwd: String(dir),
+      env: bunEnv,
+      stdout: "pipe",
+      stderr: "pipe",
+    });
+    const [, stderr, exitCode] = await Promise.all([proc.stdout.text(), proc.stderr.text(), proc.exited]);
+
+    // The path is handed to the OS as is. POSIX rejects anything longer than
+    // PATH_MAX with ENAMETOOLONG; Windows may report it as missing instead.
+    if (!isWindows) {
+      expect(stderr).toContain("error: failed to read patch file: ENAMETOOLONG: ");
+    }
+    expect(stderr).toContain(`${longName}.patch`);
+    expect(exitCode).toBe(1);
+  });
+});
diff --git a/test/cli/install/bun-install.test.ts b/test/cli/install/bun-install.test.ts
index c7d98aab03f0..81b92513c577 100644
--- a/test/cli/install/bun-install.test.ts
+++ b/test/cli/install/bun-install.test.ts
@@ -6,6 +6,7 @@ import {
   bunEnv,
   bunExe,
   bunEnv as env,
+  isLinux,
   isWindows,
   joinP,
   normalizeBunSnapshot,
@@ -10321,6 +10322,64 @@ it("does not install transitive file: dependencies with overlong folder targets"
   expect(exitCode).toBe(1);
 });
 
+// Resolving a folder dependency appends "/package.json" and a NUL to its absolute path in a
+// path buffer (4096 bytes on Linux, 1024 on macOS). The absolute path itself is checked
+// against the buffer when package.json is parsed, but the appended bytes were not, so a
+// folder path within 13 bytes of the buffer size aborted the install. Windows' buffer is
+// larger than any path the OS accepts, so the boundary cannot be reached there.
+describe.skipIf(isWindows)("file: dependency whose package.json path is around the path buffer size", () => {
+  const PATH_BUFFER_BYTES = isLinux ? 4096 : 1024;
+
+  // A relative path of exactly `bytes` bytes made of one letter directory names, so that a
+  // path which fits the buffer is rejected by the OS as missing, not as too long.
+  function pathOfLength(bytes: number) {
+    const tail = bytes % 2 === 0 ? "dd" : "d";
+    return Buffer.alloc(bytes - tail.length, "d/").toString() + tail;
+  }
+
+  // `packageJsonPathBytes` is the length of `<project>/<folder>/package.json`.
+  async function installFolderDependency(projectDir: string, packageJsonPathBytes: number) {
+    const folder = pathOfLength(
+      packageJsonPathBytes - Buffer.byteLength(projectDir) - "/".length - "/package.json".length,
+    );
+    await writeFile(
+      join(projectDir, "package.json"),
+      JSON.stringify({ name: "my-app", dependencies: { dep: `file:./${folder}` } }),
+    );
+    await using proc = spawn({
+      cmd: [bunExe(), "install"],
+      cwd: projectDir,
+      stdout: "pipe",
+      stderr: "pipe",
+      env,
+    });
+    const [, err, exitCode] = await Promise.all([proc.stdout.text(), proc.stderr.text(), proc.exited]);
+    return { folder, err, exitCode };
+  }
+
+  it("is looked up on disk when the path and its NUL terminator fit", async () => {
+    using dir = tempDir("file-dep-path-buffer-fits", {});
+
+    const { folder, err, exitCode } = await installFolderDependency(String(dir), PATH_BUFFER_BYTES - 1);
+
+    expect(err).toContain(`error: Could not find package.json for "file:${folder}"`);
+    expect(exitCode).toBe(1);
+  });
+
+  it.each([
+    ["exactly the buffer size, leaving no room for the NUL terminator", 0],
+    // The folder path alone fits; "/package.json" is what does not.
+    ['longer than the buffer by less than the appended "/package.json"', 8],
+  ])("fails with ENAMETOOLONG when it is %s", async (_, extraBytes) => {
+    using dir = tempDir("file-dep-path-buffer-overflow", {});
+
+    const { err, exitCode } = await installFolderDependency(String(dir), PATH_BUFFER_BYTES + extraBytes);
+
+    expect(err).toContain("error: ENAMETOOLONG");
+    expect(exitCode).toBe(1);
+  });
+});
+
 for (const field of ["resolutions", "overrides"]) {
   it(`installs a file: dependency pointing outside the project when it came from root package.json "${field}"`, async () => {
     // `overrides` / `resolutions` can only be declared in the root package.json,
diff --git a/test/cli/install/bun-link.test.ts b/test/cli/install/bun-link.test.ts
index 8a937dad63fd..0863bf41d813 100644
--- a/test/cli/install/bun-link.test.ts
+++ b/test/cli/install/bun-link.test.ts
@@ -1,5 +1,5 @@
 import { file, spawn } from "bun";
-import { afterAll, afterEach, beforeAll, beforeEach, expect, it } from "bun:test";
+import { afterAll, afterEach, beforeAll, beforeEach, describe, expect, it } from "bun:test";
 import { access, mkdir, writeFile } from "fs/promises";
 import {
   bunExe,
@@ -471,3 +471,89 @@ it("should link dependency without crashing", async () => {
   // This should fail with a non-zero exit code.
   expect(await exited4).toBe(1);
 });
+
+// A `link:` target is normalized and joined onto the global link directory in
+// fixed-size buffers (the normalizer's is 1024 bytes, the others are a path
+// buffer). These used to be written without a length check, so a long enough
+// specifier aborted `bun install` instead of failing the dependency.
+describe("link: specifier longer than the path buffers", () => {
+  // Longer than every buffer on every platform (the Windows path buffer is ~96 KiB).
+  const LONG_SPEC_BYTES = 100_000;
+
+  async function run(cwd: string, ...args: string[]) {
+    await using proc = spawn({
+      cmd: [bunExe(), ...args],
+      cwd,
+      stdout: "pipe",
+      stderr: "pipe",
+      env,
+    });
+    const [out, err, exitCode] = await Promise.all([proc.stdout.text(), proc.stderr.text(), proc.exited]);
+    return { out, err, exitCode };
+  }
+
+  it("fails to resolve a name that does not fit", async () => {
+    const target = Buffer.alloc(LONG_SPEC_BYTES, "n").toString();
+    await writeFile(
+      join(package_dir, "package.json"),
+      JSON.stringify({ name: "foo", version: "0.0.1", dependencies: { bar: `link:${target}` } }),
+    );
+
+    const { err, exitCode } = await run(package_dir, "install");
+
+    expect(err).toContain("error: ENAMETOOLONG");
+    expect(err).toContain("error: bar@link:" + target.slice(0, 64));
+    expect(exitCode).toBe(1);
+  });
+
+  // `x/../` segments normalize away, so this resolves to the linked package, but
+  // the specifier itself (which is what gets linked) is still too long for a path.
+  it("fails to install a linked package whose specifier only fits once normalized", async () => {
+    const link_name = basename(link_dir).slice("bun-link.".length);
+    await writeFile(join(link_dir, "package.json"), JSON.stringify({ name: link_name, version: "0.0.1" }));
+    const registered = await run(link_dir, "link");
+    expect(registered.err).toBe("");
+    expect(registered.out).toContain(`Success! Registered "${link_name}"`);
+    expect(registered.exitCode).toBe(0);
+
+    try {
+      const target = Buffer.alloc(LONG_SPEC_BYTES, "x/../").toString() + link_name;
+      await writeFile(
+        join(package_dir, "package.json"),
+        JSON.stringify({ name: "foo", version: "0.0.1", dependencies: { [link_name]: `link:${target}` } }),
+      );
+
+      const { out, err, exitCode } = await run(package_dir, "install");
+
+      expect(err).toContain(`ENAMETOOLONG: link path for package ${link_name} is too long`);
+      expect(out).toContain("Failed to install 1 package");
+      expect(await file(join(package_dir, "node_modules", link_name, "package.json")).exists()).toBe(false);
+      expect(exitCode).toBe(1);
+
+      // Like the other per-package failures, the error respects --silent.
+      expect(await run(package_dir, "install", "--silent")).toEqual({ out: "", err: "", exitCode: 1 });
+    } finally {
+      await run(link_dir, "unlink");
+    }
+  });
+
+  it("still resolves a specifier that normalizes to a linked package", async () => {
+    const link_name = basename(link_dir).slice("bun-link.".length);
+    await writeFile(
+      join(package_dir, "package.json"),
+      JSON.stringify({
+        name: "foo",
+        version: "0.0.1",
+        dependencies: { [link_name]: "link:" + Buffer.alloc(LONG_SPEC_BYTES, "x/../").toString() + link_name },
+      }),
+    );
+
+    // Nothing is registered under this name: resolution gets as far as looking
+    // the name up in the link directory, like `link:${link_name}` would.
+    const { err, exitCode } = await run(package_dir, "install");
+
+    expect(err).toContain(`error: Package "${link_name}" is not linked`);
+    expect(err).not.toContain("ENAMETOOLONG");
+    expect(exitCode).toBe(1);
+  });
+});
diff --git a/test/cli/install/bun-workspaces.test.ts b/test/cli/install/bun-workspaces.test.ts
index 562e1ded1f3e..8b7b3758d672 100644
--- a/test/cli/install/bun-workspaces.test.ts
+++ b/test/cli/install/bun-workspaces.test.ts
@@ -591,6 +591,7 @@ describe("workspace aliases", async () => {
       const err = await stderr.text();
       if (version === "workspace:@org/b") {
         expect(err).toContain('Workspace dependency "a1" not found');
+        expect(err).toMatch(/Searched in "\.[\\/]packages[\\/]pkg1[\\/]@org[\\/]b"/);
       } else {
         expect(err).toContain(`No matching version for workspace dependency "a1". Version: "${version}"`);
       }

From aae3b8589f608feb01599bf14ce7871e368a1662 Mon Sep 17 00:00:00 2001
From: robobun <117481402+robobun@users.noreply.github.com>
Date: Mon, 17 Aug 2026 01:05:40 +0000
Subject: [PATCH 029/258] cli: stop aborting on --cwd and --tsconfig-override
 values longer than the path join buffer (#38368)

---
 src/paths/resolve_path.rs              | 97 +++++++++++++++++++++++---
 src/runtime/cli/Arguments.rs           | 26 ++++---
 test/cli/install/bun-run.test.ts       | 52 +++++++++++++-
 test/cli/run/tsconfig-override.test.ts | 29 +++++++-
 4 files changed, 179 insertions(+), 25 deletions(-)

diff --git a/src/paths/resolve_path.rs b/src/paths/resolve_path.rs
index 6cd439d8eea6..2720213d2014 100644
--- a/src/paths/resolve_path.rs
+++ b/src/paths/resolve_path.rs
@@ -12,11 +12,15 @@ use bun_core::{ZStr, strings};
 // SAFETY invariant: each buffer has at most one live mutable borrow per thread;
 // callers must not re-enter the accessor while a previous borrow is alive.
 thread_local! {
-    static PARSER_JOIN_INPUT_BUFFER: UnsafeCell<[u8; 4096]> = const { UnsafeCell::new([0u8; 4096]) };
+    static PARSER_JOIN_INPUT_BUFFER: UnsafeCell<[u8; PARSER_JOIN_INPUT_BUFFER_LEN]> =
+        const { UnsafeCell::new([0u8; PARSER_JOIN_INPUT_BUFFER_LEN]) };
     static PARSER_BUFFER: UnsafeCell<[u8; PARSER_BUFFER_LEN]> =
         const { UnsafeCell::new([0u8; PARSER_BUFFER_LEN]) };
 }
 
+/// Output capacity of [`join_abs_string`] / [`join_abs_string_z`].
+const PARSER_JOIN_INPUT_BUFFER_LEN: usize = 4096;
+
 /// Output capacity of [`normalize_string`].
 const PARSER_BUFFER_LEN: usize = 1024;
 
@@ -1379,6 +1383,24 @@ pub fn join_abs_string<'a, P: PlatformT>(cwd: &'a [u8], parts: &[&[u8]]) -> &'a
     PARSER_JOIN_INPUT_BUFFER.with(|b| join_abs_string_buf::<P>(cwd, tl_buf_mut(b), parts))
 }
 
+/// [`join_abs_string`] (thread-local buffer) when the result fits, otherwise
+/// into `spill` (grown as needed). `spill` is untouched in the common case.
+pub fn join_abs_string_spill<'a, P: PlatformT>(
+    cwd: &'a [u8],
+    spill: &'a mut Vec<u8>,
+    parts: &[&[u8]],
+) -> &'a [u8] {
+    debug_assert!(!matches!(P::P, Platform::Nt));
+    let needed = join_abs_needed(cwd.len(), parts);
+    if needed <= PARSER_JOIN_INPUT_BUFFER_LEN {
+        return join_abs_string::<P>(cwd, parts);
+    }
+    if spill.len() < needed {
+        spill.resize(needed, 0);
+    }
+    join_abs_string_buf::<P>(cwd, &mut spill[..], parts)
+}
+
 /// Convert parts of potentially invalid file paths into a single valid filpeath
 /// without querying the filesystem
 /// This is the equivalent of path.resolve
@@ -1591,6 +1613,14 @@ fn join_string_buf_t<'a, T: PathChar, P: PlatformT>(buf: &'a mut [T], parts: &[&
     normalize_string_node_t::<T, P>(&temp_buf[0..written], buf)
 }
 
+/// Buffer length that holds `_join_abs_string_buf`'s concatenation of `cwd` and
+/// `parts` (one separator each, plus the one a bare Windows root gains) as well
+/// as its normalized output.
+#[inline]
+fn join_abs_needed(cwd_len: usize, parts: &[&[u8]]) -> usize {
+    parts.iter().map(|p| p.len() + 1).sum::<usize>() + cwd_len + 2
+}
+
 /// Scratch buffer for `_join_abs_string_buf`'s unnormalized concatenation.
 /// Draws from the
 /// thread-local `path_buffer_pool` for the common case and only heap-allocates
@@ -1604,10 +1634,7 @@ enum JoinScratch {
 impl JoinScratch {
     #[inline]
     fn init(base: usize, parts: &[&[u8]]) -> Self {
-        let mut total = base + 2;
-        for p in parts {
-            total += p.len() + 1;
-        }
+        let total = join_abs_needed(base, parts);
         if total <= MAX_PATH_BYTES {
             JoinScratch::Pooled(crate::path_buffer_pool::get())
         } else {
@@ -1645,10 +1672,7 @@ pub fn join_abs_string_buf_checked<'a, P: PlatformT>(
     debug_assert!(!matches!(P::P, Platform::Nt));
     // Fast path: size check only — don't allocate a JoinScratch here since the
     // inner join_abs_string_buf already has its own (avoids doubling stack usage).
-    let mut total: usize = cwd.len() + 2;
-    for p in parts {
-        total += p.len() + 1;
-    }
+    let total = join_abs_needed(cwd.len(), parts);
     if total < buf.len() {
         return Some(join_abs_string_buf::<P>(cwd, buf, parts));
     }
@@ -2542,6 +2566,61 @@ mod tests {
         );
     }
 
+    #[test]
+    fn join_abs_string_spill_leaves_spill_untouched_when_the_result_fits() {
+        let mut spill = Vec::new();
+        let out = join_abs_string_spill::<platform::Posix>(b"/work", &mut spill, &[b"a/../b.json"]);
+        assert_eq!(out, b"/work/b.json");
+        assert!(spill.is_empty());
+    }
+
+    #[test]
+    fn join_abs_string_spill_spills_a_part_longer_than_the_thread_local_buffer() {
+        let name = vec![b'a'; PARSER_JOIN_INPUT_BUFFER_LEN + 1];
+        let mut expected = b"/work/".to_vec();
+        expected.extend_from_slice(&name);
+
+        let mut spill = Vec::new();
+        let out = join_abs_string_spill::<platform::Posix>(b"/work", &mut spill, &[&name]);
+        assert_eq!(out, &expected[..]);
+        assert!(!spill.is_empty());
+    }
+
+    #[test]
+    fn join_abs_string_spill_spills_an_absolute_part_and_a_long_cwd_alike() {
+        let mut abs = b"/".to_vec();
+        abs.resize(PARSER_JOIN_INPUT_BUFFER_LEN * 2, b'a');
+        let mut spill = Vec::new();
+        assert_eq!(
+            join_abs_string_spill::<platform::Posix>(b"/", &mut spill, &[&abs]),
+            &abs[..]
+        );
+
+        let mut cwd = b"/".to_vec();
+        cwd.resize(PARSER_JOIN_INPUT_BUFFER_LEN, b'c');
+        let mut expected = cwd.clone();
+        expected.extend_from_slice(b"/x");
+        let mut spill = Vec::new();
+        assert_eq!(
+            join_abs_string_spill::<platform::Posix>(&cwd, &mut spill, &[b"./x"]),
+            &expected[..]
+        );
+    }
+
+    #[test]
+    fn join_abs_string_spill_normalizes_a_long_part_that_collapses() {
+        // `sub/../` repeated past the buffer size resolves back to the cwd.
+        let mut part = Vec::new();
+        while part.len() <= PARSER_JOIN_INPUT_BUFFER_LEN {
+            part.extend_from_slice(b"sub/../");
+        }
+        part.extend_from_slice(b"sub");
+
+        let mut spill = Vec::new();
+        let out = join_abs_string_spill::<platform::Posix>(b"/work", &mut spill, &[&part]);
+        assert_eq!(out, b"/work/sub");
+    }
+
     #[test]
     fn normalize_string_spill_accounts_for_outputs_that_grow_by_one_byte() {
         // A bare UNC volume exactly as long as the thread-local buffer
diff --git a/src/runtime/cli/Arguments.rs b/src/runtime/cli/Arguments.rs
index ab0fc39e9b37..d95d08a9fe88 100644
--- a/src/runtime/cli/Arguments.rs
+++ b/src/runtime/cli/Arguments.rs
@@ -836,9 +836,10 @@ pub(crate) fn parse(cmd: CommandTag, ctx: Context<'_>) -> crate::Result<api::Tra
         } else {
             bun_core::getcwd(&mut outbuf)?.as_bytes()
         };
-        let out = resolve_path::join_abs::<platform::Loose>(base, cwd_arg);
-        // `chdir` wants a NUL-terminated path; `join_abs` returns a borrowed
-        // slice into a threadlocal buffer, so dupe-Z once and reuse for both
+        let mut spill = Vec::new();
+        let out =
+            resolve_path::join_abs_string_spill::<platform::Loose>(base, &mut spill, &[cwd_arg]);
+        // `chdir` wants a NUL-terminated path, so dupe-Z once and reuse for both
         // the `chdir` arg and the stored `absolute_working_dir`.
         let out_z = bun_core::ZBox::from_bytes(out);
         if let bun_sys::Result::Err(err) = bun_sys::chdir(&out_z) {
@@ -963,17 +964,14 @@ pub(crate) fn parse(cmd: CommandTag, ctx: Context<'_>) -> crate::Result<api::Tra
         });
     }
 
-    opts.tsconfig_override = if let Some(ts) = args.option(b"--tsconfig-override") {
-        Some(
-            resolve_path::join_abs_string::<platform::Auto>(
-                ctx.args.absolute_working_dir.as_deref().unwrap(),
-                &[ts],
-            )
-            .into(),
-        )
-    } else {
-        None
-    };
+    opts.tsconfig_override = args.option(b"--tsconfig-override").map(|ts| {
+        let mut spill = Vec::new();
+        Box::from(resolve_path::join_abs_string_spill::<platform::Auto>(
+            ctx.args.absolute_working_dir.as_deref().unwrap(),
+            &mut spill,
+            &[ts],
+        ))
+    });
 
     opts.main_fields = slice_to_owned(args.options(b"--main-fields"));
     // we never actually supported inject.
diff --git a/test/cli/install/bun-run.test.ts b/test/cli/install/bun-run.test.ts
index 2dac7325e97c..9ea1f91edb2c 100644
--- a/test/cli/install/bun-run.test.ts
+++ b/test/cli/install/bun-run.test.ts
@@ -2,7 +2,7 @@ import { $ } from "bun";
 import { describe, expect, it } from "bun:test";
 import { chmodSync } from "fs";
 import { bunEnv as bunEnv_, bunExe, isWindows, tempDir, tempDirWithFiles } from "harness";
-import { join } from "path";
+import { basename, join } from "path";
 
 const bunEnv = {
   ...bunEnv_,
@@ -329,6 +329,56 @@ describe.concurrent("bun run", () => {
     expect(exitCode).toBe(0);
   });
 
+  describe("--cwd longer than the OS path limit", () => {
+    // Longer than PATH_MAX on every platform (4096 on Linux, 1024 on macOS).
+    const tooLong = Buffer.alloc(5000, "a").toString();
+
+    for (const [kind, cwdArg] of [
+      ["absolute", "/" + tooLong],
+      ["relative", tooLong],
+    ] as const) {
+      it(`${kind} value is reported as an error instead of crashing`, async () => {
+        await using proc = Bun.spawn({
+          cmd: [bunExe(), "--cwd", cwdArg, "-e", "console.log('ran')"],
+          env: bunEnv,
+          stdout: "pipe",
+          stderr: "pipe",
+        });
+
+        const [stdout, stderr, exitCode] = await Promise.all([proc.stdout.text(), proc.stderr.text(), proc.exited]);
+
+        expect(stderr).toContain(`Could not change directory to "${cwdArg}"`);
+        // Windows leaves the verdict on a path this long to SetCurrentDirectoryW.
+        if (!isWindows) expect(stderr).toContain("ENAMETOOLONG");
+        expect(stdout).toBe("");
+        expect(proc.signalCode).toBeNull();
+        expect(exitCode).toBe(1);
+      });
+    }
+
+    it("value that only normalizes down to a path that fits is honored", async () => {
+      using dir = tempDir("bun-run-cwd-normalize", {
+        "subdir/.keep": "",
+      });
+      // 6006 bytes before normalization, "subdir" after it.
+      const cwdArg = "subdir" + Buffer.alloc(6000, "/../subdir").toString();
+
+      await using proc = Bun.spawn({
+        cmd: [bunExe(), "--cwd", cwdArg, "-e", "console.log(process.cwd())"],
+        cwd: String(dir),
+        env: bunEnv,
+        stdout: "pipe",
+        stderr: "pipe",
+      });
+
+      const [stdout, stderr, exitCode] = await Promise.all([proc.stdout.text(), proc.stderr.text(), proc.exited]);
+
+      expect(stderr).toBe("");
+      expect(basename(stdout.trim())).toBe("subdir");
+      expect(exitCode).toBe(0);
+    });
+  });
+
   it("DCE annotations are respected", async () => {
     using dir = tempDir("test", {
       "index.ts": `
diff --git a/test/cli/run/tsconfig-override.test.ts b/test/cli/run/tsconfig-override.test.ts
index f5e81aa68fdc..43c7052a8882 100644
--- a/test/cli/run/tsconfig-override.test.ts
+++ b/test/cli/run/tsconfig-override.test.ts
@@ -1,5 +1,5 @@
 import { describe, expect, test } from "bun:test";
-import { bunEnv, bunExe, tempDir } from "harness";
+import { bunEnv, bunExe, isWindows, tempDir } from "harness";
 import path from "node:path";
 
 describe("bun run --tsconfig-override", () => {
@@ -302,4 +302,31 @@ describe("bun run --tsconfig-override", () => {
     }
     expect(exitCode).toBe(0);
   });
+
+  describe.concurrent("path longer than the OS path limit", () => {
+    // Longer than PATH_MAX on every platform (4096 on Linux, 1024 on macOS).
+    const tooLong = Buffer.alloc(5000, "a").toString();
+
+    for (const [kind, tsconfigArg] of [
+      ["absolute", "/" + tooLong],
+      ["relative", tooLong],
+    ] as const) {
+      test(`${kind} path is reported as unreadable instead of crashing`, async () => {
+        await using proc = Bun.spawn({
+          cmd: [bunExe(), "--tsconfig-override", tsconfigArg, "-e", "console.log('ran')"],
+          env: bunEnv,
+          stdout: "pipe",
+          stderr: "pipe",
+        });
+
+        const [stdout, stderr, exitCode] = await Promise.all([proc.stdout.text(), proc.stderr.text(), proc.exited]);
+
+        // Windows leaves the verdict on a path this long to the file system.
+        if (!isWindows) expect(stderr).toContain(`Cannot read file "${path.resolve(tsconfigArg)}": ENAMETOOLONG`);
+        expect(stdout).toBe("ran\n");
+        expect(proc.signalCode).toBeNull();
+        expect(exitCode).toBe(0);
+      });
+    }
+  });
 });

From 8ecb2925e7ff62ff8b6fb4823f067c5b9cbcf387 Mon Sep 17 00:00:00 2001
From: robobun <117481402+robobun@users.noreply.github.com>
Date: Mon, 17 Aug 2026 01:05:45 +0000
Subject: [PATCH 030/258] install: stop panicking when the cache directory
 setting does not fit the path buffer (#38390)

---
 .../PackageManagerDirectories.rs              |  78 +++++-----
 src/runtime/cli/package_manager_command.rs    |   7 +-
 test/cli/install/bun-pm.test.ts               | 133 +++++++++++++++++-
 3 files changed, 171 insertions(+), 47 deletions(-)

diff --git a/src/install/PackageManager/PackageManagerDirectories.rs b/src/install/PackageManager/PackageManagerDirectories.rs
index 8b4c09be09ca..96f5a5eb4a57 100644
--- a/src/install/PackageManager/PackageManagerDirectories.rs
+++ b/src/install/PackageManager/PackageManagerDirectories.rs
@@ -332,11 +332,14 @@ unsafe fn ensure_cache_directory(this: *mut PackageManager) -> Dir {
             // encapsulates the BackRef deref + singleton-liveness invariant.
             let env = unsafe { &*this }.env_mut();
             // SAFETY: shared read of `options`; disjoint from `cache_directory_path`.
-            let cache_dir = fetch_cache_directory_path(env, Some(unsafe { &(*this).options }));
-            // SAFETY: see fn safety contract.
-            unsafe { (*this).cache_directory_path = ZBox::from_bytes(&cache_dir.path) };
+            let opened = fetch_cache_directory_path(env, Some(unsafe { &(*this).options }))
+                .and_then(|cache_dir| {
+                    // SAFETY: see fn safety contract.
+                    unsafe { (*this).cache_directory_path = ZBox::from_bytes(&cache_dir.path) };
+                    Dir::cwd().make_open_path(&cache_dir.path, Default::default())
+                });
 
-            match Dir::cwd().make_open_path(&cache_dir.path, Default::default()) {
+            match opened {
                 Ok(d) => return d,
                 Err(_) => {
                     // SAFETY: narrow `&mut enable` projection; disjoint from
@@ -375,46 +378,35 @@ pub struct CacheDir {
     pub path: Vec<u8>,
 }
 
-pub fn fetch_cache_directory_path(env: &mut DotEnvLoader, options: Option<&Options>) -> CacheDir {
-    if let Some(dir) = env.get(b"BUN_INSTALL_CACHE_DIR") {
-        return CacheDir {
-            path: FileSystem::instance().abs(&[dir]).to_vec(),
-        };
-    }
-
-    if let Some(opts) = options {
-        if !opts.cache_directory.is_empty() {
-            return CacheDir {
-                path: FileSystem::instance().abs(&[opts.cache_directory]).to_vec(),
-            };
-        }
-    }
-
-    if let Some(dir) = env.get(b"BUN_INSTALL") {
-        let parts: [&[u8]; 3] = [dir, b"install/", b"cache/"];
-        return CacheDir {
-            path: FileSystem::instance().abs(&parts).to_vec(),
-        };
-    }
-
-    if let Some(dir) = env_var::XDG_CACHE_HOME.get() {
-        let parts: [&[u8]; 4] = [dir, b".bun/", b"install/", b"cache/"];
-        return CacheDir {
-            path: FileSystem::instance().abs(&parts).to_vec(),
-        };
-    }
-
-    if let Some(dir) = env_var::HOME.get() {
-        let parts: [&[u8]; 4] = [dir, b".bun/", b"install/", b"cache/"];
-        return CacheDir {
-            path: FileSystem::instance().abs(&parts).to_vec(),
-        };
-    }
+/// Fails with `ENAMETOOLONG` when the configured directory (user-controlled, so
+/// possibly longer than any path the OS accepts) does not fit a `PathBuffer`.
+pub fn fetch_cache_directory_path(
+    env: &mut DotEnvLoader,
+    options: Option<&Options>,
+) -> sys::Maybe<CacheDir> {
+    let parts: &[&[u8]] = if let Some(dir) = env.get(b"BUN_INSTALL_CACHE_DIR") {
+        &[dir]
+    } else if let Some(dir) = options
+        .map(|opts| opts.cache_directory)
+        .filter(|dir| !dir.is_empty())
+    {
+        &[dir]
+    } else if let Some(dir) = env.get(b"BUN_INSTALL") {
+        &[dir, b"install/", b"cache/"]
+    } else if let Some(dir) = env_var::XDG_CACHE_HOME
+        .get()
+        .or_else(|| env_var::HOME.get())
+    {
+        &[dir, b".bun/", b"install/", b"cache/"]
+    } else {
+        &[b"node_modules/.bun-cache"]
+    };
 
-    let fallback_parts: [&[u8]; 1] = [b"node_modules/.bun-cache"];
-    CacheDir {
-        path: FileSystem::instance().abs(&fallback_parts).to_vec(),
-    }
+    let mut buf = path::path_buffer_pool::get();
+    let Some(abs) = FileSystem::instance().abs_buf_checked(parts, &mut buf[..]) else {
+        return Err(sys::Error::from_code(sys::E::ENAMETOOLONG, sys::Tag::open).with_path(parts[0]));
+    };
+    Ok(CacheDir { path: abs.to_vec() })
 }
 
 // ─────────────────────── cached folder name printers ──────────────────────────
diff --git a/src/runtime/cli/package_manager_command.rs b/src/runtime/cli/package_manager_command.rs
index 62b21f210e1b..3518637edec7 100644
--- a/src/runtime/cli/package_manager_command.rs
+++ b/src/runtime/cli/package_manager_command.rs
@@ -419,9 +419,12 @@ Learn more about these at <magenta>https://bun.com/docs/cli/pm<r>.\n";
 
                 let mut process_env = bun_dotenv::Loader::init();
                 process_env.load_process()?;
-                let cache_dir = fetch_cache_directory_path(&mut process_env, None);
+                let opened =
+                    fetch_cache_directory_path(&mut process_env, None).and_then(|cache_dir| {
+                        Dir::cwd().make_open_path(&cache_dir.path, Default::default())
+                    });
                 let mut rm_buf = PathBuffer::uninit();
-                let rm_dir = match Dir::cwd().make_open_path(&cache_dir.path, Default::default()) {
+                let rm_dir = match opened {
                     Ok(d) => d,
                     Err(err) => {
                         bun_core::pretty_errorln!(
diff --git a/test/cli/install/bun-pm.test.ts b/test/cli/install/bun-pm.test.ts
index d0c54586c249..024dfdc020be 100644
--- a/test/cli/install/bun-pm.test.ts
+++ b/test/cli/install/bun-pm.test.ts
@@ -1,7 +1,7 @@
 import { spawn } from "bun";
-import { afterAll, afterEach, beforeAll, beforeEach, expect, it, test } from "bun:test";
+import { afterAll, afterEach, beforeAll, beforeEach, describe, expect, it, test } from "bun:test";
 import { exists, mkdir, writeFile } from "fs/promises";
-import { bunEnv, bunExe, bunEnv as env, readdirSorted, tempDir, tmpdirSync } from "harness";
+import { bunEnv, bunExe, bunEnv as env, isWindows, readdirSorted, tempDir, tmpdirSync } from "harness";
 import { cpSync } from "node:fs";
 import { join } from "path";
 import {
@@ -936,3 +936,132 @@ test("bun pm cache rm does not create the directory named by a project-local .en
   expect(stderr).not.toContain("error");
   expect(exitCode).toBe(0);
 });
+
+// The cache directory setting (the first one set of $BUN_INSTALL_CACHE_DIR, --cache-dir,
+// $BUN_INSTALL/install/cache, $XDG_CACHE_HOME/.bun/install/cache, $HOME/.bun/install/cache) is
+// joined into a path buffer of MAX_PATH_BYTES: 4096 bytes on Linux, 1024 on macOS. A value that
+// does not fit is unusable in the same way as a directory the OS refuses to create, and bun falls
+// back to node_modules/.cache of the project like it does for those. On Windows the buffer holds
+// more than an environment variable or argument can carry.
+describe.concurrent.skipIf(isWindows)("cache directory setting longer than the path buffer", () => {
+  // Longer than the buffer on every POSIX platform (the Linux one is the largest).
+  const tooLong = "/" + Buffer.alloc(2 * 4096, "a").toString();
+
+  const project = {
+    "package.json": JSON.stringify({ name: "pm-cache-too-long", version: "1.0.0" }),
+    // $XDG_CONFIG_HOME stands in for $HOME when bun looks for .npmrc and .bunfig.toml, so the
+    // oversized $HOME below is only ever used as a cache directory candidate.
+    "config/.npmrc": "",
+  };
+
+  // Every lower precedence setting points at a usable directory: the fallback must be
+  // node_modules/.cache, not the next candidate.
+  function cacheEnv(dir: string, setting: Record<string, string>): NodeJS.Dict<string> {
+    const spawnEnv: NodeJS.Dict<string> = {
+      ...env,
+      HOME: join(dir, "home"),
+      XDG_CONFIG_HOME: join(dir, "config"),
+    };
+    delete spawnEnv.BUN_INSTALL_CACHE_DIR;
+    delete spawnEnv.BUN_INSTALL;
+    delete spawnEnv.XDG_CACHE_HOME;
+    return { ...spawnEnv, ...setting };
+  }
+
+  async function runPm(dir: string, args: string[], setting: Record<string, string>) {
+    await using proc = Bun.spawn({
+      cmd: [bunExe(), "pm", ...args],
+      cwd: dir,
+      env: cacheEnv(dir, setting),
+      stdout: "pipe",
+      stderr: "pipe",
+    });
+    const [stdout, stderr, exitCode] = await Promise.all([proc.stdout.text(), proc.stderr.text(), proc.exited]);
+    return { stdout, stderr, exitCode };
+  }
+
+  test.each(["BUN_INSTALL_CACHE_DIR", "BUN_INSTALL", "XDG_CACHE_HOME", "HOME"])(
+    "bun pm cache falls back to node_modules/.cache when $%s does not fit",
+    async name => {
+      using dir = tempDir("pm-cache-too-long", project);
+
+      const { stdout, stderr, exitCode } = await runPm(String(dir), ["cache"], { [name]: tooLong });
+
+      expect(stderr).toBe("");
+      expect(stdout).toBe(join(String(dir), "node_modules", ".cache"));
+      expect(exitCode).toBe(0);
+    },
+  );
+
+  test("bun pm cache falls back to node_modules/.cache when --cache-dir does not fit", async () => {
+    using dir = tempDir("pm-cache-too-long-flag", project);
+
+    const { stdout, stderr, exitCode } = await runPm(String(dir), ["--cache-dir", tooLong, "cache"], {});
+
+    expect(stderr).toBe("");
+    expect(stdout).toBe(join(String(dir), "node_modules", ".cache"));
+    expect(exitCode).toBe(0);
+  });
+
+  // A directory that fits the buffer but that the OS rejects (one name longer than NAME_MAX) has
+  // always been handled this way; the oversized values above take the same route.
+  test("bun pm cache falls back to node_modules/.cache when the OS rejects the directory", async () => {
+    using dir = tempDir("pm-cache-os-rejects", project);
+    const tooLongForTheOS = join(String(dir), Buffer.alloc(300, "a").toString());
+
+    const { stdout, stderr, exitCode } = await runPm(String(dir), ["cache"], {
+      BUN_INSTALL_CACHE_DIR: tooLongForTheOS,
+    });
+
+    expect(stderr).toBe("");
+    expect(stdout).toBe(join(String(dir), "node_modules", ".cache"));
+    expect(exitCode).toBe(0);
+  });
+
+  // What has to fit the buffer is the normalized directory, not the value as written.
+  test("bun pm cache uses a directory that only fits the path buffer once normalized", async () => {
+    using dir = tempDir("pm-cache-long-normalized", project);
+    const cacheDir = `${String(dir)}/${Buffer.alloc("x/../".length * 2000, "x/../").toString()}cache`;
+
+    const { stdout, stderr, exitCode } = await runPm(String(dir), ["cache"], { BUN_INSTALL_CACHE_DIR: cacheDir });
+
+    expect(stderr).toBe("");
+    expect(stdout).toBe(join(String(dir), "cache"));
+    expect(exitCode).toBe(0);
+  });
+
+  // `bun pm cache rm` has no fallback: it reports the directory it could not open.
+  test("bun pm cache rm reports ENAMETOOLONG when $BUN_INSTALL_CACHE_DIR does not fit", async () => {
+    using dir = tempDir("pm-cache-rm-too-long", project);
+
+    const { stdout, stderr, exitCode } = await runPm(String(dir), ["cache", "rm"], { BUN_INSTALL_CACHE_DIR: tooLong });
+
+    expect(stderr).toContain("ENAMETOOLONG getting cache directory");
+    expect(stdout).toBe("");
+    expect(exitCode).toBe(1);
+    expect(await exists(join(String(dir), "node_modules"))).toBeFalse();
+  });
+
+  test("bun install falls back to node_modules/.cache when $BUN_INSTALL_CACHE_DIR does not fit", async () => {
+    using dir = tempDir("pm-cache-too-long-install", {
+      ...project,
+      "package.json": JSON.stringify({ name: "pm-cache-too-long", dependencies: { moo: "./moo" } }),
+      "moo/package.json": JSON.stringify({ name: "moo", version: "0.1.0" }),
+    });
+
+    await using proc = Bun.spawn({
+      cmd: [bunExe(), "install"],
+      cwd: String(dir),
+      env: cacheEnv(String(dir), { BUN_INSTALL_CACHE_DIR: tooLong }),
+      stdout: "pipe",
+      stderr: "pipe",
+    });
+    const [stdout, stderr, exitCode] = await Promise.all([proc.stdout.text(), proc.stderr.text(), proc.exited]);
+
+    expect(stderr).not.toContain("error");
+    expect(stdout).toContain("1 package installed");
+    expect(exitCode).toBe(0);
+    expect(await exists(join(String(dir), "node_modules", "moo", "package.json"))).toBeTrue();
+    expect(await exists(join(String(dir), "node_modules", ".cache"))).toBeTrue();
+  });
+});

From c3c6e24a60ece6d407973fe705e4bc124d112716 Mon Sep 17 00:00:00 2001
From: robobun <117481402+robobun@users.noreply.github.com>
Date: Mon, 17 Aug 2026 01:05:49 +0000
Subject: [PATCH 031/258] install: stop panicking when a progress bar name is
 longer than its buffer (#38558)

---
 src/bun_core/Progress.rs                      |  5 +-
 src/bun_core/string/immutable.rs              | 28 ++++++
 src/install/PackageManager/ProgressStrings.rs | 29 ++++---
 test/cli/install/bun-install.test.ts          | 85 +++++++++++++++++++
 4 files changed, 129 insertions(+), 18 deletions(-)

diff --git a/src/bun_core/Progress.rs b/src/bun_core/Progress.rs
index a80dbf1ea1b7..44588bf6af5e 100644
--- a/src/bun_core/Progress.rs
+++ b/src/bun_core/Progress.rs
@@ -194,10 +194,7 @@ pub enum Unit {
 pub struct Node {
     pub(crate) context: *mut Progress,
     pub(crate) parent: *mut Node,
-    // The non-allocating design means `Node` cannot own the bytes. `'static`
-    // is the chosen simplification because all current callers (install/,
-    // cli/) pass string literals; the alternative would be threading a
-    // lifetime through `Node`/`Progress`.
+    // Dynamic names (install, create) point at caller-owned scratch buffers that outlive the node.
     pub name: &'static [u8],
     pub unit: Unit,
     /// Must be handled atomically to be thread-safe.
diff --git a/src/bun_core/string/immutable.rs b/src/bun_core/string/immutable.rs
index c3df7ef4c337..9e71c874881c 100644
--- a/src/bun_core/string/immutable.rs
+++ b/src/bun_core/string/immutable.rs
@@ -974,6 +974,18 @@ pub fn is_utf8_char_boundary(c: u8) -> bool {
     (c as i8) >= -0x40
 }
 
+/// Longest prefix of `self_` within `max_len` bytes that does not split a UTF-8 sequence.
+pub fn truncate_to_char_boundary(self_: &[u8], max_len: usize) -> &[u8] {
+    if self_.len() <= max_len {
+        return self_;
+    }
+    let mut end = max_len;
+    while !is_on_char_boundary(self_, end) {
+        end -= 1;
+    }
+    &self_[..end]
+}
+
 pub fn starts_with_case_insensitive_ascii(self_: &[u8], prefix: &[u8]) -> bool {
     self_.len() >= prefix.len()
         && eql_case_insensitive_ascii(&self_[0..prefix.len()], prefix, false)
@@ -2721,6 +2733,22 @@ mod tests {
         assert!(!super::eql_case_insensitive_ascii(b"Ab", b"a", true));
     }
 
+    #[test]
+    fn truncate_to_char_boundary_never_splits_a_sequence() {
+        assert_eq!(super::truncate_to_char_boundary(b"abc", 3), b"abc");
+        assert_eq!(super::truncate_to_char_boundary(b"abc", 4), b"abc");
+        assert_eq!(super::truncate_to_char_boundary(b"abcd", 3), b"abc");
+        assert_eq!(super::truncate_to_char_boundary(b"abc", 0), b"");
+        // "aé" is `61 C3 A9`: a cut at byte 2 would land inside `é`.
+        assert_eq!(super::truncate_to_char_boundary("aéz".as_bytes(), 2), b"a");
+        assert_eq!(
+            super::truncate_to_char_boundary("aéz".as_bytes(), 3),
+            "aé".as_bytes()
+        );
+        // A 4-byte sequence that does not fit at all yields the empty prefix.
+        assert_eq!(super::truncate_to_char_boundary("😀".as_bytes(), 3), b"");
+    }
+
     #[test]
     fn convert_utf8_to_utf16_in_buffer_fallback_rejects_malformed_sequences() {
         let mut buf = [0u16; 16];
diff --git a/src/install/PackageManager/ProgressStrings.rs b/src/install/PackageManager/ProgressStrings.rs
index 5ba05d1890fa..d1f5825991ac 100644
--- a/src/install/PackageManager/ProgressStrings.rs
+++ b/src/install/PackageManager/ProgressStrings.rs
@@ -1,6 +1,6 @@
 use core::sync::atomic::Ordering;
 
-use bun_core::Output;
+use bun_core::{Output, strings};
 use const_format::concatcp;
 
 use crate::bun_progress::Node as ProgressNode;
@@ -94,24 +94,25 @@ impl PackageManager {
         name: &[u8],
         emoji: &[u8],
     ) {
+        let emoji_len = if Output::enable_ansi_colors_stderr() {
+            if IS_FIRST {
+                self.progress_name_buf[..emoji.len()].copy_from_slice(emoji);
+            }
+            emoji.len()
+        } else {
+            0
+        };
+        // Display-only, so a name longer than the buffer is simply cut short.
+        let name =
+            strings::truncate_to_char_boundary(name, self.progress_name_buf.len() - emoji_len);
+        self.progress_name_buf[emoji_len..][..name.len()].copy_from_slice(name);
+        let len = emoji_len + name.len();
         // SAFETY: `node` is `self.downloads_node` / `self.scripts_node`, both of
         // which point at storage owned by (or outliving) this `PackageManager`
         // singleton; `progress_name_buf` is an inline field of that same
         // singleton, so the buffer outlives every node that references it and
         // erasing the slice lifetime to `'static` is sound.
-        unsafe {
-            let len = if Output::enable_ansi_colors_stderr() {
-                if IS_FIRST {
-                    self.progress_name_buf[..emoji.len()].copy_from_slice(emoji);
-                }
-                self.progress_name_buf[emoji.len()..][..name.len()].copy_from_slice(name);
-                emoji.len() + name.len()
-            } else {
-                self.progress_name_buf[..name.len()].copy_from_slice(name);
-                name.len()
-            };
-            node.name = bun_ptr::detach_lifetime(&self.progress_name_buf[..len]);
-        }
+        node.name = unsafe { bun_ptr::detach_lifetime(&self.progress_name_buf[..len]) };
     }
 
     pub fn start_progress_bar_if_none(&mut self) {
diff --git a/test/cli/install/bun-install.test.ts b/test/cli/install/bun-install.test.ts
index 81b92513c577..663dcfbe6f8e 100644
--- a/test/cli/install/bun-install.test.ts
+++ b/test/cli/install/bun-install.test.ts
@@ -11505,3 +11505,88 @@ it.each([
     expect(exitCode).not.toBe(0);
   });
 });
+
+// The progress bar copies the name it is currently showing into a fixed
+// 768-byte buffer (PackageManager.progress_name_buf). Dependency and package
+// names have no length limit, so a longer name used to abort the install with
+// "panic: range end index 900 out of range for slice of length 768" whenever
+// the progress bar was on. BUN_INSTALL_PROGRESS=1 turns it on without a TTY;
+// with colors enabled an emoji shares the buffer with the name, so both color
+// settings are covered.
+describe("progress bar with a name longer than its name buffer", () => {
+  const longName = Buffer.alloc(900, "a").toString();
+  const progressEnvs = [
+    ["NO_COLOR", { ...env, BUN_INSTALL_PROGRESS: "1", NO_COLOR: "1" }],
+    ["FORCE_COLOR", { ...env, BUN_INSTALL_PROGRESS: "1", NO_COLOR: undefined, FORCE_COLOR: "1" }],
+  ] as const;
+
+  it.each(progressEnvs)("dependency whose manifest is fetched (%s)", async (_colors, progressEnv) => {
+    await withContext(defaultOpts, async ctx => {
+      const requests: string[] = [];
+      setContextHandler(ctx, request => {
+        requests.push(request.url);
+        return new Response("Not Found", { status: 404 });
+      });
+      await writeFile(
+        join(ctx.package_dir, "package.json"),
+        JSON.stringify({
+          name: "foo",
+          version: "0.0.1",
+          dependencies: {
+            [longName]: "1.0.0",
+          },
+        }),
+      );
+
+      await using proc = Bun.spawn({
+        cmd: [bunExe(), "install"],
+        cwd: ctx.package_dir,
+        stdout: "pipe",
+        stderr: "pipe",
+        env: progressEnv,
+      });
+      const [out, err, exitCode] = await Promise.all([proc.stdout.text(), proc.stderr.text(), proc.exited]);
+
+      expect(requests).toEqual([`${ctx.registry_url}${longName}`]);
+      expect(Bun.stripANSI(err)).toContain(`error: GET ${ctx.registry_url}${longName} - 404`);
+      expect(Bun.stripANSI(err)).toContain(`error: ${longName}@1.0.0 failed to resolve`);
+      expect(out).not.toContain("1 package installed");
+      expect(exitCode).toBe(1);
+    });
+  });
+
+  it.each(progressEnvs)("workspace package running a lifecycle script (%s)", async (_colors, progressEnv) => {
+    using dir = tempDir("install-progress-long-name", {
+      "package.json": JSON.stringify({
+        name: "foo",
+        workspaces: ["packages/*"],
+      }),
+      "packages/long/package.json": JSON.stringify({
+        name: longName,
+        version: "1.0.0",
+        scripts: {
+          postinstall: "echo ran > postinstall-ran",
+        },
+      }),
+    });
+
+    // Nothing depends on the workspace package, so the isolated linker never
+    // creates a node_modules entry with this name: the progress bar is the
+    // only thing that has to cope with it.
+    await using proc = Bun.spawn({
+      cmd: [bunExe(), "install", "--linker", "isolated"],
+      cwd: String(dir),
+      stdout: "pipe",
+      stderr: "pipe",
+      env: progressEnv,
+    });
+    const [out, err, exitCode] = await Promise.all([proc.stdout.text(), proc.stderr.text(), proc.exited]);
+
+    expect({ stderr: Bun.stripANSI(err), exitCode }).toEqual({
+      stderr: expect.not.stringContaining("error:"),
+      exitCode: 0,
+    });
+    expect(Bun.stripANSI(out)).toContain("Checked 2 packages");
+    expect(await file(join(String(dir), "packages", "long", "postinstall-ran")).text()).toBe("ran\n");
+  });
+});

From 2f450e5427153b2a18a37b9145373f662c118edb Mon Sep 17 00:00:00 2001
From: robobun <117481402+robobun@users.noreply.github.com>
Date: Mon, 17 Aug 2026 01:05:53 +0000
Subject: [PATCH 032/258] install: stop aborting on linked package names that
 do not fit the symlink buffers (#38571)

---
 src/install/PackageInstall.rs           | 33 +++++++++++++----------
 test/cli/install/bun-workspaces.test.ts | 36 +++++++++++++++++++++++++
 2 files changed, 55 insertions(+), 14 deletions(-)

diff --git a/src/install/PackageInstall.rs b/src/install/PackageInstall.rs
index 0e890e476c6c..121b706599bf 100644
--- a/src/install/PackageInstall.rs
+++ b/src/install/PackageInstall.rs
@@ -2094,7 +2094,11 @@ impl<'a> PackageInstall<'a> {
                 }
             }
         };
-        let dest = bun_paths::basename(dest_path.as_bytes());
+        // The entry name is the NUL-terminated tail of `dest_path`.
+        let dest: &ZStr = ZStr::from_slice_with_nul(
+            &dest_path.as_bytes_with_nul()[subdir.map_or(0, |dir| dir.len() + 1)..],
+        );
+        debug_assert_eq!(dest.as_bytes(), bun_paths::basename(dest_path.as_bytes()));
         // When we're linking on Windows, we want to avoid keeping the source directory handle open
         #[cfg(windows)]
         {
@@ -2145,7 +2149,14 @@ impl<'a> PackageInstall<'a> {
                 dest_buf[offset] = bun_paths::SEP_WINDOWS;
                 offset += 1;
             }
-            dest_buf[offset..offset + dest.len()].copy_from_slice(dest);
+            if offset + dest.len() >= dest_buf.len() {
+                return InstallResult::fail(
+                    crate::Error::Sys(bun_errno::SystemErrno::ENAMETOOLONG),
+                    Step::LinkingDependency,
+                    None,
+                );
+            }
+            dest_buf[offset..offset + dest.len()].copy_from_slice(dest.as_bytes());
             offset += dest.len();
             dest_buf[offset] = 0;
 
@@ -2204,19 +2215,13 @@ impl<'a> PackageInstall<'a> {
                 Err(err) => return InstallResult::fail(err.into(), Step::LinkingDependency, None),
             };
 
-            let target = path::resolve_path::relative(dest_dir_path, to_path);
-            // `symlinkat` takes `&ZStr` for both target and dest; build NUL-terminated
-            // copies in stack buffers.
             let mut target_buf = PathBuffer::uninit();
-            target_buf[..target.len()].copy_from_slice(target);
-            target_buf[target.len()] = 0;
-            // SAFETY: NUL written above.
-            let target_z = ZStr::from_buf(&target_buf, target.len());
-            let mut dest_name_buf = [0u8; 512];
-            dest_name_buf[..dest.len()].copy_from_slice(dest);
-            // SAFETY: zero-initialized; NUL at [dest.len()].
-            let dest_z = ZStr::from_buf(&dest_name_buf, dest.len());
-            if let Err(err) = sys::symlinkat(target_z, dest_dir.fd(), dest_z) {
+            let target = path::resolve_path::relative_buf_z(
+                target_buf.as_mut_slice(),
+                dest_dir_path,
+                to_path,
+            );
+            if let Err(err) = sys::symlinkat(target, dest_dir.fd(), dest) {
                 return InstallResult::fail(err.into(), Step::LinkingDependency, None);
             }
         }
diff --git a/test/cli/install/bun-workspaces.test.ts b/test/cli/install/bun-workspaces.test.ts
index 8b7b3758d672..a5af15e6fd02 100644
--- a/test/cli/install/bun-workspaces.test.ts
+++ b/test/cli/install/bun-workspaces.test.ts
@@ -7,6 +7,7 @@ import {
   assertManifestsPopulated,
   bunEnv as baseEnv,
   bunExe,
+  isWindows,
   readdirSorted,
   runBunInstall,
   toMatchNodeModulesAt,
@@ -2974,3 +2975,38 @@ describe("packages whose version label is longer than 512 bytes", () => {
     );
   });
 });
+
+// The hoisted installer links a workspace package into node_modules under its name. A name
+// too long for the buffer that symlink is given used to abort the whole install instead of
+// failing that one package with ENAMETOOLONG. On POSIX that buffer held 512 bytes. On
+// Windows the name is appended to the absolute node_modules path in a 98302 byte buffer
+// (bun refuses names of 98302 bytes and up), so the name has to come within a node_modules
+// path (`\\?\C:\x\node_modules\` at the very least) of that size to overflow it.
+describe("workspace packages whose name is too long to link", () => {
+  const longName = Buffer.alloc(isWindows ? 98302 - 20 : 600, "a").toString();
+
+  // A scoped package is linked inside a separately opened `node_modules/@scope` directory.
+  test.concurrent.each([
+    ["unscoped", longName],
+    ["scoped", `@scope/${longName}`],
+  ])("%s name fails with ENAMETOOLONG", async (_, name) => {
+    using ctx = await setupTest();
+    const { packageDir, packageJson } = ctx;
+    await Promise.all([
+      write(packageJson, JSON.stringify({ name: "foo", workspaces: ["pkgs/*"] })),
+      write(join(packageDir, "pkgs", "pkg1", "package.json"), JSON.stringify({ name, version: "1.0.0" })),
+    ]);
+
+    await using proc = spawn({
+      cmd: [bunExe(), "install", "--linker", "hoisted"],
+      cwd: packageDir,
+      stdout: "pipe",
+      stderr: "pipe",
+      env: ctx.env,
+    });
+    const [out, err, exitCode] = await Promise.all([proc.stdout.text(), proc.stderr.text(), proc.exited]);
+    expect(err).toContain(`ENAMETOOLONG: failed linking dependency/workspace to node_modules for package ${name}`);
+    expect(out).toContain("Failed to install 1 package");
+    expect(exitCode).toBe(1);
+  });
+});

From 900279d3f0e1afcf3524b5d14efbb05359c04258 Mon Sep 17 00:00:00 2001
From: robobun <117481402+robobun@users.noreply.github.com>
Date: Mon, 17 Aug 2026 01:05:57 +0000
Subject: [PATCH 033/258] install: fail verification instead of panicking when
 <alias>/package.json does not fit the path buffer (#38575)

---
 src/install/PackageInstall.rs        | 96 ++++++++++++++++------------
 test/cli/install/bun-install.test.ts | 52 +++++++++++++++
 2 files changed, 108 insertions(+), 40 deletions(-)

diff --git a/src/install/PackageInstall.rs b/src/install/PackageInstall.rs
index 121b706599bf..0b6db8483b9c 100644
--- a/src/install/PackageInstall.rs
+++ b/src/install/PackageInstall.rs
@@ -5,7 +5,7 @@ use bun_core::Progress::Progress;
 use bun_core::{Global, Output};
 use bun_core::{MutableString, ZStr};
 use bun_paths::strings;
-use bun_paths::{self as path, OSPathChar, OSPathSlice, PathBuffer, SEP, SEP_STR};
+use bun_paths::{self as path, OSPathChar, OSPathSlice, PathBuffer, SEP};
 use bun_semver::String as SemverString;
 #[cfg(not(windows))]
 use bun_sys::OpenDirOptions;
@@ -740,6 +740,48 @@ impl UninstallTask {
     }
 }
 
+/// `<destination_dir_subpath>/<name>`, written in place after the alias in
+/// `destination_dir_subpath_buf`. Dropping it restores the alias's NUL terminator.
+struct DestinationSubpath<'b> {
+    buf: &'b mut [u8],
+    alias_len: usize,
+    len: usize,
+}
+
+impl<'b> DestinationSubpath<'b> {
+    /// `None` when the path and its NUL terminator do not fit `buf`: the alias is
+    /// only required to fit the buffer by itself (`alias_is_safe_install_target`).
+    fn new(buf: &'b mut [u8], alias_len: usize, name: &[u8]) -> Option<Self> {
+        let name_start = alias_len + 1;
+        let len = name_start + name.len();
+        if len >= buf.len() {
+            return None;
+        }
+        buf[alias_len] = SEP;
+        buf[name_start..len].copy_from_slice(name);
+        buf[len] = 0;
+        Some(Self {
+            buf,
+            alias_len,
+            len,
+        })
+    }
+}
+
+impl core::ops::Deref for DestinationSubpath<'_> {
+    type Target = ZStr;
+
+    fn deref(&self) -> &ZStr {
+        ZStr::from_buf(self.buf, self.len)
+    }
+}
+
+impl Drop for DestinationSubpath<'_> {
+    fn drop(&mut self) {
+        self.buf[self.alias_len] = 0;
+    }
+}
+
 // ───────────────────────────── impl PackageInstall ─────────────────────────────
 
 impl<'a> PackageInstall<'a> {
@@ -778,28 +820,17 @@ impl<'a> PackageInstall<'a> {
     // 1. verify that .bun-tag exists (was it installed from bun?)
     // 2. check .bun-tag against the resolved version
     fn verify_git_resolution(&mut self, repo: &Repository, root_node_modules_dir: &Dir) -> bool {
-        let dest_len = self.destination_dir_subpath.len();
-        let suffix: &[u8] = &[SEP, b'.', b'b', b'u', b'n', b'-', b't', b'a', b'g'];
-        // Reshaped for borrowck — write into buf via raw indices.
-        self.destination_dir_subpath_buf[dest_len..dest_len + suffix.len()].copy_from_slice(suffix);
-        self.destination_dir_subpath_buf[dest_len + SEP_STR.len() + b".bun-tag".len()] = 0;
-        // SAFETY: NUL written above.
-        let bun_tag_path = unsafe {
-            ZStr::from_raw_mut(
-                self.destination_dir_subpath_buf.as_mut_ptr(),
-                dest_len + SEP_STR.len() + b".bun-tag".len(),
-            )
+        let Some(bun_tag_path) = DestinationSubpath::new(
+            self.destination_dir_subpath_buf,
+            self.destination_dir_subpath.len(),
+            b".bun-tag",
+        ) else {
+            return false;
         };
-        let _restore = scopeguard::guard(
-            self.destination_dir_subpath_buf.as_mut_ptr(),
-            // SAFETY: p points into destination_dir_subpath_buf which outlives this scope;
-            // dest_len < buf capacity (was the prior NUL position).
-            move |p| unsafe { *p.add(dest_len) = 0 },
-        );
 
         let Ok(bun_tag_file) = self
             .node_modules
-            .read_small_file(root_node_modules_dir, bun_tag_path)
+            .read_small_file(root_node_modules_dir, &bun_tag_path)
         else {
             return false;
         };
@@ -859,30 +890,15 @@ impl<'a> PackageInstall<'a> {
         mutable.reset();
         mutable.expand_to_capacity();
 
-        let dest_len = self.destination_dir_subpath.len();
-        // Write the literal directly into the path buffer; no intermediate Vec.
-        let suffix: &[u8] = &[
-            SEP, b'p', b'a', b'c', b'k', b'a', b'g', b'e', b'.', b'j', b's', b'o', b'n',
-        ];
-        self.destination_dir_subpath_buf[dest_len..dest_len + suffix.len()].copy_from_slice(suffix);
-        self.destination_dir_subpath_buf[dest_len + SEP_STR.len() + b"package.json".len()] = 0;
-        // SAFETY: NUL written above.
-        let package_json_path = unsafe {
-            ZStr::from_raw_mut(
-                self.destination_dir_subpath_buf.as_mut_ptr(),
-                dest_len + SEP_STR.len() + b"package.json".len(),
-            )
-        };
-        let _restore = scopeguard::guard(
-            self.destination_dir_subpath_buf.as_mut_ptr(),
-            // SAFETY: p points into destination_dir_subpath_buf which outlives this scope;
-            // dest_len < buf capacity (was the prior NUL position).
-            move |p| unsafe { *p.add(dest_len) = 0 },
-        );
+        let package_json_path = DestinationSubpath::new(
+            self.destination_dir_subpath_buf,
+            self.destination_dir_subpath.len(),
+            b"package.json",
+        )?;
 
         let package_json_file = self
             .node_modules
-            .open_file(root_node_modules_dir, package_json_path)
+            .open_file(root_node_modules_dir, &package_json_path)
             .ok()?;
         // defer package_json_file.close()
 
diff --git a/test/cli/install/bun-install.test.ts b/test/cli/install/bun-install.test.ts
index 663dcfbe6f8e..5c813fe9de3f 100644
--- a/test/cli/install/bun-install.test.ts
+++ b/test/cli/install/bun-install.test.ts
@@ -899,6 +899,58 @@ describe.concurrent("bun-install", () => {
     expect(exitCode).toBe(1);
   });
 
+  // When node_modules already exists, the hoisted installer first checks what is installed at
+  // node_modules/<alias> by appending "/package.json" (or "/.bun-tag" for git dependencies) to
+  // the alias inside the path buffer holding it. The alias may be up to one byte short of the
+  // buffer (4096 bytes on Linux, 1024 on macOS), so aliases a few bytes short of it used to crash
+  // the install right there instead of failing like any other name the file system rejects.
+  // On Windows the buffer is far larger than any path the OS accepts.
+  describe.concurrent.skipIf(isWindows)("dependency alias that fills the path buffer", () => {
+    const alias = Buffer.alloc((isLinux ? 4096 : 1024) - 6, "a").toString();
+
+    async function installIntoExistingNodeModules(cwd: string) {
+      await using proc = spawn({
+        // hardlink (the Linux default) creates node_modules/<alias> itself on every platform, so
+        // the failure is reported the same way on macOS, whose default backend is clonefile.
+        cmd: [bunExe(), "install", "--linker", "hoisted", "--backend", "hardlink"],
+        cwd,
+        env: { ...env, BUN_INSTALL_CACHE_DIR: join(cwd, ".cache") },
+        stdout: "pipe",
+        stderr: "pipe",
+      });
+      const [stdout, stderr, exitCode] = await Promise.all([proc.stdout.text(), proc.stderr.text(), proc.exited]);
+      expect(stderr).toContain("ENAMETOOLONG: failed opening node_modules/package dir for package pkg");
+      expect(stdout).toContain("Failed to install 1 package");
+      expect(exitCode).toBe(1);
+    }
+
+    it("file: dependency is verified through <alias>/package.json", async () => {
+      using dir = tempDir("long-alias-file-dep", {
+        "package.json": JSON.stringify({ name: "app", dependencies: { [alias]: "file:./pkg" } }),
+        "pkg/package.json": JSON.stringify({ name: "pkg", version: "1.0.0" }),
+        "node_modules": {},
+      });
+
+      await installIntoExistingNodeModules(String(dir));
+    });
+
+    it("git dependency is verified through <alias>/.bun-tag", async () => {
+      using dir = tempDir("long-alias-git-dep", {
+        "work/package.json": JSON.stringify({ name: "pkg", version: "1.0.0" }),
+        "app/node_modules": {},
+      });
+      await createDumbHttpGitRepo(String(dir), {});
+      using server = serveDirectory(String(dir));
+      const app = join(String(dir), "app");
+      await writeFile(
+        join(app, "package.json"),
+        JSON.stringify({ name: "app", dependencies: { [alias]: `git+http://localhost:${server.port}/repo.git` } }),
+      );
+
+      await installIntoExistingNodeModules(app);
+    });
+  });
+
   it("should handle empty string in dependencies", async () => {
     await withContext(defaultOpts, async ctx => {
       const urls: string[] = [];

From a4d081c43aa86e25feb6ca0b3b7060285dcea14d Mon Sep 17 00:00:00 2001
From: robobun <117481402+robobun@users.noreply.github.com>
Date: Mon, 17 Aug 2026 01:06:00 +0000
Subject: [PATCH 034/258] pm ls --all: stop panicking on resolutions longer
 than 512 bytes (#38616)

---
 src/runtime/cli/package_manager_command.rs | 29 ++----------
 test/cli/install/bun-pm.test.ts            | 54 ++++++++++++++++++++++
 2 files changed, 58 insertions(+), 25 deletions(-)

diff --git a/src/runtime/cli/package_manager_command.rs b/src/runtime/cli/package_manager_command.rs
index 3518637edec7..05cfe0a302ca 100644
--- a/src/runtime/cli/package_manager_command.rs
+++ b/src/runtime/cli/package_manager_command.rs
@@ -801,7 +801,6 @@ fn print_node_modules_folder_structure(
             }
         }
 
-        let mut resolution_buf = [0u8; 512];
         if let Some(id) = directory_package_id {
             let mut path: &[u8] = directory.relative_path.as_bytes();
 
@@ -813,25 +812,15 @@ fn print_node_modules_folder_structure(
                     }
                 }
             }
-            let directory_version = buf_print(
-                &mut resolution_buf,
-                format_args!(
-                    "{}",
-                    resolutions[id as usize].fmt(string_bytes, PathSep::Auto)
-                ),
-            );
+            let directory_version = resolutions[id as usize].fmt(string_bytes, PathSep::Auto);
             if let Some(j) = strings::index_of(path, b"node_modules") {
                 bun_core::prettyln!(
                     "{}<d>@{}<r>",
                     bstr::BStr::new(&path[0..j - 1]),
-                    bstr::BStr::new(directory_version),
+                    directory_version,
                 );
             } else {
-                bun_core::prettyln!(
-                    "{}<d>@{}<r>",
-                    bstr::BStr::new(path),
-                    bstr::BStr::new(directory_version),
-                );
+                bun_core::prettyln!("{}<d>@{}<r>", bstr::BStr::new(path), directory_version);
             }
         } else {
             let mut cwd_buf = PathBuffer::uninit();
@@ -938,18 +927,10 @@ fn print_node_modules_folder_structure(
             bun_core::pretty!("<d>└──<r> ");
         }
 
-        let mut resolution_buf = [0u8; 512];
-        let package_version = buf_print(
-            &mut resolution_buf,
-            format_args!(
-                "{}",
-                resolutions[package_id as usize].fmt(string_bytes, PathSep::Auto)
-            ),
-        );
         bun_core::prettyln!(
             "{}<d>@{}<r>",
             bstr::BStr::new(package_name),
-            bstr::BStr::new(package_version),
+            resolutions[package_id as usize].fmt(string_bytes, PathSep::Auto),
         );
     }
 
@@ -1031,5 +1012,3 @@ fn print_trusted_dependencies_flat(
         }
     }
 }
-
-use bun_core::fmt::buf_print_infallible as buf_print;
diff --git a/test/cli/install/bun-pm.test.ts b/test/cli/install/bun-pm.test.ts
index 024dfdc020be..ebf54aad16ea 100644
--- a/test/cli/install/bun-pm.test.ts
+++ b/test/cli/install/bun-pm.test.ts
@@ -140,6 +140,60 @@ it("should list all dependencies", async () => {
   expect(requested).toBe(2);
 });
 
+// A tarball package's label is the URL it was installed from, which has no length
+// limit. `--all` prints a label in two places: the header of a package that has its own
+// nested node_modules (moo, whose bar/baz conflict with the root's), and the line of a
+// package that has none (bar).
+it("should list all dependencies when a resolution is longer than 512 bytes", async () => {
+  const urls: string[] = [];
+  setHandler(dummyRegistry(urls, { "0.0.2": {}, "0.0.3": {}, "0.0.5": {}, latest: "0.0.3" }));
+  const barUrl = `${root_url}/${Buffer.alloc(600, "a").toString()}/bar-0.0.2.tgz`;
+  const mooUrl = `${root_url}/${Buffer.alloc(600, "b").toString()}/moo-0.1.0.tgz`;
+  await writeFile(
+    join(package_dir, "package.json"),
+    JSON.stringify({
+      name: "foo",
+      version: "0.0.1",
+      dependencies: {
+        bar: barUrl,
+        baz: "0.0.5",
+        // moo-0.1.0.tgz depends on bar@0.0.2 and baz@latest
+        moo: mooUrl,
+      },
+    }),
+  );
+  {
+    await using proc = spawn({
+      cmd: [bunExe(), "install"],
+      cwd: package_dir,
+      stdout: "pipe",
+      stderr: "pipe",
+      env,
+    });
+    const [err, exitCode] = await Promise.all([proc.stderr.text(), proc.exited]);
+    expect(err).not.toContain("error:");
+    expect(err).toContain("Saved lockfile");
+    expect(exitCode).toBe(0);
+  }
+  await using proc = spawn({
+    cmd: [bunExe(), "pm", "ls", "--all"],
+    cwd: package_dir,
+    stdout: "pipe",
+    stderr: "pipe",
+    env,
+  });
+  const [stdout, stderr, exitCode] = await Promise.all([proc.stdout.text(), proc.stderr.text(), proc.exited]);
+  expect(stderr).toBe("");
+  expect(stdout).toBe(`${package_dir} node_modules
+├── bar@${barUrl}
+├── baz@0.0.5
+└── moo@${mooUrl}
+    ├── bar@0.0.2
+    └── baz@0.0.3
+`);
+  expect(exitCode).toBe(0);
+});
+
 it("should list top-level aliased dependency", async () => {
   const urls: string[] = [];
   setHandler(dummyRegistry(urls));

From f6055e89f738f14977ba7b42f235720554087804 Mon Sep 17 00:00:00 2001
From: robobun <robobun@oven.sh>
Date: Mon, 17 Aug 2026 01:06:05 +0000
Subject: [PATCH 035/258] pack/publish: stop panicking on package.json bin and
 files entries longer than the path buffer (#38784)

---
 src/paths/resolve_path.rs            | 150 ++++++++++++++++++++++++++-
 src/runtime/cli/pack_command.rs      |  27 +++--
 src/runtime/cli/publish_command.rs   |  26 +++--
 test/cli/install/bun-pack.test.ts    |  83 +++++++++++++++
 test/cli/install/bun-publish.test.ts |  47 +++++++++
 5 files changed, 312 insertions(+), 21 deletions(-)

diff --git a/src/paths/resolve_path.rs b/src/paths/resolve_path.rs
index 2720213d2014..e640015524e1 100644
--- a/src/paths/resolve_path.rs
+++ b/src/paths/resolve_path.rs
@@ -1306,6 +1306,40 @@ pub fn normalize_buf_z<'a, P: PlatformT>(str: &[u8], buf: &'a mut [u8]) -> &'a m
     unsafe { ZStr::from_raw_mut(buf.as_mut_ptr(), len) }
 }
 
+/// [`normalize_buf`] into `buf` when the result fits, otherwise into `spill` (grown as needed).
+pub fn normalize_buf_spill<'a, P: PlatformT>(
+    buf: &'a mut [u8],
+    spill: &'a mut Vec<u8>,
+    str: &[u8],
+) -> &'a [u8] {
+    normalize_buf::<P>(str, normalize_buf_or_spill(buf, spill, str))
+}
+
+/// [`normalize_buf_z`] into `buf` when the result fits, otherwise into `spill` (grown as needed).
+pub fn normalize_buf_z_spill<'a, P: PlatformT>(
+    buf: &'a mut [u8],
+    spill: &'a mut Vec<u8>,
+    str: &[u8],
+) -> &'a ZStr {
+    normalize_buf_z::<P>(str, normalize_buf_or_spill(buf, spill, str))
+}
+
+fn normalize_buf_or_spill<'a>(
+    buf: &'a mut [u8],
+    spill: &'a mut Vec<u8>,
+    str: &[u8],
+) -> &'a mut [u8] {
+    // Normalizing grows a path by at most one byte (`""` -> `.`, `C:` -> `C:.`), plus the NUL.
+    let needed = str.len() + 2;
+    if needed <= buf.len() {
+        return buf;
+    }
+    if spill.len() < needed {
+        spill.resize(needed, 0);
+    }
+    &mut spill[..]
+}
+
 pub fn normalize_buf_t<'a, T: PathChar, P: PlatformT>(str: &[T], buf: &'a mut [T]) -> &'a mut [T] {
     if str.is_empty() {
         buf[0] = T::from_u8(b'.');
@@ -2479,7 +2513,7 @@ pub use crate::PathChar;
 
 // Run with `cargo test -p bun_paths` (also the Miri lane, `bun run rust:miri -p bun_paths`).
 // Normalizing reaches `bun_core::strings`' byte searches, whose highway kernels
-// are only linked into the full binary, so the two they reference are satisfied
+// are only linked into the full binary, so the ones they reference are satisfied
 // below with scalar stubs (the simdutf counterparts live in string_paths.rs).
 // Under Miri the wrappers take their own scalar path and never call these.
 #[cfg(test)]
@@ -2521,6 +2555,45 @@ mod tests {
             .unwrap_or(text_len)
     }
 
+    /// Returns `haystack_len` when `needle` does not occur, like the kernel.
+    #[unsafe(no_mangle)]
+    unsafe extern "C" fn highway_last_index_of_char(
+        haystack: *const u8,
+        haystack_len: usize,
+        needle: u8,
+    ) -> usize {
+        // SAFETY: test stub; callers pass a valid (ptr, len) pair.
+        let haystack = unsafe { core::slice::from_raw_parts(haystack, haystack_len) };
+        haystack
+            .iter()
+            .rposition(|&b| b == needle)
+            .unwrap_or(haystack_len)
+    }
+
+    /// Returns `usize::MAX` when `needle` does not occur, like the kernel.
+    #[unsafe(no_mangle)]
+    unsafe extern "C" fn highway_memrmem16(
+        haystack: *const u16,
+        haystack_len: usize,
+        needle: *const u16,
+        needle_len: usize,
+    ) -> usize {
+        // SAFETY: test stub; callers pass valid (ptr, len) pairs.
+        let (haystack, needle) = unsafe {
+            (
+                core::slice::from_raw_parts(haystack, haystack_len),
+                core::slice::from_raw_parts(needle, needle_len),
+            )
+        };
+        if needle_len > haystack_len {
+            return usize::MAX;
+        }
+        (0..=haystack_len - needle_len)
+            .rev()
+            .find(|&i| haystack[i..i + needle_len] == *needle)
+            .unwrap_or(usize::MAX)
+    }
+
     #[test]
     fn normalize_string_spill_leaves_spill_untouched_when_the_input_fits() {
         let mut spill = Vec::new();
@@ -2640,4 +2713,79 @@ mod tests {
             b"C:."
         );
     }
+
+    #[test]
+    fn normalize_buf_spill_leaves_spill_untouched_when_the_input_fits() {
+        let mut buf = [0u8; 32];
+        let mut spill = Vec::new();
+        assert_eq!(
+            normalize_buf_spill::<platform::Posix>(&mut buf, &mut spill, b"./bins/../cli/./x.js"),
+            b"cli/x.js"
+        );
+        assert_eq!(
+            normalize_buf_z_spill::<platform::Posix>(&mut buf, &mut spill, b"./bins/").as_bytes(),
+            b"bins/"
+        );
+        assert!(spill.is_empty());
+    }
+
+    #[test]
+    fn normalize_buf_spill_spills_input_longer_than_buf() {
+        let mut buf = [0u8; 32];
+        let name = vec![b'b'; buf.len() * 3];
+        let mut input = b"./".to_vec();
+        input.extend_from_slice(&name);
+        input.extend_from_slice(b"/./x.js");
+        let mut expected = name;
+        expected.extend_from_slice(b"/x.js");
+
+        let mut spill = Vec::new();
+        assert_eq!(
+            normalize_buf_spill::<platform::Posix>(&mut buf, &mut spill, &input),
+            &expected[..]
+        );
+        expected.push(0);
+        assert_eq!(
+            normalize_buf_z_spill::<platform::Posix>(&mut buf, &mut spill, &input)
+                .as_bytes_with_nul(),
+            &expected[..]
+        );
+        assert!(!spill.is_empty());
+    }
+
+    #[test]
+    fn normalize_buf_z_spill_spills_input_exactly_as_long_as_buf() {
+        // The input normalizes to `buf.len()` bytes, leaving no room for the NUL.
+        let mut buf = [0u8; 32];
+        let input = vec![b'a'; buf.len()];
+        let mut expected = input.clone();
+        expected.push(0);
+
+        let mut spill = Vec::new();
+        assert_eq!(
+            normalize_buf_z_spill::<platform::Posix>(&mut buf, &mut spill, &input)
+                .as_bytes_with_nul(),
+            &expected[..]
+        );
+        assert!(!spill.is_empty());
+    }
+
+    #[test]
+    fn normalize_buf_spill_sizes_the_spill_for_the_empty_input_becoming_a_dot() {
+        let mut buf = [0u8; 1];
+
+        let mut spill = Vec::new();
+        assert_eq!(
+            normalize_buf_spill::<platform::Posix>(&mut buf, &mut spill, b""),
+            b"."
+        );
+        assert_eq!(spill.len(), 2);
+
+        let mut spill = Vec::new();
+        assert_eq!(
+            normalize_buf_z_spill::<platform::Posix>(&mut buf, &mut spill, b"").as_bytes_with_nul(),
+            b".\0"
+        );
+        assert_eq!(spill.len(), 2);
+    }
 }
diff --git a/src/runtime/cli/pack_command.rs b/src/runtime/cli/pack_command.rs
index aafee8e9db8c..d9a0f0e03bcb 100644
--- a/src/runtime/cli/pack_command.rs
+++ b/src/runtime/cli/pack_command.rs
@@ -28,7 +28,7 @@ type CowString = CowSlice<u8>;
 use crate::cli::run_command::{ConfigureEnvOptions, RunCommand};
 use bun_core::ZBox;
 use bun_core::{ZStr, strings};
-use bun_paths::resolve_path;
+use bun_paths::resolve_path::{self, normalize_buf_spill};
 use bun_semver as Semver;
 use bun_sha_hmac::sha;
 use bun_sys::{
@@ -1461,12 +1461,14 @@ fn get_package_bins(json: &Expr) -> Result<Vec<BinInfo>, AllocError> {
     let mut bins: Vec<BinInfo> = Vec::new();
 
     let mut path_buf = PathBuffer::uninit();
+    let mut path_spill: Vec<u8> = Vec::new();
 
     if let Some(bin) = json.as_property(b"bin") {
         if let Some(bin_str) = bin.expr.as_string(pack_bump()) {
-            let normalized = resolve_path::normalize_buf::<resolve_path::platform::Posix>(
-                bin_str,
+            let normalized = normalize_buf_spill::<path::platform::Posix>(
                 &mut path_buf,
+                &mut path_spill,
+                bin_str,
             );
             if !bin_path_escapes_root(normalized) {
                 bins.push(BinInfo {
@@ -1485,9 +1487,10 @@ fn get_package_bins(json: &Expr) -> Result<Vec<BinInfo>, AllocError> {
             for bin_prop in bin_obj.properties.slice() {
                 if let Some(bin_prop_value) = &bin_prop.value {
                     if let Some(bin_str) = bin_prop_value.as_string(pack_bump()) {
-                        let normalized = resolve_path::normalize_buf::<resolve_path::platform::Posix>(
-                            bin_str,
+                        let normalized = normalize_buf_spill::<path::platform::Posix>(
                             &mut path_buf,
+                            &mut path_spill,
+                            bin_str,
                         );
                         if !bin_path_escapes_root(normalized) {
                             bins.push(BinInfo {
@@ -1507,9 +1510,10 @@ fn get_package_bins(json: &Expr) -> Result<Vec<BinInfo>, AllocError> {
         if let ExprData::EObject(directories_obj) = &directories.expr.data {
             if let Some(bin) = directories_obj.as_property(b"bin") {
                 if let Some(bin_str) = bin.expr.as_string(pack_bump()) {
-                    let normalized = resolve_path::normalize_buf::<resolve_path::platform::Posix>(
-                        bin_str,
+                    let normalized = normalize_buf_spill::<path::platform::Posix>(
                         &mut path_buf,
+                        &mut path_spill,
+                        bin_str,
                     );
                     if !bin_path_escapes_root(normalized) {
                         bins.push(BinInfo {
@@ -2312,12 +2316,13 @@ pub(crate) fn pack<const FOR_PUBLISH: bool>(
                     let mut excludes: Vec<Pattern> = Vec::new();
 
                     let mut path_buf = PathBuffer::uninit();
+                    let mut path_spill: Vec<u8> = Vec::new();
                     while let Some(files_entry) = files_array.next() {
                         if let Some(file_entry_str) = files_entry.as_string(bump) {
-                            let normalized = resolve_path::normalize_buf::<
-                                resolve_path::platform::Posix,
-                            >(
-                                file_entry_str, &mut path_buf
+                            let normalized = normalize_buf_spill::<path::platform::Posix>(
+                                &mut path_buf,
+                                &mut path_spill,
+                                file_entry_str,
                             );
                             let Some(parsed) = Pattern::from_utf8(normalized)? else {
                                 continue;
diff --git a/src/runtime/cli/publish_command.rs b/src/runtime/cli/publish_command.rs
index 60a861015688..b9778ff23a52 100644
--- a/src/runtime/cli/publish_command.rs
+++ b/src/runtime/cli/publish_command.rs
@@ -15,7 +15,7 @@ use bun_install::lockfile::{LoadResult, LoadStep};
 use bun_install::{self as install, Lockfile, Npm, PackageManager, Subcommand};
 use bun_libarchive::lib::{Archive, ArchiveIterator, IteratorResult as ArchiveIterResult};
 use bun_parsers::json as json_mod;
-use bun_paths::resolve_path::{join_abs_string_buf_z, normalize_buf, normalize_buf_z};
+use bun_paths::resolve_path::{join_abs_string_buf_z, normalize_buf_spill, normalize_buf_z_spill};
 use bun_paths::{self as path, PathBuffer};
 use bun_resolver::fs::FileSystem;
 use bun_sha_hmac as sha;
@@ -1608,14 +1608,16 @@ impl PublishCommand {
             };
         }
         let mut path_buf = PathBuffer::uninit();
+        let mut path_spill: Vec<u8> = Vec::new();
         if let Some(bin_query) = json.as_property(b"bin") {
             match &bin_query.expr.data {
                 ExprData::EString(bin_str) => {
                     let mut bin_props: Vec<G::Property> = Vec::new();
                     let normalized = strings::without_prefix_comptime_z(
-                        normalize_buf_z::<path::platform::Posix>(
-                            bin_str.string(bump)?,
+                        normalize_buf_z_spill::<path::platform::Posix>(
                             &mut *path_buf,
+                            &mut path_spill,
+                            bin_str.string(bump)?,
                         ),
                         b"./",
                     );
@@ -1660,9 +1662,10 @@ impl PublishCommand {
                                     if ks.len() != 0 {
                                         break 'key Some(Box::<[u8]>::from(
                                             strings::without_prefix(
-                                                normalize_buf::<path::platform::Posix>(
-                                                    ks.string(bump)?,
+                                                normalize_buf_spill::<path::platform::Posix>(
                                                     &mut *path_buf,
+                                                    &mut path_spill,
+                                                    ks.string(bump)?,
                                                 ),
                                                 b"./",
                                             ),
@@ -1685,9 +1688,10 @@ impl PublishCommand {
                                         break 'value Some(bun_core::ZBox::from_bytes(
                                             strings::without_prefix_comptime_z(
                                                 // replace separators
-                                                normalize_buf_z::<path::platform::Posix>(
-                                                    vs.string(bump)?,
+                                                normalize_buf_z_spill::<path::platform::Posix>(
                                                     &mut *path_buf,
+                                                    &mut path_spill,
+                                                    vs.string(bump)?,
                                                 ),
                                                 b"./",
                                             )
@@ -1746,7 +1750,11 @@ impl PublishCommand {
                 let mut bin_props: Vec<G::Property> = Vec::new();
                 let normalized_bin_dir = bun_core::ZBox::from_bytes(
                     strings::without_trailing_slash(strings::without_prefix(
-                        normalize_buf::<path::platform::Posix>(bin_dir_str, &mut *path_buf),
+                        normalize_buf_spill::<path::platform::Posix>(
+                            &mut *path_buf,
+                            &mut path_spill,
+                            bin_dir_str,
+                        ),
                         b"./",
                     )),
                 );
@@ -1763,7 +1771,7 @@ impl PublishCommand {
                 ) {
                     Ok(fd) => fd,
                     Err(e) => {
-                        if e.get_errno() == bun_sys::E::ENOENT {
+                        if matches!(e.get_errno(), bun_sys::E::ENOENT | bun_sys::E::ENAMETOOLONG) {
                             bun_core::warn!(
                                 "bin directory '{}' does not exist",
                                 bstr::BStr::new(normalized_bin_dir.as_bytes()),
diff --git a/test/cli/install/bun-pack.test.ts b/test/cli/install/bun-pack.test.ts
index 34f42ac8a360..8f67964bbbcd 100644
--- a/test/cli/install/bun-pack.test.ts
+++ b/test/cli/install/bun-pack.test.ts
@@ -1422,6 +1422,34 @@ describe("files", () => {
       { "pathname": "package/src/index.ts" },
     ]);
   });
+
+  test("an entry longer than the path buffer is still matched", async () => {
+    // A brace group of 1000 names that do not exist, then "dist". ~100KB, longer
+    // than the path buffer on every platform (98302 bytes on Windows).
+    const unused = Buffer.alloc(100, "x").toString();
+    const pattern = `{${Array.from({ length: 1000 }, (_, i) => `${unused}${i}`).join(",")},dist}`;
+    expect(pattern.length).toBeGreaterThan(100_000);
+
+    await Promise.all([
+      write(
+        join(packageDir, "package.json"),
+        JSON.stringify({
+          name: "pack-files-long-entry",
+          version: "1.0.0",
+          files: [pattern],
+        }),
+      ),
+      write(join(packageDir, "dist", "index.js"), "console.log('hello ./dist/index.js')"),
+      write(join(packageDir, "src", "index.js"), "console.log('hello ./src/index.js')"),
+    ]);
+
+    await pack(packageDir, bunEnv);
+    const tarball = readTarball(join(packageDir, "pack-files-long-entry-1.0.0.tgz"));
+    expect(tarball.entries).toMatchObject([
+      { "pathname": "package/package.json" },
+      { "pathname": "package/dist/index.js" },
+    ]);
+  });
 });
 
 describe(".gitignore/.npmignore", () => {
@@ -1678,6 +1706,61 @@ describe("bins", () => {
       },
     ]);
   });
+
+  describe("longer than the path buffer", () => {
+    // Longer than the path buffer on every platform (98302 bytes on Windows), so
+    // nothing on disk can have this name.
+    const long = Buffer.alloc(100_000, "b").toString();
+
+    test.each([
+      ["bin", { bin: long }],
+      ["bin object value", { bin: { cli: long } }],
+      ["directories.bin", { directories: { bin: long } }],
+    ])("%s is skipped like any other bin that does not exist", async (_, fields) => {
+      await Promise.all([
+        write(
+          join(packageDir, "package.json"),
+          JSON.stringify({
+            name: "pack-long-bin",
+            version: "1.0.0",
+            ...fields,
+          }),
+        ),
+        write(join(packageDir, "index.js"), "console.log('hello ./index.js')"),
+      ]);
+
+      await pack(packageDir, bunEnv);
+
+      const tarball = readTarball(join(packageDir, "pack-long-bin-1.0.0.tgz"));
+      expect(tarball.entries).toMatchObject([{ pathname: "package/package.json" }, { pathname: "package/index.js" }]);
+    });
+
+    test("the other bins are still packed", async () => {
+      await Promise.all([
+        write(
+          join(packageDir, "package.json"),
+          JSON.stringify({
+            name: "pack-long-bin",
+            version: "1.0.0",
+            files: ["index.js"],
+            bin: { long, cli: "cli.js" },
+          }),
+        ),
+        write(join(packageDir, "index.js"), "console.log('hello ./index.js')"),
+        write(join(packageDir, "cli.js"), `#!/usr/bin/env bun\n`),
+      ]);
+
+      await pack(packageDir, bunEnv);
+
+      const tarball = readTarball(join(packageDir, "pack-long-bin-1.0.0.tgz"));
+      expect(tarball.entries).toMatchObject([
+        { pathname: "package/package.json" },
+        { pathname: "package/cli.js" },
+        { pathname: "package/index.js" },
+      ]);
+      expect(tarball.entries[1].perm & 0o111).toBe(0o111);
+    });
+  });
 });
 
 test("unicode", async () => {
diff --git a/test/cli/install/bun-publish.test.ts b/test/cli/install/bun-publish.test.ts
index c701b322806c..981a56c307d9 100644
--- a/test/cli/install/bun-publish.test.ts
+++ b/test/cli/install/bun-publish.test.ts
@@ -654,6 +654,53 @@ for (const info of [
   });
 }
 
+describe("bin longer than the path buffer", () => {
+  // Longer than the path buffer on every platform (98302 bytes on Windows), so
+  // nothing on disk can have this name.
+  const long = Buffer.alloc(100_000, "b").toString();
+  // The registry is never contacted with --dry-run; the userinfo only satisfies the auth check.
+  const dryRunEnv = { ...env, npm_config_registry: "http://user:pass@127.0.0.1:1/" };
+
+  test.each([
+    ["bin", { bin: long }, "warn: bin '<long>' does not exist"],
+    ["bin object value", { bin: { cli: long } }, "warn: bin '<long>' does not exist"],
+    ["bin object key", { bin: { [long]: "cli.js" } }, null],
+    ["directories.bin", { directories: { bin: long } }, "warn: bin directory '<long>' does not exist"],
+  ])("tarball with a long %s", async (_, fields, warning) => {
+    const packageDir = tmpdirSync();
+    const packageJson = JSON.stringify({ name: "publish-long-bin", version: "1.0.0", ...fields });
+    await Promise.all([
+      write(join(packageDir, "package.json"), packageJson),
+      write(join(packageDir, "cli.js"), ""),
+      Bun.Archive.write(
+        join(packageDir, "publish-long-bin-1.0.0.tgz"),
+        { "package/package.json": packageJson },
+        { compress: "gzip" },
+      ),
+    ]);
+
+    const { out, err, exitCode } = await publish(dryRunEnv, packageDir, "./publish-long-bin-1.0.0.tgz", "--dry-run");
+    const stderr = err.replaceAll(long, "<long>");
+    expect(stderr.split("\n").filter(line => line.startsWith("warn:"))).toEqual(warning === null ? [] : [warning]);
+    expect(stderr).not.toContain("error:");
+    expect(out).toContain("+ publish-long-bin@1.0.0 (dry-run)");
+    expect(exitCode).toBe(0);
+  });
+
+  test("directory with a long bin", async () => {
+    const packageDir = tmpdirSync();
+    await write(
+      join(packageDir, "package.json"),
+      JSON.stringify({ name: "publish-long-bin", version: "1.0.0", bin: long }),
+    );
+
+    const { out, err, exitCode } = await publish(dryRunEnv, packageDir, "--dry-run");
+    expect(err).not.toContain("error:");
+    expect(out).toContain("+ publish-long-bin@1.0.0 (dry-run)");
+    expect(exitCode).toBe(0);
+  });
+});
+
 test("dependencies are installed", async () => {
   const { packageDir, packageJson } = await registry.createTestDir();
   const publishDir = tmpdirSync();

From 2feba6ed2a407bddc798cc59afdc27d8ce2634eb Mon Sep 17 00:00:00 2001
From: robobun <117481402+robobun@users.noreply.github.com>
Date: Mon, 17 Aug 2026 01:06:09 +0000
Subject: [PATCH 036/258] install: stop panicking on bin values longer than the
 path buffer (#38954)

---
 src/install/bin.rs                            | 226 ++++++------
 .../bun-install-native-binlink.test.ts        |   5 +
 test/cli/install/bun-install-registry.test.ts | 338 +++++++++++++++++-
 .../create-native-binlink-altpath-packages.ts |  15 +-
 .../package.json                              |  21 +-
 ...st-native-binlink-altpath-target-4.0.0.tgz | Bin 0 -> 342 bytes
 .../test-native-binlink-altpath/package.json  |  23 +-
 .../test-native-binlink-altpath-4.0.0.tgz     | Bin 0 -> 324 bytes
 8 files changed, 516 insertions(+), 112 deletions(-)
 create mode 100644 test/cli/install/registry/packages/test-native-binlink-altpath-target/test-native-binlink-altpath-target-4.0.0.tgz
 create mode 100644 test/cli/install/registry/packages/test-native-binlink-altpath/test-native-binlink-altpath-4.0.0.tgz

diff --git a/src/install/bin.rs b/src/install/bin.rs
index 7bb19bf33bbf..763755386e16 100644
--- a/src/install/bin.rs
+++ b/src/install/bin.rs
@@ -1042,11 +1042,10 @@ impl<'a> Linker<'a> {
 
         // Create temporary file path
         let mut tmppath_buf = [0u8; MAX_PATH_BYTES];
-        let tmppath = resolve_path::join_abs_string_buf_z::<PlatformAuto>(
-            dir_path,
-            &mut tmppath_buf,
-            &[tmpname.as_bytes()],
-        );
+        let Some(tmppath) = Self::join_z_checked(dir_path, tmpname.as_bytes(), &mut tmppath_buf)
+        else {
+            return;
+        };
         let mut needs_unlink = true;
         let unlink_guard = scopeguard::guard(&mut needs_unlink, |needs_unlink| {
             if *needs_unlink {
@@ -1263,8 +1262,16 @@ impl<'a> Linker<'a> {
         // so each return path calls `Self::chmod_on_ok` explicitly instead.
 
         let abs_dest_dir = resolve_path::dirname::<PlatformAuto>(abs_dest.as_bytes());
-        let rel_target =
-            resolve_path::relative_buf_z(self.rel_buf, abs_dest_dir, abs_target.as_bytes());
+        // One `..` per component of `abs_dest_dir` can make this longer than `abs_target`.
+        let rel_bound = abs_target.len() + 3 * (strings::count_char(abs_dest_dir, SEP) + 1) + 2;
+        let mut rel_spill: Vec<u8>;
+        let rel_buf: &mut [u8] = if rel_bound <= self.rel_buf.len() {
+            self.rel_buf
+        } else {
+            rel_spill = vec![0; rel_bound];
+            &mut rel_spill
+        };
+        let rel_target = resolve_path::relative_buf_z(rel_buf, abs_dest_dir, abs_target.as_bytes());
 
         debug_assert!(strings::has_prefix(rel_target.as_bytes(), b".."));
 
@@ -1464,59 +1471,73 @@ impl<'a> Linker<'a> {
     ///
     /// Falls through to (1) when nothing exists so the existing
     /// `skipped_due_to_missing_bin` retry-without-redirect path still fires.
-    // `is_native_binlink_redirect()` is hoisted to a parameter so the
-    // caller can drop its `&self` borrow before mutably calling
-    // `link_bin_or_create_shim`. Result borrows the threadlocal join buffer
-    // (lifetime tied to `package_dir` per `join_abs_string_z`'s signature).
+    /// `None`: the path does not fit `buf`; callers treat that as a missing bin.
     fn resolve_bin_target<'b>(
         is_native_binlink_redirect: bool,
-        package_dir: &'b [u8],
+        package_dir: &[u8],
         target: &[u8],
         bin_name: &[u8],
-    ) -> &'b ZStr {
+        buf: &'b mut [u8],
+    ) -> Option<&'b ZStr> {
         // A trailing separator would make `lchmod` follow a symlinked target; npm drops it too.
         let target = strings::without_trailing_slash(target);
-        let primary = resolve_path::join_abs_string_z::<PlatformAuto>(package_dir, &[target]);
 
         if !is_native_binlink_redirect {
-            return primary;
-        }
-
-        if sys::exists(primary.as_bytes()) {
-            return primary;
-        }
-
-        if !bin_name.is_empty() {
-            let at_root = resolve_path::join_abs_string_z::<PlatformAuto>(package_dir, &[bin_name]);
-            if sys::exists(at_root.as_bytes()) {
-                return at_root;
-            }
+            return Self::join_z_checked(package_dir, target, buf);
         }
 
         let target_basename = path::basename(target);
-        if !target_basename.is_empty() && target_basename.len() != target.len() {
-            let at_root =
-                resolve_path::join_abs_string_z::<PlatformAuto>(package_dir, &[target_basename]);
-            if sys::exists(at_root.as_bytes()) {
-                return at_root;
-            }
-        }
+        let exe_name: Vec<u8> =
+            if !bin_name.is_empty() && !strings::has_suffix_comptime(bin_name, b".exe") {
+                [bin_name, b".exe"].concat()
+            } else {
+                Vec::new()
+            };
+        let candidates: [&[u8]; 4] = [
+            // (1)
+            target,
+            // (2)
+            bin_name,
+            // (3), only when `target` has a directory component
+            if target_basename.len() != target.len() {
+                target_basename
+            } else {
+                b""
+            },
+            // (4)
+            &exe_name,
+        ];
 
-        if !bin_name.is_empty() && !strings::has_suffix_comptime(bin_name, b".exe") {
-            let mut exe_name = Vec::with_capacity(bin_name.len() + b".exe".len());
-            exe_name.extend_from_slice(bin_name);
-            exe_name.extend_from_slice(b".exe");
-            let at_root =
-                resolve_path::join_abs_string_z::<PlatformAuto>(package_dir, &[&exe_name]);
-            if sys::exists(at_root.as_bytes()) {
-                return at_root;
+        for candidate in candidates {
+            if candidate.is_empty() {
+                continue;
+            }
+            let Some(abs_candidate) = Self::join_z_checked(package_dir, candidate, buf) else {
+                continue;
+            };
+            if sys::exists_z(abs_candidate) {
+                let len = abs_candidate.len();
+                return Some(ZStr::from_buf(buf, len));
             }
         }
 
-        // Nothing found; return the primary so `linkBinOrCreateShim` sets
+        // Nothing found; return the primary so `link_bin_or_create_shim` sets
         // `skipped_due_to_missing_bin` and the caller retries without the
         // redirect.
-        resolve_path::join_abs_string_z::<PlatformAuto>(package_dir, &[target])
+        Self::join_z_checked(package_dir, target, buf)
+    }
+
+    /// `<dir>/<relative>` with a NUL in `buf`, or `None` if it does not fit (`sys` rejects it too).
+    fn join_z_checked<'b>(dir: &[u8], relative: &[u8], buf: &'b mut [u8]) -> Option<&'b ZStr> {
+        let without_nul = buf.len() - 1;
+        let len = resolve_path::join_abs_string_buf_checked::<PlatformAuto>(
+            dir,
+            &mut buf[..without_nul],
+            &[relative],
+        )?
+        .len();
+        buf[len] = 0;
+        Some(ZStr::from_buf(buf, len))
     }
 
     /// uses `self.abs_target_buf`
@@ -1588,17 +1609,13 @@ impl<'a> Linker<'a> {
 
         debug_assert!(self.bin.tag != Tag::None);
 
-        // `link_bin_or_create_shim(&mut self, ..)`
-        // is called while `abs_target` / `abs_dest` borrow `self.abs_target_buf`
-        // / `self.abs_dest_buf`. `link_bin_or_create_shim` never reads or writes
-        // those two buffers (it only touches `rel_buf`, `node_modules_path`, `seen`, `err`,
-        // `skipped_due_to_missing_bin`). Detach the `abs_dest` borrow via a raw
-        // pointer so borrowck allows the disjoint access; the SAFETY invariant
-        // is that `abs_dest_buf` is not aliased mutably for the lifetime of the
-        // detached slice. `package_dir` (`abs_target_buf[0..package_dir_len]`)
-        // is re-derived inside each arm so no detached borrow is needed for it.
+        // SAFETY (`from_raw` below): `link_bin_or_create_shim` never touches `abs_dest_buf`.
         let abs_dest_buf_ptr: *mut u8 = self.abs_dest_buf.as_mut_ptr();
 
+        // `abs_target_buf` holds `package_dir`, the join input, so the output needs its own buffer.
+        let mut resolved_target_pool_buf = path::path_buffer_pool::get();
+        let resolved_target_buf = resolved_target_pool_buf.as_mut_slice();
+
         // SAFETY: tag determines the active union field
         unsafe {
             match self.bin.tag {
@@ -1616,20 +1633,15 @@ impl<'a> Linker<'a> {
                         Dependency::unscoped_package_name(self.package_name.slice());
 
                     // for normalizing `target`
-                    let abs_target: &ZStr = {
-                        let package_dir = &self.abs_target_buf[0..package_dir_len];
-                        let r = Self::resolve_bin_target(
-                            is_redirect,
-                            package_dir,
-                            target,
-                            unscoped_package_name,
-                        );
-                        // SAFETY: `resolve_bin_target` writes into the thread-local
-                        // `PARSER_JOIN_INPUT_BUFFER` (via `join_abs_string_z`); the
-                        // returned slice does not actually borrow `self` or
-                        // `package_dir`. Detach the lifetime so `self` can be
-                        // re-borrowed mutably below.
-                        ZStr::from_raw(r.as_bytes().as_ptr(), r.len())
+                    let Some(abs_target) = Self::resolve_bin_target(
+                        is_redirect,
+                        &self.abs_target_buf[0..package_dir_len],
+                        target,
+                        unscoped_package_name,
+                        resolved_target_buf,
+                    ) else {
+                        self.skipped_due_to_missing_bin = true;
+                        return;
                     };
 
                     if unscoped_package_name.len()
@@ -1672,16 +1684,15 @@ impl<'a> Linker<'a> {
                     }
 
                     // for normalizing `target`
-                    let abs_target: &ZStr = {
-                        let package_dir = &self.abs_target_buf[0..package_dir_len];
-                        let r = Self::resolve_bin_target(
-                            is_redirect,
-                            package_dir,
-                            target,
-                            normalized_name,
-                        );
-                        // SAFETY: thread-local buffer; see Tag::File above.
-                        ZStr::from_raw(r.as_bytes().as_ptr(), r.len())
+                    let Some(abs_target) = Self::resolve_bin_target(
+                        is_redirect,
+                        &self.abs_target_buf[0..package_dir_len],
+                        target,
+                        normalized_name,
+                        resolved_target_buf,
+                    ) else {
+                        self.skipped_due_to_missing_bin = true;
+                        return;
                     };
 
                     self.abs_dest_buf[dest_off..dest_off + normalized_name.len()]
@@ -1728,16 +1739,16 @@ impl<'a> Linker<'a> {
                             return;
                         }
 
-                        let abs_target: &ZStr = {
-                            let package_dir = &self.abs_target_buf[0..package_dir_len];
-                            let r = Self::resolve_bin_target(
-                                is_redirect,
-                                package_dir,
-                                bin_target,
-                                normalized_bin_dest,
-                            );
-                            // SAFETY: thread-local buffer; see Tag::File above.
-                            ZStr::from_raw(r.as_bytes().as_ptr(), r.len())
+                        let Some(abs_target) = Self::resolve_bin_target(
+                            is_redirect,
+                            &self.abs_target_buf[0..package_dir_len],
+                            bin_target,
+                            normalized_bin_dest,
+                            resolved_target_buf,
+                        ) else {
+                            self.skipped_due_to_missing_bin = true;
+                            i += 2;
+                            continue;
                         };
 
                         dest_off = abs_dest_dir_end;
@@ -1766,15 +1777,13 @@ impl<'a> Linker<'a> {
                         return;
                     }
                     // for normalizing `target`
-                    let abs_target_dir: &ZStr = {
-                        let package_dir = &self.abs_target_buf[0..package_dir_len];
-                        let r =
-                            resolve_path::join_abs_string_z::<PlatformAuto>(package_dir, &[target]);
-                        // SAFETY: `join_abs_string_z` writes into the thread-local
-                        // `PARSER_JOIN_INPUT_BUFFER`; result does not borrow
-                        // `package_dir`. Detached so `abs_target_buf` can be
-                        // reused inside the loop body (see the SAFETY note below).
-                        ZStr::from_raw(r.as_bytes().as_ptr(), r.len())
+                    let Some(abs_target_dir) = Self::join_z_checked(
+                        &self.abs_target_buf[0..package_dir_len],
+                        target,
+                        resolved_target_buf,
+                    ) else {
+                        self.err = Some(crate::Error::Sys(bun_errno::SystemErrno::ENAMETOOLONG));
+                        return;
                     };
 
                     let target_dir = match sys::open_dir_absolute(abs_target_dir.as_bytes()) {
@@ -1800,13 +1809,16 @@ impl<'a> Linker<'a> {
                         match entry.kind {
                             sys::EntryKind::SymLink | sys::EntryKind::File => {
                                 let entry_name = entry.name.slice_u8();
-                                // `self.abs_target_buf` is available now because `path::join_abs_string_z` copied everything into `parse_join_input_buffer`
+                                // `package_dir` is no longer needed, so `abs_target_buf` is free.
                                 let abs_target: &ZStr = {
-                                    let r = resolve_path::join_abs_string_buf_z::<PlatformAuto>(
+                                    let Some(r) = Self::join_z_checked(
                                         abs_target_dir.as_bytes(),
+                                        entry_name,
                                         self.abs_target_buf,
-                                        &[entry_name],
-                                    );
+                                    ) else {
+                                        self.skipped_due_to_missing_bin = true;
+                                        continue;
+                                    };
                                     // SAFETY: result lives in `self.abs_target_buf`, which
                                     // `link_bin_or_create_shim` does not write to (only
                                     // `rel_buf`/`node_modules_path`/`seen`/`err`/
@@ -1847,11 +1859,6 @@ impl<'a> Linker<'a> {
 
         debug_assert!(self.bin.tag != Tag::None);
 
-        // see `link()` — detach abs_target_buf borrow via raw ptr.
-        let abs_target_buf_ptr: *const u8 = self.abs_target_buf.as_ptr();
-        // SAFETY: abs_target_buf is not written between here and use.
-        let package_dir = unsafe { bun_core::ffi::slice(abs_target_buf_ptr, package_dir_len) };
-
         // SAFETY: tag determines the active union field
         unsafe {
             match self.bin.tag {
@@ -1936,8 +1943,15 @@ impl<'a> Linker<'a> {
                         return;
                     }
 
-                    let abs_target_dir =
-                        resolve_path::join_abs_string_z::<PlatformAuto>(package_dir, &[target]);
+                    let mut abs_target_dir_buf = path::path_buffer_pool::get();
+                    let Some(abs_target_dir) = Self::join_z_checked(
+                        &self.abs_target_buf[0..package_dir_len],
+                        target,
+                        abs_target_dir_buf.as_mut_slice(),
+                    ) else {
+                        self.err = Some(crate::Error::Sys(bun_errno::SystemErrno::ENAMETOOLONG));
+                        return;
+                    };
 
                     let target_dir = match sys::open_dir_absolute(abs_target_dir.as_bytes()) {
                         Ok(d) => d,
diff --git a/test/cli/install/bun-install-native-binlink.test.ts b/test/cli/install/bun-install-native-binlink.test.ts
index 71df3ee19c83..1f5e6433d135 100644
--- a/test/cli/install/bun-install-native-binlink.test.ts
+++ b/test/cli/install/bun-install-native-binlink.test.ts
@@ -460,6 +460,11 @@ describe.concurrent("native binlink altpath", () => {
       targetFile: "altpath-cmd.exe",
       description: "<pkg>/<bin_name>.exe (@esbuild/win32 shape)",
     },
+    {
+      version: "4.0.0",
+      targetFile: "altpath-cmd",
+      description: "<pkg>/<bin_name> when the bin value does not fit the path buffer",
+    },
   ] as const;
 
   for (const linker of ["hoisted", "isolated"]) {
diff --git a/test/cli/install/bun-install-registry.test.ts b/test/cli/install/bun-install-registry.test.ts
index be638966e2f6..c70bc604fa05 100644
--- a/test/cli/install/bun-install-registry.test.ts
+++ b/test/cli/install/bun-install-registry.test.ts
@@ -2,7 +2,7 @@ import { file, spawn, write } from "bun";
 import { install_test_helpers, npm_manifest_test_helpers } from "bun:internal-for-testing";
 import { afterAll, beforeEach, describe, expect, setDefaultTimeout, test } from "bun:test";
 import { copyFileSync, mkdirSync } from "fs";
-import { cp, exists, lstat, mkdir, readlink, rm, writeFile } from "fs/promises";
+import { cp, exists, lstat, mkdir, readlink, rename, rm, writeFile } from "fs/promises";
 import {
   assertManifestsPopulated,
   bunExe,
@@ -3281,6 +3281,342 @@ describe("binaries", () => {
     expect(err).not.toContain("error:");
     expect(await exited).toBe(0);
   });
+
+  describe("bin values longer than the path buffer", () => {
+    // Longer than the path buffer (MAX_PATH_BYTES: 96 KiB on Windows, 4 KiB on
+    // Linux, 1 KiB on macOS), so on every platform the linker cannot even build
+    // the target path.
+    const longValue = Buffer.alloc(100_000, "b").toString();
+    // Also longer than the buffer as written, but normalizes to a short path.
+    const longNormalizingValue = Buffer.alloc(20_000 * "x/../".length, "x/../").toString() + "normalizing-bin.js";
+    const script = (name: string) => `#!/usr/bin/env node\nconsole.log("${name}")`;
+    const binDir = () => join(packageDir, "node_modules", ".bin");
+    const binEntries = (...names: string[]) =>
+      names.flatMap(name => (isWindows ? [`${name}.bunx`, `${name}.exe`] : [name])).sort();
+
+    async function run(args: string[], { cwd = packageDir, env: runEnv = env } = {}) {
+      await using proc = spawn({
+        cmd: [bunExe(), ...args],
+        cwd,
+        stdout: "pipe",
+        stderr: "pipe",
+        env: runEnv,
+      });
+      const [out, err, exitCode] = await Promise.all([proc.stdout.text(), proc.stderr.text(), proc.exited]);
+      return { out, err, exitCode };
+    }
+    const install = (linker: "hoisted" | "isolated", cwd = packageDir) =>
+      run(["install", `--linker=${linker}`], { cwd });
+
+    // For the tests below that need paths close to the limit (POSIX only: the
+    // Windows buffer is far larger than any path the filesystem accepts).
+    const maxPathBytes = isMacOS ? 1024 : 4096;
+    // Directory components (at most 200 bytes each) that bring `base` to exactly `length` bytes.
+    const componentsUpTo = (base: string, length: number, fill: string) => {
+      const components: string[] = [];
+      let remaining = length - Buffer.byteLength(base);
+      while (remaining > 0) {
+        let len = Math.min(200, remaining - 1);
+        if (remaining - 1 - len === 1) len -= 1;
+        components.push(Buffer.alloc(len, fill).toString());
+        remaining -= 1 + len;
+      }
+      return components;
+    };
+    // Creates `<pkgDir>/bins/<chain>/` holding `entries`. The absolute paths can be
+    // too long for the OS to create directly, so descend one component at a time.
+    async function createBinChain(pkgDir: string, chain: string[], entries: Record<string, string>) {
+      const { err, exitCode } = await run(
+        [
+          "-e",
+          `const fs = require("fs");
+           for (const component of process.argv.slice(1)) { fs.mkdirSync(component); process.chdir(component); }
+           for (const [name, contents] of Object.entries(${JSON.stringify(entries)})) fs.writeFileSync(name, contents);`,
+          "bins",
+          ...chain,
+        ],
+        { cwd: pkgDir },
+      );
+      expect(err).toBe("");
+      expect(exitCode).toBe(0);
+    }
+    // Shortens the paths again so that ordinary tools can delete the directory.
+    const shortenBinChain = (pkgDir: string, chain: string[]) =>
+      rename(join(pkgDir, "bins", chain[0]), join(pkgDir, "bins", "d"));
+
+    for (const linker of ["hoisted", "isolated"] as const) {
+      test(`file targets are skipped like missing bins (${linker})`, async () => {
+        // A target this long cannot exist, and the linker silently skips a bin
+        // whose target does not exist, so these install without output and the
+        // other bins are still linked. Covers the string, single-entry and
+        // multi-entry forms of "bin", which are linked by separate code paths.
+        await Promise.all([
+          write(
+            packageJson,
+            JSON.stringify({
+              name: "foo",
+              dependencies: {
+                "long-file-bin": "./long-file-bin",
+                "long-named-bin": "./long-named-bin",
+                "long-map-bin": "./long-map-bin",
+                "normalizing-bin": "./normalizing-bin",
+              },
+            }),
+          ),
+          write(
+            join(packageDir, "long-file-bin", "package.json"),
+            JSON.stringify({ name: "long-file-bin", version: "1.0.0", bin: longValue }),
+          ),
+          write(
+            join(packageDir, "long-named-bin", "package.json"),
+            JSON.stringify({ name: "long-named-bin", version: "1.0.0", bin: { "long-named-bin": longValue } }),
+          ),
+          write(
+            join(packageDir, "long-map-bin", "package.json"),
+            JSON.stringify({
+              name: "long-map-bin",
+              version: "1.0.0",
+              bin: { "long-map-bin-1": longValue, "long-map-bin-2": "long-map-bin-2.js" },
+            }),
+          ),
+          write(join(packageDir, "long-map-bin", "long-map-bin-2.js"), script("long-map-bin-2")),
+          write(
+            join(packageDir, "normalizing-bin", "package.json"),
+            JSON.stringify({
+              name: "normalizing-bin",
+              version: "1.0.0",
+              bin: { "normalizing-bin": longNormalizingValue },
+            }),
+          ),
+          write(join(packageDir, "normalizing-bin", "normalizing-bin.js"), script("normalizing-bin")),
+        ]);
+
+        const expectBins = async () => {
+          expect(await readdirSorted(binDir())).toEqual(binEntries("long-map-bin-2", "normalizing-bin"));
+          if (linker === "hoisted") {
+            expect(join(binDir(), "long-map-bin-2")).toBeValidBin(join("..", "long-map-bin", "long-map-bin-2.js"));
+            expect(join(binDir(), "normalizing-bin")).toBeValidBin(join("..", "normalizing-bin", "normalizing-bin.js"));
+          }
+        };
+
+        let { out, err, exitCode } = await install(linker);
+        expect(err).not.toContain("error:");
+        expect(err).toContain("Saved lockfile");
+        expect(out).toContain("+ long-file-bin@long-file-bin");
+        expect(out).toContain("+ long-named-bin@long-named-bin");
+        expect(out).toContain("+ long-map-bin@long-map-bin");
+        expect(out).toContain("+ normalizing-bin@normalizing-bin");
+        expect(exitCode).toBe(0);
+        await expectBins();
+
+        // The lockfile stores the values as written, so linking from it hits the same paths.
+        await rm(binDir(), { recursive: true, force: true });
+        ({ err, exitCode } = await install(linker));
+        expect(err).not.toContain("error:");
+        expect(exitCode).toBe(0);
+        await expectBins();
+      });
+
+      test(`directories.bin fails with ENAMETOOLONG (${linker})`, async () => {
+        // The linker reports every failure to open a bin directory other than
+        // ENOENT, and ENAMETOOLONG is what the OS reports for a directory path it
+        // cannot address, so a value that does not fit gets the same error.
+        await Promise.all([
+          write(
+            packageJson,
+            JSON.stringify({
+              name: "foo",
+              dependencies: {
+                "long-dir-bin": "./long-dir-bin",
+                "ok-bin": "./ok-bin",
+              },
+            }),
+          ),
+          write(
+            join(packageDir, "long-dir-bin", "package.json"),
+            JSON.stringify({ name: "long-dir-bin", version: "1.0.0", directories: { bin: longValue } }),
+          ),
+          write(
+            join(packageDir, "ok-bin", "package.json"),
+            JSON.stringify({ name: "ok-bin", version: "1.0.0", bin: { "ok-bin": "ok-bin.js" } }),
+          ),
+          write(join(packageDir, "ok-bin", "ok-bin.js"), script("ok-bin")),
+        ]);
+
+        const { err, exitCode } = await install(linker);
+        expect(err).toContain(
+          linker === "hoisted"
+            ? "error: Failed to link long-dir-bin: ENAMETOOLONG"
+            : "ENAMETOOLONG: failed to link binaries for package: long-dir-bin@",
+        );
+        expect(exitCode).toBe(1);
+
+        // The rest of the install still happens.
+        expect(await exists(join(packageDir, "node_modules", "ok-bin", "package.json"))).toBeTrue();
+        if (linker === "hoisted") {
+          expect(await exists(join(packageDir, "node_modules", "long-dir-bin", "package.json"))).toBeTrue();
+          expect(await readdirSorted(binDir())).toEqual(binEntries("ok-bin"));
+        }
+      });
+    }
+
+    // The entries of a bin directory are joined onto the directory's path as
+    // well, and so is the temporary file used to rewrite a CRLF shebang.
+    test.skipIf(isWindows)("entries of a directories.bin close to the path limit", async () => {
+      // Most of the depth goes into the project directory: the `.bin` links are
+      // relative, so everything below the package ends up in the link targets,
+      // and XFS rejects link targets of 1 KiB or more. The bin directory is then
+      // 64 bytes below the limit, so it can be opened. Joined onto it, `short.js`
+      // fits, `crlfEntry` fits but the temporary file for its shebang (27 bytes
+      // longer) does not, and `longEntry` does not fit at all.
+      const project = join(packageDir, ...componentsUpTo(packageDir, maxPathBytes - 768, "p"));
+      const pkgDir = join(project, "deep-dir-bin");
+      const chain = componentsUpTo(join(project, "node_modules", "deep-dir-bin", "bins"), maxPathBytes - 64, "d");
+      const crlfEntry = Buffer.alloc(49, "c").toString() + ".js";
+      const crlfScript = `#!/usr/bin/env node\r\nconsole.log("crlf")`;
+      const longEntry = Buffer.alloc(128, "e").toString();
+
+      await Promise.all([
+        write(join(project, "package.json"), JSON.stringify({ name: "foo", workspaces: ["deep-dir-bin"] })),
+        write(
+          join(pkgDir, "package.json"),
+          JSON.stringify({ name: "deep-dir-bin", version: "1.0.0", directories: { bin: join("bins", ...chain) } }),
+        ),
+      ]);
+      await createBinChain(pkgDir, chain, {
+        "short.js": script("short"),
+        [crlfEntry]: crlfScript,
+        [longEntry]: script("long"),
+      });
+
+      try {
+        const { err, exitCode } = await install("hoisted", project);
+        expect(err).not.toContain("error:");
+        expect(exitCode).toBe(0);
+        const projectBinDir = join(project, "node_modules", ".bin");
+        expect(await readdirSorted(projectBinDir)).toEqual([crlfEntry, "short.js"]);
+        expect(join(projectBinDir, "short.js")).toBeValidBin(join("..", "deep-dir-bin", "bins", ...chain, "short.js"));
+        expect(join(projectBinDir, crlfEntry)).toBeValidBin(join("..", "deep-dir-bin", "bins", ...chain, crlfEntry));
+      } finally {
+        await shortenBinChain(pkgDir, chain);
+      }
+      // Linked, but left as it was since the shebang could not be rewritten in place.
+      expect(await file(join(pkgDir, "bins", "d", ...chain.slice(1), crlfEntry)).text()).toBe(crlfScript);
+    });
+
+    // The link itself is relative to the bin directory. A global bin directory
+    // on another branch of the tree contributes one `..` per component, so the
+    // link target can be longer than the target's absolute path.
+    test.skipIf(isWindows)("bun link with a link target longer than the path buffer", async () => {
+      // As in the previous test, most of the depth has to sit above everything
+      // that ends up in a link target that is meant to be created (XFS), so it
+      // goes into the global directory itself.
+      const globalBase = join(packageDir, "global", "install");
+      const globalDir = join(globalBase, ...componentsUpTo(globalBase, maxPathBytes - 768, "g"));
+      const pkgDir = join(packageDir, "far-bin");
+      // The linker sees the target as <globalDir>/node_modules/far-bin/bins/<chain>/<entry>,
+      // 20 bytes below the limit.
+      const chain = componentsUpTo(join(globalDir, "node_modules", "far-bin", "bins"), maxPathBytes - 64, "d");
+      const entry = Buffer.alloc(43, "e").toString();
+      await Promise.all([
+        mkdir(globalDir, { recursive: true }),
+        write(
+          join(pkgDir, "package.json"),
+          JSON.stringify({ name: "far-bin", version: "1.0.0", directories: { bin: join("bins", ...chain) } }),
+        ),
+      ]);
+      await createBinChain(pkgDir, chain, { [entry]: script("far") });
+      const link = (binDir: string) =>
+        run(["link"], {
+          cwd: pkgDir,
+          env: {
+            ...env,
+            BUN_INSTALL: join(packageDir, "global"),
+            BUN_INSTALL_GLOBAL_DIR: globalDir,
+            BUN_INSTALL_BIN: binDir,
+          },
+        });
+
+      try {
+        // Below the global directory the link target drops that common prefix and
+        // fits (about 770 bytes), even though the per-component estimate says it
+        // might not.
+        const nearBinDir = join(globalDir, "a", "b", "c", "d", "e", "bin");
+        let { out, err, exitCode } = await link(nearBinDir);
+        expect(err).not.toContain("error:");
+        expect(out).toContain('Success! Registered "far-bin"');
+        expect(exitCode).toBe(0);
+        expect(await readdirSorted(nearBinDir)).toEqual([entry]);
+        expect(join(nearBinDir, entry)).toBeValidBin(
+          join("..", "..", "..", "..", "..", "..", "node_modules", "far-bin", "bins", ...chain, entry),
+        );
+
+        // Far enough away for the `..`s to outweigh the prefix they replace: the
+        // link target no longer fits, and the OS refuses to create the link.
+        const farBinDir = join(
+          packageDir,
+          ...Array(Math.ceil(Buffer.byteLength(packageDir) / 3) + 40).fill("x"),
+          "bin",
+        );
+        ({ err, exitCode } = await link(farBinDir));
+        expect(err).toContain("error: failed to link bin due to error ENAMETOOLONG");
+        expect(exitCode).toBe(1);
+        expect(await readdirSorted(farBinDir)).toEqual([]);
+      } finally {
+        await shortenBinChain(pkgDir, chain);
+      }
+    });
+
+    test("bun link and bun unlink", async () => {
+      // `bun link` links a package's bins into the global bin directory with the
+      // same linker, and `bun unlink` is the only caller of its unlink side, which
+      // has to open the same bin directory.
+      const globalDir = join(packageDir, "global");
+      const globalEnv = {
+        ...env,
+        BUN_INSTALL: globalDir,
+        BUN_INSTALL_GLOBAL_DIR: join(globalDir, "install", "global"),
+        BUN_INSTALL_BIN: join(globalDir, "bin"),
+      };
+      const globalBins = () => readdirSorted(join(globalDir, "bin"));
+      await Promise.all([
+        write(
+          join(packageDir, "long-map-bin", "package.json"),
+          JSON.stringify({
+            name: "long-map-bin",
+            version: "1.0.0",
+            bin: { "long-map-bin-1": longValue, "long-map-bin-2": "long-map-bin-2.js" },
+          }),
+        ),
+        write(join(packageDir, "long-map-bin", "long-map-bin-2.js"), script("long-map-bin-2")),
+        write(
+          join(packageDir, "long-dir-bin", "package.json"),
+          JSON.stringify({ name: "long-dir-bin", version: "1.0.0", directories: { bin: longValue } }),
+        ),
+      ]);
+
+      let { out, err, exitCode } = await run(["link"], { cwd: join(packageDir, "long-map-bin"), env: globalEnv });
+      expect(err).not.toContain("error:");
+      expect(out).toContain('Success! Registered "long-map-bin"');
+      expect(exitCode).toBe(0);
+      expect(await globalBins()).toEqual(binEntries("long-map-bin-2"));
+
+      ({ out, exitCode } = await run(["unlink"], { cwd: join(packageDir, "long-map-bin"), env: globalEnv }));
+      expect(out).toContain('success: unlinked package "long-map-bin"');
+      expect(exitCode).toBe(0);
+      expect(await globalBins()).toEqual([]);
+
+      // The package is registered before its bins are linked, so the failed link
+      // still leaves something for `bun unlink` to remove.
+      ({ err, exitCode } = await run(["link"], { cwd: join(packageDir, "long-dir-bin"), env: globalEnv }));
+      expect(err).toContain("error: failed to link bin due to error ENAMETOOLONG");
+      expect(exitCode).toBe(1);
+
+      ({ out, exitCode } = await run(["unlink"], { cwd: join(packageDir, "long-dir-bin"), env: globalEnv }));
+      expect(out).toContain('success: unlinked package "long-dir-bin"');
+      expect(exitCode).toBe(0);
+    });
+  });
 });
 
 test("--config cli flag works", async () => {
diff --git a/test/cli/install/registry/packages/create-native-binlink-altpath-packages.ts b/test/cli/install/registry/packages/create-native-binlink-altpath-packages.ts
index fce515ac49ea..7478945306c4 100644
--- a/test/cli/install/registry/packages/create-native-binlink-altpath-packages.ts
+++ b/test/cli/install/registry/packages/create-native-binlink-altpath-packages.ts
@@ -13,6 +13,9 @@
  *          probe 4's `<bin_name>.exe` misses; isolates probe 3)
  *   3.0.0  parent bin `bin/altpath-cmd`, target ships `altpath-cmd.exe` at root
  *          → probe 4, `<pkg>/<bin_name>.exe` (@esbuild/win32-* shape)
+ *   4.0.0  parent bin is an 8 KiB value that does not fit the path buffer on
+ *          Linux or macOS (so probe 1 cannot even be built, and no stub is
+ *          packed for it), target ships `altpath-cmd` at root → probe 2
  */
 
 import { mkdir, writeFile } from "fs/promises";
@@ -55,10 +58,13 @@ console.log("SUCCESS: Using platform-specific bin at package root");
 process.exit(0);
 `;
 
+const longBinValue = "bin/" + Buffer.alloc(8192, "b").toString();
+
 const shapes = [
   { version: "1.0.0", parentBinValue: "bin/altpath-cmd.exe", targetFile: "altpath-cmd" },
   { version: "2.0.0", parentBinValue: "bin/launcher.exe", targetFile: "launcher.exe" },
   { version: "3.0.0", parentBinValue: "bin/altpath-cmd", targetFile: "altpath-cmd.exe" },
+  { version: "4.0.0", parentBinValue: longBinValue, targetFile: "altpath-cmd" },
 ] as const;
 
 const parentVersions: Record<string, { tarball: string; pkgJson: object }> = {};
@@ -74,9 +80,12 @@ for (const { version, parentBinValue, targetFile } of shapes) {
   };
   parentVersions[version] = {
     pkgJson: parentJson,
-    tarball: await packTarball("test-native-binlink-altpath", version, parentJson, {
-      [parentBinValue]: stub,
-    }),
+    tarball: await packTarball(
+      "test-native-binlink-altpath",
+      version,
+      parentJson,
+      parentBinValue === longBinValue ? {} : { [parentBinValue]: stub },
+    ),
   };
 
   const targetJson = {
diff --git a/test/cli/install/registry/packages/test-native-binlink-altpath-target/package.json b/test/cli/install/registry/packages/test-native-binlink-altpath-target/package.json
index aac96faf9891..ad04aeeb719d 100644
--- a/test/cli/install/registry/packages/test-native-binlink-altpath-target/package.json
+++ b/test/cli/install/registry/packages/test-native-binlink-altpath-target/package.json
@@ -2,7 +2,7 @@
   "_id": "test-native-binlink-altpath-target",
   "name": "test-native-binlink-altpath-target",
   "dist-tags": {
-    "latest": "3.0.0"
+    "latest": "4.0.0"
   },
   "versions": {
     "1.0.0": {
@@ -61,6 +61,25 @@
         "shasum": "b1b381785a8690834073eef4b9d92ccc1b2a3347",
         "tarball": "http://localhost:4873/test-native-binlink-altpath-target/-/test-native-binlink-altpath-target-3.0.0.tgz"
       }
+    },
+    "4.0.0": {
+      "name": "test-native-binlink-altpath-target",
+      "version": "4.0.0",
+      "os": [
+        "darwin",
+        "linux",
+        "win32"
+      ],
+      "cpu": [
+        "arm64",
+        "x64"
+      ],
+      "_id": "test-native-binlink-altpath-target@4.0.0",
+      "dist": {
+        "integrity": "sha512-nFy+nSrqd+Id9wpIFbHYtYp3vJfO9nvxuMlHcBAHp36csP5Cnqfz/jkCmnjHUQxFNg0t5r+cqllCzAZD4k3icA==",
+        "shasum": "63a056dbd70ced7435dd653daef17245a9df3e42",
+        "tarball": "http://localhost:4873/test-native-binlink-altpath-target/-/test-native-binlink-altpath-target-4.0.0.tgz"
+      }
     }
   }
 }
\ No newline at end of file
diff --git a/test/cli/install/registry/packages/test-native-binlink-altpath-target/test-native-binlink-altpath-target-4.0.0.tgz b/test/cli/install/registry/packages/test-native-binlink-altpath-target/test-native-binlink-altpath-target-4.0.0.tgz
new file mode 100644
index 0000000000000000000000000000000000000000..867345ea7dfc01e6bec4bb90f43b06baaa07d4a0
GIT binary patch
literal 342
zcmV-c0jd5UiwFP!00000|LxPuY63A72H;uGQ=Fz7h0e^Gah!rKrB5KPN*8gAHg!yf
zBwnEO-HSI0Zn~%nh5y?e63!un<ZorYlna%$$C`e4YoaS-=Bg}dUzz!`G8bi^@_tb=
zS4FSNiSu60{fIcagS8LRMf~TpE-&{_e8xn=$dwWU5<&Tp7#Z|NB~xu0ZI+2_LMy|2
z5~N$GAfER98|A#VW<OG<obqwkdNH8an21Qsq}yt9*e4Q=HtXGavDKzmh?wZ@Fjcqf
zpE2oHRe5gQRpp^A{)*sMPPxy{&s?u&(Y5`S|GZyZ<iB|CA^&&r_>ir=%ck07%52Ek
znTl&`ylqt4*hNQ-C!^8Jcs!tq*JeR&Bg5RfRpMJ!>$$FJstw6Nr;kL=+90~axOKKx
o-luA(Lx;P=I066w0000000000000000Dv3#29xO~^Z+OT0HU?2?EnA(

literal 0
HcmV?d00001

diff --git a/test/cli/install/registry/packages/test-native-binlink-altpath/package.json b/test/cli/install/registry/packages/test-native-binlink-altpath/package.json
index aee53d59c365..58831c434083 100644
--- a/test/cli/install/registry/packages/test-native-binlink-altpath/package.json
+++ b/test/cli/install/registry/packages/test-native-binlink-altpath/package.json
@@ -2,7 +2,7 @@
   "_id": "test-native-binlink-altpath",
   "name": "test-native-binlink-altpath",
   "dist-tags": {
-    "latest": "3.0.0"
+    "latest": "4.0.0"
   },
   "versions": {
     "1.0.0": {
@@ -67,6 +67,27 @@
         "shasum": "a7754b7851528cc3f175c180619bfc66a235a413",
         "tarball": "http://localhost:4873/test-native-binlink-altpath/-/test-native-binlink-altpath-3.0.0.tgz"
       }
+    },
+    "4.0.0": {
+      "name": "test-native-binlink-altpath",
+      "version": "4.0.0",
+      "bin": {
+        "altpath-cmd": "bin/bbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbb"
+      },
+      "scripts": {
+        "postinstall": "node -e \"require('fs').writeFileSync(require('path').join(__dirname,'postinstall-ran'),'')\""
+      },
+      "optionalDependencies": {
+        "test-native-binlink-altpath-target": "4.0.0"
+      },
+      "_id": "test-native-binlink-altpath@4.0.0",
+      "_hasInstallScript": true,
+      "hasInstallScript": true,
+      "dist": {
+        "integrity": "sha512-csMS6h+MbekxkdVvQ1wBPy9GOFSv4UGdGGVRG5kGMohmeFUlY5zJ6ieLQ8sdhVnQm/1ZqUb14O1OR8mesiiw1g==",
+        "shasum": "bd3f63bfe6512b904e8c550bdcab1202b31739d7",
+        "tarball": "http://localhost:4873/test-native-binlink-altpath/-/test-native-binlink-altpath-4.0.0.tgz"
+      }
     }
   }
 }
\ No newline at end of file
diff --git a/test/cli/install/registry/packages/test-native-binlink-altpath/test-native-binlink-altpath-4.0.0.tgz b/test/cli/install/registry/packages/test-native-binlink-altpath/test-native-binlink-altpath-4.0.0.tgz
new file mode 100644
index 0000000000000000000000000000000000000000..d6d0befd1da2a636746d3a0aa8d2cb8135df6576
GIT binary patch
literal 324
zcmV-K0lWSmiwFP!00000|LxkrYQjJe2H>3Y6vJMkVB$t&4mp>;K(B(V$y8V4B;8#t
zMSS;ymMR{4X(<T*cNy4Oc4zK?Z|bdC@wmU#Y~wqL{+QOfEDDPB*?pbpnVwNTn-p4?
zlWCcg&ZoI9Bht}7*!y5yq<{U_{c;cD7!xTmJ608`z&@m6f<17$w9;DHrlt+O32QZq
ziPV9ex1FepRFUaSUrv`+R7J;_h)8|iPwQQys&j9=1ONa400000000000001hho@qq
z(>W>NYiIl5uW5n4^TCP_rfpS4O1g$AWtuC;Z+q)_ki7b2n7un2_}RAn@*(x$yVskr
zPKMd0vocsL8tcUDc$C~cnmQxNaFis&xw?+g^}%*x+9&Q=8kXAf%}hU}Aktvmio-Sk
W5EGr^Qv?9;cs>Cd=IibNC;$LR$)Fhk

literal 0
HcmV?d00001


From 6be388513da4927f5218852e34a14dee3d51b77b Mon Sep 17 00:00:00 2001
From: robobun <117481402+robobun@users.noreply.github.com>
Date: Mon, 17 Aug 2026 01:06:13 +0000
Subject: [PATCH 037/258] pm view: escape control characters coming from the
 registry (#38536)

---
 src/bun_core/fmt.rs                | 81 +++++++++++++++++++++++++
 src/runtime/cli/pm_view_command.rs | 67 +++++++++++++++------
 test/cli/install/bun-info.test.ts  | 97 +++++++++++++++++++++++++++++-
 3 files changed, 225 insertions(+), 20 deletions(-)

diff --git a/src/bun_core/fmt.rs b/src/bun_core/fmt.rs
index 381ba04fa6c8..f52f07cbc9d5 100644
--- a/src/bun_core/fmt.rs
+++ b/src/bun_core/fmt.rs
@@ -3326,6 +3326,87 @@ fn escape_powershell_impl(str: &[u8], writer: &mut impl fmt::Write) -> fmt::Resu
     write_bytes(writer, remain)
 }
 
+// ───────────────────────────────────────────────────────────────────────────
+// escapeControlChars
+// ───────────────────────────────────────────────────────────────────────────
+
+/// Renders the wrapped `Display` with C0 controls, DEL and C1 controls
+/// spelled out (`\n`, `\r`, `\t`, `\x1b`, `\x7f`, `\u009b`) instead of
+/// written raw. For text somebody else authored (a registry manifest, a
+/// dependency's `package.json`): printed raw, an ESC/CR/C1 sequence can erase
+/// or repaint the line it is shown on and a newline can forge further lines
+/// of our output. Everything else passes through unchanged.
+pub struct EscapeControlChars<T>(pub T);
+
+/// [`EscapeControlChars`] for a value that is legitimately multi-line and is
+/// printed on its own (`bun pm view <pkg> readme`): `\t`, `\n` and `\r\n`
+/// pass through. A `\r` not followed by `\n` is still escaped; on a terminal
+/// it only overwrites the line printed so far.
+pub struct EscapeControlCharsMultiline<T>(pub T);
+
+/// [`EscapeControlChars`] over raw bytes; invalid UTF-8 renders as U+FFFD.
+pub fn escape_control_chars(text: &[u8]) -> EscapeControlChars<&bstr::BStr> {
+    EscapeControlChars(bstr::BStr::new(text))
+}
+
+/// [`EscapeControlCharsMultiline`] over raw bytes; invalid UTF-8 renders as U+FFFD.
+pub fn escape_control_chars_multiline(text: &[u8]) -> EscapeControlCharsMultiline<&bstr::BStr> {
+    EscapeControlCharsMultiline(bstr::BStr::new(text))
+}
+
+impl<T: Display> Display for EscapeControlChars<T> {
+    fn fmt(&self, f: &mut Formatter<'_>) -> fmt::Result {
+        let mut writer = EscapeControlCharsWriter {
+            f,
+            keep_line_breaks: false,
+        };
+        write!(writer, "{}", self.0)
+    }
+}
+
+impl<T: Display> Display for EscapeControlCharsMultiline<T> {
+    fn fmt(&self, f: &mut Formatter<'_>) -> fmt::Result {
+        let mut writer = EscapeControlCharsWriter {
+            f,
+            keep_line_breaks: true,
+        };
+        write!(writer, "{}", self.0)
+    }
+}
+
+struct EscapeControlCharsWriter<'a, 'f> {
+    f: &'a mut Formatter<'f>,
+    keep_line_breaks: bool,
+}
+
+impl fmt::Write for EscapeControlCharsWriter<'_, '_> {
+    fn write_str(&mut self, s: &str) -> fmt::Result {
+        let mut start = 0;
+        let mut chars = s.char_indices().peekable();
+        while let Some((i, c)) = chars.next() {
+            let pass_through = match c {
+                '\t' | '\n' => self.keep_line_breaks,
+                '\r' => self.keep_line_breaks && matches!(chars.peek(), Some((_, '\n'))),
+                '\0'..='\x1f' | '\x7f' | '\u{80}'..='\u{9f}' => false,
+                _ => true,
+            };
+            if pass_through {
+                continue;
+            }
+            self.f.write_str(&s[start..i])?;
+            match c {
+                '\n' => self.f.write_str("\\n")?,
+                '\r' => self.f.write_str("\\r")?,
+                '\t' => self.f.write_str("\\t")?,
+                c if c.is_ascii() => write!(self.f, "\\x{:02x}", c as u32)?,
+                c => write!(self.f, "\\u{:04x}", c as u32)?,
+            }
+            start = i + c.len_utf8();
+        }
+        self.f.write_str(&s[start..])
+    }
+}
+
 // js_bindings (fmtString for highlighter.test.ts) lives in src/jsc/fmt_jsc.rs
 // alongside fmt_jsc.bind.ts; bun_core/ stays JSC-free.
 
diff --git a/src/runtime/cli/pm_view_command.rs b/src/runtime/cli/pm_view_command.rs
index ebeca184aac6..205293552cce 100644
--- a/src/runtime/cli/pm_view_command.rs
+++ b/src/runtime/cli/pm_view_command.rs
@@ -316,7 +316,10 @@ pub(crate) fn view(
                         bun_fmt::format_json_string_utf8(slice, Default::default())
                     ));
                 } else {
-                    Output::print(format_args!("{}\n", BStr::new(slice)));
+                    Output::print(format_args!(
+                        "{}\n",
+                        bun_fmt::escape_control_chars_multiline(slice)
+                    ));
                 }
                 Output::flush();
                 return Ok(());
@@ -416,21 +419,23 @@ pub(crate) fn view(
             .len_u32() as usize;
     }
 
+    // Every string printed below is registry-controlled: always go through
+    // `escape_control_chars`.
     prettyln!(
         "<b><blue><u>{}<r><d>@<r><blue><b><u>{}<r> <d>|<r> <cyan>{}<r> <d>|<r> deps<d>:<r> {} <d>|<r> versions<d>:<r> {}",
-        BStr::new(pkg_name),
-        BStr::new(pkg_version),
-        BStr::new(license),
+        bun_fmt::escape_control_chars(pkg_name),
+        bun_fmt::escape_control_chars(pkg_version),
+        bun_fmt::escape_control_chars(license),
         dep_count,
         versions_len,
     );
 
     // Get description and homepage from the top-level package manifest, not the version-specific one
     if let Some(desc) = json.get_string_cloned(&bump, b"description").ok().flatten() {
-        prettyln!("{}", BStr::new(desc));
+        prettyln!("{}", bun_fmt::escape_control_chars(desc));
     }
     if let Some(hp) = json.get_string_cloned(&bump, b"homepage").ok().flatten() {
-        prettyln!("<blue>{}<r>", BStr::new(hp));
+        prettyln!("<blue>{}<r>", bun_fmt::escape_control_chars(hp));
     }
 
     if let Some(mut iter) = json.get_array(b"keywords") {
@@ -447,7 +452,10 @@ pub(crate) fn view(
             }
         }
         if !keywords.list.is_empty() {
-            prettyln!("<d>keywords:<r> {}", BStr::new(keywords.list.as_slice()));
+            prettyln!(
+                "<d>keywords:<r> {}",
+                bun_fmt::escape_control_chars(keywords.list.as_slice())
+            );
         }
     }
 
@@ -481,8 +489,8 @@ pub(crate) fn view(
             };
             prettyln!(
                 "- <cyan>{}<r><d>:<r> {}",
-                BStr::new(dep_name),
-                BStr::new(dep_version),
+                bun_fmt::escape_control_chars(dep_name),
+                bun_fmt::escape_control_chars(dep_version),
             );
         }
     }
@@ -490,13 +498,22 @@ pub(crate) fn view(
     if let Some(dist) = manifest.get_object(b"dist") {
         prettyln!("\n<d><r><b>dist<r>");
         if let Some(t) = dist.get_string_cloned(&bump, b"tarball").ok().flatten() {
-            prettyln!(" <d>.<r>tarball<d>:<r> {}", BStr::new(t));
+            prettyln!(
+                " <d>.<r>tarball<d>:<r> {}",
+                bun_fmt::escape_control_chars(t)
+            );
         }
         if let Some(s) = dist.get_string_cloned(&bump, b"shasum").ok().flatten() {
-            prettyln!(" <d>.<r>shasum<r><d>:<r> <green>{}<r>", BStr::new(s));
+            prettyln!(
+                " <d>.<r>shasum<r><d>:<r> <green>{}<r>",
+                bun_fmt::escape_control_chars(s)
+            );
         }
         if let Some(i) = dist.get_string_cloned(&bump, b"integrity").ok().flatten() {
-            prettyln!(" <d>.<r>integrity<r><d>:<r> <green>{}<r>", BStr::new(i));
+            prettyln!(
+                " <d>.<r>integrity<r><d>:<r> <green>{}<r>",
+                bun_fmt::escape_control_chars(i)
+            );
         }
         if let Some(u) = dist.get_number(b"unpackedSize") {
             prettyln!(
@@ -522,12 +539,14 @@ pub(crate) fn view(
             let val_expr = prop.value.as_ref().expect("infallible: prop has value");
             if let Some(tag) = tagname_expr.as_string(&bump) {
                 if let Some(val) = val_expr.as_string(&bump) {
+                    let tag_fmt = bun_fmt::escape_control_chars(tag);
+                    let val_fmt = bun_fmt::escape_control_chars(val);
                     if tag == b"latest" {
-                        prettyln!("<cyan>{}<r><d>:<r> {}", BStr::new(tag), BStr::new(val));
+                        prettyln!("<cyan>{}<r><d>:<r> {}", tag_fmt, val_fmt);
                     } else if tag == b"beta" {
-                        prettyln!("<blue>{}<r><d>:<r> {}", BStr::new(tag), BStr::new(val));
+                        prettyln!("<blue>{}<r><d>:<r> {}", tag_fmt, val_fmt);
                     } else {
-                        prettyln!("<magenta>{}<r><d>:<r> {}", BStr::new(tag), BStr::new(val));
+                        prettyln!("<magenta>{}<r><d>:<r> {}", tag_fmt, val_fmt);
                     }
                 }
             }
@@ -548,9 +567,13 @@ pub(crate) fn view(
                 .flatten()
                 .unwrap_or(b"");
             if !em.is_empty() {
-                prettyln!("<d>-<r> {} <d>\\<{}\\><r>", BStr::new(nm), BStr::new(em));
+                prettyln!(
+                    "<d>-<r> {} <d>\\<{}\\><r>",
+                    bun_fmt::escape_control_chars(nm),
+                    bun_fmt::escape_control_chars(em)
+                );
             } else if !nm.is_empty() {
-                prettyln!("<d>-<r> {}", BStr::new(nm));
+                prettyln!("<d>-<r> {}", bun_fmt::escape_control_chars(nm));
             }
         }
     }
@@ -563,13 +586,19 @@ pub(crate) fn view(
             .ok()
             .flatten()
         {
-            prettyln!("\n<b>Published<r><d>:<r> {}", BStr::new(published_time));
+            prettyln!(
+                "\n<b>Published<r><d>:<r> {}",
+                bun_fmt::escape_control_chars(published_time)
+            );
         } else if let Some(modified_time) = time_obj
             .get_string_cloned(&bump, b"modified")
             .ok()
             .flatten()
         {
-            prettyln!("\n<b>Published<r><d>:<r> {}", BStr::new(modified_time));
+            prettyln!(
+                "\n<b>Published<r><d>:<r> {}",
+                bun_fmt::escape_control_chars(modified_time)
+            );
         }
     }
 
diff --git a/test/cli/install/bun-info.test.ts b/test/cli/install/bun-info.test.ts
index 04b1d9fe80b7..17715a244f57 100644
--- a/test/cli/install/bun-info.test.ts
+++ b/test/cli/install/bun-info.test.ts
@@ -1,6 +1,6 @@
 import { spawn } from "bun";
 import { describe, expect, it, test } from "bun:test";
-import { bunEnv, bunExe, isASAN, tempDirWithFiles } from "harness";
+import { bunEnv, bunExe, isASAN, tempDir, tempDirWithFiles } from "harness";
 import { join } from "node:path";
 
 describe.concurrent("bun info", () => {
@@ -372,6 +372,101 @@ describe.concurrent("bun info", () => {
   });
 });
 
+describe.concurrent("bun info with control characters in the packument", () => {
+  // One of each kind of byte the registry must not be able to write to the
+  // terminal: ESC (clear screen, then an OSC title change), BEL, a bare CR
+  // (overwrites the line), CRLF, tab, DEL, and the C1 controls NEL (U+0085)
+  // and CSI (U+009B).
+  const hostile = "\x1b[2J\x1b]0;PWNED\x07\rX\r\nY\tZ\x7f\u0085\u009b[31m";
+  // How the summary view renders it: every control becomes a visible escape.
+  const escaped = String.raw`\x1b[2J\x1b]0;PWNED\x07\rX\r\nY\tZ\x7f\u0085\u009b[31m`;
+  // How `bun pm view <pkg> <field>` renders it: CRLF and tab are kept since
+  // the field itself may be multi-line (readme), everything else is escaped.
+  const escapedMultiline = String.raw`\x1b[2J\x1b]0;PWNED\x07\rX` + "\r\nY\tZ" + String.raw`\x7f\u0085\u009b[31m`;
+
+  const packument = {
+    name: "hostile",
+    "dist-tags": { latest: "1.0.0", ["tag" + hostile]: "1.0.0" },
+    description: "D" + hostile,
+    homepage: "H" + hostile,
+    keywords: ["K" + hostile, "plain"],
+    maintainers: [{ name: "M" + hostile, email: "E" + hostile }, { name: "N" + hostile }],
+    time: { "1.0.0": "P" + hostile },
+    versions: {
+      "1.0.0": {
+        name: "n" + hostile,
+        version: "1.0.0",
+        license: "L" + hostile,
+        description: "D" + hostile,
+        dependencies: { ["dep" + hostile]: "^1" + hostile },
+        dist: { tarball: "T" + hostile, shasum: "S" + hostile, integrity: "I" + hostile },
+      },
+    },
+  };
+
+  async function view(...args: string[]) {
+    await using server = Bun.serve({
+      port: 0,
+      fetch: () => Response.json(packument),
+    });
+    using dir = tempDir("bun-info-control-chars", {
+      "package.json": JSON.stringify({ name: "app", version: "1.0.0" }),
+    });
+    await using proc = spawn({
+      cmd: [bunExe(), ...args],
+      cwd: String(dir),
+      env: { ...bunEnv, NPM_CONFIG_REGISTRY: server.url.href },
+      stdout: "pipe",
+      stderr: "pipe",
+      stdin: "ignore",
+    });
+    const [stdout, stderr, exitCode] = await Promise.all([proc.stdout.text(), proc.stderr.text(), proc.exited]);
+    return { stdout, stderr, exitCode };
+  }
+
+  it("escapes every field of the summary view", async () => {
+    const { stdout, stderr, exitCode } = await view("info", "hostile");
+
+    // Only the newlines bun itself prints between lines may remain.
+    expect(stdout).not.toMatch(/[\x00-\x09\x0b-\x1f\x7f\u0080-\u009f]/);
+    expect(stdout.replaceAll(escaped, "<escaped>")).toMatchInlineSnapshot(`
+      "n<escaped>@1.0.0 | L<escaped> | deps: 1 | versions: 1
+      D<escaped>
+      H<escaped>
+      keywords: K<escaped>, plain
+
+      dependencies (1):
+      - dep<escaped>: ^1<escaped>
+
+      dist
+       .tarball: T<escaped>
+       .shasum: S<escaped>
+       .integrity: I<escaped>
+
+      dist-tags:
+      latest: 1.0.0
+      tag<escaped>: 1.0.0
+
+      maintainers:
+      - M<escaped> <E<escaped>>
+      - N<escaped>
+
+      Published: P<escaped>
+      "
+    `);
+    expect(stderr).toBe("");
+    expect(exitCode).toBe(0);
+  });
+
+  it("keeps line structure but escapes the rest when printing a single string field", async () => {
+    const { stdout, stderr, exitCode } = await view("pm", "view", "hostile", "description");
+
+    expect(stdout).toBe(`D${escapedMultiline}\n`);
+    expect(stderr).toBe("");
+    expect(exitCode).toBe(0);
+  });
+});
+
 // LSan's default conservative scan only flags the `send_sync` response-metadata
 // leak when no idle thread parks with a stale pointer in a callee-saved
 // register; excluding registers as roots makes the check deterministic.

From 5acc84e24c9a516db6714e2e751377d58cfb7e0e Mon Sep 17 00:00:00 2001
From: robobun <117481402+robobun@users.noreply.github.com>
Date: Mon, 17 Aug 2026 01:06:19 +0000
Subject: [PATCH 038/258] install: redact secrets in the URLs printed for
 failed manifest and tarball downloads (#38817)

---
 src/install/PackageManager/runTasks.rs        |   8 +-
 src/install/isolated_install/Installer.rs     |   4 +-
 test/cli/install/redacted-config-logs.test.ts | 131 ++++++++++++++++++
 3 files changed, 137 insertions(+), 6 deletions(-)

diff --git a/src/install/PackageManager/runTasks.rs b/src/install/PackageManager/runTasks.rs
index dd674fb65f00..106025bbfaa9 100644
--- a/src/install/PackageManager/runTasks.rs
+++ b/src/install/PackageManager/runTasks.rs
@@ -488,7 +488,7 @@ pub fn run_tasks<C: RunTasksCallbacks>(
                             None,
                             bun_ast::Loc::EMPTY,
                             "<r><red><b>GET<r><red> {}<d> - {}<r>",
-                            bstr::BStr::new(metadata.url.slice()),
+                            bun_core::fmt::redacted_npm_url(metadata.url.slice()),
                             response.status_code,
                         );
                     } else {
@@ -497,7 +497,7 @@ pub fn run_tasks<C: RunTasksCallbacks>(
                             None,
                             bun_ast::Loc::EMPTY,
                             "<r><yellow><b>GET<r><yellow> {}<d> - {}<r>",
-                            bstr::BStr::new(metadata.url.slice()),
+                            bun_core::fmt::redacted_npm_url(metadata.url.slice()),
                             response.status_code,
                         );
                     }
@@ -838,7 +838,7 @@ pub fn run_tasks<C: RunTasksCallbacks>(
                             None,
                             bun_ast::Loc::EMPTY,
                             "<r><red><b>GET<r><red> {}<d> - {}<r>",
-                            bstr::BStr::new(metadata.url.slice()),
+                            bun_core::fmt::redacted_npm_url(metadata.url.slice()),
                             response.status_code,
                         );
                     } else {
@@ -847,7 +847,7 @@ pub fn run_tasks<C: RunTasksCallbacks>(
                             None,
                             bun_ast::Loc::EMPTY,
                             "<r><yellow><b>GET<r><yellow> {}<d> - {}<r>",
-                            bstr::BStr::new(metadata.url.slice()),
+                            bun_core::fmt::redacted_npm_url(metadata.url.slice()),
                             response.status_code,
                         );
                     }
diff --git a/src/install/isolated_install/Installer.rs b/src/install/isolated_install/Installer.rs
index 12383a8c66a8..e95ff866ff21 100644
--- a/src/install/isolated_install/Installer.rs
+++ b/src/install/isolated_install/Installer.rs
@@ -318,7 +318,7 @@ impl<'a> Installer<'a> {
                     bstr::BStr::new(name),
                     resolution.fmt(string_buf, bun_core::fmt::PathSep::Auto),
                     bstr::BStr::new(download_error_reason(err)),
-                    bstr::BStr::new(url),
+                    bun_core::fmt::redacted_npm_url(url),
                 ),
             );
             Output::flush();
@@ -429,7 +429,7 @@ impl<'a> Installer<'a> {
                         bstr::BStr::new(pkg_name.slice(string_buf)),
                         pkg_res.fmt(string_buf, bun_core::fmt::PathSep::Auto),
                         bstr::BStr::new(download_error_reason(dl.err)),
-                        bstr::BStr::new(&dl.url),
+                        bun_core::fmt::redacted_npm_url(&dl.url),
                     ),
                 );
             }
diff --git a/test/cli/install/redacted-config-logs.test.ts b/test/cli/install/redacted-config-logs.test.ts
index 6c49d43123b4..31b8752e0cbc 100644
--- a/test/cli/install/redacted-config-logs.test.ts
+++ b/test/cli/install/redacted-config-logs.test.ts
@@ -243,3 +243,134 @@ describe.concurrent("redact", async () => {
     });
   }
 });
+
+// Covers the URL bun reports when a manifest or tarball request fails: the
+// manifest URL (after redirects) and the manifest's dist.tarball. Those come
+// from the registry, so a password or token in them is not something the user
+// wrote down themselves. The registry URL bun is configured with below carries
+// no secret; the secrets only enter through the redirect and dist.tarball.
+describe.concurrent("bun install masks secrets in the registry-supplied URL it prints after a failed download", () => {
+  const password = "s3cret";
+  const token = "npm_" + "a1b2c3d4e5f6g7h8i9j0k1l2m3n4o5p6q7r8";
+
+  function startRegistry() {
+    return Bun.serve({
+      port: 0,
+      fetch(req) {
+        const url = new URL(req.url);
+        const secretOrigin = `http://carol:${password}@${url.host}`;
+        switch (url.pathname) {
+          case "/redirected-pkg":
+            return Response.redirect(`${secretOrigin}/private/redirected-pkg?token=${token}`, 302);
+          case "/tarball-pkg":
+            return Response.json({
+              name: "tarball-pkg",
+              "dist-tags": { latest: "1.0.0" },
+              versions: {
+                "1.0.0": {
+                  name: "tarball-pkg",
+                  version: "1.0.0",
+                  dist: { tarball: `${secretOrigin}/cdn/tarball-pkg-1.0.0.tgz?token=${token}` },
+                },
+              },
+            });
+          default:
+            // Every other request, in particular the redirect target and the tarball, fails.
+            return new Response("not found", { status: 404 });
+        }
+      },
+    });
+  }
+
+  type Registry = ReturnType<typeof startRegistry>;
+
+  async function install(server: Registry, args: string[], files: Record<string, string>) {
+    using dir = tempDir("redacted-install-url", files);
+    await using proc = Bun.spawn({
+      cmd: [bunExe(), "install", "--registry", `http://${server.hostname}:${server.port}/`, ...args],
+      cwd: String(dir),
+      env: { ...bunEnv, BUN_INSTALL_CACHE_DIR: join(String(dir), ".bun-cache") },
+      stdout: "pipe",
+      stderr: "pipe",
+    });
+    const [out, err, exitCode] = await Promise.all([proc.stdout.text(), proc.stderr.text(), proc.exited]);
+    expect(out).not.toContain(password);
+    expect(out).not.toContain(token);
+    expect(err).not.toContain(password);
+    expect(err).not.toContain(token);
+    return { err, exitCode };
+  }
+
+  const masked = (server: Registry) => `http://carol:******@${server.hostname}:${server.port}`;
+
+  test("manifest request redirected to a URL with secrets (required dependency)", async () => {
+    await using server = startRegistry();
+    const { err, exitCode } = await install(server, [], {
+      "package.json": JSON.stringify({ name: "app", dependencies: { "redirected-pkg": "1.0.0" } }),
+    });
+    expect(err).toContain(`error: GET ${masked(server)}/private/redirected-pkg?token=*** - 404`);
+    expect(exitCode).toBe(1);
+  });
+
+  test("manifest request redirected to a URL with secrets (optional dependency)", async () => {
+    await using server = startRegistry();
+    const { err, exitCode } = await install(server, [], {
+      "package.json": JSON.stringify({ name: "app", optionalDependencies: { "redirected-pkg": "1.0.0" } }),
+    });
+    expect(err).toContain(`warn: GET ${masked(server)}/private/redirected-pkg?token=*** - 404`);
+    expect(exitCode).toBe(0);
+  });
+
+  test("dist.tarball URL with secrets (required dependency)", async () => {
+    await using server = startRegistry();
+    const { err, exitCode } = await install(server, [], {
+      "package.json": JSON.stringify({ name: "app", dependencies: { "tarball-pkg": "1.0.0" } }),
+    });
+    expect(err).toContain(`error: GET ${masked(server)}/cdn/tarball-pkg-1.0.0.tgz?token=*** - 404`);
+    expect(exitCode).toBe(1);
+  });
+
+  test("dist.tarball URL with secrets (optional dependency)", async () => {
+    await using server = startRegistry();
+    const { err, exitCode } = await install(server, [], {
+      "package.json": JSON.stringify({ name: "app", optionalDependencies: { "tarball-pkg": "1.0.0" } }),
+    });
+    expect(err).toContain(`warn: GET ${masked(server)}/cdn/tarball-pkg-1.0.0.tgz?token=*** - 404`);
+    expect(exitCode).toBe(0);
+  });
+
+  test("dist.tarball URL recorded in the lockfile, downloaded by the isolated linker", async () => {
+    await using server = startRegistry();
+    // What a previous install writes to bun.lock for an npm package whose
+    // dist.tarball is not the registry's default tarball location.
+    const tarball = `http://carol:${password}@${server.hostname}:${server.port}/cdn/tarball-pkg-1.0.0.tgz?token=${token}`;
+    const { err, exitCode } = await install(server, ["--linker", "isolated"], {
+      "package.json": JSON.stringify({ name: "app", dependencies: { "tarball-pkg": "1.0.0" } }),
+      "bun.lock": JSON.stringify({
+        lockfileVersion: 1,
+        workspaces: { "": { name: "app", dependencies: { "tarball-pkg": "1.0.0" } } },
+        packages: { "tarball-pkg": ["tarball-pkg@1.0.0", tarball, {}, ""] },
+      }),
+    });
+    expect(err).toContain(
+      `error: failed to download tarball-pkg@1.0.0: 404 Not Found\n  ${masked(server)}/cdn/tarball-pkg-1.0.0.tgz?token=***`,
+    );
+    expect(exitCode).toBe(1);
+  });
+
+  // A tarball URL written directly into package.json is printed as the
+  // dependency's resolution by other lines ("<name>@<url> failed to resolve",
+  // and the "failed to download <name>@<url>" prefix of the isolated linker
+  // message checked above), and those still print it verbatim.
+  test.todo("tarball URL written in package.json is masked wherever it is echoed", async () => {
+    await using server = startRegistry();
+    const spec = `http://carol:${password}@${server.hostname}:${server.port}/cdn/direct-1.0.0.tgz?token=${token}`;
+    for (const linker of ["hoisted", "isolated"]) {
+      const { err, exitCode } = await install(server, ["--linker", linker], {
+        "package.json": JSON.stringify({ name: "app", dependencies: { direct: spec } }),
+      });
+      expect(err).toContain(`error: GET ${masked(server)}/cdn/direct-1.0.0.tgz?token=*** - 404`);
+      expect(exitCode).toBe(1);
+    }
+  });
+});

From d4308e42e9806ffefe55f09989e1c84bc1d3ac43 Mon Sep 17 00:00:00 2001
From: robobun <117481402+robobun@users.noreply.github.com>
Date: Mon, 17 Aug 2026 01:06:23 +0000
Subject: [PATCH 039/258] install: redact the registry URL in the
 manifest/tarball URL errors and keep namedRegistries credentials out of
 bun.lock (#38997)

---
 src/install/NetworkTask.rs                    |  45 +++++---
 src/install/pnpm.rs                           |   6 +-
 .../install/migration/pnpm-lock-v9.test.ts    |  59 ++++++++++
 test/cli/install/redacted-config-logs.test.ts | 102 ++++++++++++++++++
 4 files changed, 194 insertions(+), 18 deletions(-)

diff --git a/src/install/NetworkTask.rs b/src/install/NetworkTask.rs
index 615177ac1646..8c2cef98922f 100644
--- a/src/install/NetworkTask.rs
+++ b/src/install/NetworkTask.rs
@@ -4,14 +4,15 @@ use core::sync::atomic::Ordering;
 
 use crate::bun_fs::{FileSystem, FilenameStore};
 use bun_collections::HashMap;
-use bun_core::{self, fmt::quote};
-use bun_core::{MutableString, strings};
+use bun_core::fmt::{quote, redacted_npm_url};
+use bun_core::{self, MutableString, strings};
 use bun_http::{
     self as http, AsyncHTTP, HTTPClientResult, HTTPClientResultCallback, HTTPVerboseLevel,
     HeaderBuilder, async_http::Options as AsyncHTTPOptions,
 };
 use bun_threading::thread_pool::Batch;
 use bun_url::URL;
+use std::io::Write as _;
 
 use crate::extract_tarball;
 use crate::npm::{self as npm, PackageManifest};
@@ -435,6 +436,13 @@ impl bun_core::output::ErrName for ForManifestError {
     }
 }
 
+/// Redacted before `quote()`: the password scan only recognizes an unquoted URL.
+fn redacted_url(url: &[u8]) -> Vec<u8> {
+    let mut out: Vec<u8> = Vec::new();
+    let _ = write!(out, "{}", redacted_npm_url(url));
+    out
+}
+
 impl NetworkTask {
     pub(crate) fn for_manifest(
         &mut self,
@@ -471,13 +479,14 @@ impl NetworkTask {
             ));
 
             if tmp.tag() == bun_core::Tag::Dead {
+                let redacted_registry = redacted_url(scope.url.href());
                 if !is_optional {
                     log.add_error_fmt(
                         None,
                         bun_ast::Loc::EMPTY,
                         format_args!(
                             "Failed to join registry {} and package {} URLs",
-                            quote(scope.url.href()),
+                            quote(&redacted_registry),
                             quote(name),
                         ),
                     );
@@ -487,7 +496,7 @@ impl NetworkTask {
                         bun_ast::Loc::EMPTY,
                         format_args!(
                             "Failed to join registry {} and package {} URLs",
-                            quote(scope.url.href()),
+                            quote(&redacted_registry),
                             quote(name),
                         ),
                     );
@@ -495,14 +504,18 @@ impl NetworkTask {
                 return Err(ForManifestError::InvalidURL);
             }
 
+            // This actually duplicates the string! So we defer deref the WTF managed one above.
+            let url_bytes = tmp.to_owned_slice().into_boxed_slice();
+
             if !(tmp.has_prefix_comptime(b"https://") || tmp.has_prefix_comptime(b"http://")) {
+                let redacted_manifest_url = redacted_url(&url_bytes);
                 if !is_optional {
                     log.add_error_fmt(
                         None,
                         bun_ast::Loc::EMPTY,
                         format_args!(
-                            "Registry URL must be http:// or https://\nReceived: \"{}\"",
-                            *tmp
+                            "Registry URL must be http:// or https://\nReceived: {}",
+                            quote(&redacted_manifest_url)
                         ),
                     );
                 } else {
@@ -510,17 +523,14 @@ impl NetworkTask {
                         None,
                         bun_ast::Loc::EMPTY,
                         format_args!(
-                            "Registry URL must be http:// or https://\nReceived: \"{}\"",
-                            *tmp
+                            "Registry URL must be http:// or https://\nReceived: {}",
+                            quote(&redacted_manifest_url)
                         ),
                     );
                 }
                 return Err(ForManifestError::InvalidURL);
             }
 
-            // This actually duplicates the string! So we defer deref the WTF managed one above.
-            let url_bytes = tmp.to_owned_slice().into_boxed_slice();
-
             {
                 let joined = URL::parse(&url_bytes);
                 let registry = scope.url.url();
@@ -532,6 +542,8 @@ impl NetworkTask {
                     || joined.get_port_auto() != registry.get_port_auto()
                     || !joined.pathname.starts_with(registry_dir)
                 {
+                    let redacted_manifest_url = redacted_url(&url_bytes);
+                    let redacted_registry = redacted_url(scope.url.href());
                     if !is_optional {
                         log.add_error_fmt(
                             None,
@@ -539,8 +551,8 @@ impl NetworkTask {
                             format_args!(
                                 "Invalid package name {}: manifest URL {} is not on registry {}",
                                 quote(name),
-                                quote(&url_bytes),
-                                quote(scope.url.href()),
+                                quote(&redacted_manifest_url),
+                                quote(&redacted_registry),
                             ),
                         );
                     } else {
@@ -550,8 +562,8 @@ impl NetworkTask {
                             format_args!(
                                 "Invalid package name {}: manifest URL {} is not on registry {}",
                                 quote(name),
-                                quote(&url_bytes),
-                                quote(scope.url.href()),
+                                quote(&redacted_manifest_url),
+                                quote(&redacted_registry),
                             ),
                         );
                     }
@@ -770,6 +782,7 @@ impl NetworkTask {
         };
 
         if !(self.url_buf.starts_with(b"https://") || self.url_buf.starts_with(b"http://")) {
+            let redacted_tarball_url = redacted_url(&self.url_buf);
             // SAFETY: `pm.log` is the long-lived `*mut Log` the package
             // manager was constructed with.
             pm.log_mut().add_error_fmt(
@@ -777,7 +790,7 @@ impl NetworkTask {
                 bun_ast::Loc::EMPTY,
                 format_args!(
                     "Expected tarball URL to start with https:// or http://, got {} while fetching package {}",
-                    quote(&self.url_buf),
+                    quote(&redacted_tarball_url),
                     quote(tarball.name.slice()),
                 ),
             );
diff --git a/src/install/pnpm.rs b/src/install/pnpm.rs
index 479beef92007..17aa9c36d83b 100644
--- a/src/install/pnpm.rs
+++ b/src/install/pnpm.rs
@@ -243,7 +243,9 @@ fn read_named_registries(
                     let key = prop.key.as_ref().expect("infallible: prop has key");
                     let value = prop.value.as_ref().expect("infallible: prop has value");
                     if let (Some(name_str), Some(url_str)) = (as_string(key), as_string(value)) {
-                        registries.put(name_str, Box::from(url_str))?;
+                        // Without its credentials: this URL is recorded in bun.lock as the tarball base.
+                        let url = crate::bun_schema::api::NpmRegistry::from_url(url_str).url;
+                        registries.put(name_str, url)?;
                     }
                 }
             }
@@ -1311,7 +1313,7 @@ pub(crate) fn migrate_pnpm_lockfile<'a>(
                                         bun_core::warn!(
                                             "fetching pnpm registry \"{}\" packages from {}; add it to bunfig.toml or .npmrc if it needs authentication",
                                             bstr::BStr::new(registry_name),
-                                            bstr::BStr::new(url)
+                                            bun_core::fmt::redacted_npm_url(url)
                                         );
                                     }
                                     &**url
diff --git a/test/cli/install/migration/pnpm-lock-v9.test.ts b/test/cli/install/migration/pnpm-lock-v9.test.ts
index a08d0dbe23cd..d86648e17ccb 100644
--- a/test/cli/install/migration/pnpm-lock-v9.test.ts
+++ b/test/cli/install/migration/pnpm-lock-v9.test.ts
@@ -412,6 +412,65 @@ snapshots:
       `);
     });
 
+    test("credentials in a namedRegistries URL stay out of bun.lock and a token in its path is masked in the warning", async () => {
+      const password = "s3cret";
+      const token = "npm_" + "a1b2c3d4e5f6g7h8i9j0k1l2m3n4o5p6q7r8";
+      const { packageDir } = await verdaccio.createTestDir({
+        bunfigOpts: { linker: "hoisted" },
+        files: {
+          "package.json": JSON.stringify({ name: "named-registry-secrets", dependencies: { "no-deps": "^1.0.0" } }),
+          "pnpm-workspace.yaml": `namedRegistries:\n  work: http://carol:${password}@127.0.0.1:1/${token}/\n`,
+          "pnpm-lock.yaml": registryQualifiedNoDepsLockfile("work"),
+        },
+      });
+
+      const { stderr, exitCode } = await migrate(packageDir);
+
+      expect(stderr).toContain(
+        'warn: fetching pnpm registry "work" packages from http://127.0.0.1:1/***/; add it to bunfig.toml or .npmrc if it needs authentication',
+      );
+      expect(stderr).not.toContain(password);
+      expect(stderr).not.toContain(token);
+      expect(stderr).toContain("migrated lockfile from pnpm-lock.yaml");
+      expect(exitCode).toBe(0);
+
+      // The token is part of the tarball location; the credentials are not.
+      const bunLock = await bunLockOf(packageDir);
+      expect(bunLock).toContain(
+        `["no-deps@1.0.1", "http://127.0.0.1:1/${token}/no-deps/-/no-deps-1.0.1.tgz", {}, "${NO_DEPS_1_0_1_INTEGRITY}"]`,
+      );
+      expect(bunLock).not.toContain(password);
+    });
+
+    test("namedRegistries entry naming the configured registry with credentials in the URL needs no warning", async () => {
+      const { packageDir } = await verdaccio.createTestDir({
+        bunfigOpts: { linker: "hoisted" },
+        files: {
+          "package.json": JSON.stringify({ name: "named-registry-same-creds", dependencies: { "no-deps": "^1.0.0" } }),
+          "pnpm-workspace.yaml": `namedRegistries:\n  work: ${verdaccio.registryUrl().replace("http://", "http://carol:s3cret@")}\n`,
+          "pnpm-lock.yaml": registryQualifiedNoDepsLockfile("work"),
+        },
+      });
+
+      const { stderr, exitCode } = await migrate(packageDir);
+
+      expect(stderr).not.toContain("pnpm registry");
+      expect(stderr).not.toContain("warn:");
+      expect(stderr).toContain("migrated lockfile from pnpm-lock.yaml");
+      expect(exitCode).toBe(0);
+
+      const bunLock = await bunLockOf(packageDir);
+      expect(bunLock).toContain(`"no-deps@1.0.1"`);
+      expect(bunLock).not.toContain("s3cret");
+      expect(bunLock).not.toContain("work:");
+
+      const install = await run(packageDir, "install", "--frozen-lockfile");
+
+      expect(install.stderr).not.toContain("error:");
+      expect(install.exitCode).toBe(0);
+      expect(nodeModulesPackages(packageDir)).toMatchInlineSnapshot(`"node_modules/no-deps/no-deps@1.0.1"`);
+    });
+
     test("two packages from one unknown registry warn once", async () => {
       const { packageDir } = await verdaccio.createTestDir({
         bunfigOpts: { linker: "hoisted" },
diff --git a/test/cli/install/redacted-config-logs.test.ts b/test/cli/install/redacted-config-logs.test.ts
index 31b8752e0cbc..015ef1bdf4d2 100644
--- a/test/cli/install/redacted-config-logs.test.ts
+++ b/test/cli/install/redacted-config-logs.test.ts
@@ -141,6 +141,108 @@ test("bunfig password value is masked in config error output", async () => {
   expect(coloredExit).toBe(1);
 });
 
+// The config loaders split user:password@ off a registry URL, but a token
+// written as a path segment stays part of it, and these messages echo that
+// URL (or the manifest / tarball URL built from it) when no request can be
+// made out of it. None of the cases below sends a request.
+describe.concurrent("bun install masks the configured registry URL in the messages that echo it", () => {
+  const token = "npm_" + "a1b2c3d4e5f6g7h8i9j0k1l2m3n4o5p6q7r8";
+  const packageJson = (deps: Record<string, Record<string, string>>) => JSON.stringify({ name: "app", ...deps });
+
+  const cases: {
+    title: string;
+    registry: string;
+    files: Record<string, string>;
+    expected: string;
+    exitCode: number;
+  }[] = [
+    {
+      title: "registry URL that is not a valid base URL (dependency)",
+      registry: `http://ex ample.org/${token}/`,
+      files: { "package.json": packageJson({ dependencies: { notapackage: "1.0.0" } }) },
+      expected: `error: Failed to join registry "http://ex ample.org/***/" and package "notapackage" URLs\n`,
+      exitCode: 1,
+    },
+    {
+      title: "registry URL that is not a valid base URL (optional dependency)",
+      registry: `http://ex ample.org/${token}/`,
+      files: { "package.json": packageJson({ optionalDependencies: { notapackage: "1.0.0" } }) },
+      expected: `warn: Failed to join registry "http://ex ample.org/***/" and package "notapackage" URLs\n`,
+      exitCode: 0,
+    },
+    // The alias makes ".." the name the manifest is requested for. It joins to
+    // the registry's parent directory, so the manifest URL no longer contains
+    // the token segment; the registry URL printed next to it does.
+    {
+      title: "manifest URL outside the registry directory (dependency)",
+      registry: `http://127.0.0.1:1/${token}/`,
+      files: { "package.json": packageJson({ dependencies: { innocent: "npm:..@1.0.0" } }) },
+      expected: `error: Invalid package name "..": manifest URL "http://127.0.0.1:1/" is not on registry "http://127.0.0.1:1/***/"\n`,
+      exitCode: 1,
+    },
+    {
+      title: "manifest URL outside the registry directory (optional dependency)",
+      registry: `http://127.0.0.1:1/${token}/`,
+      files: { "package.json": packageJson({ optionalDependencies: { innocent: "npm:..@1.0.0" } }) },
+      expected: `warn: Invalid package name "..": manifest URL "http://127.0.0.1:1/" is not on registry "http://127.0.0.1:1/***/"\n`,
+      exitCode: 0,
+    },
+    {
+      title: "registry URL with a non-http scheme (dependency)",
+      registry: `htp://127.0.0.1:1/${token}/`,
+      files: { "package.json": packageJson({ dependencies: { notapackage: "1.0.0" } }) },
+      expected: `error: Registry URL must be http:// or https://\nReceived: "htp://127.0.0.1:1/***/notapackage"\n`,
+      exitCode: 1,
+    },
+    {
+      title: "registry URL with a non-http scheme (optional dependency)",
+      registry: `htp://127.0.0.1:1/${token}/`,
+      files: { "package.json": packageJson({ optionalDependencies: { notapackage: "1.0.0" } }) },
+      expected: `warn: Registry URL must be http:// or https://\nReceived: "htp://127.0.0.1:1/***/notapackage"\n`,
+      exitCode: 0,
+    },
+    {
+      title: "tarball URL built from a registry URL with a non-http scheme",
+      registry: `htp://127.0.0.1:1/${token}/`,
+      files: {
+        "package.json": packageJson({ dependencies: { pkg: "1.0.0" } }),
+        // An empty URL in bun.lock stands for the configured registry's
+        // default tarball location, so no manifest is fetched first.
+        "bun.lock": JSON.stringify({
+          lockfileVersion: 1,
+          workspaces: { "": { name: "app", dependencies: { pkg: "1.0.0" } } },
+          packages: { pkg: ["pkg@1.0.0", "", {}, ""] },
+        }),
+      },
+      expected: `error: Expected tarball URL to start with https:// or http://, got "htp://127.0.0.1:1/***/pkg/-/pkg-1.0.0.tgz" while fetching package "pkg"\n`,
+      exitCode: 1,
+    },
+  ];
+
+  for (const { title, registry, files, expected, exitCode } of cases) {
+    test(title, async () => {
+      using dir = tempDir("redacted-registry-token", {
+        ...files,
+        "bunfig.toml": `[install]\nregistry = ${JSON.stringify(registry)}\n`,
+      });
+      await using proc = Bun.spawn({
+        cmd: [bunExe(), "install"],
+        cwd: String(dir),
+        env: { ...bunEnv, BUN_INSTALL_CACHE_DIR: join(String(dir), ".bun-cache") },
+        stdout: "pipe",
+        stderr: "pipe",
+      });
+
+      const [out, err, exited] = await Promise.all([proc.stdout.text(), proc.stderr.text(), proc.exited]);
+
+      expect(err).toContain(expected);
+      expect(err).not.toContain(token);
+      expect(out).not.toContain(token);
+      expect(exited).toBe(exitCode);
+    });
+  }
+});
+
 describe.concurrent("redact", async () => {
   const tests = [
     {

From 058682fa1a717491db41afefabd910cd6ce8f3f7 Mon Sep 17 00:00:00 2001
From: robobun <117481402+robobun@users.noreply.github.com>
Date: Mon, 17 Aug 2026 01:06:27 +0000
Subject: [PATCH 040/258] install: keep registry credentials across redirects
 to the same hostname (#38001)

---
 src/http/lib.rs                            |  99 ++++++++++++-----
 src/install/NetworkTask.rs                 |   4 +
 test/cli/install/bun-install-retry.test.ts |  25 +++--
 test/cli/install/bun-install.test.ts       | 122 +++++++++++++++++++++
 4 files changed, 211 insertions(+), 39 deletions(-)

diff --git a/src/http/lib.rs b/src/http/lib.rs
index 57bfb2fccb51..bd6db45186f6 100644
--- a/src/http/lib.rs
+++ b/src/http/lib.rs
@@ -106,6 +106,17 @@ pub enum Protocol {
     Http3,
 }
 
+/// Which redirects the request's credential headers survive.
+#[repr(u8)]
+#[derive(Copy, Clone, PartialEq, Eq, Default)]
+pub enum RedirectCredentialsPolicy {
+    /// fetch(): https://fetch.spec.whatwg.org/#concept-http-redirect-fetch
+    #[default]
+    SameOrigin,
+    /// npm's rule, used by `bun install`: port and scheme changes keep them, except https -> http.
+    SameHostname,
+}
+
 pub use bun_http_types::Encoding::Encoding;
 pub use header_value_iterator::{
     HeaderValueIterator, connection_header_keep_alive, upgrade_header_is_not_h2,
@@ -214,6 +225,7 @@ pub struct Flags {
     pub forced_protocol: Option<Protocol>,
     pub(crate) h3_retried: bool,
     pub is_node_http_client: bool,
+    pub redirect_credentials: RedirectCredentialsPolicy,
 }
 
 impl Default for Flags {
@@ -235,6 +247,7 @@ impl Default for Flags {
             forced_protocol: None,
             h3_retried: false,
             is_node_http_client: false,
+            redirect_credentials: RedirectCredentialsPolicy::SameOrigin,
         }
     }
 }
@@ -1071,20 +1084,56 @@ bun_core::comptime_string_map! {
     };
 }
 
+#[derive(Copy, Clone)]
+enum StrippedOnRedirect {
+    /// Per `Flags::redirect_credentials`.
+    Credential,
+    /// Would suppress the default Host header derived from the new URL.
+    Host,
+}
+
 bun_core::comptime_string_map! {
     /// Headers deleted from the request on a cross-origin redirect.
-    /// `host` is included because a user-supplied Host header names the
-    /// previous origin; keeping it would also suppress the default Host
-    /// header derived from the new URL.
     /// Keys are lowercase: looked up via `get_ascii_case_insensitive`.
-    static CROSS_ORIGIN_STRIPPED_REQUEST_HEADERS: () = {
-        b"authorization" => (),
-        b"proxy-authorization" => (),
-        b"cookie" => (),
-        b"host" => (),
+    static CROSS_ORIGIN_STRIPPED_REQUEST_HEADERS: StrippedOnRedirect = {
+        b"authorization" => StrippedOnRedirect::Credential,
+        b"proxy-authorization" => StrippedOnRedirect::Credential,
+        b"cookie" => StrippedOnRedirect::Credential,
+        b"host" => StrippedOnRedirect::Host,
     };
 }
 
+#[derive(Copy, Clone)]
+struct RedirectHop {
+    same_origin: bool,
+    same_hostname: bool,
+    /// https -> http; credentials never follow this hop (cleartext replay).
+    downgrades_to_http: bool,
+}
+
+impl RedirectHop {
+    fn between(from: &URL<'_>, to: &URL<'_>) -> Self {
+        Self {
+            same_origin: strings::eql_case_insensitive_ascii(
+                strings::without_trailing_slash(to.origin),
+                strings::without_trailing_slash(from.origin),
+                true,
+            ),
+            same_hostname: strings::eql_case_insensitive_ascii(to.hostname, from.hostname, true),
+            downgrades_to_http: from.is_https() && !to.is_https(),
+        }
+    }
+
+    fn strips_credentials(self, policy: RedirectCredentialsPolicy) -> bool {
+        match policy {
+            RedirectCredentialsPolicy::SameOrigin => !self.same_origin,
+            RedirectCredentialsPolicy::SameHostname => {
+                !self.same_hostname || self.downgrades_to_http
+            }
+        }
+    }
+}
+
 // ── shared per-thread buffers ───────────────────────────────────────────
 // All four are HTTP-thread-only scratch (single uws loop thread); `RacyCell`
 // is the alias-safe static cell per docs/PORTING.md §Global mutable state.
@@ -5023,7 +5072,7 @@ impl<'a> HTTPClient<'a> {
                 {
                     return Err(crate::Error::RequestBodyNotReusable);
                 }
-                let is_same_origin;
+                let hop: RedirectHop;
 
                 {
                     if let Some(i) = strings::index_of(location, b"://") {
@@ -5087,11 +5136,7 @@ impl<'a> HTTPClient<'a> {
                         // `self.redirect` below, which lives as long as `self` (≥ `'a`).
                         let new_url: URL<'a> =
                             unsafe { URL::parse(&normalized_url_str).erase_lifetime() };
-                        is_same_origin = strings::eql_case_insensitive_ascii(
-                            strings::without_trailing_slash(new_url.origin),
-                            strings::without_trailing_slash(self.url.origin),
-                            true,
-                        );
+                        hop = RedirectHop::between(&self.url, &new_url);
                         self.url = new_url;
                         // connected_url still borrows from the previous hop's buffer
                         // until doRedirect releases the socket, so park it in
@@ -5142,11 +5187,7 @@ impl<'a> HTTPClient<'a> {
                         // `self.redirect` below, which lives as long as `self` (≥ `'a`).
                         let new_url: URL<'a> =
                             unsafe { URL::parse(&normalized_url_str).erase_lifetime() };
-                        is_same_origin = strings::eql_case_insensitive_ascii(
-                            strings::without_trailing_slash(new_url.origin),
-                            strings::without_trailing_slash(self.url.origin),
-                            true,
-                        );
+                        hop = RedirectHop::between(&self.url, &new_url);
                         self.url = new_url;
                         debug_assert!(self.prev_redirect.is_empty());
                         self.prev_redirect =
@@ -5170,11 +5211,7 @@ impl<'a> HTTPClient<'a> {
                         // SAFETY: self-borrow — `new_url` is moved into `self.redirect`
                         // below, which lives as long as `self` (≥ `'a`).
                         self.url = unsafe { parsed_url.erase_lifetime() };
-                        is_same_origin = strings::eql_case_insensitive_ascii(
-                            strings::without_trailing_slash(self.url.origin),
-                            strings::without_trailing_slash(original_url.origin),
-                            true,
-                        );
+                        hop = RedirectHop::between(&original_url, &self.url);
                         debug_assert!(self.prev_redirect.is_empty());
                         self.prev_redirect = core::mem::replace(&mut self.redirect, new_url);
                     }
@@ -5214,7 +5251,7 @@ impl<'a> HTTPClient<'a> {
                 // Cross-origin redirect: re-derive SNI / cert
                 // verification / Host from the redirect target. See
                 // `InternalStateFlags::clear_hostname_on_redirect`.
-                if !is_same_origin {
+                if !hop.same_origin {
                     self.state.flags.clear_hostname_on_redirect = true;
                 }
 
@@ -5223,14 +5260,20 @@ impl<'a> HTTPClient<'a> {
                 // locationURL's origin, then for each headerName of CORS
                 // non-wildcard request-header name, delete headerName from
                 // request's header list.
-                if !is_same_origin && self.header_entries.len() > 0 {
+                // The credential headers follow `Flags::redirect_credentials`.
+                if !hop.same_origin && self.header_entries.len() > 0 {
+                    let strip_credentials = hop.strips_credentials(self.flags.redirect_credentials);
                     let mut i = 0;
                     while i < self.header_entries.len() {
                         let name = self.header_str(self.header_entries.items_name()[i]);
-                        if CROSS_ORIGIN_STRIPPED_REQUEST_HEADERS
+                        let strip = match CROSS_ORIGIN_STRIPPED_REQUEST_HEADERS
                             .get_ascii_case_insensitive(name)
-                            .is_some()
                         {
+                            Some(StrippedOnRedirect::Host) => true,
+                            Some(StrippedOnRedirect::Credential) => strip_credentials,
+                            None => false,
+                        };
+                        if strip {
                             let _ = self.header_entries.ordered_remove(i);
                         } else {
                             i += 1;
diff --git a/src/install/NetworkTask.rs b/src/install/NetworkTask.rs
index 8c2cef98922f..e1fd9aaa0a9e 100644
--- a/src/install/NetworkTask.rs
+++ b/src/install/NetworkTask.rs
@@ -673,6 +673,8 @@ impl NetworkTask {
             },
         ));
         self.http_mut().client.flags.reject_unauthorized = pm.tls_reject_unauthorized();
+        self.http_mut().client.flags.redirect_credentials =
+            http::RedirectCredentialsPolicy::SameHostname;
 
         if PackageManager::verbose_install() {
             self.http_mut().client.verbose = HTTPVerboseLevel::Headers;
@@ -896,6 +898,8 @@ impl NetworkTask {
             http_options,
         ));
         self.http_mut().client.flags.reject_unauthorized = pm.tls_reject_unauthorized();
+        self.http_mut().client.flags.redirect_credentials =
+            http::RedirectCredentialsPolicy::SameHostname;
         if PackageManager::verbose_install() {
             self.http_mut().client.verbose = HTTPVerboseLevel::Headers;
         }
diff --git a/test/cli/install/bun-install-retry.test.ts b/test/cli/install/bun-install-retry.test.ts
index d9706157a9be..9c34fa6d5c95 100644
--- a/test/cli/install/bun-install-retry.test.ts
+++ b/test/cli/install/bun-install-retry.test.ts
@@ -94,16 +94,20 @@ it("retries a manifest whose redirect target 500s once", async () => {
   });
 });
 
-// A cross-origin redirect strips Authorization from the request (per the fetch
-// spec). The install retry restarts from the original registry URL and must
-// carry the original headers, including Authorization, again.
-it("retries an authorized manifest whose cross-origin redirect target 500s once", async () => {
-  const token = "test-registry-token";
+// The registry (reached as `localhost`) redirects the manifest to a second
+// server standing in for a CDN, and the retry restarts from the registry URL.
+// 127.0.0.1 is a different hostname, so that hop strips the token and the
+// retry must carry the original headers again; localhost:<other port> keeps
+// it, and the retry must apply the same rule. Which redirects keep the token
+// is covered by "registry token across redirects" in bun-install.test.ts.
+const token = "test-registry-token";
+it.each([
+  { cdnHost: "localhost", expectedCdnAuth: [`Bearer ${token}`, `Bearer ${token}`] },
+  { cdnHost: "127.0.0.1", expectedCdnAuth: [null, null] },
+])("retries an authorized manifest redirected to $cdnHost when it 500s once", async ({ cdnHost, expectedCdnAuth }) => {
   const registryUrls: string[] = [];
   const cdnAuth: (string | null)[] = [];
   let cdnHits = 0;
-  // A second server on its own port stands in for the CDN the registry
-  // redirects to; a different port makes the redirect cross-origin.
   await using cdn = Bun.serve({
     port: 0,
     fetch(request) {
@@ -133,7 +137,7 @@ it("retries an authorized manifest whose cross-origin redirect target 500s once"
       }
       return new Response(null, {
         status: 302,
-        headers: { Location: `http://localhost:${cdn.port}/cdn/BaR` },
+        headers: { Location: `http://${cdnHost}:${cdn.port}/cdn/BaR` },
       });
     }
     if (pathname === "/BaR-0.0.2.tgz") {
@@ -168,10 +172,9 @@ it("retries an authorized manifest whose cross-origin redirect target 500s once"
   expect(err).toContain("Saved lockfile");
   expect(out).toContain("1 package installed");
   expect(exitCode).toBe(0);
-  // Both registry hits carried the token (the handler 401s otherwise); the
-  // cross-origin CDN hops must NOT have (the spec strips it for that hop).
+  // Both registry hits carried the token (the handler 401s otherwise).
   expect(registryUrls).toEqual(["/BaR", "/BaR", "/BaR-0.0.2.tgz"]);
-  expect(cdnAuth).toEqual([null, null]);
+  expect(cdnAuth).toEqual(expectedCdnAuth);
 });
 
 // Sibling retry site (tarball downloads in runTasks): the tarball URL
diff --git a/test/cli/install/bun-install.test.ts b/test/cli/install/bun-install.test.ts
index 5c813fe9de3f..06de24343ffb 100644
--- a/test/cli/install/bun-install.test.ts
+++ b/test/cli/install/bun-install.test.ts
@@ -14,6 +14,7 @@ import {
   runBunInstall,
   tempDir,
   textLockfile,
+  tls,
   toBeValidBin,
   toBeWorkspaceLink,
   toHaveBins,
@@ -855,6 +856,127 @@ describe.concurrent("bun-install", () => {
     expect(exitCode).toBe(0);
   });
 
+  // Registries such as Nexus and Artifactory answer manifest and tarball
+  // requests with a redirect to the same host on another scheme or port
+  // (https://github.com/oven-sh/bun/issues/15516). Like npm, bun keeps the
+  // token across such a redirect; it drops it once the redirect leaves the
+  // registry's hostname, and (unlike npm) when it downgrades https to http.
+  describe("registry token across redirects", () => {
+    const token = "secret-registry-token";
+    const tgz = join(import.meta.dir, "registry", "packages", "no-deps", "no-deps-1.0.0.tgz");
+    const integrity = "sha512-v4w12JRjUGvfHDUP8vFDwu0gUWu04j0cv9hLb1Abf9VdaXu4XcrddYFTMVBVvmldKViGWH7jrb6xPJRF0wq6gw==";
+    const manifestPath = "/no-deps";
+    const tarballPath = "/no-deps/-/no-deps-1.0.0.tgz";
+
+    // The registry lives on `registry`://127.0.0.1; `target` is the scheme and
+    // hostname it redirects to (the port always differs). https servers use
+    // the harness certificate, which the install trusts via --cafile.
+    it.each([
+      {
+        name: "keeps the token when only the port changes",
+        registry: "http",
+        target: "http://127.0.0.1",
+        authorization: `Bearer ${token}`,
+      },
+      {
+        name: "keeps the token when only the port changes (https registry)",
+        registry: "https",
+        target: "https://127.0.0.1",
+        authorization: `Bearer ${token}`,
+      },
+      {
+        name: "keeps the token when the redirect upgrades http to https",
+        registry: "http",
+        target: "https://127.0.0.1",
+        authorization: `Bearer ${token}`,
+      },
+      {
+        name: "drops the token when the redirect downgrades https to http",
+        registry: "https",
+        target: "http://127.0.0.1",
+        authorization: null,
+      },
+      {
+        // The same machine, but a different hostname than the registry's.
+        name: "drops the token when the hostname changes",
+        registry: "http",
+        target: "http://localhost",
+        authorization: null,
+      },
+    ])("$name", async ({ registry: registryScheme, target, authorization }) => {
+      // `target` serves the manifest and the tarball unconditionally and
+      // records the Authorization header each hop arrived with.
+      const received: { pathname: string; authorization: string | null }[] = [];
+      await using targetServer = Bun.serve({
+        port: 0,
+        ...(target.startsWith("https:") ? tls : {}),
+        fetch(req) {
+          const { pathname } = new URL(req.url);
+          received.push({ pathname, authorization: req.headers.get("authorization") });
+          if (pathname === manifestPath) {
+            // `dist.tarball` points at the registry origin so the tarball
+            // request carries the token in the first place (see the test
+            // above); the registry then redirects it as well.
+            return Response.json({
+              name: "no-deps",
+              "dist-tags": { latest: "1.0.0" },
+              versions: {
+                "1.0.0": {
+                  name: "no-deps",
+                  version: "1.0.0",
+                  dist: { integrity, tarball: `${registryScheme}://127.0.0.1:${registry.port}${tarballPath}` },
+                },
+              },
+            });
+          }
+          if (pathname === tarballPath) return new Response(file(tgz));
+          return new Response("not found", { status: 404 });
+        },
+      });
+      // The registry requires the token and answers every request with a
+      // redirect to the same path on `target`.
+      await using registry = Bun.serve({
+        port: 0,
+        hostname: "127.0.0.1",
+        ...(registryScheme === "https" ? tls : {}),
+        fetch(req) {
+          if (req.headers.get("authorization") !== `Bearer ${token}`) {
+            return new Response("unauthorized", { status: 401 });
+          }
+          return Response.redirect(`${target}:${targetServer.port}${new URL(req.url).pathname}`, 302);
+        },
+      });
+
+      using dir = tempDir("token-across-redirects", {
+        "package.json": JSON.stringify({ name: "app", version: "1.0.0", dependencies: { "no-deps": "1.0.0" } }),
+        ".npmrc": [
+          `registry=${registryScheme}://127.0.0.1:${registry.port}/`,
+          `//127.0.0.1:${registry.port}/:_authToken=${token}`,
+          ``,
+        ].join("\n"),
+        "cafile": tls.cert,
+      });
+      await using proc = spawn({
+        cmd: [bunExe(), "install", "--cafile", "cafile"],
+        cwd: String(dir),
+        env: { ...env, BUN_INSTALL_CACHE_DIR: join(String(dir), ".cache") },
+        stdout: "pipe",
+        stderr: "pipe",
+      });
+      const [stdout, stderr, exitCode] = await Promise.all([proc.stdout.text(), proc.stderr.text(), proc.exited]);
+
+      expect({ stderr, received }).toEqual({
+        stderr: expect.stringContaining("Saved lockfile"),
+        received: [
+          { pathname: manifestPath, authorization },
+          { pathname: tarballPath, authorization },
+        ],
+      });
+      expect(stdout).toContain("1 package installed");
+      expect(exitCode).toBe(0);
+    });
+  });
+
   it("--silent suppresses verbose output even when RUNNER_DEBUG is set", async () => {
     using dir = tempDir("install-silent-verbose", {
       "package.json": JSON.stringify({ name: "app", dependencies: {} }),

From d8148a0899076a1baa00dc2ce1c5ba45790d9cf0 Mon Sep 17 00:00:00 2001
From: robobun <117481402+robobun@users.noreply.github.com>
Date: Mon, 17 Aug 2026 01:06:31 +0000
Subject: [PATCH 041/258] install: read NPM_CONFIG_USERCONFIG as the user-level
 .npmrc path (#38047)

---
 docs/pm/npmrc.mdx              | 15 ++++++
 src/install/PackageManager.rs  | 20 ++++++--
 test/cli/install/npmrc.test.ts | 92 +++++++++++++++++++++++++++++++---
 3 files changed, 118 insertions(+), 9 deletions(-)

diff --git a/docs/pm/npmrc.mdx b/docs/pm/npmrc.mdx
index 6e734c9f32bc..adac6df65c44 100644
--- a/docs/pm/npmrc.mdx
+++ b/docs/pm/npmrc.mdx
@@ -24,6 +24,21 @@ Values may reference environment variables. Bun replaces `${NAME}` with the vari
 
 ---
 
+## Which files are read
+
+Bun reads up to two `.npmrc` files. Options in the later file override the earlier one:
+
+1. The user-level file. This is the file `NPM_CONFIG_USERCONFIG` (npm's `userconfig` option) points at when that variable is set; otherwise `$XDG_CONFIG_HOME/.npmrc` if it exists, otherwise `$HOME/.npmrc`.
+2. The `.npmrc` next to your project's root `package.json`.
+
+<Note>
+  `actions/setup-node` with `registry-url` writes an `.npmrc` to `$RUNNER_TEMP` and exports `NPM_CONFIG_USERCONFIG`
+  pointing at it, so `bun publish` reads the token from `NODE_AUTH_TOKEN` in that workflow the same way `npm publish`
+  does.
+</Note>
+
+---
+
 ## Supported options
 
 ### Set the default registry
diff --git a/src/install/PackageManager.rs b/src/install/PackageManager.rs
index 1379fe74aec3..f27026b6f903 100644
--- a/src/install/PackageManager.rs
+++ b/src/install/PackageManager.rs
@@ -1927,10 +1927,24 @@ pub fn init(
         let mut buf = PathBuffer::uninit();
         let parts = [b"./.npmrc" as &[u8]];
 
-        // npm reads `$HOME/.npmrc` and ignores XDG_CONFIG_HOME; keep
-        // `$XDG_CONFIG_HOME/.npmrc` only when that file actually exists.
         let mut global_len: usize = 0;
-        if let Some(xdg_dir) = bun_core::env_var::XDG_CONFIG_HOME.get_not_empty() {
+        // npm's `userconfig`: when set, this file is the per-user .npmrc and
+        // neither $XDG_CONFIG_HOME/.npmrc nor ~/.npmrc is looked at.
+        // actions/setup-node writes one to $RUNNER_TEMP and exports
+        // NPM_CONFIG_USERCONFIG pointing at it.
+        if let Some(userconfig) = [b"NPM_CONFIG_USERCONFIG" as &[u8], b"npm_config_userconfig"]
+            .into_iter()
+            .find_map(|key| env.get(key).filter(|path| !path.is_empty()))
+        {
+            global_len = resolve_path::join_abs_string_buf_z::<platform::Auto>(
+                &original_cwd_clone,
+                &mut buf,
+                &[userconfig],
+            )
+            .len();
+        } else if let Some(xdg_dir) = bun_core::env_var::XDG_CONFIG_HOME.get_not_empty() {
+            // npm reads `$HOME/.npmrc` and ignores XDG_CONFIG_HOME; keep
+            // `$XDG_CONFIG_HOME/.npmrc` only when that file actually exists.
             let p =
                 resolve_path::join_abs_string_buf_z::<platform::Auto>(xdg_dir, &mut buf, &parts);
             if bun_sys::exists_z(p) {
diff --git a/test/cli/install/npmrc.test.ts b/test/cli/install/npmrc.test.ts
index ec2e6adfcaee..5f8e8516daab 100644
--- a/test/cli/install/npmrc.test.ts
+++ b/test/cli/install/npmrc.test.ts
@@ -172,16 +172,17 @@ registry = http://localhost:${registry.port}/
     const npmrc = (port: number) => `registry=http://localhost:${port}/\n//localhost:${port}/:_authToken=token\n`;
     const pkg = { "pkg/package.json": JSON.stringify({ name: "npmrc-lookup", version: "0.0.1" }) };
 
-    // `publish --dry-run` never contacts the registry, but it still requires a token
-    // for it and prints which registry it picked up, so it shows which .npmrc was read.
-    // bunEnv spreads process.env and CI runners commonly export XDG_CONFIG_HOME, so it
-    // is removed here and each case passes back exactly the value it is testing.
-    async function publishDryRun(dir: string, envOverride: Record<string, string>) {
+    // bunEnv spreads process.env, and CI runners commonly export XDG_CONFIG_HOME or
+    // (via actions/setup-node) NPM_CONFIG_USERCONFIG, so both are removed here and each
+    // case passes back exactly the variables it is testing.
+    async function publish(dir: string, envOverride: Record<string, string>, ...args: string[]) {
       const spawnEnv = { ...env, HOME: join(dir, "home"), USERPROFILE: join(dir, "home") };
       delete spawnEnv.XDG_CONFIG_HOME;
+      delete spawnEnv.NPM_CONFIG_USERCONFIG;
+      delete spawnEnv.npm_config_userconfig;
 
       await using proc = Bun.spawn({
-        cmd: [bunExe(), "publish", "--dry-run"],
+        cmd: [bunExe(), "publish", ...args],
         cwd: join(dir, "pkg"),
         env: { ...spawnEnv, ...envOverride },
         stdout: "pipe",
@@ -191,6 +192,10 @@ registry = http://localhost:${registry.port}/
       return { stdout, stderr, exitCode };
     }
 
+    // `publish --dry-run` never contacts the registry, but it still requires a token
+    // for it and prints which registry it picked up, so it shows which .npmrc was read.
+    const publishDryRun = (dir: string, envOverride: Record<string, string>) => publish(dir, envOverride, "--dry-run");
+
     const usesRegistry = (port: number) => ({
       stdout: expect.stringContaining(`Registry: http://localhost:${port}/\n`),
       stderr: expect.not.stringContaining("missing authentication"),
@@ -222,6 +227,81 @@ registry = http://localhost:${registry.port}/
       const result = await publishDryRun(String(dir), { XDG_CONFIG_HOME: "" });
       expect(result).toEqual(usesRegistry(1));
     });
+
+    // npm's `userconfig` option: the path of the per-user .npmrc, settable through
+    // NPM_CONFIG_USERCONFIG like any other npm config option.
+    it.concurrent("uses $NPM_CONFIG_USERCONFIG instead of $XDG_CONFIG_HOME/.npmrc and $HOME/.npmrc", async () => {
+      using dir = tempDir("npmrc-userconfig", {
+        ...pkg,
+        "home/.npmrc": npmrc(1),
+        "xdg/.npmrc": npmrc(2),
+        "elsewhere/ci.npmrc": npmrc(3),
+      });
+      const result = await publishDryRun(String(dir), {
+        XDG_CONFIG_HOME: join(String(dir), "xdg"),
+        NPM_CONFIG_USERCONFIG: join(String(dir), "elsewhere", "ci.npmrc"),
+      });
+      expect(result).toEqual(usesRegistry(3));
+    });
+
+    it.concurrent("accepts lowercase $npm_config_userconfig", async () => {
+      using dir = tempDir("npmrc-userconfig-lowercase", {
+        ...pkg,
+        "home/.npmrc": npmrc(1),
+        "elsewhere/ci.npmrc": npmrc(2),
+      });
+      const result = await publishDryRun(String(dir), {
+        npm_config_userconfig: join(String(dir), "elsewhere", "ci.npmrc"),
+      });
+      expect(result).toEqual(usesRegistry(2));
+    });
+
+    it.concurrent("uses $HOME/.npmrc when $NPM_CONFIG_USERCONFIG is empty", async () => {
+      using dir = tempDir("npmrc-userconfig-empty", { ...pkg, "home/.npmrc": npmrc(1) });
+      const result = await publishDryRun(String(dir), { NPM_CONFIG_USERCONFIG: "" });
+      expect(result).toEqual(usesRegistry(1));
+    });
+
+    it.concurrent("the project .npmrc still overrides $NPM_CONFIG_USERCONFIG", async () => {
+      using dir = tempDir("npmrc-userconfig-project", {
+        ...pkg,
+        "elsewhere/ci.npmrc": npmrc(1),
+        "pkg/.npmrc": npmrc(2),
+      });
+      const result = await publishDryRun(String(dir), {
+        NPM_CONFIG_USERCONFIG: join(String(dir), "elsewhere", "ci.npmrc"),
+      });
+      expect(result).toEqual(usesRegistry(2));
+    });
+
+    // https://github.com/oven-sh/bun/issues/14824: actions/setup-node with `registry-url`
+    // writes $RUNNER_TEMP/.npmrc with the contents below and exports NPM_CONFIG_USERCONFIG
+    // pointing at it; the token itself is only present as $NODE_AUTH_TOKEN.
+    it.concurrent("reads the .npmrc written by actions/setup-node, expanding ${NODE_AUTH_TOKEN}", async () => {
+      const { promise: authorization, resolve } = Promise.withResolvers<string | null>();
+      using mockRegistry = Bun.serve({
+        port: 0,
+        fetch(req) {
+          resolve(req.headers.get("authorization"));
+          return new Response("{}");
+        },
+      });
+      const { port } = mockRegistry;
+      using dir = tempDir("npmrc-setup-node", {
+        ...pkg,
+        "runner-temp/.npmrc": `//localhost:${port}/:_authToken=\${NODE_AUTH_TOKEN}\nregistry=http://localhost:${port}/\nalways-auth=true\n`,
+      });
+      const result = await publish(String(dir), {
+        NPM_CONFIG_USERCONFIG: join(String(dir), "runner-temp", ".npmrc"),
+        NODE_AUTH_TOKEN: "npm_token-from-the-workflow-env",
+      });
+      expect(result).toEqual({
+        stdout: expect.stringContaining(" + npmrc-lookup@0.0.1\n"),
+        stderr: "",
+        exitCode: 0,
+      });
+      expect(await authorization).toBe("Bearer npm_token-from-the-workflow-env");
+    });
   });
 
   it("package config overrides home config", async () => {

From 0648a52de965bd5881fed6fe86bb3ed93318bdb7 Mon Sep 17 00:00:00 2001
From: robobun <117481402+robobun@users.noreply.github.com>
Date: Mon, 17 Aug 2026 01:06:35 +0000
Subject: [PATCH 042/258] publish, pm whoami: route registry requests through
 http_proxy (#38075)

---
 src/install/npm.rs                            |   3 +-
 src/runtime/cli/publish_command.rs            |  18 +-
 test/cli/install/bun-install-proxy.test.ts    | 356 ++++++++++++++----
 .../source-lints/init-sync-http-proxy.test.ts | 146 +++++++
 4 files changed, 436 insertions(+), 87 deletions(-)
 create mode 100644 test/internal/source-lints/init-sync-http-proxy.test.ts

diff --git a/src/install/npm.rs b/src/install/npm.rs
index 1d1482ab76e2..72227e8215e4 100644
--- a/src/install/npm.rs
+++ b/src/install/npm.rs
@@ -146,6 +146,7 @@ pub fn whoami(manager: &mut PackageManager) -> Result<Vec<u8>, WhoamiError> {
     // returns. `init_sync` borrows the URL/header buffers for the duration of
     // the synchronous request only.
     let url = URL::parse(&print_buf);
+    let http_proxy = manager.http_proxy(&url);
 
     // `headers.allocate()` set `content.ptr` to a valid `content.len`-byte
     // allocation; `headers` outlives `req`. `written_slice()` is the safe
@@ -159,7 +160,7 @@ pub fn whoami(manager: &mut PackageManager) -> Result<Vec<u8>, WhoamiError> {
         headers.entries,
         header_buf,
         b"",
-        None,
+        http_proxy,
         None,
         http::FetchRedirect::Follow,
     );
diff --git a/src/runtime/cli/publish_command.rs b/src/runtime/cli/publish_command.rs
index b9778ff23a52..826d12dbd522 100644
--- a/src/runtime/cli/publish_command.rs
+++ b/src/runtime/cli/publish_command.rs
@@ -743,6 +743,7 @@ impl PublishCommand {
     }
 
     fn check_package_version_exists(
+        manager: &PackageManager,
         package_name: &[u8],
         version: &[u8],
         registry: &Npm::Registry::Scope,
@@ -807,13 +808,14 @@ impl PublishCommand {
             headers.append(b"authorization", &auth_buf);
         }
 
+        let http_proxy = manager.http_proxy(&package_url);
         let mut req = http::AsyncHTTP::init_sync(
             http::Method::GET,
             package_url,
             headers.entries,
             headers.content.written_slice(),
             b"",
-            None,
+            http_proxy,
             None,
             http::FetchRedirect::Follow,
         );
@@ -860,6 +862,7 @@ impl PublishCommand {
         if tolerate_republish {
             let version_without_build_tag = dependency::without_build_tag(&ctx.package_version);
             let package_exists = Self::check_package_version_exists(
+                ctx.manager,
                 &ctx.package_name,
                 version_without_build_tag,
                 registry,
@@ -932,6 +935,7 @@ impl PublishCommand {
         // arena so the URL outlives `print_buf.clear()` below.
         let publish_url = URL::parse(crate::cli::cli_dupe(&print_buf));
         print_buf.clear();
+        let http_proxy = ctx.manager.http_proxy(&publish_url);
 
         let mut req = http::AsyncHTTP::init_sync(
             http::Method::PUT,
@@ -939,7 +943,7 @@ impl PublishCommand {
             publish_headers.entries,
             publish_headers.content.written_slice(),
             publish_req_body,
-            None,
+            http_proxy.clone(),
             None,
             http::FetchRedirect::Follow,
         );
@@ -1033,7 +1037,7 @@ impl PublishCommand {
                     otp_headers.entries,
                     otp_headers.content.written_slice(),
                     publish_req_body,
-                    None,
+                    http_proxy,
                     None,
                     http::FetchRedirect::Follow,
                 );
@@ -1252,18 +1256,20 @@ impl PublishCommand {
                     ctx.manager.options.publish_config.auth_type,
                 )?;
 
+                let http_proxy = ctx.manager.http_proxy(&done_url);
+
                 loop {
                     response_buf.reset();
 
-                    // Note: `done_url`/`auth_headers.entries` move into
-                    // `init_sync`, so re-clone per iteration.
+                    // Note: `done_url`/`auth_headers.entries`/`http_proxy` move
+                    // into `init_sync`, so re-clone per iteration.
                     let mut req = http::AsyncHTTP::init_sync(
                         http::Method::GET,
                         done_url.clone(),
                         auth_headers.entries.clone()?,
                         auth_headers.content.written_slice(),
                         b"",
-                        None,
+                        http_proxy.clone(),
                         None,
                         http::FetchRedirect::Follow,
                     );
diff --git a/test/cli/install/bun-install-proxy.test.ts b/test/cli/install/bun-install-proxy.test.ts
index 40672217c0ab..960f80e3c0fb 100644
--- a/test/cli/install/bun-install-proxy.test.ts
+++ b/test/cli/install/bun-install-proxy.test.ts
@@ -1,97 +1,293 @@
-import { beforeAll, it } from "bun:test";
+import { beforeAll, describe, expect, it } from "bun:test";
 import { exec } from "child_process";
 import { rm } from "fs/promises";
-import { bunEnv, bunExe, dockerExe, isDockerEnabled, tempDirWithFiles } from "harness";
+import { bunEnv, bunExe, dockerExe, isDockerEnabled, tempDir, tempDirWithFiles } from "harness";
 import { join } from "path";
 import { promisify } from "util";
 const execAsync = promisify(exec);
 const dockerCLI = dockerExe() as string;
 const SQUID_URL = "http://127.0.0.1:3128";
 if (isDockerEnabled()) {
-  beforeAll(async () => {
-    async function isSquidRunning() {
-      const text = await fetch(SQUID_URL)
-        .then(res => res.text())
-        .catch(() => {});
-      return text?.includes("squid") ?? false;
-    }
-    if (!(await isSquidRunning())) {
-      // try to create or error if is already created
-      await execAsync(
-        `${dockerCLI} run -d --name squid-container -e TZ=UTC -p 3128:3128 ubuntu/squid:5.2-22.04_beta`,
-      ).catch(() => {});
-
-      async function waitForSquid(max_wait = 60_000) {
-        const start = Date.now();
-        while (true) {
-          if (await isSquidRunning()) {
-            return;
-          }
-          if (Date.now() - start > max_wait) {
-            throw new Error("Squid did not start in time");
-          }
+  describe("squid", () => {
+    beforeAll(async () => {
+      async function isSquidRunning() {
+        const text = await fetch(SQUID_URL)
+          .then(res => res.text())
+          .catch(() => {});
+        return text?.includes("squid") ?? false;
+      }
+      if (!(await isSquidRunning())) {
+        // try to create or error if is already created
+        await execAsync(
+          `${dockerCLI} run -d --name squid-container -e TZ=UTC -p 3128:3128 ubuntu/squid:5.2-22.04_beta`,
+        ).catch(() => {});
 
-          await Bun.sleep(1000);
+        async function waitForSquid(max_wait = 60_000) {
+          const start = Date.now();
+          while (true) {
+            if (await isSquidRunning()) {
+              return;
+            }
+            if (Date.now() - start > max_wait) {
+              throw new Error("Squid did not start in time");
+            }
+
+            await Bun.sleep(1000);
+          }
         }
+        // wait for squid to start
+        await waitForSquid();
       }
-      // wait for squid to start
-      await waitForSquid();
-    }
+    });
+
+    it("bun install with proxy with big packages", async () => {
+      const files = {
+        "package.json": JSON.stringify({
+          "name": "test-install",
+          "module": "index.ts",
+          "type": "module",
+          "private": true,
+          "dependencies": {
+            "gastby": "1.0.1",
+            "mitata": "1.0.34",
+            "next.js": "1.0.3",
+            "react": "19.1.0",
+            "react-dom": "19.1.0",
+            "@types/react": "18.3.3",
+            "esbuild": "0.21.4",
+            "peechy": "0.4.34",
+            "prettier": "3.5.3",
+            "prettier-plugin-organize-imports": "4.0.0",
+            "source-map-js": "1.2.0",
+            "typescript": "5.7.2",
+          },
+        }),
+      };
+      const promises = new Array(5);
+      // this repro a hang when using a proxy, we run multiple times to make sure it's not a flaky test
+      for (let i = 0; i < 5; i++) {
+        const package_dir = tempDirWithFiles("codex-" + i, files);
+
+        const { exited } = Bun.spawn([bunExe(), "install", "--ignore-scripts"], {
+          cwd: package_dir,
+          // @ts-ignore
+          env: {
+            ...bunEnv,
+            BUN_INSTALL_CACHE_DIR: join(package_dir, ".bun-install-cache"),
+            TMPDIR: join(package_dir, ".tmp"),
+            BUN_TMPDIR: join(package_dir, ".tmp"),
+            HTTPS_PROXY: SQUID_URL,
+            HTTP_PROXY: SQUID_URL,
+          },
+          stdio: ["inherit", "inherit", "inherit"],
+          timeout: 20_000,
+        });
+        promises[i] = exited
+          .then(r => {
+            if (r !== 0) {
+              throw new Error("failed to install with exit code " + r);
+            }
+          })
+          .finally(() => {
+            return rm(package_dir, { recursive: true, force: true });
+          });
+      }
+
+      await Promise.all(promises);
+    }, 60_000);
   });
+}
 
-  it("bun install with proxy with big packages", async () => {
-    const files = {
-      "package.json": JSON.stringify({
-        "name": "test-install",
-        "module": "index.ts",
-        "type": "module",
-        "private": true,
-        "dependencies": {
-          "gastby": "1.0.1",
-          "mitata": "1.0.34",
-          "next.js": "1.0.3",
-          "react": "19.1.0",
-          "react-dom": "19.1.0",
-          "@types/react": "18.3.3",
-          "esbuild": "0.21.4",
-          "peechy": "0.4.34",
-          "prettier": "3.5.3",
-          "prettier-plugin-organize-imports": "4.0.0",
-          "source-map-js": "1.2.0",
-          "typescript": "5.7.2",
-        },
-      }),
-    };
-    const promises = new Array(5);
-    // this repro a hang when using a proxy, we run multiple times to make sure it's not a flaky test
-    for (let i = 0; i < 5; i++) {
-      const package_dir = tempDirWithFiles("codex-" + i, files);
-
-      const { exited } = Bun.spawn([bunExe(), "install", "--ignore-scripts"], {
-        cwd: package_dir,
-        // @ts-ignore
-        env: {
-          ...bunEnv,
-          BUN_INSTALL_CACHE_DIR: join(package_dir, ".bun-install-cache"),
-          TMPDIR: join(package_dir, ".tmp"),
-          BUN_TMPDIR: join(package_dir, ".tmp"),
-          HTTPS_PROXY: SQUID_URL,
-          HTTP_PROXY: SQUID_URL,
+// Each command builds its registry requests separately, and `bun audit`
+// (#20295), `bun publish` and `bun pm whoami` have each shipped without the
+// proxy, so every command that talks to the registry gets a case here.
+describe("registry commands honor http_proxy", () => {
+  type RegistryRequest = { via: "proxy" | "registry"; method: string; url: string; otp?: string };
+
+  // The registry from bunfig.toml and the proxy from http_proxy both answer
+  // with `respond`, and every request records which of the two received it.
+  // A request sent through an HTTP proxy names the full registry URL as its
+  // target, so `req.url` is the registry URL at either server.
+  function registryBehindProxy(respond: (req: RegistryRequest) => Response) {
+    const requests: RegistryRequest[] = [];
+    const serve = (via: RegistryRequest["via"]) =>
+      Bun.serve({
+        hostname: "127.0.0.1",
+        port: 0,
+        async fetch(req) {
+          await req.arrayBuffer();
+          const request: RegistryRequest = { via, method: req.method, url: req.url };
+          const otp = req.headers.get("npm-otp");
+          if (otp !== null) request.otp = otp;
+          requests.push(request);
+          return respond(request);
         },
-        stdio: ["inherit", "inherit", "inherit"],
-        timeout: 20_000,
       });
-      promises[i] = exited
-        .then(r => {
-          if (r !== 0) {
-            throw new Error("failed to install with exit code " + r);
-          }
-        })
-        .finally(() => {
-          return rm(package_dir, { recursive: true, force: true });
+    const registry = serve("registry");
+    const proxy = serve("proxy");
+    const registryUrl = `http://127.0.0.1:${registry.port}/`;
+    return {
+      registryUrl,
+      requests,
+      async run(args: string[], opts: { files?: Record<string, string>; env?: Record<string, string> } = {}) {
+        using dir = tempDir("registry-behind-proxy", {
+          "package.json": JSON.stringify({ name: "app", version: "1.0.0" }),
+          ...opts.files,
+          "bunfig.toml": Bun.TOML.stringify({
+            install: { cache: false, registry: { url: registryUrl, token: "unused" } },
+          }),
+        });
+        await using proc = Bun.spawn({
+          cmd: [bunExe(), ...args],
+          cwd: String(dir),
+          env: {
+            ...bunEnv,
+            BUN_INSTALL_CACHE_DIR: join(String(dir), ".bun-cache"),
+            NO_PROXY: undefined,
+            no_proxy: undefined,
+            HTTPS_PROXY: undefined,
+            https_proxy: undefined,
+            HTTP_PROXY: undefined,
+            http_proxy: `http://127.0.0.1:${proxy.port}`,
+            ...opts.env,
+          },
+          stdout: "pipe",
+          stderr: "pipe",
         });
-    }
+        const [stdout, stderr, exitCode] = await Promise.all([proc.stdout.text(), proc.stderr.text(), proc.exited]);
+        return { stdout, stderr, exitCode };
+      },
+      [Symbol.dispose]() {
+        registry.stop(true);
+        proxy.stop(true);
+      },
+    };
+  }
 
-    await Promise.all(promises);
-  }, 60_000);
-}
+  const manifest = (name: string) =>
+    Response.json({
+      name,
+      "dist-tags": { latest: "1.0.0" },
+      versions: { "1.0.0": { name, version: "1.0.0", dist: { tarball: `http://127.0.0.1:1/${name}-1.0.0.tgz` } } },
+    });
+
+  it.concurrent("bun pm whoami", async () => {
+    using setup = registryBehindProxy(() => Response.json({ username: "user-behind-the-proxy" }));
+
+    const { stdout, stderr, exitCode } = await setup.run(["pm", "whoami"]);
+    expect({ requests: setup.requests, stdout, stderr, exitCode }).toEqual({
+      requests: [{ via: "proxy", method: "GET", url: `${setup.registryUrl}-/whoami` }],
+      stdout: "user-behind-the-proxy\n",
+      stderr: "",
+      exitCode: 0,
+    });
+  });
+
+  it.concurrent("bun publish", async () => {
+    using setup = registryBehindProxy(() => Response.json({ ok: true }));
+
+    const { stdout, stderr, exitCode } = await setup.run(["publish"]);
+    expect({ requests: setup.requests, stderr, exitCode }).toEqual({
+      requests: [{ via: "proxy", method: "PUT", url: `${setup.registryUrl}app` }],
+      stderr: "",
+      exitCode: 0,
+    });
+    expect(stdout).toContain(" + app@1.0.0");
+  });
+
+  it.concurrent("bun publish --tolerate-republish version lookup", async () => {
+    using setup = registryBehindProxy(({ method }) =>
+      method === "GET" ? manifest("app") : new Response(null, { status: 500 }),
+    );
+
+    const { stderr, exitCode } = await setup.run(["publish", "--tolerate-republish"]);
+    expect({ requests: setup.requests, stderr, exitCode }).toEqual({
+      requests: [{ via: "proxy", method: "GET", url: `${setup.registryUrl}app` }],
+      stderr: "warn: Registry already knows about version 1.0.0; skipping.\n",
+      exitCode: 0,
+    });
+  });
+
+  it.concurrent("bun publish web login poll and OTP retry", async () => {
+    using setup = registryBehindProxy(({ url, otp }) => {
+      if (url.endsWith("/-/done")) return Response.json({ token: "otp-from-web-login" });
+      if (otp === "otp-from-web-login") return Response.json({ ok: true });
+      return Response.json(
+        { authUrl: new URL("/-/auth", url).href, doneUrl: new URL("/-/done", url).href },
+        { status: 401, headers: { "www-authenticate": "OTP" } },
+      );
+    });
+
+    const { stdout, stderr, exitCode } = await setup.run(["publish"]);
+    expect({ requests: setup.requests, stderr, exitCode }).toEqual({
+      requests: [
+        { via: "proxy", method: "PUT", url: `${setup.registryUrl}app` },
+        { via: "proxy", method: "GET", url: `${setup.registryUrl}-/done` },
+        { via: "proxy", method: "PUT", url: `${setup.registryUrl}app`, otp: "otp-from-web-login" },
+      ],
+      stderr: "",
+      exitCode: 0,
+    });
+    expect(stdout).toContain(" + app@1.0.0");
+  });
+
+  it.concurrent("bun publish to a registry listed in no_proxy goes direct", async () => {
+    using setup = registryBehindProxy(() => Response.json({ ok: true }));
+
+    const { stdout, stderr, exitCode } = await setup.run(["publish"], { env: { no_proxy: "127.0.0.1" } });
+    expect({ requests: setup.requests, stderr, exitCode }).toEqual({
+      requests: [{ via: "registry", method: "PUT", url: `${setup.registryUrl}app` }],
+      stderr: "",
+      exitCode: 0,
+    });
+    expect(stdout).toContain(" + app@1.0.0");
+  });
+
+  it.concurrent("bun info", async () => {
+    using setup = registryBehindProxy(() => manifest("some-dep"));
+
+    const { stdout, stderr, exitCode } = await setup.run(["info", "some-dep", "name"]);
+    expect({ requests: setup.requests, stdout, stderr, exitCode }).toEqual({
+      requests: [{ via: "proxy", method: "GET", url: `${setup.registryUrl}some-dep` }],
+      stdout: "some-dep\n",
+      stderr: "",
+      exitCode: 0,
+    });
+  });
+
+  it.concurrent("bun audit", async () => {
+    using setup = registryBehindProxy(() => Response.json({}));
+
+    const { stdout, stderr, exitCode } = await setup.run(["audit"], {
+      files: {
+        "package.json": JSON.stringify({ name: "app", version: "1.0.0", dependencies: { "some-dep": "1.0.0" } }),
+        "bun.lock": JSON.stringify({
+          lockfileVersion: 1,
+          workspaces: { "": { name: "app", dependencies: { "some-dep": "1.0.0" } } },
+          packages: { "some-dep": ["some-dep@1.0.0", "", {}, "sha512-AAAA"] },
+        }),
+      },
+    });
+    expect({ requests: setup.requests, stdout, stderr, exitCode }).toEqual({
+      requests: [{ via: "proxy", method: "POST", url: `${setup.registryUrl}-/npm/v1/security/advisories/bulk` }],
+      stdout: "No vulnerabilities found\n",
+      stderr: expect.stringMatching(/^bun audit v.*\n$/),
+      exitCode: 0,
+    });
+  });
+
+  it.concurrent("bun install", async () => {
+    using setup = registryBehindProxy(() => new Response(null, { status: 404 }));
+
+    const { stderr, exitCode } = await setup.run(["install"], {
+      files: {
+        "package.json": JSON.stringify({ name: "app", version: "1.0.0", dependencies: { "some-dep": "1.0.0" } }),
+      },
+    });
+    expect({ requests: setup.requests, stderr, exitCode }).toEqual({
+      requests: [{ via: "proxy", method: "GET", url: `${setup.registryUrl}some-dep` }],
+      stderr: expect.stringContaining(`error: GET ${setup.registryUrl}some-dep - 404`),
+      exitCode: 1,
+    });
+  });
+});
diff --git a/test/internal/source-lints/init-sync-http-proxy.test.ts b/test/internal/source-lints/init-sync-http-proxy.test.ts
new file mode 100644
index 000000000000..6c5cc125ce90
--- /dev/null
+++ b/test/internal/source-lints/init-sync-http-proxy.test.ts
@@ -0,0 +1,146 @@
+import { file } from "bun";
+import { expect, test } from "bun:test";
+import { realpathSync } from "fs";
+import path from "path";
+import { globAllSources } from "../../../scripts/glob-sources.ts";
+
+// `AsyncHTTP::init_sync` is how CLI commands (install, publish, audit, pm view,
+// upgrade, create, ...) make a blocking request, and its `http_proxy` argument
+// is the only way the request learns about http_proxy / https_proxy /
+// NO_PROXY. A literal `None` there is a command that silently ignores the
+// proxy environment every other command honours: `bun audit` shipped that way
+// (#20295), and so did `bun publish` and `bun pm whoami`. Resolve it from the
+// environment instead, for the URL being requested:
+//
+//   let http_proxy = pm.http_proxy(&url);                   // with a PackageManager
+//   let http_proxy = env_loader.get_http_proxy_for(&url);   // with a dotenv Loader
+//
+// Both return `None` when no proxy applies, so there is never a reason to
+// write the literal. The argument is found by position, so the lint also
+// fails if the signature changes shape; update INIT_SYNC_ARGS along with it.
+
+const INIT_SYNC_ARGS = [
+  "method",
+  "url",
+  "headers",
+  "headers_buf",
+  "request_body",
+  "http_proxy",
+  "hostname",
+  "redirect_type",
+];
+const HTTP_PROXY_ARG = INIT_SYNC_ARGS.indexOf("http_proxy");
+const CALL = "AsyncHTTP::init_sync(";
+
+const root = path.resolve(import.meta.dir, "..", "..", "..");
+const rustSources = globAllSources().rust.filter(p => p.endsWith(".rs"));
+
+// Only scan files tracked in HEAD (a `git stash` round-trip can leave stray
+// `.rs` files in the working tree; CI runs on a clean checkout). Same guard as
+// dead-code-escapes.test.ts.
+const tracked: Set<string> | null = (() => {
+  const r = Bun.spawnSync({
+    cmd: ["git", "-C", root, "ls-tree", "-r", "--name-only", "-z", "HEAD"],
+    stdout: "pipe",
+    stderr: "ignore",
+  });
+  if (!r.success) return null;
+  return new Set(r.stdout.toString().split("\0").filter(Boolean));
+})();
+
+// A string or char literal (`"..."`, `b"..."`, `'x'`, `b'\n'`) starting at
+// lastIndex; a lifetime (`'a`) has no closing quote after its first character
+// and does not match.
+const LITERAL = /b?"(?:\\[\s\S]|[^\\"])*"|b?'(?:\\[\s\S]|[^\\'])'/y;
+const COMMENT = /\/\/[^\n]*|\/\*[\s\S]*?\*\//y;
+
+function matchAt(re: RegExp, source: string, at: number): string | null {
+  re.lastIndex = at;
+  return re.exec(source)?.[0] ?? null;
+}
+
+/** Replaces comments with spaces (line count preserved); literals are kept as-is. */
+function stripComments(source: string): string {
+  let out = "";
+  for (let i = 0; i < source.length; ) {
+    const literal = matchAt(LITERAL, source, i);
+    if (literal !== null) {
+      out += literal;
+      i += literal.length;
+      continue;
+    }
+    const comment = matchAt(COMMENT, source, i);
+    if (comment !== null) {
+      out += comment.replace(/[^\n]/g, " ");
+      i += comment.length;
+      continue;
+    }
+    out += source[i++];
+  }
+  return out;
+}
+
+/**
+ * The arguments of the call whose `(` is at `source[open]`, split on the
+ * commas at nesting depth 0, or `null` if the call is never closed.
+ */
+function callArguments(source: string, open: number): string[] | null {
+  const args: string[] = [];
+  let current = "";
+  let depth = 0;
+  for (let i = open + 1; i < source.length; ) {
+    const literal = matchAt(LITERAL, source, i);
+    if (literal !== null) {
+      current += literal;
+      i += literal.length;
+      continue;
+    }
+    const c = source[i++]!;
+    if (c === "(" || c === "[" || c === "{") depth++;
+    if (c === ")" || c === "]" || c === "}") {
+      if (depth === 0) {
+        if (current.trim() !== "") args.push(current.trim());
+        return args;
+      }
+      depth--;
+    }
+    if (c === "," && depth === 0) {
+      args.push(current.trim());
+      current = "";
+      continue;
+    }
+    current += c;
+  }
+  return null;
+}
+
+const offenders: string[] = [];
+let calls = 0;
+for (const abs of rustSources) {
+  const source = path.relative(root, abs).replaceAll(path.sep, "/");
+  if (path.relative(root, realpathSync(abs)).replaceAll(path.sep, "/") !== source) continue;
+  if (tracked !== null && !tracked.has(source)) continue;
+  const content = await file(abs).text();
+  if (!content.includes(CALL)) continue;
+  const code = stripComments(content);
+  for (let at = code.indexOf(CALL); at !== -1; at = code.indexOf(CALL, at + CALL.length)) {
+    calls++;
+    const where = `${source}:${code.slice(0, at).split("\n").length}`;
+    const args = callArguments(code, at + CALL.length - 1);
+    if (args === null || args.length !== INIT_SYNC_ARGS.length) {
+      offenders.push(
+        `${where}: expected the ${INIT_SYNC_ARGS.length} arguments (${INIT_SYNC_ARGS.join(", ")}), found ${args?.length ?? "an unterminated call"}; update this lint if init_sync changed`,
+      );
+    } else if (args[HTTP_PROXY_ARG] === "None") {
+      offenders.push(`${where}: AsyncHTTP::init_sync with http_proxy: None; resolve it from the environment`);
+    }
+  }
+}
+
+test("scans the AsyncHTTP::init_sync call sites", () => {
+  expect(calls).toBeGreaterThan(0);
+});
+
+test("every AsyncHTTP::init_sync call resolves http_proxy from the environment", () => {
+  expect(offenders).toEqual([]);
+});

From 1595a7824bf047eec0e8fbcc9de49ca34ca1cc4a Mon Sep 17 00:00:00 2001
From: robobun <117481402+robobun@users.noreply.github.com>
Date: Mon, 17 Aug 2026 01:06:40 +0000
Subject: [PATCH 043/258] install: make BUN_CONFIG_NO_VERIFY disable integrity
 verification when set (#38310)

---
 .../PackageManager/PackageManagerOptions.rs   |  2 +-
 .../bun-install-tarball-integrity.test.ts     | 68 +++++++++++++++++++
 2 files changed, 69 insertions(+), 1 deletion(-)

diff --git a/src/install/PackageManager/PackageManagerOptions.rs b/src/install/PackageManager/PackageManagerOptions.rs
index 10504ff5a1cd..a8f97684a22d 100644
--- a/src/install/PackageManager/PackageManagerOptions.rs
+++ b/src/install/PackageManager/PackageManagerOptions.rs
@@ -691,7 +691,7 @@ impl Options {
         }
 
         if let Some(check_bool) = env.get(b"BUN_CONFIG_NO_VERIFY") {
-            self.do_.set(Do::VERIFY_INTEGRITY, check_bool != b"0");
+            self.do_.set(Do::VERIFY_INTEGRITY, check_bool == b"0");
         }
 
         // Update should never read from manifest cache
diff --git a/test/cli/install/bun-install-tarball-integrity.test.ts b/test/cli/install/bun-install-tarball-integrity.test.ts
index 35e208458ea2..765f13314ccb 100644
--- a/test/cli/install/bun-install-tarball-integrity.test.ts
+++ b/test/cli/install/bun-install-tarball-integrity.test.ts
@@ -884,6 +884,74 @@ describe.concurrent("tarball integrity metadata forms", () => {
     expect(stdout).not.toContain("1 package installed");
     expect(exitCode).not.toBe(0);
   });
+
+  it("--no-verify installs a tarball whose bytes don't match the advertised integrity", async () => {
+    const real = buildTarball(Buffer.from('{"name":"pkg","version":"1.0.0"}\n'));
+    const other = buildTarball(Buffer.from('{"name":"other","version":"9.9.9"}\n'));
+
+    await using server = serveManifest(other.sha512, real.tgz);
+    using dir = projectDir("integrity-no-verify-flag", server.port);
+
+    await using proc = spawn({
+      cmd: [bunExe(), "install", "--no-verify"],
+      cwd: String(dir),
+      env: { ...env, BUN_INSTALL_CACHE_DIR: join(String(dir), ".cache") },
+      stdout: "pipe",
+      stderr: "pipe",
+    });
+    const [stderr, stdout, exitCode] = await Promise.all([proc.stderr.text(), proc.stdout.text(), proc.exited]);
+    expect(stderr + stdout).not.toContain("Integrity check failed");
+    expect(stdout).toContain("1 package installed");
+    expect(await file(join(String(dir), "node_modules", "pkg", "package.json")).json()).toEqual({
+      name: "pkg",
+      version: "1.0.0",
+    });
+    expect(exitCode).toBe(0);
+  });
+
+  it("BUN_CONFIG_NO_VERIFY=1 skips the integrity check like --no-verify", async () => {
+    const real = buildTarball(Buffer.from('{"name":"pkg","version":"1.0.0"}\n'));
+    const other = buildTarball(Buffer.from('{"name":"other","version":"9.9.9"}\n'));
+
+    await using server = serveManifest(other.sha512, real.tgz);
+    using dir = projectDir("integrity-no-verify-env-1", server.port);
+
+    await using proc = spawn({
+      cmd: [bunExe(), "install"],
+      cwd: String(dir),
+      env: { ...env, BUN_INSTALL_CACHE_DIR: join(String(dir), ".cache"), BUN_CONFIG_NO_VERIFY: "1" },
+      stdout: "pipe",
+      stderr: "pipe",
+    });
+    const [stderr, stdout, exitCode] = await Promise.all([proc.stderr.text(), proc.stdout.text(), proc.exited]);
+    expect(stderr + stdout).not.toContain("Integrity check failed");
+    expect(stdout).toContain("1 package installed");
+    expect(await file(join(String(dir), "node_modules", "pkg", "package.json")).json()).toEqual({
+      name: "pkg",
+      version: "1.0.0",
+    });
+    expect(exitCode).toBe(0);
+  });
+
+  it("BUN_CONFIG_NO_VERIFY=0 keeps the integrity check enabled", async () => {
+    const real = buildTarball(Buffer.from('{"name":"pkg","version":"1.0.0"}\n'));
+    const other = buildTarball(Buffer.from('{"name":"other","version":"9.9.9"}\n'));
+
+    await using server = serveManifest(other.sha512, real.tgz);
+    using dir = projectDir("integrity-no-verify-env-0", server.port);
+
+    await using proc = spawn({
+      cmd: [bunExe(), "install"],
+      cwd: String(dir),
+      env: { ...env, BUN_INSTALL_CACHE_DIR: join(String(dir), ".cache"), BUN_CONFIG_NO_VERIFY: "0" },
+      stdout: "pipe",
+      stderr: "pipe",
+    });
+    const [stderr, stdout, exitCode] = await Promise.all([proc.stderr.text(), proc.stdout.text(), proc.exited]);
+    expect(stderr + stdout).toContain("Integrity check failed");
+    expect(stdout).not.toContain("1 package installed");
+    expect(exitCode).not.toBe(0);
+  });
 });
 
 describe.concurrent.each(["hoisted", "isolated"] as const)("tarball download failure (%s)", linker => {

From a6f3a869cf8e2d7c256be8dc73e4502ad0394b98 Mon Sep 17 00:00:00 2001
From: robobun <117481402+robobun@users.noreply.github.com>
Date: Mon, 17 Aug 2026 01:06:44 +0000
Subject: [PATCH 044/258] install: honor BUN_CONFIG_MAX_HTTP_REQUESTS (#38744)

---
 docs/runtime/environment-variables.mdx |   2 +-
 src/install/PackageManager.rs          |  31 ++++---
 test/cli/install/bun-install.test.ts   | 118 ++++++++-----------------
 3 files changed, 51 insertions(+), 100 deletions(-)

diff --git a/docs/runtime/environment-variables.mdx b/docs/runtime/environment-variables.mdx
index aaf6d5beda5f..40b0a3545d67 100644
--- a/docs/runtime/environment-variables.mdx
+++ b/docs/runtime/environment-variables.mdx
@@ -203,7 +203,7 @@ Bun reads these environment variables to configure aspects of its behavior.
 | `TMPDIR`                                 | Bun occasionally requires a directory to store intermediate assets during bundling or other operations. If unset, defaults to the platform-specific temporary directory: `/tmp` on Linux, `/private/tmp` on macOS.                                                                                                                                                            |
 | `NO_COLOR`                               | If `NO_COLOR=1`, then ANSI color output is [disabled](https://no-color.org/).                                                                                                                                                                                                                                                                                                 |
 | `FORCE_COLOR`                            | If `FORCE_COLOR=1`, then ANSI color output is forced on, even if `NO_COLOR` is set.                                                                                                                                                                                                                                                                                           |
-| `BUN_CONFIG_MAX_HTTP_REQUESTS`           | Sets the maximum number of concurrent HTTP requests sent by fetch and `bun install`. Defaults to `256`. Lower it if you run into rate limits or connection issues.                                                                                                                                                                                                            |
+| `BUN_CONFIG_MAX_HTTP_REQUESTS`           | Sets the maximum number of concurrent HTTP requests sent by `fetch` and `bun install`. `fetch` defaults to `256`. `bun install` defaults to `64`, and its `--network-concurrency` flag overrides this variable. Lower it if you run into rate limits or connection issues.                                                                                                    |
 | `BUN_CONFIG_NO_CLEAR_TERMINAL_ON_RELOAD` | If `BUN_CONFIG_NO_CLEAR_TERMINAL_ON_RELOAD=true`, then `bun --watch` does not clear the console on reload                                                                                                                                                                                                                                                                     |
 | `DO_NOT_TRACK`                           | Disable uploading crash reports to `bun.report` on crash. On macOS & Windows, crash report uploads are enabled by default. Bun sends no other telemetry, though we plan to add some. If `DO_NOT_TRACK=1`, then auto-uploading crash reports and telemetry are both [disabled](https://do-not-track.dev/).                                                                     |
 | `BUN_OPTIONS`                            | Prepends command-line arguments to any Bun execution. For example, `BUN_OPTIONS="--hot"` makes `bun run dev` behave like `bun --hot run dev`.                                                                                                                                                                                                                                 |
diff --git a/src/install/PackageManager.rs b/src/install/PackageManager.rs
index f27026b6f903..4382e8d4aa5b 100644
--- a/src/install/PackageManager.rs
+++ b/src/install/PackageManager.rs
@@ -2247,6 +2247,16 @@ pub fn init(
             }
         }
 
+        // `options.load` applies BUN_CONFIG_MAX_HTTP_REQUESTS on top of this default.
+        http::async_http::MAX_SIMULTANEOUS_REQUESTS.store(
+            if env.has_http_proxy() {
+                DEFAULT_MAX_SIMULTANEOUS_REQUESTS_FOR_BUN_INSTALL_FOR_PROXIES
+            } else {
+                DEFAULT_MAX_SIMULTANEOUS_REQUESTS_FOR_BUN_INSTALL
+            },
+            Ordering::Relaxed,
+        );
+
         manager.options.load(
             // SAFETY: ctx.log is the process-lifetime CLI log set by
             // create_context_data(); single-threaded init region.
@@ -2257,6 +2267,11 @@ pub fn init(
             subcommand,
         )?;
 
+        if let Some(network_concurrency) = cli_network_concurrency {
+            http::async_http::MAX_SIMULTANEOUS_REQUESTS
+                .store(usize::from(network_concurrency.max(1)), Ordering::Relaxed);
+        }
+
         if let Some(config) = ctx.install.as_deref_mut() {
             if let Some(p) = config.public_hoist_pattern.take() {
                 manager.options.public_hoist_pattern = Some(p);
@@ -2305,22 +2320,6 @@ pub fn init(
         }
     }
 
-    http::async_http::MAX_SIMULTANEOUS_REQUESTS.store(
-        'brk: {
-            if let Some(network_concurrency) = cli_network_concurrency {
-                break 'brk network_concurrency.max(1) as usize;
-            }
-
-            // If any HTTP proxy is set, use a diferent limit
-            if env.has_http_proxy() {
-                break 'brk DEFAULT_MAX_SIMULTANEOUS_REQUESTS_FOR_BUN_INSTALL_FOR_PROXIES;
-            }
-
-            DEFAULT_MAX_SIMULTANEOUS_REQUESTS_FOR_BUN_INSTALL
-        },
-        Ordering::Relaxed, // .monotonic
-    );
-
     // `InitOpts.ca: Vec<*const c_void>` (erased `[*:0]const u8`). The HTTP
     // thread reads these asynchronously after `init` returns, so park the
     // owning `ZBox`es in `holder::CA` for process lifetime (never freed)
diff --git a/test/cli/install/bun-install.test.ts b/test/cli/install/bun-install.test.ts
index 06de24343ffb..aeb048ae55ac 100644
--- a/test/cli/install/bun-install.test.ts
+++ b/test/cli/install/bun-install.test.ts
@@ -155,105 +155,57 @@ describe.concurrent("bun-install", () => {
     });
   }
 
-  it("bun install --network-concurrency=5 doesnt go over 5 concurrent requests", async () => {
+  it.each([
+    { label: "--network-concurrency=5", cap: 5, args: ["--network-concurrency", "5"], extraEnv: {} },
+    { label: "BUN_CONFIG_MAX_HTTP_REQUESTS=5", cap: 5, args: [], extraEnv: { BUN_CONFIG_MAX_HTTP_REQUESTS: "5" } },
+    {
+      label: "--network-concurrency=2 overriding BUN_CONFIG_MAX_HTTP_REQUESTS=50",
+      cap: 2,
+      args: ["--network-concurrency", "2"],
+      extraEnv: { BUN_CONFIG_MAX_HTTP_REQUESTS: "50" },
+    },
+  ])("bun install with $label doesnt go over $cap concurrent requests", async ({ cap, args, extraEnv }) => {
     await withContext(defaultOpts, async ctx => {
-      const urls: string[] = [];
       let maxConcurrentRequests = 0;
-      let concurrentRequestCounter = 0;
-      let totalRequests = 0;
-      setContextHandler(ctx, async function (request) {
-        concurrentRequestCounter++;
-        totalRequests++;
+      let concurrentRequests = 0;
+      setContextHandler(ctx, async function () {
+        concurrentRequests++;
+        maxConcurrentRequests = Math.max(maxConcurrentRequests, concurrentRequests);
         try {
+          // Simulated registry latency: requests have to overlap for the stub to
+          // observe how many the client keeps in flight at once.
           await Bun.sleep(10);
-          maxConcurrentRequests = Math.max(maxConcurrentRequests, concurrentRequestCounter);
-
-          if (concurrentRequestCounter > 20) {
-            throw new Error("Too many concurrent requests");
-          }
         } finally {
-          concurrentRequestCounter--;
+          concurrentRequests--;
         }
-
         return new Response("404", { status: 404 });
       });
+
+      const dependencies: Record<string, string> = {};
+      for (let i = 1; i <= 51; i++) {
+        dependencies[`bar${i}`] = "^1";
+      }
       await writeFile(
         join(ctx.package_dir, "package.json"),
-        `
-  {
-    "name": "foo",
-    "version": "0.0.1",
-    "dependencies": {
-      "bar1": "^1",
-      "bar2": "^1",
-      "bar3": "^1",
-      "bar4": "^1",
-      "bar5": "^1",
-      "bar6": "^1",
-      "bar7": "^1",
-      "bar8": "^1",
-      "bar9": "^1",
-      "bar10": "^1",
-      "bar11": "^1",
-      "bar12": "^1",
-      "bar13": "^1",
-      "bar14": "^1",
-      "bar15": "^1",
-      "bar16": "^1",
-      "bar17": "^1",
-      "bar18": "^1",
-      "bar19": "^1",
-      "bar20": "^1",
-      "bar21": "^1",
-      "bar22": "^1",
-      "bar23": "^1",
-      "bar24": "^1",
-      "bar25": "^1",
-      "bar26": "^1",
-      "bar27": "^1",
-      "bar28": "^1",
-      "bar29": "^1",
-      "bar30": "^1",
-      "bar31": "^1",
-      "bar32": "^1",
-      "bar33": "^1",
-      "bar34": "^1",
-      "bar35": "^1",
-      "bar36": "^1",
-      "bar37": "^1",
-      "bar38": "^1",
-      "bar39": "^1",
-      "bar40": "^1",
-      "bar41": "^1",
-      "bar42": "^1",
-      "bar43": "^1",
-      "bar44": "^1",
-      "bar45": "^1",
-      "bar46": "^1",
-      "bar47": "^1",
-      "bar48": "^1",
-      "bar49": "^1",
-      "bar50": "^1",
-      "bar51": "^1",
-    }
-  }`,
+        JSON.stringify({ name: "foo", version: "0.0.1", dependencies }),
       );
-      const { stdout, stderr, exited } = spawn({
-        cmd: [bunExe(), "install", "--network-concurrency", "5"],
+
+      await using proc = spawn({
+        cmd: [bunExe(), "install", ...args],
         cwd: ctx.package_dir,
         stdout: "pipe",
-        stdin: "pipe",
         stderr: "pipe",
-        env,
+        env: { ...env, ...extraEnv },
       });
-      const err = await stderr.text();
-      expect(await exited).toBe(1);
-      expect(urls).toBeEmpty();
-      expect(maxConcurrentRequests).toBeLessThanOrEqual(5);
-      expect(totalRequests).toBe(51);
+      const [stdout, stderr, exitCode] = await Promise.all([proc.stdout.text(), proc.stderr.text(), proc.exited]);
 
-      expect(err).toContain("failed to resolve");
-      expect(await stdout.text()).toEqual(expect.stringContaining("bun install v1."));
+      expect(maxConcurrentRequests).toBeLessThanOrEqual(cap);
+      expect({ totalRequests: ctx.requested, stdout, stderr, exitCode }).toEqual({
+        totalRequests: 51,
+        stdout: expect.stringContaining("bun install v1."),
+        stderr: expect.stringContaining("failed to resolve"),
+        exitCode: 1,
+      });
     });
   });
 

From aa522102fb1c7944441d9c30000f20b5455fe653 Mon Sep 17 00:00:00 2001
From: robobun <117481402+robobun@users.noreply.github.com>
Date: Mon, 17 Aug 2026 01:06:48 +0000
Subject: [PATCH 045/258] url: emit a single slash in href_without_auth() for
 root-path registry URLs (#38812)

---
 src/url/lib.rs                 | 13 ++---
 test/cli/install/npmrc.test.ts | 93 ++++++++++++++++++++++++++++++++++
 2 files changed, 98 insertions(+), 8 deletions(-)

diff --git a/src/url/lib.rs b/src/url/lib.rs
index 8c02d641839a..dc1dd00fdb7a 100644
--- a/src/url/lib.rs
+++ b/src/url/lib.rs
@@ -390,12 +390,7 @@ impl<'a> URL<'a> {
         }
     }
 
-    /// Formats `<displayProtocol>://<displayHost>/<trimmed pathname>/`.
-    ///
-    /// `display_host()` yields a `bun_core::fmt::HostFormatter` (impls
-    /// `Display`); the other two pieces are raw byte slices, so we assemble
-    /// into a `Vec<u8>` directly rather than going through `format!` and
-    /// risking lossy UTF-8 round-trips.
+    /// The URL without its userinfo, ending in exactly one `/`: `http://host/`, `http://host/npm/`.
     pub fn href_without_auth(&self) -> Box<[u8]> {
         let proto = self.display_protocol();
         let path = strings::trim(self.pathname, b"/");
@@ -407,8 +402,10 @@ impl<'a> URL<'a> {
         // bun_core::io::Write on Vec<u8> is infallible.
         let _ = buf.print(format_args!("{}", self.display_host()));
         buf.push(b'/');
-        buf.extend_from_slice(path);
-        buf.push(b'/');
+        if !path.is_empty() {
+            buf.extend_from_slice(path);
+            buf.push(b'/');
+        }
         buf.into_boxed_slice()
     }
 
diff --git a/test/cli/install/npmrc.test.ts b/test/cli/install/npmrc.test.ts
index 5f8e8516daab..69e24a9b14a6 100644
--- a/test/cli/install/npmrc.test.ts
+++ b/test/cli/install/npmrc.test.ts
@@ -706,6 +706,99 @@ registry=https://somehost.com/org1/npm/registry/
   });
 });
 
+describe.concurrent("registry URL with embedded credentials", () => {
+  // Credentials written into the registry URL are split off and the URL is
+  // stored without them. The stored URL is what requests are built from and
+  // what error messages print, so a registry at the root of its host has to
+  // come back as "http://host/", not "http://host//".
+  test.each([
+    ["http://alice:s3cret@registry.example.com/", "http://registry.example.com/"],
+    ["http://alice:s3cret@registry.example.com", "http://registry.example.com/"],
+    ["http://alice:s3cret@registry.example.com:8080", "http://registry.example.com:8080/"],
+    ["http://alice:s3cret@registry.example.com/npm/", "http://registry.example.com/npm/"],
+    ["http://alice:s3cret@registry.example.com/npm", "http://registry.example.com/npm/"],
+  ])("registry=%s is stored as %s", (registry, url) => {
+    expect(loadNpmrc(`registry=${registry}\n`)).toMatchObject({
+      default_registry_url: url,
+      default_registry_username: "alice",
+      default_registry_password: "s3cret",
+    });
+  });
+
+  test.each([
+    ["http://:tok@registry.example.com/", "http://registry.example.com/"],
+    ["http://:tok@registry.example.com:8080", "http://registry.example.com:8080/"],
+    ["http://:tok@registry.example.com:8080/a/b/", "http://registry.example.com:8080/a/b/"],
+  ])("registry=%s is stored as %s", (registry, url) => {
+    expect(loadNpmrc(`registry=${registry}\n`)).toMatchObject({
+      default_registry_url: url,
+      default_registry_token: "tok",
+    });
+  });
+
+  type Req = { path: string; auth: string | null };
+
+  function mockRegistry(reqs: Req[], respond: () => Response) {
+    return Bun.serve({
+      port: 0,
+      hostname: "127.0.0.1",
+      fetch(req) {
+        reqs.push({ path: new URL(req.url).pathname, auth: req.headers.get("authorization") });
+        return respond();
+      },
+    });
+  }
+
+  async function run(dir: string, ...args: string[]) {
+    await using proc = Bun.spawn({
+      cmd: [bunExe(), ...args],
+      cwd: dir,
+      env: { ...env, BUN_INSTALL_CACHE_DIR: join(dir, ".cache") },
+      stdout: "pipe",
+      stderr: "pipe",
+    });
+    const [, stderr, exitCode] = await Promise.all([proc.stdout.text(), proc.stderr.text(), proc.exited]);
+    return { stderr, exitCode };
+  }
+
+  // The documented bunfig form for a token: the token rides on the end of the
+  // URL's path. `bun pm whoami` prints the stored URL verbatim when the
+  // registry does not return a username.
+  test.each([
+    ["/", "/-/whoami"],
+    ["/npm/", "/npm/-/whoami"],
+  ])("_authToken= appended to a bunfig.toml registry URL with path %s", async (path, whoami) => {
+    const reqs: Req[] = [];
+    await using server = mockRegistry(reqs, () => Response.json({}));
+    const base = `http://127.0.0.1:${server.port}${path}`;
+    using dir = tempDir("bunfig-authtoken-suffix", {
+      "bunfig.toml": `[install.registry]\nurl = "${base}_authToken=tok"\n`,
+      "package.json": JSON.stringify({ name: "app" }),
+    });
+
+    const { stderr, exitCode } = await run(String(dir), "pm", "whoami");
+
+    expect(stderr).toBe(`error: failed to authenticate with registry '${base}'\n`);
+    expect(reqs).toEqual([{ path: whoami, auth: "Bearer tok" }]);
+    expect(exitCode).toBe(1);
+  });
+
+  test("username:password in the .npmrc registry URL", async () => {
+    const reqs: Req[] = [];
+    await using server = mockRegistry(reqs, () => new Response("unauthorized", { status: 401 }));
+    using dir = tempDir("npmrc-userinfo", {
+      ".npmrc": `registry=http://alice:s3cret@127.0.0.1:${server.port}/\n`,
+      "package.json": JSON.stringify({ name: "app", dependencies: { "needs-creds": "1.0.0" } }),
+    });
+
+    const { stderr, exitCode } = await run(String(dir), "install");
+
+    expect(stderr.split(/\r?\n/)).toContain(`error: GET http://127.0.0.1:${server.port}/needs-creds - 401`);
+    expect(reqs).toEqual([{ path: "/needs-creds", auth: `Basic ${Buffer.from("alice:s3cret").toString("base64")}` }]);
+    expect(exitCode).toBe(1);
+  });
+});
+
 describe("scoped registry routing", () => {
   // A request for a @scope package must be sent only to that scope's configured
   // registry with that scope's token. The registry map was keyed by a bare

From dc0e10c0ed111945ab19b21520be5be0123061c2 Mon Sep 17 00:00:00 2001
From: robobun <117481402+robobun@users.noreply.github.com>
Date: Mon, 17 Aug 2026 01:06:53 +0000
Subject: [PATCH 046/258] url: parse the host of a protocol-relative URL
 instead of leaving the authority in the path (#39000)

---
 src/url/lib.rs                             |   7 +-
 test/cli/install/npmrc.test.ts             | 100 +++++++++++++++++++++
 test/js/bun/util/filesystem_router.test.ts |  36 ++++++++
 3 files changed, 140 insertions(+), 3 deletions(-)

diff --git a/src/url/lib.rs b/src/url/lib.rs
index dc1dd00fdb7a..be249e698626 100644
--- a/src/url/lib.rs
+++ b/src/url/lib.rs
@@ -589,9 +589,9 @@ impl<'a> URL<'a> {
                 offset += url.parse_host(base).unwrap_or(0);
             }
             b'/' | b'a'..=b'z' | b'A'..=b'Z' | b'0'..=b'9' | b'-' | b'_' | b':' => {
-                let is_protocol_relative = base.len() > 1 && base[1] == b'/';
+                let is_protocol_relative = base.starts_with(b"//");
                 if is_protocol_relative {
-                    offset += 1;
+                    offset += 2;
                 } else {
                     offset += url.parse_protocol(&base[offset as usize..]).unwrap_or(0);
                 }
@@ -697,7 +697,8 @@ impl<'a> URL<'a> {
             url.pathname = &url.pathname[1..];
         }
 
-        url.origin = strings::trim(url.origin, b"/ ?#");
+        // Only the right side: a protocol-relative origin keeps its leading `//`.
+        url.origin = strings::trim_right(url.origin, b"/ ?#");
         url
     }
 
diff --git a/test/cli/install/npmrc.test.ts b/test/cli/install/npmrc.test.ts
index 69e24a9b14a6..7dca931cd5fd 100644
--- a/test/cli/install/npmrc.test.ts
+++ b/test/cli/install/npmrc.test.ts
@@ -683,6 +683,65 @@ registry=https://somehost.com/org1/npm/registry/
     });
   });
 
+  describe("protocol-relative registry value", () => {
+    // `registry=//host/path/` is kept as written and matched against the credential
+    // keys by host and pathname. It used to parse with an empty host and `/host/path/`
+    // as its pathname, so no key could match it.
+    test.each([
+      ["host only", "//registry.example.com/", "//registry.example.com/"],
+      ["host with a port and a path", "//registry.example.com:8080/npm/", "//registry.example.com:8080/npm/"],
+      ["key without the trailing slash", "//registry.example.com:8080/npm/", "//registry.example.com:8080/npm"],
+    ])("_authToken is applied: %s", (_, registryUrl, key) => {
+      expect(loadNpmrc(`registry=${registryUrl}\n${key}:_authToken=rel-token\n`)).toEqual({
+        default_registry_url: registryUrl,
+        default_registry_token: "rel-token",
+        default_registry_username: "",
+        default_registry_password: "",
+        default_registry_email: "",
+      });
+    });
+
+    test.each([
+      ["a different port", "//registry.example.com:9090/npm/"],
+      ["a different host", "//other.example.com:8080/npm/"],
+      ["the host without the path", "//registry.example.com:8080/"],
+    ])("a key for %s is not applied", (_, key) => {
+      const result = loadNpmrc(`registry=//registry.example.com:8080/npm/\n${key}:_authToken=rel-token\n`);
+      expect(result.default_registry_url).toBe("//registry.example.com:8080/npm/");
+      expect(result.default_registry_token).toBe("");
+    });
+
+    test.each(["http://", "//"])("credentials embedded in a %sregistry value are split out of the URL", prefix => {
+      expect(loadNpmrc(`registry=${prefix}:embedded-token@registry.example.com/npm/\n`)).toEqual({
+        default_registry_url: "http://registry.example.com/npm/",
+        default_registry_token: "embedded-token",
+        default_registry_username: "",
+        default_registry_password: "",
+        default_registry_email: "",
+      });
+
+      expect(loadNpmrc(`registry=${prefix}embedded-user:embedded-password@registry.example.com/npm/\n`)).toEqual({
+        default_registry_url: "http://registry.example.com/npm/",
+        default_registry_token: "",
+        default_registry_username: "embedded-user",
+        default_registry_password: "embedded-password",
+        default_registry_email: "",
+      });
+    });
+  });
+
+  test.each(["a", "ab"])("a credential key for the host %j is applied to registry=http://<host>/", host => {
+    // The `//a/` key is stripped to `a/` before it is parsed. A second byte of `/` used to
+    // be taken as the start of a protocol-relative URL, leaving the key with an empty host.
+    expect(loadNpmrc(`registry=http://${host}/\n//${host}/:_authToken=${host}-token\n`)).toEqual({
+      default_registry_url: `http://${host}/`,
+      default_registry_token: `${host}-token`,
+      default_registry_username: "",
+      default_registry_password: "",
+      default_registry_email: "",
+    });
+  });
+
   it("does not print an undecodable _password value", async () => {
     const secret = "s!ecret!pass";
     using dir = tempDir("npmrc-password-decode", {
@@ -946,6 +1005,47 @@ describe("--registry override", () => {
   });
 });
 
+describe("protocol-relative registry", () => {
+  test("bun install rejects registry=//host:port/path/ instead of requesting http://localhost/host/", async () => {
+    // The `:port` used to be taken for a `:option=value` suffix of the pathname and the
+    // value rewritten to http://localhost/127.0.0.1/, so the manifest was requested from
+    // a different host on port 80. A scheme-less registry is not usable either way; the
+    // server only exists to show that the host actually named in the value is not hit.
+    let hits = 0;
+    await using named = Bun.serve({
+      port: 0,
+      hostname: "127.0.0.1",
+      fetch() {
+        hits++;
+        return new Response("not found", { status: 404 });
+      },
+    });
+    const registryUrl = `//127.0.0.1:${named.port}/npm/`;
+
+    using dir = tempDir("npmrc-protocol-relative-registry", {
+      ".npmrc": `registry=${registryUrl}\n`,
+      "package.json": JSON.stringify({
+        name: "app",
+        version: "1.0.0",
+        dependencies: { "no-deps": "1.0.0" },
+      }),
+    });
+
+    await using proc = Bun.spawn({
+      cmd: [bunExe(), "install", "--no-cache"],
+      cwd: String(dir),
+      env: { ...env, http_proxy: "", https_proxy: "", HTTP_PROXY: "", HTTPS_PROXY: "" },
+      stdout: "pipe",
+      stderr: "pipe",
+    });
+    const [, stderr, exitCode] = await Promise.all([proc.stdout.text(), proc.stderr.text(), proc.exited]);
+
+    expect(stderr).toContain(`Failed to join registry "${registryUrl}" and package "no-deps" URLs`);
+    expect(hits).toBe(0);
+    expect(exitCode).toBe(1);
+  });
+});
+
 describe.skipIf(!isIPv6())("registry on a bracketed IPv6 host", () => {
   test("sends the token keyed to //[::1]:port/ to the default and the scoped registry", async () => {
     type Req = { path: string; auth: string | null };
diff --git a/test/js/bun/util/filesystem_router.test.ts b/test/js/bun/util/filesystem_router.test.ts
index 9c9821457815..9bee32bb2fe1 100644
--- a/test/js/bun/util/filesystem_router.test.ts
+++ b/test/js/bun/util/filesystem_router.test.ts
@@ -314,6 +314,42 @@ it("assetPrefix, src, and origin", async () => {
   }
 });
 
+it("src keeps a protocol-relative origin and a one-character host", () => {
+  using dir = tempDir("fsr-origin", {
+    "pages/index.tsx": "export default 1;",
+    "pages/posts/[id].tsx": "export default 1;",
+  });
+
+  const srcFor = (origin: string) =>
+    new Bun.FileSystemRouter({
+      dir: path.join(String(dir), "pages"),
+      style: "nextjs",
+      assetPrefix: "/_next/static/",
+      origin,
+    }).match("/posts/hello-world")!.src;
+
+  // `//host` used to parse with an empty host, and so did `a/` (any second byte
+  // of `/` was taken as the start of a protocol-relative URL). Both silently
+  // dropped the origin and the assetPrefix from `src`.
+  expect({
+    "//nextjs.org": srcFor("//nextjs.org"),
+    "//nextjs.org:8080": srcFor("//nextjs.org:8080"),
+    "//nextjs.org/ignored": srcFor("//nextjs.org/ignored"),
+    "a/": srcFor("a/"),
+    "https://nextjs.org/ignored": srcFor("https://nextjs.org/ignored"),
+    "nextjs.org:8080": srcFor("nextjs.org:8080"),
+    "ab/": srcFor("ab/"),
+  }).toEqual({
+    "//nextjs.org": "//nextjs.org/_next/static/posts/[id].tsx",
+    "//nextjs.org:8080": "//nextjs.org:8080/_next/static/posts/[id].tsx",
+    "//nextjs.org/ignored": "//nextjs.org/_next/static/posts/[id].tsx",
+    "a/": "a/_next/static/posts/[id].tsx",
+    "https://nextjs.org/ignored": "https://nextjs.org/_next/static/posts/[id].tsx",
+    "nextjs.org:8080": "nextjs.org:8080/_next/static/posts/[id].tsx",
+    "ab/": "ab/_next/static/posts/[id].tsx",
+  });
+});
+
 it(".query works", () => {
   // set up the test
   const { dir } = make(["posts.tsx"]);

From efff492f5de11fd54266181c26d2a56ea48c2d09 Mon Sep 17 00:00:00 2001
From: robobun <117481402+robobun@users.noreply.github.com>
Date: Mon, 17 Aug 2026 01:06:57 +0000
Subject: [PATCH 047/258] install: say --network-concurrency defaults to 64 in
 help and docs (#38759)

---
 completions/bun-cli.json                      | 22 ++---
 docs/snippets/cli/add.mdx                     |  2 +-
 docs/snippets/cli/install.mdx                 |  2 +-
 docs/snippets/cli/link.mdx                    |  2 +-
 docs/snippets/cli/outdated.mdx                |  4 +-
 docs/snippets/cli/patch.mdx                   |  4 +-
 docs/snippets/cli/publish.mdx                 |  2 +-
 docs/snippets/cli/remove.mdx                  |  4 +-
 docs/snippets/cli/update.mdx                  |  4 +-
 .../PackageManager/CommandLineArguments.rs    | 13 ++-
 test/cli/install/bun-install.test.ts          | 84 ++++++++++++++++++-
 11 files changed, 115 insertions(+), 28 deletions(-)

diff --git a/completions/bun-cli.json b/completions/bun-cli.json
index 5bcf1c989fbd..2a14b1a1ab85 100644
--- a/completions/bun-cli.json
+++ b/completions/bun-cli.json
@@ -427,7 +427,7 @@
         },
         {
           "name": "network-concurrency",
-          "description": "Maximum number of concurrent network requests (default 48)",
+          "description": "Maximum number of concurrent network requests (default 64)",
           "hasValue": true,
           "valueType": "val",
           "required": false,
@@ -748,7 +748,7 @@
         },
         {
           "name": "network-concurrency",
-          "description": "Maximum number of concurrent network requests (default 48)",
+          "description": "Maximum number of concurrent network requests (default 64)",
           "hasValue": true,
           "valueType": "val",
           "required": false,
@@ -1079,7 +1079,7 @@
         },
         {
           "name": "network-concurrency",
-          "description": "Maximum number of concurrent network requests (default 48)",
+          "description": "Maximum number of concurrent network requests (default 64)",
           "hasValue": true,
           "valueType": "val",
           "required": false,
@@ -1351,7 +1351,7 @@
         },
         {
           "name": "network-concurrency",
-          "description": "Maximum number of concurrent network requests (default 48)",
+          "description": "Maximum number of concurrent network requests (default 64)",
           "hasValue": true,
           "valueType": "val",
           "required": false,
@@ -1769,7 +1769,7 @@
         },
         {
           "name": "network-concurrency",
-          "description": "Maximum number of concurrent network requests (default 48)",
+          "description": "Maximum number of concurrent network requests (default 64)",
           "hasValue": true,
           "valueType": "val",
           "required": false,
@@ -2149,7 +2149,7 @@
         },
         {
           "name": "network-concurrency",
-          "description": "Maximum number of concurrent network requests (default 48)",
+          "description": "Maximum number of concurrent network requests (default 64)",
           "hasValue": true,
           "valueType": "val",
           "required": false,
@@ -2432,7 +2432,7 @@
         },
         {
           "name": "network-concurrency",
-          "description": "Maximum number of concurrent network requests (default 48)",
+          "description": "Maximum number of concurrent network requests (default 64)",
           "hasValue": true,
           "valueType": "val",
           "required": false,
@@ -2691,7 +2691,7 @@
         },
         {
           "name": "network-concurrency",
-          "description": "Maximum number of concurrent network requests (default 48)",
+          "description": "Maximum number of concurrent network requests (default 64)",
           "hasValue": true,
           "valueType": "val",
           "required": false,
@@ -2943,7 +2943,7 @@
         },
         {
           "name": "network-concurrency",
-          "description": "Maximum number of concurrent network requests (default 48)",
+          "description": "Maximum number of concurrent network requests (default 64)",
           "hasValue": true,
           "valueType": "val",
           "required": false,
@@ -3248,7 +3248,7 @@
         },
         {
           "name": "network-concurrency",
-          "description": "Maximum number of concurrent network requests (default 48)",
+          "description": "Maximum number of concurrent network requests (default 64)",
           "hasValue": true,
           "valueType": "val",
           "required": false,
@@ -3677,7 +3677,7 @@
         },
         {
           "name": "network-concurrency",
-          "description": "Maximum number of concurrent network requests (default 48)",
+          "description": "Maximum number of concurrent network requests (default 64)",
           "hasValue": true,
           "valueType": "val",
           "required": false,
diff --git a/docs/snippets/cli/add.mdx b/docs/snippets/cli/add.mdx
index 170d397c69e1..5a2e18bc855e 100644
--- a/docs/snippets/cli/add.mdx
+++ b/docs/snippets/cli/add.mdx
@@ -116,7 +116,7 @@ bun add <package> <@version>
   variables
 </ParamField>
 
-<ParamField path="--network-concurrency" type="number" default="48">
+<ParamField path="--network-concurrency" type="number" default="64">
   Maximum number of concurrent network requests
 </ParamField>
 
diff --git a/docs/snippets/cli/install.mdx b/docs/snippets/cli/install.mdx
index c8392f9f27ff..f65e5026082e 100644
--- a/docs/snippets/cli/install.mdx
+++ b/docs/snippets/cli/install.mdx
@@ -157,7 +157,7 @@ bun install <name>@<version>
   Maximum number of concurrent jobs for lifecycle scripts (default: 2x CPU cores)
 </ParamField>
 
-<ParamField path="--network-concurrency" type="number" default="48">
+<ParamField path="--network-concurrency" type="number" default="64">
   Maximum number of concurrent network requests
 </ParamField>
 
diff --git a/docs/snippets/cli/link.mdx b/docs/snippets/cli/link.mdx
index 6e6d84d3bacb..87222e86fd75 100644
--- a/docs/snippets/cli/link.mdx
+++ b/docs/snippets/cli/link.mdx
@@ -93,7 +93,7 @@ bun link <packages>
   variables
 </ParamField>
 
-<ParamField path="--network-concurrency" type="number" default="48">
+<ParamField path="--network-concurrency" type="number" default="64">
   Maximum number of concurrent network requests
 </ParamField>
 
diff --git a/docs/snippets/cli/outdated.mdx b/docs/snippets/cli/outdated.mdx
index 32d5e582ed78..ceb98222f41b 100644
--- a/docs/snippets/cli/outdated.mdx
+++ b/docs/snippets/cli/outdated.mdx
@@ -102,8 +102,8 @@ bun outdated <filter>
   Use a specific registry by default, overriding <code>.npmrc</code>, <code>bunfig.toml</code> and environment variables
 </ParamField>
 
-<ParamField path="--network-concurrency" type="number" default="48">
-  Maximum number of concurrent network requests (default 48)
+<ParamField path="--network-concurrency" type="number" default="64">
+  Maximum number of concurrent network requests (default 64)
 </ParamField>
 
 ### Caching
diff --git a/docs/snippets/cli/patch.mdx b/docs/snippets/cli/patch.mdx
index 01bf9b04d288..71d991157771 100644
--- a/docs/snippets/cli/patch.mdx
+++ b/docs/snippets/cli/patch.mdx
@@ -105,8 +105,8 @@ bun patch <package>@<version>
   variables
 </ParamField>
 
-<ParamField path="--network-concurrency" type="number" default="48">
-  Maximum number of concurrent network requests (default 48)
+<ParamField path="--network-concurrency" type="number" default="64">
+  Maximum number of concurrent network requests (default 64)
 </ParamField>
 
 ### Performance &amp; Resource
diff --git a/docs/snippets/cli/publish.mdx b/docs/snippets/cli/publish.mdx
index 3989732fa75a..7d542b1fd8cc 100644
--- a/docs/snippets/cli/publish.mdx
+++ b/docs/snippets/cli/publish.mdx
@@ -177,7 +177,7 @@ bun publish --cafile ./ca-cert.pem
   `copyfile`
 </ParamField>
 
-<ParamField path="--network-concurrency" type="number" default="48">
+<ParamField path="--network-concurrency" type="number" default="64">
   Maximum concurrent network requests
 </ParamField>
 
diff --git a/docs/snippets/cli/remove.mdx b/docs/snippets/cli/remove.mdx
index d736f537d175..5dac16332867 100644
--- a/docs/snippets/cli/remove.mdx
+++ b/docs/snippets/cli/remove.mdx
@@ -146,6 +146,6 @@ bun remove <package>
   macOS), <code>hardlink</code> (default on Linux and Windows), <code>symlink</code>, <code>copyfile</code>
 </ParamField>
 
-<ParamField path="--network-concurrency" type="number" default="48">
-  Maximum number of concurrent network requests (default 48)
+<ParamField path="--network-concurrency" type="number" default="64">
+  Maximum number of concurrent network requests (default 64)
 </ParamField>
diff --git a/docs/snippets/cli/update.mdx b/docs/snippets/cli/update.mdx
index 913251ada4f8..ae98afaf0b1c 100644
--- a/docs/snippets/cli/update.mdx
+++ b/docs/snippets/cli/update.mdx
@@ -78,8 +78,8 @@ bun up
   Use a specific registry by default, overriding <code>.npmrc</code>, <code>bunfig.toml</code> and environment variables
 </ParamField>
 
-<ParamField path="--network-concurrency" type="number" default="48">
-  Maximum number of concurrent network requests (default 48)
+<ParamField path="--network-concurrency" type="number" default="64">
+  Maximum number of concurrent network requests (default 64)
 </ParamField>
 
 ### Caching
diff --git a/src/install/PackageManager/CommandLineArguments.rs b/src/install/PackageManager/CommandLineArguments.rs
index be895af25bf1..dfd92eb3c21a 100644
--- a/src/install/PackageManager/CommandLineArguments.rs
+++ b/src/install/PackageManager/CommandLineArguments.rs
@@ -50,6 +50,15 @@ const BACKEND_PARAM: ParamType = clap::param!(
     "--backend <STR>                       Platform-specific optimizations for installing dependencies. Possible values: \"hardlink\" (default), \"symlink\", \"copyfile\""
 );
 
+const NETWORK_CONCURRENCY_PARAM: ParamType = clap::param!(
+    "--network-concurrency <NUM>           Maximum number of concurrent network requests (default 64)"
+);
+const _: () = assert!(
+    super::DEFAULT_MAX_SIMULTANEOUS_REQUESTS_FOR_BUN_INSTALL == 64
+        && super::DEFAULT_MAX_SIMULTANEOUS_REQUESTS_FOR_BUN_INSTALL_FOR_PROXIES == 64,
+    "update the default in the --network-concurrency help text (and docs/snippets/cli/*.mdx)"
+);
+
 const SHARED_HEAD_PARAMS: &[ParamType] = &[
     clap::param!("-c, --config <STR>?                   Specify path to config file (bunfig.toml)"),
     clap::param!("-y, --yarn                            Write a yarn.lock file (yarn v1)"),
@@ -103,9 +112,7 @@ const SHARED_TAIL_PARAMS: &[ParamType] = &[
     clap::param!(
         "--concurrent-scripts <NUM>            Maximum number of concurrent jobs for lifecycle scripts (default: 2x CPU cores)"
     ),
-    clap::param!(
-        "--network-concurrency <NUM>           Maximum number of concurrent network requests (default 48)"
-    ),
+    NETWORK_CONCURRENCY_PARAM,
     clap::param!("--save-text-lockfile                  Save a text-based lockfile"),
     clap::param!(
         "--omit <dev|optional|peer>...         Exclude 'dev', 'optional', or 'peer' dependencies from install"
diff --git a/test/cli/install/bun-install.test.ts b/test/cli/install/bun-install.test.ts
index aeb048ae55ac..817c06db84c6 100644
--- a/test/cli/install/bun-install.test.ts
+++ b/test/cli/install/bun-install.test.ts
@@ -69,6 +69,66 @@ async function withContext(
 // Default context options for most tests
 const defaultOpts = { linker: "hoisted" as const };
 
+// BUN_CONFIG_MAX_HTTP_REQUESTS is documented as another way to set the request
+// limit, so it must not leak in from the outer environment while measuring it.
+const networkConcurrencyEnv = { ...env, BUN_CONFIG_MAX_HTTP_REQUESTS: undefined };
+
+// Runs `bun install` with one dependency more than `limit`, against a registry
+// that holds every manifest request open, and asserts that bun has exactly
+// `limit` requests in flight: the extra dependency has to wait for a slot.
+async function expectInstallInFlightLimit(ctx: TestContext, limit: number) {
+  const dependencies: Record<string, string> = {};
+  for (let i = 0; i < limit + 1; i++) dependencies[`dep-${i}`] = "^1";
+  await writeFile(
+    join(ctx.package_dir, "package.json"),
+    JSON.stringify({ name: "foo", version: "0.0.1", dependencies }),
+  );
+
+  let inFlight = 0;
+  let maxInFlight = 0;
+  const limitReached = Promise.withResolvers<void>();
+  const limitExceeded = Promise.withResolvers<void>();
+  const release = Promise.withResolvers<void>();
+  setContextHandler(ctx, async () => {
+    inFlight++;
+    maxInFlight = Math.max(maxInFlight, inFlight);
+    if (inFlight >= limit) limitReached.resolve();
+    if (inFlight > limit) limitExceeded.resolve();
+    await release.promise;
+    inFlight--;
+    return new Response("404", { status: 404 });
+  });
+
+  await using proc = spawn({
+    cmd: [bunExe(), "install"],
+    cwd: ctx.package_dir,
+    stdout: "pipe",
+    stderr: "pipe",
+    stdin: "ignore",
+    env: networkConcurrencyEnv,
+  });
+  try {
+    // A real limit below `limit` parks bun (and this wait) with fewer requests
+    // in flight and no further signal, so the wait is bounded (generously: this
+    // is a debug build under CI load) and the assertions below report what was
+    // reached. proc.exited covers bun giving up early.
+    await Promise.race([limitReached.promise, proc.exited, Bun.sleep(30_000)]);
+    // bun sends everything its limit allows in one burst, so a request beyond
+    // the limit arrives right behind the others. That it never arrives can only
+    // be observed by giving it a moment to show up.
+    await Promise.race([limitExceeded.promise, Bun.sleep(500)]);
+  } finally {
+    release.resolve();
+  }
+  const [stdout, stderr, exitCode] = await Promise.all([proc.stdout.text(), proc.stderr.text(), proc.exited]);
+
+  expect(maxInFlight).toBe(limit);
+  expect(ctx.requested).toBe(limit + 1);
+  expect(stderr).toContain("failed to resolve");
+  expect(stdout).toContain("bun install v1.");
+  expect(exitCode).toBe(1);
+}
+
 const gitEnv = {
   ...bunEnv,
   GIT_AUTHOR_NAME: "bun-test",
@@ -123,6 +183,26 @@ function serveDirectory(root: string) {
 }
 
 describe.concurrent("bun-install", () => {
+  it("bun install --help states the --network-concurrency default that bun install actually uses", async () => {
+    await using help = spawn({
+      cmd: [bunExe(), "install", "--help"],
+      stdout: "pipe",
+      stderr: "pipe",
+      env,
+    });
+    const [helpStdout, helpStderr, helpExitCode] = await Promise.all([
+      help.stdout.text(),
+      help.stderr.text(),
+      help.exited,
+    ]);
+    const helpLine = (helpStdout + helpStderr).split(/\r?\n/).find(line => line.includes("--network-concurrency"));
+    const documentedDefault = /Maximum number of concurrent network requests \(default (\d+)\)$/.exec(helpLine ?? "");
+    expect(documentedDefault).not.toBeNull();
+    expect(helpExitCode).toBe(0);
+
+    await withContext(defaultOpts, ctx => expectInstallInFlightLimit(ctx, Number(documentedDefault![1])));
+  });
+
   for (let input of ["abcdef", "65537", "-1"]) {
     it(`bun install --network-concurrency=${input} fails`, async () => {
       await withContext(defaultOpts, async ctx => {
@@ -140,7 +220,7 @@ describe.concurrent("bun-install", () => {
   }`,
         );
         const { stderr, exited } = spawn({
-          cmd: [bunExe(), "install", "--network-concurrency", "abcdef"],
+          cmd: [bunExe(), "install", "--network-concurrency", input],
           cwd: ctx.package_dir,
           stdout: "inherit",
           stdin: "inherit",
@@ -148,7 +228,7 @@ describe.concurrent("bun-install", () => {
           env,
         });
         const err = await stderr.text();
-        expect(err).toContain("Expected --network-concurrency to be a number between 0 and 65535");
+        expect(err).toContain(`Expected --network-concurrency to be a number between 0 and 65535: ${input}`);
         expect(await exited).toBe(1);
         expect(urls).toBeEmpty();
       });

From 3d96a1dc52e5543bf3100a4313b6e7e1d5e9699f Mon Sep 17 00:00:00 2001
From: robobun <117481402+robobun@users.noreply.github.com>
Date: Mon, 17 Aug 2026 01:07:01 +0000
Subject: [PATCH 048/258] http: report a refused HTTP client thread as an error
 instead of a crash (#38766)

---
 src/errno/lib.rs                              | 42 ++++++++++++++
 src/http/HTTPThread.rs                        | 26 ++++++++-
 .../bun-install-thread-spawn-failure.test.ts  | 57 +++++++++++++++++++
 3 files changed, 124 insertions(+), 1 deletion(-)
 create mode 100644 test/cli/install/bun-install-thread-spawn-failure.test.ts

diff --git a/src/errno/lib.rs b/src/errno/lib.rs
index 09e327f8bf72..ff770d74dd52 100644
--- a/src/errno/lib.rs
+++ b/src/errno/lib.rs
@@ -304,6 +304,22 @@ pub fn from_errno(errno: i32) -> SystemErrno {
     SystemErrno::init(errno as i64).unwrap_or(SystemErrno::EIO)
 }
 
+impl SystemErrno {
+    /// The OS error behind a `std::io::Error`; `None` if it is not an OS error or its code has no `SystemErrno`.
+    pub fn from_io_error(err: &std::io::Error) -> Option<SystemErrno> {
+        let code = err.raw_os_error()?;
+        #[cfg(windows)]
+        {
+            // A Win32 code: the `u32` entry point maps it, `i64` would read it as an errno discriminant.
+            SystemErrno::init(code as u32)
+        }
+        #[cfg(not(windows))]
+        {
+            SystemErrno::init(i64::from(code))
+        }
+    }
+}
+
 #[cfg(not(windows))]
 impl SystemErrno {
     // `i64` covers every concrete call site (errno-range values).
@@ -503,6 +519,32 @@ mod errno_name_tests {
         }
     }
 
+    #[test]
+    fn io_error_to_errno() {
+        // Deliberately not EAGAIN, which is what the callers fall back to.
+        #[cfg(not(windows))]
+        assert_eq!(
+            SystemErrno::from_io_error(&std::io::Error::from_raw_os_error(libc::ENOMEM)),
+            Some(SystemErrno::ENOMEM)
+        );
+        #[cfg(windows)]
+        {
+            // Win32 ERROR_NOT_ENOUGH_MEMORY and ERROR_ACCESS_DENIED; read as errno values, 8 and 5 would be ENOEXEC and EIO.
+            assert_eq!(
+                SystemErrno::from_io_error(&std::io::Error::from_raw_os_error(8)),
+                Some(SystemErrno::ENOMEM)
+            );
+            assert_eq!(
+                SystemErrno::from_io_error(&std::io::Error::from_raw_os_error(5)),
+                Some(SystemErrno::EPERM)
+            );
+        }
+        assert_eq!(
+            SystemErrno::from_io_error(&std::io::Error::other("not from the OS")),
+            None
+        );
+    }
+
     #[test]
     fn coreutils_map() {
         assert_eq!(
diff --git a/src/http/HTTPThread.rs b/src/http/HTTPThread.rs
index 09e3273ccbf4..2c023c1b387b 100644
--- a/src/http/HTTPThread.rs
+++ b/src/http/HTTPThread.rs
@@ -5,6 +5,7 @@ use std::time::Instant;
 
 use bun_collections::ArrayHashMap;
 use bun_core::{self, Output};
+use bun_errno::SystemErrno;
 
 use bun_threading::{Mutex, UnboundedQueue};
 use bun_uws as uws;
@@ -1285,10 +1286,33 @@ mod _event_loop_draft {
             Ok(t) => {
                 let _ = HTTP_THREAD_HANDLE.set(t);
             }
-            Err(err) => Output::panic(format_args!("Failed to start HTTP Client thread: {}", err)),
+            Err(err) => exit_spawn_failed(&err),
         }
     }
 
+    /// Nothing that needs the HTTP thread can go on without it, but a refused
+    /// `pthread_create`/`CreateThread` (`RLIMIT_NPROC`, a container pids limit,
+    /// no memory) is the environment's limit, not a bug: report it like any
+    /// other fatal CLI error rather than through the crash reporter.
+    #[cold]
+    #[inline(never)]
+    fn exit_spawn_failed(err: &std::io::Error) -> ! {
+        match SystemErrno::from_io_error(err) {
+            Some(errno) => {
+                bun_core::err_generic!("Failed to start HTTP Client thread: {}", errno);
+                if errno == SystemErrno::EAGAIN {
+                    bun_core::note!(
+                        "The process or thread limit may have been reached (ulimit -u, or the container's pids limit); raise it or reduce concurrency"
+                    );
+                }
+            }
+            // No errno name for this OS code (most Windows thread-creation
+            // failures): show the OS's own description instead of guessing one.
+            None => bun_core::err_generic!("Failed to start HTTP Client thread: {}", err),
+        }
+        bun_core::Global::crash()
+    }
+
     fn on_start(opts: InitOpts) {
         Output::Source::configure_named_thread(bun_core::zstr!("HTTP Client"));
 
diff --git a/test/cli/install/bun-install-thread-spawn-failure.test.ts b/test/cli/install/bun-install-thread-spawn-failure.test.ts
new file mode 100644
index 000000000000..907cfa20ca70
--- /dev/null
+++ b/test/cli/install/bun-install-thread-spawn-failure.test.ts
@@ -0,0 +1,57 @@
+// `bun install` starts the HTTP client thread unconditionally. When the OS
+// refuses the thread (EAGAIN under a tight `ulimit -u` / RLIMIT_NPROC or a
+// container pids limit) that is the environment's limit, not a bug in bun, so
+// it must be reported as a plain error with exit code 1 instead of going
+// through the crash reporter ("oh no: Bun has crashed", bun.report link).
+import { describe, expect, test } from "bun:test";
+import { bunEnv, bunExe, compileFixture, isLinux, isMusl, tempDir } from "harness";
+import { join } from "node:path";
+
+const cc = Bun.which("cc") || Bun.which("gcc") || Bun.which("clang");
+
+// Models a process sitting at its thread limit: every further pthread_create
+// fails with `code`, the way pthread_create reports errors (a returned errno).
+const shimC = (code: string) => /* c */ `
+#include <errno.h>
+#include <pthread.h>
+
+int pthread_create(pthread_t *thread, const pthread_attr_t *attr, void *(*start)(void *), void *arg) {
+  (void)thread; (void)attr; (void)start; (void)arg;
+  return ${code};
+}
+`;
+
+// bun-musl is statically linked, so LD_PRELOAD cannot intercept pthread_create.
+describe.skipIf(!isLinux || isMusl || !cc)("bun install when the HTTP client thread cannot be started", () => {
+  test.concurrent.each([
+    // [pthread_create result, how it is reported, whether the thread-limit hint applies]
+    ["EAGAIN", "EAGAIN", true],
+    ["EPERM", "EPERM", false],
+    // A code bun has no errno name for is reported with the OS's own description.
+    ["9999", "Unknown error 9999 (os error 9999)", false],
+  ])("pthread_create returning %s exits 1 with an error naming %s", async (code, reported, hintApplies) => {
+    using dir = tempDir(`install-thread-spawn-${code}`, {
+      "shim.c": shimC(code),
+      "package.json": JSON.stringify({ name: "thread-spawn-failure", dependencies: {} }),
+    });
+    const shim = compileFixture(join(String(dir), "shim.c"));
+
+    await using proc = Bun.spawn({
+      cmd: [bunExe(), "install"],
+      cwd: String(dir),
+      env: {
+        ...bunEnv,
+        BUN_INSTALL_CACHE_DIR: join(String(dir), "cache"),
+        LD_PRELOAD: [shim, bunEnv.LD_PRELOAD].filter(Boolean).join(":"),
+      },
+      stdout: "pipe",
+      stderr: "pipe",
+    });
+    const [stderr, , exitCode] = await Promise.all([proc.stderr.text(), proc.stdout.text(), proc.exited]);
+
+    expect(stderr).toContain(`Failed to start HTTP Client thread: ${reported}`);
+    expect(stderr.includes("ulimit -u")).toBe(hintApplies);
+    expect(stderr).not.toContain("Bun has crashed");
+    expect(exitCode).toBe(1);
+  });
+});

From 878f8c21c8c9b8f9ca1d1519cffdb09c405f2a18 Mon Sep 17 00:00:00 2001
From: robobun <117481402+robobun@users.noreply.github.com>
Date: Mon, 17 Aug 2026 01:07:05 +0000
Subject: [PATCH 049/258] bun why: print a package's dependents once, mark
 repeats as *deduped (#37922)

---
 docs/pm/cli/why.mdx                 |  18 +++
 src/runtime/cli/why_command.rs      |  89 +++++++++++--
 test/cli/install/bun-pm-why.test.ts | 196 +++++++++++++++++++++++++++-
 3 files changed, 288 insertions(+), 15 deletions(-)

diff --git a/docs/pm/cli/why.mdx b/docs/pm/cli/why.mdx
index 2091605c8c99..6db73b4723f4 100644
--- a/docs/pm/cli/why.mdx
+++ b/docs/pm/cli/why.mdx
@@ -82,3 +82,21 @@ The output shows:
 - The version requirement specified in each package's dependencies
 
 For nested dependencies, the command shows the complete dependency tree by default, with indentation indicating the relationship hierarchy.
+
+A package can appear in the tree more than once when several chains go through it. Once its dependents have been listed (and take up more than one line), later occurrences are marked `*deduped` instead of listing them again. The exception is `--depth`: if the listing was cut off by the depth limit and the package appears again closer to the queried package, where more levels fit, it is listed again. A dependency cycle is marked `*circular`.
+
+```bash terminal icon="terminal"
+bun why pkg-x
+```
+
+```txt
+pkg-x@workspace:packages/pkg-x
+  ├─ monorepo
+  ├─ pkg-a@workspace (requires workspace:*)
+  │  └─ pkg-c@workspace (requires workspace:*)
+  │     └─ pkg-d@workspace (requires workspace:*)
+  │        └─ pkg-f@workspace (requires workspace:*)
+  │
+  └─ pkg-c@workspace (requires workspace:*)
+     └─ *deduped
+```
diff --git a/src/runtime/cli/why_command.rs b/src/runtime/cli/why_command.rs
index 095c8e8db2ce..a4ba088cf79b 100644
--- a/src/runtime/cli/why_command.rs
+++ b/src/runtime/cli/why_command.rs
@@ -486,7 +486,6 @@ impl WhyCommand {
                 } else if MAX_DEPTH.load(AtomicOrdering::Relaxed) == 0 {
                     bun_core::prettyln!("<d>  └─ (deeper dependencies hidden)<r>");
                 } else {
-                    let _ctx_data = TreeContext::init(&all_dependents);
                     // Clone the slice so it can be sorted while `ctx_data`
                     // still borrows `all_dependents`.
                     let mut sorted: Vec<DependentInfo> = dependents.clone();
@@ -515,8 +514,6 @@ impl WhyCommand {
                             );
                         }
                     }
-
-                    ctx_data.clear_path_tracker();
                 }
             } else {
                 bun_core::prettyln!("<d>  └─ No dependents found<r>");
@@ -565,7 +562,24 @@ fn print_package_with_type(prefix: &[u8], package: &DependentInfo) {
 
 pub(crate) struct TreeContext<'a> {
     all_dependents: &'a HashMap<PackageID, Vec<DependentInfo>>,
-    path_tracker: HashMap<PackageID, usize>,
+    /// Packages being expanded right now; the value records whether a `*circular` pointed at it.
+    path_tracker: HashMap<PackageID, bool>,
+    /// Subtrees already printed; repeats print `*deduped` (there are exponentially many paths).
+    expanded: HashMap<PackageID, Expanded>,
+}
+
+#[derive(Clone, Copy)]
+struct Expanded {
+    depth: usize,
+    cutoff: usize,
+}
+
+/// What `print_dependency_tree` printed below a package line.
+#[derive(Clone, Copy)]
+struct Printed {
+    lines: usize,
+    /// Repeating the package at a depth below this shows more: a branch ran into `MAX_DEPTH`.
+    cutoff: usize,
 }
 
 impl<'a> TreeContext<'a> {
@@ -573,11 +587,14 @@ impl<'a> TreeContext<'a> {
         TreeContext {
             all_dependents,
             path_tracker: HashMap::default(),
+            expanded: HashMap::default(),
         }
     }
 
-    fn clear_path_tracker(&mut self) {
-        self.path_tracker.clear();
+    /// The earlier expansion of `pkg_id`, unless repeating it at `depth` would show more.
+    fn already_expanded(&self, pkg_id: PackageID, depth: usize) -> Option<Expanded> {
+        let previous = *self.expanded.get(&pkg_id)?;
+        (depth >= previous.cutoff).then_some(previous)
     }
 }
 
@@ -588,16 +605,33 @@ fn print_dependency_tree(
     depth: usize,
     printed_break_line: bool,
     parent_is_workspace: bool,
-) {
-    if ctx.path_tracker.get(&current_pkg_id).is_some() {
+) -> Printed {
+    if let Some(pointed_at_by_cycle) = ctx.path_tracker.get_mut(&current_pkg_id) {
+        *pointed_at_by_cycle = true;
         bun_core::prettyln!("<d>{}└─ <yellow>*circular<r>", BStr::new(prefix));
-        return;
+        return Printed {
+            lines: 1,
+            cutoff: 0,
+        };
+    }
+
+    if let Some(previous) = ctx.already_expanded(current_pkg_id, depth) {
+        bun_core::prettyln!("<d>{}└─ *deduped<r>", BStr::new(prefix));
+        return Printed {
+            lines: 1,
+            cutoff: previous.cutoff,
+        };
     }
 
-    ctx.path_tracker.insert(current_pkg_id, depth);
+    ctx.path_tracker.insert(current_pkg_id, false);
     // All post-insert exit paths below remove explicitly. Error paths are gone
     // (alloc failures abort under global mimalloc).
 
+    let mut printed = Printed {
+        lines: 0,
+        cutoff: 0,
+    };
+
     if let Some(dependents) = ctx.all_dependents.get(&current_pkg_id) {
         let mut sorted_dependents: Vec<DependentInfo> = dependents.clone();
         sorted_dependents.sort_by(cmp_dependents);
@@ -610,8 +644,9 @@ fn print_dependency_tree(
 
             if depth >= MAX_DEPTH.load(AtomicOrdering::Relaxed) {
                 bun_core::prettyln!("<d>{}└─ (deeper dependencies hidden)<r>", BStr::new(prefix));
-                ctx.path_tracker.remove(&current_pkg_id);
-                return;
+                printed.lines += 1;
+                printed.cutoff = depth;
+                break;
             }
 
             let is_dep_last = dep_idx == len - 1;
@@ -625,6 +660,7 @@ fn print_dependency_tree(
             full_prefix.extend_from_slice(prefix);
             full_prefix.extend_from_slice(prefix_char);
             print_package_with_type(&full_prefix, dep);
+            printed.lines += 1;
 
             let next_suffix: &[u8] = if is_dep_last {
                 b"   "
@@ -636,7 +672,7 @@ fn print_dependency_tree(
             next_prefix.extend_from_slice(next_suffix);
 
             let print_break_line = is_dep_last && len > 1 && !printed_break_line;
-            print_dependency_tree(
+            let subtree = print_dependency_tree(
                 ctx,
                 dep.pkg_id,
                 &next_prefix,
@@ -644,6 +680,9 @@ fn print_dependency_tree(
                 printed_break_line || print_break_line,
                 dep.workspace,
             );
+            printed.lines += subtree.lines;
+            // A dependent repeats one level deeper than this package does.
+            printed.cutoff = printed.cutoff.max(subtree.cutoff.saturating_sub(1));
 
             if print_break_line {
                 bun_core::prettyln!("<d>{}<r>", BStr::new(prefix));
@@ -651,5 +690,27 @@ fn print_dependency_tree(
         }
     }
 
-    ctx.path_tracker.remove(&current_pkg_id);
+    let pointed_at_by_cycle = ctx.path_tracker.remove(&current_pkg_id) == Some(true);
+
+    if pointed_at_by_cycle && printed.cutoff > 0 {
+        // Their `*circular` stood in for this cut-off subtree; a repeat reaches it one level down.
+        for record in ctx.expanded.values_mut() {
+            if record.depth > depth {
+                record.cutoff = record.cutoff.max(printed.cutoff - 1);
+            }
+        }
+    }
+
+    // A one-line subtree is no longer than the `*deduped` marker, so it is repeated instead.
+    if printed.lines > 1 {
+        ctx.expanded.insert(
+            current_pkg_id,
+            Expanded {
+                depth,
+                cutoff: printed.cutoff,
+            },
+        );
+    }
+
+    printed
 }
diff --git a/test/cli/install/bun-pm-why.test.ts b/test/cli/install/bun-pm-why.test.ts
index aa147f047daf..ff47bc4ac411 100644
--- a/test/cli/install/bun-pm-why.test.ts
+++ b/test/cli/install/bun-pm-why.test.ts
@@ -1,6 +1,6 @@
 import { spawn } from "bun";
 import { afterAll, beforeAll, describe, expect, it } from "bun:test";
-import { bunEnv, bunExe, tempDir, tempDirWithFiles } from "harness";
+import { bunEnv, bunExe, normalizeBunSnapshot, tempDir, tempDirWithFiles } from "harness";
 import { existsSync, mkdtempSync, realpathSync } from "node:fs";
 import { mkdir, rm } from "node:fs/promises";
 import { tmpdir } from "node:os";
@@ -579,4 +579,198 @@ describe.concurrent.each(["why", "pm why"])("bun %s", cmd => {
 
     expect(outputDepth2).toContain("mime-db@");
   });
+
+  describe("packages reachable through more than one path", () => {
+    // Workspace packages that only depend on each other, so `bun install` never
+    // contacts a registry. The root sorts before the `pkg-*`/`w*` names.
+    function workspaceFixture(name: string, dependencies: Record<string, string[]>) {
+      const files: Record<string, string> = {
+        "package.json": JSON.stringify({ name: "monorepo", private: true, workspaces: ["p/*"] }),
+      };
+      for (const [pkg, deps] of Object.entries(dependencies)) {
+        files[`p/${pkg}/package.json`] = JSON.stringify({
+          name: pkg,
+          version: "1.0.0",
+          dependencies: Object.fromEntries(deps.map(dep => [dep, "workspace:*"])),
+        });
+      }
+      return tempDir(name, files);
+    }
+
+    async function installAndWhy(cwd: string, args: string[]) {
+      await using install = spawn({
+        cmd: [bunExe(), "install", "--lockfile-only"],
+        cwd,
+        env: bunEnv,
+        stdout: "pipe",
+        stderr: "pipe",
+      });
+      const [, installStderr, installExitCode] = await Promise.all([
+        install.stdout.text(),
+        install.stderr.text(),
+        install.exited,
+      ]);
+      expect(installStderr).toContain("Saved lockfile");
+      expect(installExitCode).toBe(0);
+
+      await using why = spawn({
+        cmd: [bunExe(), ...cmd.split(" "), ...args],
+        cwd,
+        env: bunEnv,
+        stdout: "pipe",
+        stderr: "pipe",
+      });
+      const [stdout, stderr, exitCode] = await Promise.all([why.stdout.text(), why.stderr.text(), why.exited]);
+      return {
+        // The tree prints spacer lines that are only a trailing prefix.
+        stdout: normalizeBunSnapshot(stdout)
+          .split("\n")
+          .map(line => line.trimEnd())
+          .join("\n"),
+        stderr,
+        exitCode,
+      };
+    }
+
+    // pkg-c is listed under pkg-x twice: it depends on pkg-x directly and on
+    // pkg-a, which depends on pkg-x.
+    const diamond = {
+      "pkg-x": [],
+      "pkg-a": ["pkg-x"],
+      "pkg-c": ["pkg-x", "pkg-a"],
+      "pkg-d": ["pkg-c"],
+      "pkg-f": ["pkg-d"],
+    };
+
+    it("prints the dependents of a package once and marks later occurrences as deduped", async () => {
+      using dir = workspaceFixture("why-deduped", diamond);
+
+      const { stdout, stderr, exitCode } = await installAndWhy(String(dir), ["pkg-x"]);
+      expect(stdout).toMatchInlineSnapshot(`
+        "pkg-x@workspace:p/pkg-x
+          ├─ monorepo
+          ├─ pkg-a@workspace (requires workspace:*)
+          │  └─ pkg-c@workspace (requires workspace:*)
+          │     └─ pkg-d@workspace (requires workspace:*)
+          │        └─ pkg-f@workspace (requires workspace:*)
+          │
+          └─ pkg-c@workspace (requires workspace:*)
+             └─ *deduped"
+      `);
+      expect({ stderr, exitCode }).toEqual({ stderr: "", exitCode: 0 });
+    });
+
+    it("expands a deduped package again when --depth cut it off at a deeper occurrence", async () => {
+      using dir = workspaceFixture("why-deduped-depth", diamond);
+
+      const { stdout, stderr, exitCode } = await installAndWhy(String(dir), ["pkg-x", "--depth", "3"]);
+      expect(stdout).toMatchInlineSnapshot(`
+        "pkg-x@workspace:p/pkg-x
+          ├─ monorepo
+          ├─ pkg-a@workspace (requires workspace:*)
+          │  └─ pkg-c@workspace (requires workspace:*)
+          │     └─ pkg-d@workspace (requires workspace:*)
+          │        └─ (deeper dependencies hidden)
+          │
+          └─ pkg-c@workspace (requires workspace:*)
+             └─ pkg-d@workspace (requires workspace:*)
+                └─ pkg-f@workspace (requires workspace:*)"
+      `);
+      expect({ stderr, exitCode }).toEqual({ stderr: "", exitCode: 0 });
+    });
+
+    // pkg-a and pkg-p depend on each other. Walking up from pkg-x, the cycle is
+    // first reached through pkg-l1 -> pkg-l2 -> pkg-a, where pkg-p's only
+    // dependent (pkg-a) is cut off as circular, and again through pkg-p itself,
+    // three levels closer to pkg-x.
+    const cycle = {
+      "pkg-x": [],
+      "pkg-l1": ["pkg-x"],
+      "pkg-l2": ["pkg-l1"],
+      "pkg-a": ["pkg-l2", "pkg-p"],
+      "pkg-p": ["pkg-a", "pkg-x"],
+      "pkg-q1": ["pkg-a"],
+      "pkg-q2": ["pkg-q1"],
+      "pkg-q3": ["pkg-q2"],
+    };
+
+    it("does not dedupe a package whose circular branch hides what --depth would show closer to the root", async () => {
+      using dir = workspaceFixture("why-deduped-cycle-depth", cycle);
+
+      // pkg-q3 only fits within the depth limit under the shorter chain.
+      const { stdout, stderr, exitCode } = await installAndWhy(String(dir), ["pkg-x", "--depth", "5"]);
+      expect(stdout).toMatchInlineSnapshot(`
+        "pkg-x@workspace:p/pkg-x
+          ├─ monorepo
+          ├─ pkg-l1@workspace (requires workspace:*)
+          │  └─ pkg-l2@workspace (requires workspace:*)
+          │     └─ pkg-a@workspace (requires workspace:*)
+          │        ├─ pkg-p@workspace (requires workspace:*)
+          │        │  └─ pkg-a@workspace (requires workspace:*)
+          │        │     └─ *circular
+          │        └─ pkg-q1@workspace (requires workspace:*)
+          │           └─ pkg-q2@workspace (requires workspace:*)
+          │              └─ (deeper dependencies hidden)
+          │
+          └─ pkg-p@workspace (requires workspace:*)
+             └─ pkg-a@workspace (requires workspace:*)
+                ├─ pkg-p@workspace (requires workspace:*)
+                │  └─ *circular
+                └─ pkg-q1@workspace (requires workspace:*)
+                   └─ pkg-q2@workspace (requires workspace:*)
+                      └─ pkg-q3@workspace (requires workspace:*)"
+      `);
+      expect({ stderr, exitCode }).toEqual({ stderr: "", exitCode: 0 });
+    });
+
+    it("dedupes a package inside a cycle once its dependents were printed in full", async () => {
+      using dir = workspaceFixture("why-deduped-cycle", cycle);
+
+      const { stdout, stderr, exitCode } = await installAndWhy(String(dir), ["pkg-x"]);
+      expect(stdout).toMatchInlineSnapshot(`
+        "pkg-x@workspace:p/pkg-x
+          ├─ monorepo
+          ├─ pkg-l1@workspace (requires workspace:*)
+          │  └─ pkg-l2@workspace (requires workspace:*)
+          │     └─ pkg-a@workspace (requires workspace:*)
+          │        ├─ pkg-p@workspace (requires workspace:*)
+          │        │  └─ pkg-a@workspace (requires workspace:*)
+          │        │     └─ *circular
+          │        └─ pkg-q1@workspace (requires workspace:*)
+          │           └─ pkg-q2@workspace (requires workspace:*)
+          │              └─ pkg-q3@workspace (requires workspace:*)
+          │
+          └─ pkg-p@workspace (requires workspace:*)
+             └─ *deduped"
+      `);
+      expect({ stderr, exitCode }).toEqual({ stderr: "", exitCode: 0 });
+    });
+
+    it("keeps the output linear when every package depends on the next two", async () => {
+      // w00 depends on w01 and w02, w01 on w02 and w03, and so on, so the
+      // number of dependency paths between w15 and any one package grows like
+      // the Fibonacci sequence.
+      const count = 16;
+      const name = (i: number) => `w${String(i).padStart(2, "0")}`;
+      const ladder: Record<string, string[]> = {};
+      for (let i = 0; i < count; i++) {
+        ladder[name(i)] = [i + 1, i + 2].filter(j => j < count).map(name);
+      }
+      using dir = workspaceFixture("why-ladder", ladder);
+
+      const { stdout, stderr, exitCode } = await installAndWhy(String(dir), [name(count - 1)]);
+      const lines = stdout.split("\n");
+      expect({
+        // w08 depends on w09 and w10, so it is listed under each of them, and
+        // each of those is expanded exactly once.
+        w08: lines.filter(line => line.includes("w08@workspace")).length,
+        // One marker each for w02 through w13. w00 and w01 have at most one line
+        // below them, so they are repeated instead, and w14 is only listed once
+        // because it only depends on w15.
+        deduped: lines.filter(line => line.endsWith("*deduped")).length,
+        stderr,
+        exitCode,
+      }).toEqual({ w08: 2, deduped: count - 4, stderr: "", exitCode: 0 });
+    });
+  });
 });

From 1ed855041963882ee2406987ab30b21a23efa03b Mon Sep 17 00:00:00 2001
From: robobun <117481402+robobun@users.noreply.github.com>
Date: Mon, 17 Aug 2026 01:07:09 +0000
Subject: [PATCH 050/258] pm pkg: support arrays in set and delete (#38025)

---
 docs/pm/cli/pm.mdx                  |   2 +
 src/runtime/cli/pm_pkg_command.rs   | 419 ++++++++++++++--------------
 src/runtime/error.rs                |   3 -
 test/cli/install/bun-pm-pkg.test.ts | 222 +++++++++++++--
 4 files changed, 410 insertions(+), 236 deletions(-)

diff --git a/docs/pm/cli/pm.mdx b/docs/pm/cli/pm.mdx
index f937d84b6b07..5b6ba556d06a 100644
--- a/docs/pm/cli/pm.mdx
+++ b/docs/pm/cli/pm.mdx
@@ -379,6 +379,8 @@ bun pm pkg get scripts.build                      # nested property
 bun pm pkg set name="my-package"                  # simple property
 bun pm pkg set scripts.test="jest" version=2.0.0  # multiple properties
 bun pm pkg set private=true --json                # JSON values with --json flag
+bun pm pkg set 'keywords[]=cli'                   # append to an array (created if missing)
+bun pm pkg set 'contributors[0].name=Jane'        # update an array element
 
 # delete
 bun pm pkg delete description                     # single property
diff --git a/src/runtime/cli/pm_pkg_command.rs b/src/runtime/cli/pm_pkg_command.rs
index 556f5cfd0d0c..2ad62ff0123b 100644
--- a/src/runtime/cli/pm_pkg_command.rs
+++ b/src/runtime/cli/pm_pkg_command.rs
@@ -5,6 +5,7 @@ use crate::cli::command::Context;
 use bun_ast::{E, Expr, ExprData, G};
 use bun_ast::{Loc, Log, Source};
 use bun_collections::{StringArrayHashMap, VecExt};
+use bun_core::fmt::quote;
 use bun_core::strings;
 use bun_core::{Global, Output};
 use bun_install::PackageManager;
@@ -48,6 +49,40 @@ struct PackageJson {
     indentation: bun_ast::Indentation,
 }
 
+/// One step of a key path such as `contributors[0].name` or `keywords[]`.
+#[derive(Clone, Copy)]
+struct Segment<'a> {
+    kind: SegmentKind<'a>,
+    /// Offset just past this segment in the key; errors name a value by `&key[..end]`.
+    end: usize,
+}
+
+#[derive(Clone, Copy)]
+enum SegmentKind<'a> {
+    /// `b` in `a.b` or `a[b]`: an index when applied to an array, otherwise a property name.
+    Key { name: &'a [u8], bracketed: bool },
+    /// `[]`: the slot after the last element of an array.
+    Append,
+}
+
+impl Segment<'_> {
+    /// `files[0]=x` and `files[]=x` create an array; `config.0=x` creates an object keyed `"0"`.
+    fn creates_array(self) -> bool {
+        match self.kind {
+            SegmentKind::Key {
+                name,
+                bracketed: true,
+            } => array_index(name).is_some(),
+            SegmentKind::Key { .. } => false,
+            SegmentKind::Append => true,
+        }
+    }
+}
+
+fn array_index(name: &[u8]) -> Option<usize> {
+    bun_core::fmt::parse_decimal::<usize>(name)
+}
+
 impl PmPkgCommand {
     pub(crate) fn exec(
         ctx: &Context,
@@ -106,7 +141,9 @@ impl PmPkgCommand {
   <d>$<r> <b><green>bun pm pkg<r> <cyan>set<r> <blue>config='{"port":3000,"debug":true}'<r> <cyan>--json<r>
   <d>$<r> <b><green>bun pm pkg<r> <cyan>set<r> <blue>scripts.test="bun test"<r>
   <d>$<r> <b><green>bun pm pkg<r> <cyan>set<r> <blue>bin.mycli=cli.js<r>
+  <d>$<r> <b><green>bun pm pkg<r> <cyan>set<r> <blue>'keywords[]=cli' 'files[0]=dist'<r>
   <d>$<r> <b><green>bun pm pkg<r> <cyan>delete<r> <blue>scripts.test devDependencies.webpack<r>
+  <d>$<r> <b><green>bun pm pkg<r> <cyan>delete<r> <blue>'keywords[0]'<r>
   <d>$<r> <b><green>bun pm pkg<r> <cyan>fix<r>
 
 <b>More info<r>: <magenta>https://bun.com/docs/cli/pm#pkg<r>
@@ -490,128 +527,66 @@ impl PmPkgCommand {
     }
 
     fn resolve_path(root: Expr, key: &[u8]) -> Result<Expr, Error> {
-        if !matches!(root.data, ExprData::EObject(_)) {
-            return Err(crate::Error::NotFound);
-        }
-
-        let mut parts = strings::tokenize(key, b".");
         let mut current = root;
-
-        while let Some(part) = parts.next() {
-            if let Some(first_bracket) = strings::index_of(part, b"[") {
-                let mut remaining_part = part;
-
-                if first_bracket > 0 {
-                    let prop_name = &part[..first_bracket];
-                    if !matches!(current.data, ExprData::EObject(_)) {
-                        return Err(crate::Error::NotFound);
-                    }
-                    current = current.get(prop_name).ok_or(crate::Error::NotFound)?;
-                    remaining_part = &part[first_bracket..];
-                }
-
-                while let Some(bracket_start) = strings::index_of(remaining_part, b"[") {
-                    let bracket_end = strings::index_of(&remaining_part[bracket_start..], b"]")
-                        .ok_or(crate::Error::InvalidPath)?;
-                    let actual_bracket_end = bracket_start + bracket_end;
-                    let index_str = &remaining_part[bracket_start + 1..actual_bracket_end];
-
-                    if index_str.is_empty() {
-                        return Err(crate::Error::InvalidPath);
-                    }
-
-                    if let Some(index) = bun_core::fmt::parse_decimal::<usize>(index_str) {
-                        let ExprData::EArray(arr) = &current.data else {
-                            return Err(crate::Error::NotFound);
-                        };
-
-                        if index >= arr.items.len_u32() as usize {
-                            return Err(crate::Error::NotFound);
-                        }
-
-                        current = arr.items.slice()[index];
-                    } else {
-                        if !matches!(current.data, ExprData::EObject(_)) {
-                            return Err(crate::Error::NotFound);
-                        }
-                        current = current.get(index_str).ok_or(crate::Error::NotFound)?;
-                    }
-
-                    remaining_part = &remaining_part[actual_bracket_end + 1..];
-                    if remaining_part.is_empty() {
-                        break;
-                    }
-                }
-            } else {
-                if let Some(index) = bun_core::fmt::parse_decimal::<usize>(part) {
-                    match &current.data {
-                        ExprData::EArray(arr) => {
-                            if index >= arr.items.len_u32() as usize {
-                                return Err(crate::Error::NotFound);
-                            }
-                            current = arr.items.slice()[index];
-                        }
-                        ExprData::EObject(_) => {
-                            current = current.get(part).ok_or(crate::Error::NotFound)?;
-                        }
-                        _ => return Err(crate::Error::NotFound),
-                    }
-                } else {
-                    if !matches!(current.data, ExprData::EObject(_)) {
-                        return Err(crate::Error::NotFound);
-                    }
-                    current = current.get(part).ok_or(crate::Error::NotFound)?;
-                }
-            }
+        for segment in Self::parse_key_path(key)? {
+            let SegmentKind::Key { name, .. } = segment.kind else {
+                return Err(crate::Error::InvalidPath);
+            };
+            current = match &current.data {
+                ExprData::EArray(array) => array_index(name)
+                    .and_then(|index| array.items.slice().get(index).copied())
+                    .ok_or(crate::Error::NotFound)?,
+                ExprData::EObject(_) => current.get(name).ok_or(crate::Error::NotFound)?,
+                _ => return Err(crate::Error::NotFound),
+            };
         }
-
         Ok(current)
     }
 
-    /// Splits `a.b[0][c]` into `["a", "b", "0", "c"]`. Segments are sub-slices
-    /// of `key`: `E::Object::put` stores keys by reference (no copy into the
-    /// AST arena), so they must outlive the `Expr` tree, which `key` (an argv
-    /// slice) does. Returning owned buffers here would leave dangling keys.
-    fn parse_key_path(key: &[u8]) -> Result<Vec<&[u8]>, Error> {
-        let mut path_parts: Vec<&[u8]> = Vec::new();
-
-        let mut parts = strings::tokenize(key, b".");
-
-        while let Some(part) = parts.next() {
-            if let Some(first_bracket) = strings::index_of(part, b"[") {
-                let mut remaining_part = part;
-
-                if first_bracket > 0 {
-                    path_parts.push(&part[..first_bracket]);
-                    remaining_part = &part[first_bracket..];
-                }
-
-                while let Some(bracket_start) = strings::index_of(remaining_part, b"[") {
-                    let Some(bracket_end) =
-                        strings::index_of(&remaining_part[bracket_start..], b"]")
-                    else {
-                        return Err(crate::Error::InvalidPath);
-                    };
-                    let actual_bracket_end = bracket_start + bracket_end;
-                    let index_str = &remaining_part[bracket_start + 1..actual_bracket_end];
-
-                    if index_str.is_empty() {
-                        return Err(crate::Error::InvalidPath);
-                    }
-
-                    path_parts.push(index_str);
+    /// Names are sub-slices of `key`; `E::Object::put` stores them by reference (#33186).
+    fn parse_key_path(key: &[u8]) -> Result<Vec<Segment<'_>>, Error> {
+        let mut segments: Vec<Segment<'_>> = Vec::new();
+
+        let mut part_start = 0;
+        for part in strings::split(key, b".") {
+            let start = part_start;
+            part_start += part.len() + b".".len();
+
+            let name_len = strings::index_of(part, b"[").unwrap_or(part.len());
+            if name_len > 0 {
+                segments.push(Segment {
+                    kind: SegmentKind::Key {
+                        name: &part[..name_len],
+                        bracketed: false,
+                    },
+                    end: start + name_len,
+                });
+            }
 
-                    remaining_part = &remaining_part[actual_bracket_end + 1..];
-                    if remaining_part.is_empty() {
-                        break;
-                    }
-                }
-            } else {
-                path_parts.push(part);
+            let mut cursor = name_len;
+            while let Some(open) = strings::index_of(&part[cursor..], b"[") {
+                let open = cursor + open;
+                let Some(close) = strings::index_of(&part[open..], b"]") else {
+                    return Err(crate::Error::InvalidPath);
+                };
+                let close = open + close;
+                let name = &part[open + 1..close];
+                segments.push(Segment {
+                    kind: if name.is_empty() {
+                        SegmentKind::Append
+                    } else {
+                        SegmentKind::Key {
+                            name,
+                            bracketed: true,
+                        }
+                    },
+                    end: start + close + 1,
+                });
+                cursor = close + 1;
             }
         }
 
-        Ok(path_parts)
+        Ok(segments)
     }
 
     fn set_value(root: &mut Expr, key: &[u8], value: &[u8], parse_json: bool) -> Result<(), Error> {
@@ -619,70 +594,105 @@ impl PmPkgCommand {
             return Err(crate::Error::InvalidRoot);
         }
 
-        let path_parts = Self::parse_key_path(key)?;
-
-        if path_parts.is_empty() {
+        let path = Self::parse_key_path(key)?;
+        if path.is_empty() {
             return Err(crate::Error::EmptyKey);
         }
 
-        if path_parts.len() == 1 {
-            let expr = Self::parse_value(value, parse_json)?;
-
-            root.data
-                .e_object_mut()
-                .unwrap()
-                .put(dummy_bump(), path_parts[0], expr)?;
-
-            return Ok(());
-        }
-
-        Self::set_nested(root, &path_parts, value, parse_json)
+        let expr = Self::parse_value(value, parse_json)?;
+        Self::set_in_container(root, b"package.json", key, &path, expr)
     }
 
-    fn set_nested(
-        root: &mut Expr,
-        path: &[&[u8]],
-        value: &[u8],
-        parse_json: bool,
+    /// As in npm, only the final segment may replace a value; anything else in the way is an error.
+    fn set_in_container(
+        container: &mut Expr,
+        container_name: &[u8],
+        key: &[u8],
+        path: &[Segment<'_>],
+        value: Expr,
     ) -> Result<(), Error> {
-        if path.is_empty() {
+        let [segment, rest @ ..] = path else {
             return Ok(());
+        };
+        let slot_name = &key[..segment.end];
+
+        if let Some(array) = container.data.e_array_mut() {
+            let len = array.items.len();
+            let index = match segment.kind {
+                SegmentKind::Append => len,
+                SegmentKind::Key { name, .. } => match array_index(name) {
+                    Some(index) if index <= len => index,
+                    Some(index) => {
+                        Output::err_generic(
+                            "{s}: index {s} is out of range for {s} (length {s})",
+                            (quote(key), index, quote(container_name), len),
+                        );
+                        bun_core::note!(
+                            "{}[] appends to the end of the array",
+                            bstr::BStr::new(container_name)
+                        );
+                        Global::exit(1);
+                    }
+                    None => {
+                        Output::err_generic(
+                            "{s}: {s} is an array, so {s} must be an index or []",
+                            (quote(key), quote(container_name), quote(name)),
+                        );
+                        Global::exit(1);
+                    }
+                },
+            };
+            if index == len {
+                array.push(dummy_bump(), Expr::init(E::Null {}, Loc::EMPTY))?;
+            }
+            let Some(next) = rest.first() else {
+                array.items[index] = value;
+                return Ok(());
+            };
+            let mut child = Self::child_container(Some(array.items[index]), *next, key, slot_name);
+            array.items[index] = child;
+            return Self::set_in_container(&mut child, slot_name, key, rest, value);
         }
 
-        let current_key = path[0];
-        let remaining_path = &path[1..];
-
-        if remaining_path.is_empty() {
-            let expr = Self::parse_value(value, parse_json)?;
-
-            root.data
-                .e_object_mut()
-                .unwrap()
-                .put(dummy_bump(), current_key, expr)?;
-
+        let SegmentKind::Key { name, .. } = segment.kind else {
+            Output::err_generic(
+                "{s}: cannot append to {s} because it is not an array",
+                (quote(key), quote(container_name)),
+            );
+            Global::exit(1);
+        };
+        let object = container
+            .data
+            .e_object_mut()
+            .expect("set_value checks the root and child_container only returns arrays or objects");
+        let Some(next) = rest.first() else {
+            object.put(dummy_bump(), name, value)?;
             return Ok(());
-        }
-
-        let mut nested_obj = root.get(current_key);
-        if nested_obj.is_none()
-            || !matches!(nested_obj.as_ref().unwrap().data, ExprData::EObject(_))
-        {
-            let new_obj = Expr::init(E::Object::default(), Loc::EMPTY);
-
-            root.data
-                .e_object_mut()
-                .unwrap()
-                .put(dummy_bump(), current_key, new_obj)?;
-
-            nested_obj = root.get(current_key);
-        }
+        };
+        let mut child = Self::child_container(object.get(name), *next, key, slot_name);
+        object.put(dummy_bump(), name, child)?;
+        Self::set_in_container(&mut child, slot_name, key, rest, value)
+    }
 
-        if !matches!(nested_obj.as_ref().unwrap().data, ExprData::EObject(_)) {
-            return Err(crate::Error::ExpectedObject);
+    /// A missing or `null` slot gets a new container shaped for `next`.
+    fn child_container(
+        existing: Option<Expr>,
+        next: Segment<'_>,
+        key: &[u8],
+        slot_name: &[u8],
+    ) -> Expr {
+        match existing {
+            Some(expr) if matches!(expr.data, ExprData::EArray(_) | ExprData::EObject(_)) => expr,
+            Some(expr) if !matches!(expr.data, ExprData::ENull(_)) => {
+                Output::err_generic(
+                    "{s}: {s} already exists and is not an object or array",
+                    (quote(key), quote(slot_name)),
+                );
+                Global::exit(1);
+            }
+            _ if next.creates_array() => Expr::init(E::Array::default(), Loc::EMPTY),
+            _ => Expr::init(E::Object::default(), Loc::EMPTY),
         }
-
-        let mut nested = nested_obj.unwrap();
-        Self::set_nested(&mut nested, remaining_path, value, parse_json)
     }
 
     fn parse_value(value: &[u8], parse_json: bool) -> Result<Expr, Error> {
@@ -724,60 +734,41 @@ impl PmPkgCommand {
             return Ok(false);
         }
 
-        let mut path_parts: Vec<&[u8]> = Vec::new();
-        for part in strings::tokenize(key, b".") {
-            path_parts.push(part);
-        }
-
-        if path_parts.is_empty() {
-            return Ok(false);
-        }
-
-        if path_parts.len() == 1 {
-            let exists = root.get(path_parts[0]).is_some();
-            if exists {
-                return Self::remove_property(root, path_parts[0]);
-            }
-            return Ok(false);
-        }
-
-        Self::delete_nested(root, &path_parts)
+        Self::delete_in_container(root, &Self::parse_key_path(key)?)
     }
 
-    fn delete_nested(root: &mut Expr, path: &[&[u8]]) -> Result<bool, Error> {
-        if path.is_empty() {
+    /// Splices out an array element or removes a property; returns whether anything was removed.
+    fn delete_in_container(container: &mut Expr, path: &[Segment<'_>]) -> Result<bool, Error> {
+        let [segment, rest @ ..] = path else {
             return Ok(false);
-        }
-
-        let current_key = path[0];
-        let remaining_path = &path[1..];
+        };
+        let SegmentKind::Key { name, .. } = segment.kind else {
+            Output::err_generic(
+                "Empty brackets are not valid syntax for deleting values.",
+                (),
+            );
+            Global::exit(1);
+        };
 
-        if remaining_path.is_empty() {
-            let exists = root.get(current_key).is_some();
-            if exists {
-                return Self::remove_property(root, current_key);
+        let mut child = if let Some(array) = container.data.e_array_mut() {
+            let Some(index) = array_index(name).filter(|&index| index < array.items.len()) else {
+                return Ok(false);
+            };
+            if rest.is_empty() {
+                array.items.remove(index);
+                return Ok(true);
             }
-            return Ok(false);
-        }
-
-        let nested_obj = root.get(current_key);
-        if nested_obj.is_none()
-            || !matches!(nested_obj.as_ref().unwrap().data, ExprData::EObject(_))
-        {
-            return Ok(false);
-        }
-
-        let mut nested = nested_obj.unwrap();
-        let deleted = Self::delete_nested(&mut nested, remaining_path)?;
-
-        if deleted {
-            root.data
-                .e_object_mut()
-                .unwrap()
-                .put(dummy_bump(), current_key, nested)?;
-        }
-
-        Ok(deleted)
+            array.items[index]
+        } else {
+            if rest.is_empty() {
+                return Self::remove_property(container, name);
+            }
+            let Some(child) = container.get(name) else {
+                return Ok(false);
+            };
+            child
+        };
+        Self::delete_in_container(&mut child, rest)
     }
 
     fn remove_property(obj: &mut Expr, key: &[u8]) -> Result<bool, Error> {
diff --git a/src/runtime/error.rs b/src/runtime/error.rs
index f68f3158b592..d872df9deb14 100644
--- a/src/runtime/error.rs
+++ b/src/runtime/error.rs
@@ -248,8 +248,6 @@ pub enum Error {
     InvalidRoot,
     #[error("EmptyKey")]
     EmptyKey,
-    #[error("ExpectedObject")]
-    ExpectedObject,
     #[error("FormatFailed")]
     FormatFailed,
     #[error("SelfExePathFailed")]
@@ -694,7 +692,6 @@ impl Error {
             Self::NotFound => "NotFound",
             Self::InvalidRoot => "InvalidRoot",
             Self::EmptyKey => "EmptyKey",
-            Self::ExpectedObject => "ExpectedObject",
             Self::FormatFailed => "FormatFailed",
             Self::SelfExePathFailed => "SelfExePathFailed",
             Self::SpawnFailed => "SpawnFailed",
diff --git a/test/cli/install/bun-pm-pkg.test.ts b/test/cli/install/bun-pm-pkg.test.ts
index 1c9bfdc9f6f7..3b28026edd91 100644
--- a/test/cli/install/bun-pm-pkg.test.ts
+++ b/test/cli/install/bun-pm-pkg.test.ts
@@ -23,6 +23,7 @@ async function runPmPkg(args: string[], cwd: string, expectSuccess = true) {
 }
 
 const readPkg = (dir: string) => Bun.file(join(dir, "package.json")).json();
+const readRaw = (dir: string) => Bun.file(join(dir, "package.json")).text();
 
 function createTestPackageJson(overrides = {}) {
   return JSON.stringify(
@@ -312,12 +313,156 @@ describe.concurrent("bun pm pkg", () => {
       expect(await readPkg(dir)).toEqual({
         name: "x",
         version: "1.0.0",
-        contributors: { "0": "alice" },
-        nested: { deep: { "0": "value" } },
+        contributors: ["alice"],
+        nested: { deep: ["value"] },
         scripts: { lint: "eslint ." },
       });
     });
 
+    describe("arrays", () => {
+      it("should append, index, and create arrays", async () => {
+        using dir = makeTestDir();
+        const { error, code } = await runPmPkg(
+          [
+            "set",
+            // existing array: append, then replace by bracket and dot index, then add at index == length
+            "keywords[]=cli",
+            "keywords[0]=first",
+            "keywords.1=second",
+            "keywords[3]=fourth",
+            // missing properties: [] and a bracketed index create arrays, a dotted number creates an object
+            "files[]=dist",
+            "files[]=README.md",
+            "os[0]=linux",
+            "config.0=zero",
+            // existing object: either notation is a property name
+            "scripts[0]=bracket",
+            "scripts.1=dot",
+            // null is treated as missing
+            "testNull[0]=x",
+            "matrix[0][0]=a",
+            "matrix[0][]=b",
+            "matrix[][0]=c",
+          ],
+          dir,
+        );
+        expect(error).toBe("");
+        expect(code).toBe(0);
+        expect(await readPkg(dir)).toEqual({
+          ...JSON.parse(createTestPackageJson()),
+          keywords: ["first", "second", "cli", "fourth"],
+          files: ["dist", "README.md"],
+          os: ["linux"],
+          config: { "0": "zero" },
+          scripts: { test: "echo 'test'", build: "echo 'build'", "0": "bracket", "1": "dot" },
+          testNull: ["x"],
+          matrix: [["a", "b"], ["c"]],
+        });
+
+        const { output } = await runPmPkg(["get", "scripts[0]", "scripts.1", "keywords[3]"], dir);
+        expect(JSON.parse(output)).toEqual({ "scripts[0]": "bracket", "scripts.1": "dot", "keywords[3]": "fourth" });
+      });
+
+      it("should set properties of objects inside an array, creating elements as needed", async () => {
+        using dir = makeTestDir();
+        const { error, code } = await runPmPkg(
+          [
+            "set",
+            "contributors[0].email=john@new.example",
+            "contributors[1].email=jane@example.com",
+            "contributors[2].name=Third",
+            "contributors[].name=Fourth",
+            "testNull.key=x",
+          ],
+          dir,
+        );
+        expect(error).toBe("");
+        expect(code).toBe(0);
+        expect(await readPkg(dir)).toEqual({
+          ...JSON.parse(createTestPackageJson()),
+          contributors: [
+            { name: "John Doe", email: "john@new.example" },
+            { name: "Jane Smith", email: "jane@example.com" },
+            { name: "Third" },
+            { name: "Fourth" },
+          ],
+          testNull: { key: "x" },
+        });
+      });
+
+      it("should append --json values", async () => {
+        using dir = makeTestDir();
+        const { code } = await runPmPkg(["set", "keywords[]=42", 'contributors[]={"name":"Obj"}', "--json"], dir);
+        expect(code).toBe(0);
+        expect(await readPkg(dir)).toMatchObject({
+          keywords: ["test", "package", 42],
+          contributors: [{ name: "John Doe", email: "john@example.com" }, { name: "Jane Smith" }, { name: "Obj" }],
+        });
+      });
+
+      it("should still replace a whole array or element when it is the final segment", async () => {
+        using dir = makeTestDir();
+        const { code } = await runPmPkg(["set", "keywords=none", "contributors[0]=alice"], dir);
+        expect(code).toBe(0);
+        expect(await readPkg(dir)).toMatchObject({
+          keywords: "none",
+          contributors: ["alice", { name: "Jane Smith" }],
+        });
+      });
+
+      const rejected = [
+        [
+          "keywords[3]=x",
+          'error: "keywords[3]": index 3 is out of range for "keywords" (length 2)\n' +
+            "note: keywords[] appends to the end of the array\n",
+        ],
+        ["keywords.foo=x", 'error: "keywords.foo": "keywords" is an array, so "foo" must be an index or []\n'],
+        ["scripts[]=x", 'error: "scripts[]": cannot append to "scripts" because it is not an array\n'],
+        ["name[]=x", 'error: "name[]": "name" already exists and is not an object or array\n'],
+        ["name.first=x", 'error: "name.first": "name" already exists and is not an object or array\n'],
+        // nested values are named by the part of the key that leads to them
+        [
+          "matrix[0][9]=x",
+          'error: "matrix[0][9]": index 9 is out of range for "matrix[0]" (length 2)\n' +
+            "note: matrix[0][] appends to the end of the array\n",
+        ],
+        ["matrix[0].foo=x", 'error: "matrix[0].foo": "matrix[0]" is an array, so "foo" must be an index or []\n'],
+        [
+          "contributors[0].name.first=x",
+          'error: "contributors[0].name.first": "contributors[0].name" already exists and is not an object or array\n',
+        ],
+        [
+          "nested.matrix[0][9]=x",
+          'error: "nested.matrix[0][9]": index 9 is out of range for "nested.matrix[0]" (length 1)\n' +
+            "note: nested.matrix[0][] appends to the end of the array\n",
+        ],
+        // an empty part between dots is skipped but still counts towards the name
+        [
+          "nested..matrix[0].foo=x",
+          'error: "nested..matrix[0].foo": "nested..matrix[0]" is an array, so "foo" must be an index or []\n',
+        ],
+      ] as const;
+
+      it.each(rejected)("should reject %s without touching package.json", async (arg, expectedError) => {
+        using dir = tempDir("pm-pkg-reject", {
+          "package.json": createTestPackageJson({ matrix: [["a", "b"]], nested: { matrix: [["a"]] } }),
+        });
+        const before = await readRaw(dir);
+        const { output, error, code } = await runPmPkg(["set", arg], dir, false);
+        expect({ output, error, code }).toEqual({ output: "", error: expectedError, code: 1 });
+        expect(await readRaw(dir)).toBe(before);
+      });
+
+      it("should not write earlier arguments when a later one is rejected", async () => {
+        using dir = makeTestDir();
+        const before = await readRaw(dir);
+        const { error, code } = await runPmPkg(["set", "description=changed", "keywords[9]=x"], dir, false);
+        expect(error).toStartWith('error: "keywords[9]": index 9 is out of range');
+        expect(code).toBe(1);
+        expect(await readRaw(dir)).toBe(before);
+      });
+    });
+
     it("should fail with invalid key=value format", async () => {
       using dir = makeTestDir();
       const { error, code } = await runPmPkg(["set", "invalidformat"], dir, false);
@@ -379,6 +524,43 @@ describe.concurrent("bun pm pkg", () => {
       expect(error).toContain("delete expects key args");
       expect(code).toBe(1);
     });
+
+    it("should delete array elements and bracketed properties", async () => {
+      using dir = makeTestDir();
+      const { error, code } = await runPmPkg(
+        ["delete", "keywords[0]", "contributors.1", "contributors[0].email", "scripts[test]"],
+        dir,
+      );
+      expect(error).toBe("");
+      expect(code).toBe(0);
+      expect(await readPkg(dir)).toEqual({
+        ...JSON.parse(createTestPackageJson()),
+        keywords: ["package"],
+        contributors: [{ name: "John Doe" }],
+        scripts: { build: "echo 'build'" },
+      });
+    });
+
+    it("should leave package.json alone when the path does not lead anywhere", async () => {
+      using dir = makeTestDir();
+      const before = await readRaw(dir);
+      const { error, code } = await runPmPkg(
+        ["delete", "keywords[2]", "keywords.foo", "contributors[0].missing", "name[0]", "missing[0]"],
+        dir,
+      );
+      expect(error).toBe("");
+      expect(code).toBe(0);
+      expect(await readRaw(dir)).toBe(before);
+    });
+
+    it("should reject empty brackets", async () => {
+      using dir = makeTestDir();
+      const before = await readRaw(dir);
+      const { error, code } = await runPmPkg(["delete", "keywords[]"], dir, false);
+      expect(error).toBe("error: Empty brackets are not valid syntax for deleting values.\n");
+      expect(code).toBe(1);
+      expect(await readRaw(dir)).toBe(before);
+    });
   });
 
   describe("help command", () => {
@@ -668,20 +850,22 @@ describe.concurrent("bun pm pkg", () => {
     it("should handle numeric indices with different data types", async () => {
       using dir = makeTestDir();
 
-      const [arr0, arr1] = await Promise.all([
-        runPmPkg(["get", "keywords.0"], dir, false),
-        runPmPkg(["get", "keywords.1"], dir, false),
+      const setThenGet = async () => {
+        const { code } = await runPmPkg(["set", "config.0=zero-value"], dir);
+        expect(code).toBe(0);
+        return runPmPkg(["get", "config.0"], dir);
+      };
+      // The read-only gets use the shared fixture so they can overlap with the set/get round trip.
+      const [arr0, arr1, config0] = await Promise.all([
+        runPmPkg(["get", "keywords.0"], readonlyDir, false),
+        runPmPkg(["get", "keywords.1"], readonlyDir, false),
+        setThenGet(),
       ]);
       expect(arr0.output.trim()).toBe('"test"');
       expect(arr0.code).toBe(0);
       expect(arr1.output.trim()).toBe('"package"');
       expect(arr1.code).toBe(0);
-
-      const { code: setCode } = await runPmPkg(["set", "config.0=zero-value"], dir);
-      expect(setCode).toBe(0);
-
-      const { output } = await runPmPkg(["get", "config.0"], dir);
-      expect(output.trim()).toBe('"zero-value"');
+      expect(config0.output.trim()).toBe('"zero-value"');
     });
 
     it("should gracefully handle invalid notation patterns", async () => {
@@ -705,15 +889,15 @@ describe.concurrent("bun pm pkg", () => {
     it("should maintain consistency between set and get operations", async () => {
       using dir = makeTestDir();
 
-      const { code: setCode1 } = await runPmPkg(["set", "test.array.0=first"], dir);
-      expect(setCode1).toBe(0);
-      const { output: getOutput1 } = await runPmPkg(["get", "test.array.0"], dir);
-      expect(getOutput1.trim()).toBe('"first"');
+      const { code: setCode } = await runPmPkg(["set", "test.array.0=first", "test.bracket.access=success"], dir);
+      expect(setCode).toBe(0);
 
-      const { code: setCode2 } = await runPmPkg(["set", "test.bracket.access=success"], dir);
-      expect(setCode2).toBe(0);
-      const { output: getOutput2 } = await runPmPkg(["get", "test.bracket.access"], dir);
-      expect(getOutput2.trim()).toBe('"success"');
+      const [getOutput1, getOutput2] = await Promise.all([
+        runPmPkg(["get", "test.array.0"], dir),
+        runPmPkg(["get", "test.bracket.access"], dir),
+      ]);
+      expect(getOutput1.output.trim()).toBe('"first"');
+      expect(getOutput2.output.trim()).toBe('"success"');
     });
 
     it("should handle edge cases with special characters", async () => {

From 3ad2bcfce1e4b775042d4a3d99096b6fb8d72a4c Mon Sep 17 00:00:00 2001
From: robobun <117481402+robobun@users.noreply.github.com>
Date: Mon, 17 Aug 2026 01:07:12 +0000
Subject: [PATCH 051/258] install: format versions with the string buffer they
 were parsed from (bun outdated table, minimum-release-age messages) (#38649)

---
 .../PackageManager/PackageManagerEnqueue.rs   |   7 +-
 src/runtime/cli/outdated_command.rs           |   4 +-
 test/cli/install/minimum-release-age.test.ts  | 189 ++++++++++++++++++
 3 files changed, 196 insertions(+), 4 deletions(-)

diff --git a/src/install/PackageManager/PackageManagerEnqueue.rs b/src/install/PackageManager/PackageManagerEnqueue.rs
index 79caa72f7e3a..6631caff81ee 100644
--- a/src/install/PackageManager/PackageManagerEnqueue.rs
+++ b/src/install/PackageManager/PackageManagerEnqueue.rs
@@ -1086,7 +1086,7 @@ pub fn enqueue_dependency_with_main_and_success_fn(
                                                             format_args!(
                                                                 "Version \"{}@{}\" was published within minimum release age of {} seconds",
                                                                 bstr::BStr::new(package_name),
-                                                                find_result.version.fmt(this.lockfile.buffers.string_bytes.as_slice()),
+                                                                find_result.version.fmt(&loaded_manifest.as_ref().unwrap().string_buf),
                                                                 min_age_seconds,
                                                             ),
                                                         );
@@ -2457,7 +2457,10 @@ fn get_or_put_resolved_package(
                                 }
                                 dependency::version::Tag::Npm => {
                                     // SAFETY: `version.tag == Npm`.
-                                    let version_str = &version.npm().version.fmt(manifest_buf);
+                                    let version_str = &version
+                                        .npm()
+                                        .version
+                                        .fmt(this.lockfile.buffers.string_bytes.as_slice());
                                     bun_core::pretty_errorln!(
                                         "<d>[minimum-release-age]<r> <b>{}<r>@{}<r> selected <green>{}<r> instead of <yellow>{}<r> due to {}-second filter",
                                         bstr::BStr::new(package_name),
diff --git a/src/runtime/cli/outdated_command.rs b/src/runtime/cli/outdated_command.rs
index 18757f7d0d32..87ab0f2f9b6b 100644
--- a/src/runtime/cli/outdated_command.rs
+++ b/src/runtime/cli/outdated_command.rs
@@ -482,7 +482,7 @@ impl OutdatedCommand {
                     write!(version_buf, "{}", uv.version.fmt(&manifest.string_buf))
                         .expect("OOM writing version");
                 } else {
-                    write!(version_buf, "{}", current_version.fmt(&manifest.string_buf))
+                    write!(version_buf, "{}", current_version.fmt(string_buf))
                         .expect("OOM writing version");
                 }
                 let update_version_len =
@@ -496,7 +496,7 @@ impl OutdatedCommand {
                     write!(version_buf, "{}", lv.version.fmt(&manifest.string_buf))
                         .expect("OOM writing version");
                 } else {
-                    write!(version_buf, "{}", current_version.fmt(&manifest.string_buf))
+                    write!(version_buf, "{}", current_version.fmt(string_buf))
                         .expect("OOM writing version");
                 }
                 let latest_version_len =
diff --git a/test/cli/install/minimum-release-age.test.ts b/test/cli/install/minimum-release-age.test.ts
index 1f7a0f934640..4692b5a16045 100644
--- a/test/cli/install/minimum-release-age.test.ts
+++ b/test/cli/install/minimum-release-age.test.ts
@@ -793,6 +793,78 @@ describe("minimum-release-age", () => {
           return Response.json(packageData);
         }
 
+        // TEST PACKAGE 14: snapshot-package (prerelease tag longer than the 8 bytes a
+        // semver string stores inline; every published version is younger than the
+        // filters used in the tests, so nothing can be selected)
+        if (url.pathname === "/snapshot-package") {
+          const packageData = {
+            name: "snapshot-package",
+            "dist-tags": {
+              latest: "1.0.0",
+              snapshot: "1.0.0-snapshot.20240101",
+            },
+            versions: {
+              "1.0.0-snapshot.20240101": {
+                name: "snapshot-package",
+                version: "1.0.0-snapshot.20240101",
+                dist: {
+                  tarball: `${mockRegistryUrl}/snapshot-package/-/snapshot-package-1.0.0-snapshot.20240101.tgz`,
+                  integrity: "sha512-snapshot==",
+                },
+              },
+              "1.0.0": {
+                name: "snapshot-package",
+                version: "1.0.0",
+                dist: {
+                  tarball: `${mockRegistryUrl}/snapshot-package/-/snapshot-package-1.0.0.tgz`,
+                  integrity: "sha512-stable==",
+                },
+              },
+            },
+            time: {
+              "1.0.0-snapshot.20240101": daysAgo(2),
+              "1.0.0": daysAgo(1),
+            },
+          };
+
+          return Response.json(packageData);
+        }
+
+        // TEST PACKAGE 15: nightly-package (prerelease tags longer than the inline
+        // limit; the older nightly passes a 5 day filter, the newer one does not)
+        if (url.pathname === "/nightly-package") {
+          const packageData = {
+            name: "nightly-package",
+            "dist-tags": {
+              latest: "1.0.0-nightly.20240102",
+            },
+            versions: {
+              "1.0.0-nightly.20240101": {
+                name: "nightly-package",
+                version: "1.0.0-nightly.20240101",
+                dist: {
+                  tarball: `${mockRegistryUrl}/nightly-package/-/nightly-package-1.0.0-nightly.20240101.tgz`,
+                  integrity: "sha512-nightly1==",
+                },
+              },
+              "1.0.0-nightly.20240102": {
+                name: "nightly-package",
+                version: "1.0.0-nightly.20240102",
+                dist: {
+                  tarball: `${mockRegistryUrl}/nightly-package/-/nightly-package-1.0.0-nightly.20240102.tgz`,
+                  integrity: "sha512-nightly2==",
+                },
+              },
+            },
+            time: {
+              "1.0.0-nightly.20240101": daysAgo(30),
+              "1.0.0-nightly.20240102": daysAgo(1),
+            },
+          };
+
+          return Response.json(packageData);
+        }
+
         // TEST PACKAGE: many-versions-package (large version count, time entries
         // in reverse order relative to versions). Exercises the publish-time
         // index built during manifest parse.
@@ -1762,6 +1834,123 @@ describe("minimum-release-age", () => {
     });
   });
 
+  // Semver strings longer than 8 bytes are not stored inline: they are offsets into
+  // the string buffer they were parsed from, and the lockfile and each package
+  // manifest have their own buffer. The prerelease tags of snapshot-package and
+  // nightly-package are long enough to live in those buffers, so these tests
+  // notice when a version is printed through the other side's buffer.
+  describe("prerelease tags longer than an inline semver string", () => {
+    const minimumReleaseAge = `${5 * SECONDS_PER_DAY}`;
+
+    async function run(cmd: string[], cwd: string, env: NodeJS.Dict<string> = bunEnv) {
+      await using proc = Bun.spawn({ cmd, cwd, env, stdout: "pipe", stderr: "pipe" });
+      const [stdout, stderr, exitCode] = await Promise.all([proc.stdout.text(), proc.stderr.text(), proc.exited]);
+      return { stdout, stderr, exitCode };
+    }
+
+    test("bun outdated sizes the Update and Latest columns by the current version when nothing passes the filter", async () => {
+      using dir = tempDir("outdated-long-prerelease", {
+        "package.json": JSON.stringify({
+          dependencies: {
+            // Already on their latest versions, so they stay out of the table. They
+            // sort before snapshot-package in bun.lock, so their names and tarball
+            // URLs fill the lockfile string buffer first and snapshot-package's
+            // prerelease tag ends up at an offset past the end of its (much smaller)
+            // manifest buffer. Closer to the start of the buffer, a read through the
+            // wrong buffer returns wrong bytes of the right length and the table
+            // lines up by accident.
+            "bugfix-package": "1.0.3",
+            "exact-threshold-package": "2.0.0",
+            "regular-package": "3.0.0",
+            "snapshot-package": "snapshot",
+          },
+        }),
+        ".npmrc": `registry=${mockRegistryUrl}`,
+      });
+
+      // Installed without the filter: the snapshot is only two days old.
+      const install = await run([bunExe(), "install", "--no-verify"], String(dir));
+      expect(install).toMatchObject({ exitCode: 0 });
+
+      // With the filter, neither the `snapshot` tag nor `latest` has a version old
+      // enough, so both columns fall back to showing the current version.
+      const { stdout, exitCode } = await run(
+        [bunExe(), "outdated", "--minimum-release-age", minimumReleaseAge],
+        String(dir),
+      );
+      const table = stdout.slice(stdout.indexOf("\n") + 1);
+      expect(table).toMatchInlineSnapshot(`
+        "|----------------------------------------------------------------------------------------------------|
+        | Package          | Current                 | Update                    | Latest                    |
+        |------------------|-------------------------|---------------------------|---------------------------|
+        | snapshot-package | 1.0.0-snapshot.20240101 | 1.0.0-snapshot.20240101 * | 1.0.0-snapshot.20240101 * |
+        |----------------------------------------------------------------------------------------------------|
+        Note: The * indicates that version isn't true latest due to minimum release age
+        "
+      `);
+      const widths = table
+        .split("\n")
+        .filter(line => line.startsWith("|"))
+        .map(line => line.length);
+      expect(new Set(widths).size).toBe(1);
+      expect(exitCode).toBe(0);
+    });
+
+    test("--verbose prints the dependency's range from the lockfile", async () => {
+      using dir = tempDir("verbose-long-prerelease", {
+        "package.json": JSON.stringify({
+          dependencies: { "nightly-package": "^1.0.0-nightly.20240101" },
+        }),
+        ".npmrc": `registry=${mockRegistryUrl}`,
+      });
+
+      const { stderr, exitCode } = await run(
+        [bunExe(), "install", "--minimum-release-age", minimumReleaseAge, "--no-verify", "--verbose"],
+        String(dir),
+      );
+      expect(stderr.split("\n").filter(line => line.includes("[minimum-release-age]"))).toEqual([
+        "[minimum-release-age] nightly-package@>=1.0.0-nightly.20240101 <2.0.0 selected 1.0.0-nightly.20240101 instead of 1.0.0-nightly.20240102 due to 432000-second filter",
+      ]);
+      expect(exitCode).toBe(0);
+    });
+
+    test("an exact pin rejected from a cached manifest is reported with the manifest's version", async () => {
+      using dir = tempDir("cached-manifest-long-prerelease", {
+        "package.json": JSON.stringify({
+          dependencies: { "nightly-package": "^1.0.0-nightly.20240101" },
+        }),
+        ".npmrc": `registry=${mockRegistryUrl}`,
+      });
+
+      // Puts nightly-package's manifest, including publish times, in the cache.
+      const first = await run(
+        [bunExe(), "install", "--minimum-release-age", minimumReleaseAge, "--no-verify"],
+        String(dir),
+      );
+      expect(first).toMatchObject({ exitCode: 0 });
+
+      await Bun.write(
+        `${dir}/package.json`,
+        JSON.stringify({ dependencies: { "nightly-package": "1.0.0-nightly.20240102" } }),
+      );
+      // BUN_MANIFEST_CACHE=1 treats every cached manifest as stale, which is how a
+      // manifest cached more than a few minutes ago looks. Exact pins are then
+      // checked against the cached manifest instead of a fresh download, and that
+      // check is what reports the rejected version.
+      const second = await run(
+        [bunExe(), "install", "--minimum-release-age", minimumReleaseAge, "--no-verify"],
+        String(dir),
+        { ...bunEnv, BUN_MANIFEST_CACHE: "1" },
+      );
+      expect(second.stderr).toMatchInlineSnapshot(`
+        "error: Version "nightly-package@1.0.0-nightly.20240102" was published within minimum release age of 432000 seconds
+        error: nightly-package@1.0.0-nightly.20240102 failed to resolve
+        "
+      `);
+      expect(second.exitCode).toBe(1);
+    });
+  });
+
   describe("transitive dependencies", () => {
     test("transitive dependencies are not filtered by minimum-release-age", async () => {
       // Only direct dependencies should be filtered, not transitive ones

From 0da2a66d6c936e90d26a0643ac9b2257f6cc8412 Mon Sep 17 00:00:00 2001
From: robobun <117481402+robobun@users.noreply.github.com>
Date: Mon, 17 Aug 2026 01:07:17 +0000
Subject: [PATCH 052/258] audit: list --production, --omit, --dry-run and --cwd
 in bun audit --help (#38836)

---
 completions/bun-cli.json                      | 32 ++++++++++++++
 .../PackageManager/CommandLineArguments.rs    | 44 ++++++++++++++-----
 test/cli/install/bun-audit.test.ts            | 32 ++++++++++++++
 3 files changed, 97 insertions(+), 11 deletions(-)

diff --git a/completions/bun-cli.json b/completions/bun-cli.json
index 2a14b1a1ab85..1c608da3651e 100644
--- a/completions/bun-cli.json
+++ b/completions/bun-cli.json
@@ -1530,6 +1530,38 @@
           "valueType": "val",
           "required": false,
           "multiple": false
+        },
+        {
+          "name": "production",
+          "shortName": "p",
+          "description": "Skip packages that are only needed by devDependencies (alias: --prod)",
+          "hasValue": false,
+          "required": false,
+          "multiple": false
+        },
+        {
+          "name": "omit",
+          "description": "Skip packages that are only needed by the given dependency types: dev, optional, or peer (repeatable)",
+          "hasValue": true,
+          "valueType": "val",
+          "required": false,
+          "multiple": false
+        },
+        {
+          "name": "cwd",
+          "description": "Set a specific cwd",
+          "hasValue": true,
+          "valueType": "val",
+          "required": false,
+          "multiple": false
+        },
+        {
+          "name": "help",
+          "shortName": "h",
+          "description": "Print this help menu",
+          "hasValue": false,
+          "required": false,
+          "multiple": false
         }
       ],
       "positionalArgs": [
diff --git a/src/install/PackageManager/CommandLineArguments.rs b/src/install/PackageManager/CommandLineArguments.rs
index dfd92eb3c21a..d2a7b0c47cd5 100644
--- a/src/install/PackageManager/CommandLineArguments.rs
+++ b/src/install/PackageManager/CommandLineArguments.rs
@@ -324,24 +324,49 @@ static OUTDATED_PARAMS: &[ParamType] = concat_params![
     ]
 ];
 
-const AUDIT_PARAMS: &[ParamType] = &[
+static AUDIT_PARAMS: &[ParamType] = concat_params![
+    SHARED_PARAMS,
+    &[
+        clap::param!(
+            "<POS> ...                              Check installed packages for vulnerabilities"
+        ),
+        clap::param!("--json                                 Output in JSON format"),
+        clap::param!(
+            "--audit-level <STR>                    Only print advisories with severity greater than or equal to \\<level\\> (low, moderate, high, critical)"
+        ),
+        clap::param!(
+            "--ignore <STR>...                      Ignore advisories by GHSA or numeric advisory ID (repeatable)"
+        ),
+        clap::param!(
+            "-L, --latest                           Also apply fixes your declared ranges exclude, rewriting package.json"
+        ),
+    ]
+];
+
+const AUDIT_HELP_PARAMS: &[ParamType] = &[
     clap::param!(
-        "<POS> ...                              Check installed packages for vulnerabilities"
+        "--audit-level <STR>                    Only print advisories with severity greater than or equal to \\<level\\> (low, moderate, high, critical)"
     ),
-    clap::param!("--json                                 Output in JSON format"),
     clap::param!(
-        "--audit-level <STR>                    Only print advisories with severity greater than or equal to \\<level\\> (low, moderate, high, critical)"
+        "-p, --production                       Skip packages that are only needed by devDependencies (alias: --prod)"
+    ),
+    clap::param!(
+        "--omit <dev|optional|peer>...          Skip packages that are only needed by the given dependency types: dev, optional, or peer (repeatable)"
     ),
     clap::param!(
         "--ignore <STR>...                      Ignore advisories by GHSA or numeric advisory ID (repeatable)"
     ),
+    clap::param!("--json                                 Output in JSON format"),
+    clap::param!(
+        "--dry-run                              Show what bun audit fix would change without changing anything"
+    ),
     clap::param!(
         "-L, --latest                           Also apply fixes your declared ranges exclude, rewriting package.json"
     ),
+    clap::param!("--cwd <STR>                            Set a specific cwd"),
+    clap::param!("-h, --help                             Print this help menu"),
 ];
 
-static AUDIT_PARAMS_FULL: &[ParamType] = concat_params![SHARED_PARAMS, AUDIT_PARAMS];
-
 static INFO_PARAMS: &[ParamType] = concat_params![
     SHARED_PARAMS,
     &[
@@ -1059,7 +1084,7 @@ Full documentation is available at <magenta>https://bun.com/docs/install/audit<r
 ";
 
                 pretty_help(intro_text);
-                clap::simple_help(AUDIT_PARAMS);
+                clap::simple_help(AUDIT_HELP_PARAMS);
                 pretty_help(outro_text);
                 Output::flush();
             }
@@ -1198,10 +1223,7 @@ Full documentation is available at <magenta>https://bun.com/docs/pm/cli/prune<r>
             Subcommand::Why => WHY_PARAMS,
             Subcommand::Dedupe => DEDUPE_PARAMS,
             Subcommand::Prune => PRUNE_PARAMS,
-
-            // TODO: we will probably want to do this for other *_params. this way extra params
-            // are not included in the help text
-            Subcommand::Audit => AUDIT_PARAMS_FULL,
+            Subcommand::Audit => AUDIT_PARAMS,
             Subcommand::Info => INFO_PARAMS,
         };
 
diff --git a/test/cli/install/bun-audit.test.ts b/test/cli/install/bun-audit.test.ts
index b0197c013fb3..431037cc5bf0 100644
--- a/test/cli/install/bun-audit.test.ts
+++ b/test/cli/install/bun-audit.test.ts
@@ -1040,6 +1040,38 @@ describe("`bun audit --omit`", () => {
   });
 });
 
+describe("`bun audit --help`", () => {
+  test.concurrent("lists the flags bun audit and bun audit fix act on", async () => {
+    using dir = tempDir("audit-help-", {});
+
+    const { stdout, stderr, exitCode } = await audit(dir, "--help");
+    expect(stdout).toContain("Usage: bun audit [flags]");
+    const out = normalizeBunSnapshot(stdout).split("\n");
+    const flagsStart = out.indexOf("Flags:") + 1;
+    expect(flagsStart).toBeGreaterThan(0);
+    const flagLines = out.slice(flagsStart, out.indexOf("", flagsStart));
+    expect(flagLines.map(line => line.match(/--[\w-]+/)![0])).toStrictEqual([
+      "--audit-level",
+      "--production",
+      "--omit",
+      "--ignore",
+      "--json",
+      "--dry-run",
+      "--latest",
+      "--cwd",
+      "--help",
+    ]);
+    expect(flagLines.find(line => line.includes("--production"))).toStartWith("  -p, --production");
+    expect(flagLines.find(line => line.includes("--production"))).toContain("(alias: --prod)");
+    expect(flagLines.find(line => line.includes("--omit"))).toContain("dev, optional, or peer");
+    expect(flagLines.find(line => line.includes("--dry-run"))).toContain("bun audit fix");
+    expect(flagLines.find(line => line.includes("--latest"))).toStartWith("  -L, --latest");
+    expect(flagLines.find(line => line.includes("--help"))).toStartWith("  -h, --help");
+    expect(stderr).toBe("");
+    expect(exitCode).toBe(0);
+  });
+});
+
 describe("`bun audit` report", () => {
   test.concurrent("an unknown severity is counted and filtered as moderate", async () => {
     await using server = startRegistry({ "a-dep": [{ ...adv("<1.0.4"), severity: "info" }] });

From 943d87aff2b24d9cede49918d1cc92bf456a28de Mon Sep 17 00:00:00 2001
From: robobun <117481402+robobun@users.noreply.github.com>
Date: Mon, 17 Aug 2026 01:07:21 +0000
Subject: [PATCH 053/258] install: say --ignore-scripts also skips trusted
 dependencies' scripts in --help (#38893)

---
 completions/bun-cli.json                      | 22 ++++++-------
 completions/bun.zsh                           | 14 ++++----
 .../PackageManager/CommandLineArguments.rs    |  2 +-
 .../bun-install-lifecycle-scripts.test.ts     | 33 +++++++++++++++++++
 4 files changed, 52 insertions(+), 19 deletions(-)

diff --git a/completions/bun-cli.json b/completions/bun-cli.json
index 1c608da3651e..a708a90db102 100644
--- a/completions/bun-cli.json
+++ b/completions/bun-cli.json
@@ -373,7 +373,7 @@
         },
         {
           "name": "ignore-scripts",
-          "description": "Skip lifecycle scripts in the project's package.json (dependency scripts are never run)",
+          "description": "Skip lifecycle scripts for all packages, including the project's package.json and trusted dependencies",
           "hasValue": false,
           "required": false,
           "multiple": false
@@ -694,7 +694,7 @@
         },
         {
           "name": "ignore-scripts",
-          "description": "Skip lifecycle scripts in the project's package.json (dependency scripts are never run)",
+          "description": "Skip lifecycle scripts for all packages, including the project's package.json and trusted dependencies",
           "hasValue": false,
           "required": false,
           "multiple": false
@@ -1025,7 +1025,7 @@
         },
         {
           "name": "ignore-scripts",
-          "description": "Skip lifecycle scripts in the project's package.json (dependency scripts are never run)",
+          "description": "Skip lifecycle scripts for all packages, including the project's package.json and trusted dependencies",
           "hasValue": false,
           "required": false,
           "multiple": false
@@ -1296,7 +1296,7 @@
         },
         {
           "name": "ignore-scripts",
-          "description": "Skip lifecycle scripts in the project's package.json (dependency scripts are never run)",
+          "description": "Skip lifecycle scripts for all packages, including the project's package.json and trusted dependencies",
           "hasValue": false,
           "required": false,
           "multiple": false
@@ -1746,7 +1746,7 @@
         },
         {
           "name": "ignore-scripts",
-          "description": "Skip lifecycle scripts in the project's package.json (dependency scripts are never run)",
+          "description": "Skip lifecycle scripts for all packages, including the project's package.json and trusted dependencies",
           "hasValue": false,
           "required": false,
           "multiple": false
@@ -2127,7 +2127,7 @@
         },
         {
           "name": "ignore-scripts",
-          "description": "Skip lifecycle scripts in the project's package.json (dependency scripts are never run)",
+          "description": "Skip lifecycle scripts for all packages, including the project's package.json and trusted dependencies",
           "hasValue": false,
           "required": false,
           "multiple": false
@@ -2410,7 +2410,7 @@
         },
         {
           "name": "ignore-scripts",
-          "description": "Skip lifecycle scripts in the project's package.json (dependency scripts are never run)",
+          "description": "Skip lifecycle scripts for all packages, including the project's package.json and trusted dependencies",
           "hasValue": false,
           "required": false,
           "multiple": false
@@ -2669,7 +2669,7 @@
         },
         {
           "name": "ignore-scripts",
-          "description": "Skip lifecycle scripts in the project's package.json (dependency scripts are never run)",
+          "description": "Skip lifecycle scripts for all packages, including the project's package.json and trusted dependencies",
           "hasValue": false,
           "required": false,
           "multiple": false
@@ -2921,7 +2921,7 @@
         },
         {
           "name": "ignore-scripts",
-          "description": "Skip lifecycle scripts in the project's package.json (dependency scripts are never run)",
+          "description": "Skip lifecycle scripts for all packages, including the project's package.json and trusted dependencies",
           "hasValue": false,
           "required": false,
           "multiple": false
@@ -3226,7 +3226,7 @@
         },
         {
           "name": "ignore-scripts",
-          "description": "Skip lifecycle scripts in the project's package.json (dependency scripts are never run)",
+          "description": "Skip lifecycle scripts for all packages, including the project's package.json and trusted dependencies",
           "hasValue": false,
           "required": false,
           "multiple": false
@@ -3655,7 +3655,7 @@
         },
         {
           "name": "ignore-scripts",
-          "description": "Skip lifecycle scripts in the project's package.json (dependency scripts are never run)",
+          "description": "Skip lifecycle scripts for all packages, including the project's package.json and trusted dependencies",
           "hasValue": false,
           "required": false,
           "multiple": false
diff --git a/completions/bun.zsh b/completions/bun.zsh
index 3a02d58b200c..9ef9930f7a85 100644
--- a/completions/bun.zsh
+++ b/completions/bun.zsh
@@ -23,7 +23,7 @@ _bun_add_completion() {
         '--no-progress[Disable the progress bar]' \
         '--no-summary[Don'"'"'t print a summary]' \
         '--no-verify[Skip verifying integrity of newly downloaded packages]' \
-        '--ignore-scripts[Skip lifecycle scripts in the package.json (dependency scripts are never run)]' \
+        '--ignore-scripts[Skip lifecycle scripts for all packages, including the project'"'"'s package.json and trusted dependencies]' \
         '--global[Add a package globally]' \
         '-g[Add a package globally]' \
         '--cwd[Set a specific cwd]:cwd' \
@@ -77,7 +77,7 @@ _bun_unlink_completion() {
         '--no-progress[Disable the progress bar]' \
         '--no-summary[Don'"'"'t print a summary]' \
         '--no-verify[Skip verifying integrity of newly downloaded packages]' \
-        '--ignore-scripts[Skip lifecycle scripts in the package.json (dependency scripts are never run)]' \
+        '--ignore-scripts[Skip lifecycle scripts for all packages, including the project'"'"'s package.json and trusted dependencies]' \
         '--global[Add a package globally]' \
         '-g[Add a package globally]' \
         '--cwd[Set a specific cwd]:cwd' \
@@ -121,7 +121,7 @@ _bun_link_completion() {
         '--no-progress[Disable the progress bar]' \
         '--no-summary[Don'"'"'t print a summary]' \
         '--no-verify[Skip verifying integrity of newly downloaded packages]' \
-        '--ignore-scripts[Skip lifecycle scripts in the package.json (dependency scripts are never run)]' \
+        '--ignore-scripts[Skip lifecycle scripts for all packages, including the project'"'"'s package.json and trusted dependencies]' \
         '--global[Add a package globally]' \
         '-g[Add a package globally]' \
         '--cwd[Set a specific cwd]:cwd' \
@@ -387,7 +387,7 @@ _bun_install_completion() {
         '--no-progress[Disable the progress bar]' \
         '--no-summary[Don'"'"'t print a summary]' \
         '--no-verify[Skip verifying integrity of newly downloaded packages]' \
-        '--ignore-scripts[Skip lifecycle scripts in the package.json (dependency scripts are never run)]' \
+        '--ignore-scripts[Skip lifecycle scripts for all packages, including the project'"'"'s package.json and trusted dependencies]' \
         '--global[Add a package globally]' \
         '-g[Add a package globally]' \
         '--cwd[Set a specific cwd]:cwd' \
@@ -437,7 +437,7 @@ _bun_remove_completion() {
         '--no-progress[Disable the progress bar]' \
         '--no-summary[Don'"'"'t print a summary]' \
         '--no-verify[Skip verifying integrity of newly downloaded packages]' \
-        '--ignore-scripts[Skip lifecycle scripts in the package.json (dependency scripts are never run)]' \
+        '--ignore-scripts[Skip lifecycle scripts for all packages, including the project'"'"'s package.json and trusted dependencies]' \
         '--global[Add a package globally]' \
         '-g[Add a package globally]' \
         '--cwd[Set a specific cwd]:cwd' \
@@ -656,7 +656,7 @@ _bun_update_completion() {
         '--no-progress[Disable the progress bar]' \
         '--no-summary[Don'"'"'t print a summary]' \
         '--no-verify[Skip verifying integrity of newly downloaded packages]' \
-        '--ignore-scripts[Skip lifecycle scripts in the package.json (dependency scripts are never run)]' \
+        '--ignore-scripts[Skip lifecycle scripts for all packages, including the project'"'"'s package.json and trusted dependencies]' \
         '-g[Add a package globally]' \
         '--global[Add a package globally]' \
         '--cwd[Set a specific cwd]:cwd' \
@@ -713,7 +713,7 @@ _bun_dedupe_completion() {
         '--no-progress[Disable the progress bar]' \
         '--no-summary[Don'"'"'t print a summary]' \
         '--no-verify[Skip verifying integrity of newly downloaded packages]' \
-        '--ignore-scripts[Skip lifecycle scripts in the package.json (dependency scripts are never run)]' \
+        '--ignore-scripts[Skip lifecycle scripts for all packages, including the project'"'"'s package.json and trusted dependencies]' \
         '--cwd[Set a specific cwd]:cwd' \
         '--backend[Platform-specific optimizations for installing dependencies]:backend:("copyfile" "hardlink" "symlink")' \
         '--linker[Linker strategy]:linker:(isolated hoisted)' \
diff --git a/src/install/PackageManager/CommandLineArguments.rs b/src/install/PackageManager/CommandLineArguments.rs
index d2a7b0c47cd5..999ce9016546 100644
--- a/src/install/PackageManager/CommandLineArguments.rs
+++ b/src/install/PackageManager/CommandLineArguments.rs
@@ -98,7 +98,7 @@ const SHARED_TAIL_PARAMS: &[ParamType] = &[
         "--no-verify                           Skip verifying integrity of newly downloaded packages"
     ),
     clap::param!(
-        "--ignore-scripts                      Skip lifecycle scripts in the project's package.json (dependency scripts are never run)"
+        "--ignore-scripts                      Skip lifecycle scripts for all packages, including the project's package.json and trusted dependencies"
     ),
     clap::param!(
         "--trust                               Add to trustedDependencies in the project's package.json and install the package(s)"
diff --git a/test/cli/install/bun-install-lifecycle-scripts.test.ts b/test/cli/install/bun-install-lifecycle-scripts.test.ts
index d641b05600a8..636331993ff3 100644
--- a/test/cli/install/bun-install-lifecycle-scripts.test.ts
+++ b/test/cli/install/bun-install-lifecycle-scripts.test.ts
@@ -1104,6 +1104,39 @@ test.concurrent(
   },
 );
 
+// Every subcommand below prints the flag table shared by the install family. The behavior the
+// entry describes is covered by "ignore-scripts is read from npmrc" (above) and "--ignore-scripts
+// should skip lifecycle scripts" (below): both install a trustedDependencies package.
+test.concurrent.each([
+  "install",
+  "add",
+  "update",
+  "remove",
+  "link",
+  "unlink",
+  "patch",
+  "patch-commit",
+  "outdated",
+  "publish",
+  "info",
+])("bun %s --help says --ignore-scripts also skips the scripts of trusted dependencies", async subcommand => {
+  await using proc = spawn({
+    cmd: [bunExe(), subcommand, "--help"],
+    env: baseEnv,
+    stdout: "pipe",
+    stderr: "pipe",
+  });
+  const [stdout, stderr, exitCode] = await Promise.all([proc.stdout.text(), proc.stderr.text(), proc.exited]);
+
+  const entry = stdout.split(/\r?\n/).find(line => line.includes("--ignore-scripts"));
+  expect(entry).toBeDefined();
+  expect(entry).toContain("trusted dependencies");
+  // The wording from before trustedDependencies existed.
+  expect(entry).not.toContain("dependency scripts are never run");
+  expect(stderr).toBe("");
+  expect(exitCode).toBe(0);
+});
+
 // waiter thread is only a thing on Linux.
 for (const forceWaiterThread of isLinux ? [false, true] : [false]) {
   describe.concurrent("lifecycle scripts" + (forceWaiterThread ? " (waiter thread)" : ""), async () => {

From 6e9b4b6414ad51c4f1e361bb1ecd7f76d875602d Mon Sep 17 00:00:00 2001
From: robobun <117481402+robobun@users.noreply.github.com>
Date: Mon, 17 Aug 2026 01:07:26 +0000
Subject: [PATCH 054/258] pm: polish dedupe, prune, pm ls and pm licenses
 output (#38952)

---
 .../from-npm-install-to-bun-install.mdx       |   2 +-
 docs/pm/cli/dedupe.mdx                        |   4 +-
 docs/pm/cli/pm.mdx                            |  10 +-
 docs/pm/cli/prune.mdx                         |   4 +-
 src/install/dedupe.rs                         |  60 +++--
 src/install/prune.rs                          |  89 ++++++--
 src/runtime/cli/package_manager_command.rs    |   2 +-
 src/runtime/cli/pm_licenses_command.rs        |  56 ++++-
 test/cli/install/bun-dedupe.test.ts           |  34 +--
 .../bun-install-lifecycle-scripts.test.ts     |   4 +-
 test/cli/install/bun-pm-licenses.test.ts      | 210 +++++++++++++-----
 test/cli/install/bun-pm.test.ts               |  16 +-
 test/cli/install/bun-prune.test.ts            | 198 +++++++++--------
 test/cli/install/isolated-relink.test.ts      |   2 +-
 14 files changed, 469 insertions(+), 222 deletions(-)

diff --git a/docs/guides/install/from-npm-install-to-bun-install.mdx b/docs/guides/install/from-npm-install-to-bun-install.mdx
index f97fae445048..1fcf44967f03 100644
--- a/docs/guides/install/from-npm-install-to-bun-install.mdx
+++ b/docs/guides/install/from-npm-install-to-bun-install.mdx
@@ -155,7 +155,7 @@ bun pm ls
 ```
 
 ```txt
-my-pkg node_modules (781)
+my-pkg node_modules (781 installed)
 ├── @types/node@20.16.5
 ├── @types/react@18.3.8
 ├── @types/react-dom@18.3.0
diff --git a/docs/pm/cli/dedupe.mdx b/docs/pm/cli/dedupe.mdx
index 67c09efadb3a..47d947a6c137 100644
--- a/docs/pm/cli/dedupe.mdx
+++ b/docs/pm/cli/dedupe.mdx
@@ -15,7 +15,7 @@ bun dedupe v1.4.0 (abc12345)
 ↳ esbuild 0.15.10 → 0.15.11
 ↳ react 18.2.0 → 18.3.1
 
-2 duplicate versions removed, 3 packages installed (checked 5 packages) [12.00ms]
+2 duplicate versions removed, 3 packages installed (checked 5 packages in bun.lock) [12.00ms]
 ```
 
 Each row is a version Bun removed and the version its dependents now use.
@@ -36,7 +36,7 @@ bun dedupe v1.4.0 (abc12345)
 ↳ esbuild 0.15.10 → 0.15.11
 ↳ react 18.2.0 → 18.3.1
 
-2 duplicate versions can be removed (checked 5 packages) [9.00ms]
+2 duplicate versions can be removed (checked 5 packages in bun.lock) [9.00ms]
   bun dedupe
 ```
 
diff --git a/docs/pm/cli/pm.mdx b/docs/pm/cli/pm.mdx
index 5b6ba556d06a..ee0255597ae2 100644
--- a/docs/pm/cli/pm.mdx
+++ b/docs/pm/cli/pm.mdx
@@ -118,7 +118,7 @@ bun list
 ```
 
 ```txt
-/path/to/project node_modules (135)
+/path/to/project node_modules (135 installed)
 ├── eslint@8.38.0
 ├── react@18.2.0
 ├── react-dom@18.2.0
@@ -135,7 +135,7 @@ bun list --all
 ```
 
 ```txt
-/path/to/project node_modules (135)
+/path/to/project node_modules (135 installed)
 ├── @eslint-community/eslint-utils@4.4.0
 ├── @eslint-community/regexpp@4.5.0
 ├── @eslint/eslintrc@2.0.2
@@ -159,7 +159,7 @@ bun list --trusted
 ```
 
 ```txt
-/path/to/project node_modules (135)
+/path/to/project node_modules (135 installed)
 └── esbuild@0.21.5
 ```
 
@@ -174,6 +174,8 @@ bun pm licenses ls
 ```
 
 ```txt
+bun pm licenses v1.3.0 (a4b2f86f)
+
 MIT (2)
 ├── path-parse@1.0.6
 └── resolve@1.9.0
@@ -183,6 +185,8 @@ Unknown (4)
 ├── no-deps@1.0.0
 ├── no-deps@1.0.1
 └── one-dep@1.0.0
+
+6 packages across 2 licenses (checked 6 packages in bun.lock) [4.00ms]
 ```
 
 | Flag                           | Description                                                                     |
diff --git a/docs/pm/cli/prune.mdx b/docs/pm/cli/prune.mdx
index 3988e1a0b28a..97ca936e013f 100644
--- a/docs/pm/cli/prune.mdx
+++ b/docs/pm/cli/prune.mdx
@@ -16,7 +16,7 @@ bun prune v1.4.0 (abc12345)
 
 - @types/node@20.11.5
 - left-pad@1.3.0
-2 packages removed (checked 948) [22.00ms]
+2 packages removed (checked 948 installed packages) [22.00ms]
 ```
 
 Packages removed from a workspace or nested `node_modules` folder show the folder in parentheses, e.g. `- typescript@5.4.0 (packages/app/node_modules)`.
@@ -47,7 +47,7 @@ bun prune --production --dry-run
 bun prune v1.4.0 (abc12345)
 
 - typescript@5.4.0
-1 package can be removed (checked 948) [9.00ms]
+1 package can be removed (checked 948 installed packages) [9.00ms]
   bun prune --production
 ```
 
diff --git a/src/install/dedupe.rs b/src/install/dedupe.rs
index e524e2b6e54a..bf50240ada80 100644
--- a/src/install/dedupe.rs
+++ b/src/install/dedupe.rs
@@ -325,8 +325,15 @@ fn sort_by_name_then_version(lockfile: &Lockfile, ids: &mut [PackageID]) {
     index_sort::sort_indices(ids, &mut |a, b| order_by_name_then_version(lockfile, a, b));
 }
 
-// (name, removed version, surviving version(s) its dependents now resolve to)
-type Row = (Box<[u8]>, Box<[u8]>, Box<[u8]>);
+struct Row {
+    name: Box<[u8]>,
+    /// The removed version.
+    from: Box<[u8]>,
+    /// Surviving version(s); empty when `from` is dropped outright.
+    to: Box<[u8]>,
+    /// Every survivor is a lower major than `from`.
+    downgrade: bool,
+}
 
 #[derive(Default)]
 pub(crate) struct Report {
@@ -540,8 +547,9 @@ fn dedupe_lockfile(lockfile: &mut Lockfile) -> Report {
         .iter()
         .zip(&targets)
         .map(|(&id, moved_to)| {
+            let from_version = pkg_res[id as usize].npm().version;
             let mut from: Vec<u8> = Vec::new();
-            let _ = write!(from, "{}", pkg_res[id as usize].npm().version.fmt(buf));
+            let _ = write!(from, "{}", from_version.fmt(buf));
             let mut survivors: Vec<PackageID> = moved_to.clone();
             index_sort::sort_vec_by(&mut survivors, |&a, &b| {
                 pkg_res[a as usize]
@@ -556,11 +564,15 @@ fn dedupe_lockfile(lockfile: &mut Lockfile) -> Report {
                 }
                 let _ = write!(to, "{}", pkg_res[c as usize].npm().version.fmt(buf));
             }
-            (
-                Box::from(names[id as usize].slice(buf)),
-                from.into_boxed_slice(),
-                to.into_boxed_slice(),
-            )
+            let downgrade = survivors
+                .last()
+                .is_some_and(|&c| pkg_res[c as usize].npm().version.major < from_version.major);
+            Row {
+                name: Box::from(names[id as usize].slice(buf)),
+                from: from.into_boxed_slice(),
+                to: to.into_boxed_slice(),
+                downgrade,
+            }
         })
         .collect();
 
@@ -730,7 +742,7 @@ fn report_already_deduplicated(manager: &PackageManager, report: &Report) -> ! {
                 bun_core::pretty!("\n");
             }
             bun_core::pretty!(
-                "🎉 <green>No duplicates<r> <d>— checked {} package{}, every one already resolves to a single version<r> ",
+                "🎉 <green>No duplicates<r> <d>— checked {} package{} in bun.lock, every one already resolves to a single version<r> ",
                 report.checked,
                 plural(report.checked)
             );
@@ -758,7 +770,7 @@ fn print_would_remove(manager: &PackageManager, report: &Report) {
     }
     let n = report.rows.len();
     bun_core::pretty!(
-        "\n<b>{}<r> duplicate version{} can be removed <d>(checked {} package{})<r> ",
+        "\n<b>{}<r> duplicate version{} can be removed <d>(checked {} package{} in bun.lock)<r> ",
         n,
         plural(n),
         report.checked,
@@ -774,22 +786,32 @@ fn print_rows(report: &Report) {
     } else {
         ("~", "->")
     };
-    for (name, from, to) in &report.rows {
-        if to.is_empty() {
+    for row in &report.rows {
+        if row.to.is_empty() {
+            bun_core::prettyln!(
+                "<cyan>{}<r> <b>{}<r> <d>{} {} (removed)<r>",
+                glyph,
+                BStr::new(&row.name),
+                BStr::new(&row.from),
+                arrow
+            );
+        } else if row.downgrade {
             bun_core::prettyln!(
-                "<cyan>{}<r> <b>{}<r> <d>{}<r>",
+                "<cyan>{}<r> <b>{}<r> <d>{} {}<r> <b>{}<r> <yellow>(downgrade)<r>",
                 glyph,
-                BStr::new(name),
-                BStr::new(from)
+                BStr::new(&row.name),
+                BStr::new(&row.from),
+                arrow,
+                BStr::new(&row.to)
             );
         } else {
             bun_core::prettyln!(
                 "<cyan>{}<r> <b>{}<r> <d>{} {}<r> <b>{}<r>",
                 glyph,
-                BStr::new(name),
-                BStr::new(from),
+                BStr::new(&row.name),
+                BStr::new(&row.from),
                 arrow,
-                BStr::new(to)
+                BStr::new(&row.to)
             );
         }
     }
@@ -818,7 +840,7 @@ pub(crate) fn print_dedupe_summary(manager: &PackageManager, installed: u32, sta
         );
     }
     bun_core::pretty!(
-        " <d>(checked {} package{})<r> ",
+        " <d>(checked {} package{} in bun.lock)<r> ",
         report.checked,
         plural(report.checked)
     );
diff --git a/src/install/prune.rs b/src/install/prune.rs
index 85376162d1e5..e4d382b4009e 100644
--- a/src/install/prune.rs
+++ b/src/install/prune.rs
@@ -14,7 +14,7 @@ use crate::isolated_install::store::{EntryColumns as _, NodeColumns as _, entry
 use crate::isolated_install::{Store, Timings, build_store};
 use crate::lockfile::package::PackageColumns as _;
 use crate::lockfile::tree::is_filtered_dependency_or_workspace;
-use crate::lockfile::{LoadResult, Lockfile, reachable, tree};
+use crate::lockfile::{LoadResult, Lockfile, PackageIndexEntry, reachable, tree};
 use crate::lockfile_real::package::{Diff, DiffSummary, Package};
 use crate::package_manager::Options::{Enable, LogLevel};
 use crate::package_manager::ROOT_PACKAGE_JSON_PATH;
@@ -311,7 +311,7 @@ pub fn prune(manager: &mut PackageManager, original_cwd: &[u8]) -> crate::Result
                 .filter(|f| matches!(f.kind, FolderKind::NodeModules | FolderKind::Store))
                 .count();
             bun_core::pretty!(
-                "<r><green>Done<r>! Checked <green>{} package{}<r> across {} folder{} <d>(nothing to prune)<r> ",
+                "<r><green>Done<r>! Checked <green>{} installed package{}<r> across {} folder{} <d>(nothing to prune)<r> ",
                 checked,
                 plural(checked),
                 folders,
@@ -333,10 +333,11 @@ pub fn prune(manager: &mut PackageManager, original_cwd: &[u8]) -> crate::Result
                 plan.print_row(removal);
             }
             bun_core::pretty!(
-                "<r><b>{}<r> package{} can be removed <d>(checked {})<r> ",
+                "<r><b>{}<r> package{} can be removed <d>(checked {} installed package{})<r> ",
                 n,
                 plural(n),
-                checked
+                checked,
+                plural(checked)
             );
             print_elapsed();
             print_apply_hint();
@@ -354,7 +355,11 @@ pub fn prune(manager: &mut PackageManager, original_cwd: &[u8]) -> crate::Result
         if failed > 0 {
             bun_core::pretty!(", <red>{} failed<r>", failed);
         }
-        bun_core::pretty!(" <d>(checked {})<r> ", checked);
+        bun_core::pretty!(
+            " <d>(checked {} installed package{})<r> ",
+            checked,
+            plural(checked)
+        );
         print_elapsed();
     }
     if failed > 0 {
@@ -641,10 +646,13 @@ struct HoistedTree<'a> {
     paths: Vec<u8>,
     expected: Vec<(&'a [u8], PackageID)>,
     quiet: bool,
+    /// The expected tree excludes dev/optional/peer dependencies.
+    filtered: bool,
     kept_mismatched: Cell<bool>,
     checked: RefCell<DynamicBitSet>,
     matched: RefCell<DynamicBitSet>,
     missing: RefCell<DynamicBitSet>,
+    other_version: RefCell<DynamicBitSet>,
 }
 
 #[derive(Clone, Copy, PartialEq, Eq)]
@@ -652,10 +660,14 @@ enum Installed {
     Matches,
     Missing,
     Mismatch,
+    /// A version the lockfile installs elsewhere; the filter just favors a
+    /// different copy at this position, so it is kept without warning.
+    /// Only produced when `filtered` is set.
+    OtherVersion,
 }
 
 impl<'a> HoistedTree<'a> {
-    fn init(lockfile: &'a Lockfile, quiet: bool) -> HoistedTree<'a> {
+    fn init(lockfile: &'a Lockfile, quiet: bool, filtered: bool) -> HoistedTree<'a> {
         let trees = lockfile.buffers.trees.as_slice();
         let deps = lockfile.buffers.dependencies.as_slice();
         let resolutions = lockfile.buffers.resolutions.as_slice();
@@ -700,6 +712,7 @@ impl<'a> HoistedTree<'a> {
         let checked = handle_oom(DynamicBitSet::init_empty(expected.len()));
         let matched = handle_oom(DynamicBitSet::init_empty(expected.len()));
         let missing = handle_oom(DynamicBitSet::init_empty(expected.len()));
+        let other_version = handle_oom(DynamicBitSet::init_empty(expected.len()));
         HoistedTree {
             lockfile,
             trees,
@@ -707,10 +720,12 @@ impl<'a> HoistedTree<'a> {
             paths,
             expected,
             quiet,
+            filtered,
             kept_mismatched: Cell::new(false),
             checked: RefCell::new(checked),
             matched: RefCell::new(matched),
             missing: RefCell::new(missing),
+            other_version: RefCell::new(other_version),
         }
     }
 
@@ -750,8 +765,10 @@ impl<'a> HoistedTree<'a> {
         };
         let (alias, pkg_id) = self.expected[idx];
         let installed = self.verified_installed(id, idx, alias, pkg_id);
-        if installed == Installed::Matches {
-            return true;
+        match installed {
+            Installed::Matches => return true,
+            Installed::OtherVersion => return false,
+            Installed::Missing | Installed::Mismatch => {}
         }
         self.kept_mismatched.set(true);
         if !self.quiet {
@@ -789,6 +806,8 @@ impl<'a> HoistedTree<'a> {
                 Installed::Matches
             } else if self.missing.borrow().is_set(idx) {
                 Installed::Missing
+            } else if self.other_version.borrow().is_set(idx) {
+                Installed::OtherVersion
             } else {
                 Installed::Mismatch
             };
@@ -798,6 +817,7 @@ impl<'a> HoistedTree<'a> {
         match installed {
             Installed::Matches => self.matched.borrow_mut().set(idx),
             Installed::Missing => self.missing.borrow_mut().set(idx),
+            Installed::OtherVersion => self.other_version.borrow_mut().set(idx),
             Installed::Mismatch => {}
         }
         installed
@@ -837,12 +857,20 @@ impl<'a> HoistedTree<'a> {
         let expected_name = self.lockfile.packages.items_name()[pkg_id as usize].slice(buf);
         let matches = match res.tag {
             ResolutionTag::Npm => {
-                installed_package_json(&package).is_some_and(|(name, version)| {
-                    let expected = res.npm().version.fmt(buf).to_string();
-                    version.is_some_and(|version| {
-                        without_build(&version) == without_build(expected.as_bytes())
-                    }) && name == expected_name
-                })
+                let Some((name, Some(version))) = installed_package_json(&package) else {
+                    return Installed::Mismatch;
+                };
+                if name != expected_name {
+                    return Installed::Mismatch;
+                }
+                let expected = res.npm().version.fmt(buf).to_string();
+                if without_build(&version) == without_build(expected.as_bytes()) {
+                    return Installed::Matches;
+                }
+                if self.filtered && self.version_in_lockfile(pkg_id, &version) {
+                    return Installed::OtherVersion;
+                }
+                return Installed::Mismatch;
             }
             ResolutionTag::Git | ResolutionTag::Github => {
                 sys::File::read_from(package.fd(), b".bun-tag")
@@ -859,6 +887,29 @@ impl<'a> HoistedTree<'a> {
             Installed::Mismatch
         }
     }
+
+    /// Whether some npm package with the same name in the lockfile resolves
+    /// to `version`.
+    fn version_in_lockfile(&self, pkg_id: PackageID, version: &[u8]) -> bool {
+        let lockfile = self.lockfile;
+        let buf = lockfile.buffers.string_bytes.as_slice();
+        let name_hash = lockfile.packages.items_name_hash()[pkg_id as usize];
+        let Some(entry) = lockfile.package_index.get(&name_hash) else {
+            return false;
+        };
+        let ids: &[PackageID] = match entry {
+            PackageIndexEntry::Id(id) => core::slice::from_ref(id),
+            PackageIndexEntry::Ids(ids) => ids,
+        };
+        let pkg_res = lockfile.packages.items_resolution();
+        ids.iter().any(|&id| {
+            pkg_res.get(id as usize).is_some_and(|res| {
+                res.tag == ResolutionTag::Npm
+                    && without_build(version)
+                        == without_build(res.npm().version.fmt(buf).to_string().as_bytes())
+            })
+        })
+    }
 }
 
 fn installed_package_json(package: &Dir) -> Option<(Vec<u8>, Option<Vec<u8>>)> {
@@ -904,8 +955,12 @@ fn plan_hoisted(
     hoist_filtered(manager);
 
     let quiet = manager.options.log_level == LogLevel::Silent;
+    let features = manager.options.local_package_features;
+    let filtered = !features.dev_dependencies
+        || !features.optional_dependencies
+        || !features.peer_dependencies;
     let lockfile: &Lockfile = &manager.lockfile;
-    let hoisted = HoistedTree::init(lockfile, quiet);
+    let hoisted = HoistedTree::init(lockfile, quiet, filtered);
     let buf = lockfile.buffers.string_bytes.as_slice();
     let deps = lockfile.buffers.dependencies.as_slice();
     let trees = lockfile.buffers.trees.as_slice();
@@ -1089,8 +1144,8 @@ pub(crate) fn remove_collapsed_copies(manager: &PackageManager, before: &Lockfil
         return;
     }
     let quiet = manager.options.log_level == LogLevel::Silent;
-    let old = HoistedTree::init(before, true);
-    let new = HoistedTree::init(after, quiet);
+    let old = HoistedTree::init(before, true, false);
+    let new = HoistedTree::init(after, quiet, false);
     let targets = manager.filtered_link_targets.as_ref();
     let selected: Option<Vec<PackageID>> = targets.map(|targets| targets.package_ids(before));
     let importers = selected.as_ref().map(|_| tree_importers(before));
diff --git a/src/runtime/cli/package_manager_command.rs b/src/runtime/cli/package_manager_command.rs
index 05cfe0a302ca..3cd4c0af057e 100644
--- a/src/runtime/cli/package_manager_command.rs
+++ b/src/runtime/cli/package_manager_command.rs
@@ -619,7 +619,7 @@ Learn more about these at <magenta>https://bun.com/docs/cli/pm<r>.\n";
                 let root_deps = slice.items_dependencies()[0];
 
                 Output::println(format_args!(
-                    "{} node_modules ({})",
+                    "{} node_modules ({} installed)",
                     bstr::BStr::new(path),
                     lockfile.buffers.hoisted_dependencies.len(),
                 ));
diff --git a/src/runtime/cli/pm_licenses_command.rs b/src/runtime/cli/pm_licenses_command.rs
index 0079a85383ee..ad4da0f6fd8e 100644
--- a/src/runtime/cli/pm_licenses_command.rs
+++ b/src/runtime/cli/pm_licenses_command.rs
@@ -154,6 +154,15 @@ impl PmLicensesCommand {
             (selection.ids, false)
         };
 
+        // After the exits above so error output keeps a clean stdout.
+        if pm.options.should_print_command_name() && !json_output {
+            bun_core::pretty!(
+                "<r><b>bun pm licenses <r><d>v{}<r>\n\n",
+                Global::package_json_version_with_sha
+            );
+            Output::flush();
+        }
+
         let options = reachable::Options {
             root: 0,
             dev: features.dev_dependencies,
@@ -300,7 +309,12 @@ impl PmLicensesCommand {
         if json_output {
             print_json(&entries);
         } else {
-            print_text(&entries, flags.long, checked);
+            print_text(
+                &entries,
+                flags.long,
+                checked,
+                pm.options.should_print_command_name(),
+            );
         }
 
         Output::flush();
@@ -681,18 +695,29 @@ impl DiskIndex {
     }
 }
 
-fn print_text(entries: &[Entry], long: bool, checked: usize) {
+fn plural(n: usize) -> &'static str {
+    if n == 1 { "" } else { "s" }
+}
+
+fn print_text(entries: &[Entry], long: bool, checked: usize, summary: bool) {
     if entries.is_empty() {
-        bun_core::pretty!(
-            "No packages to list <d>(checked {} package{} in bun.lock)<r> ",
-            checked,
-            if checked == 1 { "" } else { "s" }
-        );
-        Output::print_start_end_stdout(bun_core::start_time(), bun_core::time::nano_timestamp());
+        bun_core::pretty!("No packages to list");
+        if summary {
+            bun_core::pretty!(
+                " <d>(checked {} package{} in bun.lock)<r> ",
+                checked,
+                plural(checked)
+            );
+            Output::print_start_end_stdout(
+                bun_core::start_time(),
+                bun_core::time::nano_timestamp(),
+            );
+        }
         bun_core::pretty!("\n");
         return;
     }
 
+    let mut licenses = 0;
     let mut start = 0;
     while start < entries.len() {
         let license = &entries[start].license;
@@ -704,6 +729,7 @@ fn print_text(entries: &[Entry], long: bool, checked: usize) {
         if start > 0 {
             Output::print(format_args!("\n"));
         }
+        licenses += 1;
         bun_core::prettyln!(
             "<b>{}<r> <d>({})<r>",
             BStr::new(&printable(license)),
@@ -737,6 +763,20 @@ fn print_text(entries: &[Entry], long: bool, checked: usize) {
 
         start = end;
     }
+
+    if summary {
+        bun_core::pretty!(
+            "\n<b>{}<r> package{} across {} license{} <d>(checked {} package{} in bun.lock)<r> ",
+            entries.len(),
+            plural(entries.len()),
+            licenses,
+            plural(licenses),
+            checked,
+            plural(checked)
+        );
+        Output::print_start_end_stdout(bun_core::start_time(), bun_core::time::nano_timestamp());
+        bun_core::pretty!("\n");
+    }
 }
 
 fn json_string(out: &mut Vec<u8>, s: &[u8]) {
diff --git a/test/cli/install/bun-dedupe.test.ts b/test/cli/install/bun-dedupe.test.ts
index 0bae63226a61..72873a224653 100644
--- a/test/cli/install/bun-dedupe.test.ts
+++ b/test/cli/install/bun-dedupe.test.ts
@@ -55,9 +55,9 @@ const packagesWord = (n: number) => `${n} package${n === 1 ? "" : "s"}`;
 const versionsWord = (n: number) => `${n} duplicate version${n === 1 ? "" : "s"}`;
 
 const noDuplicates = (checked: number) =>
-  `🎉 No duplicates — checked ${packagesWord(checked)}, every one already resolves to a single version`;
+  `🎉 No duplicates — checked ${packagesWord(checked)} in bun.lock, every one already resolves to a single version`;
 const wouldRemove = (removed: number, checked: number) =>
-  `${versionsWord(removed)} can be removed (checked ${packagesWord(checked)})`;
+  `${versionsWord(removed)} can be removed (checked ${packagesWord(checked)} in bun.lock)`;
 const HINT = "  bun dedupe";
 
 const row = (label: string) => `~ ${label}`;
@@ -77,7 +77,7 @@ function removedSummary(removed: number, checked?: number) {
   return new RegExp(
     `^${versionsWord(removed)} removed(, [1-9]\\d* packages? installed)? \\(checked ${
       checked === undefined ? "[1-9]\\d* packages?" : packagesWord(checked)
-    }\\)$`,
+    } in bun\\.lock\\)$`,
   );
 }
 
@@ -125,7 +125,7 @@ function expectNoDuplicates({ stdout, stderr, exitCode }: Result, checked?: numb
     ...kept,
     ...(kept.length ? [""] : []),
     checked === undefined
-      ? expect.stringMatching(/^🎉 No duplicates — checked [1-9]\d* packages?, /)
+      ? expect.stringMatching(/^🎉 No duplicates — checked [1-9]\d* packages? in bun\.lock, /)
       : noDuplicates(checked),
   ]);
   expectTimed(stdout, NO_DUPLICATES);
@@ -215,7 +215,7 @@ test.concurrent("collapses a range onto the exact version that satisfies every e
     HEADER,
     "~ no-deps 1.1.0 -> 1.0.0",
     "",
-    "1 duplicate version removed (checked 4 packages)",
+    "1 duplicate version removed (checked 4 packages in bun.lock)",
   ]);
   expectRemoved(stdout, "no-deps 1.1.0 -> 1.0.0", { checked: 4 });
   expect(lines(stderr)).toStrictEqual(["Saved lockfile"]);
@@ -279,7 +279,7 @@ test.concurrent("--check reports and exits 1 without writing", async () => {
       "bun dedupe <version> (<revision>)",
       "~ no-deps 1.1.0 -> 1.0.0",
       "",
-      "1 duplicate version can be removed (checked 4 packages)",
+      "1 duplicate version can be removed (checked 4 packages in bun.lock)",
       "  bun dedupe",
     ]
   `);
@@ -347,7 +347,7 @@ test.concurrent("already deduplicated", async () => {
   expect(lines(second.stdout)).toMatchInlineSnapshot(`
     [
       "bun dedupe <version> (<revision>)",
-      "🎉 No duplicates — checked 3 packages, every one already resolves to a single version",
+      "🎉 No duplicates — checked 3 packages in bun.lock, every one already resolves to a single version",
     ]
   `);
   expect(second.stderr).toBe("");
@@ -672,7 +672,7 @@ test.concurrent("cascading removal lists every unreachable duplicate in name ord
     expect(lockfile).toContain(label);
   }
 
-  const rows = ["no-deps 2.0.0", "one-fixed-dep 2.0.0 -> 1.0.0"];
+  const rows = ["no-deps 2.0.0 -> (removed)", "one-fixed-dep 2.0.0 -> 1.0.0 (downgrade)"];
   const checked = lockPackageCount(lockfile);
   expect(checked).toBe(5);
   const check = await dedupe(packageDir, "--check");
@@ -706,7 +706,7 @@ test.concurrent("multiple names removed in one run are sorted, scoped names firs
     expect(lockfile).toContain(label);
   }
 
-  const rows = ["@types/is-number 2.0.0 -> 1.0.0", "no-deps 1.1.0 -> 1.0.0"];
+  const rows = ["@types/is-number 2.0.0 -> 1.0.0 (downgrade)", "no-deps 1.1.0 -> 1.0.0"];
   const checked = lockPackageCount(lockfile);
   expect(checked).toBe(6);
   const check = await dedupe(packageDir, "--check");
@@ -850,7 +850,7 @@ test.concurrent("the report is printed as one block after root lifecycle script
   expect(out.slice(firstRow)).toStrictEqual([
     "~ no-deps 1.1.0 -> 1.0.0",
     "",
-    "1 duplicate version removed (checked 4 packages)",
+    "1 duplicate version removed (checked 4 packages in bun.lock)",
   ]);
   expectRemoved(stdout, "no-deps 1.1.0 -> 1.0.0", { checked: 4 });
   expect(stderr).not.toContain("error:");
@@ -945,7 +945,7 @@ test.concurrent("--lockfile-only rewrites bun.lock without installing", async ()
     HEADER,
     "~ no-deps 1.1.0 -> 1.0.0",
     "",
-    "1 duplicate version removed (checked 4 packages)",
+    "1 duplicate version removed (checked 4 packages in bun.lock)",
   ]);
   expectRemoved(stdout, "no-deps 1.1.0 -> 1.0.0", { checked: 4 });
   expect(lines(stderr)).toStrictEqual(["Saved lockfile"]);
@@ -1554,7 +1554,7 @@ test.concurrent("a version that is the only way to reach a patched package is ke
       "~ dep-with-tags 3.0.1 -> 3.0.0",
       "  kept one-fixed-dep@1.0.0 (needed to reach patched no-deps@1.0.0)",
       "",
-      "1 duplicate version can be removed (checked 7 packages)",
+      "1 duplicate version can be removed (checked 7 packages in bun.lock)",
       "  bun dedupe",
     ]
   `);
@@ -1588,7 +1588,7 @@ test.concurrent("a version that is the only way to reach a patched package is ke
       "bun dedupe <version> (<revision>)",
       "  kept one-fixed-dep@1.0.0 (needed to reach patched no-deps@1.0.0)",
       "",
-      "🎉 No duplicates — checked 6 packages, every one already resolves to a single version",
+      "🎉 No duplicates — checked 6 packages in bun.lock, every one already resolves to a single version",
     ]
   `);
   expectNoDuplicates(recheck, 6, kept);
@@ -1631,7 +1631,7 @@ test.concurrent("a version removed by the run does not vote for its own dependen
   }
   expect(await nodeModulesVersion(packageDir, "no-deps")).toBe("1.1.0");
 
-  const rows = ["no-deps 1.0.0", "one-fixed-dep 1.0.0 -> 2.0.0"];
+  const rows = ["no-deps 1.0.0 -> (removed)", "one-fixed-dep 1.0.0 -> 2.0.0"];
   const checked = lockPackageCount(lockfile);
   expect(checked).toBe(7);
   const check = await dedupe(packageDir, "--check");
@@ -1837,7 +1837,7 @@ test.concurrent("a lockfile whose root has no dependencies is reported as dedupl
   expect(lines(check.stdout)).toMatchInlineSnapshot(`
     [
       "bun dedupe <version> (<revision>)",
-      "🎉 No duplicates — checked 1 package, every one already resolves to a single version",
+      "🎉 No duplicates — checked 1 package in bun.lock, every one already resolves to a single version",
     ]
   `);
   expectNoDuplicates(check, 1);
@@ -1905,7 +1905,9 @@ test.concurrent("migrates package-lock.json when there is no bun.lock", async ()
   // Nothing was installed before this run, so the summary also carries the install count.
   const { stdout, stderr, exitCode } = await dedupe(packageDir);
   expectRemoved(stdout, "no-deps 1.1.0 -> 1.0.0", { checked: 4 });
-  expect(lines(stdout).at(-1)).toBe("1 duplicate version removed, 2 packages installed (checked 4 packages)");
+  expect(lines(stdout).at(-1)).toBe(
+    "1 duplicate version removed, 2 packages installed (checked 4 packages in bun.lock)",
+  );
   expect(stderr).toContain("migrated lockfile from package-lock.json");
   expect(stderr).toContain("Saved lockfile");
   expect(stderr).not.toContain("error:");
diff --git a/test/cli/install/bun-install-lifecycle-scripts.test.ts b/test/cli/install/bun-install-lifecycle-scripts.test.ts
index 636331993ff3..45ceb6e999b4 100644
--- a/test/cli/install/bun-install-lifecycle-scripts.test.ts
+++ b/test/cli/install/bun-install-lifecycle-scripts.test.ts
@@ -2874,7 +2874,7 @@ for (const forceWaiterThread of isLinux ? [false, true] : [false]) {
         });
         const out = await stdout.text();
         expect(await stderr.text()).toBe("");
-        expect(out).toBe(`${packageDir} node_modules (2)
+        expect(out).toBe(`${packageDir} node_modules (2 installed)
 └── electron@1.0.0
 `);
         expect(await exited).toBe(0);
@@ -2919,7 +2919,7 @@ for (const forceWaiterThread of isLinux ? [false, true] : [false]) {
         });
         const out = await stdout.text();
         expect(await stderr.text()).toBe("");
-        expect(out).toBe(`${packageDir} node_modules (2)
+        expect(out).toBe(`${packageDir} node_modules (2 installed)
 └── no-deps@1.0.0
 `);
         expect(await exited).toBe(0);
diff --git a/test/cli/install/bun-pm-licenses.test.ts b/test/cli/install/bun-pm-licenses.test.ts
index 791f5260f09b..ec349296495a 100644
--- a/test/cli/install/bun-pm-licenses.test.ts
+++ b/test/cli/install/bun-pm-licenses.test.ts
@@ -60,11 +60,13 @@ async function gitRepo(manifest: Record<string, unknown>) {
   return repoDir;
 }
 
+const HEADER = "bun pm licenses <version> (<revision>)";
+
 const emptyText = (checked: number) => `No packages to list (checked ${checked} packages in bun.lock)`;
 
 function expectEmptyText(stdout: string, checked: number) {
-  expect(normalizeBunSnapshot(stdout)).toBe(emptyText(checked));
-  expect(stdout).toMatch(/^No packages to list \(checked \d+ packages in bun\.lock\) \[\d+\.\d+m?s\]\n$/);
+  expect(normalizeBunSnapshot(stdout)).toBe(`${HEADER}\n\n${emptyText(checked)}`);
+  expect(stdout).toMatch(/\nNo packages to list \(checked \d+ packages in bun\.lock\) \[\d+\.\d+m?s\]\n$/);
 }
 
 const MISSING_NOTE = "note: run 'bun install' first";
@@ -269,7 +271,9 @@ describe("bun pm licenses", () => {
   test.concurrent("text output groups packages by license, Unknown last, dev-only packages marked", async () => {
     const [stdout, stderr, exitCode] = await licenses(hoistedDir);
     expect(normalizeBunSnapshot(stdout)).toMatchInlineSnapshot(`
-      "MIT (2)
+      "bun pm licenses <version> (<revision>)
+
+      MIT (2)
       ├── path-parse@1.0.6
       └── resolve@1.9.0
 
@@ -277,7 +281,9 @@ describe("bun pm licenses", () => {
       ├── a-dep@1.0.1 (dev)
       ├── no-deps@1.0.0
       ├── no-deps@1.0.1
-      └── one-dep@1.0.0"
+      └── one-dep@1.0.0
+
+      6 packages across 2 licenses (checked 6 packages in bun.lock)"
     `);
     expect(stdout.split("\n").filter(line => line.endsWith(" (dev)"))).toStrictEqual(["├── a-dep@1.0.1 (dev)"]);
     expect(stdout).not.toContain(hoistedDir);
@@ -355,7 +361,9 @@ describe("bun pm licenses", () => {
 
     const [stdout, stderr, exitCode] = await licenses(dir);
     expect(normalizeBunSnapshot(stdout)).toMatchInlineSnapshot(`
-      "BSD-3-Clause (1)
+      "bun pm licenses <version> (<revision>)
+
+      BSD-3-Clause (1)
       └── no-deps@1.0.1
 
       ISC (1)
@@ -377,7 +385,9 @@ describe("bun pm licenses", () => {
       └── a-dep@1.0.9
 
       Unknown (1)
-      └── uses-a-dep-9@1.0.0"
+      └── uses-a-dep-9@1.0.0
+
+      8 packages across 8 licenses (checked 8 packages in bun.lock)"
     `);
     expect(stderr).toBe("");
     expect(exitCode).toBe(0);
@@ -491,11 +501,15 @@ describe("bun pm licenses", () => {
 
     const [stdout, stderr, exitCode] = await licenses(dir);
     expect(normalizeBunSnapshot(stdout)).toMatchInlineSnapshot(`
-      "Unknown (4)
+      "bun pm licenses <version> (<revision>)
+
+      Unknown (4)
       ├── a-dep@1.0.9
       ├── a-dep@1.0.10
       ├── uses-a-dep-10@1.0.0
-      └── uses-a-dep-9@1.0.0"
+      └── uses-a-dep-9@1.0.0
+
+      4 packages across 1 license (checked 4 packages in bun.lock)"
     `);
     expect(stderr).toBe("");
     expect(exitCode).toBe(0);
@@ -511,9 +525,13 @@ describe("bun pm licenses", () => {
 
     const [stdout, stderr, exitCode] = await licenses(dir);
     expect(normalizeBunSnapshot(stdout)).toMatchInlineSnapshot(`
-      "Unknown (2)
+      "bun pm licenses <version> (<revision>)
+
+      Unknown (2)
       ├── a-dep@1.0.9
-      └── uses-a-dep-9@1.0.0 (dev)"
+      └── uses-a-dep-9@1.0.0 (dev)
+
+      2 packages across 1 license (checked 2 packages in bun.lock)"
     `);
     expect(stderr).toBe("");
     expect(exitCode).toBe(0);
@@ -531,9 +549,13 @@ describe("bun pm licenses", () => {
       Unknown: [u("a-dep", "1.0.9"), u("uses-a-dep-9", "1.0.0")],
     });
     expect(normalizeBunSnapshot(await licensesText(dir, "--dev"))).toMatchInlineSnapshot(`
-      "Unknown (2)
+      "bun pm licenses <version> (<revision>)
+
+      Unknown (2)
       ├── a-dep@1.0.9
-      └── uses-a-dep-9@1.0.0 (dev)"
+      └── uses-a-dep-9@1.0.0 (dev)
+
+      2 packages across 1 license (checked 2 packages in bun.lock)"
     `);
   });
 
@@ -547,21 +569,29 @@ describe("bun pm licenses", () => {
     });
 
     expect(normalizeBunSnapshot(await licensesText(dir))).toMatchInlineSnapshot(`
-      "Unknown (6)
+      "bun pm licenses <version> (<revision>)
+
+      Unknown (6)
       ├── a-dep@1.0.9 (dev)
       ├── a-dep@1.0.10
       ├── no-deps@1.0.1
       ├── one-dep@1.0.0 (dev)
       ├── uses-a-dep-10@1.0.0
-      └── uses-a-dep-9@1.0.0 (dev)"
+      └── uses-a-dep-9@1.0.0 (dev)
+
+      6 packages across 1 license (checked 6 packages in bun.lock)"
     `);
 
     expect(normalizeBunSnapshot(await licensesText(dir, "--dev"))).toMatchInlineSnapshot(`
-      "Unknown (4)
+      "bun pm licenses <version> (<revision>)
+
+      Unknown (4)
       ├── a-dep@1.0.9 (dev)
       ├── no-deps@1.0.1
       ├── one-dep@1.0.0 (dev)
-      └── uses-a-dep-9@1.0.0 (dev)"
+      └── uses-a-dep-9@1.0.0 (dev)
+
+      4 packages across 1 license (checked 4 packages in bun.lock)"
     `);
     expect(await licensesJson(dir, "--dev")).toStrictEqual({
       Unknown: [u("a-dep", "1.0.9"), u("no-deps", "1.0.1"), u("one-dep", "1.0.0"), u("uses-a-dep-9", "1.0.0")],
@@ -577,14 +607,22 @@ describe("bun pm licenses", () => {
     expect(await licensesJson(dir, "--dev")).toStrictEqual(expected);
     expect(await licensesJson(dir, "-D")).toStrictEqual(expected);
     expect(normalizeBunSnapshot(await licensesText(dir, "--dev"))).toMatchInlineSnapshot(`
-      "Unknown (2)
+      "bun pm licenses <version> (<revision>)
+
+      Unknown (2)
       ├── no-deps@1.0.1 (dev)
-      └── one-dep@1.0.0 (dev)"
+      └── one-dep@1.0.0 (dev)
+
+      2 packages across 1 license (checked 2 packages in bun.lock)"
     `);
 
     expect(normalizeBunSnapshot(await licensesText(hoistedDir, "--dev"))).toMatchInlineSnapshot(`
-      "Unknown (1)
-      └── a-dep@1.0.1 (dev)"
+      "bun pm licenses <version> (<revision>)
+
+      Unknown (1)
+      └── a-dep@1.0.1 (dev)
+
+      1 package across 1 license (checked 1 package in bun.lock)"
     `);
     expect(await licensesJson(hoistedDir, "--dev")).toStrictEqual({ Unknown: [u("a-dep", "1.0.1")] });
   });
@@ -620,14 +658,18 @@ describe("bun pm licenses", () => {
   test.concurrent("--prod omits devDependencies (text)", async () => {
     const [stdout, stderr, exitCode] = await licenses(hoistedDir, "--prod");
     expect(normalizeBunSnapshot(stdout)).toMatchInlineSnapshot(`
-      "MIT (2)
+      "bun pm licenses <version> (<revision>)
+
+      MIT (2)
       ├── path-parse@1.0.6
       └── resolve@1.9.0
 
       Unknown (3)
       ├── no-deps@1.0.0
       ├── no-deps@1.0.1
-      └── one-dep@1.0.0"
+      └── one-dep@1.0.0
+
+      5 packages across 2 licenses (checked 5 packages in bun.lock)"
     `);
     expect(stderr).toBe("");
     expect(exitCode).toBe(0);
@@ -669,7 +711,9 @@ describe("bun pm licenses", () => {
   test.concurrent("--long prints author, description and homepage under each entry", async () => {
     const [stdout, stderr, exitCode] = await licenses(hoistedDir, "--long");
     expect(normalizeBunSnapshot(stdout)).toMatchInlineSnapshot(`
-      "MIT (2)
+      "bun pm licenses <version> (<revision>)
+
+      MIT (2)
       ├── path-parse@1.0.6
       │   Javier Blanco <http://jbgutierrez.info>
       │   Node.js path.parse() ponyfill
@@ -683,12 +727,14 @@ describe("bun pm licenses", () => {
       ├── a-dep@1.0.1 (dev)
       ├── no-deps@1.0.0
       ├── no-deps@1.0.1
-      └── one-dep@1.0.0"
+      └── one-dep@1.0.0
+
+      6 packages across 2 licenses (checked 6 packages in bun.lock)"
     `);
     expect(stderr).toBe("");
     expect(exitCode).toBe(0);
 
-    expect(await licensesText(hoistedDir, "ls", "--long")).toBe(stdout);
+    expect(normalizeBunSnapshot(await licensesText(hoistedDir, "ls", "--long"))).toBe(normalizeBunSnapshot(stdout));
     expect(stdout).not.toContain(nm(hoistedDir));
 
     const [plainJson, longJson] = await Promise.all([
@@ -767,7 +813,9 @@ describe("bun pm licenses", () => {
       ],
     });
     expect(normalizeBunSnapshot(await licensesText(dir, "--long"))).toMatchInlineSnapshot(`
-      "MIT (2)
+      "bun pm licenses <version> (<revision>)
+
+      MIT (2)
       ├── path-parse@1.0.6
       │   Javier Blanco <http://jbgutierrez.info>
       │   Node.js path.parse() ponyfill
@@ -783,7 +831,9 @@ describe("bun pm licenses", () => {
       │   https://no-deps.example
       ├── no-deps@1.0.1
       └── one-dep@1.0.0
-          git+ssh://git@github.com/example/one-dep.git"
+          git+ssh://git@github.com/example/one-dep.git
+
+      6 packages across 2 licenses (checked 6 packages in bun.lock)"
     `);
   });
 
@@ -850,9 +900,11 @@ describe("bun pm licenses", () => {
   test.concurrent("isolated linker matches hoisted: marker, --dev and --long", async () => {
     const dir = await setup("isolated");
     const [[expected], [stdout, stderr, exitCode]] = await Promise.all([licenses(hoistedDir), licenses(dir)]);
-    expect(stdout).toBe(expected);
+    expect(normalizeBunSnapshot(stdout)).toBe(normalizeBunSnapshot(expected));
     expect(normalizeBunSnapshot(stdout)).toMatchInlineSnapshot(`
-      "MIT (2)
+      "bun pm licenses <version> (<revision>)
+
+      MIT (2)
       ├── path-parse@1.0.6
       └── resolve@1.9.0
 
@@ -860,7 +912,9 @@ describe("bun pm licenses", () => {
       ├── a-dep@1.0.1 (dev)
       ├── no-deps@1.0.0
       ├── no-deps@1.0.1
-      └── one-dep@1.0.0"
+      └── one-dep@1.0.0
+
+      6 packages across 2 licenses (checked 6 packages in bun.lock)"
     `);
     expect(stderr).toBe("");
     expect(exitCode).toBe(0);
@@ -876,8 +930,8 @@ describe("bun pm licenses", () => {
         licensesJson(dir, "--long"),
         licensesJson(hoistedDir, "--long"),
       ]);
-    expect(isoLong).toBe(hoistedLong);
-    expect(isoDev).toBe(hoistedDev);
+    expect(normalizeBunSnapshot(isoLong)).toBe(normalizeBunSnapshot(hoistedLong));
+    expect(normalizeBunSnapshot(isoDev)).toBe(normalizeBunSnapshot(hoistedDev));
     expect(isoDevJson).toStrictEqual(hoistedDevJson);
     expect(isoLongJson).toStrictEqual(hoistedLongJson);
     expect(isoLong).toContain("│   Javier Blanco <http://jbgutierrez.info>\n");
@@ -1044,13 +1098,17 @@ describe("bun pm licenses", () => {
     });
 
     expect(normalizeBunSnapshot(await licensesText(dir))).toMatchInlineSnapshot(`
-      "MIT (2)
+      "bun pm licenses <version> (<revision>)
+
+      MIT (2)
       ├── path-parse@1.0.6
       └── resolve@1.9.0
 
       Unknown (2)
       ├── a-dep@1.0.1 (dev)
-      └── no-deps@1.0.0"
+      └── no-deps@1.0.0
+
+      4 packages across 2 licenses (checked 4 packages in bun.lock)"
     `);
     expect(await licensesText(join(dir, "packages", "foo"))).toContain("├── a-dep@1.0.1 (dev)\n└── no-deps@1.0.0\n");
   });
@@ -1097,9 +1155,13 @@ describe("bun pm licenses", () => {
     expect(packagesGlob).toStrictEqual(monoJson);
     expectEmptyText(rootOnly, 0);
     expect(normalizeBunSnapshot(fooText)).toMatchInlineSnapshot(`
-      "Unknown (2)
+      "bun pm licenses <version> (<revision>)
+
+      Unknown (2)
       ├── a-dep@1.0.1 (dev)
-      └── no-deps@1.0.0"
+      └── no-deps@1.0.0
+
+      2 packages across 1 license (checked 2 packages in bun.lock)"
     `);
     expect(await licensesJson(monoDir, "--filter", "foo", "--prod")).toStrictEqual({
       Unknown: [u("no-deps", "1.0.0")],
@@ -1158,9 +1220,13 @@ describe("bun pm licenses", () => {
       `"warn: No workspace packages matched the filters "nomatch", "alsonone""`,
     );
     expect(normalizeBunSnapshot(text)).toMatchInlineSnapshot(`
-      "MIT (2)
+      "bun pm licenses <version> (<revision>)
+
+      MIT (2)
       ├── path-parse@1.0.6
-      └── resolve@1.9.0"
+      └── resolve@1.9.0
+
+      2 packages across 1 license (checked 2 packages in bun.lock)"
     `);
     expect(textExit).toBe(0);
   });
@@ -1209,6 +1275,30 @@ describe("bun pm licenses", () => {
     expect(jsonExit).toBe(0);
   });
 
+  test.concurrent("--no-summary prints the bare listing without banner or summary", async () => {
+    const [stdout, stderr, exitCode] = await licenses(hoistedDir, "--no-summary");
+    expect(normalizeBunSnapshot(stdout)).toMatchInlineSnapshot(`
+      "MIT (2)
+      ├── path-parse@1.0.6
+      └── resolve@1.9.0
+
+      Unknown (4)
+      ├── a-dep@1.0.1 (dev)
+      ├── no-deps@1.0.0
+      ├── no-deps@1.0.1
+      └── one-dep@1.0.0"
+    `);
+    expect(stderr).toBe("");
+    expect(exitCode).toBe(0);
+
+    // The empty listing keeps its message but drops the checked-count and timing.
+    const dir = await setup("hoisted", { "package.json": pkg({ devDependencies: { "no-deps": "1.0.0" } }) });
+    const [empty, emptyStderr, emptyExit] = await licenses(dir, "--prod", "--no-summary");
+    expect(empty).toBe("No packages to list\n");
+    expect(emptyStderr).toBe("");
+    expect(emptyExit).toBe(0);
+  });
+
   test.concurrent("--silent still prints the listing but no diagnostics", async () => {
     const dir = await setup();
     rmSync(nm(dir, "path-parse"), { recursive: true });
@@ -1220,7 +1310,9 @@ describe("bun pm licenses", () => {
       `warn: 1 package in bun.lock is not installed and was skipped\n${MISSING_NOTE}`,
     );
     expect(quietStderr).toBe("");
-    expect(quiet).toBe(loud);
+    // The loud run wraps the same listing in the banner and summary.
+    expect(loud).toContain(quiet);
+    expect(normalizeBunSnapshot(loud)).toStartWith(HEADER);
     expect(normalizeBunSnapshot(quiet)).toMatchInlineSnapshot(`
       "MIT (1)
       └── resolve@1.9.0
@@ -1279,8 +1371,8 @@ describe("bun pm licenses", () => {
       licenses(hoistedDir, "ls"),
     ]);
     expect(plain).toContain("MIT (2)");
-    expect(list).toBe(plain);
-    expect(ls).toBe(plain);
+    expect(normalizeBunSnapshot(list)).toBe(normalizeBunSnapshot(plain));
+    expect(normalizeBunSnapshot(ls)).toBe(normalizeBunSnapshot(plain));
     expect([plainExit, listExit, lsExit]).toStrictEqual([0, 0, 0]);
 
     const [stdout, stderr, exitCode] = await licenses(hoistedDir, "bogus");
@@ -1433,9 +1525,13 @@ describe("bun pm licenses", () => {
 
     const [stdout, stderr, exitCode] = await licenses(dir);
     expect(normalizeBunSnapshot(stdout).replace(/git\+file:\/\/\S+/, "git+file://<repo>")).toMatchInlineSnapshot(`
-      "Unknown (2)
+      "bun pm licenses <version> (<revision>)
+
+      Unknown (2)
       ├── no-deps@1.0.0
-      └── no-deps@git+file://<repo>"
+      └── no-deps@git+file://<repo>
+
+      2 packages across 1 license (checked 2 packages in bun.lock)"
     `);
     expect(stderr).toBe("");
     expect(exitCode).toBe(0);
@@ -1479,7 +1575,9 @@ describe("bun pm licenses", () => {
   test.concurrent("--omit=dev and bunfig install.production behave like --prod", async () => {
     expect(await licensesJson(hoistedDir, "--omit=dev")).toStrictEqual(prodJson);
     expect(await licensesText(hoistedDir, "--omit=dev")).not.toContain("(dev)");
-    expect(await licensesText(hoistedDir, "--omit", "dev")).toBe(await licensesText(hoistedDir, "--prod"));
+    expect(normalizeBunSnapshot(await licensesText(hoistedDir, "--omit", "dev"))).toBe(
+      normalizeBunSnapshot(await licensesText(hoistedDir, "--prod")),
+    );
 
     const dir = await setup();
     const bunfig = readFileSync(join(dir, "bunfig.toml"), "utf8");
@@ -1499,8 +1597,12 @@ describe("bun pm licenses", () => {
     expect(await licensesJson(dir)).toStrictEqual({ Unknown: [u("no-deps", "1.0.0", "1.0.1"), u("one-dep", "1.0.0")] });
     expect(await licensesJson(dir, "--omit=optional")).toStrictEqual({ Unknown: [u("no-deps", "1.0.0")] });
     expect(normalizeBunSnapshot(await licensesText(dir, "--omit=optional"))).toMatchInlineSnapshot(`
-      "Unknown (1)
-      └── no-deps@1.0.0"
+      "bun pm licenses <version> (<revision>)
+
+      Unknown (1)
+      └── no-deps@1.0.0
+
+      1 package across 1 license (checked 1 package in bun.lock)"
     `);
   });
 
@@ -1510,8 +1612,12 @@ describe("bun pm licenses", () => {
 
     expect(await licensesJson(dir)).toStrictEqual({ Unknown: [u("no-deps", "1.0.0")] });
     expect(normalizeBunSnapshot(await licensesText(dir))).toMatchInlineSnapshot(`
-      "Unknown (1)
-      └── no-deps@1.0.0"
+      "bun pm licenses <version> (<revision>)
+
+      Unknown (1)
+      └── no-deps@1.0.0
+
+      1 package across 1 license (checked 1 package in bun.lock)"
     `);
     expectEmptyText(await licensesText(dir, "--omit=peer"), 0);
     expect(await licensesJson(dir, "--omit=peer")).toStrictEqual({});
@@ -1634,7 +1740,9 @@ describe("bun pm licenses", () => {
       ],
     });
     expect(normalizeBunSnapshot(await licensesText(dir, "--long"))).toMatchInlineSnapshot(`
-      "MIT (2)
+      "bun pm licenses <version> (<revision>)
+
+      MIT (2)
       ├── path-parse@1.0.6
       │   Javier Blanco <http://jbgutierrez.info>
       │   Node.js path.parse() ponyfill
@@ -1650,7 +1758,9 @@ describe("bun pm licenses", () => {
       ├── no-deps@1.0.1
       │   (https://nd.example)
       └── one-dep@1.0.0
-          <one@example.com>"
+          <one@example.com>
+
+      6 packages across 2 licenses (checked 6 packages in bun.lock)"
     `);
   });
 
diff --git a/test/cli/install/bun-pm.test.ts b/test/cli/install/bun-pm.test.ts
index ebf54aad16ea..9f5fb0152216 100644
--- a/test/cli/install/bun-pm.test.ts
+++ b/test/cli/install/bun-pm.test.ts
@@ -73,7 +73,7 @@ it("should list top-level dependency", async () => {
     env,
   });
   expect(await stderr.text()).toBe("");
-  expect(await stdout.text()).toBe(`${package_dir} node_modules (2)
+  expect(await stdout.text()).toBe(`${package_dir} node_modules (2 installed)
 └── moo@moo
 `);
   expect(await exited).toBe(0);
@@ -244,7 +244,7 @@ it("should list top-level aliased dependency", async () => {
     env,
   });
   expect(await stderr.text()).toBe("");
-  expect(await stdout.text()).toBe(`${package_dir} node_modules (2)
+  expect(await stdout.text()).toBe(`${package_dir} node_modules (2 installed)
 └── moo-1@moo
 `);
   expect(await exited).toBe(0);
@@ -370,7 +370,7 @@ it("should list only trusted dependencies with --trusted", async () => {
       env,
     });
     expect(await stderr.text()).toBe("");
-    expect(await stdout.text()).toBe(`${package_dir} node_modules (2)
+    expect(await stdout.text()).toBe(`${package_dir} node_modules (2 installed)
 └── bar@0.0.2
 `);
     expect(await exited).toBe(0);
@@ -387,7 +387,7 @@ it("should list only trusted dependencies with --trusted", async () => {
       env,
     });
     expect(await stderr.text()).toBe("");
-    expect(await stdout.text()).toBe(`${package_dir} node_modules (2)
+    expect(await stdout.text()).toBe(`${package_dir} node_modules (2 installed)
 ├── bar@0.0.2
 └── moo@moo
 `);
@@ -579,7 +579,7 @@ it("should list nothing with --trusted when no dependencies are trusted", async
     env,
   });
   expect(await stderr.text()).toBe("");
-  expect(await stdout.text()).toBe(`${package_dir} node_modules (1)
+  expect(await stdout.text()).toBe(`${package_dir} node_modules (1 installed)
 `);
   expect(await exited).toBe(0);
 });
@@ -778,7 +778,7 @@ test.each([
     cmd: ["list"],
     packageName: "test-list",
     dependencies: { bar: "latest" },
-    expectedOutput: (dir: string) => `${dir} node_modules (1)\n└── bar@0.0.2\n`,
+    expectedOutput: (dir: string) => `${dir} node_modules (1 installed)\n└── bar@0.0.2\n`,
     checkReservationMessage: true,
   },
   {
@@ -786,7 +786,7 @@ test.each([
     cmd: ["pm", "list"],
     packageName: "test-pm-list",
     dependencies: { bar: "latest" },
-    expectedOutput: (dir: string) => `${dir} node_modules (1)\n└── bar@0.0.2\n`,
+    expectedOutput: (dir: string) => `${dir} node_modules (1 installed)\n└── bar@0.0.2\n`,
     checkReservationMessage: false,
   },
   {
@@ -794,7 +794,7 @@ test.each([
     cmd: ["pm", "ls"],
     packageName: "test-pm-ls",
     dependencies: { bar: "latest" },
-    expectedOutput: (dir: string) => `${dir} node_modules (1)\n└── bar@0.0.2\n`,
+    expectedOutput: (dir: string) => `${dir} node_modules (1 installed)\n└── bar@0.0.2\n`,
     checkReservationMessage: false,
   },
 ])("$name", async ({ cmd, packageName, dependencies, expectedOutput, checkReservationMessage }) => {
diff --git a/test/cli/install/bun-prune.test.ts b/test/cli/install/bun-prune.test.ts
index 47483f97d9f9..b59827f13b97 100644
--- a/test/cli/install/bun-prune.test.ts
+++ b/test/cli/install/bun-prune.test.ts
@@ -42,9 +42,11 @@ const PRUNED_NOTE = 'note: skipped 1 workspace listed in bun.lock but not on dis
 const BANNER = "bun prune <version> (<revision>)";
 const plural = (n: number, noun: string) => `${n} ${noun}${n === 1 ? "" : "s"}`;
 const NOTHING = (packages: number, folders: number) =>
-  `Done! Checked ${plural(packages, "package")} across ${plural(folders, "folder")} (nothing to prune)`;
-const REMOVED = (n: number, checked: number) => `${plural(n, "package")} removed (checked ${checked})`;
-const CAN_BE_REMOVED = (n: number, checked: number) => `${plural(n, "package")} can be removed (checked ${checked})`;
+  `Done! Checked ${plural(packages, "installed package")} across ${plural(folders, "folder")} (nothing to prune)`;
+const REMOVED = (n: number, checked: number) =>
+  `${plural(n, "package")} removed (checked ${plural(checked, "installed package")})`;
+const CAN_BE_REMOVED = (n: number, checked: number) =>
+  `${plural(n, "package")} can be removed (checked ${plural(checked, "installed package")})`;
 // The copy-pasteable line `--dry-run` prints last: the invocation with `--dry-run` taken out.
 const APPLY_HINT = (...flags: string[]) => ["  bun prune", ...flags].join(" ");
 const DURATION = /\) \[\d+(\.\d+)?m?s\]$/m;
@@ -283,9 +285,9 @@ test.concurrent("removes extraneous packages, keeps everything the lockfile inst
     - @other/thing
     - @scoped/junk
     - junk
-    3 packages removed (checked 5)"
+    3 packages removed (checked 5 installed packages)"
   `);
-  expect(first.stdout).toMatch(/\(checked 5\) \[\d+(\.\d+)?m?s\]\n?$/);
+  expect(first.stdout).toMatch(/\(checked 5 installed packages\) \[\d+(\.\d+)?m?s\]\n?$/);
   expect(first.exitCode).toBe(0);
 
   for (const path of planted) {
@@ -316,7 +318,7 @@ test.concurrent("prunes nested node_modules folders the tree installs into", asy
     "bun prune <version> (<revision>)
 
     - junk (node_modules/one-dep/node_modules)
-    1 package removed (checked 4)"
+    1 package removed (checked 4 installed packages)"
   `);
   expect(exitCode).toBe(0);
   expect(existsSync(junk)).toBeFalse();
@@ -344,7 +346,7 @@ test.concurrent.each([["--production"], ["--prod"], ["--omit=dev"]])(
       - no-deps-bins@1.0.0
       - one-fixed-dep-bins@1.0.0
       - what-bin@1.0.0
-      3 packages removed (checked 5)"
+      3 packages removed (checked 5 installed packages)"
     `);
     expect(exitCode).toBe(0);
 
@@ -375,7 +377,7 @@ test.concurrent("--production keeps a package that prod and dev both need", asyn
     "bun prune <version> (<revision>)
 
     - one-fixed-dep@1.0.0
-    1 package removed (checked 2)"
+    1 package removed (checked 2 installed packages)"
   `);
   expect(production.exitCode).toBe(0);
   expect(existsSync(join(dir, "node_modules", "no-deps"))).toBeTrue();
@@ -385,7 +387,7 @@ test.concurrent("--production keeps a package that prod and dev both need", asyn
   expect(out(plain.stdout)).toMatchInlineSnapshot(`
     "bun prune <version> (<revision>)
 
-    Done! Checked 2 packages across 1 folder (nothing to prune)"
+    Done! Checked 2 installed packages across 1 folder (nothing to prune)"
   `);
   expect(plain.exitCode).toBe(0);
   expect(existsSync(join(plainDir, "node_modules", "one-fixed-dep"))).toBeTrue();
@@ -400,7 +402,7 @@ test.concurrent("--dry-run prints without deleting; --silent deletes without pri
     "bun prune <version> (<revision>)
 
     - junk
-    1 package can be removed (checked 2)
+    1 package can be removed (checked 2 installed packages)
       bun prune"
   `);
   expect(dryRun.stdout).toMatch(DURATION);
@@ -458,7 +460,7 @@ test.concurrent("nothing to prune when node_modules is missing or clean", async
   expect(out(clean.stdout)).toMatchInlineSnapshot(`
     "bun prune <version> (<revision>)
 
-    Done! Checked 1 package across 1 folder (nothing to prune)"
+    Done! Checked 1 installed package across 1 folder (nothing to prune)"
   `);
   expect(clean.exitCode).toBe(0);
   expect(existsSync(join(cleanDir, "node_modules", "no-deps"))).toBeTrue();
@@ -479,7 +481,7 @@ test.concurrent("never follows symlinks out of node_modules", async () => {
     "bun prune <version> (<revision>)
 
     - linked-junk
-    1 package removed (checked 2)"
+    1 package removed (checked 2 installed packages)"
   `);
   expect(exitCode).toBe(0);
   expect(() => lstatSync(link)).toThrow();
@@ -563,7 +565,7 @@ test.concurrent("workspaces: prunes workspace folders, keeps workspace links, ru
 
     - a-dep@1.0.1
     - junk (node_modules/a/node_modules)
-    2 packages removed (checked 5)"
+    2 packages removed (checked 5 installed packages)"
   `);
   expect(exitCode).toBe(0);
 
@@ -582,7 +584,7 @@ test.concurrent("keeps dependencies bundled inside a package", async () => {
   expect(out(stdout)).toMatchInlineSnapshot(`
     "bun prune <version> (<revision>)
 
-    Done! Checked 3 packages across 1 folder (nothing to prune)"
+    Done! Checked 3 installed packages across 1 folder (nothing to prune)"
   `);
   expect(exitCode).toBe(0);
   expect(existsSync(bundled)).toBeTrue();
@@ -621,7 +623,7 @@ test.concurrent("isolated linker: removes unused store entries and their links",
     - no-deps@1.0.1
     - one-dep@1.0.0
     - zzz@1.0.0
-    6 packages removed (checked 9)"
+    6 packages removed (checked 9 installed packages)"
   `);
   expect(exitCode).toBe(0);
 
@@ -691,7 +693,7 @@ test.concurrent("isolated linker: prune removes the peer-hash variants a peer bu
     "",
     "- no-deps@1.0.0",
     `- ${before}`,
-    "2 packages removed (checked 6)",
+    "2 packages removed (checked 6 installed packages)",
   ]);
   expect(exitCode).toBe(0);
   expect(peerEntries()).toStrictEqual([after]);
@@ -715,7 +717,7 @@ test.concurrent("isolated linker + global store: unlinks the store link, never d
 
   const { stdout, exitCode } = await prune(dir, "--production");
   expect(out(stdout)).toContain("- one-dep@1.0.0");
-  expect(out(stdout)).toEndWith("2 packages removed (checked 3)");
+  expect(out(stdout)).toEndWith("2 packages removed (checked 3 installed packages)");
   expect(exitCode).toBe(0);
 
   expect(() => lstatSync(storeEntry)).toThrow();
@@ -734,7 +736,7 @@ test.concurrent("isolated linker: bins of removed packages are removed, live one
   expectBinInstalled(nm, "has-bin-entry");
 
   const { stdout, exitCode } = await prune(dir, "--production", "--linker", "isolated");
-  expect(out(stdout)).toEndWith("- what-bin@1.0.0\n1 package removed (checked 4)");
+  expect(out(stdout)).toEndWith("- what-bin@1.0.0\n1 package removed (checked 4 installed packages)");
   expect(exitCode).toBe(0);
 
   expectBinRemoved(nm, "what-bin");
@@ -773,7 +775,7 @@ test.concurrent("hoisted: dot entries and files are never touched even when the
     "bun prune <version> (<revision>)
 
     - junk
-    1 package removed (checked 1)"
+    1 package removed (checked 1 installed package)"
   `);
   expect(exitCode).toBe(0);
   expect(existsSync(junk)).toBeFalse();
@@ -833,7 +835,7 @@ test.concurrent(
     expect(out(stdout)).toMatchInlineSnapshot(`
     "bun prune <version> (<revision>)
 
-    Done! Checked 2 packages across 1 folder (nothing to prune)"
+    Done! Checked 2 installed packages across 1 folder (nothing to prune)"
   `);
     expect(exitCode).toBe(0);
     expect(existsSync(keepMe)).toBeTrue();
@@ -854,7 +856,7 @@ test.concurrent("hoisted: a symlinked scope dir is unlinked, not followed", asyn
 
     - @fake
     - @real/junk
-    2 packages removed (checked 3)"
+    2 packages removed (checked 3 installed packages)"
   `);
   expect(exitCode).toBe(0);
   expect(() => lstatSync(join(nm, "@fake"))).toThrow();
@@ -888,7 +890,7 @@ test.concurrent(
       "bun prune <version> (<revision>)
 
       - junk (node_modules/a/node_modules)
-      1 package can be removed (checked 4)
+      1 package can be removed (checked 4 installed packages)
         bun prune --linker hoisted"
     `);
     expect(dryRun.exitCode).toBe(0);
@@ -899,7 +901,7 @@ test.concurrent(
       "bun prune <version> (<revision>)
 
       - junk (node_modules/a/node_modules)
-      1 package removed (checked 4)"
+      1 package removed (checked 4 installed packages)"
     `);
     expect(exitCode).toBe(0);
     expect(existsSync(junk)).toBeFalse();
@@ -924,7 +926,7 @@ test.concurrent.skipIf(isWindows)("a symlinked .bin directory is never cleaned t
     "bun prune <version> (<revision>)
 
     - junk
-    1 package removed (checked 2)"
+    1 package removed (checked 2 installed packages)"
   `);
   expect(exitCode).toBe(0);
   expect(existsSync(junk)).toBeFalse();
@@ -944,7 +946,7 @@ test.concurrent("isolated: extraneous symlinks are removed even when the store i
 
     - @ext/thing
     - ext
-    2 packages removed (checked 4)"
+    2 packages removed (checked 4 installed packages)"
   `);
   expect(first.exitCode).toBe(0);
   expect(() => lstatSync(join(nm, "ext"))).toThrow();
@@ -978,7 +980,7 @@ test.concurrent(
 
     - @scoped/has-bin-entry@1.0.0
     - one-dep@1.0.0
-    2 packages removed (checked 3)"
+    2 packages removed (checked 3 installed packages)"
   `);
     expect(exitCode).toBe(0);
     expect(existsSync(join(nm, "one-dep"))).toBeFalse();
@@ -1004,7 +1006,7 @@ test.concurrent("hoisted: removing only a scoped package also removes its bin li
     "bun prune <version> (<revision>)
 
     - @scoped/has-bin-entry@1.0.0
-    1 package removed (checked 2)"
+    1 package removed (checked 2 installed packages)"
   `);
   expect(exitCode).toBe(0);
   expect(existsSync(join(nm, "@scoped"))).toBeFalse();
@@ -1032,7 +1034,7 @@ test.concurrent(
     - @scoped/has-bin-entry@1.0.0
     - no-deps@1.0.1
     - one-dep@1.0.0
-    3 packages removed (checked 7)"
+    3 packages removed (checked 7 installed packages)"
   `);
     expect(exitCode).toBe(0);
     expect(() => lstatSync(join(nm, "one-dep"))).toThrow();
@@ -1065,7 +1067,7 @@ test.concurrent("hoisted: --production empties a workspace folder that only held
     "bun prune <version> (<revision>)
 
     - no-deps@1.0.0 (packages/a/node_modules)
-    1 package removed (checked 3)"
+    1 package removed (checked 3 installed packages)"
   `);
   expect(exitCode).toBe(0);
   expect(existsSync(nested)).toBeFalse();
@@ -1105,7 +1107,7 @@ test.concurrent(
 
       - a-dep@1.0.1
       - tool@1.0.0 (packages/app/node_modules)
-      2 packages can be removed (checked 6)
+      2 packages can be removed (checked 6 installed packages)
         bun prune --production --linker isolated"
     `);
     expect(dryRun.exitCode).toBe(0);
@@ -1117,7 +1119,7 @@ test.concurrent(
 
       - a-dep@1.0.1
       - tool@1.0.0 (packages/app/node_modules)
-      2 packages removed (checked 6)"
+      2 packages removed (checked 6 installed packages)"
     `);
     expect(exitCode).toBe(0);
     expect(() => lstatSync(join(appNm, "a-dep"))).toThrow();
@@ -1145,7 +1147,7 @@ test.concurrent("isolated: a real directory named like a workspace is never dele
     "bun prune <version> (<revision>)
 
     - a-dep@1.0.1
-    1 package removed (checked 6)"
+    1 package removed (checked 6 installed packages)"
   `);
   expect(exitCode).toBe(0);
   expect(existsSync(join(planted, "package.json"))).toBeTrue();
@@ -1182,7 +1184,7 @@ test.concurrent(
       "bun prune <version> (<revision>)
 
       - @scope/tool@1.0.0 (packages/app/node_modules)
-      1 package removed (checked 4)"
+      1 package removed (checked 4 installed packages)"
     `);
     expect(mixed.exitCode).toBe(0);
     expect(() => lstatSync(join(mixedScope, "tool"))).toThrow();
@@ -1195,7 +1197,7 @@ test.concurrent(
       "bun prune <version> (<revision>)
 
       - @scope/tool@1.0.0 (packages/app/node_modules)
-      1 package removed (checked 3)"
+      1 package removed (checked 3 installed packages)"
     `);
     expect(devOnly.exitCode).toBe(0);
     expect(existsSync(devOnlyScope)).toBeFalse();
@@ -1225,7 +1227,7 @@ test.concurrent(
       "bun prune <version> (<revision>)
 
       - tool@1.0.0 (packages/app/node_modules)
-      1 package removed (checked 4)"
+      1 package removed (checked 4 installed packages)"
     `);
     expect(exitCode).toBe(0);
     expect(() => lstatSync(appTool)).toThrow();
@@ -1372,7 +1374,7 @@ test.concurrent.each(linkers)("%s: a workspace lifecycle script is not out of sy
     "bun prune <version> (<revision>)
 
     - junk
-    1 package removed (checked 3)"
+    1 package removed (checked 3 installed packages)"
   `);
   expect(exitCode).toBe(0);
   expect(existsSync(junk)).toBeFalse();
@@ -1393,7 +1395,7 @@ test.concurrent("trustedDependencies stripped from bun.lock is not out of sync",
     "bun prune <version> (<revision>)
 
     - junk
-    1 package removed (checked 2)"
+    1 package removed (checked 2 installed packages)"
   `);
   expect(exitCode).toBe(0);
   expect(existsSync(junk)).toBeFalse();
@@ -1449,7 +1451,7 @@ test.concurrent("isolated: a workspace missing from disk no longer keeps its sto
 
     - junk
     - left-pad@1.0.0
-    2 packages removed (checked 4)"
+    2 packages removed (checked 4 installed packages)"
   `);
   expect(exitCode).toBe(0);
   expect(existsSync(junk)).toBeFalse();
@@ -1478,7 +1480,7 @@ test.concurrent("hoisted: --filter on a pruned checkout does not protect the mis
 
     - left-pad@1.0.0
     - other
-    2 packages removed (checked 4)"
+    2 packages removed (checked 4 installed packages)"
   `);
   expect(exitCode).toBe(0);
   expect(existsSync(join(nm, "left-pad"))).toBeFalse();
@@ -1520,7 +1522,7 @@ test.concurrent(
       "bun prune <version> (<revision>)
 
       - shared-alias@1.0.0
-      1 package removed (checked 3)"
+      1 package removed (checked 3 installed packages)"
     `);
     expect(exitCode).toBe(0);
     expect(isSymlink(join(nm, "app"))).toBeTrue();
@@ -1560,7 +1562,7 @@ test.concurrent(
 
       - a-dep@1.0.1
       - junk (node_modules/a/node_modules)
-      2 packages removed (checked 8)"
+      2 packages removed (checked 8 installed packages)"
     `);
     expect(onlyA.exitCode).toBe(0);
     expect(existsSync(aJunk)).toBeFalse();
@@ -1575,7 +1577,7 @@ test.concurrent(
       "bun prune <version> (<revision>)
 
       - left-pad@1.0.0
-      1 package removed (checked 5)"
+      1 package removed (checked 5 installed packages)"
     `);
     expect(onlyRoot.exitCode).toBe(0);
     expect(existsSync(bJunk)).toBeTrue();
@@ -1587,7 +1589,7 @@ test.concurrent(
 
       - junk (node_modules/b/node_modules)
       - one-fixed-dep@1.0.0
-      2 packages removed (checked 7)"
+      2 packages removed (checked 7 installed packages)"
     `);
     expect(everything.exitCode).toBe(0);
     expect(existsSync(bJunk)).toBeFalse();
@@ -1615,7 +1617,7 @@ test.concurrent(
 
       - a-dep@1.0.1 (packages/a/node_modules)
       - one-fixed-dep@1.0.0
-      2 packages removed (checked 7)"
+      2 packages removed (checked 7 installed packages)"
     `);
     expect(onlyA.exitCode).toBe(0);
     expect(existsSync(join(store, "a-dep@1.0.1"))).toBeTrue();
@@ -1633,7 +1635,7 @@ test.concurrent(
 
       - a-dep@1.0.1
       - left-pad@1.0.0
-      2 packages removed (checked 6)"
+      2 packages removed (checked 6 installed packages)"
     `);
     expect(everything.exitCode).toBe(0);
     expect(() => lstatSync(join(bNm, "a-dep"))).toThrow();
@@ -1657,7 +1659,7 @@ test.concurrent(
       "bun prune <version> (<revision>)
 
       - a-dep@1.0.1 (packages/selected/node_modules)
-      1 package removed (checked 4)"
+      1 package removed (checked 4 installed packages)"
     `);
     expect(first.exitCode).toBe(0);
     expect(() => lstatSync(selectedADep)).toThrow();
@@ -1669,7 +1671,7 @@ test.concurrent(
       "bun prune <version> (<revision>)
 
       - a-dep@1.0.1 (packages/unselected/node_modules)
-      1 package removed (checked 4)"
+      1 package removed (checked 4 installed packages)"
     `);
     expect(second.exitCode).toBe(0);
     expect(() => lstatSync(unselectedADep)).toThrow();
@@ -1680,7 +1682,7 @@ test.concurrent(
       "bun prune <version> (<revision>)
 
       - a-dep@1.0.1
-      1 package removed (checked 4)"
+      1 package removed (checked 4 installed packages)"
     `);
     expect(everything.exitCode).toBe(0);
     expect(existsSync(storeEntry)).toBeFalse();
@@ -1824,7 +1826,7 @@ test.concurrent("hoisted: --filter with no match is an error; path filters resol
     "bun prune <version> (<revision>)
 
     - junk (node_modules/a/node_modules)
-    1 package removed (checked 4)"
+    1 package removed (checked 4 installed packages)"
   `);
   expect(exitCode).toBe(0);
   expect(existsSync(junk)).toBeFalse();
@@ -1905,7 +1907,7 @@ test.concurrent.each([["--os=aix"], ["--cpu=s390x"]])(
       "bun prune <version> (<revision>)
 
       - test-postinstall-skip-native@1.0.0
-      1 package removed (checked 2)"
+      1 package removed (checked 2 installed packages)"
     `);
     expect(other.exitCode).toBe(0);
     expect(existsSync(native)).toBeFalse();
@@ -1929,9 +1931,7 @@ test.concurrent.each(["hoisted", "isolated"] as Linker[])(
     const junk = plant(dir, "node_modules/junk");
 
     const { stdout, exitCode } = await prune(dir, "--linker", linker);
-    expect(out(stdout)).toBe(
-      `bun prune <version> (<revision>)\n\n- junk\n1 package removed (checked ${linker === "hoisted" ? 4 : 6})`,
-    );
+    expect(out(stdout)).toBe(`bun prune <version> (<revision>)\n\n- junk\n${REMOVED(1, linker === "hoisted" ? 4 : 6)}`);
     expect(exitCode).toBe(0);
     expect(existsSync(junk)).toBeFalse();
     expect(await file(join(nm, "my-alias", "package.json")).json()).toMatchObject({
@@ -1966,7 +1966,7 @@ test.concurrent("isolated + publicHoistPattern: hoisted links follow their store
 
     - no-deps@1.0.1
     - one-dep@1.0.0
-    2 packages removed (checked 5)"
+    2 packages removed (checked 5 installed packages)"
   `);
   expect(production.exitCode).toBe(0);
   expect(() => lstatSync(join(store, "node_modules", "one-dep"))).toThrow();
@@ -1992,7 +1992,7 @@ test.concurrent.skipIf(isWindows || process.getuid?.() === 0)(
         "",
         "- junk-a",
         expect.stringMatching(failure),
-        "1 package removed, 1 failed (checked 3)",
+        "1 package removed, 1 failed (checked 3 installed packages)",
       ]);
       expect(exitCode).toBe(1);
       expect(existsSync(junkA)).toBeFalse();
@@ -2013,7 +2013,7 @@ test.concurrent.skipIf(isWindows || process.getuid?.() === 0)(
     "bun prune <version> (<revision>)
 
     - junk-b
-    1 package removed (checked 2)"
+    1 package removed (checked 2 installed packages)"
   `);
     expect(exitCode).toBe(0);
     expect(existsSync(junkB)).toBeFalse();
@@ -2042,7 +2042,7 @@ test.concurrent("never runs the project's lifecycle scripts", async () => {
     "bun prune <version> (<revision>)
 
     - junk
-    1 package removed (checked 3)"
+    1 package removed (checked 3 installed packages)"
   `);
   expect(plain.exitCode).toBe(0);
   expect(existsSync(junk)).toBeFalse();
@@ -2053,7 +2053,7 @@ test.concurrent("never runs the project's lifecycle scripts", async () => {
     "bun prune <version> (<revision>)
 
     - a-dep@1.0.1
-    1 package removed (checked 2)"
+    1 package removed (checked 2 installed packages)"
   `);
   expect(production.exitCode).toBe(0);
   expect(existsSync(ran)).toBeFalse();
@@ -2112,7 +2112,7 @@ test.concurrent.each(["peer-deps-fixed", "optional-peer-deps"])(
       "bun prune <version> (<revision>)",
       "",
       "- no-deps@1.0.0",
-      "1 package removed (checked 4)",
+      "1 package removed (checked 4 installed packages)",
     ]);
     expect(exitCode).toBe(0);
     expect(storeEntries(dir)).toStrictEqual(["no-deps@1.0.0", entry]);
@@ -2179,7 +2179,7 @@ test.concurrent(
       "",
       "- a-dep@1.0.1",
       "- no-deps@2.0.0",
-      "2 packages removed (checked 10)",
+      "2 packages removed (checked 10 installed packages)",
     ]);
     expect(exitCode).toBe(0);
     expect(storeEntries(dir)).toStrictEqual(["no-deps@1.0.1", "one-dep@1.0.0", productionEntry, fullEntry].toSorted());
@@ -2216,7 +2216,7 @@ test.concurrent("isolated: --production removes the stale peer-hash variant and
     "- a-dep@1.0.1",
     "- no-deps@1.0.0",
     `- ${before}`,
-    "3 packages removed (checked 8)",
+    "3 packages removed (checked 8 installed packages)",
   ]);
   expect(exitCode).toBe(0);
   expect(storeEntries(dir)).toStrictEqual(["no-deps@1.0.1", after]);
@@ -2250,7 +2250,7 @@ test.concurrent("keeps dependencies bundled inside a file: dependency", async ()
     "bun prune <version> (<revision>)
 
     - junk
-    1 package removed (checked 2)"
+    1 package removed (checked 2 installed packages)"
   `);
   expect(exitCode).toBe(0);
   expect(existsSync(junk)).toBeFalse();
@@ -2297,7 +2297,7 @@ test.concurrent(
       "bun prune <version> (<revision>)
 
       - no-deps@1.0.1 (node_modules/one-dep/node_modules)
-      1 package removed (checked 3)"
+      1 package removed (checked 3 installed packages)"
     `);
     expect(stderr).toBe("");
     expect(exitCode).toBe(0);
@@ -2317,18 +2317,30 @@ test.concurrent(
     expect(await file(rootPkgJson).json()).toMatchObject({ version: "2.0.0" });
     expect(await file(nestedPkgJson).json()).toMatchObject({ version: "1.0.0" });
 
+    // The root copy is the one a full install hoists there, not a stale tree:
+    // no "is not the version bun.lock expects" warning, no install hint.
     const { stdout, stderr, exitCode } = await prune(dir, "--production");
     expect(out(stdout)).toMatchInlineSnapshot(`
       "bun prune <version> (<revision>)
 
-      Done! Checked 3 packages across 2 folders (nothing to prune)"
+      Done! Checked 3 installed packages across 2 folders (nothing to prune)"
     `);
-    expect(out(stderr)).toBe(
-      `${WARN("node_modules/no-deps", "node_modules/one-fixed-dep/node_modules/no-deps")}\n${NOTE}`,
-    );
+    expect(stderr).toBe("");
     expect(exitCode).toBe(0);
     expect(await file(nestedPkgJson).json()).toMatchObject({ version: "1.0.0" });
     expect(await file(rootPkgJson).json()).toMatchObject({ version: "2.0.0" });
+
+    // A root copy whose version the lockfile does not know anywhere is a
+    // genuinely stale tree and still warns under --production.
+    const rootPkg = await file(rootPkgJson).json();
+    await write(rootPkgJson, JSON.stringify({ ...rootPkg, version: "9.9.9" }));
+    const stale = await prune(dir, "--production", "--dry-run");
+    expect(out(stale.stderr)).toBe(
+      `${WARN("node_modules/no-deps", "node_modules/one-fixed-dep/node_modules/no-deps")}\n${NOTE}`,
+    );
+    expect(stale.exitCode).toBe(0);
+    await write(rootPkgJson, JSON.stringify(rootPkg));
+
     await runBunInstall(installEnv(dir), dir, { production: true });
 
     const silent = await prune(silentDir, "--production", "--silent");
@@ -2399,13 +2411,15 @@ test.concurrent(
     expect(await file(rootPkgJson).json()).toMatchObject({ version: "2.0.0" });
     expect(await file(workspacePkgJson).json()).toMatchObject({ version: "1.0.0" });
 
+    // The root copy is the dev version a full install hoists there; not a
+    // stale tree, so no warning under --production.
     const { stdout, stderr, exitCode } = await prune(dir, "--production", "--linker", "hoisted");
     expect(out(stdout)).toMatchInlineSnapshot(`
       "bun prune <version> (<revision>)
 
-      Done! Checked 3 packages across 2 folders (nothing to prune)"
+      Done! Checked 3 installed packages across 2 folders (nothing to prune)"
     `);
-    expect(out(stderr)).toBe(`${WARN("node_modules/no-deps", "packages/a/node_modules/no-deps")}\n${NOTE}`);
+    expect(stderr).toBe("");
     expect(exitCode).toBe(0);
     expect(await file(workspacePkgJson).json()).toMatchObject({ version: "1.0.0" });
     expect(isSymlink(join(nm, "a"))).toBeTrue();
@@ -2433,7 +2447,7 @@ test.concurrent(
       "bun prune <version> (<revision>)
 
       - what-bin@1.0.0
-      1 package can be removed (checked 4)
+      1 package can be removed (checked 4 installed packages)
         bun prune --production --linker isolated"
     `);
     expect(dryRun.exitCode).toBe(0);
@@ -2445,7 +2459,7 @@ test.concurrent(
       "bun prune <version> (<revision>)
 
       - what-bin@1.0.0
-      1 package removed (checked 4)"
+      1 package removed (checked 4 installed packages)"
     `);
     expect(exitCode).toBe(0);
     expect(() => lstatSync(join(nm, "what-bin"))).toThrow();
@@ -2478,7 +2492,7 @@ test.concurrent("hoisted: nested node_modules of packages without a tree node ar
 
     - @other/thing (node_modules/@scoped/has-bin-entry/node_modules)
     - junk (node_modules/no-deps/node_modules)
-    2 packages removed (checked 4)"
+    2 packages removed (checked 4 installed packages)"
   `);
   expect(exitCode).toBe(0);
   expect(existsSync(junk)).toBeFalse();
@@ -2534,7 +2548,7 @@ test.concurrent("refuses to prune an isolated install with the hoisted linker",
 
     - no-deps@1.0.1
     - one-dep@1.0.0
-    2 packages removed (checked 3)"
+    2 packages removed (checked 3 installed packages)"
   `);
   expect(same.exitCode).toBe(0);
   expect(() => lstatSync(join(nm, "one-dep"))).toThrow();
@@ -2653,7 +2667,7 @@ test.concurrent(
       - git-pkg@1.0.0
       - junk@1.0.0
       - local@file+elsewhere
-      3 packages removed (checked 11)"
+      3 packages removed (checked 11 installed packages)"
     `);
     expect(exitCode).toBe(0);
     expect(storeEntries(dir)).toStrictEqual(installed);
@@ -2688,7 +2702,7 @@ test.concurrent(
 
       - a-dep@1.0.1
       - junk@1.0.0
-      2 packages removed (checked 6)"
+      2 packages removed (checked 6 installed packages)"
     `);
     expect(exitCode).toBe(0);
     expect(existsSync(junk)).toBeFalse();
@@ -2731,7 +2745,7 @@ test.concurrent(
 
       - a-dep@1.0.1
       - junk
-      2 packages removed (checked 5)"
+      2 packages removed (checked 5 installed packages)"
     `);
     expect(exitCode).toBe(0);
     expect(existsSync(junk)).toBeFalse();
@@ -2763,7 +2777,7 @@ test.concurrent("without --linker, a project without workspaces is pruned with t
 
     - a-dep@1.0.1
     - junk
-    2 packages removed (checked 4)"
+    2 packages removed (checked 4 installed packages)"
   `);
   expect(exitCode).toBe(0);
   expect(existsSync(junk)).toBeFalse();
@@ -2793,7 +2807,7 @@ test.concurrent.each([["--os=aix"], ["--cpu=s390x"]])(
       "bun prune <version> (<revision>)
 
       - test-postinstall-skip-native@1.0.0
-      1 package removed (checked 4)"
+      1 package removed (checked 4 installed packages)"
     `);
     expect(other.exitCode).toBe(0);
     expect(existsSync(join(store, "test-postinstall-skip-native@1.0.0"))).toBeFalse();
@@ -2849,7 +2863,7 @@ test.concurrent("hoisted: the nested tree of a package with bundled dependencies
     "bun prune <version> (<revision>)
 
     - junk (node_modules/one-dep/node_modules)
-    1 package removed (checked 5)"
+    1 package removed (checked 5 installed packages)"
   `);
   expect(exitCode).toBe(0);
   expect(existsSync(junk)).toBeTrue();
@@ -2887,7 +2901,7 @@ test.concurrent(
       "bun prune <version> (<revision>)
 
       - git-pkg (node_modules/no-deps/node_modules)
-      1 package removed (checked 3)"
+      1 package removed (checked 3 installed packages)"
     `);
     expect(exitCode).toBe(0);
     expect(existsSync(nested)).toBeFalse();
@@ -2943,7 +2957,7 @@ test.concurrent(
       "bun prune <version> (<revision>)
 
       - left-pad (node_modules/no-deps/node_modules)
-      1 package removed (checked 3)"
+      1 package removed (checked 3 installed packages)"
     `);
     expect(exitCode).toBe(0);
     expect(existsSync(nested)).toBeFalse();
@@ -2975,7 +2989,7 @@ test.concurrent("hoisted: a nested copy of a link: dependency is removed when th
     "bun prune <version> (<revision>)
 
     - linked (node_modules/no-deps/node_modules)
-    1 package removed (checked 3)"
+    1 package removed (checked 3 installed packages)"
   `);
   expect(exitCode).toBe(0);
   expect(existsSync(nested)).toBeFalse();
@@ -3009,7 +3023,7 @@ test.concurrent("hoisted: a nested copy left behind by an override to a tarball
     "bun prune <version> (<revision>)
 
     - no-deps@1.0.1 (node_modules/one-dep/node_modules)
-    1 package removed (checked 3)"
+    1 package removed (checked 3 installed packages)"
   `);
   expect(exitCode).toBe(0);
   expect(existsSync(nested)).toBeFalse();
@@ -3034,7 +3048,7 @@ test.concurrent(
       "bun prune <version> (<revision>)
 
       - no-deps-build-metadata (node_modules/no-deps/node_modules)
-      1 package removed (checked 3)"
+      1 package removed (checked 3 installed packages)"
     `);
     expect(exitCode).toBe(0);
     expect(existsSync(nested)).toBeFalse();
@@ -3066,7 +3080,7 @@ test.concurrent(
 
       - no-deps@1.0.1
       - one-dep@1.0.0
-      2 packages removed (checked 6)"
+      2 packages removed (checked 6 installed packages)"
     `);
     expect(production.exitCode).toBe(0);
     expect(existsSync(join(store, "no-deps@1.0.1"))).toBeFalse();
@@ -3105,7 +3119,7 @@ test.concurrent(
       - no-deps@1.0.1
       - one-dep@1.0.0
       - one-dep@1.0.0+0123456789abcdef
-      4 packages removed (checked 7)"
+      4 packages removed (checked 7 installed packages)"
     `);
     expect(exitCode).toBe(0);
     expect(existsSync(variant)).toBeFalse();
@@ -3136,7 +3150,7 @@ test.concurrent("isolated: an emptied scope dir of dangling hidden-hoist links i
     - @scope/zzz@1.0.0
     - no-deps@1.0.1
     - one-dep@1.0.0
-    3 packages removed (checked 6)"
+    3 packages removed (checked 6 installed packages)"
   `);
   expect(exitCode).toBe(0);
   expect(existsSync(scopeDir)).toBeFalse();
@@ -3156,7 +3170,7 @@ test.concurrent("isolated: --filter on a pruned checkout does not protect the mi
     "bun prune <version> (<revision>)
 
     - left-pad@1.0.0
-    1 package removed (checked 3)"
+    1 package removed (checked 3 installed packages)"
   `);
   expect(exitCode).toBe(0);
   expect(existsSync(join(store, "left-pad@1.0.0"))).toBeFalse();
@@ -3244,7 +3258,7 @@ test.concurrent("missing package.json is an error; --cwd prunes another director
     "bun prune <version> (<revision>)
 
     - junk
-    1 package removed (checked 2)"
+    1 package removed (checked 2 installed packages)"
   `);
   expect(exitCode).toBe(0);
   expect(existsSync(junk)).toBeFalse();
@@ -3285,7 +3299,7 @@ test.concurrent(
       "bun prune <version> (<revision>)
 
       - junk
-      1 package removed (checked 2)"
+      1 package removed (checked 2 installed packages)"
     `);
     expect(pruned.exitCode).toBe(0);
     expect(existsSync(junk)).toBeFalse();
@@ -3315,7 +3329,7 @@ test.concurrent("--no-optional is not --omit=optional", async () => {
     "bun prune <version> (<revision>)
 
     - a-dep@1.0.1
-    1 package can be removed (checked 2)
+    1 package can be removed (checked 2 installed packages)
       bun prune --omit=optional"
   `);
   expect(omit.exitCode).toBe(0);
@@ -3387,7 +3401,7 @@ test.concurrent("--help lists every flag; -F is --filter, -p is --production", a
     "bun prune <version> (<revision>)
 
     - junk (node_modules/b/node_modules)
-    1 package removed (checked 5)"
+    1 package removed (checked 5 installed packages)"
   `);
   expect(exitCode).toBe(0);
   expect(existsSync(aJunk)).toBeTrue();
diff --git a/test/cli/install/isolated-relink.test.ts b/test/cli/install/isolated-relink.test.ts
index c1e736ba0c45..a20ca431eb28 100644
--- a/test/cli/install/isolated-relink.test.ts
+++ b/test/cli/install/isolated-relink.test.ts
@@ -204,7 +204,7 @@ test.concurrent("the orphaned store entry survives the re-link until bun prune",
     "bun prune <version> (<revision>)
 
     - no-deps@1.1.0
-    1 package removed (checked 4)"
+    1 package removed (checked 4 installed packages)"
   `);
   expect(err).not.toContain("error:");
   expect(exitCode).toBe(0);

From 5f82df2d0641bfef5cf83bd9959027b57087f5f7 Mon Sep 17 00:00:00 2001
From: robobun <117481402+robobun@users.noreply.github.com>
Date: Mon, 17 Aug 2026 01:07:31 +0000
Subject: [PATCH 055/258] prune: add --check, a CI gate that exits 1 when
 anything would be removed (#39216)

---
 completions/bun-cli.json                      |  9 ++++-
 completions/bun.bash                          |  2 +-
 completions/bun.fish                          |  1 +
 completions/bun.zsh                           |  1 +
 docs/pm/cli/prune.mdx                         |  8 ++++
 .../PackageManager/CommandLineArguments.rs    | 11 ++++-
 src/install/prune.rs                          |  4 +-
 test/cli/install/bun-prune.test.ts            | 40 +++++++++++++++++++
 8 files changed, 71 insertions(+), 5 deletions(-)

diff --git a/completions/bun-cli.json b/completions/bun-cli.json
index a708a90db102..365c2ac427ec 100644
--- a/completions/bun-cli.json
+++ b/completions/bun-cli.json
@@ -1917,6 +1917,13 @@
           "required": false,
           "multiple": false
         },
+        {
+          "name": "check",
+          "description": "Exit with code 1 if node_modules has packages that can be removed, without deleting anything",
+          "hasValue": false,
+          "required": false,
+          "multiple": false
+        },
         {
           "name": "os",
           "description": "Prune for a different operating system than the current one",
@@ -1982,7 +1989,7 @@
           "type": "string"
         }
       ],
-      "examples": ["bun prune", "bun prune --production", "bun prune --dry-run"],
+      "examples": ["bun prune", "bun prune --production", "bun prune --dry-run", "bun prune --check"],
       "usage": "Usage: bun prune [flags]",
       "documentationUrl": "https://bun.com/docs/pm/cli/prune.",
       "dynamicCompletions": {}
diff --git a/completions/bun.bash b/completions/bun.bash
index 29304d7e69ca..92adf0b700ed 100644
--- a/completions/bun.bash
+++ b/completions/bun.bash
@@ -105,7 +105,7 @@ _bun_completions() {
     PACKAGE_OPTIONS[SHARED_OPTIONS_SHORT]="-c -y -p -f -g";
 
     PACKAGE_OPTIONS[DEDUPE_OPTIONS_LONG]="--check";
-    PACKAGE_OPTIONS[PRUNE_OPTIONS_LONG]="--production --prod --omit --filter --dry-run --os --cpu --linker --silent --cwd --help";
+    PACKAGE_OPTIONS[PRUNE_OPTIONS_LONG]="--production --prod --omit --filter --dry-run --check --os --cpu --linker --silent --cwd --help";
     PACKAGE_OPTIONS[PRUNE_OPTIONS_SHORT]="-p -P -F -h";
     PACKAGE_OPTIONS[AUDIT_OPTIONS_LONG]="--json --audit-level --ignore --prod --production --omit --dry-run --latest --cwd --help";
     PACKAGE_OPTIONS[AUDIT_OPTIONS_SHORT]="-L";
diff --git a/completions/bun.fish b/completions/bun.fish
index 5e94166f5ecb..3332391a6aa7 100644
--- a/completions/bun.fish
+++ b/completions/bun.fish
@@ -220,6 +220,7 @@ complete -c bun -n "__fish_seen_subcommand_from audit" -l "ignore" -r -d "Ignore
 complete -c bun -n "__fish_seen_subcommand_from audit" -l "prod" -d "Omit devDependencies" -f
 complete -c bun -n "__fish_seen_subcommand_from audit prune" -l "omit" -r -a "dev optional peer" -d "Omit the given dependency type" -f
 complete -c bun -n "__fish_seen_subcommand_from audit prune" -l "dry-run" -d "Print what would change without changing anything" -f
+complete -c bun -n "__fish_seen_subcommand_from prune" -l "check" -d "Exit with code 1 if node_modules has packages that can be removed, without deleting anything" -f
 complete -c bun -n "__fish_seen_subcommand_from audit; and __fish_seen_subcommand_from fix" -s "L" -l "latest" -d "Also apply fixes that fall outside the ranges declared in package.json or catalogs" -f
 complete -c bun -n "__fish_seen_subcommand_from prune" -s "p" -l "production" -d "Also remove packages that are only needed by devDependencies" -f
 complete -c bun -n "__fish_seen_subcommand_from prune" -s "P" -l "prod" -d "Also remove packages that are only needed by devDependencies" -f
diff --git a/completions/bun.zsh b/completions/bun.zsh
index 9ef9930f7a85..790da62bd25d 100644
--- a/completions/bun.zsh
+++ b/completions/bun.zsh
@@ -737,6 +737,7 @@ _bun_prune_completion() {
         '--prod[Also remove packages that are only needed by devDependencies]' \
         '*--omit[Also remove packages that are only needed by the given dependency types]:type:(dev optional peer)' \
         '--dry-run[Print what would be removed without deleting anything]' \
+        '--check[Exit with code 1 if node_modules has packages that can be removed, without deleting anything]' \
         '*--os[Prune for a different operating system than the current one]:os' \
         '*--cpu[Prune for a different CPU architecture than the current one]:cpu' \
         '--linker[Prune a node_modules installed with the given linker]:linker:(isolated hoisted)' \
diff --git a/docs/pm/cli/prune.mdx b/docs/pm/cli/prune.mdx
index 97ca936e013f..5db2c86cd61f 100644
--- a/docs/pm/cli/prune.mdx
+++ b/docs/pm/cli/prune.mdx
@@ -51,6 +51,14 @@ bun prune v1.4.0 (abc12345)
   bun prune --production
 ```
 
+### `--check`
+
+Print the same report as `--dry-run`, but exit `1` if anything would be removed. Use it in CI:
+
+```bash terminal icon="terminal"
+bun prune --production --check
+```
+
 ### `--filter`
 
 Prune only the selected workspaces' `node_modules` folders (same patterns as [`bun install --filter`](/pm/filter)). Bun also cleans shared locations: the root `node_modules`, or `node_modules/.bun` with the isolated linker. In those locations, Bun keeps anything an unselected workspace still needs.
diff --git a/src/install/PackageManager/CommandLineArguments.rs b/src/install/PackageManager/CommandLineArguments.rs
index 999ce9016546..b7307ba874a6 100644
--- a/src/install/PackageManager/CommandLineArguments.rs
+++ b/src/install/PackageManager/CommandLineArguments.rs
@@ -460,6 +460,9 @@ const DEDUPE_HELP_PARAMS: &[ParamType] = &[
 static PRUNE_PARAMS: &[ParamType] = concat_params![
     SHARED_PARAMS,
     &[
+        clap::param!(
+            "--check                                Exit with code 1 if node_modules has packages that can be removed, without deleting anything"
+        ),
         clap::param!(
             "-F, --filter <STR>...                  Only prune the node_modules folders of the matching workspaces"
         ),
@@ -474,6 +477,9 @@ const PRUNE_HELP_PARAMS: &[ParamType] = &[
     clap::param!(
         "--omit <dev|optional|peer>...          Also remove packages that are only needed by the given dependency types"
     ),
+    clap::param!(
+        "--check                                Exit with code 1 if node_modules has packages that can be removed, without deleting anything"
+    ),
     clap::param!(
         "--dry-run                              Print what would be removed without deleting anything"
     ),
@@ -1190,6 +1196,9 @@ Full documentation is available at <magenta>https://bun.com/docs/pm/cli/dedupe<r
   <d>Show what would be removed without deleting anything<r>
   <b><green>bun prune<r> <cyan>--dry-run<r>
 
+  <d>Only report what would be removed; exit code 1 if there is anything (for CI)<r>
+  <b><green>bun prune<r> <cyan>--check<r>
+
   <d>Only prune what the app workspace no longer needs<r>
   <b><green>bun prune<r> <cyan>--production --filter app<r>
 
@@ -1388,7 +1397,7 @@ Full documentation is available at <magenta>https://bun.com/docs/pm/cli/prune<r>
             // cli.json_output = args.flag(b"--json");
         }
 
-        if subcommand == Subcommand::Dedupe && args.flag(b"--check") {
+        if matches!(subcommand, Subcommand::Dedupe | Subcommand::Prune) && args.flag(b"--check") {
             cli.check = true;
             cli.dry_run = true;
         }
diff --git a/src/install/prune.rs b/src/install/prune.rs
index e4d382b4009e..1684eae0de35 100644
--- a/src/install/prune.rs
+++ b/src/install/prune.rs
@@ -342,7 +342,7 @@ pub fn prune(manager: &mut PackageManager, original_cwd: &[u8]) -> crate::Result
             print_elapsed();
             print_apply_hint();
         }
-        return Ok(());
+        Global::exit(manager.options.check as u32);
     }
 
     let failed = execute(&plan, quiet);
@@ -403,7 +403,7 @@ fn print_apply_hint() {
         .skip_while(|arg| **arg != *b"prune")
         .skip(1)
     {
-        if arg.starts_with(b"--dry-run") {
+        if arg.starts_with(b"--dry-run") || arg.starts_with(b"--check") {
             continue;
         }
         bun_core::pretty!(" {}", BStr::new(arg));
diff --git a/test/cli/install/bun-prune.test.ts b/test/cli/install/bun-prune.test.ts
index b59827f13b97..adc4b67e87cb 100644
--- a/test/cli/install/bun-prune.test.ts
+++ b/test/cli/install/bun-prune.test.ts
@@ -438,6 +438,42 @@ test.concurrent("--dry-run prints without deleting; --silent deletes without pri
   expect(clean.exitCode).toBe(0);
 });
 
+// `--check` is the CI gate: the same report as `--dry-run`, but exits 1 when anything would be removed, like `bun dedupe --check`.
+test.concurrent("--check reports and exits 1 without deleting", async () => {
+  const dir = await setup({ name: "foo", dependencies: { "no-deps": "1.0.0" } });
+  const junk = plant(dir, "node_modules/junk");
+
+  const check = await prune(dir, "--check");
+  expect(lines(check.stdout)).toStrictEqual([BANNER, "", "- junk", CAN_BE_REMOVED(1, 2), APPLY_HINT()]);
+  expect(check.stderr).toBe("");
+  expect(existsSync(junk)).toBeTrue();
+  expect(check.exitCode).toBe(1);
+
+  // The report is identical to --dry-run; only the exit code differs.
+  const dryRun = await prune(dir, "--dry-run");
+  expect(out(dryRun.stdout)).toBe(out(check.stdout));
+  expect(dryRun.exitCode).toBe(0);
+
+  // The hint omits both flags, so it stays copy-pasteable.
+  const both = await prune(dir, "--dry-run", "--check");
+  expect(lines(both.stdout)).toStrictEqual(lines(check.stdout));
+  expect(both.exitCode).toBe(1);
+
+  const silent = await prune(dir, "--check", "--silent");
+  expect(silent.stdout).toBe("");
+  expect(silent.stderr).toBe("");
+  expect(existsSync(junk)).toBeTrue();
+  expect(silent.exitCode).toBe(1);
+
+  const apply = await prune(dir);
+  expect(apply.exitCode).toBe(0);
+  expect(existsSync(junk)).toBeFalse();
+
+  const clean = await prune(dir, "--check");
+  expect(lines(clean.stdout)).toStrictEqual([BANNER, "", NOTHING(1, 1)]);
+  expect(clean.exitCode).toBe(0);
+});
+
 test.concurrent("nothing to prune when node_modules is missing or clean", async () => {
   const { packageDir, packageJson } = await registry.createTestDir();
   await write(packageJson, JSON.stringify({ name: "foo", dependencies: { "no-deps": "1.0.0" } }));
@@ -3354,6 +3390,7 @@ test.concurrent("--help lists every flag; -F is --filter, -p is --production", a
     Flags:
       -p, --production      Also remove packages that are only needed by devDependencies (alias: --prod)
           --omit=<val>      Also remove packages that are only needed by the given dependency types
+          --check           Exit with code 1 if node_modules has packages that can be removed, without deleting anything
           --dry-run         Print what would be removed without deleting anything
           --os=<val>        Prune for a different operating system than the current one
           --cpu=<val>       Prune for a different CPU architecture than the current one
@@ -3373,6 +3410,9 @@ test.concurrent("--help lists every flag; -F is --filter, -p is --production", a
       Show what would be removed without deleting anything
       bun prune --dry-run
 
+      Only report what would be removed; exit code 1 if there is anything (for CI)
+      bun prune --check
+
       Only prune what the app workspace no longer needs
       bun prune --production --filter app
 

From c046da3f14860840b7cc770b94e4865025d5b163 Mon Sep 17 00:00:00 2001
From: robobun <117481402+robobun@users.noreply.github.com>
Date: Mon, 17 Aug 2026 01:07:35 +0000
Subject: [PATCH 056/258] audit fix: never downgrade a package out of its
 installed release line (#39317)

---
 docs/pm/cli/audit.mdx                         |   4 +-
 src/install/audit_fix.rs                      |  16 +-
 test/cli/install/bun-audit.test.ts            | 199 +++++++++++++++++-
 .../packages/create-zero-major-packages.ts    |  48 +++++
 .../registry/packages/zero-major/package.json |  49 +++++
 .../packages/zero-major/zero-major-0.4.0.tgz  | Bin 0 -> 159 bytes
 .../packages/zero-major/zero-major-0.4.1.tgz  | Bin 0 -> 160 bytes
 .../packages/zero-major/zero-major-0.5.0.tgz  | Bin 0 -> 160 bytes
 .../packages/zero-major/zero-major-0.5.1.tgz  | Bin 0 -> 160 bytes
 9 files changed, 303 insertions(+), 13 deletions(-)
 create mode 100644 test/cli/install/registry/packages/create-zero-major-packages.ts
 create mode 100644 test/cli/install/registry/packages/zero-major/package.json
 create mode 100644 test/cli/install/registry/packages/zero-major/zero-major-0.4.0.tgz
 create mode 100644 test/cli/install/registry/packages/zero-major/zero-major-0.4.1.tgz
 create mode 100644 test/cli/install/registry/packages/zero-major/zero-major-0.5.0.tgz
 create mode 100644 test/cli/install/registry/packages/zero-major/zero-major-0.5.1.tgz

diff --git a/docs/pm/cli/audit.mdx b/docs/pm/cli/audit.mdx
index 8fa35e1734fb..6285756ffc30 100644
--- a/docs/pm/cli/audit.mdx
+++ b/docs/pm/cli/audit.mdx
@@ -96,8 +96,8 @@ Fixed 2 vulnerabilities in 2 packages
 ```
 
 - **blocked by a dependent's range** — no safe version fits a dependent's declared range. If the range is in your own `package.json` or catalog, `bun audit fix --latest` gets past it. Otherwise, update the dependent or add an [`overrides`](/pm/overrides) entry.
-- **no published version fixes** — every published version is vulnerable. Replace the package, or silence the advisory with the printed `--ignore` command.
-- If no newer version is safe but an older one is, Bun downgrades and marks the row `(downgrade)`.
+- **no published version fixes** — every version Bun would install is vulnerable. Replace the package, or silence the advisory with the printed `--ignore` command.
+- If no newer version is safe but an older one is, Bun downgrades and marks the row `(downgrade)`. Bun only downgrades within the installed major version (within the installed minor version below 1.0.0), with or without `--latest`. When an advisory covers every `2.x` release, Bun lists the package under **no published version fixes** instead of installing a `1.x` release.
 - Bun still installs a safe version newer than `--minimum-release-age` and marks the row `(newer than --minimum-release-age)`.
 - Bun upgrades patched dependencies (`patchedDependencies`) like any other package. Re-create the patch afterwards with `bun patch`.
 - After installing, Bun re-audits the new lockfile. The `remaining` count and exit code reflect that second audit, so they match what a follow-up `bun audit` would report.
diff --git a/src/install/audit_fix.rs b/src/install/audit_fix.rs
index 505bd97a225c..c1d01cd6d5ca 100644
--- a/src/install/audit_fix.rs
+++ b/src/install/audit_fix.rs
@@ -214,6 +214,11 @@ struct Candidate {
     downgrade: bool,
 }
 
+/// Downgrades stay in the installed major (minor below 1.0.0): an older line is a different API, and the bulk response only carries advisories matching the installed versions, so its releases merely look safe (#39309).
+fn same_release_line(a: Semver::Version, b: Semver::Version) -> bool {
+    a.major == b.major && (a.major != 0 || a.minor == b.minor)
+}
+
 fn fmt_version(version: Semver::Version, buf: &[u8]) -> Box<[u8]> {
     let mut out: Vec<u8> = Vec::new();
     let _ = write!(out, "{}", version.fmt(buf));
@@ -691,7 +696,13 @@ pub fn plan_fixes(manager: &mut PackageManager, advisories: &[Advisory]) -> crat
         }
         let upgrade_count = candidates.len();
         for (i, &v) in releases.iter().enumerate().rev() {
-            if v.order(inst.current, manifest_buf, buf) == Ordering::Less && is_safe(v) {
+            if v.order(inst.current, manifest_buf, buf) != Ordering::Less {
+                continue;
+            }
+            if !same_release_line(v, inst.current) {
+                break;
+            }
+            if is_safe(v) {
                 candidates.push(Candidate {
                     version: v,
                     index: i,
@@ -819,7 +830,8 @@ pub fn plan_fixes(manager: &mut PackageManager, advisories: &[Advisory]) -> crat
                             edits.push(edit);
                         }
                         // A rewritten peer row is deferred by the differ and rebinds to the old package unless the edge is pinned too.
-                        if edge.peer {
+                        // A rewritten range re-resolves to the newest release it allows, which for a downgrade is the vulnerable one again (`^1.0.1` still takes 1.1.0).
+                        if edge.peer || candidate.downgrade {
                             edges.push(PlannedEdge {
                                 dep_id: edge.dep_id,
                                 parent: edge.parent,
diff --git a/test/cli/install/bun-audit.test.ts b/test/cli/install/bun-audit.test.ts
index 431037cc5bf0..9d23b5c0abf7 100644
--- a/test/cli/install/bun-audit.test.ts
+++ b/test/cli/install/bun-audit.test.ts
@@ -1558,25 +1558,112 @@ describe("`bun audit fix`", () => {
   });
 
   test.concurrent("a range that rejects every safe release is blocked on the highest safe downgrade", async () => {
+    await using server = startRegistry({ "no-deps": [adv(">=1.1.0")] });
+    using dir = await setup(server, { name: "foo", dependencies: { "no-deps": "^1.1.0" } });
+    const lockBefore = await lock(dir);
+    expect(lockBefore).toContain('"no-deps@1.1.0"');
+
+    const { stdout, exitCode } = await auditFix(dir);
+    expect(normalizeBunSnapshot(stdout)).toMatchInlineSnapshot(`
+      "bun audit fix <version> (<revision>)
+
+      blocked by a dependent's range:
+        v no-deps 1.1.0 -> 1.0.1 (downgrade)
+          package.json depends on no-deps@^1.1.0
+          bun audit fix --latest
+
+      Fixed 0 of 1 vulnerability (checked 1)
+      1 vulnerability remaining"
+    `);
+    expect(exitCode).toBe(1);
+    expect(await lock(dir)).toBe(lockBefore);
+  });
+
+  test.concurrent("a safe release in an older major is not a downgrade candidate", async () => {
     await using server = startRegistry({ "no-deps": [adv(">=2.0.0")] });
     using dir = await setup(server, { name: "foo", dependencies: { "no-deps": "^2.0.0" } });
     const lockBefore = await lock(dir);
     expect(lockBefore).toContain('"no-deps@2.0.0"');
 
+    const { stdout, stderr, exitCode } = await auditFix(dir);
+    expect(normalizeBunSnapshot(stdout)).toMatchInlineSnapshot(`
+      "bun audit fix <version> (<revision>)
+
+      no published version fixes:
+        no-deps@2.0.0  1
+          bun audit fix --ignore 1
+
+      Fixed 0 of 1 vulnerability (checked 1)
+      1 vulnerability remaining"
+    `);
+    expect(stderr).not.toContain("Saved lockfile");
+    expect(exitCode).toBe(1);
+    expect(await lock(dir)).toBe(lockBefore);
+  });
+
+  // peer-deps@1.0.0 declares no-deps@* as a peer, so every older release is inside the range; the installed major is still the floor.
+  test.concurrent("a dependent's wide range does not let a fix downgrade into an older major", async () => {
+    await using server = startRegistry({ "no-deps": [adv(">=2.0.0")] });
+    using dir = await setup(server, { name: "foo", dependencies: { "peer-deps": "1.0.0" } });
+    const lockBefore = await lock(dir);
+    expect(lockBefore).toContain('"no-deps@2.0.0"');
+
     const { stdout, exitCode } = await auditFix(dir);
     expect(normalizeBunSnapshot(stdout)).toMatchInlineSnapshot(`
       "bun audit fix <version> (<revision>)
 
-      blocked by a dependent's range:
-        v no-deps 2.0.0 -> 1.1.0 (downgrade)
-          package.json depends on no-deps@^2.0.0
-          bun audit fix --latest
+      no published version fixes:
+        no-deps@2.0.0  1
+          bun audit fix --ignore 1
+
+      Fixed 0 of 1 vulnerability (checked 2)
+      1 vulnerability remaining"
+    `);
+    expect(exitCode).toBe(1);
+    expect(await lock(dir)).toBe(lockBefore);
+    expect(await installedVersion(dir, "no-deps")).toBe("2.0.0");
+  });
+
+  // zero-major publishes 0.4.0, 0.4.1, 0.5.0 and 0.5.1; below 1.0.0 the minor is the release line.
+  test.concurrent("a 0.x package downgrades within its minor line", async () => {
+    await using server = startRegistry({ "zero-major": [adv(">=0.5.1")] });
+    using dir = await setup(server, { name: "foo", dependencies: { "zero-major": "*" } });
+    expect(await lock(dir)).toContain('"zero-major@0.5.1"');
+
+    const { stdout, exitCode } = await auditFix(dir);
+    expect(normalizeBunSnapshot(stdout)).toMatchInlineSnapshot(`
+      "bun audit fix <version> (<revision>)
+
+      fixing:
+        v zero-major 0.5.1 -> 0.5.0 (downgrade)
+
+      Fixed 1 vulnerability in 1 package (checked 1)"
+    `);
+    expect(exitCode).toBe(0);
+    expect(await lock(dir)).toContain('"zero-major@0.5.0"');
+    expect(await installedVersion(dir, "zero-major")).toBe("0.5.0");
+  });
+
+  test.concurrent("a 0.x package is not downgraded into an older minor line", async () => {
+    await using server = startRegistry({ "zero-major": [adv(">=0.5.0")] });
+    using dir = await setup(server, { name: "foo", dependencies: { "zero-major": "*" } });
+    const lockBefore = await lock(dir);
+    expect(lockBefore).toContain('"zero-major@0.5.1"');
+
+    const { stdout, exitCode } = await auditFix(dir);
+    expect(normalizeBunSnapshot(stdout)).toMatchInlineSnapshot(`
+      "bun audit fix <version> (<revision>)
+
+      no published version fixes:
+        zero-major@0.5.1  1
+          bun audit fix --ignore 1
 
       Fixed 0 of 1 vulnerability (checked 1)
       1 vulnerability remaining"
     `);
     expect(exitCode).toBe(1);
     expect(await lock(dir)).toBe(lockBefore);
+    expect(await installedVersion(dir, "zero-major")).toBe("0.5.1");
   });
 
   test.concurrent("no vulnerabilities", async () => {
@@ -3915,8 +4002,8 @@ describe("`bun audit fix`", () => {
   });
 
   test.concurrent("--json marks a blocked fix that would be a downgrade", async () => {
-    await using server = startRegistry({ "no-deps": [adv(">=2.0.0")] });
-    using dir = await setup(server, { name: "foo", dependencies: { "no-deps": "^2.0.0" } });
+    await using server = startRegistry({ "no-deps": [adv(">=1.1.0")] });
+    using dir = await setup(server, { name: "foo", dependencies: { "no-deps": "^1.1.0" } });
     const lockBefore = await lock(dir);
 
     const { stdout, exitCode } = await auditFix(dir, "--json");
@@ -3924,11 +4011,11 @@ describe("`bun audit fix`", () => {
     expect(doc.blocked).toStrictEqual([
       {
         name: "no-deps",
-        from: "2.0.0",
-        to: "1.1.0",
+        from: "1.1.0",
+        to: "1.0.1",
         downgrade: true,
         latestFixes: true,
-        blockers: [{ dependent: "package.json", range: "^2.0.0", bundled: false }],
+        blockers: [{ dependent: "package.json", range: "^1.1.0", bundled: false }],
       },
     ]);
     expect(doc).toMatchObject({ dryRun: false, fixed: 0, remaining: 1, fixes: [] });
@@ -4296,6 +4383,100 @@ describe("`bun audit fix --latest`", () => {
     expect(await lock(dir)).toContain('"no-deps@2.0.0"');
   });
 
+  // Every no-deps 2.x release is vulnerable. The safe 1.x releases are a different major, so there is nothing to rewrite the range to.
+  test.concurrent("never rewrites a range to downgrade into an older major", async () => {
+    await using server = startRegistry({ "no-deps": [adv(">=2.0.0")] });
+    using dir = await setup(server, { name: "foo", dependencies: { "no-deps": "^2.0.0" } });
+    const lockBefore = await lock(dir);
+    expect(lockBefore).toContain('"no-deps@2.0.0"');
+    const pkgJsonBefore = await pkgJsonText(dir);
+
+    const { stdout, stderr, exitCode } = await auditFix(dir, "--latest");
+    expect(normalizeBunSnapshot(stdout)).toMatchInlineSnapshot(`
+      "bun audit fix <version> (<revision>)
+
+      no published version fixes:
+        no-deps@2.0.0  1
+          bun audit fix --ignore 1
+
+      Fixed 0 of 1 vulnerability (checked 1)
+      1 vulnerability remaining"
+    `);
+    expect(stderr).not.toContain("Saved lockfile");
+    expect(exitCode).toBe(1);
+    expect(await pkgJsonText(dir)).toBe(pkgJsonBefore);
+    expect(await lock(dir)).toBe(lockBefore);
+    expect(await installedVersion(dir, "no-deps")).toBe("2.0.0");
+
+    const json = await auditFix(dir, "--latest", "--json");
+    expect(JSON.parse(json.stdout)).toMatchObject({
+      fixed: 0,
+      remaining: 1,
+      fixes: [],
+      blocked: [],
+      unfixable: [{ name: "no-deps", from: "2.0.0", advisories: ["1"] }],
+    });
+    expect(json.exitCode).toBe(1);
+    expect(await pkgJsonText(dir)).toBe(pkgJsonBefore);
+    expect(await lock(dir)).toBe(lockBefore);
+  });
+
+  test.concurrent("rewrites a range for a downgrade that stays in the installed major", async () => {
+    await using server = startRegistry({ "no-deps": [adv(">=1.1.0")] });
+    using dir = await setup(server, { name: "foo", dependencies: { "no-deps": "^1.1.0" } });
+    expect(await lock(dir)).toContain('"no-deps@1.1.0"');
+
+    const { stdout, exitCode } = await auditFix(dir, "--latest");
+    expect(normalizeBunSnapshot(stdout)).toMatchInlineSnapshot(`
+      "bun audit fix <version> (<revision>)
+
+      fixing:
+        v no-deps 1.1.0 -> 1.0.1 (downgrade)
+          package.json: ^1.1.0 -> ^1.0.1
+
+      Fixed 1 vulnerability in 1 package (checked 1)"
+    `);
+    expect(exitCode).toBe(0);
+    expect((await pkgJson(dir)).dependencies).toStrictEqual({ "no-deps": "^1.0.1" });
+    const lockfile = await lock(dir);
+    expect(lockfile).toContain('"no-deps@1.0.1"');
+    expect(lockfile).not.toContain('"no-deps@1.1.0"');
+    expect(await installedVersion(dir, "no-deps")).toBe("1.0.1");
+
+    const recheck = await audit(dir);
+    expectClean(recheck, 1);
+
+    await runBunInstall(installEnv(dir), dir, { frozenLockfile: true });
+  });
+
+  test.concurrent("rewrites a catalog entry for a downgrade that stays in the installed major", async () => {
+    await using server = startRegistry({ "no-deps": [adv(">=1.1.0")] });
+    const member = JSON.stringify({ name: "a", dependencies: { "no-deps": "catalog:" } });
+    using dir = await setup(
+      server,
+      { name: "root", workspaces: ["packages/*"], catalog: { "no-deps": "^1.1.0" } },
+      { "packages/a/package.json": member },
+    );
+    expect(await lock(dir)).toContain('"no-deps@1.1.0"');
+
+    const { stdout, exitCode } = await auditFix(dir, "--latest");
+    expect(stdout).toContain("  v no-deps 1.1.0 -> 1.0.1 (downgrade)\n    package.json (catalog): ^1.1.0 -> ^1.0.1\n");
+    expect(stdout).toContain("Fixed 1 vulnerability in 1 package");
+    expect(exitCode).toBe(0);
+
+    expect((await pkgJson(dir)).catalog).toStrictEqual({ "no-deps": "^1.0.1" });
+    expect(await pkgJsonText(dir, "packages", "a")).toBe(member);
+    const lockfile = await lock(dir);
+    expect(lockfile).toContain('"no-deps@1.0.1"');
+    expect(lockfile).not.toContain('"no-deps@1.1.0"');
+    expect((await pkgJson(dir, "packages", "a", "node_modules", "no-deps")).version).toBe("1.0.1");
+
+    const recheck = await audit(dir);
+    expectClean(recheck, 1);
+
+    await runBunInstall(installEnv(dir), dir, { frozenLockfile: true });
+  });
+
   test.concurrent("a package blocked only by a transitive dependent stays blocked", async () => {
     await using server = startRegistry({ "no-deps": [adv("<1.1.0")] });
     using dir = await setup(server, { name: "foo", dependencies: { "one-dep": "1.0.0" } });
diff --git a/test/cli/install/registry/packages/create-zero-major-packages.ts b/test/cli/install/registry/packages/create-zero-major-packages.ts
new file mode 100644
index 000000000000..ad76055a878f
--- /dev/null
+++ b/test/cli/install/registry/packages/create-zero-major-packages.ts
@@ -0,0 +1,48 @@
+#!/usr/bin/env bun
+// Generates the `zero-major` fixture (0.4.x and 0.5.x releases, nothing else) used by bun-audit.test.ts to check that
+// `bun audit fix` treats 0.x minors as separate release lines.
+
+import { mkdir, writeFile } from "fs/promises";
+import { join } from "path";
+
+const packagesDir = import.meta.dir;
+
+const packages: Record<string, string[]> = {
+  "zero-major": ["0.4.0", "0.4.1", "0.5.0", "0.5.1"],
+};
+
+for (const [name, versionList] of Object.entries(packages)) {
+  const dir = join(packagesDir, name);
+  await mkdir(dir, { recursive: true });
+
+  const versions: Record<string, object> = {};
+  let latest = "";
+  for (const version of versionList) {
+    const pkgJson = { name, version };
+    const tarball = join(dir, `${name}-${version}.tgz`);
+    await Bun.Archive.write(
+      tarball,
+      { "package/package.json": JSON.stringify(pkgJson, null, 2) },
+      { compress: "gzip" },
+    );
+
+    const bytes = await Bun.file(tarball).bytes();
+    versions[version] = {
+      ...pkgJson,
+      _id: `${name}@${version}`,
+      dist: {
+        integrity: `sha512-${Buffer.from(new Bun.CryptoHasher("sha512").update(bytes).digest()).toString("base64")}`,
+        shasum: new Bun.CryptoHasher("sha1").update(bytes).digest("hex"),
+        tarball: `http://localhost:4873/${name}/-/${name}-${version}.tgz`,
+      },
+    };
+    latest = version;
+  }
+
+  await writeFile(
+    join(dir, "package.json"),
+    JSON.stringify({ _id: name, name, "dist-tags": { latest }, versions }, null, 2),
+  );
+}
+
+console.log("Created zero-major test package");
diff --git a/test/cli/install/registry/packages/zero-major/package.json b/test/cli/install/registry/packages/zero-major/package.json
new file mode 100644
index 000000000000..134fc8dfefb1
--- /dev/null
+++ b/test/cli/install/registry/packages/zero-major/package.json
@@ -0,0 +1,49 @@
+{
+  "_id": "zero-major",
+  "name": "zero-major",
+  "dist-tags": {
+    "latest": "0.5.1"
+  },
+  "versions": {
+    "0.4.0": {
+      "name": "zero-major",
+      "version": "0.4.0",
+      "_id": "zero-major@0.4.0",
+      "dist": {
+        "integrity": "sha512-xY4I6VAgjzMCnNTpToxaeCeV1wtNlO92G/rB/V8hUIlhXnNSfiOwoWKr38ElkI9ro09fwPIaM34s7INVa2uCMw==",
+        "shasum": "60ec5ccba9d9ab89bebaa5a0fd117e50a3181e3f",
+        "tarball": "http://localhost:4873/zero-major/-/zero-major-0.4.0.tgz"
+      }
+    },
+    "0.4.1": {
+      "name": "zero-major",
+      "version": "0.4.1",
+      "_id": "zero-major@0.4.1",
+      "dist": {
+        "integrity": "sha512-m9SPZLJj+qAzlWZKR+s0MA8V+nTc9iJiMCM327hhW8ib2cHgj4sC33R61Mffid5uohvhs8VKmTEkLIX+wAGcdw==",
+        "shasum": "ec28d936c91a26ed55ff0ccb57229b9199214d9a",
+        "tarball": "http://localhost:4873/zero-major/-/zero-major-0.4.1.tgz"
+      }
+    },
+    "0.5.0": {
+      "name": "zero-major",
+      "version": "0.5.0",
+      "_id": "zero-major@0.5.0",
+      "dist": {
+        "integrity": "sha512-XXcn5EnWRgNs1wTxAyNamlP5WwzpwinVz29ki/ph99Utwq5NaTa4jTM2d0W8DH1+5SRK4pSD6rE03TFYypOPfQ==",
+        "shasum": "e678e28002fe6c54c5a81ea5353172890d97f07e",
+        "tarball": "http://localhost:4873/zero-major/-/zero-major-0.5.0.tgz"
+      }
+    },
+    "0.5.1": {
+      "name": "zero-major",
+      "version": "0.5.1",
+      "_id": "zero-major@0.5.1",
+      "dist": {
+        "integrity": "sha512-bNixOAGH2uJiY8pqjQq9XERxmxCwl1GsgdrUWrwZDfzn+j8rC97F/uJAPjvRJLL+jfhUZRlN3C/KjgNlWdah+A==",
+        "shasum": "5873c91085ace4ae7c3162b9467848d0db4203fe",
+        "tarball": "http://localhost:4873/zero-major/-/zero-major-0.5.1.tgz"
+      }
+    }
+  }
+}
\ No newline at end of file
diff --git a/test/cli/install/registry/packages/zero-major/zero-major-0.4.0.tgz b/test/cli/install/registry/packages/zero-major/zero-major-0.4.0.tgz
new file mode 100644
index 0000000000000000000000000000000000000000..5244bac82e92912db4433150cfb920638098c128
GIT binary patch
literal 159
zcmb2|=3oGW|8LJ9<Z5ydX?+;^TV(ofz1_D~Jh;uHIB}tJ@>Y$i?+eQEx;1|6KfB*%
zj^>-b#QV9+!avvbE&gp_yn3&Ay8r1}k-0%3OSf;@wCY3B(QC7gb?(%+IKO<toV|Ou
z+I&~fo7vHq_+pFb-ZIT~?H7(OS?%MZA3KY`@JiT~qWQDa%Gn`qfRaBr`P10LJsC6@
F7yvo7M`r*4

literal 0
HcmV?d00001

diff --git a/test/cli/install/registry/packages/zero-major/zero-major-0.4.1.tgz b/test/cli/install/registry/packages/zero-major/zero-major-0.4.1.tgz
new file mode 100644
index 0000000000000000000000000000000000000000..3ebd8e3bfe3834fb26f01573a7e54349a8e94365
GIT binary patch
literal 160
zcmb2|=3oGW|8LK4<T_*^()#dBZI^f2T65Ffh55oN9aGIzL)nj(i<i7!)p6**?*9sl
z;2W}s?edm|pRV&;{L>&bcaQjD|I@3o7C(A*Dmyg$?Vc64vu;ZTerA3CQ)JV{?c1k4
z|951qz{X^WMQ@M9CHuWr{Gxd~R53~4@O-<;Ex$F>_LXegAq{Z@lsw>H!Qc`(laWD#
GfdK$Sc}6e*

literal 0
HcmV?d00001

diff --git a/test/cli/install/registry/packages/zero-major/zero-major-0.5.0.tgz b/test/cli/install/registry/packages/zero-major/zero-major-0.5.0.tgz
new file mode 100644
index 0000000000000000000000000000000000000000..26ed88f9a52396c445a7dd6bc5852a16fd4eff01
GIT binary patch
literal 160
zcmb2|=3oGW|8LK4<T_*^()#dBZI^f2+U=&93-g6lI;NVbhO!?m7cY6es^idq-TxI9
z!8c?N+vP0_KV9dy_@_Z=?i}I8{-;-EEe`s5EA#EuaKA0LvTjQSerA3CQ)JV{?c1k4
z|951qz{X^WMQ@M9CHuWr{Gxd~R53~4@O-<;Ex$F>_Ju^>;f1&XN<L7xVW=)OOJdMq
GU;qG1f<?vv

literal 0
HcmV?d00001

diff --git a/test/cli/install/registry/packages/zero-major/zero-major-0.5.1.tgz b/test/cli/install/registry/packages/zero-major/zero-major-0.5.1.tgz
new file mode 100644
index 0000000000000000000000000000000000000000..4ad009bd2f798a8b8759d5b72398144408b6add3
GIT binary patch
literal 160
zcmb2|=3oGW|8LK4<T_*^()#dBZI^f2+U=&93-g6lI;NVbhO!?m7cY6es^idq-TxI9
z!8c?N+vP0_KV9dy_@_Z=?i}I8{-;-EEe`s5EA#EuaKA0LvTjQSerA3CQ)JV{?c1k4
z|951qz{X^WMQ@M9CHuWr{Gxd~R53~4@O-<;Ex$F>_N~b&G>5nWN;b^@z!0hZLyJL!
GfdK$mUq;vf

literal 0
HcmV?d00001


From 090ab60074670028c9750c998cc2e7bdc8498ae7 Mon Sep 17 00:00:00 2001
From: robobun <117481402+robobun@users.noreply.github.com>
Date: Mon, 17 Aug 2026 01:07:39 +0000
Subject: [PATCH 057/258] run: set npm_package_name/version/json and
 npm_config_local_prefix per run (#38071)

---
 src/runtime/cli/pack_command.rs      |  13 +++-
 src/runtime/cli/run_command.rs       |  29 ++++----
 test/cli/install/bun-pack.test.ts    |  55 +++++++++++++++
 test/cli/install/bun-publish.test.ts |  28 ++++++++
 test/cli/run/run-process-env.test.ts | 100 ++++++++++++++++++++++++++-
 5 files changed, 209 insertions(+), 16 deletions(-)

diff --git a/src/runtime/cli/pack_command.rs b/src/runtime/cli/pack_command.rs
index d9a0f0e03bcb..d4d680602518 100644
--- a/src/runtime/cli/pack_command.rs
+++ b/src/runtime/cli/pack_command.rs
@@ -2048,7 +2048,18 @@ pub(crate) fn pack<const FOR_PUBLISH: bool>(
         // not repeated.
         unsafe { (*transpiler_for_deinit).deinit() };
     }
-    ctx.manager.env_mut().map.put(b"npm_command", b"pack")?;
+    let script_env = ctx.manager.env_mut();
+    script_env.map.put(b"npm_command", b"pack")?;
+    // `configure_env_for_run` described the package.json of the directory the
+    // package manager chdir'd to, which for a workspace member is the
+    // workspace root; the lifecycle scripts belong to the manifest being packed.
+    script_env
+        .map
+        .put(b"npm_package_json", abs_package_json_path.as_bytes())?;
+    script_env.map.put(b"npm_package_name", package_name)?;
+    script_env
+        .map
+        .put(b"npm_package_version", package_version)?;
 
     let (postpack_script, publish_script, postpublish_script, ran_scripts): (
         Option<Box<[u8]>>,
diff --git a/src/runtime/cli/run_command.rs b/src/runtime/cli/run_command.rs
index b0a92bc2ac43..83fba6b67574 100644
--- a/src/runtime/cli/run_command.rs
+++ b/src/runtime/cli/run_command.rs
@@ -686,9 +686,14 @@ Full documentation is available at <magenta>https://bun.com/docs/cli/run<r>
         // remaining env-var seeding.
         let env_loader = this_transpiler.env_mut();
 
+        // Like npm, `npm_config_local_prefix` and the `npm_package_*` vars below
+        // describe this run and overwrite what an outer `bun run` exported
+        // (`cd pkg && bun run x` must see `pkg`'s values); name/version are left
+        // alone only when package.json lacks them. `npm_config_user_agent` /
+        // `npm_execpath` are deliberately inherited.
         env_loader
             .map
-            .put_default(b"npm_config_local_prefix", top_level_dir)
+            .put(b"npm_config_local_prefix", top_level_dir)
             .expect("unreachable");
 
         // Propagate --no-orphans / [run] noOrphans to the script's env so any
@@ -738,26 +743,22 @@ Full documentation is available at <magenta>https://bun.com/docs/cli/run<r>
 
         if let Some(package_json) = root_dir_info.enclosing_package_json {
             if !package_json.name.is_empty() {
-                if env_loader.map.get(NpmArgs::PACKAGE_NAME).is_none() {
-                    env_loader
-                        .map
-                        .put(NpmArgs::PACKAGE_NAME, &package_json.name)
-                        .expect("unreachable");
-                }
+                env_loader
+                    .map
+                    .put(NpmArgs::PACKAGE_NAME, &package_json.name)
+                    .expect("unreachable");
             }
 
             env_loader
                 .map
-                .put_default(b"npm_package_json", package_json.source.path.text)
+                .put(b"npm_package_json", package_json.source.path.text)
                 .expect("unreachable");
 
             if !package_json.version.is_empty() {
-                if env_loader.map.get(NpmArgs::PACKAGE_VERSION).is_none() {
-                    env_loader
-                        .map
-                        .put(NpmArgs::PACKAGE_VERSION, &package_json.version)
-                        .expect("unreachable");
-                }
+                env_loader
+                    .map
+                    .put(NpmArgs::PACKAGE_VERSION, &package_json.version)
+                    .expect("unreachable");
             }
 
             if let Some(config) = package_json.config.as_deref() {
diff --git a/test/cli/install/bun-pack.test.ts b/test/cli/install/bun-pack.test.ts
index 8f67964bbbcd..21c64646b81e 100644
--- a/test/cli/install/bun-pack.test.ts
+++ b/test/cli/install/bun-pack.test.ts
@@ -639,6 +639,61 @@ describe("workspaces", () => {
     const tarball = readTarball(join(packageDir, "pkgs", "pkg1", "pkg1-1.1.1.tgz"));
     expect(tarball.entries).toMatchObject([{ "pathname": "package/package.json" }, { "pathname": "package/index.js" }]);
   });
+
+  describe("lifecycle scripts describe the workspace member being packed", () => {
+    const echoPackageEnv = "$npm_package_name $npm_package_version $npm_package_json $npm_config_local_prefix";
+    let pkg1Dir: string;
+    let expectedLines: string[];
+
+    beforeEach(async () => {
+      pkg1Dir = join(packageDir, "pkgs", "pkg1");
+      // npm_config_local_prefix is the workspace root, as with npm.
+      const memberEnv = `pkg1 1.1.1 ${join(pkg1Dir, "package.json")} ${packageDir}`;
+      expectedLines = [`prepack ${memberEnv}`, `postpack ${memberEnv}`];
+      await Promise.all([
+        write(
+          join(packageDir, "package.json"),
+          JSON.stringify({ name: "pack-workspace", version: "2.2.2", workspaces: ["pkgs/*"] }),
+        ),
+        write(
+          join(pkg1Dir, "package.json"),
+          JSON.stringify({
+            name: "pkg1",
+            version: "1.1.1",
+            scripts: {
+              prepack: `echo prepack ${echoPackageEnv}`,
+              postpack: `echo postpack ${echoPackageEnv}`,
+              release: `'${bunExe()}' pm pack --dry-run`,
+            },
+          }),
+        ),
+      ]);
+    });
+
+    function lifecycleLines(out: string) {
+      return out.split("\n").filter(line => line.startsWith("prepack ") || line.startsWith("postpack "));
+    }
+
+    test("bun pm pack in the member", async () => {
+      const { out } = await pack(pkg1Dir, bunEnv, "--dry-run");
+      expect(lifecycleLines(out)).toEqual(expectedLines);
+    });
+
+    test("bun pm pack from a member script", async () => {
+      await using proc = spawn({
+        cmd: [bunExe(), "run", "--silent", "release"],
+        cwd: pkg1Dir,
+        env: bunEnv,
+        stdout: "pipe",
+        stderr: "pipe",
+      });
+      const [out, err, exitCode] = await Promise.all([proc.stdout.text(), proc.stderr.text(), proc.exited]);
+      expect(lifecycleLines(out)).toEqual(expectedLines);
+      expect(err).not.toContain("error:");
+      expect(exitCode).toBe(0);
+    });
+  });
+
   test("replaces workspace: protocol without lockfile", async () => {
     await Promise.all([
       write(
diff --git a/test/cli/install/bun-publish.test.ts b/test/cli/install/bun-publish.test.ts
index 981a56c307d9..9046680fa541 100644
--- a/test/cli/install/bun-publish.test.ts
+++ b/test/cli/install/bun-publish.test.ts
@@ -1290,6 +1290,34 @@ it("$npm_lifecycle_event is accurate during publish", async () => {
   expect(exitCode).toBe(0);
 });
 
+it("lifecycle scripts get the workspace member's npm_package_* when publishing a member", async () => {
+  const { packageDir, packageJson } = await registry.createTestDir();
+  const memberDir = join(packageDir, "packages", "publish-pkg-12");
+  const echoPackageEnv = "$npm_package_name $npm_package_version $npm_package_json $npm_config_local_prefix";
+  const events = ["prepublishOnly", "prepack", "postpack", "publish", "postpublish"];
+  await Promise.all([
+    write(join(packageDir, "bunfig.toml"), await registry.authBunfig("npm_package_env")),
+    write(packageJson, JSON.stringify({ name: "root", version: "0.0.1", workspaces: ["packages/*"] })),
+    write(
+      join(memberDir, "package.json"),
+      JSON.stringify({
+        name: "publish-pkg-12",
+        version: "12.0.0",
+        scripts: Object.fromEntries(events.map(event => [event, `echo ${event} ${echoPackageEnv}`])),
+      }),
+    ),
+  ]);
+
+  const { out, err, exitCode } = await publish(env, memberDir, "--dry-run");
+  // npm_config_local_prefix is the workspace root, as with npm.
+  const memberEnv = `publish-pkg-12 12.0.0 ${join(memberDir, "package.json")} ${packageDir}`;
+  expect(out.split("\n").filter(line => events.some(event => line.startsWith(`${event} `)))).toEqual(
+    events.map(event => `${event} ${memberEnv}`),
+  );
+  expect(err).not.toContain("error:");
+  expect(exitCode).toBe(0);
+});
+
 describe("readme", () => {
   // Regression for https://github.com/oven-sh/bun/issues/30255 — `bun publish`
   // packed the README into the tarball but never populated the version-level
diff --git a/test/cli/run/run-process-env.test.ts b/test/cli/run/run-process-env.test.ts
index 726aa60fda06..b179405f3477 100644
--- a/test/cli/run/run-process-env.test.ts
+++ b/test/cli/run/run-process-env.test.ts
@@ -1,5 +1,29 @@
 import { describe, expect, test } from "bun:test";
-import { bunExe, bunRunAsScript, tempDir } from "harness";
+import { bunEnv, bunExe, bunRunAsScript, tempDir } from "harness";
+import { join } from "node:path";
+
+// Run with `bun <file>` (not `bun run`), so it prints exactly what the
+// `bun run <script>` under test exported instead of re-deriving the values.
+const printNpmPackageEnv = `process.stdout.write(JSON.stringify({
+  npm_package_name: process.env.npm_package_name,
+  npm_package_version: process.env.npm_package_version,
+  npm_package_json: process.env.npm_package_json,
+  npm_config_local_prefix: process.env.npm_config_local_prefix,
+}));`;
+
+async function runScript(cwd: string, script: string, env: Record<string, string | undefined> = {}) {
+  await using proc = Bun.spawn({
+    cmd: [bunExe(), "run", "--silent", script],
+    cwd,
+    env: { ...bunEnv, ...env },
+    stdout: "pipe",
+    stderr: "pipe",
+  });
+  const [stdout, stderr, exitCode] = await Promise.all([proc.stdout.text(), proc.stderr.text(), proc.exited]);
+  expect(stderr).toBe("");
+  expect(exitCode).toBe(0);
+  return JSON.parse(stdout);
+}
 
 describe("process.env", () => {
   test("npm_lifecycle_event", () => {
@@ -25,4 +49,78 @@ describe("process.env", () => {
     const { stdout } = bunRunAsScript(dir, "first");
     expect(stdout).toBe("second");
   });
+
+  // https://github.com/oven-sh/bun/issues/11713
+  test.concurrent("nested bun run exports the inner package's npm_package_* and npm_config_local_prefix", async () => {
+    using dir = tempDir("processenv_nested_pkg", {
+      "package.json": JSON.stringify({
+        name: "outer-pkg",
+        version: "1.0.0",
+        scripts: { outer: `cd inner && '${bunExe()}' run --silent inner` },
+      }),
+      "print-env.js": printNpmPackageEnv,
+      "inner": {
+        "package.json": JSON.stringify({
+          name: "inner-pkg",
+          version: "2.0.0",
+          scripts: { inner: `'${bunExe()}' ../print-env.js` },
+        }),
+      },
+    });
+
+    expect(await runScript(String(dir), "outer")).toEqual({
+      npm_package_name: "inner-pkg",
+      npm_package_version: "2.0.0",
+      npm_package_json: join(String(dir), "inner", "package.json"),
+      npm_config_local_prefix: join(String(dir), "inner"),
+    });
+  });
+
+  // npm only exports name/version when the package.json has them, so the outer run's values stay visible.
+  test.concurrent("unnamed inner package.json keeps the inherited npm_package_name/version", async () => {
+    using dir = tempDir("processenv_nested_unnamed", {
+      "package.json": JSON.stringify({
+        name: "outer-pkg",
+        version: "1.0.0",
+        scripts: { outer: `'${bunExe()}' run --silent --cwd inner inner` },
+      }),
+      "print-env.js": printNpmPackageEnv,
+      "inner": {
+        "package.json": JSON.stringify({
+          scripts: { inner: `'${bunExe()}' ../print-env.js` },
+        }),
+      },
+    });
+
+    expect(await runScript(String(dir), "outer")).toEqual({
+      npm_package_name: "outer-pkg",
+      npm_package_version: "1.0.0",
+      npm_package_json: join(String(dir), "inner", "package.json"),
+      npm_config_local_prefix: join(String(dir), "inner"),
+    });
+  });
+
+  test.concurrent("npm_package_* and npm_config_local_prefix overwrite inherited environment values", async () => {
+    using dir = tempDir("processenv_stale_pkg", {
+      "package.json": JSON.stringify({
+        name: "my-pkg",
+        version: "3.0.0",
+        scripts: { print: `'${bunExe()}' print-env.js` },
+      }),
+      "print-env.js": printNpmPackageEnv,
+    });
+
+    const stale = {
+      npm_package_name: "stale-name",
+      npm_package_version: "0.0.0-stale",
+      npm_package_json: "/stale/package.json",
+      npm_config_local_prefix: "/stale",
+    };
+    expect(await runScript(String(dir), "print", stale)).toEqual({
+      npm_package_name: "my-pkg",
+      npm_package_version: "3.0.0",
+      npm_package_json: join(String(dir), "package.json"),
+      npm_config_local_prefix: String(dir),
+    });
+  });
 });

From b26ca3ce4ec02b55de7a678989c4c6bddf4d8e25 Mon Sep 17 00:00:00 2001
From: robobun <117481402+robobun@users.noreply.github.com>
Date: Mon, 17 Aug 2026 01:07:43 +0000
Subject: [PATCH 058/258] publish: resolve a relative tarball path against the
 invoking directory (#38704)

---
 src/runtime/cli/publish_command.rs   |  6 +--
 test/cli/install/bun-publish.test.ts | 62 ++++++++++++++++++++++++++++
 2 files changed, 65 insertions(+), 3 deletions(-)

diff --git a/src/runtime/cli/publish_command.rs b/src/runtime/cli/publish_command.rs
index 826d12dbd522..73d22e9ddd66 100644
--- a/src/runtime/cli/publish_command.rs
+++ b/src/runtime/cli/publish_command.rs
@@ -17,7 +17,6 @@ use bun_libarchive::lib::{Archive, ArchiveIterator, IteratorResult as ArchiveIte
 use bun_parsers::json as json_mod;
 use bun_paths::resolve_path::{join_abs_string_buf_z, normalize_buf_spill, normalize_buf_z_spill};
 use bun_paths::{self as path, PathBuffer};
-use bun_resolver::fs::FileSystem;
 use bun_sha_hmac as sha;
 use bun_simdutf_sys::simdutf;
 use bun_sys::dir_iterator as DirIterator;
@@ -138,11 +137,12 @@ impl<'a, const DIRECTORY_PUBLISH: bool> Context<'a, DIRECTORY_PUBLISH> {
     pub(crate) fn from_tarball_path(
         ctx: Command::Context<'a>,
         manager: &'a mut PackageManager,
+        original_cwd: &[u8],
         tarball_path: &[u8],
     ) -> Result<Context<'a, DIRECTORY_PUBLISH>, FromTarballError> {
         let mut abs_buf = PathBuffer::uninit();
         let abs_tarball_path = join_abs_string_buf_z::<path::platform::Auto>(
-            FileSystem::instance().top_level_dir,
+            original_cwd,
             &mut abs_buf,
             &[tarball_path],
         );
@@ -549,13 +549,13 @@ impl PublishCommand {
                     Global::crash();
                 }
             };
-        drop(original_cwd);
         let manager_ptr: *mut PackageManager = manager;
 
         if cli.positionals.len() > 1 {
             let context = match Context::<false>::from_tarball_path(
                 ctx,
                 manager,
+                &original_cwd,
                 cli.positionals[1],
             ) {
                 Ok(c) => c,
diff --git a/test/cli/install/bun-publish.test.ts b/test/cli/install/bun-publish.test.ts
index 9046680fa541..b3b2c49f1f9e 100644
--- a/test/cli/install/bun-publish.test.ts
+++ b/test/cli/install/bun-publish.test.ts
@@ -551,6 +551,68 @@ test("can publish from a tarball", async () => {
   await runBunInstall(env, packageDir, { savesLockfile: false });
   expect(await file(join(packageDir, "node_modules", "publish-pkg-2", "package.json")).json()).toEqual(json);
 });
+describe("relative tarball path", () => {
+  // `bun publish` chdirs to the package root (or the workspace root) before it reads the tarball.
+  // The path on the command line still has to be resolved against the directory the command ran from.
+  // --dry-run never talks to the registry, so a bogus one with auth in the url is enough.
+  const dryRunEnv = { ...env, npm_config_registry: "http://someuser:hunter2@127.0.0.1:1/" };
+
+  test.concurrent("is resolved against the cwd, not the package root above it", async () => {
+    using dir = tempDir("publish-tarball-cwd", {
+      "package.json": JSON.stringify({ name: "publish-tarball-cwd-root", version: "0.0.0" }),
+      "stale-src/package.json": JSON.stringify({ name: "publish-tarball-cwd-stale", version: "0.0.1" }),
+      "dist-src/package.json": JSON.stringify({ name: "publish-tarball-cwd-dist", version: "9.9.9" }),
+      "dist": {},
+    });
+    // a same-named tarball in the package root, and the one we actually mean in ./dist
+    await pack(join(String(dir), "stale-src"), env, "--filename", join(String(dir), "rel.tgz"));
+    await pack(join(String(dir), "dist-src"), env, "--filename", join(String(dir), "dist", "rel.tgz"));
+
+    const { out, err, exitCode } = await publish(dryRunEnv, join(String(dir), "dist"), "./rel.tgz", "--dry-run");
+    expect(err).not.toContain("error:");
+    expect(out).toContain(" + publish-tarball-cwd-dist@9.9.9");
+    expect(out).not.toContain("publish-tarball-cwd-stale");
+    expect(exitCode).toBe(0);
+  });
+
+  test.concurrent("is found when the cwd is a subdirectory of the package root", async () => {
+    using dir = tempDir("publish-tarball-subdir", {
+      "package.json": JSON.stringify({ name: "publish-tarball-subdir-root", version: "0.0.0" }),
+      "dist-src/package.json": JSON.stringify({ name: "publish-tarball-subdir-dist", version: "1.0.0" }),
+      "dist": {},
+    });
+    await pack(join(String(dir), "dist-src"), env, "--filename", join(String(dir), "dist", "pkg.tgz"));
+
+    const { out, err, exitCode } = await publish(dryRunEnv, join(String(dir), "dist"), "pkg.tgz", "--dry-run");
+    expect(err).not.toContain("ENOENT");
+    expect(out).toContain(" + publish-tarball-subdir-dist@1.0.0");
+    expect(exitCode).toBe(0);
+  });
+
+  test.concurrent("is found when the cwd is a workspace package", async () => {
+    using dir = tempDir("publish-tarball-workspace", {
+      "package.json": JSON.stringify({
+        name: "publish-tarball-workspace-root",
+        version: "0.0.0",
+        workspaces: ["packages/*"],
+      }),
+      "packages/member/package.json": JSON.stringify({ name: "publish-tarball-workspace-member", version: "1.2.3" }),
+    });
+    const memberDir = join(String(dir), "packages", "member");
+    await pack(memberDir, env);
+    expect(await exists(join(memberDir, "publish-tarball-workspace-member-1.2.3.tgz"))).toBeTrue();
+
+    const { out, err, exitCode } = await publish(
+      dryRunEnv,
+      memberDir,
+      "./publish-tarball-workspace-member-1.2.3.tgz",
+      "--dry-run",
+    );
+    expect(err).not.toContain("ENOENT");
+    expect(out).toContain(" + publish-tarball-workspace-member@1.2.3");
+    expect(exitCode).toBe(0);
+  });
+});
 test("can publish scoped packages", async () => {
   const { packageDir, packageJson } = await registry.createTestDir();
   const bunfig = await registry.authBunfig("scoped-pkg");

From a65c1eb79054a944321af190395ad47673464dfd Mon Sep 17 00:00:00 2001
From: robobun <117481402+robobun@users.noreply.github.com>
Date: Mon, 17 Aug 2026 01:07:48 +0000
Subject: [PATCH 059/258] pack, publish: include entries on filesystems whose
 readdir reports DT_UNKNOWN (#38716)

---
 src/runtime/cli/pack_command.rs             |   5 +
 src/runtime/cli/publish_command.rs          |   2 +
 src/sys/lib.rs                              |  36 ++++-
 test/cli/install/dt-unknown-readdir.test.ts | 160 ++++++++++++++++++++
 test/fixtures/dt-unknown-readdir-shim.c     |  50 ++++++
 test/harness.ts                             |  45 ++++++
 6 files changed, 295 insertions(+), 3 deletions(-)
 create mode 100644 test/cli/install/dt-unknown-readdir.test.ts
 create mode 100644 test/fixtures/dt-unknown-readdir-shim.c

diff --git a/src/runtime/cli/pack_command.rs b/src/runtime/cli/pack_command.rs
index d4d680602518..70f12e2174e4 100644
--- a/src/runtime/cli/pack_command.rs
+++ b/src/runtime/cli/pack_command.rs
@@ -476,6 +476,7 @@ fn iterate_included_project_tree(
         });
 
         let mut dir_iter = DirIterator::iterate(Fd::from_std_dir(&dir));
+        dir_iter.resolve_unknown_entry_types = true;
         'next_entry: while let Some(entry) = dir_iter.next().ok().flatten() {
             // On iterator error, treat as end of iteration.
             if entry.kind != bun_sys::FileKind::File && entry.kind != bun_sys::FileKind::Directory {
@@ -713,6 +714,7 @@ fn add_entire_tree(
         }
 
         let mut iter = DirIterator::iterate(Fd::from_std_dir(&dir));
+        iter.resolve_unknown_entry_types = true;
         'next_entry: while let Some(entry) = iter.next().ok().flatten() {
             if entry.kind != bun_sys::FileKind::File && entry.kind != bun_sys::FileKind::Directory {
                 continue;
@@ -884,6 +886,7 @@ fn iterate_bundled_deps(
     let mut additional_bundled_deps: Vec<DirInfo> = Vec::new();
 
     let mut iter = DirIterator::iterate(Fd::from_std_dir(&dir));
+    iter.resolve_unknown_entry_types = true;
     while let Some(entry) = iter.next().ok().flatten() {
         if entry.kind != bun_sys::FileKind::Directory {
             continue;
@@ -1023,6 +1026,7 @@ fn add_bundled_dep(
         let DirInfo(dir, dir_subpath, dir_depth) = dir_info;
 
         let mut iter = DirIterator::iterate(Fd::from_std_dir(&dir));
+        iter.resolve_unknown_entry_types = true;
         while let Some(entry) = iter.next().ok().flatten() {
             if entry.kind != bun_sys::FileKind::File && entry.kind != bun_sys::FileKind::Directory {
                 continue;
@@ -1285,6 +1289,7 @@ fn iterate_project_tree(
         }
 
         let mut dir_iter = DirIterator::iterate(Fd::from_std_dir(&dir));
+        dir_iter.resolve_unknown_entry_types = true;
         'next_entry: while let Some(entry) = dir_iter.next().ok().flatten() {
             if entry.kind != bun_sys::FileKind::File && entry.kind != bun_sys::FileKind::Directory {
                 continue;
diff --git a/src/runtime/cli/publish_command.rs b/src/runtime/cli/publish_command.rs
index 73d22e9ddd66..661251897af3 100644
--- a/src/runtime/cli/publish_command.rs
+++ b/src/runtime/cli/publish_command.rs
@@ -1577,6 +1577,7 @@ impl PublishCommand {
         });
 
         let mut iter = DirIterator::iterate(workspace_dir);
+        iter.resolve_unknown_entry_types = true;
         while let Some(entry) = iter.next().ok().flatten() {
             if entry.kind == bun_sys::EntryKind::Directory {
                 continue;
@@ -1807,6 +1808,7 @@ impl PublishCommand {
                     });
 
                     let mut iter = DirIterator::iterate(dir);
+                    iter.resolve_unknown_entry_types = true;
                     while let Some(entry) = iter.next().ok().flatten() {
                         let (name, subpath): (&'static ZStr, &'static ZStr) = {
                             // Entry names are UTF-8 on every platform.
diff --git a/src/sys/lib.rs b/src/sys/lib.rs
index 4a1c4833770e..75ea40183bca 100644
--- a/src/sys/lib.rs
+++ b/src/sys/lib.rs
@@ -122,6 +122,25 @@ pub mod dir_iterator {
         pub kind: EntryKind,
     }
 
+    impl IteratorResult {
+        /// See `WrappedIterator::resolve_unknown_entry_types`.
+        fn resolve_unknown_kind(&mut self, dir: Fd) {
+            #[cfg(not(windows))]
+            {
+                if self.kind == EntryKind::Unknown {
+                    if let Ok(stat) = super::lstatat(dir, self.name.as_zstr()) {
+                        self.kind = super::kind_from_mode(stat.st_mode as super::Mode);
+                    }
+                }
+            }
+            #[cfg(windows)]
+            {
+                // The Windows iterator always knows the kind.
+                let _ = dir;
+            }
+        }
+    }
+
     /// Length-known, NUL-terminated entry name in OS-native encoding.
     ///
     /// **POSIX**: lifetime-erased borrow (raw pointer + length) into the
@@ -265,8 +284,7 @@ pub mod dir_iterator {
             // literal matches <sys/dirent.h>.
             #[cfg(any(target_os = "macos", target_os = "freebsd"))]
             14 /* DT_WHT */ => EntryKind::Whiteout,
-            // DT_UNKNOWN: some filesystems (bind mounts, FUSE, NFS) don't
-            // provide d_type. Callers should lstatat() to resolve when needed.
+            // DT_UNKNOWN: see `WrappedIterator::resolve_unknown_entry_types`.
             _ => EntryKind::Unknown,
         }
     }
@@ -731,6 +749,10 @@ pub mod dir_iterator {
         #[cfg(not(windows))]
         name_filter: Option<Vec<u16>>,
         state: State,
+        /// `lstat` entries whose kind the filesystem did not report (`Unknown`:
+        /// FUSE, NFS, XFS with `ftype=0`), so that, as with `d_type`, a symlink is
+        /// still a symlink. Entries that cannot be stat'ed stay `Unknown`.
+        pub resolve_unknown_entry_types: bool,
     }
     impl WrappedIterator {
         #[inline]
@@ -759,7 +781,13 @@ pub mod dir_iterator {
         /// Copy it out before pushing the iterator into a `Vec` etc.
         #[inline]
         pub fn next(&mut self) -> Result<Option<IteratorResult>> {
-            self.state.next(self.dir)
+            let mut entry = self.state.next(self.dir)?;
+            if self.resolve_unknown_entry_types {
+                if let Some(entry) = entry.as_mut() {
+                    entry.resolve_unknown_kind(self.dir);
+                }
+            }
+            Ok(entry)
         }
     }
 
@@ -770,6 +798,7 @@ pub mod dir_iterator {
                 dir,
                 name_filter: None,
                 state: State::new(),
+                resolve_unknown_entry_types: false,
             }
         }
         #[cfg(windows)]
@@ -777,6 +806,7 @@ pub mod dir_iterator {
             WrappedIterator {
                 dir,
                 state: State::new(),
+                resolve_unknown_entry_types: false,
             }
         }
     }
diff --git a/test/cli/install/dt-unknown-readdir.test.ts b/test/cli/install/dt-unknown-readdir.test.ts
new file mode 100644
index 000000000000..56fa2d784240
--- /dev/null
+++ b/test/cli/install/dt-unknown-readdir.test.ts
@@ -0,0 +1,160 @@
+// Some filesystems (FUSE, NFS, XFS formatted with ftype=0) do not fill in
+// d_type, so every readdir entry comes back as DT_UNKNOWN. The package manager
+// commands must behave as they do elsewhere; `dtUnknownReaddir` (harness)
+// simulates such a filesystem with an LD_PRELOAD shim.
+import { readTarball } from "bun:internal-for-testing";
+import { beforeAll, describe, expect, test } from "bun:test";
+import { bunExe, dtUnknownReaddir, tempDir } from "harness";
+import { symlink, writeFile } from "node:fs/promises";
+import { join } from "node:path";
+
+let env: NodeJS.Dict<string>;
+
+// Compiles the shim; a C compiler on a busy CI machine can take longer than the
+// default hook timeout.
+beforeAll(async () => {
+  if (dtUnknownReaddir.available) env = await dtUnknownReaddir.env();
+}, 30_000);
+
+async function run(cwd: string, ...args: string[]) {
+  await using proc = Bun.spawn({
+    cmd: [bunExe(), ...args],
+    cwd,
+    env,
+    stdin: "ignore",
+    stdout: "pipe",
+    stderr: "pipe",
+  });
+  const [stdout, stderr, exitCode] = await Promise.all([proc.stdout.text(), proc.stderr.text(), proc.exited]);
+  expect(stderr).toContain(dtUnknownReaddir.marker);
+  expect({ stdout, stderr, exitCode }).toMatchObject({ stderr: expect.not.stringContaining("error:"), exitCode: 0 });
+}
+
+function packedPaths(tarball: string): string[] {
+  return readTarball(tarball)
+    .entries.map((entry: { pathname: string }) => entry.pathname)
+    .sort();
+}
+
+describe.skipIf(!dtUnknownReaddir.available)("pack on a filesystem whose readdir reports DT_UNKNOWN", () => {
+  test.concurrent("packs the project tree", async () => {
+    using dir = tempDir("dt-unknown-tree", {
+      "package.json": JSON.stringify({ name: "dt-unknown-tree", version: "1.0.0" }),
+      "index.js": "",
+      "lib/a.js": "",
+      "lib/nested/b.js": "",
+      // `out/` only ignores directories, so it needs the entry's kind: the
+      // `out` directory is ignored, the `lib/out` file is not.
+      ".npmignore": "out/\n",
+      "out/c.js": "",
+      "lib/out": "",
+    });
+    // Symlinks are never packed; resolving the kind with lstat has to keep that.
+    await symlink("index.js", join(String(dir), "link.js"));
+
+    await run(String(dir), "pm", "pack");
+
+    expect(packedPaths(join(String(dir), "dt-unknown-tree-1.0.0.tgz"))).toEqual([
+      "package/index.js",
+      "package/lib/a.js",
+      "package/lib/nested/b.js",
+      "package/lib/out",
+      "package/package.json",
+    ]);
+  });
+
+  test.concurrent('packs what "files" selects', async () => {
+    using dir = tempDir("dt-unknown-files", {
+      "package.json": JSON.stringify({
+        name: "dt-unknown-files",
+        version: "1.0.0",
+        files: ["index.js", "lib", "!lib/internal/"],
+      }),
+      "index.js": "",
+      "excluded.js": "",
+      "lib/a.js": "",
+      "lib/nested/b.js": "",
+      "lib/internal/c.js": "",
+    });
+    await symlink("a.js", join(String(dir), "lib", "link.js"));
+
+    await run(String(dir), "pm", "pack");
+
+    expect(packedPaths(join(String(dir), "dt-unknown-files-1.0.0.tgz"))).toEqual([
+      "package/index.js",
+      "package/lib/a.js",
+      "package/lib/nested/b.js",
+      "package/package.json",
+    ]);
+  });
+
+  test.concurrent("packs bundledDependencies", async () => {
+    using dir = tempDir("dt-unknown-bundled", {
+      "package.json": JSON.stringify({
+        name: "dt-unknown-bundled",
+        version: "1.0.0",
+        dependencies: { "dep": "1.0.0", "@scope/dep": "1.0.0", "not-bundled": "1.0.0" },
+        bundledDependencies: ["dep", "@scope/dep"],
+      }),
+      "index.js": "",
+      "node_modules/dep/package.json": JSON.stringify({ name: "dep", version: "1.0.0" }),
+      "node_modules/dep/lib/index.js": "",
+      "node_modules/@scope/dep/package.json": JSON.stringify({ name: "@scope/dep", version: "1.0.0" }),
+      "node_modules/@scope/dep/index.js": "",
+      "node_modules/not-bundled/package.json": JSON.stringify({ name: "not-bundled", version: "1.0.0" }),
+    });
+
+    await run(String(dir), "pm", "pack");
+
+    expect(packedPaths(join(String(dir), "dt-unknown-bundled-1.0.0.tgz"))).toEqual([
+      "package/index.js",
+      "package/node_modules/@scope/dep/index.js",
+      "package/node_modules/@scope/dep/package.json",
+      "package/node_modules/dep/lib/index.js",
+      "package/node_modules/dep/package.json",
+      "package/package.json",
+    ]);
+  });
+
+  test.concurrent('publish packs the tree, walks "directories.bin" and finds the readme', async () => {
+    let captured: any;
+    using registry = Bun.serve({
+      port: 0,
+      async fetch(req) {
+        if (req.method === "PUT") captured = await req.json();
+        return new Response("OK");
+      },
+    });
+    using dir = tempDir("dt-unknown-publish", {
+      "bunfig.toml": `[install]\ncache = false\nregistry = { url = "http://localhost:${registry.port}", token = "unused" }\n`,
+      "package.json": JSON.stringify({
+        name: "dt-unknown-publish",
+        version: "1.0.0",
+        directories: { bin: "bins" },
+      }),
+      "README.md": "# dt-unknown-publish",
+      "index.js": "",
+      "bins/a.js": "",
+      "bins/more/b.js": "",
+    });
+
+    await run(String(dir), "publish");
+
+    expect(captured.versions["1.0.0"]).toMatchObject({
+      bin: { "a.js": "bins/a.js", "more": "bins/more", "b.js": "bins/more/b.js" },
+      readme: "# dt-unknown-publish",
+      readmeFilename: "README.md",
+    });
+
+    const attachment: { data: string } = Object.values(captured._attachments)[0] as any;
+    const tarball = join(String(dir), "published.tgz");
+    await writeFile(tarball, Buffer.from(attachment.data, "base64"));
+    expect(packedPaths(tarball)).toEqual([
+      "package/README.md",
+      "package/bins/a.js",
+      "package/bins/more/b.js",
+      "package/index.js",
+      "package/package.json",
+    ]);
+  });
+});
diff --git a/test/fixtures/dt-unknown-readdir-shim.c b/test/fixtures/dt-unknown-readdir-shim.c
new file mode 100644
index 000000000000..e6a435a315e0
--- /dev/null
+++ b/test/fixtures/dt-unknown-readdir-shim.c
@@ -0,0 +1,50 @@
+// LD_PRELOAD shim: every getdents64 record comes back with d_type == DT_UNKNOWN,
+// the way FUSE, some NFS servers and XFS formatted with ftype=0 report entries.
+// bun issues getdents64 through libc's syscall() wrapper, which this interposes.
+// Compiled by `dtUnknownReaddir` in test/harness.ts, which defines MARKER: it is
+// written to stderr the first time a record is rewritten so a test can tell the
+// shim actually saw bun's readdir calls.
+#define _GNU_SOURCE
+#include <dlfcn.h>
+#include <stdarg.h>
+#include <stdint.h>
+#include <string.h>
+#include <sys/syscall.h>
+#include <unistd.h>
+
+static long (*real_syscall)(long, long, long, long, long, long, long);
+static int announced;
+
+long syscall(long number, ...) {
+  va_list ap;
+  long a, b, c, d, e, f;
+  va_start(ap, number);
+  a = va_arg(ap, long);
+  b = va_arg(ap, long);
+  c = va_arg(ap, long);
+  d = va_arg(ap, long);
+  e = va_arg(ap, long);
+  f = va_arg(ap, long);
+  va_end(ap);
+  if (!real_syscall) {
+    real_syscall = (long (*)(long, long, long, long, long, long, long))dlsym(RTLD_NEXT, "syscall");
+  }
+  long rc = real_syscall(number, a, b, c, d, e, f);
+  if (number != SYS_getdents64 || rc <= 0) return rc;
+  if (!announced) {
+    announced = 1;
+    static const char marker[] = MARKER "\n";
+    if (write(2, marker, sizeof(marker) - 1) < 0) {
+    }
+  }
+  // struct linux_dirent64 { u64 d_ino; s64 d_off; u16 d_reclen; u8 d_type; char d_name[]; }
+  unsigned char *buf = (unsigned char *)b;
+  for (long off = 0; off + 19 <= rc;) {
+    uint16_t reclen;
+    memcpy(&reclen, buf + off + 16, sizeof(reclen));
+    if (reclen == 0) break;
+    buf[off + 18] = 0; /* DT_UNKNOWN */
+    off += reclen;
+  }
+  return rc;
+}
diff --git a/test/harness.ts b/test/harness.ts
index b3167919ec84..c2034a71319c 100644
--- a/test/harness.ts
+++ b/test/harness.ts
@@ -2275,6 +2275,51 @@ export function compileFixture(sourcePath: string, options: { flags?: string[] }
   return outPath;
 }
 
+const dtUnknownReaddirMarker = "dt-unknown-readdir-shim: rewrote getdents64 d_type";
+let dtUnknownReaddirShim: Promise<string> | undefined;
+
+async function compileDtUnknownReaddirShim(): Promise<string> {
+  const cc = which("cc") || which("clang") || which("gcc");
+  if (!cc) throw new Error("dtUnknownReaddir: no C compiler (cc/clang/gcc) found in $PATH");
+  const shim = join(tmpdirSync("dt-unknown-readdir-"), "shim.so");
+  const source = join(import.meta.dir, "fixtures", "dt-unknown-readdir-shim.c");
+  const proc = Bun.spawn({
+    cmd: [cc, "-shared", "-fPIC", "-O2", `-DMARKER="${dtUnknownReaddirMarker}"`, "-o", shim, source, "-ldl"],
+    env: bunEnv,
+    stdout: "pipe",
+    stderr: "pipe",
+  });
+  const [stdout, stderr, exitCode] = await Promise.all([proc.stdout.text(), proc.stderr.text(), proc.exited]);
+  if (exitCode !== 0)
+    throw new Error(`dtUnknownReaddir: compiling the shim failed (exit ${exitCode}):\n${stderr || stdout}`);
+  return shim;
+}
+
+/**
+ * Runs bun as if on a filesystem whose readdir does not report entry types
+ * (FUSE, some NFS servers, XFS formatted with `ftype=0`), without needing such a
+ * mount: `env()` preloads a shim that zeroes `d_type` in every `getdents64`
+ * record. The shim prints `marker` to stderr the first time it does so; assert
+ * on it, otherwise a test here passes vacuously if bun ever stops issuing
+ * `getdents64` through libc's `syscall()` wrapper, which is what the shim hooks.
+ */
+export const dtUnknownReaddir = {
+  /** Linux with a C compiler; `skipIf(!dtUnknownReaddir.available)`. */
+  get available(): boolean {
+    return isLinux && !!(which("cc") || which("clang") || which("gcc"));
+  },
+  marker: dtUnknownReaddirMarker,
+  /**
+   * Compiles the shim the first time it is called. Call it from `beforeAll`
+   * (the compiler can take several seconds on a loaded machine) and spawn bun
+   * with the returned env.
+   */
+  async env(): Promise<NodeJS.Dict<string>> {
+    const shim = await (dtUnknownReaddirShim ??= compileDtUnknownReaddirShim());
+    return { ...bunEnv, LD_PRELOAD: bunEnv.LD_PRELOAD ? `${shim}:${bunEnv.LD_PRELOAD}` : shim };
+  },
+};
+
 export const rss: () => number =
   process.platform === "darwin" && typeof Bun.unsafe.memoryFootprint === "function"
     ? (Bun.unsafe.memoryFootprint as () => number)

From a0e4a6bdcfcb475ab187dd4ffa22719e150b71f8 Mon Sep 17 00:00:00 2001
From: robobun <117481402+robobun@users.noreply.github.com>
Date: Mon, 17 Aug 2026 01:07:53 +0000
Subject: [PATCH 060/258] pack: build the tarball in memory and write it out
 only once it is complete (#38721)

---
 src/libarchive/lib.rs                |  22 +-
 src/runtime/cli/pack_command.rs      | 362 +++++++++++----------------
 src/runtime/cli/publish_command.rs   |  10 +-
 test/cli/install/bun-pack.test.ts    | 120 ++++++++-
 test/cli/install/bun-publish.test.ts |  47 ++++
 5 files changed, 323 insertions(+), 238 deletions(-)

diff --git a/src/libarchive/lib.rs b/src/libarchive/lib.rs
index 3965e9b415fb..4c20e66b36ff 100644
--- a/src/libarchive/lib.rs
+++ b/src/libarchive/lib.rs
@@ -105,6 +105,8 @@ pub mod lib {
         fn archive_write_new() -> *mut Archive;
         fn archive_write_free(a: *mut Archive) -> Result;
         fn archive_write_close(a: *mut Archive) -> Result;
+        fn archive_write_set_bytes_in_last_block(a: *mut Archive, bytes: c_int) -> Result;
+        fn archive_set_error(a: *mut Archive, err: c_int, fmt: *const c_char, ...);
         fn archive_write_set_format_pax_restricted(a: *mut Archive) -> Result;
         fn archive_write_add_filter_gzip(a: *mut Archive) -> Result;
         fn archive_write_set_filter_option(
@@ -114,7 +116,6 @@ pub mod lib {
             value: *const c_char,
         ) -> Result;
         fn archive_write_set_options(a: *mut Archive, opts: *const c_char) -> Result;
-        fn archive_write_open_filename(a: *mut Archive, filename: *const c_char) -> Result;
         fn archive_write_header(a: *mut Archive, entry: *mut Entry) -> Result;
         fn archive_write_data(a: *mut Archive, data: *const c_void, size: usize) -> la_ssize_t;
         fn archive_write_finish_entry(a: *mut Archive) -> Result;
@@ -370,14 +371,15 @@ pub mod lib {
             // SAFETY: FFI call with no preconditions.
             unsafe { archive_write_new() }
         }
-        pub fn write_free(&self) -> Result {
-            // SAFETY: self came from archive_write_new(); not used after this.
-            unsafe { archive_write_free(self.as_mut_ptr()) }
-        }
         pub fn write_close(&self) -> Result {
             // SAFETY: self valid.
             unsafe { archive_write_close(self.as_mut_ptr()) }
         }
+        /// Padding unit for the last output block; the default pads it to 10 KiB, 1 disables padding.
+        pub fn write_set_bytes_in_last_block(&self, bytes: c_int) -> Result {
+            // SAFETY: self valid.
+            unsafe { archive_write_set_bytes_in_last_block(self.as_mut_ptr(), bytes) }
+        }
         pub fn write_set_format_pax_restricted(&self) -> Result {
             // SAFETY: self valid.
             unsafe { archive_write_set_format_pax_restricted(self.as_mut_ptr()) }
@@ -406,10 +408,6 @@ pub mod lib {
             // SAFETY: self valid; ZStr guarantees NUL-termination.
             unsafe { archive_write_set_options(self.as_mut_ptr(), opts.as_ptr().cast()) }
         }
-        pub fn write_open_filename(&self, filename: &ZStr) -> Result {
-            // SAFETY: self valid; ZStr guarantees NUL-termination.
-            unsafe { archive_write_open_filename(self.as_mut_ptr(), filename.as_ptr().cast()) }
-        }
         pub fn write_header(&self, entry: &Entry) -> Result {
             // SAFETY: self valid; entry came from Entry::new()/read_next_header().
             // `Entry` has interior mutability so `&Entry -> *mut Entry` is sound.
@@ -831,7 +829,7 @@ pub mod lib {
         }
 
         pub unsafe extern "C" fn write_callback(
-            _a: *mut Archive,
+            a: *mut Archive,
             client_data: *mut c_void,
             buff: *const c_void,
             length: usize,
@@ -845,6 +843,10 @@ pub mod lib {
             let data = unsafe { core::slice::from_raw_parts(buff.cast::<u8>(), length) };
             if this.list.try_reserve(length).is_err() {
                 this.had_error = true;
+                // libarchive sets no error of its own for a failed client write.
+                // SAFETY: `a` is the archive this callback was invoked for; the
+                // format string has no conversions, so no varargs are read.
+                unsafe { archive_set_error(a, libc::ENOMEM, c"No memory".as_ptr()) };
                 return -1;
             }
             this.list.extend_from_slice(data);
diff --git a/src/runtime/cli/pack_command.rs b/src/runtime/cli/pack_command.rs
index 70f12e2174e4..5eeb7a32bde0 100644
--- a/src/runtime/cli/pack_command.rs
+++ b/src/runtime/cli/pack_command.rs
@@ -19,7 +19,10 @@ use bun_parsers::json as JSON;
 // lift via `bun_ast::Expr::from(t2_expr)` at the call site.
 use bun_ast::{E, Expr, ExprData};
 use bun_js_printer as js_printer;
-use bun_libarchive::lib::{Archive, Entry as ArchiveEntry, Result as ArchiveStatus};
+use bun_libarchive::lib::{
+    Archive, Entry as ArchiveEntry, GrowingBuffer, Result as ArchiveStatus, WriteArchive,
+    archive_write_open2,
+};
 use bun_paths::{self as path, PathBuffer, SEP_STR};
 // `bun.ptr.CowString = CowSlice(u8)` — the lifetime-free struct port (init_owned/
 // borrow_subslice/length live on `cow_slice::CowSliceZ`).
@@ -1701,18 +1704,6 @@ const fn zstr_lit(s: &'static [u8]) -> &'static ZStr {
 /// Extension trait wrapping `*mut Archive` so existing `archive.method()` call
 /// sites compile without per-call `unsafe { &* }`.
 trait ArchivePtrExt {
-    fn write_set_format_pax_restricted(self) -> ArchiveResult;
-    fn write_add_filter_gzip(self) -> ArchiveResult;
-    fn write_set_filter_option(
-        self,
-        module: Option<&ZStr>,
-        key: &ZStr,
-        value: &ZStr,
-    ) -> ArchiveResult;
-    fn write_set_options(self, opts: &ZStr) -> ArchiveResult;
-    fn write_open_filename(self, path: &ZStr) -> ArchiveResult;
-    fn write_close(self) -> ArchiveResult;
-    fn write_free(self) -> ArchiveResult;
     fn error_string(self) -> &'static [u8];
     fn read_support_format_tar(self) -> ArchiveResult;
     fn read_support_format_gnutar(self) -> ArchiveResult;
@@ -1725,44 +1716,11 @@ trait ArchivePtrExt {
     fn read_free(self) -> ArchiveResult;
 }
 impl ArchivePtrExt for *mut Archive {
-    #[inline]
-    fn write_set_format_pax_restricted(self) -> ArchiveResult {
-        Archive::opaque_ref(self).write_set_format_pax_restricted()
-    }
-    #[inline]
-    fn write_add_filter_gzip(self) -> ArchiveResult {
-        Archive::opaque_ref(self).write_add_filter_gzip()
-    }
-    #[inline]
-    fn write_set_filter_option(
-        self,
-        module: Option<&ZStr>,
-        key: &ZStr,
-        value: &ZStr,
-    ) -> ArchiveResult {
-        Archive::opaque_ref(self).write_set_filter_option(module, key, value)
-    }
-    #[inline]
-    fn write_set_options(self, opts: &ZStr) -> ArchiveResult {
-        Archive::opaque_ref(self).write_set_options(opts)
-    }
-    #[inline]
-    fn write_open_filename(self, path: &ZStr) -> ArchiveResult {
-        Archive::opaque_ref(self).write_open_filename(path)
-    }
-    #[inline]
-    fn write_close(self) -> ArchiveResult {
-        Archive::opaque_ref(self).write_close()
-    }
-    #[inline]
-    fn write_free(self) -> ArchiveResult {
-        Archive::opaque_ref(self).write_free()
-    }
     #[inline]
     fn error_string(self) -> &'static [u8] {
         // Every `ArchivePtrExt` call site holds a live `*mut Archive` from
-        // `archive_{read,write}_new()` (the trait exists precisely so those
-        // sites avoid per-call `unsafe { &* }`).
+        // `archive_read_new()` (the trait exists precisely so those sites
+        // avoid per-call `unsafe { &* }`).
         Archive::opaque_ref(self).error_string()
     }
     #[inline]
@@ -2452,15 +2410,6 @@ pub(crate) fn pack<const FOR_PUBLISH: bool>(
         }
 
         if FOR_PUBLISH {
-            let mut dest_buf = PathBuffer::uninit();
-            let (abs_tarball_dest, _) = tarball_destination(
-                opt_pack_destination(ctx.manager),
-                opt_pack_filename(ctx.manager),
-                abs_workspace_path,
-                package_name,
-                package_version,
-                &mut dest_buf[..],
-            );
             // Note: `manager`/`command_ctx` reborrowed via raw pointer —
             // both are process-lifetime
             // singletons (see `cli::command::GLOBAL_CLI_CTX`).
@@ -2474,7 +2423,6 @@ pub(crate) fn pack<const FOR_PUBLISH: bool>(
                 command_ctx: unsafe { &mut *std::ptr::from_mut(ctx.command_ctx) },
                 package_name: package_name.into(),
                 package_version: package_version.into(),
-                abs_tarball_path: ZStr::boxed(abs_tarball_dest.as_bytes()),
                 tarball_bytes: Box::new([]),
                 uses_workspaces: false,
                 publish_script,
@@ -2489,7 +2437,9 @@ pub(crate) fn pack<const FOR_PUBLISH: bool>(
 
     let mut print_buf: Vec<u8> = Vec::new();
 
-    let archive = Archive::write_new();
+    // Must outlive `archive`, whose close (also run by its Drop) writes into it.
+    let mut tarball_buffer = GrowingBuffer::init();
+    let archive = WriteArchive::new();
 
     match archive.write_set_format_pax_restricted() {
         ArchiveResult::Failed | ArchiveResult::Fatal | ArchiveResult::Warn => {
@@ -2552,43 +2502,48 @@ pub(crate) fn pack<const FOR_PUBLISH: bool>(
         _ => {}
     }
 
-    let mut dest_buf = PathBuffer::uninit();
-    let (abs_tarball_dest, abs_tarball_dest_dir_end) = tarball_destination(
-        opt_pack_destination(ctx.manager),
-        opt_pack_filename(ctx.manager),
-        abs_workspace_path,
-        package_name,
-        package_version,
-        &mut dest_buf[..],
-    );
-    // Note: reshaped for borrowck — abs_tarball_dest borrows dest_buf
-    let abs_tarball_dest_len = abs_tarball_dest.as_bytes().len();
-
-    {
-        // create the directory if it doesn't exist
-        let most_likely_a_slash = dest_buf[abs_tarball_dest_dir_end];
-        dest_buf[abs_tarball_dest_dir_end] = 0;
-        // SAFETY: NUL written above
-        let abs_tarball_dest_dir = ZStr::from_buf(&dest_buf[..], abs_tarball_dest_dir_end);
-        let _ = bun_sys::Dir::cwd().make_path(abs_tarball_dest_dir.as_bytes());
-        dest_buf[abs_tarball_dest_dir_end] = most_likely_a_slash;
-    }
-
-    // SAFETY: dest_buf[abs_tarball_dest_len] == 0 (written by tarball_destination)
-    let abs_tarball_dest = ZStr::from_buf(&dest_buf[..], abs_tarball_dest_len);
-
-    // TODO: experiment with `archive.writeOpenMemory()`
-    match archive.write_open_filename(abs_tarball_dest) {
+    // Same as `archive_write_open_filename` set for a file, so the output stays byte-identical.
+    match archive.write_set_bytes_in_last_block(1) {
         ArchiveResult::Failed | ArchiveResult::Fatal | ArchiveResult::Warn => {
             Output::err_generic(
-                "failed to open tarball file destination: \"{}\"",
-                format_args!("{}", bstr::BStr::new(abs_tarball_dest.as_bytes())),
+                "failed to set archive block padding: {}",
+                format_args!("{}", bstr::BStr::new(archive.error_string())),
             );
             Global::crash();
         }
         _ => {}
     }
 
+    // `bun publish` uploads the bytes from memory; only `bun pm pack` writes a file.
+    let mut dest_buf = PathBuffer::uninit();
+    let abs_tarball_dest: Option<&ZStr> = if FOR_PUBLISH {
+        None
+    } else {
+        Some(pack_destination(
+            ctx.manager,
+            abs_workspace_path,
+            package_name,
+            package_version,
+            &mut dest_buf,
+        ))
+    };
+
+    if archive_write_open2(
+        &archive,
+        (&raw mut tarball_buffer).cast(),
+        Some(GrowingBuffer::open_callback),
+        Some(GrowingBuffer::write_callback),
+        Some(GrowingBuffer::close_callback),
+        None,
+    ) != 0
+    {
+        Output::err_generic(
+            "failed to open archive for writing: {}",
+            format_args!("{}", bstr::BStr::new(archive.error_string())),
+        );
+        Global::crash();
+    }
+
     // append removed items from `pack_queue` with their file size
     let mut pack_list: PackList = Vec::new();
 
@@ -2596,8 +2551,7 @@ pub(crate) fn pack<const FOR_PUBLISH: bool>(
     let mut file_reader: Box<BufferedFileReader> =
         new_boxed_buffered_file_reader(File::from_fd(Fd::invalid()));
 
-    // SAFETY: `archive` is the live `archive_write_new()` handle opened above.
-    let mut entry = ArchiveEntry::new2(unsafe { &*archive });
+    let mut entry = ArchiveEntry::new2(&archive);
 
     {
         let mut progress = Progress::Progress::default();
@@ -2613,15 +2567,7 @@ pub(crate) fn pack<const FOR_PUBLISH: bool>(
         // uses below, so call `complete_one()` explicitly at every loop-body
         // exit and `end()` once after the loops.
 
-        entry = archive_package_json(
-            ctx,
-            // SAFETY: `archive` is the non-null `*mut Archive` returned by
-            // `Archive::write_new()` above; only this thread accesses it.
-            unsafe { &mut *archive },
-            entry,
-            &root_dir,
-            &edited_package_json,
-        )?;
+        entry = archive_package_json(ctx, &archive, entry, &root_dir, &edited_package_json);
         if log_level.show_progress() {
             node.as_mut()
                 .expect("infallible: progress active")
@@ -2695,13 +2641,11 @@ pub(crate) fn pack<const FOR_PUBLISH: bool>(
                 &item.path,
                 &mut read_buf,
                 &mut file_reader,
-                // SAFETY: `archive` is the non-null `*mut Archive` returned by
-                // `Archive::write_new()` above; only this thread accesses it.
-                unsafe { &mut *archive },
+                &archive,
                 entry,
                 &mut print_buf,
                 &bins,
-            )?;
+            );
 
             if log_level.show_progress() {
                 node.as_mut()
@@ -2750,13 +2694,11 @@ pub(crate) fn pack<const FOR_PUBLISH: bool>(
                 &item.path,
                 &mut read_buf,
                 &mut file_reader,
-                // SAFETY: `archive` is the non-null `*mut Archive` returned by
-                // `Archive::write_new()` above; only this thread accesses it.
-                unsafe { &mut *archive },
+                &archive,
                 entry,
                 &mut print_buf,
                 &bins,
-            )?;
+            );
 
             if log_level.show_progress() {
                 node.as_mut()
@@ -2785,101 +2727,25 @@ pub(crate) fn pack<const FOR_PUBLISH: bool>(
         _ => {}
     }
 
-    match archive.write_free() {
-        ArchiveResult::Failed | ArchiveResult::Fatal | ArchiveResult::Warn => {
-            Output::err_generic(
-                "failed to free archive: {}",
-                format_args!("{}", bstr::BStr::new(archive.error_string())),
-            );
-            Global::crash();
-        }
-        _ => {}
-    }
+    drop(archive);
+    // Only fails after a write into the buffer failed, which crashed above.
+    let tarball_bytes = tarball_buffer.to_owned_slice()?;
 
     let mut shasum: [u8; sha::SHA1::DIGEST] = [0; sha::SHA1::DIGEST];
-    let mut integrity: [u8; sha::SHA512::DIGEST] = [0; sha::SHA512::DIGEST];
-
-    let tarball_bytes: Option<Vec<u8>> = 'tarball_bytes: {
-        let tarball_file = match File::open(abs_tarball_dest, bun_sys::O::RDONLY, 0) {
-            Ok(f) => f,
-            Err(err) => {
-                Output::err(
-                    err,
-                    "failed to open tarball at: \"{}\"",
-                    format_args!("{}", bstr::BStr::new(abs_tarball_dest.as_bytes())),
-                );
-                Global::crash();
-            }
-        };
-
-        let mut sha1 = sha::SHA1::init();
-        let mut sha512 = sha::SHA512::init();
-
-        if FOR_PUBLISH {
-            let bytes = match tarball_file.read_to_end() {
-                Ok(b) => b,
-                Err(err) => {
-                    Output::err(
-                        err,
-                        "failed to read tarball: \"{}\"",
-                        format_args!("{}", bstr::BStr::new(abs_tarball_dest.as_bytes())),
-                    );
-                    Global::crash();
-                }
-            };
-
-            sha1.update(&bytes);
-            sha512.update(&bytes);
-
-            sha1.r#final(&mut shasum);
-            sha512.r#final(&mut integrity);
+    let mut sha1 = sha::SHA1::init();
+    sha1.update(&tarball_bytes);
+    sha1.r#final(&mut shasum);
 
-            ctx.stats.packed_size = bytes.len();
-
-            break 'tarball_bytes Some(bytes);
-        }
-
-        reset_buffered_file_reader(&mut file_reader, File::from_fd(tarball_file.into_raw()));
-
-        let mut size: usize = 0;
-        let mut read = match buffered_file_reader_read(&mut file_reader, &mut read_buf) {
-            Ok(n) => n,
-            Err(err) => {
-                Output::err(
-                    err,
-                    "failed to read tarball: \"{}\"",
-                    format_args!("{}", bstr::BStr::new(abs_tarball_dest.as_bytes())),
-                );
-                Global::crash();
-            }
-        };
-        while read > 0 {
-            sha1.update(&read_buf[..read]);
-            sha512.update(&read_buf[..read]);
-            size += read;
-            read = match buffered_file_reader_read(&mut file_reader, &mut read_buf) {
-                Ok(n) => n,
-                Err(err) => {
-                    Output::err(
-                        err,
-                        "failed to read tarball: \"{}\"",
-                        format_args!("{}", bstr::BStr::new(abs_tarball_dest.as_bytes())),
-                    );
-                    Global::crash();
-                }
-            };
-        }
+    let mut integrity: [u8; sha::SHA512::DIGEST] = [0; sha::SHA512::DIGEST];
+    let mut sha512 = sha::SHA512::init();
+    sha512.update(&tarball_bytes);
+    sha512.r#final(&mut integrity);
 
-        sha1.r#final(&mut shasum);
-        sha512.r#final(&mut integrity);
+    ctx.stats.packed_size = tarball_bytes.len();
 
-        ctx.stats.packed_size = size;
-        None
-    };
-    let _ = core::mem::replace(
-        &mut file_reader.unbuffered_reader,
-        File::from_fd(Fd::invalid()),
-    );
+    if let Some(abs_tarball_dest) = abs_tarball_dest {
+        write_tarball(abs_tarball_dest, &tarball_bytes);
+    }
 
     let normalized_pkg_info: Option<Box<[u8]>> = if FOR_PUBLISH {
         // The mutated tree is consumed inside `normalized_package` (it prints
@@ -2906,7 +2772,7 @@ pub(crate) fn pack<const FOR_PUBLISH: bool>(
         edited_package_json.len(),
     );
 
-    if !FOR_PUBLISH {
+    if let Some(abs_tarball_dest) = abs_tarball_dest {
         if opt_pack_destination(ctx.manager).is_empty() && opt_pack_filename(ctx.manager).is_empty()
         {
             Context::print_tarball_path(
@@ -2947,8 +2813,7 @@ pub(crate) fn pack<const FOR_PUBLISH: bool>(
             command_ctx: unsafe { &mut *std::ptr::from_mut(ctx.command_ctx) },
             package_name: package_name.into(),
             package_version: package_version.into(),
-            abs_tarball_path: ZStr::boxed(abs_tarball_dest.as_bytes()),
-            tarball_bytes: tarball_bytes.unwrap_or_default().into_boxed_slice(),
+            tarball_bytes: tarball_bytes.into_boxed_slice(),
             uses_workspaces: false,
             publish_script,
             postpublish_script,
@@ -3155,13 +3020,83 @@ impl<'a> fmt::Display for TarballNameFormatter<'a> {
     }
 }
 
+/// Resolves where `bun pm pack` writes the tarball and creates that directory.
+fn pack_destination<'a>(
+    manager: &PackageManager,
+    abs_workspace_path: &[u8],
+    package_name: &[u8],
+    package_version: &[u8],
+    buf: &'a mut PathBuffer,
+) -> &'a ZStr {
+    let (abs_tarball_dest, dir_end) = tarball_destination(
+        opt_pack_destination(manager),
+        opt_pack_filename(manager),
+        abs_workspace_path,
+        package_name,
+        package_version,
+        &mut buf[..],
+    );
+    let len = abs_tarball_dest.as_bytes().len();
+    let _ = bun_sys::Dir::cwd().make_path(&buf[..dir_end]);
+    // SAFETY: buf[len] == 0 (written by tarball_destination)
+    ZStr::from_buf(&buf[..], len)
+}
+
+/// The only write to disk, and so the only failure that has a partial file to remove.
+fn write_tarball(abs_tarball_dest: &ZStr, tarball_bytes: &[u8]) {
+    let file = match File::create(Fd::cwd(), abs_tarball_dest, true) {
+        Ok(file) => file,
+        Err(err) => {
+            Output::err(
+                err,
+                "failed to open tarball file destination: \"{}\"",
+                format_args!("{}", bstr::BStr::new(abs_tarball_dest.as_bytes())),
+            );
+            Global::crash();
+        }
+    };
+    if let Err(err) = file.write_all(tarball_bytes) {
+        Output::err(
+            err,
+            "failed to write tarball: \"{}\"",
+            format_args!("{}", bstr::BStr::new(abs_tarball_dest.as_bytes())),
+        );
+        // Windows cannot delete the file while it is open.
+        drop(file);
+        // A `--filename` that is a symlink or a device is not ours to delete.
+        if let Ok(stat) = bun_sys::lstat(abs_tarball_dest) {
+            if bun_sys::kind_from_mode(stat.st_mode as bun_sys::Mode) == bun_sys::FileKind::File {
+                let _ = bun_sys::unlink(abs_tarball_dest);
+            }
+        }
+        Global::crash();
+    }
+}
+
+/// Returns the number of bytes libarchive accepted for the current entry.
+fn write_entry_data(archive: &Archive, pathname: &[u8], data: &[u8]) -> usize {
+    match usize::try_from(archive.write_data(data)) {
+        Ok(written) => written,
+        Err(_) => {
+            Output::err_generic(
+                "failed to write \"{}\" to tarball: {}",
+                (
+                    bstr::BStr::new(pathname),
+                    bstr::BStr::new(archive.error_string()),
+                ),
+            );
+            Global::crash();
+        }
+    }
+}
+
 fn archive_package_json(
     ctx: &mut Context<'_>,
-    archive: &mut Archive,
+    archive: &Archive,
     entry: *mut ArchiveEntry,
     root_dir: &Dir,
     edited_package_json: &[u8],
-) -> Result<*mut ArchiveEntry, AllocError> {
+) -> *mut ArchiveEntry {
     // `entry` is the same pointer after `.clear()`.
     let entry = ArchiveEntry::opaque_ref(entry);
     let stat = match bun_sys::fstatat(Fd::from_std_dir(root_dir), bun_core::zstr!("package.json")) {
@@ -3189,20 +3124,16 @@ fn archive_package_json(
         ArchiveStatus::Failed | ArchiveStatus::Fatal | ArchiveStatus::Warn => {
             Output::err_generic(
                 "failed to write tarball header: {}",
-                format_args!(
-                    "{}",
-                    bstr::BStr::new(std::ptr::from_mut::<Archive>(archive).error_string())
-                ),
+                format_args!("{}", bstr::BStr::new(archive.error_string())),
             );
             Global::crash();
         }
         _ => {}
     }
 
-    ctx.stats.unpacked_size +=
-        usize::try_from(archive.write_data(edited_package_json)).expect("int cast");
+    ctx.stats.unpacked_size += write_entry_data(archive, b"package.json", edited_package_json);
 
-    Ok(entry.clear())
+    entry.clear()
 }
 
 fn add_archive_entry(
@@ -3212,11 +3143,11 @@ fn add_archive_entry(
     filename: &ZStr,
     read_buf: &mut [u8],
     file_reader: &mut BufferedFileReader,
-    archive: &mut Archive,
+    archive: &Archive,
     entry: *mut ArchiveEntry,
     print_buf: &mut Vec<u8>,
     bins: &[BinInfo],
-) -> Result<*mut ArchiveEntry, AllocError> {
+) -> *mut ArchiveEntry {
     // `entry` is the same pointer after `.clear()`.
     let entry = ArchiveEntry::opaque_ref(entry);
     write!(
@@ -3255,10 +3186,7 @@ fn add_archive_entry(
         ArchiveStatus::Failed | ArchiveStatus::Fatal => {
             Output::err_generic(
                 "failed to write tarball header: {}",
-                format_args!(
-                    "{}",
-                    bstr::BStr::new(std::ptr::from_mut::<Archive>(archive).error_string())
-                ),
+                format_args!("{}", bstr::BStr::new(archive.error_string())),
             );
             Global::crash();
         }
@@ -3280,7 +3208,7 @@ fn add_archive_entry(
     };
     while read > 0 {
         ctx.stats.unpacked_size +=
-            usize::try_from(archive.write_data(&read_buf[..read])).expect("int cast");
+            write_entry_data(archive, filename.as_bytes(), &read_buf[..read]);
         read = match buffered_file_reader_read(file_reader, read_buf) {
             Ok(n) => n,
             Err(err) => {
@@ -3300,7 +3228,7 @@ fn add_archive_entry(
     // close a fd we don't own.
     reset_buffered_file_reader(file_reader, File::from_fd(Fd::invalid()));
 
-    Ok(entry.clear())
+    entry.clear()
 }
 
 /// Strips workspace and catalog protocols from dependency versions then
diff --git a/src/runtime/cli/publish_command.rs b/src/runtime/cli/publish_command.rs
index 661251897af3..146fc5e5c485 100644
--- a/src/runtime/cli/publish_command.rs
+++ b/src/runtime/cli/publish_command.rs
@@ -96,7 +96,6 @@ pub(crate) struct Context<'a, const DIRECTORY_PUBLISH: bool> {
 
     pub(crate) package_name: Box<[u8]>,
     pub(crate) package_version: Box<[u8]>,
-    pub(crate) abs_tarball_path: Box<ZStr>,
     pub(crate) tarball_bytes: Box<[u8]>,
     pub(crate) uses_workspaces: bool,
 
@@ -438,7 +437,6 @@ impl<'a, const DIRECTORY_PUBLISH: bool> Context<'a, DIRECTORY_PUBLISH> {
             command_ctx: ctx,
             package_name,
             package_version,
-            abs_tarball_path: ZStr::boxed(abs_tarball_path.as_bytes()),
             tarball_bytes: tarball_bytes.into(),
             uses_workspaces: false,
             normalized_pkg_info,
@@ -648,9 +646,6 @@ impl PublishCommand {
             }
         };
 
-        // TODO: read this into memory
-        let _ = bun_sys::unlink(&context.abs_tarball_path);
-
         if let Err(err) = Self::publish::<true>(&context) {
             err.report_and_crash();
         }
@@ -2026,10 +2021,7 @@ impl PublishCommand {
             install::dependency::without_build_tag(&ctx.package_version);
 
         let mut buf: Vec<u8> = Vec::with_capacity(
-            ctx.package_name.len() * 5
-                + version_without_build_tag.len() * 4
-                + ctx.abs_tarball_path.len()
-                + encoded_tarball_len,
+            ctx.package_name.len() * 5 + version_without_build_tag.len() * 4 + encoded_tarball_len,
         );
 
         let _ = write!(
diff --git a/test/cli/install/bun-pack.test.ts b/test/cli/install/bun-pack.test.ts
index 21c64646b81e..f16f5cd85d32 100644
--- a/test/cli/install/bun-pack.test.ts
+++ b/test/cli/install/bun-pack.test.ts
@@ -1,7 +1,7 @@
-import { file, spawn, write } from "bun";
+import { file, gunzipSync, spawn, write } from "bun";
 import { readTarball } from "bun:internal-for-testing";
 import { beforeEach, describe, expect, test } from "bun:test";
-import { exists, mkdir, rm } from "fs/promises";
+import { chmod, exists, lstat, mkdir, rm, symlink } from "fs/promises";
 import { bunEnv, bunExe, isLinux, isWindows, pack, runBunInstall, tempDir, tmpdirSync } from "harness";
 import fs from "node:fs/promises";
 import { join } from "path";
@@ -51,6 +51,22 @@ test("basic", async () => {
   expect(tarball.entries).toMatchObject([{ "pathname": "package/package.json" }, { "pathname": "package/index.js" }]);
 });
 
+// The archive ends right after the two end-of-archive blocks. libarchive's default for a custom
+// output sink would pad it to a full 10 KiB record instead, which would change the size and shasum
+// of every tarball bun produces.
+test("the archive is not padded to a full tar record", async () => {
+  await Promise.all([
+    write(join(packageDir, "package.json"), JSON.stringify({ name: "pack-unpadded", version: "1.0.0" })),
+    write(join(packageDir, "index.js"), "module.exports = 1;"),
+  ]);
+
+  await pack(packageDir, bunEnv);
+
+  const tar = gunzipSync(await file(join(packageDir, "pack-unpadded-1.0.0.tgz")).bytes());
+  // header + data for each of the two entries, then the two end-of-archive blocks
+  expect(tar.byteLength).toBe(6 * 512);
+});
+
 test("in subdirectory", async () => {
   await Promise.all([
     write(
@@ -562,6 +578,106 @@ describe("flags", () => {
   });
 });
 
+// The tarball used to be streamed to its destination while it was being built, so any failure on
+// the way exited 1 and left a truncated `<name>-<version>.tgz` behind for the next `bun publish
+// ./*.tgz` to pick up. `ulimit -f 0` (RLIMIT_FSIZE) makes every write to the tarball fail with
+// EFBIG, which unlike a permission based setup also works when the tests run as root; setting it
+// needs a POSIX shell.
+describe.skipIf(isWindows)("a failed pack leaves no tarball behind", () => {
+  const packageJson = JSON.stringify({ name: "pack-failed", version: "1.0.0" });
+
+  async function packExpectingFailure(cwd: string, { fileSizeLimit }: { fileSizeLimit: boolean }, ...args: string[]) {
+    await using proc = spawn({
+      cmd: fileSizeLimit
+        ? ["/bin/sh", "-c", 'ulimit -f 0 && exec "$0" pm pack "$@"', bunExe(), ...args]
+        : [bunExe(), "pm", "pack", ...args],
+      cwd,
+      stdout: "pipe",
+      stderr: "pipe",
+      stdin: "ignore",
+      env: bunEnv,
+    });
+    const [, err, exitCode] = await Promise.all([proc.stdout.text(), proc.stderr.text(), proc.exited]);
+    return { err, exitCode };
+  }
+
+  test.concurrent.each([
+    { args: [], tarball: "pack-failed-1.0.0.tgz" },
+    { args: ["--destination=out"], tarball: join("out", "pack-failed-1.0.0.tgz") },
+    { args: ["--filename=custom.tgz"], tarball: "custom.tgz" },
+  ])("when the tarball cannot be written (args: $args)", async ({ args, tarball }) => {
+    await using dir = tempDir("pack-failed", {
+      "package.json": packageJson,
+      "index.js": "module.exports = 1;",
+    });
+
+    const { err, exitCode } = await packExpectingFailure(dir, { fileSizeLimit: true }, ...args);
+
+    expect(err).toContain("EFBIG");
+    expect(err).toContain('failed to write tarball: "');
+    expect({ exitCode, tarballExists: await exists(join(dir, tarball)) }).toEqual({
+      exitCode: 1,
+      tarballExists: false,
+    });
+  });
+
+  // Root can read a mode 000 file, so this one only runs as a regular user.
+  test.concurrent.skipIf(process.getuid?.() === 0)("when one of the files cannot be opened", async () => {
+    await using dir = tempDir("pack-failed-unreadable", {
+      "package.json": packageJson,
+      "index.js": "module.exports = 1;",
+      "unreadable.js": "module.exports = 2;",
+    });
+    await chmod(join(dir, "unreadable.js"), 0o000);
+
+    const { err, exitCode } = await packExpectingFailure(dir, { fileSizeLimit: false });
+
+    expect(err).toContain('EACCES: Permission denied: failed to open file: "unreadable.js"');
+    expect({ exitCode, tarballExists: await exists(join(dir, "pack-failed-1.0.0.tgz")) }).toEqual({
+      exitCode: 1,
+      tarballExists: false,
+    });
+  });
+
+  // Only the regular file pack itself created (or truncated) is removed; a destination that is
+  // something else, like a symlink, is not pack's to delete.
+  test.concurrent("does not delete a --filename that is a symlink", async () => {
+    await using dir = tempDir("pack-failed-symlink", {
+      "package.json": packageJson,
+      "index.js": "module.exports = 1;",
+      "target.tgz": "",
+    });
+    await symlink("target.tgz", join(dir, "link.tgz"));
+
+    const { err, exitCode } = await packExpectingFailure(dir, { fileSizeLimit: true }, "--filename=link.tgz");
+
+    expect(err).toContain('failed to write tarball: "link.tgz"');
+    expect({ exitCode, linkIsSymlink: (await lstat(join(dir, "link.tgz"))).isSymbolicLink() }).toEqual({
+      exitCode: 1,
+      linkIsSymlink: true,
+    });
+  });
+
+  // A destination that cannot even be opened was not written to, so it is left as it is (root can
+  // open a read-only file, hence the skip).
+  test.concurrent.skipIf(process.getuid?.() === 0)("keeps a destination it cannot open for writing", async () => {
+    await using dir = tempDir("pack-failed-readonly-dest", {
+      "package.json": packageJson,
+      "index.js": "module.exports = 1;",
+      "pack-failed-1.0.0.tgz": "an earlier tarball",
+    });
+    await chmod(join(dir, "pack-failed-1.0.0.tgz"), 0o444);
+
+    const { err, exitCode } = await packExpectingFailure(dir, { fileSizeLimit: false });
+
+    expect(err).toContain('EACCES: Permission denied: failed to open tarball file destination: "');
+    expect({ exitCode, destination: await file(join(dir, "pack-failed-1.0.0.tgz")).text() }).toEqual({
+      exitCode: 1,
+      destination: "an earlier tarball",
+    });
+  });
+});
+
 test("shasum and integrity are consistent", async () => {
   await Promise.all([
     write(
diff --git a/test/cli/install/bun-publish.test.ts b/test/cli/install/bun-publish.test.ts
index b3b2c49f1f9e..5a40a55dcfa5 100644
--- a/test/cli/install/bun-publish.test.ts
+++ b/test/cli/install/bun-publish.test.ts
@@ -874,6 +874,27 @@ describe("--dry-run", async () => {
 
     expect(await exists(join(registry.packagesPath, "dry-run-1"))).toBeFalse();
   });
+  // Publishing from a directory used to unlink `<name>-<version>.tgz` in the package directory
+  // (where it packed to), also with --dry-run, where nothing had been packed and the file was
+  // whatever the user had put there.
+  test("leaves a tarball that is already in the package directory alone", async () => {
+    const { packageDir, packageJson } = await registry.createTestDir();
+    const bunfig = await registry.authBunfig("dryrunexisting");
+    await Promise.all([
+      rm(join(registry.packagesPath, "dry-run-3"), { recursive: true, force: true }),
+      write(join(packageDir, "bunfig.toml"), bunfig),
+      write(packageJson, JSON.stringify({ name: "dry-run-3", version: "3.3.3" })),
+    ]);
+    await pack(packageDir, env);
+    const tarball = join(packageDir, "dry-run-3-3.3.3.tgz");
+    const packed = await file(tarball).bytes();
+
+    const { exitCode } = await publish(env, packageDir, "--dry-run");
+
+    expect({ exitCode, tarballExists: await exists(tarball) }).toEqual({ exitCode: 0, tarballExists: true });
+    expect(await file(tarball).bytes()).toEqual(packed);
+    expect(await exists(join(registry.packagesPath, "dry-run-3"))).toBeFalse();
+  });
   test("does not publish from tarball path", async () => {
     const { packageDir, packageJson } = await registry.createTestDir();
     const bunfig = await registry.authBunfig("dryruntarball");
@@ -1188,6 +1209,32 @@ test("attempting to publish a private package should fail", async () => {
   expect(await exists(join(packageDir, "publish-pkg-6-6.6.6.tgz"))).toBeTrue();
 });
 
+// Publishing from a directory used to pack into that directory and delete the file again after
+// publishing, so any failure in between (here: postpack) left the tarball behind.
+test("a failed publish does not leave a tarball in the package directory", async () => {
+  const { packageDir, packageJson } = await registry.createTestDir();
+  await Promise.all([
+    write(
+      packageJson,
+      JSON.stringify({
+        name: "publish-postpack-failed",
+        version: "1.0.0",
+        scripts: { postpack: "exit 3" },
+      }),
+    ),
+    write(join(packageDir, "index.js"), "module.exports = 1;"),
+    write(join(packageDir, "bunfig.toml"), await registry.authBunfig("postpackfailed")),
+  ]);
+
+  const { err, exitCode } = await publish(env, packageDir);
+
+  expect(err).toContain('script "postpack" exited with code 3');
+  expect({ exitCode, tarballExists: await exists(join(packageDir, "publish-postpack-failed-1.0.0.tgz")) }).toEqual({
+    exitCode: 3,
+    tarballExists: false,
+  });
+});
+
 describe("access", async () => {
   test("--access", async () => {
     const { packageDir, packageJson } = await registry.createTestDir();

From 69a7f2851969237bcbfa8dd0ed20d5237cabfd6e Mon Sep 17 00:00:00 2001
From: robobun <117481402+robobun@users.noreply.github.com>
Date: Mon, 17 Aug 2026 01:07:57 +0000
Subject: [PATCH 061/258] publish: accept basic auth credentials from .npmrc
 and bunfig.toml (#38776)

---
 test/cli/install/bun-publish.test.ts | 71 ++++++++++++++++++++++++++++
 1 file changed, 71 insertions(+)

diff --git a/test/cli/install/bun-publish.test.ts b/test/cli/install/bun-publish.test.ts
index 5a40a55dcfa5..e360b7bcde7d 100644
--- a/test/cli/install/bun-publish.test.ts
+++ b/test/cli/install/bun-publish.test.ts
@@ -1536,6 +1536,77 @@ test("dist.tarball in the published manifest does not include userinfo from the
   expect(exitCode).toBe(0);
 });
 
+describe.concurrent("basic auth", () => {
+  // Every spelling below makes `bun install` send `Authorization: Basic`, and npm publishes with
+  // all of them. `bun publish` used to stop with "missing authentication" unless a bearer token
+  // was configured, before sending anything. https://github.com/oven-sh/bun/issues/18670
+  const username = "alice";
+  const password = "s3cret";
+  const userPass = Buffer.from(`${username}:${password}`).toString("base64");
+
+  const configs: [name: string, files: (host: string) => Record<string, string>][] = [
+    [".npmrc _auth", host => ({ ".npmrc": `registry=http://${host}/\n//${host}/:_auth=${userPass}\n` })],
+    [
+      ".npmrc username and _password",
+      host => ({
+        ".npmrc": [
+          `registry=http://${host}/`,
+          `//${host}/:username=${username}`,
+          `//${host}/:_password=${Buffer.from(password).toString("base64")}`,
+          "",
+        ].join("\n"),
+      }),
+    ],
+    [".npmrc registry url with userinfo", host => ({ ".npmrc": `registry=http://${username}:${password}@${host}/\n` })],
+    [
+      "bunfig.toml registry username and password",
+      host => ({
+        "bunfig.toml": Bun.TOML.stringify({
+          install: { cache: false, registry: { url: `http://${host}/`, username, password } },
+        }),
+      }),
+    ],
+  ];
+
+  async function publishWith(files: (host: string) => Record<string, string>) {
+    const requests: string[] = [];
+    using mock = Bun.serve({
+      port: 0,
+      fetch(req) {
+        requests.push(`${req.method} ${new URL(req.url).pathname} ${req.headers.get("authorization")}`);
+        return new Response("OK", { status: 200 });
+      },
+    });
+
+    using dir = tempDir("publish-basic-auth", {
+      "package.json": JSON.stringify({ name: "basic-auth-pkg", version: "1.0.0" }),
+      // Empty home directory so the machine's own .npmrc / bunfig.toml cannot supply credentials.
+      "home/.keep": "",
+      ...files(`localhost:${mock.port}`),
+    });
+    const home = join(String(dir), "home");
+
+    const result = await publish({ ...env, HOME: home, USERPROFILE: home, XDG_CONFIG_HOME: home }, String(dir));
+    return { ...result, requests };
+  }
+
+  test.each(configs)("%s", async (_, files) => {
+    const { out, err, exitCode, requests } = await publishWith(files);
+    expect(err).not.toContain("error:");
+    expect(out).toContain(" + basic-auth-pkg@1.0.0");
+    expect(requests).toEqual([`PUT /basic-auth-pkg Basic ${userPass}`]);
+    expect(exitCode).toBe(0);
+  });
+
+  test("still refuses to publish without any credentials", async () => {
+    const { out, err, exitCode, requests } = await publishWith(host => ({ ".npmrc": `registry=http://${host}/\n` }));
+    expect(err).toContain("error: missing authentication (run `bunx npm login`)");
+    expect(out).not.toContain(" + basic-auth-pkg@1.0.0");
+    expect(requests).toEqual([]);
+    expect(exitCode).toBe(1);
+  });
+});
+
 describe("--tolerate-republish", async () => {
   test("republishing normally fails", async () => {
     const { packageDir, packageJson } = await registry.createTestDir();

From 167339990e78c2c39c78d2c3ffc64826d0e841a2 Mon Sep 17 00:00:00 2001
From: robobun <117481402+robobun@users.noreply.github.com>
Date: Mon, 17 Aug 2026 01:08:05 +0000
Subject: [PATCH 062/258] install(hoisted): track replaced folders instead of
 deferring and re-verifying nested skips (#38303)

---
 src/install/PackageInstaller.rs               |  90 ++++++++----
 src/install/hoisted_install.rs                |   3 +
 test/cli/install/bun-install-registry.test.ts | 132 +++++++++++++++++-
 .../packages/create-two-level-nest-package.ts |  54 +++++++
 .../packages/two-level-nest/package.json      |  23 +++
 .../two-level-nest/two-level-nest-1.0.0.tgz   | Bin 0 -> 209 bytes
 6 files changed, 269 insertions(+), 33 deletions(-)
 create mode 100644 test/cli/install/registry/packages/create-two-level-nest-package.ts
 create mode 100644 test/cli/install/registry/packages/two-level-nest/package.json
 create mode 100644 test/cli/install/registry/packages/two-level-nest/two-level-nest-1.0.0.tgz

diff --git a/src/install/PackageInstaller.rs b/src/install/PackageInstaller.rs
index 39f28b69a28e..a83f38d432cf 100644
--- a/src/install/PackageInstaller.rs
+++ b/src/install/PackageInstaller.rs
@@ -288,6 +288,13 @@ pub struct TreeContext {
 
     /// Number of installed dependencies. Could be successful or failure.
     pub(crate) install_count: usize,
+
+    /// Dependencies whose folder in this tree is replaced by this install.
+    pub(crate) replaced: Vec<DependencyID>,
+
+    /// This tree is inside one of an ancestor's `replaced` folders, so what is
+    /// on disk here is going away (possibly after a download) and cannot be skipped.
+    pub(crate) inside_replaced_folder: bool,
 }
 
 type TreeContextId = lockfile::tree::Id;
@@ -926,8 +933,7 @@ impl<'a> PackageInstaller<'a> {
                     self.node_modules.path = context.path;
                     self.current_tree_id = context.tree_id;
 
-                    // Re-verify: a parent reinstall may have deleted a deferred entry.
-                    const NEEDS_VERIFY: bool = true;
+                    const NEEDS_VERIFY: bool = false;
                     const IS_PENDING_PACKAGE_INSTALL: bool = true;
                     self.install_package_with_name_and_resolution::<NEEDS_VERIFY, IS_PENDING_PACKAGE_INSTALL>(
                         // This id might be different from the id used to enqueue the task. Important
@@ -1061,6 +1067,38 @@ impl<'a> PackageInstaller<'a> {
         true
     }
 
+    /// Call before installing a tree's dependencies; relies on trees being
+    /// visited in id order, so the parent's `replaced` is already complete.
+    pub(crate) fn set_inside_replaced_folder(&mut self, tree_id: lockfile::tree::Id) {
+        let lockfile = self.lockfile();
+        let tree = lockfile.buffers.trees.as_slice()[tree_id as usize];
+        if tree.parent == lockfile::tree::INVALID_ID {
+            return;
+        }
+        debug_assert!(tree.parent < tree_id);
+
+        let parent = &self.trees[tree.parent as usize];
+        let inside = parent.inside_replaced_folder || {
+            let deps = lockfile.buffers.dependencies.as_slice();
+            let string_buf = lockfile.buffers.string_bytes.as_slice();
+            let folder = tree.folder_name(deps, string_buf);
+            parent
+                .replaced
+                .iter()
+                .any(|&dep_id| deps[dep_id as usize].name.slice(string_buf) == folder)
+        };
+        self.trees[tree_id as usize].inside_replaced_folder = inside;
+    }
+
+    /// `install_from_link` re-points one symlink; `PackageInstall::install` replaces
+    /// the folder, folder dependencies included (a directory of per-file symlinks).
+    fn install_replaces_folder(tag: resolution::Tag) -> bool {
+        !matches!(
+            tag,
+            resolution::Tag::Symlink | resolution::Tag::Workspace | resolution::Tag::Root
+        )
+    }
+
     // `pub fn deinit` dropped. All owned fields (`pending_lifecycle_scripts: Vec`,
     // `completed_trees: Bitset`, `trees: Box<[TreeContext]>`, `tree_ids_to_trees_the_id_depends_on`,
     // `node_modules`, `trusted_dependencies_from_update_requests`) impl Drop. Borrowed fields
@@ -1612,11 +1650,26 @@ impl<'a> PackageInstaller<'a> {
             }
         }
 
-        let needs_install = self.force_install
-            || self.skip_verify_installed_version_number
-            || !NEEDS_VERIFY
+        let verifying =
+            NEEDS_VERIFY && !self.force_install && !self.skip_verify_installed_version_number;
+        let inside_replaced_folder =
+            self.trees[self.current_tree_id as usize].inside_replaced_folder;
+        let needs_install = !verifying
             || remove_patch
+            || inside_replaced_folder
             || !installer.verify(resolution, &self.root_node_modules_folder);
+        self.summary.skipped += (!needs_install) as u32;
+
+        // Not needed inside a replaced folder: child trees inherit the flag.
+        if verifying
+            && needs_install
+            && !inside_replaced_folder
+            && Self::install_replaces_folder(resolution.tag)
+        {
+            self.trees[self.current_tree_id as usize]
+                .replaced
+                .push(dependency_id);
+        }
 
         if needs_install {
             if resolution.tag.can_enqueue_install_task()
@@ -1845,8 +1898,8 @@ impl<'a> PackageInstaller<'a> {
                         || (resolution.tag == resolution::Tag::Folder
                             && !self.lockfile().is_workspace_tree_id(self.current_tree_id))
                     {
-                        // This is a transitive folder dependency. It is installed with a single symlink to the target folder/file,
-                        // and is not hoisted.
+                        // This is a transitive folder dependency. It is installed as a directory of symlinks
+                        // to the target's files (see `PackageInstall::install`), and is not hoisted.
                         //
                         // A transitive `Resolution::Folder` declared by a local `file:` package
                         // is relative to the top-level dir (`Package::parse` normalized it), so
@@ -2235,27 +2288,6 @@ impl<'a> PackageInstaller<'a> {
                 }
             }
         } else {
-            // Same gate as the `needs_install` branch: a pending parent's
-            // `uninstall_before_install` would delete this verified package.
-            if !IS_PENDING_PACKAGE_INSTALL
-                && !Self::can_install_package_for_tree(
-                    &self.completed_trees,
-                    self.lockfile().buffers.trees.as_slice(),
-                    self.current_tree_id,
-                )
-            {
-                self.trees[self.current_tree_id as usize]
-                    .pending_installs
-                    .push(DependencyInstallContext {
-                        dependency_id,
-                        tree_id: self.current_tree_id,
-                        path: self.node_modules.path.clone(),
-                    });
-                return;
-            }
-
-            self.summary.skipped += 1;
-
             if self.bins[package_id as usize].tag != bin::Tag::None {
                 self.trees[self.current_tree_id as usize]
                     .binaries
@@ -2274,7 +2306,7 @@ impl<'a> PackageInstaller<'a> {
             };
 
             // `defer { destination_dir.close(); }` + `defer increment_tree_install_count`.
-            // No early returns after this point, so manual calls at end are equivalent.
+            // No early returns in this branch, so manual calls at end are equivalent.
 
             let dep = &self.lockfile().buffers.dependencies.as_slice()[dependency_id as usize];
             let dep_behavior = dep.behavior;
diff --git a/src/install/hoisted_install.rs b/src/install/hoisted_install.rs
index 81dc1dc5ee53..1be524ca6350 100644
--- a/src/install/hoisted_install.rs
+++ b/src/install/hoisted_install.rs
@@ -407,6 +407,8 @@ pub(crate) fn install_hoisted_packages(
                             }),
                             pending_installs: Vec::new(),
                             install_count: 0,
+                            replaced: Vec::new(),
+                            inside_replaced_folder: false,
                         });
                     }
                     break 'trees trees.into_boxed_slice();
@@ -434,6 +436,7 @@ pub(crate) fn install_hoisted_packages(
             installer.node_modules.tree_id = node_modules.tree_id;
             let mut remaining: &[DependencyID] = node_modules.dependencies;
             installer.current_tree_id = node_modules.tree_id;
+            installer.set_inside_replaced_folder(node_modules.tree_id);
 
             // cache line is 64 bytes on ARM64 and x64
             // PackageIDs are 4 bytes
diff --git a/test/cli/install/bun-install-registry.test.ts b/test/cli/install/bun-install-registry.test.ts
index c70bc604fa05..cbc669b91878 100644
--- a/test/cli/install/bun-install-registry.test.ts
+++ b/test/cli/install/bun-install-registry.test.ts
@@ -4048,7 +4048,7 @@ describe("hoisting", async () => {
     expect(lockfile).toMatchNodeModulesAt(packageDir);
   });
 
-  test("nested dependency deferred behind an unrelated root reinstall is skipped, not reinstalled", async () => {
+  test("nested dependency is left alone when only an unrelated root sibling is reinstalled", async () => {
     await writeFile(
       packageJson,
       JSON.stringify({
@@ -4064,9 +4064,9 @@ describe("hoisting", async () => {
     const nested = join(packageDir, "node_modules", "one-fixed-dep", "node_modules", "no-deps", "package.json");
     const { ino } = await lstat(nested);
 
-    // Only the root `no-deps@2.0.0` needs a reinstall. The nested
-    // `no-deps@1.0.0` is deferred until the root tree finishes, then must be
-    // re-verified and skipped rather than downloaded again.
+    // Only the root `no-deps@2.0.0` needs a reinstall. `one-fixed-dep/` is not
+    // being replaced, so the nested `no-deps@1.0.0` inside it must still be
+    // skipped as installed rather than downloaded again.
     await rm(join(packageDir, ".bun-cache"), { recursive: true, force: true });
     await rm(join(packageDir, "node_modules", "no-deps", "package.json"));
 
@@ -4083,6 +4083,130 @@ describe("hoisting", async () => {
     expect(lockfile).toMatchNodeModulesAt(packageDir);
   });
 
+  test("dependencies nested two levels below a reinstalled package are reinstalled", async () => {
+    // See registry/packages/create-two-level-nest-package.ts for the layout.
+    await writeFile(
+      packageJson,
+      JSON.stringify({
+        name: "foo",
+        dependencies: {
+          "two-level-nest": "1.0.0",
+          "one-fixed-dep": "2.0.0",
+          "no-deps": "2.0.0",
+        },
+      }),
+    );
+    await runBunInstall(env, packageDir);
+
+    const nestedDir = join(packageDir, "node_modules", "two-level-nest", "node_modules");
+    const expected = async () => ({
+      "one-fixed-dep": (await file(join(nestedDir, "one-fixed-dep", "package.json")).json()).version,
+      "no-deps": (await file(join(nestedDir, "no-deps", "package.json")).json()).version,
+      "one-fixed-dep/no-deps": (
+        await file(join(nestedDir, "one-fixed-dep", "node_modules", "no-deps", "package.json")).json()
+      ).version,
+    });
+    expect(await expected()).toEqual({
+      "one-fixed-dep": "1.0.0",
+      "no-deps": "1.1.0",
+      "one-fixed-dep/no-deps": "1.0.0",
+    });
+
+    // Reinstalling `two-level-nest` replaces its whole folder. The package
+    // under `two-level-nest/node_modules/one-fixed-dep/node_modules` is only
+    // marked through its parent tree, not by a direct entry in the root's.
+    await rm(join(packageDir, ".bun-cache"), { recursive: true, force: true });
+    await rm(join(packageDir, "node_modules", "two-level-nest", "package.json"));
+
+    const { out } = await runBunInstall(env, packageDir, { savesLockfile: false });
+    expect(out).toContain("4 packages installed");
+
+    expect(await expected()).toEqual({
+      "one-fixed-dep": "1.0.0",
+      "no-deps": "1.1.0",
+      "one-fixed-dep/no-deps": "1.0.0",
+    });
+
+    const lockfile = parseLockfile(packageDir);
+    expect(lockfile).toMatchNodeModulesAt(packageDir);
+  });
+
+  test("recreating a workspace link leaves the workspace's nested dependencies alone", async () => {
+    await writeFile(
+      packageJson,
+      JSON.stringify({ name: "foo", workspaces: ["packages/*"], dependencies: { "no-deps": "2.0.0" } }),
+    );
+    await mkdir(join(packageDir, "packages", "ws"), { recursive: true });
+    await writeFile(
+      join(packageDir, "packages", "ws", "package.json"),
+      JSON.stringify({ name: "ws", version: "1.0.0", dependencies: { "no-deps": "1.0.0" } }),
+    );
+    await runBunInstall(env, packageDir);
+
+    // `node_modules/ws` is a link to `packages/ws`, so its nested `no-deps`
+    // lives in `packages/ws/node_modules` and survives the link being redone.
+    const nested = join(packageDir, "packages", "ws", "node_modules", "no-deps", "package.json");
+    expect(await file(nested).json()).toMatchObject({ name: "no-deps", version: "1.0.0" });
+    const { ino } = await lstat(nested);
+
+    await rm(join(packageDir, "node_modules", "ws"), { recursive: true, force: true });
+
+    const { out } = await runBunInstall(env, packageDir, { savesLockfile: false });
+    expect(out).toContain("1 package installed");
+
+    expect(await file(join(packageDir, "node_modules", "ws", "package.json")).json()).toMatchObject({ name: "ws" });
+    expect((await lstat(nested)).ino).toBe(ino);
+
+    const lockfile = parseLockfile(packageDir);
+    expect(lockfile).toMatchNodeModulesAt(packageDir);
+  });
+
+  test("dependency nested in a reinstalled file: dependency of a workspace is reinstalled", async () => {
+    await writeFile(
+      packageJson,
+      JSON.stringify({ name: "foo", workspaces: ["packages/*"], dependencies: { "no-deps": "2.0.0" } }),
+    );
+    await mkdir(join(packageDir, "packages", "ws"), { recursive: true });
+    await mkdir(join(packageDir, "local-dep"));
+    await writeFile(
+      join(packageDir, "local-dep", "package.json"),
+      JSON.stringify({ name: "local-dep", version: "1.0.0", dependencies: { "no-deps": "1.0.0" } }),
+    );
+    await writeFile(
+      join(packageDir, "packages", "ws", "package.json"),
+      JSON.stringify({
+        name: "ws",
+        version: "1.0.0",
+        dependencies: { "local-dep": "file:../../local-dep", "no-deps": "1.1.0" },
+      }),
+    );
+    await runBunInstall(env, packageDir);
+
+    // Unlike a workspace, a file: dependency of a workspace is copied into its
+    // node_modules, so reinstalling it replaces the folder and the no-deps@1.0.0
+    // nested inside it (neither no-deps above it satisfies local-dep).
+    const wsNodeModules = join(packageDir, "packages", "ws", "node_modules");
+    const nested = join(wsNodeModules, "local-dep", "node_modules", "no-deps", "package.json");
+    expect(await file(join(wsNodeModules, "no-deps", "package.json")).json()).toMatchObject({ version: "1.1.0" });
+    expect(await file(nested).json()).toMatchObject({ name: "no-deps", version: "1.0.0" });
+
+    // The root no-deps@2.0.0 has to be downloaded again, so the root tree is
+    // still pending while local-dep is found stale, and local-dep's own
+    // reinstall is held back until after its nested tree has been visited.
+    await rm(join(packageDir, ".bun-cache"), { recursive: true, force: true });
+    await rm(join(packageDir, "node_modules", "no-deps", "package.json"));
+    await rm(join(wsNodeModules, "local-dep", "package.json"));
+
+    const { out } = await runBunInstall(env, packageDir, { savesLockfile: false });
+    expect(out).toContain("3 packages installed");
+
+    expect(await file(join(wsNodeModules, "local-dep", "package.json")).json()).toMatchObject({ name: "local-dep" });
+    expect(await file(nested).json()).toMatchObject({ name: "no-deps", version: "1.0.0" });
+
+    const lockfile = parseLockfile(packageDir);
+    expect(lockfile).toMatchNodeModulesAt(packageDir);
+  });
+
   var tests: any = [
     {
       situation: "1.0.0 - 1.0.10 is in order",
diff --git a/test/cli/install/registry/packages/create-two-level-nest-package.ts b/test/cli/install/registry/packages/create-two-level-nest-package.ts
new file mode 100644
index 000000000000..d7da9dca126d
--- /dev/null
+++ b/test/cli/install/registry/packages/create-two-level-nest-package.ts
@@ -0,0 +1,54 @@
+#!/usr/bin/env bun
+/**
+ * Generates the `two-level-nest` fixture used by bun-install-registry.test.ts.
+ *
+ * - two-level-nest@1.0.0 -> one-fixed-dep@1.0.0, no-deps@1.1.0
+ * - one-fixed-dep@1.0.0  -> no-deps@1.0.0 (existing fixture)
+ *
+ * Installed next to root dependencies one-fixed-dep@2.0.0 and no-deps@2.0.0,
+ * both of its dependencies nest inside it, and one-fixed-dep@1.0.0's no-deps
+ * can't use either no-deps above it, so it nests one level further down:
+ *
+ *   node_modules/two-level-nest/node_modules/one-fixed-dep            @1.0.0
+ *   node_modules/two-level-nest/node_modules/no-deps                  @1.1.0
+ *   node_modules/two-level-nest/node_modules/one-fixed-dep/node_modules/no-deps  @1.0.0
+ */
+
+import { mkdir, writeFile } from "fs/promises";
+import { join } from "path";
+
+const name = "two-level-nest";
+const version = "1.0.0";
+const dir = join(import.meta.dir, name);
+await mkdir(dir, { recursive: true });
+
+const pkgJson = { name, version, dependencies: { "one-fixed-dep": "1.0.0", "no-deps": "1.1.0" } };
+const tarball = join(dir, `${name}-${version}.tgz`);
+await Bun.Archive.write(tarball, { "package/package.json": JSON.stringify(pkgJson, null, 2) }, { compress: "gzip" });
+
+const bytes = await Bun.file(tarball).bytes();
+await writeFile(
+  join(dir, "package.json"),
+  JSON.stringify(
+    {
+      _id: name,
+      name,
+      "dist-tags": { latest: version },
+      versions: {
+        [version]: {
+          ...pkgJson,
+          _id: `${name}@${version}`,
+          dist: {
+            integrity: `sha512-${Buffer.from(new Bun.CryptoHasher("sha512").update(bytes).digest()).toString("base64")}`,
+            shasum: new Bun.CryptoHasher("sha1").update(bytes).digest("hex"),
+            tarball: `http://localhost:4873/${name}/-/${name}-${version}.tgz`,
+          },
+        },
+      },
+    },
+    null,
+    2,
+  ),
+);
+
+console.log(`Created ${name} test package`);
diff --git a/test/cli/install/registry/packages/two-level-nest/package.json b/test/cli/install/registry/packages/two-level-nest/package.json
new file mode 100644
index 000000000000..84dc3e8ea457
--- /dev/null
+++ b/test/cli/install/registry/packages/two-level-nest/package.json
@@ -0,0 +1,23 @@
+{
+  "_id": "two-level-nest",
+  "name": "two-level-nest",
+  "dist-tags": {
+    "latest": "1.0.0"
+  },
+  "versions": {
+    "1.0.0": {
+      "name": "two-level-nest",
+      "version": "1.0.0",
+      "dependencies": {
+        "one-fixed-dep": "1.0.0",
+        "no-deps": "1.1.0"
+      },
+      "_id": "two-level-nest@1.0.0",
+      "dist": {
+        "integrity": "sha512-jio/5WGgbE5FhOJXoxmeVwhLtPaZOOCSIp5sIK/nfIMJpglHG/F8GrbYtdBa60djB/vRJx3sF+ouDLvYfBwqjQ==",
+        "shasum": "584fd25e8a93fc5e0e8d0888778386a59b7ee159",
+        "tarball": "http://localhost:4873/two-level-nest/-/two-level-nest-1.0.0.tgz"
+      }
+    }
+  }
+}
\ No newline at end of file
diff --git a/test/cli/install/registry/packages/two-level-nest/two-level-nest-1.0.0.tgz b/test/cli/install/registry/packages/two-level-nest/two-level-nest-1.0.0.tgz
new file mode 100644
index 0000000000000000000000000000000000000000..8430f9fa76cb1809fc932f68e9a9bee512ca1215
GIT binary patch
literal 209
zcmb2|=3oGW|8LJ9%sOl!z!EU`ujt`<+T~Ag@czj6*`k{l?CFvh#qsmIQ*BmXE(goA
zST?q4si(G7&yIVuam~$r*XG=ry7E=<{lhQ&PlvqS;w-W2>^Avrj@B7BSY&0c+&$nP
zyR7+g{r_Du<?4RC3Yk^rl8UF(zg1h`x~IOn+s33p=54_9IVmkIVbQU-GmZvr*)n_W
zsg7V~hDnouKL2@oQGZxnJj0|-{b8?ewTCTbJa_h{AO^T7U&9==;`|i`4F(1PcO+h)

literal 0
HcmV?d00001


From e67f81cd6363d611a37689b62d42f90d030fa1d6 Mon Sep 17 00:00:00 2001
From: robobun <117481402+robobun@users.noreply.github.com>
Date: Mon, 17 Aug 2026 01:08:10 +0000
Subject: [PATCH 063/258] Resolve dangling node_modules symlinks as missing
 modules; isolated installs unlink failed optional dependencies (#38756)

---
 src/install/isolated_install.rs           |   3 +
 src/install/isolated_install/Installer.rs | 120 +++++++++++++++++--
 src/install/lifecycle_script_runner.rs    |  30 +++--
 src/resolver/fs.rs                        |   2 +
 src/resolver/lib.rs                       |  41 +++++--
 src/resolver/resolver.rs                  |  15 +--
 src/router/lib.rs                         |   2 +
 src/runtime/bake/FrameworkRouter.rs       |   1 +
 src/runtime/cli/test/Scanner.rs           |   1 +
 test/cli/install/isolated-install.test.ts |  80 +++++++++++++
 test/js/bun/resolve/resolve.test.ts       | 135 ++++++++++++++++++++++
 11 files changed, 388 insertions(+), 42 deletions(-)

diff --git a/src/install/isolated_install.rs b/src/install/isolated_install.rs
index 78dc5b444a01..c9a16024133f 100644
--- a/src/install/isolated_install.rs
+++ b/src/install/isolated_install.rs
@@ -2076,6 +2076,7 @@ pub(crate) fn install_isolated_packages(
             global_store_tmp_suffix: fast_random(),
             summary: Default::default(),
             task_queue: Default::default(),
+            failed_optional_entries: Vec::new(),
         };
         // No long-lived `&mut PackageManager` reborrow here — `installer.start_task()`,
         // `on_task_complete()`, and `on_task_fail()` below all reach the manager through
@@ -2627,6 +2628,8 @@ pub(crate) fn install_isolated_packages(
             }
         }
 
+        installer.unlink_failed_optional_entries();
+
         if installer.manager().options.log_level.show_progress() {
             progress.root.end();
             *progress = Progress::default();
diff --git a/src/install/isolated_install/Installer.rs b/src/install/isolated_install/Installer.rs
index e95ff866ff21..f4eaab2d1c4f 100644
--- a/src/install/isolated_install/Installer.rs
+++ b/src/install/isolated_install/Installer.rs
@@ -119,6 +119,9 @@ pub struct Installer<'a> {
     /// Main-thread only: `waiters_head[dep]` starts the intrusive list of blocked entries waiting on `dep`, linked through `next_waiter`.
     pub(crate) waiters_head: Box<[StoreEntryId]>,
     pub(crate) next_waiter: Box<[StoreEntryId]>,
+
+    /// Main-thread only: entries deleted by `on_optional_dependency_scripts_failed`.
+    pub(crate) failed_optional_entries: Vec<StoreEntryId>,
 }
 
 impl<'a> Installer<'a> {
@@ -614,6 +617,14 @@ impl<'a> Installer<'a> {
         self.installed.set(pkg_id as usize);
     }
 
+    /// Called from main thread once the package is deleted; dependents finish without it.
+    pub(crate) fn on_optional_dependency_scripts_failed(&mut self, entry_id: StoreEntryId) {
+        self.failed_optional_entries.push(entry_id);
+        self.store.entries.items_step()[entry_id.get() as usize]
+            .store(Step::Done as u32, Ordering::Release);
+        self.on_task_complete(entry_id, CompleteState::Skipped);
+    }
+
     /// Main thread only: `completed` just reached `Step::Done`; re-check every entry waiting on it.
     pub(crate) fn resume_unblocked_tasks(&mut self, completed: StoreEntryId) {
         let entry_steps = self.store.entries.items_step();
@@ -2179,7 +2190,8 @@ impl<'a> Installer<'a> {
         Ok(PatchInfo::None)
     }
 
-    pub(crate) fn link_to_hidden_node_modules(&self, entry_id: StoreEntryId) {
+    /// `node_modules/.bun/node_modules/<package name>`
+    fn hidden_node_modules_link_path(&self, entry_id: StoreEntryId) -> AutoPath {
         let string_buf = self.lockfile().buffers.string_bytes.as_slice();
 
         let node_id = self.store.entries.items_node_id()[entry_id.get() as usize];
@@ -2202,6 +2214,18 @@ impl<'a> Installer<'a> {
         );
         let _ = hidden_hoisted_node_modules.append(pkg_name.slice(string_buf)); // OOM/capacity: fire-and-forget
 
+        hidden_hoisted_node_modules
+    }
+
+    pub(crate) fn link_to_hidden_node_modules(&self, entry_id: StoreEntryId) {
+        let string_buf = self.lockfile().buffers.string_bytes.as_slice();
+
+        let node_id = self.store.entries.items_node_id()[entry_id.get() as usize];
+        let pkg_id = self.store.nodes.items_pkg_id()[node_id.get() as usize];
+        let pkg_name = self.lockfile().packages.items_name()[pkg_id as usize];
+
+        let hidden_hoisted_node_modules = self.hidden_node_modules_link_path(entry_id);
+
         let mut target = AutoRelPath::init();
 
         let _ = target.append(b".."); // OOM/capacity: fire-and-forget
@@ -2321,12 +2345,7 @@ impl<'a> Installer<'a> {
             let dep_name = dependencies[dep.dep_id as usize].name.slice(string_buf);
 
             dest.set_length(base_len);
-            let _ = dest.append(dep_name); // OOM/capacity: fire-and-forget
-            if entry_node_modules_name.is_some_and(|name| strings::eql_long(dep_name, name, true)) {
-                // same name as the entry itself: nest one node_modules deeper to avoid the collision
-                let _ = dest.append(b"node_modules"); // OOM/capacity: fire-and-forget
-                let _ = dest.append(dep_name); // OOM/capacity: fire-and-forget
-            }
+            append_dependency_link_name(&mut dest, dep_name, entry_node_modules_name);
 
             let mut dep_store_path = AutoAbsPath::init_top_level_dir();
             if uses_global_store {
@@ -2355,6 +2374,69 @@ impl<'a> Installer<'a> {
         Ok(changed)
     }
 
+    /// Main thread, once every task is done: dependents may still be linking while a script fails.
+    pub(crate) fn unlink_failed_optional_entries(&self) {
+        if self.failed_optional_entries.is_empty() {
+            return;
+        }
+
+        let lockfile = self.lockfile();
+        let string_buf = lockfile.buffers.string_bytes.as_slice();
+        let dependencies = lockfile.buffers.dependencies.as_slice();
+        let pkg_names = lockfile.packages.items_name();
+        let pkg_resolutions = lockfile.packages.items_resolution();
+
+        let entries = &self.store.entries;
+        let entry_node_ids = entries.items_node_id();
+        let entry_hoisted = entries.items_hoisted();
+
+        let nodes = &self.store.nodes;
+        let node_pkg_ids = nodes.items_pkg_id();
+        let node_dep_ids = nodes.items_dep_id();
+
+        // Not `parents`: public hoisting adds root dependencies without recording a parent.
+        for (entry_index, entry_deps) in entries.items_dependencies().iter().enumerate() {
+            if !entry_deps
+                .slice()
+                .iter()
+                .any(|dep| self.failed_optional_entries.contains(&dep.entry_id))
+            {
+                continue;
+            }
+
+            let entry_id = StoreEntryId::from(u32::try_from(entry_index).expect("int cast"));
+            let node_id = entry_node_ids[entry_index];
+            let pkg_id = node_pkg_ids[node_id.get() as usize];
+            let dep_id = node_dep_ids[node_id.get() as usize];
+            let entry_node_modules_name = self.entry_store_node_modules_package_name(
+                dep_id,
+                pkg_id,
+                &pkg_resolutions[pkg_id as usize],
+                pkg_names,
+            );
+
+            let mut dest = AutoPath::init_top_level_dir();
+            self.append_real_store_node_modules_path(&mut dest, entry_id, Which::Final);
+            let base_len = dest.len();
+
+            for dep in entry_deps.slice() {
+                if !self.failed_optional_entries.contains(&dep.entry_id) {
+                    continue;
+                }
+                let dep_name = dependencies[dep.dep_id as usize].name.slice(string_buf);
+                dest.set_length(base_len);
+                append_dependency_link_name(&mut dest, dep_name, entry_node_modules_name);
+                remove_link(dest.slice_z());
+            }
+        }
+
+        for &entry_id in &self.failed_optional_entries {
+            if entry_hoisted[entry_id.get() as usize] {
+                remove_link(self.hidden_node_modules_link_path(entry_id).slice_z());
+            }
+        }
+    }
+
     pub(crate) fn link_dependency_bins(&self, parent_entry_id: StoreEntryId) -> crate::Result<()> {
         let lockfile = self.lockfile();
         let store = self.store;
@@ -2887,6 +2969,30 @@ pub enum Which {
     Staging,
 }
 
+fn append_dependency_link_name(
+    dest: &mut AutoPath,
+    dep_name: &[u8],
+    entry_node_modules_name: Option<&[u8]>,
+) {
+    let _ = dest.append(dep_name); // OOM/capacity: fire-and-forget
+    if entry_node_modules_name.is_some_and(|name| strings::eql_long(dep_name, name, true)) {
+        // same name as the entry itself: nest one node_modules deeper to avoid the collision
+        let _ = dest.append(b"node_modules"); // OOM/capacity: fire-and-forget
+        let _ = dest.append(dep_name); // OOM/capacity: fire-and-forget
+    }
+}
+
+fn remove_link(path: &ZStr) {
+    #[cfg(windows)]
+    {
+        // directory symlinks and junctions (dangling or not) go through rmdir
+        if sys::rmdir(path).is_ok() {
+            return;
+        }
+    }
+    let _ = sys::unlink(path);
+}
+
 fn is_rename_collision(err: &sys::Error) -> bool {
     match err.get_errno() {
         sys::Errno::EEXIST | sys::Errno::ENOTEMPTY => true,
diff --git a/src/install/lifecycle_script_runner.rs b/src/install/lifecycle_script_runner.rs
index 463fcea10407..56df90beb3ea 100644
--- a/src/install/lifecycle_script_runner.rs
+++ b/src/install/lifecycle_script_runner.rs
@@ -851,14 +851,7 @@ impl<'a> LifecycleScriptSubprocess<'a> {
             Status::Exited(exit) => {
                 if exit.code > 0 {
                     if self.optional {
-                        if let Some(ctx) = &self.ctx {
-                            let installer = ctx.installer_mut();
-                            installer.store.entries.items_step()[ctx.entry_id.get() as usize]
-                                .store(Step::Done as u32, Ordering::Release);
-                            installer.on_task_complete(ctx.entry_id, CompleteState::Skipped);
-                        }
-                        self.decrement_pending_script_tasks();
-                        self.deinit_and_delete_package();
+                        self.discard_failed_optional_package();
                         return;
                     }
                     self.print_output();
@@ -986,14 +979,7 @@ impl<'a> LifecycleScriptSubprocess<'a> {
             }
             Status::Err(err) => {
                 if self.optional {
-                    if let Some(ctx) = &self.ctx {
-                        let installer = ctx.installer_mut();
-                        installer.store.entries.items_step()[ctx.entry_id.get() as usize]
-                            .store(Step::Done as u32, Ordering::Release);
-                        installer.on_task_complete(ctx.entry_id, CompleteState::Skipped);
-                    }
-                    self.decrement_pending_script_tasks();
-                    self.deinit_and_delete_package();
+                    self.discard_failed_optional_package();
                     return;
                 }
 
@@ -1063,6 +1049,18 @@ impl<'a> LifecycleScriptSubprocess<'a> {
         drop(unsafe { bun_core::heap::take(this) });
     }
 
+    /// Frees `self`.
+    fn discard_failed_optional_package(&mut self) {
+        let ctx = self.ctx.take();
+        self.decrement_pending_script_tasks();
+        self.deinit_and_delete_package();
+        // deleted first so the resumed dependents do not link its binaries
+        if let Some(ctx) = ctx {
+            ctx.installer_mut()
+                .on_optional_dependency_scripts_failed(ctx.entry_id);
+        }
+    }
+
     pub(crate) fn deinit_and_delete_package(&mut self) {
         if self.manager().options.log_level.is_verbose() {
             bun_core::warn!(
diff --git a/src/resolver/fs.rs b/src/resolver/fs.rs
index d1edb9f43517..8cdf8d6dc6f2 100644
--- a/src/resolver/fs.rs
+++ b/src/resolver/fs.rs
@@ -112,6 +112,8 @@ pub trait EntryKindResolver {
 pub enum EntryKind {
     Dir,
     File,
+    /// A symlink to nothing; treated like a missing entry, as `stat()` would report it.
+    Dangling,
 }
 
 #[derive(Clone, Copy)]
diff --git a/src/resolver/lib.rs b/src/resolver/lib.rs
index b9ef626b8bd1..9633c7f9c45a 100644
--- a/src/resolver/lib.rs
+++ b/src/resolver/lib.rs
@@ -1439,14 +1439,12 @@ pub mod fs {
                         core::ptr::null_mut(),
                     )
                 };
-                // Dangling link / loop / EACCES: `cache.kind` is already set
-                // from the link's own directory bit, which is correct for all
-                // of those. `Entry.kind`/`Entry.symlink` swallow errors and
-                // fall back to the `.file` placeholder anyway, so returning
-                // the half-populated cache is strictly better than `try`.
-                // Empty `cache.symlink` makes the resolver fall back to
-                // `parent.abs_real_path + base`.
                 if handle == w::INVALID_HANDLE_VALUE {
+                    if is_dangling_link_error(w::get_last_errno()) {
+                        cache.kind = EntryKind::Dangling;
+                        return Ok(cache);
+                    }
+                    // anything else keeps the kind from the link's own directory bit
                     return Ok(cache);
                 }
                 scopeguard::defer! {
@@ -1482,14 +1480,15 @@ pub mod fs {
                 let mut symlink: &[u8] = b"";
 
                 if is_symlink {
-                    let file: Fd = if let Some(valid) = existing_fd.unwrap_valid() {
-                        valid
+                    let opened: bun_sys::Maybe<Fd> = if let Some(valid) = existing_fd.unwrap_valid()
+                    {
+                        Ok(valid)
                     } else if store_fd {
                         bun_sys::open_file_absolute_z(
                             absolute_path_c,
                             bun_sys::OpenFlags::READ_ONLY,
-                        )?
-                        .into_raw()
+                        )
+                        .map(bun_sys::File::into_raw)
                     } else {
                         // O_PATH is
                         // Linux-only; macOS/BSD use O_RDONLY. Both add O_NOCTTY|O_CLOEXEC.
@@ -1497,7 +1496,15 @@ pub mod fs {
                         let flags = bun_sys::O::PATH | bun_sys::O::CLOEXEC | bun_sys::O::NOCTTY;
                         #[cfg(not(any(target_os = "linux", target_os = "android")))]
                         let flags = bun_sys::O::RDONLY | bun_sys::O::CLOEXEC | bun_sys::O::NOCTTY;
-                        bun_sys::open(absolute_path_c, flags, 0)?
+                        bun_sys::open(absolute_path_c, flags, 0)
+                    };
+                    let file: Fd = match opened {
+                        Ok(file) => file,
+                        Err(err) if is_dangling_link_error(err.get_errno()) => {
+                            cache.kind = EntryKind::Dangling;
+                            return Ok(cache);
+                        }
+                        Err(err) => return Err(err.into()),
                     };
                     FileSystem::set_max_fd(file.native());
 
@@ -1537,6 +1544,14 @@ pub mod fs {
         }
     }
 
+    /// How `stat()` fails on a link to nothing or a loop; other errors surface when the entry is read.
+    fn is_dangling_link_error(errno: bun_sys::E) -> bool {
+        matches!(
+            errno,
+            bun_sys::E::ENOENT | bun_sys::E::ENOTDIR | bun_sys::E::ELOOP
+        )
+    }
+
     impl crate::fs_full::EntryKindResolver for RealFS {
         #[inline(always)]
         fn resolve_kind(
@@ -1913,6 +1928,8 @@ pub mod dir_entry_accessor {
                 let fskind = match kind {
                     EntryKind::File => bun_sys::FileKind::File,
                     EntryKind::Dir => bun_sys::FileKind::Directory,
+                    // The walker gets to apply its own broken-symlink handling.
+                    EntryKind::Dangling => bun_sys::FileKind::SymLink,
                 };
                 // `Entry::kind` resolved through symlinks above; a non-empty
                 // cached realpath is what records the entry as a symlink.
diff --git a/src/resolver/resolver.rs b/src/resolver/resolver.rs
index 1e45ac9687a1..a933414bb77b 100644
--- a/src/resolver/resolver.rs
+++ b/src/resolver/resolver.rs
@@ -3696,9 +3696,14 @@ impl<'a> Resolver<'a> {
                     esm_resolution.status = Status::ModuleNotFound;
                     return MatchStatus::NotFound;
                 };
+                // SAFETY: rfs points at the process-global RealFS; the lazy-stat
+                // rewrite inside `kind()` is serialized on the per-entry mutex.
+                let entry_kind = entry_lookup
+                    .as_ref()
+                    .map(|q| unsafe { q.entry().kind(self.rfs_ptr(), self.store_fd) });
                 let entry_query = match entry_lookup {
-                    Some(q) => q,
-                    None => {
+                    Some(q) if entry_kind != Some(Fs::file_system::EntryKind::Dangling) => q,
+                    _ => {
                         let ends_with_star = esm_resolution.status == Status::ExactEndsWithStar;
                         esm_resolution.status = Status::ModuleNotFound;
 
@@ -3718,11 +3723,7 @@ impl<'a> Resolver<'a> {
                     }
                 };
 
-                // SAFETY: rfs points at the process-global RealFS; the lazy-stat
-                // rewrite inside `kind()` is serialized on the per-entry mutex.
-                if unsafe { entry_query.entry().kind(self.rfs_ptr(), self.store_fd) }
-                    == Fs::file_system::EntryKind::Dir
-                {
+                if entry_kind == Some(Fs::file_system::EntryKind::Dir) {
                     let ends_with_star = esm_resolution.status == Status::ExactEndsWithStar;
                     if ends_with_star
                         && self.probe_wildcard_extensions(
diff --git a/src/router/lib.rs b/src/router/lib.rs
index 98bfb8cf3785..77633370b608 100644
--- a/src/router/lib.rs
+++ b/src/router/lib.rs
@@ -639,6 +639,8 @@ impl<'a> RouteLoader<'a> {
                         }
                     }
                 }
+
+                Fs::EntryKind::Dangling => {}
             }
         }
     }
diff --git a/src/runtime/bake/FrameworkRouter.rs b/src/runtime/bake/FrameworkRouter.rs
index aa6522009ff1..9fc8038d17e0 100644
--- a/src/runtime/bake/FrameworkRouter.rs
+++ b/src/runtime/bake/FrameworkRouter.rs
@@ -1727,6 +1727,7 @@ impl FrameworkRouter {
 
                         arena_state.reset_retain_with_limit(8 * 1024 * 1024);
                     }
+                    bun_resolver::fs::EntryKind::Dangling => {}
                 }
             }
         }
diff --git a/src/runtime/cli/test/Scanner.rs b/src/runtime/cli/test/Scanner.rs
index 5182755e3614..42240a2f69a3 100644
--- a/src/runtime/cli/test/Scanner.rs
+++ b/src/runtime/cli/test/Scanner.rs
@@ -440,6 +440,7 @@ impl<'a> Scanner<'a> {
                 entry.abs_path = Interned::from_static(stored);
                 self.test_files.push(entry.abs_path);
             }
+            fs::EntryKind::Dangling => {}
         }
     }
 }
diff --git a/test/cli/install/isolated-install.test.ts b/test/cli/install/isolated-install.test.ts
index 97263adb6893..cade501878db 100644
--- a/test/cli/install/isolated-install.test.ts
+++ b/test/cli/install/isolated-install.test.ts
@@ -2057,6 +2057,86 @@ test("runs lifecycle scripts correctly", async () => {
   expect(allLifecycleScriptsDir).toEqual(["all-lifecycle-scripts"]);
 });
 
+test("optional dependency with a failing lifecycle script is removed along with the links to it", async () => {
+  // optional-lifecycle-fail@1.1.1 has `lifecycle-fail@1.1.1` in its
+  // optionalDependencies, and lifecycle-fail's preinstall script exits 1.
+  const { packageJson, packageDir } = await registry.createTestDir({ bunfigOpts: { linker: "isolated" } });
+
+  await write(
+    packageJson,
+    JSON.stringify({
+      name: "test-pkg-failed-optional-dependency",
+      dependencies: {
+        "optional-lifecycle-fail": "1.1.1",
+      },
+      trustedDependencies: ["lifecycle-fail"],
+    }),
+  );
+
+  const bunDir = join(packageDir, "node_modules", ".bun");
+  const dependentNodeModules = join(bunDir, "optional-lifecycle-fail@1.1.1", "node_modules");
+
+  async function expectFailedOptionalDependencyRemoved() {
+    expect(
+      await Promise.all([
+        readdirSorted(join(packageDir, "node_modules")),
+        readdirSorted(join(bunDir, "lifecycle-fail@1.1.1", "node_modules")),
+        // Neither the dependent's `node_modules/lifecycle-fail` link nor the
+        // hidden `.bun/node_modules/lifecycle-fail` link may be left behind
+        // pointing at the deleted package.
+        readdirSorted(dependentNodeModules),
+        readdirSorted(join(bunDir, "node_modules")),
+      ]),
+    ).toEqual([[".bun", "optional-lifecycle-fail"], [], ["optional-lifecycle-fail"], ["optional-lifecycle-fail"]]);
+
+    const requireFromDependent = createRequire(join(dependentNodeModules, "optional-lifecycle-fail", "package.json"));
+    let code: string | undefined;
+    try {
+      requireFromDependent.resolve("lifecycle-fail");
+    } catch (e: any) {
+      code = e.code;
+    }
+    expect(code).toBe("MODULE_NOT_FOUND");
+  }
+
+  await runBunInstall(bunEnv, packageDir);
+  await expectFailedOptionalDependencyRemoved();
+
+  // The failed package is installed (and removed) again on the next install;
+  // relinking the packages that depend on it must not leave links behind either.
+  await runBunInstall(bunEnv, packageDir, { savesLockfile: false });
+  await expectFailedOptionalDependencyRemoved();
+});
+
+test("direct optional dependency with a failing postinstall script is removed along with the links to it", async () => {
+  const { packageJson, packageDir } = await registry.createTestDir({ bunfigOpts: { linker: "isolated" } });
+
+  await write(
+    packageJson,
+    JSON.stringify({
+      name: "test-pkg-failed-direct-optional-dependency",
+      dependencies: {
+        "no-deps": "1.0.0",
+      },
+      optionalDependencies: {
+        "lifecycle-failing-postinstall": "1.0.0",
+      },
+      trustedDependencies: ["lifecycle-failing-postinstall"],
+    }),
+  );
+
+  await runBunInstall(bunEnv, packageDir);
+
+  const bunDir = join(packageDir, "node_modules", ".bun");
+  expect(
+    await Promise.all([
+      readdirSorted(join(packageDir, "node_modules")),
+      readdirSorted(join(bunDir, "lifecycle-failing-postinstall@1.0.0", "node_modules")),
+      readdirSorted(join(bunDir, "node_modules")),
+    ]),
+  ).toEqual([[".bun", "no-deps"], [], ["no-deps"]]);
+});
+
 // When an auto-installed peer dependency has its OWN peer deps, those
 // transitive peers get re-queued during peer processing. If all manifest
 // loads are synchronous (cached with valid max-age) AND the transitive peer's
diff --git a/test/js/bun/resolve/resolve.test.ts b/test/js/bun/resolve/resolve.test.ts
index 554b7d8e1046..ed4bacadbae5 100644
--- a/test/js/bun/resolve/resolve.test.ts
+++ b/test/js/bun/resolve/resolve.test.ts
@@ -899,6 +899,141 @@ describe.if(isWindows)("#30839 - imports entry pointing at a scoped package", ()
   });
 });
 
+// A symlink in node_modules whose target no longer exists (for example an
+// optional dependency that was removed after its install script failed) is
+// not a module. Like Node, the resolver treats it as if the entry did not
+// exist and keeps looking, instead of resolving to it and failing to read it.
+describe("dangling symlinks in node_modules", () => {
+  const codeOf = (fn: () => unknown) => {
+    try {
+      fn();
+      return "resolved";
+    } catch (e: any) {
+      return { name: e.name, code: e.code };
+    }
+  };
+
+  it.concurrent("are reported as a missing module", async () => {
+    using dir = tempDir("resolver-dangling-node-modules-link", {
+      "package.json": JSON.stringify({ name: "host" }),
+      "node_modules/.keep": "",
+      "index.js": `
+        const codes = { require: null, import: null, resolve: null };
+        try {
+          require("dangling-pkg");
+        } catch (e) {
+          codes.require = e.code;
+        }
+        try {
+          require.resolve("dangling-pkg");
+        } catch (e) {
+          codes.resolve = e.code;
+        }
+        try {
+          await import("dangling-pkg");
+        } catch (e) {
+          codes.import = e.code;
+        }
+        console.log(JSON.stringify(codes));
+      `,
+    });
+    const root = String(dir);
+    symlinkSync(join("..", "does-not-exist"), join(root, "node_modules", "dangling-pkg"));
+
+    expect(codeOf(() => Bun.resolveSync("dangling-pkg", root))).toEqual({
+      name: "ResolveMessage",
+      code: "ERR_MODULE_NOT_FOUND",
+    });
+
+    await using proc = Bun.spawn({
+      cmd: [bunExe(), "index.js"],
+      env: bunEnv,
+      cwd: root,
+      stdout: "pipe",
+      stderr: "pipe",
+    });
+    const [stdout, stderr, exitCode] = await Promise.all([proc.stdout.text(), proc.stderr.text(), proc.exited]);
+
+    expect(stderr).toBe("");
+    expect(JSON.parse(stdout)).toEqual({
+      require: "MODULE_NOT_FOUND",
+      resolve: "MODULE_NOT_FOUND",
+      import: "ERR_MODULE_NOT_FOUND",
+    });
+    expect(exitCode).toBe(0);
+  });
+
+  it.concurrent("are reported as a missing module when a package.json exports target points at one", async () => {
+    using dir = tempDir("resolver-dangling-exports-target", {
+      "package.json": JSON.stringify({ name: "host" }),
+      "node_modules/exports-pkg/package.json": JSON.stringify({
+        name: "exports-pkg",
+        version: "1.0.0",
+        exports: { ".": "./index.js", "./sub": "./sub.js" },
+      }),
+      "node_modules/exports-pkg/sub.js": `module.exports = "sub";`,
+      "index.js": `
+        try {
+          require("exports-pkg");
+        } catch (e) {
+          console.log(e.code);
+        }
+        console.log(require("exports-pkg/sub"));
+      `,
+    });
+    const root = String(dir);
+    symlinkSync("removed.js", join(root, "node_modules", "exports-pkg", "index.js"));
+
+    expect(codeOf(() => Bun.resolveSync("exports-pkg", root))).toEqual({
+      name: "ResolveMessage",
+      code: "ERR_MODULE_NOT_FOUND",
+    });
+    expect(Bun.resolveSync("exports-pkg/sub", root)).toBe(join(root, "node_modules", "exports-pkg", "sub.js"));
+
+    await using proc = Bun.spawn({
+      cmd: [bunExe(), "index.js"],
+      env: bunEnv,
+      cwd: root,
+      stdout: "pipe",
+      stderr: "pipe",
+    });
+    const [stdout, stderr, exitCode] = await Promise.all([proc.stdout.text(), proc.stderr.text(), proc.exited]);
+
+    expect(stderr).toBe("");
+    expect(stdout).toBe("MODULE_NOT_FOUND\nsub\n");
+    expect(exitCode).toBe(0);
+  });
+
+  it.concurrent("do not shadow the same package in a parent node_modules", async () => {
+    using dir = tempDir("resolver-dangling-node-modules-link-shadow", {
+      "package.json": JSON.stringify({ name: "host" }),
+      "node_modules/shadowed-pkg/package.json": JSON.stringify({ name: "shadowed-pkg", version: "1.0.0" }),
+      "node_modules/shadowed-pkg/index.js": `module.exports = "from the parent node_modules";`,
+      "app/node_modules/.keep": "",
+      "app/index.js": `console.log(require("shadowed-pkg"));`,
+    });
+    const root = String(dir);
+    symlinkSync(join("..", "..", "removed-pkg"), join(root, "app", "node_modules", "shadowed-pkg"));
+
+    expect(Bun.resolveSync("shadowed-pkg", join(root, "app"))).toBe(
+      join(root, "node_modules", "shadowed-pkg", "index.js"),
+    );
+
+    await using proc = Bun.spawn({
+      cmd: [bunExe(), "index.js"],
+      env: bunEnv,
+      cwd: join(root, "app"),
+      stdout: "pipe",
+      stderr: "pipe",
+    });
+    const [stdout, stderr, exitCode] = await Promise.all([proc.stdout.text(), proc.stderr.text(), proc.exited]);
+
+    expect(stderr).toBe("");
+    expect(stdout).toBe("from the parent node_modules\n");
+    expect(exitCode).toBe(0);
+  });
+});
+
 // dirInfoCachedMaybeLog reads the rfs.entries cache without checking the union
 // tag. If readDirectory() previously failed with a non-ENOENT error (e.g.
 // EACCES), a `.err` variant is stored there; re-resolving the directory after

From 094347b7c08239473d2f64bc719fcee87824b044 Mon Sep 17 00:00:00 2001
From: robobun <117481402+robobun@users.noreply.github.com>
Date: Mon, 17 Aug 2026 01:08:15 +0000
Subject: [PATCH 064/258] install: link packages into a staging directory and
 rename them into place (#38783)

---
 src/install/PackageInstall.rs                | 171 ++++++++++---
 src/install/isolated_install.rs              |   1 +
 src/install/isolated_install/Installer.rs    | 143 ++++++-----
 test/cli/install/bun-install-staging.test.ts | 237 +++++++++++++++++++
 4 files changed, 462 insertions(+), 90 deletions(-)
 create mode 100644 test/cli/install/bun-install-staging.test.ts

diff --git a/src/install/PackageInstall.rs b/src/install/PackageInstall.rs
index 0b6db8483b9c..7fbfc8f2b02d 100644
--- a/src/install/PackageInstall.rs
+++ b/src/install/PackageInstall.rs
@@ -234,6 +234,7 @@ pub enum Step {
     OpeningCacheDir,
     OpeningDestDir,
     CopyingFiles,
+    MovingIntoPlace,
     LinkingDependency,
 }
 
@@ -244,11 +245,58 @@ impl Step {
             Step::CopyingFiles => b"copying files from cache to destination",
             Step::OpeningCacheDir => b"opening cache/package/version dir",
             Step::OpeningDestDir => b"opening node_modules/package dir",
+            Step::MovingIntoPlace => b"moving copied files into node_modules/package dir",
             Step::LinkingDependency => b"linking dependency/workspace to node_modules",
         }
     }
 }
 
+/// Where a package is linked to before being renamed onto its real path, which
+/// later installs take as proof that it is installed: `@scope/name` becomes
+/// `@scope/.bun-tmp-<hash>`. Hashed because a name may already be NAME_MAX long,
+/// deterministic so the next install of the package removes a stale one.
+pub(crate) struct StagingPath<'a>(pub(crate) &'a [u8]);
+
+impl core::fmt::Display for StagingPath<'_> {
+    fn fmt(&self, f: &mut core::fmt::Formatter<'_>) -> core::fmt::Result {
+        let name_start = strings::last_index_of_char(self.0, b'/').map_or(0, |slash| slash + 1);
+        let scope = &self.0[..name_start];
+        write!(
+            f,
+            "{}.bun-tmp-{:016x}",
+            bstr::BStr::new(scope),
+            bun_wyhash::hash(self.0)
+        )
+    }
+}
+
+/// Renames a fully linked `StagingPath` (relative to `dir`) onto `dest`. Fails if
+/// `dest` is occupied.
+pub(crate) fn rename_staging_into_place(dir: Fd, staging: &ZStr, dest: &ZStr) -> sys::Maybe<()> {
+    #[cfg(windows)]
+    {
+        // A scanner still holding a just-written file open fails the rename for a
+        // few milliseconds (#11250 is the same failure for the cache). An occupied
+        // `dest` fails with the same errors and is not worth waiting on.
+        const RETRIES: u32 = 6;
+        for attempt in 0..RETRIES {
+            match sys::renameat(dir, staging, dir, dest) {
+                Err(err)
+                    if matches!(
+                        err.get_errno(),
+                        sys::E::EPERM | sys::E::EACCES | sys::E::EBUSY
+                    ) && !sys::directory_exists_at(dir, dest).unwrap_or(false) =>
+                {
+                    // 10ms, 20ms, ... 320ms: 630ms in total.
+                    std::thread::sleep(std::time::Duration::from_millis(10u64 << attempt));
+                }
+                result => return result,
+            }
+        }
+    }
+    sys::renameat(dir, staging, dir, dest)
+}
+
 // PORTING.md §Global mutable state: install-main-thread enum. `RacyCell`
 // (no `Atomic<Method>`) — writers are the CLI option-load and the
 // clonefile/hardlink fallback in `install_with_method`, all on the install
@@ -1027,6 +1075,7 @@ impl<'a> PackageInstall<'a> {
     fn install_with_clonefile_each_dir(
         &mut self,
         destination_dir: &Dir,
+        dest_subpath: &ZStr,
     ) -> crate::Result<InstallResult> {
         let cached_package_dir = match open_dir(self.cache_dir, self.cache_dir_subpath) {
             Ok(d) => d,
@@ -1089,12 +1138,13 @@ impl<'a> PackageInstall<'a> {
             Ok(())
         }
 
-        let subdir = match destination_dir.make_open_path(
-            self.destination_dir_subpath.as_bytes(),
-            OpenDirOptions::default(),
-        ) {
+        let subdir = match destination_dir
+            .make_open_path(dest_subpath.as_bytes(), OpenDirOptions::default())
+        {
             Ok(d) => d,
-            Err(err) => return Ok(InstallResult::fail(err.into(), Step::OpeningDestDir, None)),
+            Err(err) => {
+                return Ok(InstallResult::fail(err.into(), Step::OpeningDestDir, None));
+            }
         };
         if let Err(err) = copy(&subdir, &mut walker_) {
             return Ok(InstallResult::fail(err, Step::CopyingFiles, None));
@@ -1105,15 +1155,14 @@ impl<'a> PackageInstall<'a> {
 
     // https://www.unix.com/man-page/mojave/2/fclonefileat/
     #[cfg(target_os = "macos")]
-    fn install_with_clonefile(&mut self, destination_dir: &Dir) -> crate::Result<InstallResult> {
-        if self.destination_dir_subpath.as_bytes()[0] == b'@' {
-            if let Some(slash) = strings::index_of_char_z(self.destination_dir_subpath, SEP) {
-                let slash = slash as usize;
-                self.destination_dir_subpath_buf[slash] = 0;
-                // SAFETY: NUL written above.
-                let subdir = ZStr::from_buf(self.destination_dir_subpath_buf, slash);
-                let _ = sys::mkdirat(destination_dir, subdir, 0o755);
-                self.destination_dir_subpath_buf[slash] = SEP;
+    fn install_with_clonefile(
+        &mut self,
+        destination_dir: &Dir,
+        dest_subpath: &ZStr,
+    ) -> crate::Result<InstallResult> {
+        if dest_subpath.as_bytes()[0] == b'@' {
+            if let Some(slash) = strings::index_of_char_usize(dest_subpath.as_bytes(), SEP) {
+                let _ = destination_dir.make_dir(&dest_subpath.as_bytes()[..slash]);
             }
         }
 
@@ -1121,7 +1170,7 @@ impl<'a> PackageInstall<'a> {
             self.cache_dir,
             self.cache_dir_subpath,
             destination_dir.fd(),
-            self.destination_dir_subpath,
+            dest_subpath,
         ) {
             Ok(()) => Ok(InstallResult::Success),
             Err(e) => match e.get_errno() {
@@ -1132,7 +1181,9 @@ impl<'a> PackageInstall<'a> {
                 // But, this can happen if this package contains a node_modules folder
                 // We want to continue installing as many packages as we can, so we shouldn't block while downloading
                 // We use the slow path in this case
-                sys::Errno::EEXIST => self.install_with_clonefile_each_dir(destination_dir),
+                sys::Errno::EEXIST => {
+                    self.install_with_clonefile_each_dir(destination_dir, dest_subpath)
+                }
                 sys::Errno::EACCES => Err(crate::Error::Sys(bun_errno::SystemErrno::EACCES)),
                 _ => Err(crate::Error::Unexpected),
             },
@@ -1142,10 +1193,10 @@ impl<'a> PackageInstall<'a> {
     fn init_install_dir(
         &mut self,
         destination_dir: &Dir,
+        destpath: &ZStr,
         method: Method,
     ) -> Result<InstallDirState, Box<Failure>> {
         let destbase = destination_dir;
-        let destpath = self.destination_dir_subpath;
 
         let cached_package_dir = match {
             #[cfg(windows)]
@@ -1302,8 +1353,13 @@ impl<'a> PackageInstall<'a> {
         }
     }
 
-    fn install_with_copyfile(&mut self, destination_dir: &Dir) -> InstallResult {
-        let mut state = match self.init_install_dir(destination_dir, Method::Copyfile) {
+    fn install_with_copyfile(
+        &mut self,
+        destination_dir: &Dir,
+        dest_subpath: &ZStr,
+    ) -> InstallResult {
+        let mut state = match self.init_install_dir(destination_dir, dest_subpath, Method::Copyfile)
+        {
             Ok(state) => state,
             Err(failure) => return InstallResult::Failure(failure),
         };
@@ -1547,8 +1603,12 @@ impl<'a> PackageInstall<'a> {
         InstallResult::Success
     }
 
-    fn install_with_hardlink(&mut self, dest_dir: &Dir) -> crate::Result<InstallResult> {
-        let mut state = match self.init_install_dir(dest_dir, Method::Hardlink) {
+    fn install_with_hardlink(
+        &mut self,
+        dest_dir: &Dir,
+        dest_subpath: &ZStr,
+    ) -> crate::Result<InstallResult> {
+        let mut state = match self.init_install_dir(dest_dir, dest_subpath, Method::Hardlink) {
             Ok(state) => state,
             Err(failure) => return Ok(InstallResult::Failure(failure)),
         };
@@ -1735,8 +1795,12 @@ impl<'a> PackageInstall<'a> {
         Ok(InstallResult::Success)
     }
 
-    fn install_with_symlink(&mut self, dest_dir: &Dir) -> crate::Result<InstallResult> {
-        let mut state = match self.init_install_dir(dest_dir, Method::Symlink) {
+    fn install_with_symlink(
+        &mut self,
+        dest_dir: &Dir,
+        dest_subpath: &ZStr,
+    ) -> crate::Result<InstallResult> {
+        let mut state = match self.init_install_dir(dest_dir, dest_subpath, Method::Symlink) {
             Ok(state) => state,
             Err(failure) => return Ok(InstallResult::Failure(failure)),
         };
@@ -2323,7 +2387,7 @@ impl<'a> PackageInstall<'a> {
         &mut self,
         skip_delete: bool,
         destination_dir: &Dir,
-        method_: Method,
+        method: Method,
         resolution_tag: resolution::Tag,
     ) -> InstallResult {
         let _tracer = bun_core::perf::trace("PackageInstaller.install");
@@ -2334,7 +2398,54 @@ impl<'a> PackageInstall<'a> {
             self.uninstall_before_install(destination_dir);
         }
 
-        let mut supported_method_to_use = method_;
+        let mut staging_buf = path::path_buffer_pool::get();
+        let Ok(staging) = bun_core::fmt::buf_print_z(
+            &mut staging_buf[..],
+            format_args!("{}", StagingPath(self.destination_dir_subpath.as_bytes())),
+        ) else {
+            return InstallResult::fail(
+                crate::Error::Sys(bun_errno::SystemErrno::ENAMETOOLONG),
+                Step::OpeningDestDir,
+                None,
+            );
+        };
+        // A stale one may hold files of another version, which the backends would keep.
+        if let Err(err) = destination_dir.delete_tree(staging.as_bytes()) {
+            return InstallResult::fail(err.into(), Step::OpeningDestDir, None);
+        }
+
+        if let failure @ InstallResult::Failure(_) =
+            self.install_into(destination_dir, staging, method, resolution_tag)
+        {
+            let _ = destination_dir.delete_tree(staging.as_bytes());
+            return failure;
+        }
+
+        let dest = self.destination_dir_subpath;
+        let mut renamed = rename_staging_into_place(destination_dir.fd(), staging, dest);
+        if renamed.is_err() && dest.as_bytes() != b"." {
+            // Occupied: a workspace depended on under two names is walked as two trees,
+            // so the packages inside it are installed twice. The later one replaces it.
+            self.uninstall_before_install(destination_dir);
+            renamed = rename_staging_into_place(destination_dir.fd(), staging, dest);
+        }
+        match renamed {
+            Ok(()) => InstallResult::Success,
+            Err(err) => {
+                let _ = destination_dir.delete_tree(staging.as_bytes());
+                InstallResult::fail(err.into(), Step::MovingIntoPlace, None)
+            }
+        }
+    }
+
+    fn install_into(
+        &mut self,
+        destination_dir: &Dir,
+        dest_subpath: &ZStr,
+        method: Method,
+        resolution_tag: resolution::Tag,
+    ) -> InstallResult {
+        let mut supported_method_to_use = method;
 
         if resolution_tag == resolution::Tag::Folder
             && !self
@@ -2350,7 +2461,7 @@ impl<'a> PackageInstall<'a> {
                 {
                     // First, attempt to use clonefile
                     // if that fails due to ENOTSUP, mark it as unsupported and then fall back to copyfile
-                    match self.install_with_clonefile(destination_dir) {
+                    match self.install_with_clonefile(destination_dir, dest_subpath) {
                         Ok(result) => return result,
                         Err(err) => {
                             if err == crate::Error::NotSupported {
@@ -2372,7 +2483,7 @@ impl<'a> PackageInstall<'a> {
             Method::ClonefileEachDir => {
                 #[cfg(target_os = "macos")]
                 {
-                    match self.install_with_clonefile_each_dir(destination_dir) {
+                    match self.install_with_clonefile_each_dir(destination_dir, dest_subpath) {
                         Ok(result) => return result,
                         Err(err) => {
                             if err == crate::Error::NotSupported {
@@ -2393,7 +2504,7 @@ impl<'a> PackageInstall<'a> {
             }
             #[allow(unused_labels)]
             Method::Hardlink => 'outer: {
-                match self.install_with_hardlink(destination_dir) {
+                match self.install_with_hardlink(destination_dir, dest_subpath) {
                     Ok(result) => return result,
                     Err(err) => {
                         #[cfg(not(windows))]
@@ -2418,7 +2529,7 @@ impl<'a> PackageInstall<'a> {
                 }
             }
             Method::Symlink => {
-                return match self.install_with_symlink(destination_dir) {
+                return match self.install_with_symlink(destination_dir, dest_subpath) {
                     Ok(result) => result,
                     Err(err) => {
                         if err == crate::Error::Sys(bun_errno::SystemErrno::ENOENT) {
@@ -2437,7 +2548,7 @@ impl<'a> PackageInstall<'a> {
         }
 
         // TODO: linux io_uring
-        self.install_with_copyfile(destination_dir)
+        self.install_with_copyfile(destination_dir, dest_subpath)
     }
 }
 
diff --git a/src/install/isolated_install.rs b/src/install/isolated_install.rs
index c9a16024133f..1e93f5542f9b 100644
--- a/src/install/isolated_install.rs
+++ b/src/install/isolated_install.rs
@@ -2258,6 +2258,7 @@ pub(crate) fn install_isolated_packages(
                                     .ok()
                                     .unwrap_or(false);
                             }
+                            // Likewise, the package directory appears here only once fully linked.
                             installer.append_real_store_path(&mut store_path, entry_id, installer::Which::Final);
                             // Capture the length instead of a `ResetScope` so
                             // `store_path` stays unborrowed.
diff --git a/src/install/isolated_install/Installer.rs b/src/install/isolated_install/Installer.rs
index f4eaab2d1c4f..3be474cde889 100644
--- a/src/install/isolated_install/Installer.rs
+++ b/src/install/isolated_install/Installer.rs
@@ -15,7 +15,9 @@ use bun_sys::{FdDirExt as _, FdExt as _};
 use crate::bin_real;
 use crate::lockfile::package;
 use crate::lockfile_real::PackageIDSlice;
-use crate::package_install::{Method as InstallMethod, Summary as InstallSummary};
+use crate::package_install::{
+    Method as InstallMethod, StagingPath, Summary as InstallSummary, rename_staging_into_place,
+};
 use crate::package_manager_real::Command;
 use crate::postinstall_optimizer;
 use crate::postinstall_optimizer::PostinstallOptimizer;
@@ -447,35 +449,18 @@ impl<'a> Installer<'a> {
             let mut staging = AutoAbsPath::init();
             self.append_global_store_entry_path(&mut staging, entry_id, Which::Staging);
             let _ = Fd::cwd().delete_tree(staging.slice());
-        }
-
-        // attempt deleting the package so the next install will install it again
-        match pkg_res.tag {
-            ResolutionTag::Uninitialized
-            | ResolutionTag::SingleFileModule
-            | ResolutionTag::Root
-            | ResolutionTag::Workspace
-            | ResolutionTag::Symlink => {}
-
-            // to be safe make sure we only delete packages in the store
+        } else if matches!(
+            pkg_res.tag,
             ResolutionTag::Npm
-            | ResolutionTag::Git
-            | ResolutionTag::Github
-            | ResolutionTag::LocalTarball
-            | ResolutionTag::RemoteTarball
-            | ResolutionTag::Folder => {
-                let mut store_path = AutoRelPath::init();
-
-                // OOM/capacity: fire-and-forget
-                let _ = store_path.append_fmt(format_args!(
-                    "node_modules/{}",
-                    store::entry::fmt_store_path(entry_id, self.store, self.lockfile()),
-                ));
-
-                let _ = sys::unlink(store_path.slice_z());
-            }
-
-            _ => {}
+                | ResolutionTag::Git
+                | ResolutionTag::Github
+                | ResolutionTag::LocalTarball
+                | ResolutionTag::RemoteTarball
+        ) {
+            // A failed link only ever wrote to the staging directory.
+            let mut staging = AutoPath::init_top_level_dir();
+            self.append_real_store_path(&mut staging, entry_id, Which::Staging);
+            let _ = Fd::cwd().delete_tree(staging.slice());
         }
 
         if self.manager().options.enable.fail_early() {
@@ -1299,14 +1284,15 @@ impl Task {
                             }
                         }
 
-                        // hardlink/copyfile overlay an existing tree, keeping files a previous patched build added.
-                        let mut previous = AutoPath::init_top_level_dir();
-                        installer.append_real_store_path(
-                            &mut previous,
-                            self.entry_id,
-                            Which::Final,
-                        );
-                        let _ = Fd::cwd().delete_tree(previous.slice());
+                        // The final path must be free for the rename below, and the backends
+                        // would keep whatever a stale staging tree holds.
+                        for which in [Which::Final, Which::Staging] {
+                            let mut leftover = AutoPath::init_top_level_dir();
+                            installer.append_real_store_path(&mut leftover, self.entry_id, which);
+                            if let sys::Result::Err(err) = Fd::cwd().delete_tree(leftover.slice()) {
+                                return Ok(Yield::failure(TaskError::LinkPackage(err)));
+                            }
+                        }
                     }
 
                     if uses_global_store {
@@ -1411,8 +1397,7 @@ impl Task {
                                         },
                                     }
 
-                                    step = self.next_step(current_step);
-                                    continue 'step;
+                                    break 'backend;
                                 }
                             }
 
@@ -1481,8 +1466,7 @@ impl Task {
                                     }
                                 }
 
-                                step = self.next_step(current_step);
-                                continue 'step;
+                                break 'backend;
                             }
 
                             // fallthrough copyfile
@@ -1549,12 +1533,21 @@ impl Task {
                                     }
                                 }
 
-                                step = self.next_step(current_step);
-                                continue 'step;
+                                break 'backend;
                             }
                         }
                     }
-                    // unreachable: every backend arm continues to next_step or returns
+
+                    if !uses_global_store {
+                        if let sys::Result::Err(err) =
+                            installer.commit_local_store_package(self.entry_id)
+                        {
+                            return Ok(Yield::failure(TaskError::LinkPackage(err)));
+                        }
+                    }
+
+                    step = self.next_step(current_step);
+                    continue 'step;
                 }
 
                 Step::SymlinkDependencies => {
@@ -2677,6 +2670,17 @@ impl<'a> Installer<'a> {
         }
     }
 
+    /// Renames a project-local entry's fully linked `StagingPath` onto its final
+    /// path, which is what the next install's skip check looks at.
+    pub(crate) fn commit_local_store_package(&self, entry_id: StoreEntryId) -> sys::Result<()> {
+        debug_assert!(!self.entry_uses_global_store(entry_id));
+        let mut staging = AutoPath::init_top_level_dir();
+        self.append_real_store_path(&mut staging, entry_id, Which::Staging);
+        let mut final_ = AutoPath::init_top_level_dir();
+        self.append_real_store_path(&mut final_, entry_id, Which::Final);
+        rename_staging_into_place(Fd::cwd(), staging.slice_z(), final_.slice_z())
+    }
+
     /// Project-local path `node_modules/.bun/<storepath>` (the symlink that
     /// points at the global virtual-store entry). Relative to top-level dir.
     pub(crate) fn append_local_store_entry_path(
@@ -2846,7 +2850,35 @@ impl<'a> Installer<'a> {
             buf.append(pkg_name.slice(string_buf));
             return;
         }
-        self.append_store_path(buf, entry_id);
+        match which {
+            Which::Final => self.append_store_path(buf, entry_id),
+            Which::Staging => self.append_store_package_path(buf, entry_id, which),
+        }
+    }
+
+    /// `node_modules/.bun/<storepath>/node_modules/<pkg>`, or with
+    /// `Which::Staging` the `StagingPath` next to it.
+    fn append_store_package_path(
+        &self,
+        buf: &mut impl paths::PathLike,
+        entry_id: StoreEntryId,
+        which: Which,
+    ) {
+        let string_buf = self.lockfile().buffers.string_bytes.as_slice();
+        let node_id = self.store.entries.items_node_id()[entry_id.get() as usize];
+        let pkg_id = self.store.nodes.items_pkg_id()[node_id.get() as usize];
+        let pkg_name = self.lockfile().packages.items_name()[pkg_id as usize].slice(string_buf);
+
+        buf.append(NODE_MODULES_BUN.as_bytes());
+        buf.append_fmt(format_args!(
+            "{}",
+            store::entry::fmt_store_path(entry_id, self.store, self.lockfile()),
+        ));
+        buf.append(b"node_modules");
+        match which {
+            Which::Final => buf.append(pkg_name),
+            Which::Staging => buf.append_fmt(format_args!("{}", StagingPath(pkg_name))),
+        }
     }
 
     pub(crate) fn append_store_path(&self, buf: &mut impl paths::PathLike, entry_id: StoreEntryId) {
@@ -2911,16 +2943,7 @@ impl<'a> Installer<'a> {
                 buf.append(symlink_dir_path);
                 buf.append(pkg_res.symlink().slice(string_buf));
             }
-            _ => {
-                let pkg_name = pkg_names[pkg_id as usize];
-                buf.append(NODE_MODULES_BUN.as_bytes());
-                buf.append_fmt(format_args!(
-                    "{}",
-                    store::entry::fmt_store_path(entry_id, self.store, self.lockfile()),
-                ));
-                buf.append(b"node_modules");
-                buf.append(pkg_name.slice(string_buf));
-            }
+            _ => self.append_store_package_path(buf, entry_id, Which::Final),
         }
     }
 
@@ -2960,12 +2983,12 @@ impl<'a> Installer<'a> {
 
 #[derive(Clone, Copy, PartialEq, Eq)]
 pub enum Which {
-    /// The published location (`<cache>/links/<entry>`). Use for symlink
-    /// *targets* that point at other entries, and for the warm-hit check.
+    /// The published location. Use for symlink *targets* that point at other
+    /// entries, and for the warm-hit check.
     Final,
-    /// The per-process temp sibling (`<entry>.tmp-<suffix>`) the build
-    /// steps write into. Use for *destinations* of clonefile/hardlink/
-    /// dep-symlink/bin-link when building this entry.
+    /// What the build steps write into, renamed onto `Final` once complete: the
+    /// whole entry (`<entry>.tmp-<suffix>`) for a global-store entry, only the
+    /// package directory (`StagingPath`) for a project-local one.
     Staging,
 }
 
diff --git a/test/cli/install/bun-install-staging.test.ts b/test/cli/install/bun-install-staging.test.ts
new file mode 100644
index 000000000000..66556b65be7e
--- /dev/null
+++ b/test/cli/install/bun-install-staging.test.ts
@@ -0,0 +1,237 @@
+// Packages are linked out of the cache into a staging directory that is renamed
+// onto the package's final path once complete. An install killed while linking
+// must not leave a partial copy at the final path: both linkers treat an
+// installed package.json as "this package is installed", so a truncated
+// directory that already received its package.json would be reported as up to
+// date by every later `bun install`. The rename must also cope with the final
+// path being occupied already, which the hoisted linker does to itself.
+import { expect, test } from "bun:test";
+import { bunEnv, bunExe, tempDir } from "harness";
+import { existsSync, readdirSync, readFileSync, rmSync } from "node:fs";
+import { join } from "node:path";
+
+// Enough files that the kill below lands long before linking finishes, even
+// when the test process is slow to notice that linking has started.
+const DIR_COUNT = 32;
+const FILES_PER_DIR = 64;
+
+const archiveEntries: Record<string, string> = {
+  "package/package.json": JSON.stringify({ name: "many-files", version: "1.0.0" }),
+};
+for (let dir = 0; dir < DIR_COUNT; dir++) {
+  for (let file = 0; file < FILES_PER_DIR; file++) {
+    archiveEntries[`package/d${dir}/f${file}.js`] = `module.exports = ${dir * FILES_PER_DIR + file};\n`;
+  }
+}
+
+const expectedTree = new Set<string>();
+for (const entry of Object.keys(archiveEntries)) {
+  const relative = entry.slice("package/".length);
+  const slash = relative.indexOf("/");
+  if (slash !== -1) expectedTree.add(relative.slice(0, slash));
+  expectedTree.add(relative);
+}
+
+// Summarized rather than compared entry by entry so a failure reads as a few
+// lines instead of a diff of thousands of paths.
+function compareWithExpectedTree(packageDir: string) {
+  const actual = new Set((readdirSync(packageDir, { recursive: true }) as string[]).map(p => p.replaceAll("\\", "/")));
+  const missing = [...expectedTree].filter(entry => !actual.has(entry));
+  const unexpected = [...actual].filter(entry => !expectedTree.has(entry));
+  return {
+    entries: actual.size,
+    missing: missing.length,
+    firstMissing: missing.slice(0, 3),
+    unexpected,
+  };
+}
+const completeTree = { entries: expectedTree.size, missing: 0, firstMissing: [], unexpected: [] };
+
+function serveRegistry(tgz: Uint8Array) {
+  return Bun.serve({
+    port: 0,
+    fetch(request) {
+      const { origin, pathname } = new URL(request.url);
+      switch (pathname) {
+        case "/many-files":
+          return Response.json({
+            name: "many-files",
+            "dist-tags": { latest: "1.0.0" },
+            versions: {
+              "1.0.0": {
+                name: "many-files",
+                version: "1.0.0",
+                dist: { tarball: `${origin}/many-files-1.0.0.tgz` },
+              },
+            },
+          });
+        case "/many-files-1.0.0.tgz":
+          return new Response(tgz);
+        default:
+          return new Response("not found", { status: 404 });
+      }
+    },
+  });
+}
+
+async function install(cwd: string) {
+  await using proc = Bun.spawn({
+    cmd: [bunExe(), "install"],
+    cwd,
+    env: bunEnv,
+    stdout: "pipe",
+    stderr: "pipe",
+  });
+  const [stdout, stderr, exitCode] = await Promise.all([proc.stdout.text(), proc.stderr.text(), proc.exited]);
+  return { stdout, stderr, exitCode };
+}
+
+// Kills `bun install` as soon as anything shows up in the directory the package
+// is installed into (the package is the only thing that goes there), i.e. while
+// its files are being linked out of the cache.
+async function installAndKillWhileLinking(cwd: string, packageParentDir: string) {
+  await using proc = Bun.spawn({
+    cmd: [bunExe(), "install"],
+    cwd,
+    env: bunEnv,
+    stdout: "ignore",
+    stderr: "pipe",
+  });
+  let exited = false;
+  proc.exited.then(() => (exited = true));
+  let killed = false;
+  while (!exited && !killed) {
+    if (existsSync(packageParentDir) && readdirSync(packageParentDir).length > 0) {
+      proc.kill("SIGKILL");
+      killed = true;
+    } else {
+      await Bun.sleep(0);
+    }
+  }
+  const [stderr, exitCode] = await Promise.all([proc.stderr.text(), proc.exited]);
+  // Without a kill the install finished (or died) before anything showed up;
+  // a finished install is still a valid starting point, a failed one is not.
+  if (!killed) {
+    expect(stderr).toBe("");
+    expect(exitCode).toBe(0);
+  }
+}
+
+const packageDirs = {
+  hoisted: (root: string) => join(root, "node_modules", "many-files"),
+  isolated: (root: string) => join(root, "node_modules", ".bun", "many-files@1.0.0", "node_modules", "many-files"),
+};
+
+// Not concurrent: the kill has to land while the package is still being
+// linked, which a poll loop sharing the event loop with another test's
+// assertions cannot guarantee.
+for (const [linker, packageDir] of Object.entries(packageDirs)) {
+  test(`${linker} linker: a package whose install was interrupted is installed again`, async () => {
+    const tgz = await new Bun.Archive(archiveEntries, { compress: "gzip" }).bytes();
+    using registry = serveRegistry(tgz);
+    using dir = tempDir(`interrupted-install-${linker}`, {
+      "package.json": JSON.stringify({ name: "app", dependencies: { "many-files": "1.0.0" } }),
+      "bunfig.toml": ({ root }) =>
+        Bun.TOML.stringify({ install: { registry: registry.url.href, cache: join(root, ".bun-cache"), linker } }),
+    });
+    const root = String(dir);
+    const installed = packageDir(root);
+    const installedParent = join(installed, "..");
+
+    // Warm the cache and record what a finished install looks like.
+    const warm = await install(root);
+    expect(warm.stderr).not.toContain("error");
+    expect(warm.exitCode).toBe(0);
+    expect(compareWithExpectedTree(installed)).toEqual(completeTree);
+    const finishedParentListing = readdirSync(installedParent).sort();
+    rmSync(join(root, "node_modules"), { recursive: true });
+
+    await installAndKillWhileLinking(root, installedParent);
+    // Either the package is not at its final path yet, or all of it is.
+    if (existsSync(installed)) {
+      expect(compareWithExpectedTree(installed)).toEqual(completeTree);
+    }
+
+    const repaired = await install(root);
+    expect(repaired.stderr).not.toContain("error");
+    expect(repaired.exitCode).toBe(0);
+    expect(compareWithExpectedTree(installed)).toEqual(completeTree);
+    expect(readdirSync(installedParent).sort()).toEqual(finishedParentListing);
+  });
+}
+
+// A workspace that other packages depend on under a second name is linked into
+// node_modules under both names, and the hoisted linker walks the packages
+// nested inside it once per name. The second walk finds the first one's result
+// already sitting at the final path.
+const aliasLinkDirs = {
+  hoisted: "node_modules/inner-alias",
+  isolated: "packages/second/node_modules/inner-alias",
+};
+
+for (const [linker, aliasLinkDir] of Object.entries(aliasLinkDirs)) {
+  test(`${linker} linker: a package reached through two workspace aliases is installed under both`, async () => {
+    const depTarball = await new Bun.Archive(
+      {
+        "package/package.json": JSON.stringify({ name: "dep", version: "1.0.0" }),
+        "package/index.js": "module.exports = 1;\n",
+      },
+      { compress: "gzip" },
+    ).bytes();
+    using dir = tempDir(`staging-alias-${linker}`, {
+      // The root's own `dep` keeps inner's `dep` from being hoisted out of inner.
+      "package.json": JSON.stringify({
+        name: "app",
+        workspaces: ["packages/*"],
+        dependencies: { dep: "file:./dep-root" },
+      }),
+      "dep-root/package.json": JSON.stringify({ name: "dep", version: "2.0.0" }),
+      "dep-1.0.0.tgz": Buffer.from(depTarball),
+      "packages/inner/package.json": JSON.stringify({
+        name: "inner",
+        version: "1.0.0",
+        dependencies: { dep: "file:../../dep-1.0.0.tgz" },
+      }),
+      "packages/second/package.json": JSON.stringify({
+        name: "second",
+        version: "1.0.0",
+        dependencies: { "inner-alias": "workspace:inner@*" },
+      }),
+      "bunfig.toml": ({ root }) => Bun.TOML.stringify({ install: { cache: join(root, ".bun-cache"), linker } }),
+    });
+    const root = String(dir);
+
+    const { stderr, exitCode } = await install(root);
+    expect(stderr).not.toContain("error");
+    expect(exitCode).toBe(0);
+
+    const version = (packageDir: string) =>
+      JSON.parse(readFileSync(join(root, packageDir, "package.json"), "utf8")).version;
+    expect({
+      rootDep: version("node_modules/dep"),
+      innerDep: version("packages/inner/node_modules/dep"),
+      aliasedInnerDep: version(join(aliasLinkDir, "node_modules/dep")),
+      innerNodeModules: readdirSync(join(root, "packages/inner/node_modules")),
+    }).toEqual({ rootDep: "2.0.0", innerDep: "1.0.0", aliasedInnerDep: "1.0.0", innerNodeModules: ["dep"] });
+  });
+}
+
+// An alias may already be as long as a file name can be, so the staging
+// directory's name cannot be derived from it by adding to it.
+for (const linker of ["hoisted", "isolated"]) {
+  test(`${linker} linker: a package whose alias is 255 characters long is installed`, async () => {
+    const alias = Buffer.alloc(255, "a").toString();
+    using dir = tempDir(`staging-long-alias-${linker}`, {
+      "package.json": JSON.stringify({ name: "app", dependencies: { [alias]: "file:./a-package" } }),
+      "a-package/package.json": JSON.stringify({ name: "a-package", version: "1.0.0" }),
+      "bunfig.toml": ({ root }) => Bun.TOML.stringify({ install: { cache: join(root, ".bun-cache"), linker } }),
+    });
+    const root = String(dir);
+
+    const { stderr, exitCode } = await install(root);
+    expect(stderr).not.toContain("error");
+    expect(exitCode).toBe(0);
+    expect(JSON.parse(readFileSync(join(root, "node_modules", alias, "package.json"), "utf8")).name).toBe("a-package");
+    expect(readdirSync(join(root, "node_modules")).filter(name => name !== ".bun")).toEqual([alias]);
+  });
+}

From 0f8652c70748f49eaba0a1544a788749df0da7e6 Mon Sep 17 00:00:00 2001
From: robobun <117481402+robobun@users.noreply.github.com>
Date: Mon, 17 Aug 2026 01:08:19 +0000
Subject: [PATCH 065/258] bunx: resolve directories.bin relative to the package
 (#39096)

---
 src/install/bin.rs                            |  2 +-
 src/runtime/cli/bunx_command.rs               | 14 +++-
 test/cli/install/bunx-directories-bin.test.ts | 75 +++++++++++++++++++
 3 files changed, 88 insertions(+), 3 deletions(-)
 create mode 100644 test/cli/install/bunx-directories-bin.test.ts

diff --git a/src/install/bin.rs b/src/install/bin.rs
index 763755386e16..af9c831cba23 100644
--- a/src/install/bin.rs
+++ b/src/install/bin.rs
@@ -755,7 +755,7 @@ fn normalized_bin_name(name: &[u8]) -> &[u8] {
 /// verbatim from package.json, so without this check a malicious package could
 /// point a bin link at (and chmod) an arbitrary file on disk (the bug class
 /// npm fixed as CVE-2019-16775).
-pub(crate) fn bin_target_escapes_package_dir(target: &[u8]) -> bool {
+pub fn bin_target_escapes_package_dir(target: &[u8]) -> bool {
     if path::is_absolute(target) {
         return true;
     }
diff --git a/src/runtime/cli/bunx_command.rs b/src/runtime/cli/bunx_command.rs
index f978022d1736..67f117ca91d8 100644
--- a/src/runtime/cli/bunx_command.rs
+++ b/src/runtime/cli/bunx_command.rs
@@ -335,8 +335,18 @@ impl BunxCommand {
 
         if let Some(dirs) = expr.as_property(b"directories") {
             if let Some(bin_prop) = dirs.expr.as_property(b"bin") {
-                if let Some(dir_name) = bin_prop.expr.as_utf8_string_literal() {
-                    let bin_dir = bun_sys::openat_a(dir_fd, dir_name, O::RDONLY | O::DIRECTORY, 0)?;
+                // Same values the bin linker refuses to link from (`bin.rs`, `Tag::Dir`).
+                if let Some(dir_name) = bin_prop.expr.as_utf8_string_literal().filter(|dir| {
+                    !dir.is_empty() && !bun_install::bin::bin_target_escapes_package_dir(dir)
+                }) {
+                    // `directories.bin` is relative to the package, not to `dir_fd`.
+                    use bun_paths::platform::Auto;
+                    let package_dir =
+                        bun_paths::resolve_path::dirname::<Auto>(subpath_z.as_bytes());
+                    let bin_dir_path =
+                        bun_paths::resolve_path::join_z::<Auto>(&[package_dir, dir_name]);
+                    let bin_dir =
+                        bun_sys::openat(dir_fd, bin_dir_path, O::RDONLY | O::DIRECTORY, 0)?;
                     // Fd is non-owning Copy; guard it.
                     let _close_bin_dir = bun_sys::CloseOnDrop::new(bin_dir);
                     let mut iterator = bun_sys::dir_iterator::iterate(bin_dir);
diff --git a/test/cli/install/bunx-directories-bin.test.ts b/test/cli/install/bunx-directories-bin.test.ts
new file mode 100644
index 000000000000..fd2702b6d456
--- /dev/null
+++ b/test/cli/install/bunx-directories-bin.test.ts
@@ -0,0 +1,75 @@
+import { expect, test } from "bun:test";
+import { bunEnv, bunExe, isWindows, tempDir } from "harness";
+import { chmodSync, mkdirSync, writeFileSync } from "node:fs";
+import { join } from "node:path";
+
+async function run(cwd: string, args: string[], env: Record<string, string>) {
+  await using proc = Bun.spawn({
+    cmd: [bunExe(), ...args],
+    cwd,
+    env: { ...bunEnv, ...env },
+    stdin: "ignore",
+    stdout: "pipe",
+    stderr: "pipe",
+  });
+  const [stdout, stderr, exitCode] = await Promise.all([proc.stdout.text(), proc.stderr.text(), proc.exited]);
+  return { stdout, stderr, exitCode };
+}
+
+// The bins are shell scripts, which the bin links cannot run on Windows.
+test.concurrent.skipIf(isWindows)("bunx runs the bin of a directories.bin package", async () => {
+  using dir = tempDir("bunx-directories-bin", {
+    "package.json": JSON.stringify({ name: "app", dependencies: { tool: "file:./tool" } }),
+    "tool/package.json": JSON.stringify({ name: "tool", version: "1.0.0", directories: { bin: "bins" } }),
+    "tool/bins/tool-cli": "#!/bin/sh\necho tool-cli ran\n",
+    "tool/bins/nested/not-a-bin": "",
+  });
+  chmodSync(join(String(dir), "tool", "bins", "tool-cli"), 0o755);
+  const env = { BUN_INSTALL_CACHE_DIR: join(String(dir), ".cache") };
+  expect(await run(String(dir), ["install"], env)).toMatchObject({ exitCode: 0 });
+
+  // The bin is not named after the package, so bunx has to read the package's
+  // `directories.bin` (relative to the package, not to the project) to learn
+  // its name. --no-install: failing to do so must not fall through to
+  // installing the package from the registry.
+  expect(await run(String(dir), ["x", "--no-install", "tool"], env)).toEqual({
+    stdout: "tool-cli ran\n",
+    stderr: "",
+    exitCode: 0,
+  });
+});
+
+// `bun install` links nothing for these values; bunx must not take a bin name
+// from the directory they point at either. `picked` is the entry bunx would
+// find there (and then run from node_modules/.bin) if it did.
+const rejected: [label: string, value: (dir: string) => string, picked: string][] = [
+  ["a relative path that leaves the package", () => "../../outside", "planted"],
+  ["an absolute path", dir => join(dir, "outside"), "planted"],
+  ["an empty string (the package directory itself)", () => "", "package.json"],
+];
+
+for (const [label, value, picked] of rejected) {
+  test.concurrent.skipIf(isWindows)(`bunx ignores a directories.bin that is ${label}`, async () => {
+    using dir = tempDir("bunx-directories-bin-rejected", {
+      "package.json": JSON.stringify({ name: "app", dependencies: { tool: "file:./tool" } }),
+      "tool/package.json": "",
+      "outside/planted": "",
+    });
+    // Written afterwards because the value may depend on the directory's path.
+    writeFileSync(
+      join(String(dir), "tool", "package.json"),
+      JSON.stringify({ name: "tool", version: "1.0.0", directories: { bin: value(String(dir)) } }),
+    );
+    const env = { BUN_INSTALL_CACHE_DIR: join(String(dir), ".cache") };
+    expect(await run(String(dir), ["install"], env)).toMatchObject({ exitCode: 0 });
+    const binDir = join(String(dir), "node_modules", ".bin");
+    mkdirSync(binDir, { recursive: true });
+    writeFileSync(join(binDir, picked), "#!/bin/sh\necho planted ran\n", { mode: 0o755 });
+
+    const { stdout, stderr, exitCode } = await run(String(dir), ["x", "--no-install", "tool"], env);
+
+    expect(stdout).toBe("");
+    expect(stderr).toContain("could not determine executable to run for package tool");
+    expect(exitCode).toBe(1);
+  });
+}

From c208fe4f7575dfa9caa9980e2a41c01baaa1050a Mon Sep 17 00:00:00 2001
From: robobun <117481402+robobun@users.noreply.github.com>
Date: Mon, 17 Aug 2026 01:08:23 +0000
Subject: [PATCH 066/258] install: drop the duplicated warn: label from the
 verbose tarball retry notice (#38648)

---
 src/install/PackageManager/runTasks.rs     |  2 +-
 test/cli/install/bun-install-retry.test.ts | 42 ++++++++++++++++++++++
 2 files changed, 43 insertions(+), 1 deletion(-)

diff --git a/src/install/PackageManager/runTasks.rs b/src/install/PackageManager/runTasks.rs
index 106025bbfaa9..97b6d6b54215 100644
--- a/src/install/PackageManager/runTasks.rs
+++ b/src/install/PackageManager/runTasks.rs
@@ -678,7 +678,7 @@ pub fn run_tasks<C: RunTasksCallbacks>(
                                 manager.log_mut(),
                                 None,
                                 bun_ast::Loc::EMPTY,
-                                "<r><yellow>warn:<r> {} downloading tarball <b>{}@{}<r>. Retrying {}/{}...",
+                                "{} downloading tarball <b>{}@{}<r>. Retrying {}/{}...",
                                 bstr::BStr::new(err.name().as_bytes()),
                                 bstr::BStr::new(extract.name.slice()),
                                 extract
diff --git a/test/cli/install/bun-install-retry.test.ts b/test/cli/install/bun-install-retry.test.ts
index 9c34fa6d5c95..eb9c2ba73124 100644
--- a/test/cli/install/bun-install-retry.test.ts
+++ b/test/cli/install/bun-install-retry.test.ts
@@ -235,6 +235,48 @@ it("retries a tarball whose redirect target 500s once", async () => {
   });
 });
 
+// The retry notice is added to the log as a warning, and the log printer
+// prefixes it with `warn: ` when it prints it. The message itself used to carry
+// a second `warn: `, so every retry printed as `warn: warn: ...`.
+it("prints each verbose tarball retry as a single warn: line", async () => {
+  setHandler(async request => {
+    const { pathname } = new URL(request.url);
+    if (pathname === "/BaR") {
+      return Response.json({
+        name: "BaR",
+        "dist-tags": { latest: "0.0.2" },
+        versions: {
+          "0.0.2": { name: "BaR", version: "0.0.2", dist: { tarball: `${root_url}/BaR-0.0.2.tgz` } },
+        },
+      });
+    }
+    if (pathname === "/BaR-0.0.2.tgz") {
+      return new Response("no", { status: 500 });
+    }
+    return new Response("unexpected", { status: 404 });
+  });
+  await writeFile(
+    join(package_dir, "package.json"),
+    JSON.stringify({ name: "foo", version: "0.0.1", dependencies: { BaR: "0.0.2" } }),
+  );
+  const { stdout, stderr, exited } = spawn({
+    cmd: [bunExe(), "install", "--verbose", "--no-progress", "--ignore-scripts"],
+    cwd: package_dir,
+    stdout: "pipe",
+    stdin: "pipe",
+    stderr: "pipe",
+    env: { ...env, BUN_CONFIG_HTTP_RETRY_COUNT: "2" },
+  });
+  const [err, out, exitCode] = await Promise.all([stderr.text(), stdout.text(), exited]);
+  expect(err.split(/\r?\n/).filter(line => line.includes("downloading tarball"))).toEqual([
+    "warn: TarballFailedToDownload downloading tarball BaR@0.0.2. Retrying 1/2...",
+    "warn: TarballFailedToDownload downloading tarball BaR@0.0.2. Retrying 2/2...",
+  ]);
+  expect(err).toContain(`error: GET ${root_url}/BaR-0.0.2.tgz - 500`);
+  expect(out).not.toContain("installed");
+  expect(exitCode).toBe(1);
+});
+
 it("retries on 500", async () => {
   const urls: string[] = [];
   setHandler(dummyRegistry(urls, undefined, 4));

From 888eb0ddb140287b0ee6a8bbc2188d34c77ab597 Mon Sep 17 00:00:00 2001
From: "autofix-ci[bot]" <114827586+autofix-ci[bot]@users.noreply.github.com>
Date: Mon, 17 Aug 2026 01:08:27 +0000
Subject: [PATCH 067/258] install: fix node-gyp shim PATH entry after tempdir
 falls back to cache/.tmp (#38098)

---
 .../PackageManagerDirectories.rs              | 17 ++++-
 .../bun-install-lifecycle-scripts.test.ts     | 66 +++++++++++++++++++
 2 files changed, 82 insertions(+), 1 deletion(-)

diff --git a/src/install/PackageManager/PackageManagerDirectories.rs b/src/install/PackageManager/PackageManagerDirectories.rs
index 96f5a5eb4a57..358435735306 100644
--- a/src/install/PackageManager/PackageManagerDirectories.rs
+++ b/src/install/PackageManager/PackageManagerDirectories.rs
@@ -306,9 +306,24 @@ fn get_temporary_directory_run(manager: &mut PackageManager) -> TemporaryDirecto
         }
     };
 
+    // After any fallback, `tempdir` points at `<cache>/.tmp`, not
+    // `$TMPDIR`. `name` must describe the directory `handle` actually points
+    // at: the node-gyp shim is written through `handle` but advertised on
+    // `PATH` via `name`, and a mismatch makes lifecycle scripts fail to find
+    // `node-gyp` (exit 127).
+    let name: &'static [u8] = if tried_dot_tmp {
+        let joined = path::resolve_path::join::<path::platform::Auto>(&[
+            manager.cache_directory_path.as_bytes(),
+            b".tmp",
+        ]);
+        bun_core::handle_oom(FileSystem::instance().dirname_store().append(joined))
+    } else {
+        temp_dir_name
+    };
+
     TemporaryDirectory {
         handle: tempdir,
-        name: temp_dir_name,
+        name,
         #[cfg(windows)]
         path: ZBox::from_bytes(temp_dir_path.as_bytes()),
     }
diff --git a/test/cli/install/bun-install-lifecycle-scripts.test.ts b/test/cli/install/bun-install-lifecycle-scripts.test.ts
index 45ceb6e999b4..e7cb63cac8d6 100644
--- a/test/cli/install/bun-install-lifecycle-scripts.test.ts
+++ b/test/cli/install/bun-install-lifecycle-scripts.test.ts
@@ -1,5 +1,6 @@
 import { file, spawn, write } from "bun";
 import { afterAll, beforeAll, describe, expect, setDefaultTimeout, test } from "bun:test";
+import { chmodSync, mkdtempSync, rmSync, statSync } from "fs";
 import { exists, mkdir, rm, writeFile } from "fs/promises";
 import {
   VerdaccioRegistry,
@@ -11,6 +12,7 @@ import {
   readdirSorted,
   runBunInstall,
 } from "harness";
+import { tmpdir } from "os";
 import { join, sep } from "path";
 
 var verdaccio = new VerdaccioRegistry();
@@ -498,6 +500,70 @@ test.concurrent("node-gyp shim directory added to lifecycle script PATH gets a r
   expect(distance > 21_600_000_000_000n).toBe(true);
 });
 
+// Reproducing issue #38079 needs $TMPDIR and the install cache on different
+// filesystems so that renameat() fails with EXDEV. /dev/shm is a separate
+// tmpfs mount on Linux; skip when it is unavailable or on the same device.
+const canForceExdevTmpdir =
+  isLinux &&
+  (() => {
+    try {
+      return statSync("/dev/shm").dev !== statSync(tmpdir()).dev;
+    } catch {
+      return false;
+    }
+  })();
+
+test.concurrent.skipIf(!canForceExdevTmpdir)(
+  "node-gyp shim is reachable when the tempdir falls back to cache/.tmp",
+  async () => {
+    using ctx = await setupTest();
+    const { packageDir, packageJson, env } = ctx;
+
+    const fakeNodeGyp = join(packageDir, "fake-node-gyp.sh");
+    await Promise.all([
+      write(
+        packageJson,
+        JSON.stringify({
+          name: "exdev-node-gyp",
+          version: "1.0.0",
+          scripts: {
+            preinstall: "node-gyp --version",
+          },
+        }),
+      ),
+      write(fakeNodeGyp, "#!/bin/sh\necho fake-node-gyp-ok\n"),
+    ]);
+    chmodSync(fakeNodeGyp, 0o755);
+
+    const shmTmp = mkdtempSync("/dev/shm/bun-exdev-");
+    try {
+      await using proc = Bun.spawn({
+        cmd: [bunExe(), "install"],
+        cwd: packageDir,
+        env: {
+          ...env,
+          TMPDIR: shmTmp,
+          BUN_TMPDIR: shmTmp,
+          TEMP: shmTmp,
+          // keep `node-gyp` resolvable only via the shim dir bun appends to
+          // PATH; the shim execs $npm_config_node_gyp so the test stays offline
+          PATH: "/usr/bin:/bin",
+          npm_config_node_gyp: fakeNodeGyp,
+        },
+        stdout: "pipe",
+        stderr: "pipe",
+      });
+
+      const [out, err, exitCode] = await Promise.all([proc.stdout.text(), proc.stderr.text(), proc.exited]);
+      expect(err).not.toContain("command not found");
+      expect(out).toContain("fake-node-gyp-ok");
+      expect(exitCode).toBe(0);
+    } finally {
+      rmSync(shmTmp, { recursive: true, force: true });
+    }
+  },
+);
+
 test.concurrent("default trusted dependencies require the canonical registry tarball URL", async () => {
   using ctx = await setupTest();
   const { packageDir, packageJson, env } = ctx;

From 1182bbf4a03492b42790be1f46e5b109c5dce70b Mon Sep 17 00:00:00 2001
From: robobun <117481402+robobun@users.noreply.github.com>
Date: Mon, 17 Aug 2026 01:08:31 +0000
Subject: [PATCH 068/258] install: set npm_config_local_prefix and
 npm_package_config_* for lifecycle scripts (#38110)

---
 .../PackageManager/PackageManagerLifecycle.rs | 40 +++++++++
 src/install/lib.rs                            | 10 ++-
 .../bun-install-lifecycle-scripts.test.ts     | 90 +++++++++++++++++++
 3 files changed, 137 insertions(+), 3 deletions(-)

diff --git a/src/install/PackageManager/PackageManagerLifecycle.rs b/src/install/PackageManager/PackageManagerLifecycle.rs
index ede34ff115b8..c110a6b423b5 100644
--- a/src/install/PackageManager/PackageManagerLifecycle.rs
+++ b/src/install/PackageManager/PackageManagerLifecycle.rs
@@ -14,6 +14,8 @@ use bun_semver::string::Builder as SemverStringBuilder;
 use bun_sys as Syscall;
 
 use crate::bun_fs::FileSystem;
+use crate::bun_json;
+use crate::initialize_store;
 
 use super::directories;
 use crate::lifecycle_script_runner::{
@@ -391,6 +393,8 @@ impl PackageManager {
         path.append(original_path.as_slice())?;
         script_env.put(b"PATH", path.slice())?;
 
+        put_npm_package_config_env(&mut script_env, cwd)?;
+
         // Ownership transfers to `LifecycleScriptSubprocess`, which
         // re-uses it across every `spawn_next_script` in the chain. Move the
         // owning `NullDelimitedEnvMap` by value so its `K=V\0` buffers outlive
@@ -467,6 +471,42 @@ impl PackageManager {
     }
 }
 
+/// The package's own `config` strings as `npm_package_config_<key>`, the subset `bun run` exports.
+fn put_npm_package_config_env(
+    script_env: &mut bun_dotenv::Map,
+    package_dir: &[u8],
+) -> Result<(), crate::Error> {
+    let package_json_path = join_abs_string_z::<platform::Auto>(package_dir, &[b"package.json"]);
+    let Ok(json_buf) = Syscall::File::read_from(Syscall::Fd::cwd(), package_json_path.as_bytes())
+    else {
+        return Ok(());
+    };
+    let json_src =
+        bun_ast::Source::init_path_string(package_json_path.as_bytes(), json_buf.as_slice());
+    let mut log = bun_ast::Log::init();
+
+    initialize_store();
+
+    let Ok(parsed) = bun_json::ParsedJson::parse_package_json(&json_src, &mut log) else {
+        return Ok(());
+    };
+    let Some(config) = parsed.root.get(b"config") else {
+        return Ok(());
+    };
+
+    config.try_for_each_property(|key, _key_loc, value| {
+        let Some(value) = value.as_utf8_string_literal() else {
+            return Ok(());
+        };
+        if key.is_empty() || value.is_empty() {
+            return Ok(());
+        }
+        script_env.put(&strings::concat(&[b"npm_package_config_", key]), value)
+    })?;
+
+    Ok(())
+}
+
 fn add_package_to_set(
     set: &mut ArrayHashMap<PackageID, ()>,
     lockfile: &Lockfile,
diff --git a/src/install/lib.rs b/src/install/lib.rs
index aaa1d4ba102f..5561917e4411 100644
--- a/src/install/lib.rs
+++ b/src/install/lib.rs
@@ -857,9 +857,13 @@ impl RunCommand {
             }
         }
 
-        // DirInfo walk / npm_package_* seeding is performed by the T6 impl
-        // (`bun_runtime::cli::RunCommand::configure_env_for_run`); install
-        // callers discard the return value.
+        // Overwrite like npm: an outer `bun run` in another project may have left a stale value.
+        env_loader.map.put(
+            b"npm_config_local_prefix",
+            bun_fs::FileSystem::instance().top_level_dir(),
+        )?;
+
+        // `npm_package_*` is per package; see `spawn_package_lifecycle_scripts`.
         Ok(core::ptr::null_mut())
     }
 }
diff --git a/test/cli/install/bun-install-lifecycle-scripts.test.ts b/test/cli/install/bun-install-lifecycle-scripts.test.ts
index e7cb63cac8d6..7fd85efac5c5 100644
--- a/test/cli/install/bun-install-lifecycle-scripts.test.ts
+++ b/test/cli/install/bun-install-lifecycle-scripts.test.ts
@@ -1871,6 +1871,96 @@ for (const forceWaiterThread of isLinux ? [false, true] : [false]) {
       assertManifestsPopulated(join(packageDir, ".bun-cache"), verdaccio.registryUrl());
     });
 
+    test("npm_config_local_prefix and npm_package_config_* are set for root and dependency scripts", async () => {
+      using ctx = await setupTest();
+      const { packageDir, packageJson, env } = ctx;
+      const testEnv = forceWaiterThread ? { ...env, BUN_FEATURE_FLAG_FORCE_WAITER_THREAD: "1" } : env;
+
+      // Each script dumps the variables under test into env.json in its own cwd.
+      const captureEnv = `
+      require("fs").writeFileSync(
+        "env.json",
+        JSON.stringify({
+          localPrefix: process.env.npm_config_local_prefix,
+          config: Object.fromEntries(
+            Object.entries(process.env).filter(([name]) => name.startsWith("npm_package_config_")),
+          ),
+        }),
+      );
+      `;
+
+      await mkdir(join(packageDir, "dep"));
+      await Promise.all([
+        writeFile(
+          packageJson,
+          JSON.stringify({
+            name: "root-project",
+            version: "1.0.0",
+            config: {
+              port: "8080",
+              shared: "from-root",
+              // Like `bun run`, only non-empty top-level string values are exported.
+              retries: 3,
+              nested: { key: "value" },
+              blank: "",
+            },
+            scripts: { postinstall: `${bunExe()} capture-env.js` },
+            dependencies: { "my-dep": "file:./dep" },
+            trustedDependencies: ["my-dep"],
+          }),
+        ),
+        writeFile(join(packageDir, "capture-env.js"), captureEnv),
+        writeFile(
+          join(packageDir, "dep", "package.json"),
+          JSON.stringify({
+            name: "my-dep",
+            version: "2.0.0",
+            config: { depkey: "dep-value", shared: "from-dep" },
+            scripts: { postinstall: `${bunExe()} capture-env.js` },
+          }),
+        ),
+        writeFile(join(packageDir, "dep", "capture-env.js"), captureEnv),
+      ]);
+
+      // `bun run`/`npm run` leave their own values in the environment of the commands they
+      // run (including this test under `bun run`); the install must replace them with its own.
+      const installEnv: Record<string, string> = Object.fromEntries(
+        Object.entries(testEnv).filter(([name]) => !name.startsWith("npm_package_config_")),
+      );
+      installEnv.npm_config_local_prefix = "/some/other/project";
+
+      const { stdout, stderr, exited } = spawn({
+        cmd: [bunExe(), "install"],
+        cwd: packageDir,
+        stdout: "pipe",
+        stdin: "ignore",
+        stderr: "pipe",
+        env: installEnv,
+      });
+
+      const [out, err, exitCode] = await Promise.all([stdout.text(), stderr.text(), exited]);
+      expect(err).not.toContain("error:");
+      expect(out).toContain("+ my-dep@dep");
+      expect(exitCode).toBe(0);
+
+      expect(await file(join(packageDir, "env.json")).json()).toEqual({
+        localPrefix: packageDir,
+        config: {
+          npm_package_config_port: "8080",
+          npm_package_config_shared: "from-root",
+        },
+      });
+
+      // A dependency sees its own `config`, not the root's.
+      expect(await file(join(packageDir, "node_modules", "my-dep", "env.json")).json()).toEqual({
+        localPrefix: packageDir,
+        config: {
+          npm_package_config_depkey: "dep-value",
+          npm_package_config_shared: "from-dep",
+        },
+      });
+    });
+
     test("INIT_CWD is set to the correct directory", async () => {
       using ctx = await setupTest();
       const { packageDir, packageJson, env } = ctx;

From 3bd93d00a8f07d98945fc3554004cd599e33003f Mon Sep 17 00:00:00 2001
From: robobun <117481402+robobun@users.noreply.github.com>
Date: Mon, 17 Aug 2026 01:08:36 +0000
Subject: [PATCH 069/258] install: install a git dependency's devDependencies
 before running its prepare scripts (#38810)

---
 docs/pm/cli/add.mdx                           |   2 +
 docs/pm/lifecycle.mdx                         |  17 +
 .../PackageManager/PackageManagerLifecycle.rs |  33 ++
 src/install/lifecycle_script_runner.rs        | 324 +++++++++++++---
 src/install/lockfile/Package/Scripts.rs       |  18 +
 .../bun-install-lifecycle-scripts.test.ts     | 351 ++++++++++++++++++
 6 files changed, 689 insertions(+), 56 deletions(-)

diff --git a/docs/pm/cli/add.mdx b/docs/pm/cli/add.mdx
index 15b4b286eb8e..57b35501f44e 100644
--- a/docs/pm/cli/add.mdx
+++ b/docs/pm/cli/add.mdx
@@ -213,6 +213,8 @@ Bun supports a variety of protocols, including [`github`](https://docs.npmjs.com
 }
 ```
 
+Bun installs the repository's files as they are. If the package builds its entry point in a `prepare` script, add it to `trustedDependencies`. Bun then installs the package's `devDependencies` and runs the script. See [`prepare` scripts of git dependencies](/pm/lifecycle#prepare-scripts-of-git-dependencies).
+
 ## Tarball dependencies
 
 A package name can correspond to a publicly hosted `.tgz` file. Bun downloads and installs the package from that tarball URL rather than from the package registry.
diff --git a/docs/pm/lifecycle.mdx b/docs/pm/lifecycle.mdx
index 5c35c3224bd4..5da49a68dfd2 100644
--- a/docs/pm/lifecycle.mdx
+++ b/docs/pm/lifecycle.mdx
@@ -67,6 +67,23 @@ Set `trustedDependencies: []` when you want to opt out of the default allow list
 
 ---
 
+## `prepare` scripts of git dependencies
+
+A package installed from a git repository (a `git:`, `git+https:`, or `github:` dependency) has no published build output. Many of these packages build their entry point in a `prepare` script, using build tools from their `devDependencies`.
+
+Bun does not run that script until you add the package to `trustedDependencies`. Until then, `bun install` reports the blocked script and the package has no build output. `bun pm untrusted` lists the script.
+
+For a trusted git dependency with a `preprepare`, `prepare`, or `postprepare` script, Bun:
+
+1. Moves a `node_modules` folder that the package already has out of the way.
+2. Runs `bun install --ignore-scripts --no-save` inside the package. This installs the package's `dependencies` and `devDependencies` into a new `node_modules` folder there, using your project's registry and cache directory. The package's `package.json` and a lockfile committed to the repository stay unchanged.
+3. Runs the package's `preprepare`, `prepare`, and `postprepare` scripts.
+4. Removes the `node_modules` folder from step 2 and moves the one from step 1 back. At runtime, the package uses the dependencies your project installed.
+
+Because of `--ignore-scripts` in step 2, the lifecycle scripts of the package's own dependencies do not run.
+
+---
+
 ## `--ignore-scripts`
 
 To disable lifecycle scripts for all packages, use the `--ignore-scripts` flag.
diff --git a/src/install/PackageManager/PackageManagerLifecycle.rs b/src/install/PackageManager/PackageManagerLifecycle.rs
index c110a6b423b5..aa52d8f33ce2 100644
--- a/src/install/PackageManager/PackageManagerLifecycle.rs
+++ b/src/install/PackageManager/PackageManagerLifecycle.rs
@@ -401,6 +401,13 @@ impl PackageManager {
         // this stack frame (freed by the subprocess's `Drop`).
         let envp = script_env.create_null_delimited_env_map()?;
 
+        let install_envp = if list.install_dependencies_for_prepare {
+            self.put_install_config_for_prepare(&mut script_env)?;
+            Some(script_env.create_null_delimited_env_map()?)
+        } else {
+            None
+        };
+
         let shell_bin: Option<&ZStr> = 'shell_bin: {
             #[cfg(windows)]
             {
@@ -429,6 +436,7 @@ impl PackageManager {
             self,
             list,
             envp,
+            install_envp,
             shell_bin,
             optional,
             log_level,
@@ -438,6 +446,31 @@ impl PackageManager {
         Ok(())
     }
 
+    /// The nested install's project directory is the checkout, so this project's
+    /// `bunfig.toml`/`.npmrc` settings have to reach it through the environment.
+    fn put_install_config_for_prepare(
+        &mut self,
+        script_env: &mut bun_dotenv::Map,
+    ) -> Result<(), crate::Error> {
+        let scope = &self.options.scope;
+        // The token only travels together with its registry.
+        if self.options.did_override_default_scope || !scope.token.is_empty() {
+            script_env.put(b"BUN_CONFIG_REGISTRY", scope.url.href())?;
+            if !scope.token.is_empty() {
+                script_env.put(b"BUN_CONFIG_TOKEN", &scope.token)?;
+            }
+        }
+
+        // Opening the cache directory is what fills in its path.
+        let _ = self.get_cache_directory();
+        let cache_directory_path = self.cache_directory_path.as_bytes();
+        if !cache_directory_path.is_empty() {
+            script_env.put(b"BUN_INSTALL_CACHE_DIR", cache_directory_path)?;
+        }
+
+        Ok(())
+    }
+
     pub(crate) fn find_trusted_dependencies_from_update_requests(
         &mut self,
     ) -> ArrayHashMap<PackageID, ()> {
diff --git a/src/install/lifecycle_script_runner.rs b/src/install/lifecycle_script_runner.rs
index 56df90beb3ea..430648e9aef1 100644
--- a/src/install/lifecycle_script_runner.rs
+++ b/src/install/lifecycle_script_runner.rs
@@ -14,11 +14,11 @@ use bun_io::heap as io_heap;
 use bun_io::{FilePollFlag, PosixFlags};
 
 use bun_core::ZStr;
+use bun_paths::AutoAbsPathChecked;
 #[cfg(unix)]
 use bun_spawn::SpawnResultExt as _;
 use bun_spawn::{Process, ProcessExit, ProcessExitKind, Rusage, SpawnOptions, Status};
-#[cfg(unix)]
-use bun_sys::Fd;
+use bun_sys::{Fd, FdExt as _};
 // `BufferedReaderParent::loop_` is typed `*mut bun_uws::Loop` (the
 // `bun_io::Loop` is the trait's nominal: `us_loop_t` on POSIX, `uv_loop_t`
 // on Windows. `AnyEventLoop::native_loop()` projects through the uws wrapper
@@ -270,6 +270,9 @@ pub struct LifecycleScriptSubprocess<'a> {
     /// struct so the `K=V\0` buffers stay alive across every async
     /// `spawn_next_script` for the script chain; freed by `Drop`/`destroy`.
     pub(crate) envp: bun_dotenv::NullDelimitedEnvMap,
+    /// `Some` iff `scripts.install_dependencies_for_prepare`.
+    pub(crate) install_envp: Option<bun_dotenv::NullDelimitedEnvMap>,
+    pub(crate) prepare_dependencies: PrepareDependencies,
     pub(crate) shell_bin: Option<&'a ZStr>,
 
     pub(crate) has_incremented_alive_count: bool,
@@ -307,6 +310,137 @@ impl<'a> InstallCtx<'a> {
     }
 }
 
+/// See `List::install_dependencies_for_prepare`.
+#[derive(Clone, Copy, PartialEq, Eq)]
+pub(crate) enum PrepareDependencies {
+    NotNeeded,
+    Pending,
+    /// `bun install` is running; `current_script_index` is the script that follows it.
+    Installing(NestedInstallCleanup),
+    /// Cleaned up once the scripts are done or one of them failed.
+    Installed(NestedInstallCleanup),
+}
+
+/// Holds the package's own `node_modules` (or is empty) while the nested install
+/// and the prepare scripts run. Already existing at the start means an earlier
+/// run was interrupted: it has the original and `node_modules` is that run's leftovers.
+const PREVIOUS_NODE_MODULES_NAME: &[u8] = b".bun-prepare-node_modules";
+
+/// `--ignore-scripts`: this runner is already running the package's scripts.
+/// `--no-save`: leave the package.json and a committed lockfile alone.
+const INSTALL_DEPENDENCIES_ARGS: [&core::ffi::CStr; 3] =
+    [c"install", c"--ignore-scripts", c"--no-save"];
+const INSTALL_DEPENDENCIES_COMMAND_LINE: &[u8] = b"bun install --ignore-scripts --no-save";
+
+/// What to undo in the package directory after the nested install. Its runtime
+/// dependencies are installed outside the package, so everything left inside would
+/// only shadow them.
+#[derive(Clone, Copy, PartialEq, Eq)]
+pub(crate) struct NestedInstallCleanup {
+    /// False when the previous `node_modules` could not be moved out of the way.
+    restore_node_modules: bool,
+    /// `--no-save` still writes `bun.lock` when it migrates a `package-lock.json`
+    /// (`saves_migrated_lockfile`).
+    remove_lockfile: bool,
+}
+
+fn path_in_package(cwd: &[u8], name: &[u8]) -> bun_sys::Result<AutoAbsPathChecked> {
+    let mut path = AutoAbsPathChecked::init();
+    if path.append(cwd).is_err() || path.append(name).is_err() {
+        return Err(
+            bun_sys::Error::from_code(bun_sys::E::ENAMETOOLONG, bun_sys::Tag::rename)
+                .with_path(name),
+        );
+    }
+    Ok(path)
+}
+
+fn set_aside_node_modules(cwd: &[u8]) -> bun_sys::Result<()> {
+    let mut node_modules = path_in_package(cwd, b"node_modules")?;
+    let mut previous = path_in_package(cwd, PREVIOUS_NODE_MODULES_NAME)?;
+    if bun_sys::exists(previous.slice()) {
+        return Fd::cwd().delete_tree(node_modules.slice());
+    }
+    match bun_sys::renameat(
+        Fd::cwd(),
+        node_modules.slice_z(),
+        Fd::cwd(),
+        previous.slice_z(),
+    ) {
+        Err(err) if err.get_errno() == bun_sys::E::ENOENT => {
+            bun_sys::mkdir(previous.slice_z(), 0o755)
+        }
+        result => result,
+    }
+}
+
+impl NestedInstallCleanup {
+    fn begin(cwd: &[u8], package_name: &[u8]) -> Self {
+        let remove_lockfile = path_in_package(cwd, b"bun.lock")
+            .is_ok_and(|lockfile| !bun_sys::exists(lockfile.slice()));
+
+        let restore_node_modules = match set_aside_node_modules(cwd) {
+            Ok(()) => true,
+            Err(err) => {
+                bun_core::warn!(
+                    "failed to set aside the node_modules of \"{}\" ({}); the dependencies installed for its prepare scripts will be left in it",
+                    bstr::BStr::new(package_name),
+                    err,
+                );
+                false
+            }
+        };
+
+        Self {
+            restore_node_modules,
+            remove_lockfile,
+        }
+    }
+
+    fn finish(self, cwd: &[u8], package_name: &[u8]) {
+        if self.remove_lockfile
+            && let Ok(lockfile) = path_in_package(cwd, b"bun.lock")
+        {
+            let _ = Fd::cwd().delete_tree(lockfile.slice());
+        }
+
+        if !self.restore_node_modules {
+            return;
+        }
+        // Both paths were built by `set_aside_node_modules` already.
+        let (Ok(mut node_modules), Ok(mut previous)) = (
+            path_in_package(cwd, b"node_modules"),
+            path_in_package(cwd, PREVIOUS_NODE_MODULES_NAME),
+        ) else {
+            return;
+        };
+
+        if let Err(err) = Fd::cwd().delete_tree(node_modules.slice()) {
+            bun_core::warn!(
+                "failed to remove the dependencies installed for the prepare scripts of \"{}\": {}",
+                bstr::BStr::new(package_name),
+                err,
+            );
+        }
+
+        if let Err(err) = bun_sys::renameat(
+            Fd::cwd(),
+            previous.slice_z(),
+            Fd::cwd(),
+            node_modules.slice_z(),
+        ) {
+            bun_core::warn!(
+                "failed to restore the node_modules of \"{}\" after running its prepare scripts: {}",
+                bstr::BStr::new(package_name),
+                err,
+            );
+            return;
+        }
+        // Removes the empty placeholder from `set_aside_node_modules`; fails on a real one.
+        let _ = bun_sys::rmdir(node_modules.slice_z());
+    }
+}
+
 // `io_heap::Intrusive` takes the comparator via `HeapContext::less` on the
 // `Context` type, so `sort_by_started_at` is provided via a trait impl on a
 // ZST `StartedAtCtx`.
@@ -532,16 +666,53 @@ impl<'a> LifecycleScriptSubprocess<'a> {
             (*this).current_script_index = next_script_index;
             (*this).has_called_process_exit = false;
 
-            let mut copy_script: Vec<u8> = Vec::with_capacity(original_script.len() + 1);
-            replace_package_manager_run(&mut copy_script, original_script)?;
-            copy_script.push(0);
+            let installing_dependencies = (*this).prepare_dependencies
+                == PrepareDependencies::Pending
+                && next_script_index as usize >= ScriptsList::FIRST_PREPARE_INDEX;
+
+            // `[_]?[*:0]const u8` argv array with trailing null. Element type MUST be
+            // bare `*const c_char` (null sentinel), never `Option<*const c_char>` —
+            // raw pointers are already nullable, and `Option<*const T>` is a 2-word
+            // (tag, ptr) pair, not niche-optimized. Casting a `[Option<*const c_char>; N]`
+            // to `Argv` would interleave discriminant words and EFAULT in the kernel.
+            // Sized for the longer of the two argvs built below.
+            const ARGV_LEN: usize = INSTALL_DEPENDENCIES_ARGS.len() + 2;
+            let mut argv: [*const c_char; ARGV_LEN] = [core::ptr::null(); ARGV_LEN];
+            const _: () = assert!(
+                core::mem::size_of::<[*const c_char; ARGV_LEN]>()
+                    == ARGV_LEN * core::mem::size_of::<usize>()
+            );
 
-            // SAFETY: we just pushed a NUL byte at copy_script[len-1]; slice [..len-1] is the body.
-            let combined_script: &mut ZStr =
-                ZStr::from_raw_mut(copy_script.as_mut_ptr(), copy_script.len() - 1);
+            // Owns the script bytes `argv` points into until the spawn below.
+            let mut copy_script: Vec<u8> = Vec::new();
+            let command_line: &[u8] = if installing_dependencies {
+                (*this).prepare_dependencies = PrepareDependencies::Installing(
+                    NestedInstallCleanup::begin(cwd, &(*this).package_name),
+                );
+                argv[0] = bun_core::self_exe_path()?.as_ptr();
+                for (slot, arg) in argv[1..].iter_mut().zip(INSTALL_DEPENDENCIES_ARGS) {
+                    *slot = arg.as_ptr();
+                }
+                INSTALL_DEPENDENCIES_COMMAND_LINE
+            } else {
+                copy_script.reserve_exact(original_script.len() + 1);
+                replace_package_manager_run(&mut copy_script, original_script)?;
+                copy_script.push(0);
+                let combined_script: &ZStr = ZStr::from_slice_with_nul(&copy_script);
+
+                if (*this).shell_bin.is_some() && !cfg!(windows) {
+                    argv[0] = (*this).shell_bin.unwrap().as_ptr();
+                    argv[1] = c"-c".as_ptr();
+                } else {
+                    argv[0] = bun_core::self_exe_path()?.as_ptr();
+                    argv[1] = c"exec".as_ptr();
+                }
+                argv[2] = combined_script.as_ptr();
+                combined_script.as_bytes()
+            };
 
             if (*this).foreground && (*manager).options.log_level != crate::LogLevel::Silent {
-                Output::command(Output::CommandArgv::Single(combined_script.as_bytes()));
+                Output::command(Output::CommandArgv::Single(command_line));
             } else if let Some(scripts_node) = (*manager).scripts_node_mut() {
                 (*manager).set_node_name::<true>(
                     scripts_node,
@@ -561,32 +732,13 @@ impl<'a> LifecycleScriptSubprocess<'a> {
                 "{} - {} $ {}",
                 bstr::BStr::new(&(*this).package_name),
                 bstr::BStr::new((*this).script_name()),
-                bstr::BStr::new(combined_script.as_bytes())
+                bstr::BStr::new(command_line)
             );
 
-            // `[_]?[*:0]const u8` argv array with trailing null. Element type MUST be
-            // bare `*const c_char` (null sentinel), never `Option<*const c_char>` —
-            // raw pointers are already nullable, and `Option<*const T>` is a 2-word
-            // (tag, ptr) pair, not niche-optimized. Casting a `[Option<*const c_char>; N]`
-            // to `Argv` would interleave discriminant words and EFAULT in the kernel.
-            let mut argv: [*const c_char; 4] = if (*this).shell_bin.is_some() && !cfg!(windows) {
-                [
-                    (*this).shell_bin.unwrap().as_ptr().cast::<c_char>(),
-                    c"-c".as_ptr(),
-                    combined_script.as_ptr().cast::<c_char>(),
-                    core::ptr::null(),
-                ]
-            } else {
-                [
-                    bun_core::self_exe_path()?.as_ptr().cast::<c_char>(),
-                    c"exec".as_ptr(),
-                    combined_script.as_ptr().cast::<c_char>(),
-                    core::ptr::null(),
-                ]
+            let envp: *const *const c_char = match &(*this).install_envp {
+                Some(install_envp) if installing_dependencies => install_envp.as_ptr(),
+                _ => (*this).envp.as_ptr(),
             };
-            const _: () = assert!(
-                core::mem::size_of::<[*const c_char; 4]>() == 4 * core::mem::size_of::<usize>()
-            );
 
             // OWNERSHIP:
             // `bun_io::Source::Pipe` owns a `Box<uv::Pipe>` AND
@@ -666,10 +818,10 @@ impl<'a> LifecycleScriptSubprocess<'a> {
                 .insert(this.cast::<LifecycleScriptSubprocess<'static>>());
             let spawned = match bun_spawn::spawn_process(
                 &spawn_options,
-                // argv is `[*const c_char; 4]` with trailing null — exactly the
+                // argv is a `[*const c_char; N]` with trailing null — exactly the
                 // `[*:null]?[*:0]const u8` layout `spawn_process` expects (1 word/elt).
                 argv.as_mut_ptr().cast(),
-                (*this).envp.as_ptr().cast::<*const c_char>(),
+                envp,
             ) {
                 Ok(Ok(s)) => s,
                 res => {
@@ -855,18 +1007,30 @@ impl<'a> LifecycleScriptSubprocess<'a> {
                         return;
                     }
                     self.print_output();
-                    bun_core::pretty_errorln!(
-                        "<r><red>error<r><d>:<r> <b>{}<r> script from \"<b>{}<r>\" exited with {}<r>",
-                        bstr::BStr::new(self.script_name()),
-                        bstr::BStr::new(&self.package_name),
-                        exit.code,
-                    );
+                    self.print_failure_subject();
+                    bun_core::pretty_errorln!(" exited with {}<r>", exit.code);
+                    self.remove_prepare_dependencies();
                     // SAFETY: `self` was created by `Self::new` (heap::alloc); uniquely owned here.
                     unsafe { Self::destroy(std::ptr::from_mut::<Self>(self)) };
                     Output::flush();
                     Global::exit(exit.code as u32);
                 }
 
+                if let PrepareDependencies::Installing(cleanup) = self.prepare_dependencies {
+                    self.prepare_dependencies = PrepareDependencies::Installed(cleanup);
+                    let script_index = self.current_script_index;
+                    self.reset_polls();
+                    // SAFETY: `self` was created by `Self::new` (heap::alloc) and is
+                    // uniquely owned here; it is not touched again on the success
+                    // path before `return` (same contract as the loop below).
+                    if let Err(err) = unsafe {
+                        Self::spawn_next_script(std::ptr::from_mut::<Self>(self), script_index)
+                    } {
+                        self.exit_after_spawn_failure(script_index, &err);
+                    }
+                    return;
+                }
+
                 if !self.foreground
                     && let Some(scripts_node) = self.manager().scripts_node_mut()
                 {
@@ -917,19 +1081,17 @@ impl<'a> LifecycleScriptSubprocess<'a> {
                                 u8::try_from(new_script_index).expect("int cast"),
                             )
                         } {
-                            Output::err_generic(
-                                "Failed to run script <b>{}<r> due to error <b>{}<r>",
-                                (
-                                    bstr::BStr::new(LockfileScripts::NAMES[new_script_index]),
-                                    err.name(),
-                                ),
+                            self.exit_after_spawn_failure(
+                                u8::try_from(new_script_index).expect("int cast"),
+                                &err,
                             );
-                            Global::exit(1);
                         }
                         return;
                     }
                 }
 
+                self.remove_prepare_dependencies();
+
                 if PackageManager::verbose_install() {
                     bun_core::pretty_errorln!(
                         "<r><d>[Scripts]<r> Finished scripts for <b>{}<r>",
@@ -961,12 +1123,12 @@ impl<'a> LifecycleScriptSubprocess<'a> {
                 self.print_output();
                 let signal_code = bun_sys::SignalCode::from(signal);
 
+                self.print_failure_subject();
                 bun_core::pretty_errorln!(
-                    "<r><red>error<r><d>:<r> <b>{}<r> script from \"<b>{}<r>\" terminated by {}<r>",
-                    bstr::BStr::new(self.script_name()),
-                    bstr::BStr::new(&self.package_name),
+                    " terminated by {}<r>",
                     signal_code.fmt(Output::enable_ansi_colors_stderr()),
                 );
+                self.remove_prepare_dependencies();
 
                 // `Status::signal_code()` range-checks 1..=31 (`bun_core::SignalCode` is
                 // exhaustive); RT signals (>31) fall back to SIGTERM so the diverging
@@ -989,6 +1151,7 @@ impl<'a> LifecycleScriptSubprocess<'a> {
                     bstr::BStr::new(&self.package_name),
                     err,
                 );
+                self.remove_prepare_dependencies();
                 // SAFETY: `self` was created by `Self::new` (heap::alloc); uniquely owned here.
                 unsafe { Self::destroy(std::ptr::from_mut::<Self>(self)) };
                 Output::flush();
@@ -1087,10 +1250,22 @@ impl<'a> LifecycleScriptSubprocess<'a> {
         unsafe { Self::destroy(std::ptr::from_mut::<Self>(self)) };
     }
 
+    fn remove_prepare_dependencies(&mut self) {
+        let cleanup = match self.prepare_dependencies {
+            PrepareDependencies::Installing(cleanup) | PrepareDependencies::Installed(cleanup) => {
+                cleanup
+            }
+            PrepareDependencies::NotNeeded | PrepareDependencies::Pending => return,
+        };
+        self.prepare_dependencies = PrepareDependencies::NotNeeded;
+        cleanup.finish(self.scripts.cwd.as_bytes(), &self.package_name);
+    }
+
     pub(crate) fn spawn_package_scripts(
         manager: &mut PackageManager,
         list: ScriptsList,
         envp: bun_dotenv::NullDelimitedEnvMap,
+        install_envp: Option<bun_dotenv::NullDelimitedEnvMap>,
         shell_bin: Option<&'a ZStr>,
         optional: bool,
         log_level: crate::LogLevel,
@@ -1098,9 +1273,16 @@ impl<'a> LifecycleScriptSubprocess<'a> {
         ctx: Option<InstallCtx<'a>>,
     ) -> Result<(), crate::Error> {
         let package_name = list.package_name.clone();
+        let prepare_dependencies = if list.install_dependencies_for_prepare {
+            PrepareDependencies::Pending
+        } else {
+            PrepareDependencies::NotNeeded
+        };
         let lifecycle_subprocess = Self::new(LifecycleScriptSubprocess {
             manager: bun_ptr::BackRef::new_mut(manager),
             envp,
+            install_envp,
+            prepare_dependencies,
             shell_bin,
             package_name,
             scripts: list,
@@ -1142,17 +1324,47 @@ impl<'a> LifecycleScriptSubprocess<'a> {
         // SAFETY: `lifecycle_subprocess` is the allocation-rooted `heap::alloc` pointer
         // from `Self::new`; passing it gives the stored backrefs stable provenance.
         if let Err(err) = unsafe { Self::spawn_next_script(lifecycle_subprocess, first_index) } {
-            bun_core::pretty_errorln!(
-                "<r><red>error<r>: Failed to run script <b>{}<r> due to error <b>{}<r>",
-                bstr::BStr::new(LockfileScripts::NAMES[first_index as usize]),
-                err.name(),
-            );
-            Global::exit(1);
+            // SAFETY: `spawn_next_script` does not free the subprocess when it
+            // fails; `lss` is a non-owning view that is not used again.
+            unsafe { (*lifecycle_subprocess).exit_after_spawn_failure(first_index, &err) }
         }
 
         Ok(())
     }
 
+    /// `error: <what was running>`; the caller appends how it ended.
+    fn print_failure_subject(&self) {
+        if matches!(
+            self.prepare_dependencies,
+            PrepareDependencies::Installing(_)
+        ) {
+            bun_core::pretty_error!(
+                "<r><red>error<r><d>:<r> <b>{}<r> for the <b>{}<r> script of \"<b>{}<r>\"",
+                bstr::BStr::new(INSTALL_DEPENDENCIES_COMMAND_LINE),
+                bstr::BStr::new(self.script_name()),
+                bstr::BStr::new(&self.package_name),
+            );
+        } else {
+            bun_core::pretty_error!(
+                "<r><red>error<r><d>:<r> <b>{}<r> script from \"<b>{}<r>\"",
+                bstr::BStr::new(self.script_name()),
+                bstr::BStr::new(&self.package_name),
+            );
+        }
+    }
+
+    fn exit_after_spawn_failure(&mut self, script_index: u8, err: &crate::Error) -> ! {
+        Output::err_generic(
+            "Failed to run script <b>{}<r> due to error <b>{}<r>",
+            (
+                bstr::BStr::new(LockfileScripts::NAMES[script_index as usize]),
+                err.name(),
+            ),
+        );
+        self.remove_prepare_dependencies();
+        Global::exit(1);
+    }
+
     fn increment_pending_script_tasks(&self) {
         // .monotonic is okay because this is just used for progress. Other threads
         // don't rely on side effects of tasks based on this value. (And in the case
diff --git a/src/install/lockfile/Package/Scripts.rs b/src/install/lockfile/Package/Scripts.rs
index a629ed57680b..1991d56e783e 100644
--- a/src/install/lockfile/Package/Scripts.rs
+++ b/src/install/lockfile/Package/Scripts.rs
@@ -235,6 +235,12 @@ impl Scripts {
                 }
             };
 
+            let install_dependencies_for_prepare =
+                matches!(resolution_tag, ResolutionTag::Git | ResolutionTag::Github)
+                    && scripts[List::FIRST_PREPARE_INDEX..]
+                        .iter()
+                        .any(|script| script.is_some());
+
             return Some(List {
                 items: scripts,
                 first_index: u8::try_from(first_index).expect("int cast"),
@@ -242,6 +248,7 @@ impl Scripts {
                 // Owned NUL-terminated copy.
                 cwd: ZBox::from_bytes(cwd),
                 package_name: Box::<[u8]>::from(package_name),
+                install_dependencies_for_prepare,
             });
         }
 
@@ -417,9 +424,20 @@ pub struct List {
     // Owned NUL-terminated heap string, not a borrow.
     pub(crate) cwd: ZBox,
     pub(crate) package_name: Box<[u8]>,
+    /// Git dependency with prepare scripts: nothing installs the devDependencies
+    /// those build with, so the runner runs `bun install` in `cwd` first (like npm).
+    pub(crate) install_dependencies_for_prepare: bool,
 }
 
+const _: () = assert!(matches!(
+    LockfileScripts::NAMES[List::FIRST_PREPARE_INDEX].as_bytes(),
+    b"preprepare"
+));
+
 impl List {
+    /// Index of `preprepare` in `items`; `prepare` and `postprepare` follow it.
+    pub(crate) const FIRST_PREPARE_INDEX: usize = 3;
+
     pub fn print_scripts(
         &self,
         resolution: &Resolution,
diff --git a/test/cli/install/bun-install-lifecycle-scripts.test.ts b/test/cli/install/bun-install-lifecycle-scripts.test.ts
index 7fd85efac5c5..3870af34f367 100644
--- a/test/cli/install/bun-install-lifecycle-scripts.test.ts
+++ b/test/cli/install/bun-install-lifecycle-scripts.test.ts
@@ -92,6 +92,49 @@ async function setupTest(): Promise<TestCtx> {
   }
 }
 
+/**
+ * Commits `packageJson` (plus `files`, plus whatever `beforeCommit` adds) to a fresh repository at
+ * `<packageDir>/<name>-repo` and returns a `git+file://` dependency spec for it.
+ */
+async function createGitDependency(
+  packageDir: string,
+  packageJson: { name: string } & Record<string, unknown>,
+  {
+    files = {},
+    beforeCommit,
+  }: { files?: Record<string, string>; beforeCommit?: (repoDir: string) => Promise<void> } = {},
+): Promise<string> {
+  const repoDir = join(packageDir, `${packageJson.name}-repo`);
+  const emptyGitConfig = join(packageDir, "empty.gitconfig");
+  await Promise.all([mkdir(repoDir, { recursive: true }), writeFile(emptyGitConfig, "")]);
+  await Promise.all([
+    writeFile(join(repoDir, "package.json"), JSON.stringify(packageJson)),
+    ...Object.entries(files).map(([name, contents]) => writeFile(join(repoDir, name), contents)),
+  ]);
+  await beforeCommit?.(repoDir);
+
+  const gitEnv = {
+    ...baseEnv,
+    GIT_CONFIG_NOSYSTEM: "1",
+    GIT_CONFIG_GLOBAL: emptyGitConfig,
+    GIT_AUTHOR_NAME: "bun",
+    GIT_AUTHOR_EMAIL: "bun@example.com",
+    GIT_COMMITTER_NAME: "bun",
+    GIT_COMMITTER_EMAIL: "bun@example.com",
+  };
+  for (const args of [
+    ["init", "-q"],
+    ["add", "."],
+    ["commit", "-q", "-m", "init", "--no-gpg-sign"],
+  ]) {
+    await using proc = spawn({ cmd: ["git", ...args], cwd: repoDir, env: gitEnv, stdout: "ignore", stderr: "pipe" });
+    const [stderr, exitCode] = await Promise.all([proc.stderr.text(), proc.exited]);
+    if (exitCode !== 0) throw new Error(`git ${args.join(" ")} failed:\n${stderr}`);
+  }
+
+  return `git+${Bun.pathToFileURL(repoDir).href}`;
+}
+
 // The six multi-install tests below are the longest in the file (2-3 serial `bun install`s
 // each, some with cold caches). Declare them first so they start before the ~110 shorter
 // tests and overlap with them instead of forming a serial tail at the end of the run.
@@ -2602,6 +2645,314 @@ for (const forceWaiterThread of isLinux ? [false, true] : [false]) {
       expect(await exists(join(packageDir, "node_modules", "lifecycle-install-test", "postinstall.txt"))).toBeTrue();
     });
 
+    // A git dependency is installed from its checkout, so whatever its `prepare` script builds
+    // with (its devDependencies) has to be installed before the script runs, the way npm does
+    // it. https://github.com/oven-sh/bun/issues/10297
+    describe("git dependency with a prepare script that needs its devDependencies", () => {
+      // `what-bin` writes `what-bin.txt` (containing its own version) into the cwd it runs in.
+      const gitDependency = {
+        name: "needs-dev-deps-to-prepare",
+        version: "1.0.0",
+        devDependencies: { "what-bin": "1.0.0" },
+        scripts: { prepare: "what-bin" },
+      };
+      // Like most repositories, this one ships an npm lockfile. The nested install migrates it,
+      // and a migrated lockfile is the one case where bun writes `bun.lock` despite `--no-save`.
+      const gitDependencyFiles = {
+        "package-lock.json": JSON.stringify({
+          name: gitDependency.name,
+          version: gitDependency.version,
+          lockfileVersion: 3,
+          requires: true,
+          packages: {
+            "": {
+              name: gitDependency.name,
+              version: gitDependency.version,
+              devDependencies: gitDependency.devDependencies,
+            },
+            "node_modules/what-bin": { version: "1.0.0", dev: true, bin: { "what-bin": "what-bin.js" } },
+          },
+        }),
+      };
+      const preparedDepDirEntries = ["package-lock.json", "package.json", "what-bin.txt"];
+
+      async function installedState(packageDir: string, name: string) {
+        const depDir = join(packageDir, "node_modules", name);
+        return {
+          prepareOutput: (await exists(join(depDir, "what-bin.txt")))
+            ? await file(join(depDir, "what-bin.txt")).text()
+            : null,
+          depDirEntries: (await readdirSorted(depDir)).filter(entry => entry !== ".bun-tag"),
+          hoistedDevDependency: await exists(join(packageDir, "node_modules", "what-bin")),
+          lockfileMentionsDevDependency: (await file(join(packageDir, "bun.lock")).text()).includes("what-bin"),
+        };
+      }
+
+      for (const linker of ["hoisted", "isolated"] as const) {
+        // On Windows the isolated store path of a git dependency embeds the whole repository URL
+        // (here: a temp dir path) plus the commit, which puts the package past MAX_PATH, and every
+        // lifecycle script of such a package then fails to spawn with ENOENT, with or without this
+        // feature. That is a separate isolated-linker bug; `pm trust` and the tests below still
+        // cover the nested install on Windows through the hoisted linker.
+        test.skipIf(isWindows && linker === "isolated")(
+          `${linker} linker: installs them for the prepare script and removes them afterwards`,
+          async () => {
+            using ctx = await setupTest();
+            const { packageDir, packageJson, env } = ctx;
+            const testEnv = forceWaiterThread ? { ...env, BUN_FEATURE_FLAG_FORCE_WAITER_THREAD: "1" } : env;
+            await verdaccio.writeBunfig(packageDir, { linker });
+
+            const spec = await createGitDependency(packageDir, gitDependency, { files: gitDependencyFiles });
+            await writeFile(
+              packageJson,
+              JSON.stringify({
+                name: "foo",
+                version: "1.0.0",
+                dependencies: { [gitDependency.name]: spec },
+                trustedDependencies: [gitDependency.name],
+              }),
+            );
+
+            await using proc = spawn({
+              cmd: [bunExe(), "install"],
+              cwd: packageDir,
+              stdout: "pipe",
+              stdin: "ignore",
+              stderr: "pipe",
+              env: testEnv,
+            });
+            const [out, err, exitCode] = await Promise.all([proc.stdout.text(), proc.stderr.text(), proc.exited]);
+
+            expect(err).not.toContain("error:");
+            expect(err).not.toContain("warn:");
+            expect(out).toContain(`+ ${gitDependency.name}@git+file://`);
+            expect(exitCode).toBe(0);
+
+            expect(await installedState(packageDir, gitDependency.name)).toEqual({
+              prepareOutput: "what-bin@1.0.0",
+              // neither the nested install's `node_modules` nor the `bun.lock` it migrated are left behind
+              depDirEntries: preparedDepDirEntries,
+              hoistedDevDependency: false,
+              lockfileMentionsDevDependency: false,
+            });
+          },
+        );
+      }
+
+      test("the dependencies bun already nested under the package survive", async () => {
+        using ctx = await setupTest();
+        const { packageDir, packageJson, env } = ctx;
+        const testEnv = forceWaiterThread ? { ...env, BUN_FEATURE_FLAG_FORCE_WAITER_THREAD: "1" } : env;
+
+        // The project hoists what-bin@1.5.0, so the git dependency's own what-bin@1.0.0 is installed
+        // under node_modules/<name>/node_modules, which is exactly where the nested install writes.
+        // This repository also commits a `bun.lock`, which the nested install must leave alone.
+        let committedLockfile = "";
+        const spec = await createGitDependency(
+          packageDir,
+          {
+            name: "has-nested-deps",
+            version: "1.0.0",
+            dependencies: { "what-bin": "1.0.0" },
+            devDependencies: { "no-deps": "1.0.0" },
+            scripts: { prepare: "what-bin" },
+          },
+          {
+            async beforeCommit(repoDir) {
+              await using proc = spawn({
+                cmd: [bunExe(), "install", "--lockfile-only"],
+                cwd: repoDir,
+                stdout: "ignore",
+                stdin: "ignore",
+                stderr: "pipe",
+                env: { ...testEnv, BUN_CONFIG_REGISTRY: verdaccio.registryUrl() },
+              });
+              const [err, exitCode] = await Promise.all([proc.stderr.text(), proc.exited]);
+              expect(err).not.toContain("error:");
+              expect(exitCode).toBe(0);
+              committedLockfile = await file(join(repoDir, "bun.lock")).text();
+              expect(committedLockfile).toContain("no-deps");
+            },
+          },
+        );
+        await writeFile(
+          packageJson,
+          JSON.stringify({
+            name: "foo",
+            version: "1.0.0",
+            dependencies: { "what-bin": "1.5.0", "has-nested-deps": spec },
+            trustedDependencies: ["has-nested-deps"],
+          }),
+        );
+
+        await using proc = spawn({
+          cmd: [bunExe(), "install"],
+          cwd: packageDir,
+          stdout: "ignore",
+          stdin: "ignore",
+          stderr: "pipe",
+          env: testEnv,
+        });
+        const [err, exitCode] = await Promise.all([proc.stderr.text(), proc.exited]);
+        expect(err).not.toContain("error:");
+        expect(err).not.toContain("warn:");
+        expect(exitCode).toBe(0);
+
+        const depDir = join(packageDir, "node_modules", "has-nested-deps");
+        const nestedVersion = async (dir: string) =>
+          (await file(join(dir, "node_modules", "what-bin", "package.json")).json()).version;
+        expect({
+          prepareOutput: await file(join(depDir, "what-bin.txt")).text(),
+          hoistedWhatBin: await nestedVersion(packageDir),
+          nestedWhatBin: await nestedVersion(depDir),
+          nestedDevDependency: await exists(join(depDir, "node_modules", "no-deps")),
+          depDirEntries: (await readdirSorted(depDir)).filter(entry => entry !== ".bun-tag"),
+          lockfileUnchanged: (await file(join(depDir, "bun.lock")).text()) === committedLockfile,
+        }).toEqual({
+          prepareOutput: "what-bin@1.0.0",
+          hoistedWhatBin: "1.5.0",
+          nestedWhatBin: "1.0.0",
+          nestedDevDependency: false,
+          depDirEntries: ["bun.lock", "node_modules", "package.json", "what-bin.txt"],
+          lockfileUnchanged: true,
+        });
+      });
+
+      test("`bun pm trust` installs them too", async () => {
+        using ctx = await setupTest();
+        const { packageDir, packageJson, env } = ctx;
+        const testEnv = forceWaiterThread ? { ...env, BUN_FEATURE_FLAG_FORCE_WAITER_THREAD: "1" } : env;
+
+        const spec = await createGitDependency(packageDir, gitDependency, { files: gitDependencyFiles });
+        await writeFile(
+          packageJson,
+          JSON.stringify({ name: "foo", version: "1.0.0", dependencies: { [gitDependency.name]: spec } }),
+        );
+
+        {
+          await using proc = spawn({
+            cmd: [bunExe(), "install"],
+            cwd: packageDir,
+            stdout: "pipe",
+            stdin: "ignore",
+            stderr: "pipe",
+            env: testEnv,
+          });
+          const [out, err, exitCode] = await Promise.all([proc.stdout.text(), proc.stderr.text(), proc.exited]);
+          expect(err).not.toContain("error:");
+          expect(out).toContain("Blocked 1 postinstall");
+          expect(exitCode).toBe(0);
+          expect((await installedState(packageDir, gitDependency.name)).prepareOutput).toBeNull();
+        }
+
+        await using proc = spawn({
+          cmd: [bunExe(), "pm", "trust", gitDependency.name],
+          cwd: packageDir,
+          stdout: "pipe",
+          stdin: "ignore",
+          stderr: "pipe",
+          env: testEnv,
+        });
+        const [out, err, exitCode] = await Promise.all([proc.stdout.text(), proc.stderr.text(), proc.exited]);
+        expect(err).not.toContain("error:");
+        expect(out).toContain("1 script ran across 1 package");
+        expect(exitCode).toBe(0);
+
+        expect(await installedState(packageDir, gitDependency.name)).toEqual({
+          prepareOutput: "what-bin@1.0.0",
+          depDirEntries: preparedDepDirEntries,
+          hoistedDevDependency: false,
+          lockfileMentionsDevDependency: false,
+        });
+      });
+
+      test("a failing dependency install fails the install and says why", async () => {
+        using ctx = await setupTest();
+        const { packageDir, packageJson, env } = ctx;
+        const testEnv = forceWaiterThread ? { ...env, BUN_FEATURE_FLAG_FORCE_WAITER_THREAD: "1" } : env;
+
+        const spec = await createGitDependency(packageDir, {
+          ...gitDependency,
+          name: "dev-dep-does-not-exist",
+          devDependencies: { "this-package-does-not-exist": "1.0.0" },
+        });
+        await writeFile(
+          packageJson,
+          JSON.stringify({
+            name: "foo",
+            version: "1.0.0",
+            dependencies: { "dev-dep-does-not-exist": spec },
+            trustedDependencies: ["dev-dep-does-not-exist"],
+          }),
+        );
+
+        await using proc = spawn({
+          cmd: [bunExe(), "install"],
+          cwd: packageDir,
+          stdout: "ignore",
+          stdin: "ignore",
+          stderr: "pipe",
+          env: testEnv,
+        });
+        const [err, exitCode] = await Promise.all([proc.stderr.text(), proc.exited]);
+        // the nested install's own output comes first, then bun's summary of what it was doing
+        expect(err).toContain("this-package-does-not-exist");
+        expect(err).toContain(
+          'error: bun install --ignore-scripts --no-save for the prepare script of "dev-dep-does-not-exist" exited with 1',
+        );
+        expect(exitCode).toBe(1);
+
+        // the failed nested install is cleaned up like a successful one
+        const depDir = join(packageDir, "node_modules", "dev-dep-does-not-exist");
+        expect((await readdirSorted(depDir)).filter(entry => entry !== ".bun-tag")).toEqual(["package.json"]);
+      });
+
+      test("recovers from a run that was interrupted while its dependencies were installed", async () => {
+        using ctx = await setupTest();
+        const { packageDir, packageJson, env } = ctx;
+        const testEnv = forceWaiterThread ? { ...env, BUN_FEATURE_FLAG_FORCE_WAITER_THREAD: "1" } : env;
+
+        const spec = await createGitDependency(packageDir, gitDependency);
+        await writeFile(
+          packageJson,
+          JSON.stringify({ name: "foo", version: "1.0.0", dependencies: { [gitDependency.name]: spec } }),
+        );
+        await runBunInstall(testEnv, packageDir);
+
+        // What a run that died (kill -9, power loss) between moving the package's own `node_modules`
+        // aside and putting it back leaves behind: the original in `.bun-prepare-node_modules`, and
+        // the half-installed dependencies of that run in `node_modules`.
+        const depDir = join(packageDir, "node_modules", gitDependency.name);
+        await Promise.all([
+          write(join(depDir, ".bun-prepare-node_modules", "original-nested-dep", "package.json"), "{}"),
+          write(join(depDir, "node_modules", "leftover-from-interrupted-run", "package.json"), "{}"),
+        ]);
+
+        await using proc = spawn({
+          cmd: [bunExe(), "pm", "trust", gitDependency.name],
+          cwd: packageDir,
+          stdout: "ignore",
+          stdin: "ignore",
+          stderr: "pipe",
+          env: testEnv,
+        });
+        const [err, exitCode] = await Promise.all([proc.stderr.text(), proc.exited]);
+        expect(err).not.toContain("error:");
+        expect(err).not.toContain("warn:");
+        expect(exitCode).toBe(0);
+
+        expect({
+          prepareOutput: await file(join(depDir, "what-bin.txt")).text(),
+          depDirEntries: (await readdirSorted(depDir)).filter(entry => entry !== ".bun-tag"),
+          nodeModulesEntries: await readdirSorted(join(depDir, "node_modules")),
+        }).toEqual({
+          prepareOutput: "what-bin@1.0.0",
+          depDirEntries: ["node_modules", "package.json", "what-bin.txt"],
+          nodeModulesEntries: ["original-nested-dep"],
+        });
+      });
+    });
+
     test("root lifecycle scripts should wait for dependency lifecycle scripts", async () => {
       using ctx = await setupTest();
       const { packageDir, packageJson, env } = ctx;

From 3d9f186d129921ad0360d9b258b8933d9e564f44 Mon Sep 17 00:00:00 2001
From: robobun <117481402+robobun@users.noreply.github.com>
Date: Mon, 17 Aug 2026 01:08:40 +0000
Subject: [PATCH 070/258] install: skip root lifecycle scripts and the
 yarn.lock write under --dry-run (#38830)

---
 docs/pm/cli/install.mdx                       |  6 ++
 .../PackageManager/install_with_manager.rs    | 13 ++--
 .../bun-install-lifecycle-scripts.test.ts     | 59 +++++++++++++++++++
 test/cli/install/bun-lock.test.ts             | 36 +++++++++++
 4 files changed, 109 insertions(+), 5 deletions(-)

diff --git a/docs/pm/cli/install.mdx b/docs/pm/cli/install.mdx
index f698ef57b4ea..800fca28c464 100644
--- a/docs/pm/cli/install.mdx
+++ b/docs/pm/cli/install.mdx
@@ -206,6 +206,12 @@ To perform a dry run, without installing anything:
 bun install --dry-run
 ```
 
+Bun resolves the dependency tree and prints the summary. During a dry run, Bun does not:
+
+- install packages into `node_modules`
+- write `bun.lock` (or `yarn.lock` with `--yarn`)
+- run your project's lifecycle scripts
+
 ---
 
 ## Non-npm dependencies
diff --git a/src/install/PackageManager/install_with_manager.rs b/src/install/PackageManager/install_with_manager.rs
index 280fcddd91cb..5235a3b5e344 100644
--- a/src/install/PackageManager/install_with_manager.rs
+++ b/src/install/PackageManager/install_with_manager.rs
@@ -930,12 +930,15 @@ pub fn install_with_manager(
         manager.summary.add = manager.lockfile.packages.len() as u32;
     }
 
-    if manager.options.do_.save_yarn_lock() {
-        write_yarn_lock_with_progress(manager, log_level)?;
-    }
+    if !manager.options.dry_run {
+        if manager.options.do_.save_yarn_lock() {
+            write_yarn_lock_with_progress(manager, log_level)?;
+        }
 
-    if manager.options.do_.run_scripts() && install_root_dependencies && !manager.options.global {
-        run_root_lifecycle_scripts(manager, ctx, log_level)?;
+        if manager.options.do_.run_scripts() && install_root_dependencies && !manager.options.global
+        {
+            run_root_lifecycle_scripts(manager, ctx, log_level)?;
+        }
     }
 
     if log_level != Options::LogLevel::Silent {
diff --git a/test/cli/install/bun-install-lifecycle-scripts.test.ts b/test/cli/install/bun-install-lifecycle-scripts.test.ts
index 3870af34f367..67f17aeee79b 100644
--- a/test/cli/install/bun-install-lifecycle-scripts.test.ts
+++ b/test/cli/install/bun-install-lifecycle-scripts.test.ts
@@ -2220,6 +2220,65 @@ for (const forceWaiterThread of isLinux ? [false, true] : [false]) {
       assertManifestsPopulated(join(packageDir, ".bun-cache"), verdaccio.registryUrl());
     });
 
+    test("--dry-run should not run root lifecycle scripts", async () => {
+      using ctx = await setupTest();
+      const { packageDir, packageJson, env } = ctx;
+      const testEnv = forceWaiterThread ? { ...env, BUN_FEATURE_FLAG_FORCE_WAITER_THREAD: "1" } : env;
+
+      await writeFile(
+        packageJson,
+        JSON.stringify({
+          name: "foo",
+          version: "1.0.0",
+          scripts: {
+            preinstall: "echo preinstall > preinstall.txt",
+            postinstall: "echo postinstall > postinstall.txt",
+            prepare: "echo prepare > prepare.txt",
+          },
+        }),
+      );
+
+      const scriptsRan = () =>
+        Promise.all([
+          exists(join(packageDir, "preinstall.txt")),
+          exists(join(packageDir, "postinstall.txt")),
+          exists(join(packageDir, "prepare.txt")),
+        ]);
+
+      for (const args of [["--dry-run"], ["--frozen-lockfile", "--dry-run"]]) {
+        const { stdout, stderr, exited } = spawn({
+          cmd: [bunExe(), "install", ...args],
+          cwd: packageDir,
+          stdout: "pipe",
+          stdin: "ignore",
+          stderr: "pipe",
+          env: testEnv,
+        });
+
+        const [out, err, exitCode] = await Promise.all([stdout.text(), stderr.text(), exited]);
+        expect(err).not.toContain("$ echo");
+        expect(err).not.toContain("error:");
+        expect(out).toContain("bun install v1.");
+        expect(exitCode).toBe(0);
+        expect(await scriptsRan()).toEqual([false, false, false]);
+      }
+
+      // The same package.json runs all three scripts on a real install.
+      const { stderr, exited } = spawn({
+        cmd: [bunExe(), "install"],
+        cwd: packageDir,
+        stdout: "ignore",
+        stdin: "ignore",
+        stderr: "pipe",
+        env: testEnv,
+      });
+
+      const [err, exitCode] = await Promise.all([stderr.text(), exited]);
+      expect(err).not.toContain("error:");
+      expect(exitCode).toBe(0);
+      expect(await scriptsRan()).toEqual([true, true, true]);
+    });
+
     test("it should add `node-gyp rebuild` as the `install` script when `install` and `postinstall` don't exist and `binding.gyp` exists in the root of the package", async () => {
       using ctx = await setupTest();
       const { packageDir, packageJson, env } = ctx;
diff --git a/test/cli/install/bun-lock.test.ts b/test/cli/install/bun-lock.test.ts
index 26e808b193d6..72dca187142a 100644
--- a/test/cli/install/bun-lock.test.ts
+++ b/test/cli/install/bun-lock.test.ts
@@ -1020,6 +1020,42 @@ it("escapes quotes and newlines in requested version literals when writing yarn.
   expect(lines.filter(line => line.trimStart().startsWith('resolved "http://injected.example'))).toEqual([]);
 });
 
+it("--yarn does not write yarn.lock during --dry-run", async () => {
+  const { packageDir, packageJson } = await registry.createTestDir();
+
+  await write(
+    packageJson,
+    JSON.stringify({
+      name: "yarn-lock-dry-run",
+      dependencies: {
+        "no-deps": "1.0.0",
+      },
+    }),
+  );
+
+  const { exited, stdout, stderr } = spawn({
+    cmd: [bunExe(), "install", "--yarn", "--dry-run"],
+    cwd: packageDir,
+    env,
+    stdout: "pipe",
+    stderr: "pipe",
+  });
+
+  const [out, err, exitCode] = await Promise.all([stdout.text(), stderr.text(), exited]);
+  expect(err).not.toContain("yarn.lock");
+  expect(err).not.toContain("error:");
+  expect(out).toContain("no-deps@1.0.0");
+  expect(exitCode).toBe(0);
+
+  expect(
+    await Promise.all([
+      exists(join(packageDir, "yarn.lock")),
+      exists(join(packageDir, "bun.lock")),
+      exists(join(packageDir, "node_modules")),
+    ]),
+  ).toEqual([false, false, false]);
+});
+
 it("prints an actionable error for a lockfile version newer than this build supports", async () => {
   const { packageDir, packageJson } = await registry.createTestDir();
 

From 378e0141ab8940bb845e4c99205160679ee1c1cf Mon Sep 17 00:00:00 2001
From: robobun <117481402+robobun@users.noreply.github.com>
Date: Mon, 17 Aug 2026 01:08:44 +0000
Subject: [PATCH 071/258] install: remove the same-filesystem probe from
 $TMPDIR when the rename into the cache fails (#38859)

---
 .../PackageManagerDirectories.rs              |  2 +
 .../install/bun-install-tmpdir-exdev.test.ts  | 67 +++++++++++++++++++
 2 files changed, 69 insertions(+)
 create mode 100644 test/cli/install/bun-install-tmpdir-exdev.test.ts

diff --git a/src/install/PackageManager/PackageManagerDirectories.rs b/src/install/PackageManager/PackageManagerDirectories.rs
index 358435735306..12f62686e577 100644
--- a/src/install/PackageManager/PackageManagerDirectories.rs
+++ b/src/install/PackageManager/PackageManagerDirectories.rs
@@ -242,6 +242,8 @@ fn get_temporary_directory_run(manager: &mut PackageManager) -> TemporaryDirecto
         match sys::renameat_z(tempdir.fd(), tmpname, cache_directory.fd(), tmpname) {
             Ok(()) => {}
             Err(err) => {
+                // The rename failed, so the probe is still sitting in `tempdir`.
+                let _ = tempdir.delete_file_z(tmpname);
                 if !tried_dot_tmp {
                     tried_dot_tmp = true;
                     tempdir = match cache_directory.make_open_path(b".tmp", Default::default()) {
diff --git a/test/cli/install/bun-install-tmpdir-exdev.test.ts b/test/cli/install/bun-install-tmpdir-exdev.test.ts
new file mode 100644
index 000000000000..7882fb7ef62b
--- /dev/null
+++ b/test/cli/install/bun-install-tmpdir-exdev.test.ts
@@ -0,0 +1,67 @@
+// `bun install` checks whether $TMPDIR and the install cache are on the same
+// filesystem by creating an empty `.<hex>-N.hm` probe in $TMPDIR and
+// renaming it into the cache. When the rename fails with EXDEV, bun falls
+// back to `<cache>/.tmp`; the probe it created in $TMPDIR must not be left
+// behind. Forcing EXDEV needs a writable mount on a different device from
+// the harness temp dir (/dev/shm on Linux).
+import { expect, test } from "bun:test";
+import { bunEnv, bunExe, isPosix, tempDir } from "harness";
+import { accessSync, constants, existsSync, mkdtempSync, readdirSync, rmSync, statSync } from "node:fs";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+
+function findCrossDeviceDir(): string | undefined {
+  if (!isPosix) return undefined;
+  const refDev = statSync(tmpdir()).dev;
+  for (const candidate of ["/dev/shm", "/tmp"]) {
+    try {
+      if (statSync(candidate).dev === refDev) continue;
+      accessSync(candidate, constants.W_OK | constants.X_OK);
+      return candidate;
+    } catch {}
+  }
+  return undefined;
+}
+
+const crossDeviceDir = findCrossDeviceDir();
+
+test.skipIf(!crossDeviceDir)(
+  "leaves nothing in $TMPDIR when it is on a different filesystem than the cache",
+  async () => {
+    using dir = tempDir("install-tmpdir-exdev", {
+      "package.json": JSON.stringify({
+        name: "app",
+        dependencies: { localdep: "file:./localdep" },
+      }),
+      "localdep/package.json": JSON.stringify({ name: "localdep", version: "1.0.0" }),
+    });
+    const cache = join(String(dir), "cache");
+    const tmp = mkdtempSync(join(crossDeviceDir!, "bun-install-exdev-"));
+
+    try {
+      await using proc = Bun.spawn({
+        cmd: [bunExe(), "install"],
+        cwd: String(dir),
+        env: {
+          ...bunEnv,
+          BUN_INSTALL_CACHE_DIR: cache,
+          BUN_TMPDIR: tmp,
+          TMPDIR: tmp,
+        },
+        stdout: "pipe",
+        stderr: "pipe",
+      });
+      const [stdout, stderr, exitCode] = await Promise.all([proc.stdout.text(), proc.stderr.text(), proc.exited]);
+      expect(stderr).not.toContain("error:");
+      expect(stdout).toContain("1 package installed");
+      expect(exitCode).toBe(0);
+
+      // The cross-device rename failed, so bun switched to <cache>/.tmp ...
+      expect(existsSync(join(cache, ".tmp"))).toBe(true);
+      // ... and must have removed the probe it had created in $TMPDIR first.
+      expect(readdirSync(tmp)).toEqual([]);
+    } finally {
+      rmSync(tmp, { recursive: true, force: true });
+    }
+  },
+);

From b66aeba4e8c9288953fcd836740b594fde643844 Mon Sep 17 00:00:00 2001
From: robobun <117481402+robobun@users.noreply.github.com>
Date: Mon, 17 Aug 2026 01:08:48 +0000
Subject: [PATCH 072/258] install: print version before package name in the
 minimum-release-age error (#37895)

---
 .../PackageManager/PackageManagerEnqueue.rs   |  2 +-
 test/cli/install/minimum-release-age.test.ts  | 64 +++++++++++++++++--
 2 files changed, 59 insertions(+), 7 deletions(-)

diff --git a/src/install/PackageManager/PackageManagerEnqueue.rs b/src/install/PackageManager/PackageManagerEnqueue.rs
index 6631caff81ee..45c39eb687ed 100644
--- a/src/install/PackageManager/PackageManagerEnqueue.rs
+++ b/src/install/PackageManager/PackageManagerEnqueue.rs
@@ -860,10 +860,10 @@ pub fn enqueue_dependency_with_main_and_success_fn(
                                                 None,
                                                 bun_ast::Loc::EMPTY,
                                                 "No version matching \"{}\" found for specifier \"{}\"<r> <d>(blocked by minimum-release-age: {} seconds)<r>",
-                                                bstr::BStr::new(this.lockfile.str(&name)),
                                                 bstr::BStr::new(
                                                     this.lockfile.str(&version.literal)
                                                 ),
+                                                bstr::BStr::new(this.lockfile.str(&name)),
                                                 age_gate_ms / MS_PER_S,
                                             );
                                         }
diff --git a/test/cli/install/minimum-release-age.test.ts b/test/cli/install/minimum-release-age.test.ts
index 4692b5a16045..e80cb41cd64b 100644
--- a/test/cli/install/minimum-release-age.test.ts
+++ b/test/cli/install/minimum-release-age.test.ts
@@ -1003,11 +1003,60 @@ describe("minimum-release-age", () => {
       const exitCode = await proc.exited;
       const stderr = await proc.stderr.text();
 
-      // Should fail because 3.0.0 is too recent
+      // Should fail because 3.0.0 is too recent; same argument order as the "(but package exists)" error.
+      expect(stderr).toContain(
+        `error: No version matching "3.0.0" found for specifier "regular-package" (blocked by minimum-release-age: ${5 * SECONDS_PER_DAY} seconds)`,
+      );
+      expect(exitCode).toBe(1);
+    });
+
+    test("reports the range and package name when every version in a range is too recent", async () => {
+      using dir = tempDir("range-all-too-recent", {
+        "package.json": JSON.stringify({
+          dependencies: { "regular-package": "^2.1.0" },
+        }),
+        ".npmrc": `registry=${mockRegistryUrl}`,
+      });
+
+      // 2.1.0 is 6 days old and 3.0.0 is 1 day old; ^2.1.0 excludes 1.0.0 and 2.0.0.
+      await using proc = Bun.spawn({
+        cmd: [bunExe(), "install", "--minimum-release-age", `${10 * SECONDS_PER_DAY}`, "--no-verify"],
+        cwd: String(dir),
+        env: bunEnv,
+        stdout: "pipe",
+        stderr: "pipe",
+      });
+
+      const [stderr, exitCode] = await Promise.all([proc.stderr.text(), proc.exited]);
+
+      expect(stderr).toContain(
+        `error: No version matching "^2.1.0" found for specifier "regular-package" (blocked by minimum-release-age: ${10 * SECONDS_PER_DAY} seconds)`,
+      );
       expect(exitCode).toBe(1);
-      expect(stderr.toLowerCase()).toMatch(
-        /blocked.*npm.*minimal.*age.*gate|blocked.*minimum.*release.*age|too.*recent/,
+    });
+
+    test("reports the package name and tag when every version behind a dist-tag is too recent", async () => {
+      using dir = tempDir("dist-tag-all-too-recent", {
+        "package.json": JSON.stringify({
+          dependencies: { "all-future-package": "latest" },
+        }),
+        ".npmrc": `registry=${mockRegistryUrl}`,
+      });
+
+      await using proc = Bun.spawn({
+        cmd: [bunExe(), "install", "--minimum-release-age", `${5 * SECONDS_PER_DAY}`, "--no-verify"],
+        cwd: String(dir),
+        env: bunEnv,
+        stdout: "pipe",
+        stderr: "pipe",
+      });
+
+      const [stderr, exitCode] = await Promise.all([proc.stderr.text(), proc.exited]);
+
+      expect(stderr).toContain(
+        `error: Package "all-future-package" with tag "latest" not found (all versions blocked by minimum-release-age: ${5 * SECONDS_PER_DAY} seconds)`,
       );
+      expect(exitCode).toBe(1);
     });
   });
 
@@ -1619,9 +1668,10 @@ describe("minimum-release-age", () => {
       const stderr = await proc.stderr.text();
 
       // Should fail gracefully
+      expect(stderr).toContain(
+        'error: No version matching "99.0.0" found for specifier "regular-package" (but package exists)',
+      );
       expect(exitCode).toBe(1);
-      // Error message varies but should indicate version not found
-      expect(stderr.toLowerCase()).toMatch(/not found|no version matching|failed to resolve/);
     });
   });
 
@@ -2589,8 +2639,10 @@ describe("minimum-release-age", () => {
       const [exitCode, stderr] = await Promise.all([proc.exited, proc.stderr.text()]);
 
       // Should fail - no versions pass the age gate
+      expect(stderr).toContain(
+        `error: No version matching "*" found for specifier "all-future-package" (blocked by minimum-release-age: ${5 * SECONDS_PER_DAY} seconds)`,
+      );
       expect(exitCode).toBe(1);
-      expect(stderr.toLowerCase()).toMatch(/no version|blocked|failed to resolve/);
     });
   });
 

From 40a59090356c342b97bec0b8f4e72e5355266122 Mon Sep 17 00:00:00 2001
From: Alistair Smith <hi@alistair.sh>
Date: Mon, 17 Aug 2026 01:08:52 +0000
Subject: [PATCH 073/258] install: support name@version entries in
 minimumReleaseAgeExcludes (#37909)

---
 docs/pm/cli/install.mdx                       |   9 +-
 docs/runtime/bunfig.mdx                       |   8 +-
 .../PackageManager/PackageManagerEnqueue.rs   |  21 +-
 .../PackageManager/PackageManagerOptions.rs   |   9 +-
 src/install/npm.rs                            | 137 +++++++++--
 src/semver/Version.rs                         |   3 +-
 test/cli/install/minimum-release-age.test.ts  | 226 ++++++++++++++++++
 7 files changed, 377 insertions(+), 36 deletions(-)

diff --git a/docs/pm/cli/install.mdx b/docs/pm/cli/install.mdx
index 800fca28c464..20643063fce8 100644
--- a/docs/pm/cli/install.mdx
+++ b/docs/pm/cli/install.mdx
@@ -283,10 +283,15 @@ You can also configure this in `bunfig.toml`:
 # Only install package versions published at least 3 days ago
 minimumReleaseAge = 259200 # seconds
 
-# Exclude trusted packages from the age gate
-minimumReleaseAgeExcludes = ["@types/node", "typescript"]
+# Exclude trusted packages, or individual versions you have vetted, from the age gate
+minimumReleaseAgeExcludes = ["@types/node", "typescript@5.4.5", "esbuild@0.21.4 || 0.21.5"]
 ```
 
+`minimumReleaseAgeExcludes` accepts two kinds of entries:
+
+- A package name (`"typescript"`) exempts every version of that package, including versions published in the future.
+- A package name followed by one or more exact versions (`"typescript@5.4.5"`, `"@types/node@20.11.0"`, `"esbuild@0.21.4 || 0.21.5"`) exempts only those versions. Other versions of the package still go through the age gate, so you can install a specific release early without disabling the gate for the package. Exempted versions are installed as-is: they also skip the stability check described below. Entries whose versions are not exact (`"typescript@^5"`, `"typescript@latest"`, `"typescript@"`) are ignored with a warning.
+
 When the minimum age filter is active:
 
 - It only affects new package resolution; existing packages in `bun.lock` remain unchanged
diff --git a/docs/runtime/bunfig.mdx b/docs/runtime/bunfig.mdx
index 5927b01bf6d6..f6f385cdae4b 100644
--- a/docs/runtime/bunfig.mdx
+++ b/docs/runtime/bunfig.mdx
@@ -756,15 +756,17 @@ See [Minimum release age](/pm/cli/install#minimum-release-age).
 
 ### `install.minimumReleaseAgeExcludes`
 
-An array of package names that are exempt from the `minimumReleaseAge` check. Default `[]`.
+An array of packages that are exempt from the `minimumReleaseAge` check. A package name exempts every version of the package; `name@version` (or `name@1.0.0 || 1.0.1`) exempts only the listed exact versions. Default `[]`.
 
 ```toml title="bunfig.toml" icon="settings"
 [install]
 minimumReleaseAge = 259200
-# These packages will bypass the 3-day minimum age requirement
-minimumReleaseAgeExcludes = ["@types/bun", "typescript"]
+# Every version of @types/bun, and only typescript 5.4.5, bypass the 3-day minimum age requirement
+minimumReleaseAgeExcludes = ["@types/bun", "typescript@5.4.5"]
 ```
 
+See [Minimum release age](/pm/cli/install#minimum-release-age).
+
 ## `bun run`
 
 The `[run]` section configures the `bun run` command. These settings also apply to the `bun` command when running a file, script, or executable.
diff --git a/src/install/PackageManager/PackageManagerEnqueue.rs b/src/install/PackageManager/PackageManagerEnqueue.rs
index 45c39eb687ed..fe574cc522d7 100644
--- a/src/install/PackageManager/PackageManagerEnqueue.rs
+++ b/src/install/PackageManager/PackageManagerEnqueue.rs
@@ -1068,15 +1068,18 @@ pub fn enqueue_dependency_with_main_and_success_fn(
                                                 if let Some(min_age_ms) =
                                                     this.options.minimum_release_age_ms
                                                 {
-                                                    if !loaded_manifest
-                                                        .as_ref()
-                                                        .unwrap()
-                                                        .should_exclude_from_age_filter(
-                                                            this.options.minimum_release_age_excludes,
-                                                        )
-                                                        && Npm::PackageManifest::is_package_version_too_recent(
-                                                            find_result.package, min_age_ms,
-                                                        )
+                                                    let manifest =
+                                                        loaded_manifest.as_ref().unwrap();
+                                                    let excludes =
+                                                        this.options.minimum_release_age_excludes;
+                                                    if !manifest
+                                                        .should_exclude_from_age_filter(excludes)
+                                                        && manifest
+                                                            .is_version_blocked_by_age_filter(
+                                                                find_result,
+                                                                min_age_ms,
+                                                                excludes,
+                                                            )
                                                     {
                                                         let package_name = this.lockfile.str(&name);
                                                         let min_age_seconds = min_age_ms / MS_PER_S;
diff --git a/src/install/PackageManager/PackageManagerOptions.rs b/src/install/PackageManager/PackageManagerOptions.rs
index a8f97684a22d..0fdb5ae4979c 100644
--- a/src/install/PackageManager/PackageManagerOptions.rs
+++ b/src/install/PackageManager/PackageManagerOptions.rs
@@ -87,8 +87,8 @@ pub struct Options {
     // Minimum release age in ms (security feature)
     // Only install packages published at least N ms ago
     pub minimum_release_age_ms: Option<f64>,
-    // Packages to exclude from minimum release age checking
-    pub minimum_release_age_excludes: Option<&'static [&'static [u8]]>,
+    // Packages and package versions to exclude from minimum release age checking
+    pub minimum_release_age_excludes: Option<&'static Npm::MinimumReleaseAgeExcludes>,
 
     /// Override CPU architecture for optional dependencies filtering
     pub cpu: Npm::Architecture,
@@ -564,8 +564,9 @@ impl Options {
                     exclusions.iter().map(|e| leak_static(e)).collect();
                 // Parked for the lifetime of the install command (config arena
                 // equivalent), same as `leak_static` above.
-                self.minimum_release_age_excludes =
-                    Some(&*bun_core::heap::release(leaked.into_boxed_slice()));
+                self.minimum_release_age_excludes = Some(&*bun_core::heap::release(Box::new(
+                    Npm::MinimumReleaseAgeExcludes::parse(&leaked, log),
+                )));
             }
 
             // `PnpmMatcher` is move-only; `config` is `&` here so the matchers
diff --git a/src/install/npm.rs b/src/install/npm.rs
index 72227e8215e4..a1bd26f3fda2 100644
--- a/src/install/npm.rs
+++ b/src/install/npm.rs
@@ -1508,6 +1508,81 @@ pub struct FindResult<'a> {
     pub(crate) package: &'a PackageVersion,
 }
 
+/// `minimumReleaseAgeExcludes` entries (pnpm grammar): `name` exempts a package, `name@1.2.3 || 1.2.4` only those versions.
+pub struct MinimumReleaseAgeExcludes {
+    packages: Box<[&'static [u8]]>,
+    /// Matched with `Version::eql`, which compares tags by hash, so no string buffer is kept.
+    versions: Box<[(&'static [u8], Semver::Version)]>,
+}
+
+impl MinimumReleaseAgeExcludes {
+    /// A malformed entry (`foo@`, `foo@^1`) is dropped with a warning, never widened to the bare name.
+    pub(crate) fn parse(
+        entries: &[&'static [u8]],
+        log: &mut bun_ast::Log,
+    ) -> MinimumReleaseAgeExcludes {
+        let mut packages: Vec<&'static [u8]> = Vec::new();
+        let mut versions: Vec<(&'static [u8], Semver::Version)> = Vec::new();
+
+        for &entry in entries {
+            // Skip a scope's leading `@` so `@types/node@20.0.0` splits after the name.
+            let name_start = usize::from(strings::starts_with_char(entry, b'@'));
+            let Some(at) = strings::index_of_char_usize(&entry[name_start..], b'@') else {
+                packages.push(entry);
+                continue;
+            };
+            let name = &entry[..name_start + at];
+            let specs = &entry[name_start + at + 1..];
+
+            let first_of_entry = versions.len();
+            for spec in strings::split(specs, b"||") {
+                let Some(version) = parse_exact_version(spec) else {
+                    versions.truncate(first_of_entry);
+                    log.add_warning_fmt(
+                        None,
+                        bun_ast::Loc::EMPTY,
+                        format_args!(
+                            "Ignoring minimumReleaseAgeExcludes entry {}: expected a package name or exact versions, e.g. \"{name}@1.2.3\" or \"{name}@1.2.3 || 1.2.4\"",
+                            bun_fmt::quote(entry),
+                            name = bstr::BStr::new(name),
+                        ),
+                    );
+                    break;
+                };
+                versions.push((name, version));
+            }
+        }
+
+        MinimumReleaseAgeExcludes {
+            packages: packages.into_boxed_slice(),
+            versions: versions.into_boxed_slice(),
+        }
+    }
+
+    fn excludes_package(&self, name: &[u8]) -> bool {
+        self.packages.contains(&name)
+    }
+
+    fn excludes_version(&self, name: &[u8], version: Semver::Version) -> bool {
+        self.versions
+            .iter()
+            .any(|&(package, excluded)| package == name && excluded.eql(version))
+    }
+}
+
+/// Ranges, dist-tags, empty input, and trailing bytes are all rejected.
+fn parse_exact_version(spec: &[u8]) -> Option<Semver::Version> {
+    let spec = strings::trim(spec, &strings::WHITESPACE_CHARS);
+    let parsed = Semver::Version::parse_utf8(spec);
+    if !parsed.valid
+        || parsed.wildcard != Semver::query::Wildcard::None
+        || parsed.len as usize != spec.len()
+    {
+        return None;
+    }
+    Some(parsed.version.min())
+}
+
 impl PackageManifest {
     pub(crate) fn find_by_version(&self, version: Semver::Version) -> Option<FindResult<'_>> {
         let list = if !version.tag.has_pre() {
@@ -1543,20 +1618,35 @@ impl PackageManifest {
         None
     }
 
-    pub(crate) fn should_exclude_from_age_filter(&self, exclusions: Option<&[&[u8]]>) -> bool {
-        if let Some(excl) = exclusions {
-            let pkg_name = self.name();
-            for excluded in excl {
-                if pkg_name == *excluded {
-                    return true;
-                }
-            }
-        }
-        false
+    /// Whether every version of this package bypasses the minimum release age.
+    pub(crate) fn should_exclude_from_age_filter(
+        &self,
+        exclusions: Option<&MinimumReleaseAgeExcludes>,
+    ) -> bool {
+        exclusions.is_some_and(|excludes| excludes.excludes_package(self.name()))
+    }
+
+    fn is_version_excluded_from_age_filter(
+        &self,
+        version: Semver::Version,
+        exclusions: Option<&MinimumReleaseAgeExcludes>,
+    ) -> bool {
+        exclusions.is_some_and(|excludes| excludes.excludes_version(self.name(), version))
+    }
+
+    /// Too recent for the gate and not listed in `exclusions`.
+    pub(crate) fn is_version_blocked_by_age_filter(
+        &self,
+        result: FindResult<'_>,
+        minimum_release_age_ms: f64,
+        exclusions: Option<&MinimumReleaseAgeExcludes>,
+    ) -> bool {
+        Self::is_package_version_too_recent(result.package, minimum_release_age_ms)
+            && !self.is_version_excluded_from_age_filter(result.version, exclusions)
     }
 
     #[inline]
-    pub(crate) fn is_package_version_too_recent(
+    fn is_package_version_too_recent(
         package_version: &PackageVersion,
         minimum_release_age_ms: f64,
     ) -> bool {
@@ -1572,6 +1662,7 @@ impl PackageManifest {
         group: &Semver::query::Group,
         group_buf: &[u8],
         minimum_release_age_ms: f64,
+        exclusions: Option<&MinimumReleaseAgeExcludes>,
         newest_filtered: &mut Option<Semver::Version>,
     ) -> Option<FindVersionResult<'a>> {
         let mut prev_package_blocked_from_age: Option<&PackageVersion> = None;
@@ -1588,6 +1679,11 @@ impl PackageManifest {
             let version = versions[i];
             if group.satisfies(version, group_buf, &self.string_buf) {
                 let package = &packages[i];
+                // Listed versions count as stable: no age gate, and they replace an unstable fallback in `best_version`.
+                if self.is_version_excluded_from_age_filter(version, exclusions) {
+                    best_version = Some(FindResult { version, package });
+                    break;
+                }
                 if Self::is_package_version_too_recent(package, minimum_release_age_ms) {
                     if newest_filtered.is_none() {
                         *newest_filtered = Some(version);
@@ -1681,7 +1777,7 @@ impl PackageManifest {
         &self,
         tag: &[u8],
         minimum_release_age_ms: Option<f64>,
-        exclusions: Option<&[&[u8]]>,
+        exclusions: Option<&MinimumReleaseAgeExcludes>,
     ) -> FindVersionResult<'_> {
         let Some(dist_result) = self.find_by_dist_tag(tag) else {
             return FindVersionResult::Err(FindVersionError::NotFound);
@@ -1700,8 +1796,7 @@ impl PackageManifest {
         let seven_days_ms: f64 = 7.0 * bun_core::time::MS_PER_DAY as f64;
         let stability_window_ms = min_age_ms.min(seven_days_ms);
 
-        let dist_too_recent = Self::is_package_version_too_recent(dist_result.package, min_age_ms);
-        if !dist_too_recent {
+        if !self.is_version_blocked_by_age_filter(dist_result, min_age_ms, exclusions) {
             return FindVersionResult::Found(dist_result);
         }
 
@@ -1756,6 +1851,12 @@ impl PackageManifest {
                 }
             }
 
+            // See `search_version_list`.
+            if self.is_version_excluded_from_age_filter(version, exclusions) {
+                best_version = Some(FindResult { version, package });
+                break;
+            }
+
             if Self::is_package_version_too_recent(package, min_age_ms) {
                 prev_package_blocked_from_age = Some(package);
                 continue;
@@ -1808,7 +1909,7 @@ impl PackageManifest {
         group: &Semver::query::Group,
         group_buf: &[u8],
         minimum_release_age_ms: Option<f64>,
-        exclusions: Option<&[&[u8]]>,
+        exclusions: Option<&MinimumReleaseAgeExcludes>,
     ) -> FindVersionResult<'_> {
         let min_age_gate_ms = match minimum_release_age_ms {
             Some(min_age_ms) if !self.should_exclude_from_age_filter(exclusions) => {
@@ -1831,7 +1932,7 @@ impl PackageManifest {
         if left.op == Semver::range::Op::Eql {
             let result = self.find_by_version(left.version);
             if let Some(r) = result {
-                if Self::is_package_version_too_recent(r.package, min_age_ms) {
+                if self.is_version_blocked_by_age_filter(r, min_age_ms, exclusions) {
                     return FindVersionResult::Err(FindVersionError::TooRecent);
                 }
                 return FindVersionResult::Found(r);
@@ -1841,7 +1942,7 @@ impl PackageManifest {
 
         if let Some(result) = self.find_by_dist_tag(b"latest") {
             if group.satisfies(result.version, group_buf, &self.string_buf) {
-                if Self::is_package_version_too_recent(result.package, min_age_ms) {
+                if self.is_version_blocked_by_age_filter(result, min_age_ms, exclusions) {
                     newest_filtered = Some(result.version);
                 }
                 if newest_filtered.is_none() {
@@ -1866,6 +1967,7 @@ impl PackageManifest {
             group,
             group_buf,
             min_age_ms,
+            exclusions,
             &mut newest_filtered,
         ) {
             return result;
@@ -1878,6 +1980,7 @@ impl PackageManifest {
                 group,
                 group_buf,
                 min_age_ms,
+                exclusions,
                 &mut newest_filtered,
             ) {
                 return result;
diff --git a/src/semver/Version.rs b/src/semver/Version.rs
index dd3e81a051cd..1744ae6441b7 100644
--- a/src/semver/Version.rs
+++ b/src/semver/Version.rs
@@ -1198,7 +1198,8 @@ pub struct ParseResult<T: VersionInt> {
     pub wildcard: Wildcard,
     pub valid: bool,
     pub version: Partial<T>,
-    pub(crate) len: u32,
+    /// Where parsing stopped; shorter than the input when trailing bytes are not part of the version.
+    pub len: u32,
 }
 
 impl<T: VersionInt> Default for ParseResult<T> {
diff --git a/test/cli/install/minimum-release-age.test.ts b/test/cli/install/minimum-release-age.test.ts
index e80cb41cd64b..b3d864409410 100644
--- a/test/cli/install/minimum-release-age.test.ts
+++ b/test/cli/install/minimum-release-age.test.ts
@@ -1,6 +1,8 @@
 import type { Server } from "bun";
 import { afterAll, beforeAll, describe, expect, setDefaultTimeout, test } from "bun:test";
 import { bunEnv, bunExe, normalizeBunSnapshot, tempDir } from "harness";
+import { rmSync } from "node:fs";
+import { join } from "node:path";
 
 // These tests drive real `bun install` runs against a mock registry, which is
 // slow under the debug/ASAN build — give them the same generous timeout the
@@ -1401,6 +1403,230 @@ describe("minimum-release-age", () => {
       expect(lockfile).toContain("regular-package@2.1.0");
       expect(lockfile).not.toContain("regular-package@3.0.0");
     });
+
+    // https://github.com/oven-sh/bun/issues/28967: "name@version" entries exempt
+    // one version instead of every current and future version of the package.
+    //
+    // Fixture ages: excluded-package 1.0.0 (10d), 1.0.1 (12h, latest);
+    // @scope/scoped-package 1.0.0 (20d), 1.5.0 (8d), 2.0.0 (1d, latest);
+    // bugfix-package 1.0.0 (8d), 1.0.1 (2.5d), 1.0.2 (1.5d), 1.0.3 (12h, latest);
+    // canary-package 2.0.0-canary.3 (5d), canary.4 (2d), canary.5 (12h, dist-tag "canary").
+    describe("name@version entries", () => {
+      function project(
+        name: string,
+        dependencies: Record<string, string>,
+        minimumReleaseAgeDays: number,
+        minimumReleaseAgeExcludes: string[],
+      ) {
+        return tempDir(`exclusions-${name}`, {
+          "package.json": JSON.stringify({ dependencies }),
+          "bunfig.toml": Bun.TOML.stringify({
+            install: {
+              minimumReleaseAge: minimumReleaseAgeDays * SECONDS_PER_DAY,
+              minimumReleaseAgeExcludes,
+              registry: mockRegistryUrl,
+            },
+          }),
+        });
+      }
+
+      // Every project gets its own manifest cache so the resolution path a
+      // test exercises does not depend on which tests ran before it.
+      // --no-verify: the fixture manifests carry placeholder integrity values.
+      async function install(dir: string, { args = [] as string[], env = {} as Record<string, string> } = {}) {
+        await using proc = Bun.spawn({
+          cmd: [bunExe(), "install", "--no-verify", ...args],
+          cwd: dir,
+          env: { ...bunEnv, BUN_INSTALL_CACHE_DIR: join(dir, ".bun-cache"), ...env },
+          stdout: "pipe",
+          stderr: "pipe",
+        });
+        const [, stderr, exitCode] = await Promise.all([proc.stdout.text(), proc.stderr.text(), proc.exited]);
+
+        const lockfile = Bun.file(join(dir, "bun.lock"));
+        let resolved: Record<string, string> | null = null;
+        if (await lockfile.exists()) {
+          const { packages } = Bun.JSONC.parse(await lockfile.text()) as { packages: Record<string, [string]> };
+          resolved = Object.fromEntries(Object.entries(packages).map(([name, [resolution]]) => [name, resolution]));
+        }
+        return { stderr, exitCode, resolved };
+      }
+
+      test.concurrent("exempts only the listed version", async () => {
+        using dir = project("pinned", { "excluded-package": "*", "regular-package": "*" }, 5, [
+          "excluded-package@1.0.1",
+        ]);
+        const { stderr, exitCode, resolved } = await install(String(dir), { args: ["--verbose"] });
+        expect(stderr).not.toContain("error:");
+        expect(resolved).toEqual({
+          // Too recent for the gate, but listed.
+          "excluded-package": "excluded-package@1.0.1",
+          // Not listed: still gated (3.0.0 is 1 day old).
+          "regular-package": "regular-package@2.1.0",
+        });
+        // Installing a listed version is not a downgrade, so only
+        // regular-package is reported as filtered.
+        expect(stderr.split(/\r?\n/).filter(line => line.includes("[minimum-release-age]"))).toEqual([
+          `[minimum-release-age] regular-package@>=0.0.0 selected 2.1.0 instead of 3.0.0 due to ${5 * SECONDS_PER_DAY}-second filter`,
+        ]);
+        expect(exitCode).toBe(0);
+      });
+
+      test.concurrent("does not exempt other versions of the package", async () => {
+        using dir = project("other-version", { "excluded-package": "*" }, 5, ["excluded-package@0.9.0"]);
+        const { stderr, exitCode, resolved } = await install(String(dir));
+        expect(stderr).not.toContain("error:");
+        expect(resolved).toEqual({ "excluded-package": "excluded-package@1.0.0" });
+        expect(exitCode).toBe(0);
+      });
+
+      test.concurrent("scoped package", async () => {
+        using dir = project("scoped-pinned", { "@scope/scoped-package": "*" }, 5, ["@scope/scoped-package@2.0.0"]);
+        const { stderr, exitCode, resolved } = await install(String(dir));
+        expect(stderr).not.toContain("error:");
+        expect(resolved).toEqual({ "@scope/scoped-package": "@scope/scoped-package@2.0.0" });
+        expect(exitCode).toBe(0);
+      });
+
+      test.concurrent("bare scoped package name still exempts every version", async () => {
+        using dir = project("scoped-bare", { "@scope/scoped-package": "*" }, 5, ["@scope/scoped-package"]);
+        const { stderr, exitCode, resolved } = await install(String(dir));
+        expect(stderr).not.toContain("error:");
+        expect(resolved).toEqual({ "@scope/scoped-package": "@scope/scoped-package@2.0.0" });
+        expect(exitCode).toBe(0);
+      });
+
+      // With a 1.8 day gate and no exemption, bugfix-package resolves to 1.0.0:
+      // 1.0.3 and 1.0.2 are too recent, 1.0.1 passes the gate but was released
+      // only 1 day after 1.0.2 so the stability check walks on to 1.0.0.
+      test.concurrent("a listed version that is too recent is installed", async () => {
+        using dir = project("too-recent", { "bugfix-package": "*" }, 1.8, ["bugfix-package@1.0.2"]);
+        const { stderr, exitCode, resolved } = await install(String(dir));
+        expect(stderr).not.toContain("error:");
+        expect(resolved).toEqual({ "bugfix-package": "bugfix-package@1.0.2" });
+        expect(exitCode).toBe(0);
+      });
+
+      test.concurrent("a listed version that passes the gate is not skipped by the stability check", async () => {
+        using dir = project("stability", { "bugfix-package": "*" }, 1.8, ["bugfix-package@1.0.1"]);
+        const { stderr, exitCode, resolved } = await install(String(dir));
+        expect(stderr).not.toContain("error:");
+        expect(resolved).toEqual({ "bugfix-package": "bugfix-package@1.0.1" });
+        expect(exitCode).toBe(0);
+      });
+
+      // With a 1.2 day gate, 1.0.3 is blocked and 1.0.2 passes the gate but was
+      // released only 1 day before 1.0.3, so the walk keeps it as a fallback and
+      // continues; without an exemption it ends on 1.0.0. A listed 1.0.1 ends
+      // the walk there, taking precedence over the unstable fallback the same
+      // way a stable version does.
+      test.concurrent.each([
+        ["*", "range"],
+        ["latest", "dist-tag"],
+      ])("a listed version is preferred over a newer unstable fallback (%s dependency)", async (spec, label) => {
+        using dir = project(`fallback-${label}`, { "bugfix-package": spec }, 1.2, ["bugfix-package@1.0.1"]);
+        const { stderr, exitCode, resolved } = await install(String(dir));
+        expect(stderr).not.toContain("error:");
+        expect(resolved).toEqual({ "bugfix-package": "bugfix-package@1.0.1" });
+        expect(exitCode).toBe(0);
+      });
+
+      test.concurrent("dist-tag dependency falls back to a listed version", async () => {
+        using dir = project("dist-tag-walk", { "bugfix-package": "latest" }, 1.8, ["bugfix-package@1.0.2"]);
+        const { stderr, exitCode, resolved } = await install(String(dir));
+        expect(stderr).not.toContain("error:");
+        expect(resolved).toEqual({ "bugfix-package": "bugfix-package@1.0.2" });
+        expect(exitCode).toBe(0);
+      });
+
+      test.concurrent("dist-tag dependency pointing at a listed version", async () => {
+        using dir = project("dist-tag-target", { "excluded-package": "latest" }, 5, ["excluded-package@1.0.1"]);
+        const { stderr, exitCode, resolved } = await install(String(dir));
+        expect(stderr).not.toContain("error:");
+        expect(resolved).toEqual({ "excluded-package": "excluded-package@1.0.1" });
+        expect(exitCode).toBe(0);
+      });
+
+      // Without the exemption the "canary" tag (canary.5) is too recent and the
+      // walk lands on canary.3, see "filters canary versions correctly".
+      test.concurrent("prerelease version", async () => {
+        using dir = project("prerelease", { "canary-package": "canary" }, 3, ["canary-package@2.0.0-canary.4"]);
+        const { stderr, exitCode, resolved } = await install(String(dir));
+        expect(stderr).not.toContain("error:");
+        expect(resolved).toEqual({ "canary-package": "canary-package@2.0.0-canary.4" });
+        expect(exitCode).toBe(0);
+      });
+
+      test.concurrent("exact dependency on a listed version", async () => {
+        using dir = project("exact", { "excluded-package": "1.0.1" }, 5, ["excluded-package@1.0.1"]);
+
+        const first = await install(String(dir));
+        expect(first.stderr).not.toContain("error:");
+        expect(first.resolved).toEqual({ "excluded-package": "excluded-package@1.0.1" });
+        expect(first.exitCode).toBe(0);
+
+        // The first install cached the manifest. With manifest cache-control
+        // disabled (BUN_MANIFEST_CACHE=1) the cached copy counts as expired, and
+        // an exact version found in an expired cached manifest is resolved
+        // before any registry request, through a separate age check.
+        rmSync(join(String(dir), "bun.lock"));
+        rmSync(join(String(dir), "node_modules"), { recursive: true });
+        const second = await install(String(dir), { env: { BUN_MANIFEST_CACHE: "1" } });
+        expect(second.stderr).not.toContain("error:");
+        expect(second.resolved).toEqual({ "excluded-package": "excluded-package@1.0.1" });
+        expect(second.exitCode).toBe(0);
+      });
+
+      test.concurrent("exact dependency on a version that is not listed is still blocked", async () => {
+        using dir = project("exact-blocked", { "excluded-package": "1.0.1" }, 5, ["excluded-package@1.0.0"]);
+        const { stderr, exitCode, resolved } = await install(String(dir));
+        expect(stderr).toContain(`blocked by minimum-release-age: ${5 * SECONDS_PER_DAY} seconds`);
+        expect(resolved).toBeNull();
+        expect(exitCode).toBe(1);
+      });
+
+      test.concurrent("several versions joined with ||", async () => {
+        using dir = project(
+          "union",
+          { "bugfix-package": "*", "@scope/scoped-package": "*" },
+          1.8,
+          // The version that matters is last in one entry and first in the
+          // other, so both halves of each entry have to be honored.
+          ["bugfix-package@1.0.1 || 1.0.2", "@scope/scoped-package@2.0.0||1.0.0"],
+        );
+        const { stderr, exitCode, resolved } = await install(String(dir));
+        expect(stderr).not.toContain("error:");
+        expect(resolved).toEqual({
+          "bugfix-package": "bugfix-package@1.0.2",
+          "@scope/scoped-package": "@scope/scoped-package@2.0.0",
+        });
+        expect(exitCode).toBe(0);
+      });
+
+      test.concurrent("entries that are not exact versions are ignored with a warning", async () => {
+        const entries = [
+          "excluded-package@",
+          "excluded-package@latest",
+          "excluded-package@^1.0.0",
+          "excluded-package@1.x",
+          "excluded-package@1.0.1 || ^1.0.0",
+          "excluded-package@1.0.1 junk",
+        ];
+        using dir = project("malformed", { "excluded-package": "*" }, 5, entries);
+        const { stderr, exitCode, resolved } = await install(String(dir));
+        expect(stderr).not.toContain("error:");
+        expect(stderr.split(/\r?\n/).filter(line => line.includes("minimumReleaseAgeExcludes"))).toEqual(
+          entries.map(
+            entry =>
+              `warn: Ignoring minimumReleaseAgeExcludes entry "${entry}": expected a package name or exact versions, e.g. "excluded-package@1.2.3" or "excluded-package@1.2.3 || 1.2.4"`,
+          ),
+        );
+        // "excluded-package@" must not turn into a whole-package exemption, and
+        // the 1.0.1 in the rejected entries must not be honored either.
+        expect(resolved).toEqual({ "excluded-package": "excluded-package@1.0.0" });
+        expect(exitCode).toBe(0);
+      });
+    });
   });
 
   describe("configuration", () => {

From 8e439899cfbe127b8f174220b387f23d2dea40b8 Mon Sep 17 00:00:00 2001
From: robobun <117481402+robobun@users.noreply.github.com>
Date: Mon, 17 Aug 2026 01:08:56 +0000
Subject: [PATCH 074/258] install: do not resolve an exact version from an
 abbreviated manifest under minimum-release-age (#38659)

---
 .../PackageManager/PackageManagerEnqueue.rs   |  11 +-
 test/cli/install/minimum-release-age.test.ts  | 122 ++++++++++++++++++
 2 files changed, 132 insertions(+), 1 deletion(-)

diff --git a/src/install/PackageManager/PackageManagerEnqueue.rs b/src/install/PackageManager/PackageManagerEnqueue.rs
index fe574cc522d7..1c703e23f664 100644
--- a/src/install/PackageManager/PackageManagerEnqueue.rs
+++ b/src/install/PackageManager/PackageManagerEnqueue.rs
@@ -1049,9 +1049,18 @@ pub fn enqueue_dependency_with_main_and_success_fn(
                                         loaded_manifest = Some(manifest.clone());
 
                                         // If it's an exact package version already living in the cache
-                                        // We can skip the network request, even if it's beyond the caching period
+                                        // We can skip the network request, even if it's beyond the caching period.
+                                        // Except when minimum-release-age needs publish times and the cached
+                                        // manifest is abbreviated: its timestamps are all 0, so the age check
+                                        // below would pass any version. Fall through and fetch the extended one.
                                         if version.tag == dependency::version::Tag::Npm
                                             && version.npm().version.is_exact()
+                                            && (!needs_extended_manifest
+                                                || loaded_manifest
+                                                    .as_ref()
+                                                    .unwrap()
+                                                    .pkg
+                                                    .has_extended_manifest)
                                         {
                                             if let Some(find_result) =
                                                 loaded_manifest.as_ref().unwrap().find_by_version(
diff --git a/test/cli/install/minimum-release-age.test.ts b/test/cli/install/minimum-release-age.test.ts
index b3d864409410..c4c115fd091e 100644
--- a/test/cli/install/minimum-release-age.test.ts
+++ b/test/cli/install/minimum-release-age.test.ts
@@ -17,6 +17,9 @@ setDefaultTimeout(1000 * 60 * 5);
 describe("minimum-release-age", () => {
   let mockRegistryServer: Server;
   let mockRegistryUrl: string;
+  // Every request the mock registry served, so tests can assert which manifests
+  // were fetched and whether the abbreviated or the full document was requested.
+  const registryRequests: { pathname: string; accept: string | null }[] = [];
   const currentTime = Date.now();
   const SECONDS_PER_DAY = 24 * 60 * 60;
   const MS_PER_SECOND = 1000;
@@ -87,6 +90,7 @@ describe("minimum-release-age", () => {
       port: 0,
       async fetch(req) {
         const url = new URL(req.url);
+        registryRequests.push({ pathname: url.pathname, accept: req.headers.get("accept") });
 
         // Special timestamp helpers for edge case packages
         const futureTime = new Date(currentTime + 7 * DAY_MS).toISOString();
@@ -1062,6 +1066,124 @@ describe("minimum-release-age", () => {
     });
   });
 
+  describe("exact version with a cached manifest", () => {
+    // An exact version can be resolved from a cached manifest without asking the
+    // registry again. An install without an age gate caches the abbreviated
+    // manifest, which (from the real registry as well as from this mock) has no
+    // publish times, so an age-gated install must not resolve from it. Each test
+    // uses its own cache directory and reads which manifest flavor was requested
+    // off the Accept header.
+    const minAgeArgs = ["--minimum-release-age", `${5 * SECONDS_PER_DAY}`];
+    const blockedMessage = /blocked by minimum-release-age|minimum release age/;
+
+    const project = (dependencies: Record<string, string>) => ({
+      "package.json": JSON.stringify({ name: "app", dependencies }),
+      ".npmrc": `registry=${mockRegistryUrl}`,
+    });
+
+    async function runWithCache(cwd: string, cacheDir: string, args: string[], { stale = false } = {}) {
+      const firstRequest = registryRequests.length;
+      await using proc = Bun.spawn({
+        cmd: [bunExe(), ...args, "--no-verify"],
+        cwd,
+        env: {
+          ...bunEnv,
+          BUN_INSTALL_CACHE_DIR: cacheDir,
+          // BUN_MANIFEST_CACHE=1 treats every cached manifest as past its
+          // freshness window, which is the state the exact-version shortcut
+          // exists for.
+          ...(stale && { BUN_MANIFEST_CACHE: "1" }),
+        },
+        stdout: "pipe",
+        stderr: "pipe",
+      });
+      const [stdout, stderr, exitCode] = await Promise.all([proc.stdout.text(), proc.stderr.text(), proc.exited]);
+      const manifestRequests = registryRequests
+        .slice(firstRequest)
+        .filter(({ pathname }) => pathname === "/regular-package")
+        .map(({ accept }) => (accept?.includes("application/vnd.npm.install-v1+json") ? "abbreviated" : "full"));
+      return { stdout, stderr, exitCode, manifestRequests };
+    }
+
+    test("too-recent exact version is blocked when only the abbreviated manifest is cached", async () => {
+      using cache = tempDir("abbreviated-cache", {});
+      using ungated = tempDir("abbreviated-ungated", project({ "regular-package": "3.0.0" }));
+      using gated = tempDir("abbreviated-gated", project({ "regular-package": "3.0.0" }));
+
+      const first = await runWithCache(String(ungated), String(cache), ["install"]);
+      expect(first.manifestRequests).toEqual(["abbreviated"]);
+      expect(first.exitCode).toBe(0);
+
+      const second = await runWithCache(String(gated), String(cache), ["install", ...minAgeArgs]);
+      expect(second.stderr).toMatch(blockedMessage);
+      expect(second.manifestRequests).toEqual(["full"]);
+      expect(await Bun.file(`${gated}/node_modules/regular-package/package.json`).exists()).toBe(false);
+      expect(second.exitCode).toBe(1);
+    });
+
+    test("old enough exact version installs after the full manifest is fetched", async () => {
+      using cache = tempDir("abbreviated-cache-old", {});
+      using ungated = tempDir("abbreviated-ungated-old", project({ "regular-package": "1.0.0" }));
+      using gated = tempDir("abbreviated-gated-old", project({ "regular-package": "1.0.0" }));
+
+      const first = await runWithCache(String(ungated), String(cache), ["install"]);
+      expect(first.manifestRequests).toEqual(["abbreviated"]);
+      expect(first.exitCode).toBe(0);
+
+      const second = await runWithCache(String(gated), String(cache), ["install", ...minAgeArgs]);
+      expect(second.manifestRequests).toEqual(["full"]);
+      expect(await Bun.file(`${gated}/bun.lock`).text()).toContain("regular-package@1.0.0");
+      expect(second.exitCode).toBe(0);
+    });
+
+    test("bun add of a too-recent exact version is blocked when only the abbreviated manifest is cached", async () => {
+      using cache = tempDir("abbreviated-cache-add", {});
+      using ungated = tempDir("abbreviated-ungated-add", project({ "regular-package": "3.0.0" }));
+      using gated = tempDir("abbreviated-gated-add", project({}));
+
+      const first = await runWithCache(String(ungated), String(cache), ["install"]);
+      expect(first.manifestRequests).toEqual(["abbreviated"]);
+      expect(first.exitCode).toBe(0);
+
+      const second = await runWithCache(String(gated), String(cache), ["add", "regular-package@3.0.0", ...minAgeArgs]);
+      expect(second.stderr).toMatch(blockedMessage);
+      expect(second.manifestRequests).toEqual(["full"]);
+      expect(await Bun.file(`${gated}/package.json`).json()).toEqual({ name: "app", dependencies: {} });
+      expect(second.exitCode).toBe(1);
+    });
+
+    test("old enough exact version still resolves from a stale full manifest without a request", async () => {
+      using cache = tempDir("full-cache", {});
+      using first = tempDir("full-first", project({ "regular-package": "1.0.0" }));
+      using second = tempDir("full-second", project({ "regular-package": "1.0.0" }));
+
+      const populate = await runWithCache(String(first), String(cache), ["install", ...minAgeArgs]);
+      expect(populate.manifestRequests).toEqual(["full"]);
+      expect(populate.exitCode).toBe(0);
+
+      const fromCache = await runWithCache(String(second), String(cache), ["install", ...minAgeArgs], { stale: true });
+      expect(fromCache.manifestRequests).toEqual([]);
+      expect(await Bun.file(`${second}/bun.lock`).text()).toContain("regular-package@1.0.0");
+      expect(fromCache.exitCode).toBe(0);
+    });
+
+    test("too-recent exact version is still blocked by a stale full manifest without a request", async () => {
+      using cache = tempDir("full-cache-blocked", {});
+      using first = tempDir("full-first-blocked", project({ "regular-package": "1.0.0" }));
+      using second = tempDir("full-second-blocked", project({ "regular-package": "3.0.0" }));
+
+      const populate = await runWithCache(String(first), String(cache), ["install", ...minAgeArgs]);
+      expect(populate.manifestRequests).toEqual(["full"]);
+      expect(populate.exitCode).toBe(0);
+
+      const fromCache = await runWithCache(String(second), String(cache), ["install", ...minAgeArgs], { stale: true });
+      expect(fromCache.stderr).toMatch(blockedMessage);
+      expect(fromCache.manifestRequests).toEqual([]);
+      expect(await Bun.file(`${second}/node_modules/regular-package/package.json`).exists()).toBe(false);
+      expect(fromCache.exitCode).toBe(1);
+    });
+  });
+
   describe("stability checks", () => {
     test("detects rapid bugfixes and selects stable version", async () => {
       using dir = tempDir("stability-check", {

From 4dbbd3b20d8d05400ef7aa996ccc45f652136993 Mon Sep 17 00:00:00 2001
From: robobun <117481402+robobun@users.noreply.github.com>
Date: Mon, 17 Aug 2026 01:09:01 +0000
Subject: [PATCH 075/258] semver: print the build tag from the printed
 version's buffer in the colored version diff (#38688)

---
 src/semver/Version.rs                         |   9 +--
 test/cli/install/bun-install-registry.test.ts |  32 ++++++++++
 .../build-metadata-1-1.0.0.tgz                | Bin 0 -> 165 bytes
 .../build-metadata-1-1.1.0-rc.0.tgz           | Bin 0 -> 169 bytes
 ...d-metadata-1-1.1.0-rc.1+build.20240101.tgz | Bin 0 -> 178 bytes
 .../packages/build-metadata-1/package.json    |  39 ++++++++++++
 .../create-build-metadata-packages.ts         |  48 ++++++++++++++
 .../cli/update_interactive_formatting.test.ts |  59 ++++++++++++++++++
 8 files changed, 180 insertions(+), 7 deletions(-)
 create mode 100644 test/cli/install/registry/packages/build-metadata-1/build-metadata-1-1.0.0.tgz
 create mode 100644 test/cli/install/registry/packages/build-metadata-1/build-metadata-1-1.1.0-rc.0.tgz
 create mode 100644 test/cli/install/registry/packages/build-metadata-1/build-metadata-1-1.1.0-rc.1+build.20240101.tgz
 create mode 100644 test/cli/install/registry/packages/build-metadata-1/package.json
 create mode 100644 test/cli/install/registry/packages/create-build-metadata-packages.ts

diff --git a/src/semver/Version.rs b/src/semver/Version.rs
index 1744ae6441b7..f87b8a231f80 100644
--- a/src/semver/Version.rs
+++ b/src/semver/Version.rs
@@ -836,14 +836,9 @@ impl<'a, T: VersionInt> fmt::Display for DiffFormatter<'a, T> {
                 }
             } else {
                 if !set_color {
-                    write!(
-                        writer,
-                        concat!(bun_core::pretty_fmt!("<r><b><red>", true), "+{}"),
-                        self.version.tag.build.fmt(self.buf),
-                    )?;
-                } else {
-                    write!(writer, "+{}", self.version.tag.build.fmt(self.other_buf))?;
+                    writer.write_str(bun_core::pretty_fmt!("<r><b><red>", true))?;
                 }
+                write!(writer, "+{}", self.version.tag.build.fmt(self.buf))?;
             }
         }
 
diff --git a/test/cli/install/bun-install-registry.test.ts b/test/cli/install/bun-install-registry.test.ts
index cbc669b91878..5fe42218ac40 100644
--- a/test/cli/install/bun-install-registry.test.ts
+++ b/test/cli/install/bun-install-registry.test.ts
@@ -9600,6 +9600,38 @@ describe("outdated", () => {
     // The catalog grouping should show which workspaces use it
     expect(out).toMatch(/catalog.*workspace-a.*workspace-b|workspace-b.*workspace-a/);
   });
+
+  // The latest build-metadata-1 is 1.1.0-rc.1+build.20240101. Its build tag is
+  // longer than the 8 bytes a semver string stores inline, so printing it reads
+  // from the manifest's string buffer. The colored diff against the current
+  // version has to read it from that buffer too, not from the lockfile's.
+  const buildTagCases = [
+    {
+      current: "1.0.0",
+      // "1." dim, "1.0" yellow (minor bump), then the whole tag red because the
+      // current version has no prerelease.
+      latest: "\x1b[2m1.\x1b[0m\x1b[1m\x1b[33m1.0\x1b[0m\x1b[1m\x1b[31m-rc.1+build.20240101\x1b[0m",
+    },
+    {
+      current: "1.1.0-rc.0",
+      // Same major.minor.patch and prerelease prefix, red from the first
+      // differing prerelease character onwards.
+      latest: "\x1b[2m1.1.0-rc.\x1b[0m\x1b[1m\x1b[31m1+build.20240101\x1b[0m",
+    },
+  ];
+
+  for (const { current, latest } of buildTagCases) {
+    test(`colored latest version keeps its build tag (current ${current})`, async () => {
+      await write(packageJson, JSON.stringify({ name: "foo", dependencies: { "build-metadata-1": current } }));
+      await runBunInstall(env, packageDir);
+
+      const out = await runBunOutdated({ ...env, FORCE_COLOR: "1" }, packageDir);
+      const row = out.split("\n").find(line => line.includes("build-metadata-1"))!;
+      const cells = row.split("│").map(cell => cell.trim());
+      expect(Bun.stripANSI(row)).toContain("1.1.0-rc.1+build.20240101");
+      expect(cells).toEqual(["", "build-metadata-1\x1b[2m\x1b[0m", current, `\x1b[2m${current}\x1b[0m`, latest, ""]);
+    });
+  }
 });
 
 // TODO: setup registry to run across multiple test files, then move this and a few other describe
diff --git a/test/cli/install/registry/packages/build-metadata-1/build-metadata-1-1.0.0.tgz b/test/cli/install/registry/packages/build-metadata-1/build-metadata-1-1.0.0.tgz
new file mode 100644
index 0000000000000000000000000000000000000000..afb86a9acc08dd76842a1e6bb5dc826682b2a011
GIT binary patch
literal 165
zcmb2|=3oGW|8LLl<~rmc;(BrAXVK{^P45{NGX0!=kw?gs|I-G+|FIYJ)-K|xHr;JA
z$4=(lLkaW0t6yfmiTa$l>ec6%9y{IDtL}B*&fR?I_o9N<6{lmSNe6yr{cO>C@Wt)u
z)5Z0VrghvfGr2e|>3ebQ%4@!JoJ5yxC@Y)VaU)yi*sknc&1*|%t@3@x25||L{E*E5
M_}W8z1`P%V0Jc6%umAu6

literal 0
HcmV?d00001

diff --git a/test/cli/install/registry/packages/build-metadata-1/build-metadata-1-1.1.0-rc.0.tgz b/test/cli/install/registry/packages/build-metadata-1/build-metadata-1-1.1.0-rc.0.tgz
new file mode 100644
index 0000000000000000000000000000000000000000..1192632e331b34861871fff4e75b967af37cf428
GIT binary patch
literal 169
zcmb2|=3oGW|8LLl=4)~galN?mXV>hNtnWFDIO~m>3|H73I(+QMd$n5^vrN>gO?TT^
zI%}MN7?Ix|KKb&M@@I!bOwSt`{@Su`)vu5{b<=;@e7{#2IDJ=1y31K{oy#(Ai}Ul>
zp8wk!t&+6+!nJJz)e*D2MYn&IS!K|E<EF1l()zC!rnTwZ8}$l1k0sAs(ff`K;u<LV
P!J7Z{&r7xp8Vn2o0@F&|

literal 0
HcmV?d00001

diff --git a/test/cli/install/registry/packages/build-metadata-1/build-metadata-1-1.1.0-rc.1+build.20240101.tgz b/test/cli/install/registry/packages/build-metadata-1/build-metadata-1-1.1.0-rc.1+build.20240101.tgz
new file mode 100644
index 0000000000000000000000000000000000000000..28f4bb1cce79d9d4b7e8be81a8d833f9dbee3928
GIT binary patch
literal 178
zcmb2|=3oGW|8LLl<~rmc((-WaXOZ??)7O^SJ_oi(ns#j0@Z2JJKei(_N>$-cyz$us
z2HUsTF0I|Wqt-}fclP5tpU~5b1eP}!uA1e#F*GJDH8M1;^VX%Lhc0(n-o?(3S{|R@
zd;V`{y4s`JB`g0%{drbr@&1$d-Q}^bg7fO;b^dU_Th^Za`1&K=hzon}vd!kbD_|;?
Ym1S3L32_#bJkWCQa=(!<g9ZZw03sJqH2?qr

literal 0
HcmV?d00001

diff --git a/test/cli/install/registry/packages/build-metadata-1/package.json b/test/cli/install/registry/packages/build-metadata-1/package.json
new file mode 100644
index 000000000000..0ab1bc99088f
--- /dev/null
+++ b/test/cli/install/registry/packages/build-metadata-1/package.json
@@ -0,0 +1,39 @@
+{
+  "_id": "build-metadata-1",
+  "name": "build-metadata-1",
+  "dist-tags": {
+    "latest": "1.1.0-rc.1+build.20240101"
+  },
+  "versions": {
+    "1.0.0": {
+      "name": "build-metadata-1",
+      "version": "1.0.0",
+      "_id": "build-metadata-1@1.0.0",
+      "dist": {
+        "integrity": "sha512-yANm0z79IFHFdniLr4g0fJqeRSA/ajV9wm82rfNSuGVX2r94YYnEFRssIARO9GdNhfBKfG5+g2ScSNa5E5RGAw==",
+        "shasum": "189a18eea309d671ac7419e4f0d260caaabae519",
+        "tarball": "http://localhost:4873/build-metadata-1/-/build-metadata-1-1.0.0.tgz"
+      }
+    },
+    "1.1.0-rc.0": {
+      "name": "build-metadata-1",
+      "version": "1.1.0-rc.0",
+      "_id": "build-metadata-1@1.1.0-rc.0",
+      "dist": {
+        "integrity": "sha512-SVk+G1ztQh6qjHA1rhwYKgBHr/2PD9WesTKDHwPPIaQ8zcAa0TlphgHbJKb/WTsVhy2/lRhhTQu5OUbxCrpqCw==",
+        "shasum": "c8f1a45157a5f3c2e486bdfbe898304da8c782c5",
+        "tarball": "http://localhost:4873/build-metadata-1/-/build-metadata-1-1.1.0-rc.0.tgz"
+      }
+    },
+    "1.1.0-rc.1+build.20240101": {
+      "name": "build-metadata-1",
+      "version": "1.1.0-rc.1+build.20240101",
+      "_id": "build-metadata-1@1.1.0-rc.1+build.20240101",
+      "dist": {
+        "integrity": "sha512-DPoVrtdy1Md8ZRNEawsVnFtHpZcGWzPzyQCcuz3c2h7wgvAbLHoqxnyFXbDWd0XOJqBsChvwdkJOUFQ+TUQ4Xw==",
+        "shasum": "8cf085a1db2b4366edffb008b6b339ccbdc45f18",
+        "tarball": "http://localhost:4873/build-metadata-1/-/build-metadata-1-1.1.0-rc.1+build.20240101.tgz"
+      }
+    }
+  }
+}
\ No newline at end of file
diff --git a/test/cli/install/registry/packages/create-build-metadata-packages.ts b/test/cli/install/registry/packages/create-build-metadata-packages.ts
new file mode 100644
index 000000000000..2870154f4930
--- /dev/null
+++ b/test/cli/install/registry/packages/create-build-metadata-packages.ts
@@ -0,0 +1,48 @@
+#!/usr/bin/env bun
+/**
+ * Generates the `build-metadata-1` fixture used by the `bun outdated` and
+ * `bun update -i` tests.
+ *
+ * Its `latest` version carries both a prerelease tag and a build tag longer
+ * than 8 bytes. Semver tag strings up to 8 bytes are stored inline; longer ones
+ * are offsets into the string buffer they were parsed from, so printing a tag
+ * against the wrong buffer is only observable with a tag this long.
+ *
+ * - build-metadata-1@1.0.0
+ * - build-metadata-1@1.1.0-rc.0
+ * - build-metadata-1@1.1.0-rc.1+build.20240101   (latest)
+ */
+
+import { mkdir, writeFile } from "fs/promises";
+import { join } from "path";
+
+const name = "build-metadata-1";
+const versionNames = ["1.0.0", "1.1.0-rc.0", "1.1.0-rc.1+build.20240101"];
+
+const dir = join(import.meta.dir, name);
+await mkdir(dir, { recursive: true });
+
+const versions: Record<string, object> = {};
+for (const version of versionNames) {
+  const pkgJson = { name, version };
+  const tarball = join(dir, `${name}-${version}.tgz`);
+  await Bun.Archive.write(tarball, { "package/package.json": JSON.stringify(pkgJson, null, 2) }, { compress: "gzip" });
+
+  const bytes = await Bun.file(tarball).bytes();
+  versions[version] = {
+    ...pkgJson,
+    _id: `${name}@${version}`,
+    dist: {
+      integrity: `sha512-${Buffer.from(new Bun.CryptoHasher("sha512").update(bytes).digest()).toString("base64")}`,
+      shasum: new Bun.CryptoHasher("sha1").update(bytes).digest("hex"),
+      tarball: `http://localhost:4873/${name}/-/${name}-${version}.tgz`,
+    },
+  };
+}
+
+await writeFile(
+  join(dir, "package.json"),
+  JSON.stringify({ _id: name, name, "dist-tags": { latest: versionNames.at(-1) }, versions }, null, 2),
+);
+
+console.log(`Created ${name} test package`);
diff --git a/test/cli/update_interactive_formatting.test.ts b/test/cli/update_interactive_formatting.test.ts
index 13c23db5bfcd..3b7167fd6818 100644
--- a/test/cli/update_interactive_formatting.test.ts
+++ b/test/cli/update_interactive_formatting.test.ts
@@ -148,6 +148,65 @@ describe.concurrent("bun update --interactive", () => {
     expect(exitCode).toBe(0);
   });
 
+  // With colors on, each version is printed as a diff against the current
+  // version. The latest build-metadata-1 is 1.1.0-rc.1+build.20240101, whose
+  // build tag is longer than the 8 bytes a semver string stores inline, so it
+  // has to be read from the latest version's own string, not the current one's.
+  // Needs a real terminal: colors, and a width at which a 25 character version
+  // is not truncated (truncated versions are printed without the diff). Skipped
+  // on Windows because ConPTY rewrites the escape sequences this asserts on.
+  it.skipIf(isWindows)("should keep the build tag of the latest version when rendering with colors", async () => {
+    await using dir = tempDir("update-interactive-build-tag", {
+      "bunfig.toml": bunfig(),
+      "package.json": JSON.stringify({
+        name: "test-project",
+        version: "1.0.0",
+        dependencies: { "build-metadata-1": "1.0.0" },
+      }),
+    });
+
+    await install(dir);
+
+    const decoder = new TextDecoder();
+    let output = "";
+    const tableRendered = Promise.withResolvers<void>();
+    await using proc = Bun.spawn({
+      cmd: [bunExe(), "update", "-i", "--latest", "--dry-run"],
+      cwd: String(dir),
+      env: { ...bunEnv, FORCE_COLOR: "1" },
+      terminal: {
+        cols: 200,
+        rows: 50,
+        data(_terminal, chunk) {
+          output += decoder.decode(chunk, { stream: true });
+          // Every frame ends with a clear-to-end-of-screen before the prompt
+          // blocks on input, so once that follows the row the row is complete.
+          const row = output.indexOf("build-metadata-1");
+          if (row !== -1 && output.includes("\x1b[0J", row)) tableRendered.resolve();
+        },
+        exit() {
+          tableRendered.reject(new Error(`exited before rendering the table:\n${output}`));
+        },
+      },
+    });
+
+    let exitCode: number;
+    try {
+      await tableRendered.promise;
+      proc.terminal!.write("\r");
+      exitCode = await proc.exited;
+    } finally {
+      proc.terminal!.close();
+    }
+
+    const row = output.split(/\r?\n/).find(line => line.includes("build-metadata-1"))!;
+    expect(Bun.stripANSI(row)).toMatch(/build-metadata-1 +1\.0\.0 +1\.0\.0 +1\.1\.0-rc\.1\+build\.20240101/);
+    // "1." dim, "1.0" yellow (minor bump), then the whole tag red because
+    // 1.0.0 has no prerelease.
+    expect(row).toContain("\x1b[2m1.\x1b[0m\x1b[1m\x1b[33m1.0\x1b[0m\x1b[1m\x1b[31m-rc.1+build.20240101\x1b[0m");
+    expect(exitCode).toBe(0);
+  });
+
   // The header's help-text budget is `terminal_width - 30`; on a tty narrower
   // than 30 columns that usize subtraction overflows (panics on overflow-checks
   // builds). Exercise the render path through a 20-column pty.

From 0e7bc38c93acd924ff7e284ec7474011156ca666 Mon Sep 17 00:00:00 2001
From: robobun <117481402+robobun@users.noreply.github.com>
Date: Mon, 17 Aug 2026 01:09:08 +0000
Subject: [PATCH 076/258] test(install): serve URL tarball dependencies locally
 in bun-install.test.ts (#37919)

---
 test/cli/install/bun-install.test.ts | 264 ++++++++++++++-------------
 1 file changed, 140 insertions(+), 124 deletions(-)

diff --git a/test/cli/install/bun-install.test.ts b/test/cli/install/bun-install.test.ts
index 817c06db84c6..0e0f843e6ea5 100644
--- a/test/cli/install/bun-install.test.ts
+++ b/test/cli/install/bun-install.test.ts
@@ -182,6 +182,39 @@ function serveDirectory(root: string) {
   });
 }
 
+/**
+ * Serves URL dependencies (`http://github.com/<user>/<repo>/tarball/<ref>`, `http://some.url/path?stuff`) without
+ * the network. `bun install` downloads such URLs as-is (there is no `GITHUB_API_URL` equivalent to point at a test
+ * server), so the returned `env` instead points the install's `http_proxy` at this server. A proxied plain-http
+ * request arrives in absolute form, so `request.url` is the dependency URL itself and the specifiers keep the real
+ * hosts bun classifies them by. The dependencies must use `http://`: `https://` would be tunneled (CONNECT) to the
+ * real host. Every URL seen is pushed to `urls`. A URL registered with a file map is answered with a gzipped tarball of
+ * those files, one registered with a `Response` (e.g. a redirect) with that response, anything else with a 404. The
+ * context's registry bypasses the proxy, so its `urls`/`requested` are unaffected.
+ */
+function urlTarballProxy(
+  ctx: TestContext,
+  urls: string[],
+  responses: Record<string, Record<string, string> | Response>,
+) {
+  const server = Bun.serve({
+    port: 0,
+    async fetch(request) {
+      urls.push(request.url);
+      const registered = responses[request.url];
+      if (!registered) return new Response(`nothing registered for ${request.url}`, { status: 404 });
+      if (registered instanceof Response) return registered.clone();
+      return new Response(await new Bun.Archive(registered, { compress: "gzip" }).bytes());
+    },
+  });
+  const proxy_url = server.url.href.replace(/\/+$/, "");
+  const registry_host = new URL(ctx.registry_url).hostname;
+  return {
+    env: { ...env, http_proxy: proxy_url, HTTP_PROXY: proxy_url, no_proxy: registry_host, NO_PROXY: registry_host },
+    [Symbol.asyncDispose]: () => server.stop(true),
+  };
+}
+
 describe.concurrent("bun-install", () => {
   it("bun install --help states the --network-concurrency default that bun install actually uses", async () => {
     await using help = spawn({
@@ -4564,126 +4597,96 @@ describe.concurrent("bun-install", () => {
     });
   });
 
-  it("should handle GitHub tarball URL in dependencies (https://github.com/user/repo/tarball/ref)", async () => {
-    await withContext(defaultOpts, async ctx => {
-      const urls: string[] = [];
-      setContextHandler(ctx, dummyRegistryForContext(ctx, urls));
-      await writeFile(
-        join(ctx.package_dir, "package.json"),
-        JSON.stringify({
-          name: "Foo",
-          version: "0.0.1",
-          dependencies: {
-            when: "https://github.com/cujojs/when/tarball/1.0.2",
-          },
-        }),
-      );
-      const { stdout, stderr, exited } = spawn({
-        cmd: [bunExe(), "install"],
-        cwd: ctx.package_dir,
-        stdout: "pipe",
-        stdin: "pipe",
-        stderr: "pipe",
-        env,
-      });
-      const err = await stderr.text();
-      expect(err).toContain("Saved lockfile");
-      let out = await stdout.text();
-      out = out.replace(/\s*\[[0-9\.]+m?s\]\s*$/, "");
-      out = out.replace(/(github:[^#]+)#[a-f0-9]+/, "$1");
-      expect(out.split(/\r?\n/)).toEqual([
-        expect.stringContaining("bun install v1."),
-        "",
-        "+ when@https://github.com/cujojs/when/tarball/1.0.2",
-        "",
-        "1 package installed",
-      ]);
-      expect(await exited).toBe(0);
-      expect(urls.sort()).toBeEmpty();
-      expect(ctx.requested).toBe(0);
-      expect(await readdirSorted(join(ctx.package_dir, "node_modules"))).toEqual([".cache", "when"]);
-      expect(await readdirSorted(join(ctx.package_dir, "node_modules", "when"))).toEqual([
-        ".gitignore",
-        ".gitmodules",
-        "LICENSE.txt",
-        "README.md",
-        "apply.js",
-        "cancelable.js",
-        "delay.js",
-        "package.json",
-        "test",
-        "timed.js",
-        "timeout.js",
-        "when.js",
-      ]);
-      const package_json = await file(join(ctx.package_dir, "node_modules", "when", "package.json")).json();
-      expect(package_json.name).toBe("when");
-      await access(join(ctx.package_dir, "bun.lockb"));
-    });
-  });
-
-  it("should handle GitHub tarball URL in dependencies (https://github.com/user/repo/tarball/ref) with custom GITHUB_API_URL", async () => {
-    await withContext(defaultOpts, async ctx => {
-      const urls: string[] = [];
-      setContextHandler(ctx, dummyRegistryForContext(ctx, urls));
-      await writeFile(
-        join(ctx.package_dir, "package.json"),
-        JSON.stringify({
-          name: "Foo",
-          version: "0.0.1",
-          dependencies: {
-            when: "https://github.com/cujojs/when/tarball/1.0.2",
-          },
-        }),
-      );
-      const { stdout, stderr, exited } = spawn({
-        cmd: [bunExe(), "install"],
-        cwd: ctx.package_dir,
-        stdout: "pipe",
-        stdin: "pipe",
-        stderr: "pipe",
-        env: {
-          ...env,
-          GITHUB_API_URL: "https://example.com/github/api",
-        },
-      });
-      const err = await stderr.text();
-      expect(err).toContain("Saved lockfile");
-      let out = await stdout.text();
-      out = out.replace(/\s*\[[0-9\.]+m?s\]\s*$/, "");
-      out = out.replace(/(github:[^#]+)#[a-f0-9]+/, "$1");
-      expect(out.split(/\r?\n/)).toEqual([
-        expect.stringContaining("bun install v1."),
-        "",
-        "+ when@https://github.com/cujojs/when/tarball/1.0.2",
-        "",
-        "1 package installed",
-      ]);
-      expect(await exited).toBe(0);
-      expect(urls.sort()).toBeEmpty();
-      expect(ctx.requested).toBe(0);
-      expect(await readdirSorted(join(ctx.package_dir, "node_modules"))).toEqual([".cache", "when"]);
-      expect(await readdirSorted(join(ctx.package_dir, "node_modules", "when"))).toEqual([
-        ".gitignore",
-        ".gitmodules",
-        "LICENSE.txt",
-        "README.md",
-        "apply.js",
-        "cancelable.js",
-        "delay.js",
-        "package.json",
-        "test",
-        "timed.js",
-        "timeout.js",
-        "when.js",
-      ]);
-      const package_json = await file(join(ctx.package_dir, "node_modules", "when", "package.json")).json();
-      expect(package_json.name).toBe("when");
-      await access(join(ctx.package_dir, "bun.lockb"));
-    });
-  });
+  // The second variant also sets GITHUB_API_URL: it only applies to `github:` dependencies, so the tarball URL
+  // must still be fetched verbatim (any request reaching the local stand-in would show up in `urls`).
+  for (const with_github_api_url of [false, true]) {
+    it(
+      "should handle GitHub tarball URL in dependencies (http://github.com/user/repo/tarball/ref)" +
+        (with_github_api_url ? " with custom GITHUB_API_URL" : ""),
+      async () => {
+        await withContext(defaultOpts, async ctx => {
+          const urls: string[] = [];
+          setContextHandler(ctx, dummyRegistryForContext(ctx, urls));
+          const tarball_url = "http://github.com/cujojs/when/tarball/1.0.2";
+          // github.com answers /tarball/ URLs with a redirect to codeload.github.com, whose tarballs have a single
+          // `<user>-<repo>-<short commit>` root directory.
+          const codeload_url = "http://codeload.github.com/cujojs/when/legacy.tar.gz/refs/tags/1.0.2";
+          const proxied_urls: string[] = [];
+          await using proxy = urlTarballProxy(ctx, proxied_urls, {
+            [tarball_url]: new Response(null, { status: 302, headers: { Location: codeload_url } }),
+            [codeload_url]: {
+              "cujojs-when-1a2b3c4/.gitignore": "",
+              "cujojs-when-1a2b3c4/.gitmodules": "",
+              "cujojs-when-1a2b3c4/LICENSE.txt": "",
+              "cujojs-when-1a2b3c4/README.md": "",
+              "cujojs-when-1a2b3c4/apply.js": "",
+              "cujojs-when-1a2b3c4/cancelable.js": "",
+              "cujojs-when-1a2b3c4/delay.js": "",
+              "cujojs-when-1a2b3c4/package.json": JSON.stringify({ name: "when", version: "1.0.2" }),
+              "cujojs-when-1a2b3c4/test/when-test.js": "",
+              "cujojs-when-1a2b3c4/timed.js": "",
+              "cujojs-when-1a2b3c4/timeout.js": "",
+              "cujojs-when-1a2b3c4/when.js": "",
+            },
+          });
+          await writeFile(
+            join(ctx.package_dir, "package.json"),
+            JSON.stringify({
+              name: "Foo",
+              version: "0.0.1",
+              dependencies: {
+                when: tarball_url,
+              },
+            }),
+          );
+          const { stdout, stderr, exited } = spawn({
+            cmd: [bunExe(), "install"],
+            cwd: ctx.package_dir,
+            stdout: "pipe",
+            stdin: "pipe",
+            stderr: "pipe",
+            env: with_github_api_url ? { ...proxy.env, GITHUB_API_URL: `${ctx.registry_url}github/api` } : proxy.env,
+          });
+          const err = await stderr.text();
+          expect(err).toContain("Saved lockfile");
+          let out = await stdout.text();
+          out = out.replace(/\s*\[[0-9\.]+m?s\]\s*$/, "");
+          out = out.replace(/(github:[^#]+)#[a-f0-9]+/, "$1");
+          expect(out.split(/\r?\n/)).toEqual([
+            expect.stringContaining("bun install v1."),
+            "",
+            `+ when@${tarball_url}`,
+            "",
+            "1 package installed",
+          ]);
+          expect(await exited).toBe(0);
+          expect(proxied_urls).toEqual([tarball_url, codeload_url]);
+          expect(urls.sort()).toBeEmpty();
+          expect(ctx.requested).toBe(0);
+          expect(await readdirSorted(join(ctx.package_dir, "node_modules"))).toEqual([".cache", "when"]);
+          expect(await readdirSorted(join(ctx.package_dir, "node_modules", "when"))).toEqual([
+            ".gitignore",
+            ".gitmodules",
+            "LICENSE.txt",
+            "README.md",
+            "apply.js",
+            "cancelable.js",
+            "delay.js",
+            "package.json",
+            "test",
+            "timed.js",
+            "timeout.js",
+            "when.js",
+          ]);
+          const package_json = await file(join(ctx.package_dir, "node_modules", "when", "package.json")).json();
+          expect(package_json.name).toBe("when");
+          await access(join(ctx.package_dir, "bun.lockb"));
+        });
+      },
+    );
+  }
 
-  it("should treat non-GitHub http(s) URLs as tarballs (https://some.url/path?stuff)", async () => {
+  it("should treat non-GitHub http(s) URLs as tarballs (http://some.url/path?stuff)", async () => {
     await withContext(defaultOpts, async ctx => {
       const urls: string[] = [];
       setContextHandler(
@@ -4692,14 +4695,26 @@ describe.concurrent("bun-install", () => {
           "4.3.0": { as: "4.3.0" },
         }),
       );
+      const tarball_url = "http://gitpkg-fork.vercel.sh/vercel/turbo/crates/turbopack-node/js?turbopack-230922.2";
+      const proxied_urls: string[] = [];
+      await using proxy = urlTarballProxy(ctx, proxied_urls, {
+        [tarball_url]: {
+          "package/package.json": JSON.stringify({
+            name: "@vercel/turbopack-node",
+            version: "0.0.0",
+            dependencies: { "loader-runner": "^4.3.0" },
+          }),
+          "package/src/index.ts": "",
+          "package/tsconfig.json": "{}",
+        },
+      });
       await writeFile(
         join(ctx.package_dir, "package.json"),
         JSON.stringify({
           name: "Foo",
           version: "0.0.1",
           dependencies: {
-            "@vercel/turbopack-node":
-              "https://gitpkg-fork.vercel.sh/vercel/turbo/crates/turbopack-node/js?turbopack-230922.2",
+            "@vercel/turbopack-node": tarball_url,
           },
         }),
       );
@@ -4709,7 +4724,7 @@ describe.concurrent("bun-install", () => {
         stdout: "pipe",
         stdin: "pipe",
         stderr: "pipe",
-        env,
+        env: proxy.env,
       });
       const err = await stderr.text();
       expect(err).toContain("Saved lockfile");
@@ -4719,12 +4734,13 @@ describe.concurrent("bun-install", () => {
       expect(out.split(/\r?\n/)).toEqual([
         expect.stringContaining("bun install v1."),
         "",
-        "+ @vercel/turbopack-node@https://gitpkg-fork.vercel.sh/vercel/turbo/crates/turbopack-node/js?turbopack-230922.2",
+        `+ @vercel/turbopack-node@${tarball_url}`,
         "",
         "2 packages installed",
       ]);
       expect(await exited).toBe(0);
-      expect(urls.sort()).toHaveLength(2);
+      expect(proxied_urls).toEqual([tarball_url]);
+      expect(urls.sort()).toEqual([`${ctx.registry_url}loader-runner`, `${ctx.registry_url}loader-runner-4.3.0.tgz`]);
       expect(ctx.requested).toBe(2);
       expect(await readdirSorted(join(ctx.package_dir, "node_modules"))).toEqual([
         ".cache",

From d9e8908501fb60901cf7e8ee99f35359a31813f9 Mon Sep 17 00:00:00 2001
From: robobun <117481402+robobun@users.noreply.github.com>
Date: Mon, 17 Aug 2026 01:09:11 +0000
Subject: [PATCH 077/258] test(install): keep bun-update-security-provider on
 the dummy registry, assert the update, run concurrently (#38185)

---
 .../bun-update-security-provider.test.ts      | 272 +++++++++---------
 1 file changed, 139 insertions(+), 133 deletions(-)

diff --git a/test/cli/install/bun-update-security-provider.test.ts b/test/cli/install/bun-update-security-provider.test.ts
index 4ea1f4792849..9885fbe86672 100644
--- a/test/cli/install/bun-update-security-provider.test.ts
+++ b/test/cli/install/bun-update-security-provider.test.ts
@@ -1,152 +1,158 @@
-import { afterAll, afterEach, beforeAll, beforeEach, expect, test } from "bun:test";
-import { bunEnv, bunExe } from "harness";
+import { file } from "bun";
+import { afterAll, beforeAll, expect, test } from "bun:test";
+import { bunEnv, bunExe, normalizeBunSnapshot } from "harness";
+import { join } from "node:path";
 import {
+  createTestContext,
+  destroyTestContext,
   dummyAfterAll,
-  dummyAfterEach,
   dummyBeforeAll,
-  dummyBeforeEach,
-  dummyRegistry,
-  package_dir,
-  setHandler,
-  write,
+  dummyRegistryForContext,
+  setContextHandler,
+  type TestContext,
 } from "./dummy.registry.js";
 
 beforeAll(dummyBeforeAll);
 afterAll(dummyAfterAll);
-beforeEach(async () => {
-  await dummyBeforeEach();
-});
-afterEach(dummyAfterEach);
-
-test("security scanner blocks bun update on fatal advisory", async () => {
-  const urls: string[] = [];
-  setHandler(
-    dummyRegistry(urls, {
-      "0.1.0": {},
-      "0.2.0": {},
-    }),
-  );
-
-  const scannerCode = `
-    export const scanner = {
-      version: "1",
-      scan: async ({ packages }) => {
-        if (packages.length === 0) return [];
-        return [
-          {
-            package: "moo",
-            description: "Fatal security issue detected",
-            level: "fatal",
-            url: "https://example.com/critical",
-          },
-        ];
-      },
-    };
-  `;
 
-  await write("./scanner.ts", scannerCode);
-  await write("package.json", {
-    name: "my-app",
-    version: "1.0.0",
-    dependencies: {
-      moo: "0.1.0",
+// Reports what it was asked to scan, then flags all of it as fatal: an update
+// that consults this scanner cannot succeed, so a successful update proves the
+// scanner was never run.
+const scannerSource = `
+  export const scanner = {
+    version: "1",
+    scan: async ({ packages }) => {
+      console.log("scanner received: " + packages.map(pkg => pkg.name + "@" + pkg.version).join(", "));
+      return packages.map(pkg => ({
+        package: pkg.name,
+        description: "Fatal security issue detected",
+        level: "fatal",
+        url: "https://example.com/critical",
+      }));
     },
-  });
-
-  // First install without security scanning (to have something to update)
-  await using installProc = Bun.spawn({
-    cmd: [bunExe(), "install", "--no-summary"],
-    env: bunEnv,
-    cwd: package_dir,
-    stdout: "pipe",
-    stderr: "pipe",
-  });
-
-  await installProc.stdout.text();
-  await installProc.stderr.text();
-  await installProc.exited;
-
-  await write(
-    "./bunfig.toml",
-    `
-[install]
-saveTextLockfile = false
-
-[install.security]
-scanner = "./scanner.ts"
-`,
-  );
-
-  await using updateProc = Bun.spawn({
-    cmd: [bunExe(), "update", "moo"],
-    env: bunEnv,
-    cwd: package_dir,
-    stdout: "pipe",
-    stderr: "pipe",
-  });
-
-  const [updateOut, updateErr, updateExitCode] = await Promise.all([
-    updateProc.stdout.text(),
-    updateProc.stderr.text(),
-    updateProc.exited,
+  };
+`;
+
+// The three things `bun update moo` changes: the package.json range, the
+// lockfile resolution and the package on disk. Every test starts from this state.
+const installedState = { range: ">=0.1.0", locked: "moo@0.1.0", installed: "0.1.0" };
+
+async function mooState(ctx: TestContext) {
+  const [packageJson, lockfile, installed] = await Promise.all([
+    file(join(ctx.package_dir, "package.json")).json(),
+    file(join(ctx.package_dir, "bun.lock")).text(),
+    file(join(ctx.package_dir, "node_modules/moo/package.json")).json(),
   ]);
-
-  expect(updateOut).toContain("FATAL: moo");
-  expect(updateOut).toContain("Fatal security issue detected");
-  expect(updateOut).toContain("Installation aborted due to fatal security advisories");
-
-  expect(updateExitCode).toBe(1);
-});
-
-test("security scanner does not run on bun update when disabled", async () => {
+  return {
+    range: packageJson.dependencies.moo,
+    locked: (Bun.JSONC.parse(lockfile) as { packages: Record<string, [string, ...unknown[]]> }).packages.moo[0],
+    installed: installed.version,
+  };
+}
+
+// Writes out what `bun install` leaves behind for `installedState` (the
+// lockfile and node_modules entry are what it writes against this registry),
+// which saves spawning an install per test. The registry has since published
+// 0.2.0. The scanner file always exists; only bunfig.toml decides whether bun
+// uses it.
+async function projectWithMooInstalled({ scanner }: { scanner: boolean }) {
+  const ctx = await createTestContext();
   const urls: string[] = [];
-  setHandler(
-    dummyRegistry(urls, {
-      "0.1.0": {},
-      "0.2.0": {},
+  setContextHandler(ctx, dummyRegistryForContext(ctx, urls, { "0.1.0": {}, "0.2.0": {} }));
+
+  const files = {
+    "bunfig.toml": Bun.TOML.stringify({
+      install: {
+        // Without this, manifests and tarballs come from the machine-wide cache
+        // and the requests asserted below never reach the registry.
+        cache: false,
+        registry: ctx.registry_url,
+        security: scanner ? { scanner: "./scanner.ts" } : undefined,
+      },
+    })!,
+    "scanner.ts": scannerSource,
+    "package.json": JSON.stringify({ name: "my-app", version: "1.0.0", dependencies: { moo: installedState.range } }),
+    "bun.lock": JSON.stringify({
+      lockfileVersion: 1,
+      configVersion: 1,
+      workspaces: { "": { name: "my-app", dependencies: { moo: installedState.range } } },
+      packages: { moo: [installedState.locked, `${ctx.registry_url}moo-${installedState.installed}.tgz`, {}, ""] },
     }),
-  );
-
-  await write("package.json", {
-    name: "my-app",
-    version: "1.0.0",
-    dependencies: {
-      moo: "0.1.0",
-    },
-  });
-
-  // Remove bunfig.toml to ensure no security scanner
-  await write("bunfig.toml", "");
-
-  await using installProc = Bun.spawn({
-    cmd: [bunExe(), "install", "--no-summary"],
-    env: bunEnv,
-    cwd: package_dir,
-    stdout: "pipe",
-    stderr: "pipe",
-  });
-
-  await installProc.stdout.text();
-  await installProc.stderr.text();
-  await installProc.exited;
-
-  await using updateProc = Bun.spawn({
+    "node_modules/moo/package.json": JSON.stringify({ name: "moo", version: installedState.installed }),
+  };
+  await Promise.all(Object.entries(files).map(([name, contents]) => Bun.write(join(ctx.package_dir, name), contents)));
+  return { ctx, urls };
+}
+
+async function updateMoo(ctx: TestContext) {
+  await using proc = Bun.spawn({
     cmd: [bunExe(), "update", "moo"],
+    cwd: ctx.package_dir,
     env: bunEnv,
-    cwd: package_dir,
     stdout: "pipe",
     stderr: "pipe",
   });
+  const [stdout, stderr, exitCode] = await Promise.all([proc.stdout.text(), proc.stderr.text(), proc.exited]);
+  return {
+    stdout: normalizeBunSnapshot(stdout),
+    // Only printed when the scanner takes over a second, i.e. on slow debug builds.
+    stderr: normalizeBunSnapshot(stderr.replace(/^\[\.\/scanner\.ts\] Scanning 1 package took \d+ms\r?\n/m, "")),
+    exitCode,
+  };
+}
+
+test.concurrent("security scanner blocks bun update on fatal advisory", async () => {
+  const { ctx, urls } = await projectWithMooInstalled({ scanner: true });
+  try {
+    const { stdout, stderr, exitCode } = await updateMoo(ctx);
+    expect(stdout).toMatchInlineSnapshot(`
+      "bun update <version> (<revision>)
+      scanner received: moo@0.2.0
+
+        FATAL: moo
+          via my-app › moo
+          Fatal security issue detected
+          https://example.com/critical
+
+      1 advisory (1 fatal)
+      Installation aborted due to fatal security advisories"
+    `);
+    expect(stderr).toMatchInlineSnapshot(`
+      "Resolving dependencies
+      Resolved, downloaded and extracted [2]"
+    `);
+    expect(exitCode).toBe(1);
+
+    // The advisory stopped the update right after resolution: the 0.2.0
+    // tarball was never downloaded and nothing on disk moved off 0.1.0.
+    expect(urls).toEqual([`${ctx.registry_url}moo`]);
+    expect(await mooState(ctx)).toEqual(installedState);
+  } finally {
+    destroyTestContext(ctx);
+  }
+});
 
-  const [updateOut, updateErr, updateExitCode] = await Promise.all([
-    updateProc.stdout.text(),
-    updateProc.stderr.text(),
-    updateProc.exited,
-  ]);
-
-  expect(updateOut).not.toContain("Security scanner");
-  expect(updateOut).not.toContain("WARN:");
-  expect(updateOut).not.toContain("FATAL:");
-
-  expect(updateExitCode).toBe(0);
+test.concurrent("security scanner does not run on bun update when not configured", async () => {
+  const { ctx, urls } = await projectWithMooInstalled({ scanner: false });
+  try {
+    const { stdout, stderr, exitCode } = await updateMoo(ctx);
+    expect(stdout).toMatchInlineSnapshot(`
+      "bun update <version> (<revision>)
+
+      installed moo@0.2.0
+
+      1 package installed"
+    `);
+    expect(stderr).toMatchInlineSnapshot(`
+      "Resolving dependencies
+      Resolved, downloaded and extracted [4]
+      Saved lockfile"
+    `);
+    expect(exitCode).toBe(0);
+
+    expect(urls).toEqual([`${ctx.registry_url}moo`, `${ctx.registry_url}moo-0.2.0.tgz`]);
+    expect(await mooState(ctx)).toEqual({ range: "^0.2.0", locked: "moo@0.2.0", installed: "0.2.0" });
+  } finally {
+    destroyTestContext(ctx);
+  }
 });

From b0cbf87c14f52fffaf3cc6e9c3e417934e12b3cf Mon Sep 17 00:00:00 2001
From: robobun <117481402+robobun@users.noreply.github.com>
Date: Mon, 17 Aug 2026 01:09:15 +0000
Subject: [PATCH 078/258] test(install): give each long-label bun patch test
 its own install cache (#38255)

---
 test/cli/install/bun-patch.test.ts | 45 +++++++++++++++++-------------
 test/harness.ts                    | 10 ++++++-
 2 files changed, 34 insertions(+), 21 deletions(-)

diff --git a/test/cli/install/bun-patch.test.ts b/test/cli/install/bun-patch.test.ts
index ec6b0b5a061c..ea9c81fbae6a 100644
--- a/test/cli/install/bun-patch.test.ts
+++ b/test/cli/install/bun-patch.test.ts
@@ -85,22 +85,25 @@ describe("packages whose label is longer than 1024 bytes", () => {
   // on every platform while the recorded spec stays long.
   const longSpec = (tarball: string) => `./${Buffer.alloc(1050, "x/../").toString()}${tarball}`;
 
-  async function createProject(tarball: string, packageJson: Record<string, unknown>) {
-    const { packageDir } = await registry.createTestDir({
+  type Project = Awaited<ReturnType<VerdaccioRegistry["createTestDir"]>>;
+
+  // Two of these concurrent tests install `bar` from the identical spec, so every command runs with
+  // the project's own cache (`project.env`) rather than the cache CI shares across the whole file.
+  function createProject(tarball: string, packageJson: Record<string, unknown>): Promise<Project> {
+    return registry.createTestDir({
       bunfigOpts: { linker: "hoisted" },
       files: {
         "package.json": JSON.stringify(packageJson),
         [tarball]: readFileSync(join(import.meta.dir, tarball)),
       },
     });
-    return packageDir;
   }
 
-  async function runBun(cwd: string, ...args: string[]) {
+  async function runBun({ packageDir, env }: Project, ...args: string[]) {
     await using proc = Bun.spawn({
       cmd: [bunExe(), ...args],
-      cwd,
-      env: bunEnv,
+      cwd: packageDir,
+      env,
       stdout: "pipe",
       stderr: "pipe",
     });
@@ -108,18 +111,18 @@ describe("packages whose label is longer than 1024 bytes", () => {
     return { stdout, stderr, exitCode };
   }
 
-  async function install(cwd: string) {
-    const { stderr, exitCode } = await runBun(cwd, "install");
+  async function install(project: Project) {
+    const { stderr, exitCode } = await runBun(project, "install");
     expect(stderr).not.toContain("error:");
-    expect(exitCode).toBe(0);
+    expect(exitCode, stderr).toBe(0);
   }
 
   test.concurrent("bun patch <name>@<label>", async () => {
     const spec = longSpec("bar-0.0.2.tgz");
-    const packageDir = await createProject("bar-0.0.2.tgz", { name: "foo", dependencies: { bar: spec } });
-    await install(packageDir);
+    const project = await createProject("bar-0.0.2.tgz", { name: "foo", dependencies: { bar: spec } });
+    await install(project);
 
-    const { stdout, stderr, exitCode } = await runBun(packageDir, "patch", `bar@${spec}`);
+    const { stdout, stderr, exitCode } = await runBun(project, "patch", `bar@${spec}`);
     expect(stderr).not.toContain("error:");
     expect(stdout).toContain("To patch bar, edit the following folder:\n\n  node_modules/bar\n");
     expect(exitCode).toBe(0);
@@ -130,20 +133,21 @@ describe("packages whose label is longer than 1024 bytes", () => {
   // The lockfile lists the long-labeled `bar` before `bar-from-npm`, so both commands
   // format the long label before reaching the package that matches.
   test.concurrent("bun patch <path> when another package with the same name has a long label", async () => {
-    const packageDir = await createProject("bar-0.0.2.tgz", {
+    const project = await createProject("bar-0.0.2.tgz", {
       name: "foo",
       dependencies: { "bar": longSpec("bar-0.0.2.tgz"), "bar-from-npm": "npm:bar@0.0.7" },
     });
-    await install(packageDir);
+    const { packageDir } = project;
+    await install(project);
 
-    const prepare = await runBun(packageDir, "patch", "node_modules/bar-from-npm");
+    const prepare = await runBun(project, "patch", "node_modules/bar-from-npm");
     expect(prepare.stderr).not.toContain("error:");
     expect(prepare.stdout).toContain("To patch bar, edit the following folder:\n\n  node_modules/bar-from-npm\n");
     expect(prepare.exitCode).toBe(0);
 
     await Bun.write(join(packageDir, "node_modules", "bar-from-npm", "index.js"), "module.exports = 'patched';\n");
 
-    const commit = await runBun(packageDir, "patch", "--commit", "node_modules/bar-from-npm");
+    const commit = await runBun(project, "patch", "--commit", "node_modules/bar-from-npm");
     expect(commit.stderr).not.toContain("error:");
     expect(commit.exitCode).toBe(0);
     expect((await Bun.file(join(packageDir, "package.json")).json()).patchedDependencies).toEqual({
@@ -159,16 +163,17 @@ describe("packages whose label is longer than 1024 bytes", () => {
   // system accepts at this length), so what is pinned here is that it fails at that step.
   test.concurrent("bun patch --commit of a long-labeled package exits 1 without recording a patch", async () => {
     const packageJson = { name: "foo", dependencies: { baz: longSpec("baz-0.0.3.tgz") } };
-    const packageDir = await createProject("baz-0.0.3.tgz", packageJson);
-    await install(packageDir);
+    const project = await createProject("baz-0.0.3.tgz", packageJson);
+    const { packageDir } = project;
+    await install(project);
 
-    const prepare = await runBun(packageDir, "patch", "node_modules/baz");
+    const prepare = await runBun(project, "patch", "node_modules/baz");
     expect(prepare.stderr).not.toContain("error:");
     expect(prepare.exitCode).toBe(0);
 
     await Bun.write(join(packageDir, "node_modules", "baz", "index.js"), "console.log('patched baz');\n");
 
-    const commit = await runBun(packageDir, "patch", "--commit", "node_modules/baz");
+    const commit = await runBun(project, "patch", "--commit", "node_modules/baz");
     expect(commit.stderr).toContain("failed renaming patch file to patches dir");
     expect(commit.exitCode).toBe(1);
     expect(await Bun.file(join(packageDir, "package.json")).json()).toEqual(packageJson);
diff --git a/test/harness.ts b/test/harness.ts
index c2034a71319c..77674afa7606 100644
--- a/test/harness.ts
+++ b/test/harness.ts
@@ -1999,7 +1999,15 @@ export class VerdaccioRegistry {
     const packageJson = join(packageDir, "package.json");
     await this.writeBunfig(packageDir, opts.bunfigOpts);
     this.users = {};
-    return { packageDir: String(packageDir), packageJson };
+    const dir = String(packageDir);
+    return {
+      packageDir: dir,
+      packageJson,
+      // The `install.cache` writeBunfig sets loses to the BUN_INSTALL_CACHE_DIR the CI runner exports, so
+      // projects spawned with plain bunEnv share one cache per test file. Projects that install concurrently
+      // spawn bun with this env instead: concurrent installs publishing the same entry fail on Windows (#28062).
+      env: { ...bunEnv, BUN_INSTALL_CACHE_DIR: join(dir, ".bun-cache") },
+    };
   }
 
   async writeBunfig(dir: string, opts: BunfigOpts = {}) {

From 4a95e9e476c922251203ddf3bec90f720a85c4e6 Mon Sep 17 00:00:00 2001
From: robobun <117481402+robobun@users.noreply.github.com>
Date: Mon, 17 Aug 2026 01:09:20 +0000
Subject: [PATCH 079/258] test(bunx): install fixture packages from a local
 registry instead of real ones (#38467)

---
 test/cli/install/bunx.test.ts | 524 +++++++++++++++++++++++-----------
 1 file changed, 361 insertions(+), 163 deletions(-)

diff --git a/test/cli/install/bunx.test.ts b/test/cli/install/bunx.test.ts
index ec0a9fb5a508..af9c67bfcab9 100644
--- a/test/cli/install/bunx.test.ts
+++ b/test/cli/install/bunx.test.ts
@@ -40,6 +40,107 @@ function pathWithout(name: string, PATH: string | undefined): string {
     .join(delimiter);
 }
 
+// Cases that need bunx to install something get a per-test in-process registry
+// serving throwaway packages: what they assert is bunx's own behavior (name ->
+// bin resolution, the bunx cache, argument passthrough), and installing real
+// packages made the file's cost scale with their dependency trees instead
+// (@angular/cli alone was ~21k files per run to extract and, once the CI runner
+// removes TMPDIR, delete again). dummy.registry's per-test contexts only serve
+// the .tgz files checked in next to it, answer every package name with the same
+// version list, and have no GitHub shape; these generate the tarballs instead,
+// and `requests` lets a case prove that a second run came from the bunx cache.
+
+type FixturePackage = {
+  name: string;
+  version: string;
+  bin?: Record<string, string>;
+  dependencies?: Record<string, string>;
+  scripts?: Record<string, string>;
+  /** Contents of the package besides its generated package.json. */
+  files: Record<string, string>;
+};
+
+/** A bin script that prints `<label>` followed by the arguments it was invoked with. */
+function echoBin(label: string): string {
+  return `#!/usr/bin/env node\nconsole.log(${JSON.stringify(label)}, ...process.argv.slice(2));\n`;
+}
+
+function fixturePackage(
+  name: string,
+  version: string,
+  binName: string,
+  binScript: string = echoBin(`${binName} ${version}`),
+): FixturePackage {
+  return { name, version, bin: { [binName]: "cli.js" }, files: { "cli.js": binScript } };
+}
+
+/**
+ * A .tgz with every entry under `root/`: `package/` for npm tarballs,
+ * `<owner>-<repo>-<commit>/` for GitHub's. The directory entry comes first
+ * because bun install reads a GitHub tarball's first entry as that root.
+ */
+function tarball(root: string, files: Record<string, string>): Promise<Uint8Array<ArrayBuffer>> {
+  const entries: Record<string, string> = { [`${root}/`]: "" };
+  for (const [path, contents] of Object.entries(files)) entries[`${root}/${path}`] = contents;
+  return new Bun.Archive(entries, { compress: "gzip" }).bytes();
+}
+
+function fixtureServer(handler: (pathname: string) => Uint8Array<ArrayBuffer> | object | undefined) {
+  const requests: string[] = [];
+  const server = Bun.serve({
+    port: 0,
+    fetch(request) {
+      const { pathname } = new URL(request.url);
+      requests.push(pathname);
+      const body = handler(pathname);
+      if (body === undefined) return new Response(`no fixture for ${pathname}`, { status: 404 });
+      return body instanceof Uint8Array ? new Response(body) : Response.json(body);
+    },
+  });
+  return {
+    /** Every request path received so far, in order. */
+    requests,
+    url: server.url.origin,
+    [Symbol.dispose]() {
+      server.stop(true);
+    },
+  };
+}
+
+/**
+ * An npm registry serving `packages` (the last version listed for a name is its
+ * `latest`); point bunx at it with `npm_config_registry: registry.url`.
+ */
+async function localRegistry(...packages: FixturePackage[]) {
+  const manifests = new Map<
+    string,
+    { name: string; versions: Record<string, object>; "dist-tags": { latest: string } }
+  >();
+  const tarballs = new Map<string, Uint8Array<ArrayBuffer>>();
+  const registry = fixtureServer(
+    pathname => tarballs.get(pathname) ?? manifests.get(decodeURIComponent(pathname.slice(1))),
+  );
+  for (const { name, version, bin, dependencies, scripts, files } of packages) {
+    const tarballPath = `/${name}/-/${name.slice(name.lastIndexOf("/") + 1)}-${version}.tgz`;
+    const packageJson = { name, version, bin, dependencies, scripts };
+    tarballs.set(tarballPath, await tarball("package", { "package.json": JSON.stringify(packageJson), ...files }));
+    const manifest = manifests.get(name) ?? { name, versions: {}, "dist-tags": { latest: version } };
+    manifest.versions[version] = { ...packageJson, dist: { tarball: `${registry.url}${tarballPath}` } };
+    manifest["dist-tags"].latest = version;
+    manifests.set(name, manifest);
+  }
+  return registry;
+}
+
+/**
+ * Stands in for api.github.com (bun install honors `GITHUB_API_URL`): every
+ * `/repos/<owner>/<repo>/tarball/<ref>` request gets the one fixture repository.
+ */
+async function localGithub(owner: string, repo: string, files: Record<string, string>) {
+  const bytes = await tarball(`${owner}-${repo}-0123abc`, files);
+  return fixtureServer(pathname => (pathname.startsWith(`/repos/${owner}/${repo}/tarball/`) ? bytes : undefined));
+}
+
 beforeAll(async () => {
   // Clean stale bunx cache dirs from previous runs once up front instead of before every test.
   const tmp = isWindows ? tmpdir() : "/tmp";
@@ -91,61 +192,112 @@ it.concurrent("should choose the tagged versions instead of the PATH versions wh
     semverVersions = semverVersions.slice(0, 2);
   }
 
-  const processes = semverVersions.map((version, i) => {
+  // Like the real 7.5+ versions (which share lru-cache), every version depends
+  // on one shared package, so the simultaneous installs below also race to
+  // extract the same dependency into the shared install cache. Not on Windows:
+  // two installs extracting the same package there fail with "ENOENT: failed
+  // opening cache/package/version dir" roughly half the time, and the real
+  // 7.0.0 and 7.1.0 that Windows runs have no dependencies either.
+  using registry = await localRegistry(
+    { name: "lru-cache", version: "1.0.0", files: { "index.js": "" } },
+    ...semverVersions.map(version => ({
+      ...fixturePackage("semver", version, "semver"),
+      ...(!isWindows && { dependencies: { "lru-cache": "1.0.0" } }),
+    })),
+  );
+
+  // A `semver` that is first in PATH must lose to the explicitly requested versions.
+  const decoyBinDir = tmpdirSync();
+  if (isWindows) {
+    await writeFile(join(decoyBinDir, "semver.cmd"), "@echo semver from PATH\r\n");
+  } else {
+    await writeFile(join(decoyBinDir, "semver"), '#!/bin/sh\necho "semver from PATH"\n');
+    chmodSync(join(decoyBinDir, "semver"), 0o755);
+  }
+
+  const processes = semverVersions.map(version => {
     return spawn({
       cmd: [bunExe(), "x", "semver@" + version, "--help"],
       cwd: x_dir,
       stdout: "pipe",
       stdin: "ignore",
-      stderr: "ignore",
+      stderr: "pipe",
       env: {
         ...env,
-        // BUN_DEBUG_QUIET_LOGS: undefined,
-        // BUN_DEBUG: "/tmp/bun-debug.txt." + i,
+        npm_config_registry: registry.url,
+        PATH: `${decoyBinDir}${delimiter}${env.PATH ?? process.env.PATH ?? ""}`,
       },
     });
   });
 
-  const results = await Promise.all(processes.map(p => p.exited));
-  expect(results).toEqual(semverVersions.map(() => 0));
-  const outputs = (await Promise.all(processes.map(p => new Response(p.stdout).text()))).map(a =>
-    a.substring(0, a.indexOf("\n")),
+  const results = await Promise.all(
+    processes.map(async (subprocess, i) => {
+      const [stdout, stderr, exitCode] = await Promise.all([
+        subprocess.stdout.text(),
+        subprocess.stderr.text(),
+        subprocess.exited,
+      ]);
+      return { version: semverVersions[i], stdout: stdout.trim(), stderr, exitCode };
+    }),
+  );
+  expect(results).toEqual(
+    semverVersions.map(version => ({
+      version,
+      stdout: `semver ${version} --help`,
+      stderr: expect.not.stringContaining("error:"),
+      exitCode: 0,
+    })),
   );
-  expect(outputs).toEqual(semverVersions.map(v => "SemVer " + v));
 });
 
+// Two versions of a package whose bin (`uglifyjs`, as in the real uglify-js) is
+// not named after the package, so bunx has to read the installed package.json to
+// find it. 3.19.3 is `latest`; `latestBin` replaces its bin script.
+function uglifyJs(latestBin?: string): FixturePackage[] {
+  return [
+    fixturePackage("uglify-js", "3.14.1", "uglifyjs"),
+    fixturePackage("uglify-js", "3.19.3", "uglifyjs", latestBin),
+  ];
+}
+
 it.concurrent("should install and run default (latest) version", async () => {
   const { x_dir, env } = setup();
+  using registry = await localRegistry(
+    ...uglifyJs(
+      `#!/usr/bin/env node\nconsole.log("uglifyjs 3.19.3", ...process.argv.slice(2), "stdin:", require("fs").readFileSync(0, "utf8"));\n`,
+    ),
+  );
   const { stdout, stderr, exited } = spawn({
     cmd: [bunExe(), "x", "uglify-js", "--compress"],
     cwd: x_dir,
     stdout: "pipe",
     stdin: new TextEncoder().encode("console.log(6 * 7);"),
     stderr: "pipe",
-    env,
+    env: { ...env, npm_config_registry: registry.url },
   });
-  const err = await stderr.text();
+  const [err, out, exitCode] = await Promise.all([stderr.text(), stdout.text(), exited]);
   expect(err).not.toContain("error:");
-  const out = await stdout.text();
-  expect(out.split(/\r?\n/)).toEqual(["console.log(42);", ""]);
-  expect(await exited).toBe(0);
+  expect(out.trim()).toBe("uglifyjs 3.19.3 --compress stdin: console.log(6 * 7);");
+  expect(registry.requests).toEqual(["/uglify-js", "/uglify-js/-/uglify-js-3.19.3.tgz"]);
+  expect(exitCode).toBe(0);
 });
 
 it.concurrent("should install and run specified version", async () => {
   const { x_dir, env } = setup();
+  using registry = await localRegistry(...uglifyJs());
   const { stdout, stderr, exited } = spawn({
     cmd: [bunExe(), "x", "uglify-js@3.14.1", "-v"],
     cwd: x_dir,
     stdout: "pipe",
     stdin: "inherit",
     stderr: "pipe",
-    env,
+    env: { ...env, npm_config_registry: registry.url },
   });
-  const err = await stderr.text();
+  const [err, out, exitCode] = await Promise.all([stderr.text(), stdout.text(), exited]);
   expect(err).not.toContain("error:");
-  const out = await stdout.text();
-  expect(out.split(/\r?\n/)).toEqual(["uglify-js 3.14.1", ""]);
-  expect(await exited).toBe(0);
+  expect(out.trim()).toBe("uglifyjs 3.14.1 -v");
+  expect(registry.requests).toEqual(["/uglify-js", "/uglify-js/-/uglify-js-3.14.1.tgz"]);
+  expect(exitCode).toBe(0);
 });
 
 it.concurrent("should output usage if no arguments are passed", async () => {
@@ -169,44 +321,38 @@ it.concurrent("should output usage if no arguments are passed", async () => {
 
 it.concurrent("should work for @scoped packages", async () => {
   const { x_dir, env } = setup();
-  let exited: number, err: string, out: string;
-  // without cache
-  const withoutCache = spawn({
-    cmd: [bunExe(), "--bun", "x", "@babel/cli", "--help"],
-    cwd: x_dir,
-    stdout: "pipe",
-    stdin: "inherit",
-    stderr: "pipe",
-    env,
-  });
-
-  [err, out, exited] = await Promise.all([
-    new Response(withoutCache.stderr).text(),
-    new Response(withoutCache.stdout).text(),
-    withoutCache.exited,
-  ]);
-  expect(err).not.toContain("error:");
-  expect(out.trim()).toContain("Usage: babel [options]");
-  expect(exited).toBe(0);
-  // cached
-  const cached = spawn({
-    cmd: [bunExe(), "--bun", "x", "@babel/cli", "--help"],
-    cwd: x_dir,
-    stdout: "pipe",
-    stdin: "inherit",
-    stderr: "pipe",
-    env,
-  });
-
-  [err, out, exited] = await Promise.all([
-    new Response(cached.stderr).text(),
-    new Response(cached.stdout).text(),
-    cached.exited,
-  ]);
+  // Like @babel/cli -> `babel`: the bin is named after neither the scope nor the
+  // package, so bunx has to read the installed package.json to find it.
+  using registry = await localRegistry(fixturePackage("@bunx-fixture/cli", "1.2.3", "scoped-cli"));
+  const run = () => {
+    const subprocess = spawn({
+      cmd: [bunExe(), "--bun", "x", "@bunx-fixture/cli", "--help"],
+      cwd: x_dir,
+      stdout: "pipe",
+      stdin: "inherit",
+      stderr: "pipe",
+      env: { ...env, npm_config_registry: registry.url },
+    });
+    return Promise.all([subprocess.stderr.text(), subprocess.stdout.text(), subprocess.exited] as const);
+  };
 
-  expect(err).not.toContain("error:");
+  // without cache
+  {
+    const [err, out, exited] = await run();
+    expect(err).not.toContain("error:");
+    expect(out.trim()).toBe("scoped-cli 1.2.3 --help");
+    expect(exited).toBe(0);
+  }
+  expect(registry.requests).toEqual(["/@bunx-fixture%2fcli", "/@bunx-fixture/cli/-/cli-1.2.3.tgz"]);
 
-  expect(out.trim()).toContain("Usage: babel [options]");
+  // cached: the second run must come from the bunx cache without touching the registry
+  {
+    const [err, out, exited] = await run();
+    expect(err).toBe("");
+    expect(out.trim()).toBe("scoped-cli 1.2.3 --help");
+    expect(exited).toBe(0);
+  }
+  expect(registry.requests).toHaveLength(2);
 });
 
 it.concurrent("should execute from current working directory", async () => {
@@ -220,104 +366,100 @@ console.log(
 7
 )`,
   );
+  // The bin resolves its argument against the directory it was started in.
+  using registry = await localRegistry(
+    ...uglifyJs(
+      `#!/usr/bin/env node\nconsole.log("uglifyjs 3.19.3 read", process.argv[2] + ":", require("fs").readFileSync(process.argv[2], "utf8").replace(/\\s+/g, ""));\n`,
+    ),
+  );
   const { stdout, stderr, exited } = spawn({
     cmd: [bunExe(), "--bun", "x", "uglify-js", "test.js", "--compress"],
     cwd: x_dir,
     stdout: "pipe",
     stdin: "inherit",
     stderr: "pipe",
-    env,
+    env: { ...env, npm_config_registry: registry.url },
   });
   const [err, out, exitCode] = await Promise.all([stderr.text(), stdout.text(), exited]);
   expect(err).not.toContain("error:");
+  // bunx installed into its cache dir, not into the directory it was run from
   expect(await readdirSorted(x_dir)).toEqual(["test.js"]);
-  expect(out.split(/\r?\n/)).toEqual(["console.log(42);", ""]);
+  expect(out.trim()).toBe("uglifyjs 3.19.3 read test.js: console.log(6*7)");
   expect(exitCode).toBe(0);
 });
 
+// `bunx github:<owner>/<repo>` guesses the bin from the repository name, so the
+// fixture repository is named after its bin, like piuccio/cowsay -> `cowsay`.
+const cowsayRepo = {
+  "package.json": JSON.stringify({ name: "cowsay", version: "1.0.0", bin: { cowsay: "cli.js" } }),
+  "cli.js": echoBin("cowsay from github"),
+};
+
 it.concurrent("should work for github repository", async () => {
   const { x_dir, env } = setup();
-  // without cache
-  const withoutCache = spawn({
-    cmd: [bunExe(), "x", "github:piuccio/cowsay", "--help"],
-    cwd: x_dir,
-    stdout: "pipe",
-    stdin: "inherit",
-    stderr: "pipe",
-    env,
-  });
-
-  let [err, out, exited] = await Promise.all([
-    new Response(withoutCache.stderr).text(),
-    new Response(withoutCache.stdout).text(),
-    withoutCache.exited,
-  ]);
+  using github = await localGithub("bunx-fixture", "cowsay", cowsayRepo);
+  const run = () => {
+    const subprocess = spawn({
+      cmd: [bunExe(), "x", "github:bunx-fixture/cowsay", "--help"],
+      cwd: x_dir,
+      stdout: "pipe",
+      stdin: "inherit",
+      stderr: "pipe",
+      env: { ...env, GITHUB_API_URL: github.url },
+    });
+    return Promise.all([subprocess.stderr.text(), subprocess.stdout.text(), subprocess.exited] as const);
+  };
 
-  expect(err).not.toContain("error:");
-  expect(out.trim()).toContain("Usage: " + (isWindows ? "cli.js" : "cowsay"));
-  expect(exited).toBe(0);
+  // without cache
+  {
+    const [err, out, exited] = await run();
+    expect(err).not.toContain("error:");
+    expect(out.trim()).toBe("cowsay from github --help");
+    expect(exited).toBe(0);
+  }
+  expect(github.requests).toEqual(["/repos/bunx-fixture/cowsay/tarball/"]);
 
   // cached
-  const cached = spawn({
-    cmd: [bunExe(), "x", "github:piuccio/cowsay", "--help"],
-    cwd: x_dir,
-    stdout: "pipe",
-    stdin: "inherit",
-    stderr: "pipe",
-    env,
-  });
-
-  [err, out, exited] = await Promise.all([
-    new Response(cached.stderr).text(),
-    new Response(cached.stdout).text(),
-    cached.exited,
-  ]);
-
-  expect(err).not.toContain("error:");
-  expect(out.trim()).toContain("Usage: " + (isWindows ? "cli.js" : "cowsay"));
-  expect(exited).toBe(0);
+  {
+    const [err, out, exited] = await run();
+    expect(err).toBe("");
+    expect(out.trim()).toBe("cowsay from github --help");
+    expect(exited).toBe(0);
+  }
+  expect(github.requests).toHaveLength(1);
 });
 
 it.concurrent("should work for github repository with committish", async () => {
   const { x_dir, env } = setup();
-  const withoutCache = spawn({
-    cmd: [bunExe(), "x", "github:piuccio/cowsay#HEAD", "hello bun!"],
-    cwd: x_dir,
-    stdout: "pipe",
-    stdin: "inherit",
-    stderr: "pipe",
-    env,
-  });
-
-  let [err, out, exited] = await Promise.all([
-    new Response(withoutCache.stderr).text(),
-    new Response(withoutCache.stdout).text(),
-    withoutCache.exited,
-  ]);
+  using github = await localGithub("bunx-fixture", "cowsay", cowsayRepo);
+  const run = (...flags: string[]) => {
+    const subprocess = spawn({
+      cmd: [bunExe(), "x", ...flags, "github:bunx-fixture/cowsay#HEAD", "hello bun!"],
+      cwd: x_dir,
+      stdout: "pipe",
+      stdin: "inherit",
+      stderr: "pipe",
+      env: { ...env, GITHUB_API_URL: github.url },
+    });
+    return Promise.all([subprocess.stderr.text(), subprocess.stdout.text(), subprocess.exited] as const);
+  };
 
-  expect(err).not.toContain("error:");
-  expect(out.trim()).toContain("hello bun!");
-  expect(exited).toBe(0);
+  {
+    const [err, out, exited] = await run();
+    expect(err).not.toContain("error:");
+    expect(out.trim()).toBe("cowsay from github hello bun!");
+    expect(exited).toBe(0);
+  }
+  expect(github.requests).toEqual(["/repos/bunx-fixture/cowsay/tarball/HEAD"]);
 
   // cached
-  const cached = spawn({
-    cmd: [bunExe(), "x", "--no-install", "github:piuccio/cowsay#HEAD", "hello bun!"],
-    cwd: x_dir,
-    stdout: "pipe",
-    stdin: "inherit",
-    stderr: "pipe",
-    env,
-  });
-
-  [err, out, exited] = await Promise.all([
-    new Response(cached.stderr).text(),
-    new Response(cached.stdout).text(),
-    cached.exited,
-  ]);
-
-  expect(err).not.toContain("error:");
-  expect(out.trim()).toContain("hello bun!");
-  expect(exited).toBe(0);
+  {
+    const [err, out, exited] = await run("--no-install");
+    expect(err).toBe("");
+    expect(out.trim()).toBe("cowsay from github hello bun!");
+    expect(exited).toBe(0);
+  }
+  expect(github.requests).toHaveLength(1);
 });
 
 it.concurrent.each(["--version", "-v"])("should print the version using %s and exit", async flag => {
@@ -359,19 +501,26 @@ it.concurrent("should print the revision and exit", async () => {
 
 it.concurrent("should pass --version to the package if specified", async () => {
   const { x_dir, env } = setup();
+  using registry = await localRegistry(fixturePackage("esbuild", "0.28.2", "esbuild"));
   const subprocess = spawn({
     cmd: [bunExe(), "x", "esbuild", "--version"],
     cwd: x_dir,
     stdout: "pipe",
     stdin: "inherit",
     stderr: "pipe",
-    env,
+    env: {
+      ...env,
+      npm_config_registry: registry.url,
+      // unversioned, so an esbuild already on PATH would be run instead of the fixture
+      PATH: pathWithout("esbuild", env.PATH ?? process.env.PATH),
+    },
   });
 
   let [err, out, exited] = await Promise.all([subprocess.stderr.text(), subprocess.stdout.text(), subprocess.exited]);
 
   expect(err).not.toContain("error:");
-  expect(out.trim()).not.toContain(Bun.version);
+  // the flag reached the package instead of being taken as bunx's own --version
+  expect(out.trim()).toBe("esbuild 0.28.2 --version");
   expect(exited).toBe(0);
 });
 
@@ -446,51 +595,82 @@ describe("bunx --no-install", () => {
   it.concurrent.each(["typescript", "http-server", "eslint"])(
     "`bunx --no-install %s` should find cached packages",
     async pkg => {
+      const bin = pkg === "typescript" ? "tsc" : pkg;
+      using registry = await localRegistry(fixturePackage(pkg, "1.0.0", bin));
       const ctx = setup();
+      ctx.env.npm_config_registry = registry.url;
+      // An unversioned `bunx <pkg>` runs a matching bin from PATH before it looks
+      // at its cache, so a tsc/eslint/http-server installed on this machine
+      // would satisfy both runs without the cache ever being consulted.
+      // (bunEnv spreads process.env, whose key is `Path` on Windows.)
+      ctx.env.PATH = pathWithout(bin, ctx.env.PATH ?? process.env.PATH);
+
       // not cached
       {
         const [err, out, code] = await run(ctx, pkg, "--version");
         expect(err).not.toContain("error:");
-        expect(out).not.toBeEmpty();
+        expect(out.trim()).toBe(`${bin} 1.0.0 --version`);
         expect(code).toBe(0);
       }
+      expect(registry.requests).toEqual([`/${pkg}`, `/${pkg}/-/${pkg}-1.0.0.tgz`]);
 
       // cached
       {
         const [err, out, code] = await run(ctx, "--no-install", pkg, "--version");
-        expect(err).not.toContain("error:");
-        expect(out).not.toBeEmpty();
+        expect(err).toBe("");
+        expect(out.trim()).toBe(`${bin} 1.0.0 --version`);
         expect(code).toBe(0);
       }
+      expect(registry.requests).toHaveLength(2);
     },
   );
 
   it.concurrent("when an exact version match is found, should find cached packages", async () => {
+    using registry = await localRegistry(fixturePackage("http-server", "14.0.0", "http-server"));
     const ctx = setup();
+    ctx.env.npm_config_registry = registry.url;
+
     // not cached
     {
       const [err, out, code] = await run(ctx, "http-server@14.0.0", "--version");
       expect(err).not.toContain("error:");
-      expect(out).not.toBeEmpty();
+      expect(out.trim()).toBe("http-server 14.0.0 --version");
       expect(code).toBe(0);
     }
+    expect(registry.requests).toEqual(["/http-server", "/http-server/-/http-server-14.0.0.tgz"]);
 
     // cached
     {
       const [err, out, code] = await run(ctx, "--no-install", "http-server@14.0.0", "--version");
-      expect(err).not.toContain("error:");
-      expect(out).not.toBeEmpty();
+      expect(err).toBe("");
+      expect(out.trim()).toBe("http-server 14.0.0 --version");
       expect(code).toBe(0);
     }
+    expect(registry.requests).toHaveLength(2);
   });
 });
 
 it.concurrent("should handle postinstall scripts correctly with symlinked bunx", async () => {
   const { x_dir, env } = setup();
-  // Create a symlink to bun called "bunx"
+  // Copies rather than symlinks: bun re-runs its own executable path for the
+  // install (`bunx add`) and for lifecycle scripts (`bunx exec`), and #17076 was
+  // those being taken for packages named "add"/"exec" when that path ends in bunx.
   copyFileSync(bunExe(), join(x_dir, isWindows ? "bun.exe" : "bun"));
   copyFileSync(bunExe(), join(x_dir, isWindows ? "bunx.exe" : "bunx"));
 
+  // esbuild is in bun's default trusted dependencies, so its postinstall runs.
+  // The bin reports whether it did.
+  using registry = await localRegistry({
+    name: "esbuild",
+    version: "0.28.2",
+    bin: { esbuild: "cli.js" },
+    scripts: { postinstall: "node postinstall.js" },
+    files: {
+      "postinstall.js": `require("fs").writeFileSync("postinstall-ran", "");\n`,
+      "cli.js": `#!/usr/bin/env node\nconsole.log("esbuild 0.28.2", require("fs").existsSync(__dirname + "/postinstall-ran") ? "after postinstall" : "without postinstall", ...process.argv.slice(2));\n`,
+    },
+  });
+
   const subprocess = spawn({
     cmd: ["bunx", "esbuild@latest", "--version"],
     cwd: x_dir,
@@ -499,7 +679,8 @@ it.concurrent("should handle postinstall scripts correctly with symlinked bunx",
     stderr: "pipe",
     env: {
       ...env,
-      PATH: `${x_dir}${isWindows ? ";" : ":"}${env.PATH || ""}`,
+      npm_config_registry: registry.url,
+      PATH: `${x_dir}${delimiter}${env.PATH ?? process.env.PATH ?? ""}`,
     },
   });
 
@@ -507,27 +688,46 @@ it.concurrent("should handle postinstall scripts correctly with symlinked bunx",
 
   expect(err).not.toContain("error:");
   expect(err).not.toContain("Cannot find module 'exec'");
-  expect(out.trim()).not.toContain(Bun.version);
+  expect(out.trim()).toBe("esbuild 0.28.2 after postinstall --version");
+  expect(registry.requests).toEqual(["/esbuild", "/esbuild/-/esbuild-0.28.2.tgz"]);
   expect(exited).toBe(0);
 });
 
-// Pinned to 20: its engines are "^20.19.0 || ^22.12.0 || >=24.0.0", so the node-24
-// requirement this test exercises holds no matter what Node.js version Bun reports.
-// @latest tracks Angular's engines upward and breaks whenever they outrun us.
+// Stands in for `bunx --bun @angular/cli`, whose `ng` refuses to start on a
+// Node.js older than its engines range (Bun used to self-report 22.6.0 and
+// fail it). The fixture applies the same gate to the version Bun reports under
+// --bun; installing the real CLI pulled in ~250 packages per run, and its
+// engines range moved under us twice.
 it.concurrent("should handle package that requires node 24", async () => {
   const { x_dir, env } = setup();
+  using registry = await localRegistry({
+    name: "@bunx-fixture/requires-node-24",
+    version: "1.0.0",
+    bin: { ng: "cli.js" },
+    files: {
+      "cli.js": `#!/usr/bin/env node
+const [major] = process.versions.node.split(".").map(Number);
+if (major < 24) {
+  console.error("error: Node.js v" + process.versions.node + " is not supported, v24 or newer is required");
+  process.exit(3);
+}
+console.log("node v" + process.versions.node + " running in " + (typeof Bun === "undefined" ? "node" : "bun"));
+`,
+    },
+  });
   const subprocess = spawn({
-    cmd: [bunExe(), "x", "--bun", "@angular/cli@20", "--help"],
+    cmd: [bunExe(), "x", "--bun", "@bunx-fixture/requires-node-24", "--help"],
     cwd: x_dir,
     stdout: "pipe",
     stdin: "inherit",
     stderr: "pipe",
-    env,
+    env: { ...env, npm_config_registry: registry.url },
   });
 
   let [err, out, exited] = await Promise.all([subprocess.stderr.text(), subprocess.stdout.text(), subprocess.exited]);
   expect(err).not.toContain("error:");
-  expect(out.trim()).not.toContain(Bun.version);
+  // --bun ran the bin with this same Bun, so it saw the version Bun reports as Node.js
+  expect(out.trim()).toBe(`node v${process.versions.node} running in bun`);
   expect(exited).toBe(0);
 });
 
@@ -1187,30 +1387,25 @@ describe("package name aliases", () => {
 // When the .bunx metadata file is corrupted (e.g., missing quote terminator in bin_path),
 // bunx should gracefully fall back to the slow path instead of panicking.
 it.skipIf(!isWindows)("should not crash on corrupted .bunx file with missing quote", async () => {
-  // First, install a package to create a valid .bunx file
-  // Use typescript which creates both .exe and .bunx files
-  // Need to init first to create package.json
-  const initProc = spawn({
-    cmd: [bunExe(), "init", "-y"],
-    cwd: x_dir,
-    stdout: "pipe",
-    stderr: "pipe",
-    env,
-  });
-  await initProc.exited;
-
+  // Installing any package with a bin creates the tsc.exe + tsc.bunx pair; the
+  // .bunx contents are overwritten below, so a fixture is as good as the real thing.
+  using registry = await localRegistry(fixturePackage("typescript", "5.0.0", "tsc"));
+  await writeFile(join(x_dir, "package.json"), "{}");
   const subprocess1 = spawn({
     cmd: [bunExe(), "add", "typescript@5.0.0"],
     cwd: x_dir,
     stdout: "pipe",
     stderr: "pipe",
-    env,
+    env: { ...env, npm_config_registry: registry.url },
   });
   const [err1, out1, exitCode1] = await Promise.all([
     subprocess1.stderr.text(),
     subprocess1.stdout.text(),
     subprocess1.exited,
   ]);
+  expect(err1).not.toContain("error:");
+  expect(out1).toContain("installed typescript@5.0.0");
+  expect(exitCode1).toBe(0);
 
   // Find the .bunx file
   const binDir = join(x_dir, "node_modules", ".bin");
@@ -1237,8 +1432,10 @@ it.skipIf(!isWindows)("should not crash on corrupted .bunx file with missing quo
   const corruptedData = Buffer.concat([binPath, corruptedQuote, nullChar, shebang, binLen, argsLen, flags]);
   await writeFile(bunxFile, corruptedData);
 
-  // Now run bunx - it should NOT crash, but may fail gracefully
-  // Using bun run to invoke tsc.exe, which triggers the BunXFastPath
+  // `bun run tsc` first tries to launch the bin in-process from the .bunx
+  // metadata (the BunXFastPath). On corrupt metadata it must fall through to
+  // spawning tsc.exe, whose standalone copy of the same parser reports the
+  // corruption and exits 255; bun then reports that exit like any other bin's.
   const subprocess2 = spawn({
     cmd: [bunExe(), "run", "tsc", "--version"],
     cwd: x_dir,
@@ -1253,9 +1450,10 @@ it.skipIf(!isWindows)("should not crash on corrupted .bunx file with missing quo
     subprocess2.exited,
   ]);
 
-  // The key assertion: we should NOT see a panic
-  expect(stderr).not.toContain("panic");
-  expect(stderr).not.toContain("reached unreachable code");
+  expect(stderr).toContain("bin metadata is corrupt");
+  expect(stderr).toContain('"tsc.exe" exited with code');
+  expect(stdout).toBe("");
+  expect(exitCode).toBe(255);
 });
 
 // The bunx cache root lives at a predictable path inside the shared temp dir

From 91549258925121beb7c60cc6bd5fd3b53f268412 Mon Sep 17 00:00:00 2001
From: robobun <117481402+robobun@users.noreply.github.com>
Date: Mon, 17 Aug 2026 01:09:24 +0000
Subject: [PATCH 080/258] test(install): don't require the refetched manifest
 to be cached before install exits (#38580)

---
 test/cli/install/bun-install-registry.test.ts | 9 ++++++++-
 1 file changed, 8 insertions(+), 1 deletion(-)

diff --git a/test/cli/install/bun-install-registry.test.ts b/test/cli/install/bun-install-registry.test.ts
index 5fe42218ac40..4443183ee1f1 100644
--- a/test/cli/install/bun-install-registry.test.ts
+++ b/test/cli/install/bun-install-registry.test.ts
@@ -10381,7 +10381,14 @@ test("npm manifest cache entries are only reused for the package name they were
   expect(npmPackages.map(pkg => pkg.name)).toEqual(["no-deps"]);
   expect(npmPackages[0].resolution.resolved).toBe(`http://localhost:${port}/no-deps/-/no-deps-1.0.0.tgz`);
 
-  expect(parseManifest(byName["no-deps"], registryUrl()).name).toBe("no-deps");
+  // The rejected entry is deleted as soon as it is read; its replacement is written by a
+  // thread pool task that `bun install` does not wait for (#37203). The first install above
+  // still had tarballs to download while its manifests were being written, but this one has
+  // everything cached and exits while the write is still in flight (always, with a Windows
+  // debug build). So the file is either gone or holds no-deps; it must never still be basic-1's.
+  if (await exists(byName["no-deps"])) {
+    expect(parseManifest(byName["no-deps"], registryUrl()).name).toBe("no-deps");
+  }
   expect(exitCode).toBe(0);
 });
 

From 606fa285bb37c494bcc9a5cb4d5105c276323f75 Mon Sep 17 00:00:00 2001
From: robobun <117481402+robobun@users.noreply.github.com>
Date: Mon, 17 Aug 2026 01:09:28 +0000
Subject: [PATCH 081/258] test(install): normalize the registry URL, not the
 bare port, in the lockb print snapshot (#38627)

---
 .../__snapshots__/bun-install-registry.test.ts.snap  | 12 ++++++------
 test/cli/install/bun-install-registry.test.ts        |  2 +-
 2 files changed, 7 insertions(+), 7 deletions(-)

diff --git a/test/cli/install/__snapshots__/bun-install-registry.test.ts.snap b/test/cli/install/__snapshots__/bun-install-registry.test.ts.snap
index 0f74856c14a5..38dc82f3392d 100644
--- a/test/cli/install/__snapshots__/bun-install-registry.test.ts.snap
+++ b/test/cli/install/__snapshots__/bun-install-registry.test.ts.snap
@@ -315,17 +315,17 @@ exports[`duplicate dependency in optionalDependencies maintains sort order 1`] =
 
 "@types/is-number@>=1.0.0":
   version "2.0.0"
-  resolved "http://localhost:4873/@types/is-number/-/is-number-2.0.0.tgz"
+  resolved "http://localhost:1234/@types/is-number/-/is-number-2.0.0.tgz"
   integrity sha512-GEeIxCB+NpM1NrDBqmkYPeU8bI//i+xPzdOY4E1YHet51IcFmz4js6k57m69fLl/cbn7sOR7wj9RNNw53X8AiA==
 
 a-dep@1.0.1:
   version "1.0.1"
-  resolved "http://localhost:4873/a-dep/-/a-dep-1.0.1.tgz"
+  resolved "http://localhost:1234/a-dep/-/a-dep-1.0.1.tgz"
   integrity sha512-6nmTaPgO2U/uOODqOhbjbnaB4xHuZ+UB7AjKUA3g2dT4WRWeNxgp0dC8Db4swXSnO5/uLLUdFmUJKINNBO/3wg==
 
 duplicate-optional@1.0.1:
   version "1.0.1"
-  resolved "http://localhost:4873/duplicate-optional/-/duplicate-optional-1.0.1.tgz"
+  resolved "http://localhost:1234/duplicate-optional/-/duplicate-optional-1.0.1.tgz"
   integrity sha512-tL28+yJiTPehPLq7QnOu9jbRBpRgfBkyTVveaJojKcyae2khKuLaPRvsiX5gXv+iNGpYiYcNnV1eDBLXS+L85A==
   dependencies:
     a-dep "1.0.1"
@@ -335,12 +335,12 @@ duplicate-optional@1.0.1:
 
 no-deps@1.0.1, no-deps@^1.0.0:
   version "1.0.1"
-  resolved "http://localhost:4873/no-deps/-/no-deps-1.0.1.tgz"
+  resolved "http://localhost:1234/no-deps/-/no-deps-1.0.1.tgz"
   integrity sha512-3X6cn4+UJdXJuLPu11v8i/fGLe2PdI6v1yKTELam04lY5esCAFdG/qQts6N6rLrL6g1YRq+MKBAwxbmUQk355A==
 
 two-range-deps@1.0.0:
   version "1.0.0"
-  resolved "http://localhost:4873/two-range-deps/-/two-range-deps-1.0.0.tgz"
+  resolved "http://localhost:1234/two-range-deps/-/two-range-deps-1.0.0.tgz"
   integrity sha512-N+6kPy/GxuMncNz/EKuIrwdoYbh1qmvHDnw1UbM3sQE184kBn+6qAQgtf1wgT9dJnt6X+tWcTzSmfDvtJikVBA==
   dependencies:
     no-deps "^1.0.0"
@@ -348,7 +348,7 @@ two-range-deps@1.0.0:
 
 what-bin@1.0.0:
   version "1.0.0"
-  resolved "http://localhost:4873/what-bin/-/what-bin-1.0.0.tgz"
+  resolved "http://localhost:1234/what-bin/-/what-bin-1.0.0.tgz"
   integrity sha512-sa99On1k5aDqCvpni/TQ6rLzYprUWBlb8fNwWOzbjDlM24fRr7FKDOuaBO/Y9WEIcZuzoPkCW5EkBCpflj8REQ==
 "
 `;
diff --git a/test/cli/install/bun-install-registry.test.ts b/test/cli/install/bun-install-registry.test.ts
index 4443183ee1f1..44b34e1c009f 100644
--- a/test/cli/install/bun-install-registry.test.ts
+++ b/test/cli/install/bun-install-registry.test.ts
@@ -7008,7 +7008,7 @@ test("duplicate dependency in optionalDependencies maintains sort order", async
   });
 
   const out = await stdout.text();
-  expect(out.replaceAll(`${port}`, "4873")).toMatchSnapshot();
+  expect(out.replaceAll(/localhost:\d+/g, "localhost:1234")).toMatchSnapshot();
   expect(await exited).toBe(0);
 });
 

From c9936186e2382d35358ef23fa92f55f4eeebd815 Mon Sep 17 00:00:00 2001
From: robobun <117481402+robobun@users.noreply.github.com>
Date: Mon, 17 Aug 2026 01:09:32 +0000
Subject: [PATCH 082/258] test(harness): let verdaccio pick its own port and
 fail start() when it exits early (#38891)

---
 test/cli/install/bun-install-registry.test.ts |  2 +-
 .../cli/install/registry/verdaccio-fixture.ts | 21 ++++++
 test/cli/install/verdaccio-registry.test.ts   | 72 +++++++++++++++++++
 .../cli/update_interactive_formatting.test.ts |  2 +-
 test/harness.ts                               | 60 ++++++++++++----
 5 files changed, 143 insertions(+), 14 deletions(-)
 create mode 100644 test/cli/install/registry/verdaccio-fixture.ts
 create mode 100644 test/cli/install/verdaccio-registry.test.ts

diff --git a/test/cli/install/bun-install-registry.test.ts b/test/cli/install/bun-install-registry.test.ts
index 44b34e1c009f..4eda69b7a7d9 100644
--- a/test/cli/install/bun-install-registry.test.ts
+++ b/test/cli/install/bun-install-registry.test.ts
@@ -43,8 +43,8 @@ let users: Record<string, string> = {};
 
 setDefaultTimeout(1000 * 60 * 5);
 registry = new VerdaccioRegistry();
-port = registry.port;
 await registry.start();
+port = registry.port;
 
 afterAll(async () => {
   await Bun.$`rm -f ${import.meta.dir}/htpasswd`.throws(false);
diff --git a/test/cli/install/registry/verdaccio-fixture.ts b/test/cli/install/registry/verdaccio-fixture.ts
new file mode 100644
index 000000000000..05f8590e0e35
--- /dev/null
+++ b/test/cli/install/registry/verdaccio-fixture.ts
@@ -0,0 +1,21 @@
+// Entry point of the verdaccio process that VerdaccioRegistry (test/harness.ts) forks.
+//
+// verdaccio's own CLI binds whatever port it is told to and only reports that it
+// started, so the port would have to be guessed up front. Its programmatic API hands
+// back the server before it listens; listen on port 0 and report what the kernel gave.
+import type { Server } from "node:http";
+import type { AddressInfo } from "node:net";
+import { runServer } from "verdaccio";
+
+const configPath = process.argv[2];
+if (!configPath) {
+  // Without a path verdaccio would go looking for (and create) a config under $HOME.
+  throw new Error("usage: verdaccio-fixture.ts <verdaccio.yaml>");
+}
+
+const server: Server = await runServer(configPath);
+// Bind the IPv4 loopback explicitly: `localhost` is `::1` first on some hosts, while
+// the install client connects to 127.0.0.1 and would have every request refused.
+server.listen(0, "127.0.0.1", () => {
+  process.send!({ verdaccio_port: (server.address() as AddressInfo).port });
+});
diff --git a/test/cli/install/verdaccio-registry.test.ts b/test/cli/install/verdaccio-registry.test.ts
new file mode 100644
index 000000000000..3cac8bcf071e
--- /dev/null
+++ b/test/cli/install/verdaccio-registry.test.ts
@@ -0,0 +1,72 @@
+import { afterEach, expect, test } from "bun:test";
+import { tempDir, VerdaccioRegistry } from "harness";
+import { once } from "node:events";
+import { join } from "node:path";
+
+const registries: VerdaccioRegistry[] = [];
+
+afterEach(async () => {
+  await Promise.all(
+    registries.splice(0).map(async ({ process: child }) => {
+      if (!child || child.exitCode !== null || child.signalCode !== null) return;
+      const exited = once(child, "exit");
+      child.kill();
+      await exited;
+    }),
+  );
+});
+
+async function startFailure(configPath: string): Promise<Error> {
+  const registry = new VerdaccioRegistry({ configPath });
+  registries.push(registry);
+  // Before the fix this promise never settled: the exit handler only logged, so a
+  // beforeAll() starting the registry sat there until the hook timed out.
+  const error = await registry.start().catch((error: Error) => error);
+  expect(error).toBeInstanceOf(Error);
+  expect(() => registry.port).toThrow("not known until start()");
+  return error as Error;
+}
+
+test("start() resolves with the port verdaccio bound and registryUrl() serves from it", async () => {
+  const registry = new VerdaccioRegistry();
+  registries.push(registry);
+
+  // The port used to be picked here, before anything was listening on it.
+  expect(() => registry.port).toThrow("not known until start()");
+
+  await registry.start();
+
+  const { port } = registry;
+  expect(port).toBeGreaterThan(0);
+  expect(registry.registryUrl()).toBe(`http://localhost:${port}/`);
+
+  const response = await fetch(new URL("no-deps", registry.registryUrl()));
+  expect(response.status).toBe(200);
+  expect(await response.json()).toMatchObject({ name: "no-deps" });
+});
+
+test("start() rejects when the config file is missing", async () => {
+  using dir = tempDir("verdaccio-registry-missing-config", {});
+  const error = await startFailure(join(String(dir), "missing.yaml"));
+  expect(error.message).toContain("Verdaccio exited with code 1 and signal null before it started listening");
+  expect(error.message).toContain("config file does not exist or not reachable");
+});
+
+test("start() rejects with what verdaccio logged when a plugin fails to load", async () => {
+  using dir = tempDir("verdaccio-registry-bad-plugin", {
+    "verdaccio.yaml": `
+      storage: ./storage
+      auth:
+        nope: {}
+      packages:
+        "**":
+          access: $all
+      log: { type: stdout, format: pretty, level: http }
+    `,
+  });
+  const error = await startFailure(join(String(dir), "verdaccio.yaml"));
+  expect(error.message).toContain("Verdaccio exited with code 1 and signal null before it started listening");
+  // verdaccio's logger (stdout) and the error that ended the fixture (stderr) word it differently.
+  expect(error.message).toContain("plugin not found. try npm install verdaccio-nope");
+  expect(error.message).toContain('plugin not found. try "npm install verdaccio-nope"');
+});
diff --git a/test/cli/update_interactive_formatting.test.ts b/test/cli/update_interactive_formatting.test.ts
index 3b7167fd6818..a2e953534c64 100644
--- a/test/cli/update_interactive_formatting.test.ts
+++ b/test/cli/update_interactive_formatting.test.ts
@@ -9,8 +9,8 @@ let registryUrl: string;
 
 beforeAll(async () => {
   registry = new VerdaccioRegistry();
-  registryUrl = registry.registryUrl();
   await registry.start();
+  registryUrl = registry.registryUrl();
 });
 
 afterAll(() => {
diff --git a/test/harness.ts b/test/harness.ts
index 77674afa7606..543e60dca8e2 100644
--- a/test/harness.ts
+++ b/test/harness.ts
@@ -1881,39 +1881,58 @@ export function textLockfile(version: number, pkgs: any): string {
 }
 
 export class VerdaccioRegistry {
-  port: number;
+  #port: number | undefined;
   process: ChildProcess | undefined;
   configPath: string;
   packagesPath: string;
   users: Record<string, string> = {};
 
   constructor(opts?: { configPath?: string; packagesPath?: string; verbose?: boolean }) {
-    this.port = randomPort();
     this.configPath = opts?.configPath ?? join(import.meta.dir, "cli", "install", "registry", "verdaccio.yaml");
     this.packagesPath = opts?.packagesPath ?? join(import.meta.dir, "cli", "install", "registry", "packages");
   }
 
+  /** The port verdaccio is listening on. Only known once `start()` has resolved. */
+  get port(): number {
+    if (this.#port === undefined) {
+      throw new Error("VerdaccioRegistry.port is not known until start() has resolved");
+    }
+    return this.#port;
+  }
+
   async start(silent: boolean = true) {
     await rm(join(dirname(this.configPath), "htpasswd"), { force: true });
-    // Bind the IPv4 loopback explicitly: a bare port makes verdaccio listen on
-    // whatever `localhost` resolves to, which is `::1` on hosts that list it first,
-    // while the install client connects to 127.0.0.1 and every request is refused.
-    const listen = `127.0.0.1:${this.port}`;
-    this.process = fork(require.resolve("verdaccio/bin/verdaccio"), ["-c", this.configPath, "-l", listen], {
+    // The fixture listens on port 0 and reports the port the kernel handed it, so there
+    // is no port picked here that another test file, a leftover registry or an outgoing
+    // connection could already be holding.
+    const fixture = join(import.meta.dir, "cli", "install", "registry", "verdaccio-fixture.ts");
+    this.process = fork(fixture, [this.configPath], {
       silent,
       // Prefer using a release build of Bun since it's faster
       execPath: isCI ? bunExe() : Bun.which("bun") || bunExe(),
       env: {
         ...(bunEnv as any),
         NODE_NO_WARNINGS: "1",
+        // Exit together with the test process, whether or not stop() ran.
+        BUN_FEATURE_FLAG_NO_ORPHANS: "1",
       },
     });
 
+    // A failed startup is explained partly by verdaccio's logger, which writes to
+    // stdout, and partly by the fixture's uncaught error on stderr, so collect both
+    // until start() settles and put them in the rejection.
+    let startupOutput = "";
+    const collectStartupOutput = (data: Buffer) => {
+      startupOutput += data;
+    };
+    this.process.stdout?.on("data", collectStartupOutput);
+    this.process.stderr?.on("data", collectStartupOutput);
+
     this.process.stderr?.on("data", data => {
       console.error(`[verdaccio] stderr: ${data}`);
     });
 
-    const started = Promise.withResolvers();
+    const started = Promise.withResolvers<number>();
 
     this.process.on("error", error => {
       console.error(`Failed to start verdaccio: ${error}`);
@@ -1928,13 +1947,30 @@ export class VerdaccioRegistry {
       }
     });
 
-    this.process.on("message", (message: { verdaccio_started: boolean }) => {
-      if (message.verdaccio_started) {
-        started.resolve();
+    // "close" rather than "exit": it fires once stdout/stderr have been read to the
+    // end, so the error carries everything verdaccio printed.
+    this.process.on("close", (code, signal) => {
+      started.reject(
+        new Error(
+          `Verdaccio exited with code ${code} and signal ${signal} before it started listening\n${startupOutput}`,
+        ),
+      );
+    });
+
+    this.process.on("message", (message: { verdaccio_port?: number }) => {
+      if (typeof message.verdaccio_port === "number") {
+        started.resolve(message.verdaccio_port);
       }
     });
 
-    await started.promise;
+    try {
+      this.#port = await started.promise;
+    } finally {
+      // Leave stdout unread from here on, as before: a registry serves thousands of
+      // requests per test file and logs every one of them.
+      this.process.stdout?.off("data", collectStartupOutput).pause();
+      this.process.stderr?.off("data", collectStartupOutput);
+    }
   }
 
   registryUrl() {

From abb11b0876b98daa64c3b9fff28a4a0b33ca082f Mon Sep 17 00:00:00 2001
From: robobun <117481402+robobun@users.noreply.github.com>
Date: Mon, 17 Aug 2026 01:09:36 +0000
Subject: [PATCH 083/258] test(install): run overrides.test.ts against the
 local registry (#39022)

---
 test/cli/install/overrides.test.ts | 433 +++++++++++++++--------------
 test/no-validate-leaksan.txt       |   1 -
 2 files changed, 228 insertions(+), 206 deletions(-)

diff --git a/test/cli/install/overrides.test.ts b/test/cli/install/overrides.test.ts
index 002a3bc73a55..9d02c3b2ebd6 100644
--- a/test/cli/install/overrides.test.ts
+++ b/test/cli/install/overrides.test.ts
@@ -1,247 +1,270 @@
-import { write } from "bun";
-import { expect, setDefaultTimeout, test } from "bun:test";
-import { readFileSync, writeFileSync } from "fs";
-import { bunEnv, bunExe, tmpdirSync } from "harness";
+import { file, write } from "bun";
+import { afterAll, beforeAll, expect, test } from "bun:test";
+import { VerdaccioRegistry, bunEnv, bunExe, nodeModulesPackages, normalizeBunSnapshot } from "harness";
 import { join } from "path";
 
-setDefaultTimeout(1000 * 60 * 5);
+// Fixtures from ./registry/packages used below:
+//   no-deps        1.0.0, 1.0.1, 1.1.0 and 2.0.0 (latest), the package the overrides target
+//   one-dep        1.0.0, depends on no-deps@1.0.1
+//   one-range-dep  1.0.0, depends on no-deps@^1.0.0
+//   a-dep          1.0.1 to 1.0.10 (latest), no dependencies
+const registry = new VerdaccioRegistry();
 
-function install(cwd: string, args: string[]) {
-  const exec = Bun.spawnSync({
-    cmd: [bunExe(), ...args, "--linker=hoisted"],
-    cwd,
-    stdout: "inherit",
-    stdin: "inherit",
-    stderr: "inherit",
-    env: bunEnv,
+beforeAll(async () => {
+  await registry.start();
+});
+
+afterAll(() => {
+  registry.stop();
+});
+
+async function project(packageJson: Record<string, unknown>, files: Record<string, string> = {}) {
+  const { packageDir } = await registry.createTestDir({
+    bunfigOpts: { linker: "hoisted" },
+    files: { "package.json": JSON.stringify(packageJson), ...files },
   });
-  if (exec.exitCode !== 0) {
-    throw new Error(`bun install exited with code ${exec.exitCode}`);
-  }
-  return exec;
+  return packageDir;
 }
 
-function installExpectFail(cwd: string, args: string[]) {
-  const exec = Bun.spawnSync({
+// Printed only by installs that had registry work to do; the bracketed task count is not what these tests check.
+const progressLine = /^Resolv(?:ing dependencies|ed, downloaded and extracted \[\d+\])\r?\n?/gm;
+
+async function bun(dir: string, ...args: string[]) {
+  await using proc = Bun.spawn({
     cmd: [bunExe(), ...args],
-    cwd,
-    stdout: "inherit",
-    stdin: "inherit",
-    stderr: "inherit",
-    env: bunEnv,
+    cwd: dir,
+    // CI exports BUN_INSTALL_CACHE_DIR, which overrides the bunfig's per-test `cache`; concurrent tests sharing one cache race on Windows.
+    env: { ...bunEnv, BUN_INSTALL_CACHE_DIR: join(dir, ".bun-cache") },
+    stdin: "ignore",
+    stdout: "pipe",
+    stderr: "pipe",
   });
-  if (exec.exitCode === 0) {
-    throw new Error(`bun install exited with code ${exec.exitCode}, (expected failure)`);
-  }
-  return exec;
+  const [stdout, stderr, exitCode] = await Promise.all([proc.stdout.text(), proc.stderr.text(), proc.exited]);
+  return {
+    stdout: normalizeBunSnapshot(stdout, dir),
+    stderr: normalizeBunSnapshot(stderr.replace(progressLine, ""), dir),
+    exitCode,
+  };
 }
 
-function versionOf(cwd: string, path: string) {
-  const data = readFileSync(join(cwd, path));
-  const json = JSON.parse(data.toString());
-  return json.version;
+const lockfile = (dir: string) => file(join(dir, "bun.lock")).text();
+
+async function editPackageJson(dir: string, edit: (pkg: Record<string, unknown>) => void) {
+  const path = join(dir, "package.json");
+  const pkg = await file(path).json();
+  edit(pkg);
+  await write(path, JSON.stringify(pkg));
 }
 
-function ensureLockfileDoesntChangeOnBunI(cwd: string) {
-  install(cwd, ["install"]);
-  const lockb1 = readFileSync(join(cwd, "bun.lock"));
-  install(cwd, ["install", "--frozen-lockfile"]);
-  install(cwd, ["install", "--force"]);
-  const lockb2 = readFileSync(join(cwd, "bun.lock"));
+// `lock` is the bun.lock written by the install under test. The frozen install checks that bun considers it in sync with
+// package.json; the plain install checks that it is neither re-resolved nor re-saved (each goes through its own comparison).
+async function expectLockfileStable(dir: string, lock: string) {
+  const frozen = await bun(dir, "install", "--frozen-lockfile");
+  expect(frozen.stderr).toBe("");
+  expect(frozen.exitCode).toBe(0);
+
+  const plain = await bun(dir, "install");
+  expect(plain.stderr).toBe("");
+  expect(plain.exitCode).toBe(0);
 
-  expect(lockb1.toString("hex")).toEqual(lockb2.toString("hex"));
+  expect(await lockfile(dir)).toBe(lock);
 }
 
-test("overrides affect your own packages", async () => {
-  const tmp = tmpdirSync();
-  writeFileSync(
-    join(tmp, "package.json"),
-    JSON.stringify({
-      dependencies: {},
-      overrides: {
-        lodash: "4.0.0",
-      },
-    }),
-  );
-  install(tmp, ["install", "lodash"]);
-  expect(versionOf(tmp, "node_modules/lodash/package.json")).toBe("4.0.0");
-  ensureLockfileDoesntChangeOnBunI(tmp);
-});
+test.concurrent("overrides affect your own packages", async () => {
+  const dir = await project({ dependencies: {}, overrides: { "no-deps": "1.0.0" } });
 
-test("overrides affects all dependencies", async () => {
-  const tmp = tmpdirSync();
-  writeFileSync(
-    join(tmp, "package.json"),
-    JSON.stringify({
-      dependencies: {},
-      overrides: {
-        bytes: "1.0.0",
-      },
-    }),
-  );
-  install(tmp, ["install", "express@4.18.2"]);
-  expect(versionOf(tmp, "node_modules/bytes/package.json")).toBe("1.0.0");
+  const { stdout, stderr, exitCode } = await bun(dir, "install", "no-deps", "a-dep");
+
+  expect(stdout).toMatchInlineSnapshot(`
+    "bun add <version> (<revision>)
 
-  ensureLockfileDoesntChangeOnBunI(tmp);
+    installed no-deps@1.0.0
+    installed a-dep@1.0.10
+
+    2 packages installed"
+  `);
+  expect(stderr).toMatchInlineSnapshot(`"Saved lockfile"`);
+  expect(exitCode).toBe(0);
+  expect(nodeModulesPackages(dir)).toMatchInlineSnapshot(`
+    "node_modules/a-dep/a-dep@1.0.10
+    node_modules/no-deps/no-deps@1.0.0"
+  `);
+  await expectLockfileStable(dir, await lockfile(dir));
 });
 
-test("overrides being set later affects all dependencies", async () => {
-  const tmp = tmpdirSync();
-  writeFileSync(
-    join(tmp, "package.json"),
-    JSON.stringify({
-      dependencies: {},
-    }),
-  );
-  install(tmp, ["install", "express@4.18.2"]);
-  expect(versionOf(tmp, "node_modules/bytes/package.json")).not.toBe("1.0.0");
+test.concurrent("overrides affects all dependencies", async () => {
+  const dir = await project({ dependencies: {}, overrides: { "no-deps": "1.0.0" } });
 
-  ensureLockfileDoesntChangeOnBunI(tmp);
+  const { stdout, stderr, exitCode } = await bun(dir, "install", "one-dep", "one-range-dep");
 
-  writeFileSync(
-    join(tmp, "package.json"),
-    JSON.stringify({
-      ...JSON.parse(readFileSync(join(tmp, "package.json")).toString()),
-      overrides: {
-        bytes: "1.0.0",
-      },
-    }),
-  );
-  install(tmp, ["install"]);
-  expect(versionOf(tmp, "node_modules/bytes/package.json")).toBe("1.0.0");
+  expect(stdout).toMatchInlineSnapshot(`
+    "bun add <version> (<revision>)
+
+    installed one-dep@1.0.0
+    installed one-range-dep@1.0.0
 
-  ensureLockfileDoesntChangeOnBunI(tmp);
+    3 packages installed"
+  `);
+  expect(stderr).toMatchInlineSnapshot(`"Saved lockfile"`);
+  expect(exitCode).toBe(0);
+  expect(nodeModulesPackages(dir)).toMatchInlineSnapshot(`
+    "node_modules/no-deps/no-deps@1.0.0
+    node_modules/one-dep/one-dep@1.0.0
+    node_modules/one-range-dep/one-range-dep@1.0.0"
+  `);
+  await expectLockfileStable(dir, await lockfile(dir));
 });
 
-test("overrides to npm specifier", async () => {
-  const tmp = tmpdirSync();
-  writeFileSync(
-    join(tmp, "package.json"),
-    JSON.stringify({
-      dependencies: {},
-      overrides: {
-        bytes: "npm:lodash@4.0.0",
-      },
-    }),
-  );
-  install(tmp, ["install", "express@4.18.2"]);
+test.concurrent("overrides being set later affects all dependencies", async () => {
+  const dir = await project({ dependencies: {} });
+  const add = await bun(dir, "install", "one-dep");
+  expect(add.stderr).toMatchInlineSnapshot(`"Saved lockfile"`);
+  expect(add.exitCode).toBe(0);
+  expect(nodeModulesPackages(dir)).toMatchInlineSnapshot(`
+    "node_modules/no-deps/no-deps@1.0.1
+    node_modules/one-dep/one-dep@1.0.0"
+  `);
+  await expectLockfileStable(dir, await lockfile(dir));
 
-  const bytes = JSON.parse(readFileSync(join(tmp, "node_modules/bytes/package.json"), "utf-8"));
+  await editPackageJson(dir, pkg => (pkg.overrides = { "no-deps": "1.0.0" }));
+  const { stdout, stderr, exitCode } = await bun(dir, "install");
 
-  expect(bytes.name).toBe("lodash");
-  expect(bytes.version).toBe("4.0.0");
+  expect(stdout).toMatchInlineSnapshot(`
+    "bun install <version> (<revision>)
 
-  ensureLockfileDoesntChangeOnBunI(tmp);
+    1 package installed"
+  `);
+  expect(stderr).toMatchInlineSnapshot(`"Saved lockfile"`);
+  expect(exitCode).toBe(0);
+  expect(nodeModulesPackages(dir)).toMatchInlineSnapshot(`
+    "node_modules/no-deps/no-deps@1.0.0
+    node_modules/one-dep/one-dep@1.0.0"
+  `);
+  await expectLockfileStable(dir, await lockfile(dir));
 });
 
-test("changing overrides makes the lockfile changed, prevent frozen install", async () => {
-  const tmp = tmpdirSync();
-  writeFileSync(
-    join(tmp, "package.json"),
-    JSON.stringify({
-      dependencies: {},
-      overrides: {
-        bytes: "1.0.0",
-      },
-    }),
-  );
-  install(tmp, ["install", "express@4.18.2"]);
-
-  writeFileSync(
-    join(tmp, "package.json"),
-    JSON.stringify({
-      ...JSON.parse(readFileSync(join(tmp, "package.json")).toString()),
-      overrides: {
-        bytes: "1.0.1",
-      },
-    }),
-  );
+test.concurrent("overrides to npm specifier", async () => {
+  const dir = await project({ dependencies: {}, overrides: { "no-deps": "npm:a-dep@1.0.1" } });
+
+  const { stdout, stderr, exitCode } = await bun(dir, "install", "one-dep");
+
+  expect(stdout).toMatchInlineSnapshot(`
+    "bun add <version> (<revision>)
 
-  installExpectFail(tmp, ["install", "--frozen-lockfile"]);
+    installed one-dep@1.0.0
+
+    2 packages installed"
+  `);
+  expect(stderr).toMatchInlineSnapshot(`"Saved lockfile"`);
+  expect(exitCode).toBe(0);
+  expect(nodeModulesPackages(dir)).toMatchInlineSnapshot(`
+    "node_modules/no-deps/a-dep@1.0.1
+    node_modules/one-dep/one-dep@1.0.0"
+  `);
+  await expectLockfileStable(dir, await lockfile(dir));
 });
 
-test("overrides reset when removed", async () => {
-  const tmp = tmpdirSync();
-  writeFileSync(
-    join(tmp, "package.json"),
-    JSON.stringify({
-      overrides: {
-        bytes: "1.0.0",
-      },
-    }),
-  );
-  install(tmp, ["install", "express@4.18.2"]);
-  expect(versionOf(tmp, "node_modules/bytes/package.json")).toBe("1.0.0");
-
-  writeFileSync(
-    join(tmp, "package.json"),
-    JSON.stringify({
-      ...JSON.parse(readFileSync(join(tmp, "package.json")).toString()),
-      overrides: undefined,
-    }),
-  );
-  install(tmp, ["install"]);
-  expect(versionOf(tmp, "node_modules/bytes/package.json")).not.toBe("1.0.0");
+test.concurrent("changing overrides makes the lockfile changed, prevent frozen install", async () => {
+  const dir = await project({ dependencies: {}, overrides: { "no-deps": "1.0.0" } });
+  const add = await bun(dir, "install", "one-dep");
+  expect(add.stderr).toMatchInlineSnapshot(`"Saved lockfile"`);
+  expect(add.exitCode).toBe(0);
+  const lock = await lockfile(dir);
+  const tree = nodeModulesPackages(dir);
+  expect(tree).toMatchInlineSnapshot(`
+    "node_modules/no-deps/no-deps@1.0.0
+    node_modules/one-dep/one-dep@1.0.0"
+  `);
+
+  await editPackageJson(dir, pkg => (pkg.overrides = { "no-deps": "1.1.0" }));
+  const { stdout, stderr, exitCode } = await bun(dir, "install", "--frozen-lockfile");
 
-  ensureLockfileDoesntChangeOnBunI(tmp);
+  expect(stdout).toMatchInlineSnapshot(`"bun install <version> (<revision>)"`);
+  expect(stderr).toMatchInlineSnapshot(`
+    "error: lockfile had changes, but lockfile is frozen
+    note: overrides in package.json changed since bun.lock was saved
+    note: try re-running without --frozen-lockfile and commit the updated lockfile"
+  `);
+  expect(exitCode).toBe(1);
+  expect(await lockfile(dir)).toBe(lock);
+  expect(nodeModulesPackages(dir)).toBe(tree);
 });
 
-test("overrides do not apply to workspaces", async () => {
-  const tmp = tmpdirSync();
-  await Promise.all([
-    write(
-      join(tmp, "package.json"),
-      JSON.stringify({ name: "monorepo-root", workspaces: ["packages/*"], overrides: { "pkg1": "file:pkg2" } }),
-    ),
-    write(
-      join(tmp, "packages", "pkg1", "package.json"),
-      JSON.stringify({
-        name: "pkg1",
-        version: "1.1.1",
-      }),
-    ),
-    write(
-      join(tmp, "pkg2", "package.json"),
-      JSON.stringify({
-        name: "pkg2",
-        version: "2.2.2",
-      }),
-    ),
-  ]);
-
-  let { exited, stderr } = Bun.spawn({
-    cmd: [bunExe(), "install"],
-    cwd: tmp,
-    env: bunEnv,
-    stderr: "pipe",
-    stdout: "inherit",
-  });
+test.concurrent("overrides reset when removed", async () => {
+  const dir = await project({ overrides: { "no-deps": "1.0.0" } });
+  const add = await bun(dir, "install", "one-dep");
+  expect(add.stderr).toMatchInlineSnapshot(`"Saved lockfile"`);
+  expect(add.exitCode).toBe(0);
+  expect(nodeModulesPackages(dir)).toMatchInlineSnapshot(`
+    "node_modules/no-deps/no-deps@1.0.0
+    node_modules/one-dep/one-dep@1.0.0"
+  `);
+  expect(await lockfile(dir)).toContain('"overrides"');
 
-  expect(await exited).toBe(0);
-  expect(await stderr.text()).toContain("Saved lockfile");
+  await editPackageJson(dir, pkg => delete pkg.overrides);
+  const { stdout, stderr, exitCode } = await bun(dir, "install");
 
-  // --frozen-lockfile works
-  ({ exited, stderr } = Bun.spawn({
-    cmd: [bunExe(), "install", "--frozen-lockfile"],
-    cwd: tmp,
-    env: bunEnv,
-    stderr: "pipe",
-    stdout: "inherit",
-  }));
+  expect(stdout).toMatchInlineSnapshot(`
+    "bun install <version> (<revision>)
+
+    1 package installed"
+  `);
+  expect(stderr).toMatchInlineSnapshot(`"Saved lockfile"`);
+  expect(exitCode).toBe(0);
+  expect(nodeModulesPackages(dir)).toMatchInlineSnapshot(`
+    "node_modules/no-deps/no-deps@1.0.1
+    node_modules/one-dep/one-dep@1.0.0"
+  `);
+  const lock = await lockfile(dir);
+  expect(lock).not.toContain('"overrides"');
+  await expectLockfileStable(dir, lock);
+});
 
-  expect(await exited).toBe(0);
-  expect(await stderr.text()).not.toContain("Frozen lockfile");
+test.concurrent("overrides do not apply to workspaces", async () => {
+  const dir = await project(
+    { name: "monorepo-root", workspaces: ["packages/*"], overrides: { pkg1: "file:pkg2" } },
+    {
+      "packages/pkg1/package.json": JSON.stringify({ name: "pkg1", version: "1.1.1" }),
+      "pkg2/package.json": JSON.stringify({ name: "pkg2", version: "2.2.2" }),
+    },
+  );
 
-  // lockfile is not changed
+  const { stdout, stderr, exitCode } = await bun(dir, "install");
 
-  ({ exited, stderr } = Bun.spawn({
-    cmd: [bunExe(), "install"],
-    cwd: tmp,
-    env: bunEnv,
-    stderr: "pipe",
-    stdout: "inherit",
-  }));
+  expect(stdout).toMatchInlineSnapshot(`
+    "bun install <version> (<revision>)
 
-  expect(await exited).toBe(0);
-  expect(await stderr.text()).not.toContain("Saved lockfile");
+    1 package installed"
+  `);
+  expect(stderr).toMatchInlineSnapshot(`"Saved lockfile"`);
+  expect(exitCode).toBe(0);
+  // node_modules/pkg1 links to the workspace; the override is recorded but does not redirect it to pkg2.
+  expect(await file(join(dir, "node_modules", "pkg1", "package.json")).json()).toEqual({
+    name: "pkg1",
+    version: "1.1.1",
+  });
+  const lock = await lockfile(dir);
+  expect(lock).toMatchInlineSnapshot(`
+    "{
+      "lockfileVersion": 2,
+      "configVersion": 1,
+      "workspaces": {
+        "": {
+          "name": "monorepo-root",
+        },
+        "packages/pkg1": {
+          "name": "pkg1",
+          "version": "1.1.1",
+        },
+      },
+      "overrides": {
+        "pkg1": "file:pkg2",
+      },
+      "packages": {
+        "pkg1": ["pkg1@workspace:packages/pkg1"],
+      }
+    }
+    "
+  `);
+  await expectLockfileStable(dir, lock);
 });
diff --git a/test/no-validate-leaksan.txt b/test/no-validate-leaksan.txt
index e4f53b8bfa48..f5b318e377ec 100644
--- a/test/no-validate-leaksan.txt
+++ b/test/no-validate-leaksan.txt
@@ -46,7 +46,6 @@ test/cli/install/bunx.test.ts
 test/cli/install/isolated-install.test.ts
 test/cli/install/migration/complex-workspace.test.ts
 test/cli/install/npmrc.test.ts
-test/cli/install/overrides.test.ts
 test/cli/install/test-dev-peer-dependency-priority.test.ts
 test/cli/run/commonjs-invalid.test.ts
 test/cli/run/preload-test.test.js

From 7bd4bbf5252d8b280f7470f507a1043b2fa855a4 Mon Sep 17 00:00:00 2001
From: robobun <117481402+robobun@users.noreply.github.com>
Date: Mon, 17 Aug 2026 01:09:40 +0000
Subject: [PATCH 084/258] test(install): serve GitHub tarball fixtures locally
 in the GHSA-pfwx-36v6-832x and lifecycle script tests (#39115)

---
 test/cli/install/GHSA-pfwx-36v6-832x.test.ts  | 386 ++++++++----------
 .../bun-install-lifecycle-scripts.test.ts     |  52 ++-
 test/cli/install/isolated-install.test.ts     |  39 +-
 test/harness.ts                               |  16 +
 4 files changed, 237 insertions(+), 256 deletions(-)

diff --git a/test/cli/install/GHSA-pfwx-36v6-832x.test.ts b/test/cli/install/GHSA-pfwx-36v6-832x.test.ts
index 457b4068e2f2..c9ca2a047e33 100644
--- a/test/cli/install/GHSA-pfwx-36v6-832x.test.ts
+++ b/test/cli/install/GHSA-pfwx-36v6-832x.test.ts
@@ -1,255 +1,207 @@
-import { file } from "bun";
 import { describe, expect, test } from "bun:test";
-import { rm } from "fs/promises";
-import { bunEnv, bunExe, tempDir } from "harness";
-import { join } from "path";
-
-// Each test uses its own BUN_INSTALL_CACHE_DIR inside the temp dir for full
-// isolation.  This avoids interfering with the global cache or other tests.
-function envWithCache(dir: string) {
-  return { ...bunEnv, BUN_INSTALL_CACHE_DIR: join(String(dir), ".bun-cache") };
+import { bunEnv, bunExe, githubTarball, tempDir, textLockfile } from "harness";
+import { createHash } from "node:crypto";
+import { existsSync } from "node:fs";
+import { rm } from "node:fs/promises";
+import { join } from "node:path";
+
+// GHSA-pfwx-36v6-832x: bun.lock records the sha512 of a GitHub dependency's tarball next
+// to its resolved commit, and an install that downloads the tarball again rejects
+// different bytes.
+//
+// `owner/repo#ref` is fetched from `${GITHUB_API_URL}/repos/owner/repo/tarball/ref`, so
+// each test serves the tarball built below from its own local server; nothing in this
+// file talks to api.github.com.
+
+const name = "gh-dep";
+const owner = "gh-owner";
+const repo = "gh-repo";
+const ref = "0badc0d";
+const spec = `${owner}/${repo}#${ref}`;
+// GitHub's tarballs unpack into `<owner>-<repo>-<short sha>`; bun records that directory
+// name in the lockfile as the resolved commit.
+const resolved = `${owner}-${repo}-${ref}`;
+const tarballPath = `/repos/${owner}/${repo}/tarball/${ref}`;
+
+// Pseudo-random bytes (xorshift32) so gzip cannot shrink them.
+function incompressible(bytes: number): Uint8Array {
+  const words = new Uint32Array(bytes / 4);
+  let x = 0x2545f491;
+  for (let i = 0; i < words.length; i++) {
+    x ^= x << 13;
+    x ^= x >>> 17;
+    x ^= x << 5;
+    words[i] = x;
+  }
+  return new Uint8Array(words.buffer);
 }
 
-describe.concurrent("GitHub tarball integrity", () => {
-  test("should store integrity hash in lockfile for GitHub dependencies", async () => {
-    using dir = tempDir("github-integrity", {
-      "package.json": JSON.stringify({
-        name: "test-github-integrity",
-        dependencies: {
-          "is-number": "jonschlinkert/is-number#98e8ff1",
-        },
-      }),
-    });
+const tarball = await githubTarball(resolved, {
+  "package.json": JSON.stringify({ name, version: "1.0.0" }),
+  "index.js": "module.exports = 1;\n",
+  // The HTTP client reads at most 512 KiB (LIBUS_RECV_BUFFER_LENGTH) per socket read, so a
+  // larger tarball always arrives in several chunks. That is what lets the streaming variant
+  // below commit to streaming extraction on every run instead of falling back to buffering
+  // when the whole body happens to arrive at once.
+  "filler.bin": incompressible(600 * 1024),
+});
+expect(tarball.length).toBeGreaterThan(512 * 1024);
 
-    const env = envWithCache(dir);
+const integrity = `sha512-${createHash("sha512").update(tarball).digest("base64")}`;
+const wrongIntegrity = `sha512-${Buffer.alloc(64).toString("base64")}`;
+const lockedPackage = `${name}@github:${spec}`;
 
-    await using proc = Bun.spawn({
-      cmd: [bunExe(), "install"],
-      cwd: String(dir),
-      env,
-      stdout: "pipe",
-      stderr: "pipe",
-    });
+function project(files: Record<string, string> = {}) {
+  return tempDir("github-integrity", {
+    "package.json": JSON.stringify({ name: "app", dependencies: { [name]: spec } }),
+    ...files,
+  });
+}
 
-    const [stdout, stderr, exitCode] = await Promise.all([proc.stdout.text(), proc.stderr.text(), proc.exited]);
+function lockfileWith(entry: unknown[]) {
+  return textLockfile(1, {
+    workspaces: { "": { name: "app", dependencies: { [name]: spec } } },
+    packages: { [name]: entry },
+  });
+}
 
+async function lockedEntry(dir: string) {
+  const { packages } = Bun.JSONC.parse(await Bun.file(join(dir, "bun.lock")).text()) as {
+    packages: Record<string, unknown[]>;
+  };
+  return packages[name];
+}
+
+// Tarballs smaller than BUN_INSTALL_STREAMING_MIN_SIZE (2 MiB by default) are extracted
+// once the whole body has been buffered; larger ones are streamed into libarchive while
+// they download. The two extractors hash and verify the tarball independently, so every
+// test runs against both. `--verbose` output names the extractor that ran.
+const variants = [
+  { variant: "buffered", variantEnv: {}, extracted: `[${name}] Extract ` },
+  { variant: "streaming", variantEnv: { BUN_INSTALL_STREAMING_MIN_SIZE: "1" }, extracted: `[${name}] Streamed ` },
+];
+
+describe.each(variants)("GitHub tarball integrity ($variant extraction)", ({ variantEnv, extracted }) => {
+  function serveTarball(dir: string) {
+    const requests: string[] = [];
+    const server = Bun.serve({
+      port: 0,
+      fetch(request) {
+        const { pathname } = new URL(request.url);
+        requests.push(pathname);
+        return pathname === tarballPath ? new Response(tarball) : new Response("Not Found", { status: 404 });
+      },
+    });
+    return {
+      requests,
+      async install() {
+        await using proc = Bun.spawn({
+          cmd: [bunExe(), "install", "--verbose"],
+          cwd: dir,
+          env: {
+            ...bunEnv,
+            ...variantEnv,
+            GITHUB_API_URL: server.url.origin,
+            BUN_INSTALL_CACHE_DIR: join(dir, ".bun-cache"),
+          },
+          stdout: "ignore",
+          stderr: "pipe",
+        });
+        const [stderr, exitCode] = await Promise.all([proc.stderr.text(), proc.exited]);
+        return { stderr, exitCode };
+      },
+      [Symbol.asyncDispose]: () => server.stop(),
+    };
+  }
+
+  test.concurrent("stores the tarball's integrity in the lockfile", async () => {
+    using dir = project();
+    await using github = serveTarball(String(dir));
+
+    const { stderr, exitCode } = await github.install();
+    expect(stderr).toContain(extracted);
+    expect(stderr).not.toContain("error:");
     expect(stderr).toContain("Saved lockfile");
     expect(exitCode).toBe(0);
 
-    const lockfileContent = await file(join(String(dir), "bun.lock")).text();
-
-    // The lockfile should contain a sha512 integrity hash for the GitHub dependency
-    expect(lockfileContent).toContain("sha512-");
-    // The resolved commit hash should be present
-    expect(lockfileContent).toContain("jonschlinkert-is-number-98e8ff1");
-    // Verify the format: the integrity appears after the resolved commit hash
-    expect(lockfileContent).toMatch(/"jonschlinkert-is-number-98e8ff1",\s*"sha512-/);
+    expect(github.requests).toEqual([tarballPath]);
+    expect(await lockedEntry(String(dir))).toEqual([lockedPackage, {}, resolved, integrity]);
+    expect(existsSync(join(String(dir), "node_modules", name, "index.js"))).toBeTrue();
   });
 
-  test("should verify integrity passes on re-install with matching hash", async () => {
-    using dir = tempDir("github-integrity-match", {
-      "package.json": JSON.stringify({
-        name: "test-github-integrity-match",
-        dependencies: {
-          "is-number": "jonschlinkert/is-number#98e8ff1",
-        },
-      }),
-    });
-
-    const env = envWithCache(dir);
+  test.concurrent("re-downloading a tarball that matches the locked integrity succeeds", async () => {
+    using dir = project();
+    await using github = serveTarball(String(dir));
 
-    // First install to generate lockfile with correct integrity
-    await using proc1 = Bun.spawn({
-      cmd: [bunExe(), "install"],
-      cwd: String(dir),
-      env,
-      stdout: "pipe",
-      stderr: "pipe",
-    });
-
-    const [stdout1, stderr1, exitCode1] = await Promise.all([proc1.stdout.text(), proc1.stderr.text(), proc1.exited]);
-    expect(stderr1).not.toContain("error:");
-    expect(exitCode1).toBe(0);
-
-    // Read the generated lockfile and extract the integrity hash adjacent to
-    // the GitHub resolved entry to avoid accidentally matching an npm hash.
-    const lockfileContent = await file(join(String(dir), "bun.lock")).text();
-    const integrityMatch = lockfileContent.match(/"jonschlinkert-is-number-98e8ff1",\s*"(sha512-[A-Za-z0-9+/]+=*)"/);
-    expect(integrityMatch).not.toBeNull();
-    const integrityHash = integrityMatch![1];
+    const first = await github.install();
+    expect(first.stderr).not.toContain("error:");
+    expect(first.exitCode).toBe(0);
+    expect(await lockedEntry(String(dir))).toEqual([lockedPackage, {}, resolved, integrity]);
 
-    // Clear cache and node_modules, then re-install with the same lockfile
     await rm(join(String(dir), ".bun-cache"), { recursive: true, force: true });
     await rm(join(String(dir), "node_modules"), { recursive: true, force: true });
 
-    await using proc2 = Bun.spawn({
-      cmd: [bunExe(), "install"],
-      cwd: String(dir),
-      env,
-      stdout: "pipe",
-      stderr: "pipe",
-    });
-
-    const [stdout2, stderr2, exitCode2] = await Promise.all([proc2.stdout.text(), proc2.stderr.text(), proc2.exited]);
+    const second = await github.install();
+    expect(second.stderr).toContain(extracted);
+    expect(second.stderr).not.toContain("error:");
+    expect(second.exitCode).toBe(0);
 
-    // Should succeed because the integrity matches
-    expect(stderr2).not.toContain("Integrity check failed");
-    expect(exitCode2).toBe(0);
-
-    // Lockfile should still contain the same integrity hash
-    const lockfileContent2 = await file(join(String(dir), "bun.lock")).text();
-    expect(lockfileContent2).toContain(integrityHash);
+    expect(github.requests).toEqual([tarballPath, tarballPath]);
+    expect(await lockedEntry(String(dir))).toEqual([lockedPackage, {}, resolved, integrity]);
+    expect(existsSync(join(String(dir), "node_modules", name, "index.js"))).toBeTrue();
   });
 
-  test("should reject GitHub tarball when integrity check fails", async () => {
-    using dir = tempDir("github-integrity-reject", {
-      "package.json": JSON.stringify({
-        name: "test-github-integrity-reject",
-        dependencies: {
-          "is-number": "jonschlinkert/is-number#98e8ff1",
-        },
-      }),
-      // Pre-create a lockfile with an invalid integrity hash (valid base64, 64 zero bytes)
-      "bun.lock": JSON.stringify({
-        lockfileVersion: 1,
-        configVersion: 1,
-        workspaces: {
-          "": {
-            name: "test-github-integrity-reject",
-            dependencies: {
-              "is-number": "jonschlinkert/is-number#98e8ff1",
-            },
-          },
-        },
-        packages: {
-          "is-number": [
-            "is-number@github:jonschlinkert/is-number#98e8ff1",
-            {},
-            "jonschlinkert-is-number-98e8ff1",
-            "sha512-AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==",
-          ],
-        },
-      }),
-    });
-
-    // Fresh per-test cache ensures the tarball must be downloaded from the network
-    const env = envWithCache(dir);
-
-    await using proc = Bun.spawn({
-      cmd: [bunExe(), "install"],
-      cwd: String(dir),
-      env,
-      stdout: "pipe",
-      stderr: "pipe",
-    });
-
-    const [stdout, stderr, exitCode] = await Promise.all([proc.stdout.text(), proc.stderr.text(), proc.exited]);
+  test.concurrent("rejects a tarball that does not match the locked integrity", async () => {
+    using dir = project({ "bun.lock": lockfileWith([lockedPackage, {}, resolved, wrongIntegrity]) });
+    await using github = serveTarball(String(dir));
 
-    expect(stderr).toContain("Integrity check failed");
+    // Both extractors report the mismatch before they log which one ran, so unlike the
+    // other tests this one cannot check `extracted`; the download is shaped exactly like
+    // theirs, so it goes through the same extractor they prove is in use.
+    const { stderr, exitCode } = await github.install();
+    expect(stderr).toContain(`Integrity check failed for tarball: ${name}`);
     expect(exitCode).not.toBe(0);
-  });
-
-  test("should update lockfile with integrity when old format has none", async () => {
-    using dir = tempDir("github-integrity-upgrade", {
-      "package.json": JSON.stringify({
-        name: "test-github-integrity-upgrade",
-        dependencies: {
-          "is-number": "jonschlinkert/is-number#98e8ff1",
-        },
-      }),
-      // Pre-create a lockfile in the old format (no integrity hash)
-      "bun.lock": JSON.stringify({
-        lockfileVersion: 1,
-        configVersion: 1,
-        workspaces: {
-          "": {
-            name: "test-github-integrity-upgrade",
-            dependencies: {
-              "is-number": "jonschlinkert/is-number#98e8ff1",
-            },
-          },
-        },
-        packages: {
-          "is-number": ["is-number@github:jonschlinkert/is-number#98e8ff1", {}, "jonschlinkert-is-number-98e8ff1"],
-        },
-      }),
-    });
-
-    // Fresh per-test cache ensures the tarball must be downloaded
-    const env = envWithCache(dir);
 
-    await using proc = Bun.spawn({
-      cmd: [bunExe(), "install"],
-      cwd: String(dir),
-      env,
-      stdout: "pipe",
-      stderr: "pipe",
-    });
+    expect(github.requests).toEqual([tarballPath]);
+    expect(existsSync(join(String(dir), "node_modules", name))).toBeFalse();
+    expect(await lockedEntry(String(dir))).toEqual([lockedPackage, {}, resolved, wrongIntegrity]);
+  });
 
-    const [stdout, stderr, exitCode] = await Promise.all([proc.stdout.text(), proc.stderr.text(), proc.exited]);
+  test.concurrent("adds the integrity to a lockfile written before it was recorded", async () => {
+    using dir = project({ "bun.lock": lockfileWith([lockedPackage, {}, resolved]) });
+    await using github = serveTarball(String(dir));
 
-    // Should succeed without errors
-    expect(stderr).not.toContain("Integrity check failed");
+    const { stderr, exitCode } = await github.install();
+    expect(stderr).toContain(extracted);
     expect(stderr).not.toContain("error:");
-    // The lockfile should be re-saved with the new integrity hash
     expect(stderr).toContain("Saved lockfile");
     expect(exitCode).toBe(0);
 
-    // Verify the lockfile now contains the integrity hash
-    const lockfileContent = await file(join(String(dir), "bun.lock")).text();
-    expect(lockfileContent).toContain("sha512-");
-    expect(lockfileContent).toMatch(/"jonschlinkert-is-number-98e8ff1",\s*"sha512-/);
+    expect(github.requests).toEqual([tarballPath]);
+    expect(await lockedEntry(String(dir))).toEqual([lockedPackage, {}, resolved, integrity]);
+    expect(existsSync(join(String(dir), "node_modules", name, "index.js"))).toBeTrue();
   });
 
-  test("should accept GitHub dependency from cache without re-downloading", async () => {
-    // Use a shared cache dir for both installs so the second is a true cache hit
-    using dir = tempDir("github-integrity-cached", {
-      "package.json": JSON.stringify({
-        name: "test-github-integrity-cached",
-        dependencies: {
-          "is-number": "jonschlinkert/is-number#98e8ff1",
-        },
-      }),
-    });
-
-    const env = envWithCache(dir);
-
-    // First install warms the per-test cache
-    await using proc1 = Bun.spawn({
-      cmd: [bunExe(), "install"],
-      cwd: String(dir),
-      env,
-      stdout: "pipe",
-      stderr: "pipe",
-    });
+  test.concurrent("installs from the cache without downloading when the lockfile has no integrity", async () => {
+    using dir = project();
+    await using github = serveTarball(String(dir));
 
-    const [stdout1, stderr1, exitCode1] = await Promise.all([proc1.stdout.text(), proc1.stderr.text(), proc1.exited]);
-    expect(stderr1).not.toContain("error:");
-    expect(exitCode1).toBe(0);
+    const first = await github.install();
+    expect(first.stderr).toContain(extracted);
+    expect(first.stderr).not.toContain("error:");
+    expect(first.exitCode).toBe(0);
 
-    // Remove node_modules but keep the cache
     await rm(join(String(dir), "node_modules"), { recursive: true, force: true });
+    const lockfile = join(String(dir), "bun.lock");
+    await Bun.write(lockfile, (await Bun.file(lockfile).text()).replace(`, "${integrity}"`, ""));
+    expect(await lockedEntry(String(dir))).toEqual([lockedPackage, {}, resolved]);
 
-    // Strip the integrity from the lockfile to simulate an old-format lockfile
-    // that should still work when the cache already has the package
-    const lockfileContent = await file(join(String(dir), "bun.lock")).text();
-    const stripped = lockfileContent.replace(/,\s*"sha512-[^"]*"/, "");
-    await Bun.write(join(String(dir), "bun.lock"), stripped);
-
-    // Second install should hit the cache and succeed without re-downloading
-    await using proc2 = Bun.spawn({
-      cmd: [bunExe(), "install"],
-      cwd: String(dir),
-      env,
-      stdout: "pipe",
-      stderr: "pipe",
-    });
-
-    const [stdout2, stderr2, exitCode2] = await Promise.all([proc2.stdout.text(), proc2.stderr.text(), proc2.exited]);
+    const second = await github.install();
+    expect(second.stderr).not.toContain(extracted);
+    expect(second.stderr).not.toContain("error:");
+    expect(second.exitCode).toBe(0);
 
-    // Should succeed without integrity errors (package served from cache)
-    expect(stderr2).not.toContain("Integrity check failed");
-    expect(stderr2).not.toContain("error:");
-    expect(exitCode2).toBe(0);
+    expect(github.requests).toEqual([tarballPath]);
+    expect(existsSync(join(String(dir), "node_modules", name, "index.js"))).toBeTrue();
   });
 });
diff --git a/test/cli/install/bun-install-lifecycle-scripts.test.ts b/test/cli/install/bun-install-lifecycle-scripts.test.ts
index 67f17aeee79b..b01d72bc737a 100644
--- a/test/cli/install/bun-install-lifecycle-scripts.test.ts
+++ b/test/cli/install/bun-install-lifecycle-scripts.test.ts
@@ -7,6 +7,7 @@ import {
   assertManifestsPopulated,
   bunEnv as baseEnv,
   bunExe,
+  githubTarball,
   isLinux,
   isWindows,
   readdirSorted,
@@ -17,14 +18,51 @@ import { join, sep } from "path";
 
 var verdaccio = new VerdaccioRegistry();
 
+// `owner/repo#commit` dependencies are downloaded from `${GITHUB_API_URL}/repos/...`, so
+// the repository below is served by this local server instead of api.github.com.
+const githubOwner = "lifecycle-owner";
+const githubRepo = "lifecycle-install-test";
+const githubCommit = "1234567890abcdef1234567890abcdef12345678";
+const githubDependency = `${githubOwner}/${githubRepo}#${githubCommit}`;
+const githubTarballPath = `/repos/${githubOwner}/${githubRepo}/tarball/${githubCommit}`;
+const githubLifecycleScripts = ["preinstall", "install", "postinstall", "preprepare", "prepare", "postprepare"];
+const githubRepositoryTarball = await githubTarball(`${githubOwner}-${githubRepo}-${githubCommit.slice(0, 7)}`, {
+  "package.json": JSON.stringify({
+    name: githubRepo,
+    version: "1.0.0",
+    scripts: Object.fromEntries(githubLifecycleScripts.map(script => [script, `bun ${script}.js`])),
+  }),
+  ...Object.fromEntries(
+    githubLifecycleScripts.map(script => [
+      `${script}.js`,
+      `
+      import { writeFileSync } from "fs";
+      import { join } from "path";
+
+      writeFileSync(join(import.meta.dir, "${script}.txt"), "${script}!");
+      `,
+    ]),
+  ),
+});
+let github: ReturnType<typeof Bun.serve>;
+
 setDefaultTimeout(1000 * 60 * 5);
 
 beforeAll(async () => {
+  github = Bun.serve({
+    port: 0,
+    fetch(request) {
+      return new URL(request.url).pathname === githubTarballPath
+        ? new Response(githubRepositoryTarball)
+        : new Response("Not Found", { status: 404 });
+    },
+  });
   await verdaccio.start();
 });
 
-afterAll(() => {
+afterAll(async () => {
   verdaccio.stop();
+  await github.stop();
 });
 
 function splitErrLines(err: string): string[] {
@@ -2619,7 +2657,11 @@ for (const forceWaiterThread of isLinux ? [false, true] : [false]) {
     test("git dependencies also run `preprepare`, `prepare`, and `postprepare` scripts", async () => {
       using ctx = await setupTest();
       const { packageDir, packageJson, env } = ctx;
-      const testEnv = forceWaiterThread ? { ...env, BUN_FEATURE_FLAG_FORCE_WAITER_THREAD: "1" } : env;
+      const testEnv = {
+        ...env,
+        GITHUB_API_URL: github.url.origin,
+        ...(forceWaiterThread ? { BUN_FEATURE_FLAG_FORCE_WAITER_THREAD: "1" } : {}),
+      };
 
       await writeFile(
         packageJson,
@@ -2627,7 +2669,7 @@ for (const forceWaiterThread of isLinux ? [false, true] : [false]) {
           name: "foo",
           version: "1.0.0",
           dependencies: {
-            "lifecycle-install-test": "dylan-conway/lifecycle-install-test#3ba6af5b64f2d27456e08df21d750072dffd3eee",
+            "lifecycle-install-test": githubDependency,
           },
         }),
       );
@@ -2649,7 +2691,7 @@ for (const forceWaiterThread of isLinux ? [false, true] : [false]) {
       expect(out.replace(/\s*\[[0-9\.]+m?s\]$/m, "").split(/\r?\n/)).toEqual([
         expect.stringContaining("bun install v1."),
         "",
-        "+ lifecycle-install-test@github:dylan-conway/lifecycle-install-test#3ba6af5",
+        `+ lifecycle-install-test@github:${githubOwner}/${githubRepo}#${githubCommit.slice(0, 7)}`,
         "",
         "1 package installed",
         "",
@@ -2672,7 +2714,7 @@ for (const forceWaiterThread of isLinux ? [false, true] : [false]) {
           name: "foo",
           version: "1.0.0",
           dependencies: {
-            "lifecycle-install-test": "dylan-conway/lifecycle-install-test#3ba6af5b64f2d27456e08df21d750072dffd3eee",
+            "lifecycle-install-test": githubDependency,
           },
           trustedDependencies: ["lifecycle-install-test"],
         }),
diff --git a/test/cli/install/isolated-install.test.ts b/test/cli/install/isolated-install.test.ts
index cade501878db..1f5cfcf1aef5 100644
--- a/test/cli/install/isolated-install.test.ts
+++ b/test/cli/install/isolated-install.test.ts
@@ -2,7 +2,7 @@ import { file, spawn, write } from "bun";
 import { afterAll, beforeAll, describe, expect, test } from "bun:test";
 import { existsSync, lstatSync, readlinkSync, statSync } from "fs";
 import { mkdir, readlink, rm, symlink } from "fs/promises";
-import { VerdaccioRegistry, bunEnv, bunExe, readdirSorted, runBunInstall, tempDir } from "harness";
+import { VerdaccioRegistry, bunEnv, bunExe, githubTarball, readdirSorted, runBunInstall, tempDir } from "harness";
 import { createRequire } from "module";
 import { basename, dirname, join } from "path";
 
@@ -858,39 +858,10 @@ index 0000000000000000000000000000000000000000..3b18e512dba79e4c8300dd08aeb37f8e
 test("adding and removing a patch for a github dependency in a workspace completes", async () => {
   const { packageJson, packageDir } = await registry.createTestDir({ bunfigOpts: { linker: "isolated" } });
 
-  // Minimal gzipped tarball shaped like a github codeload tarball: a single
-  // root directory wrapping the package contents.
-  function tarHeader(name: string, size: number, isDir: boolean): Uint8Array {
-    const header = new Uint8Array(512);
-    const encoder = new TextEncoder();
-    header.set(encoder.encode(name), 0);
-    header.set(encoder.encode(isDir ? "0000755 " : "0000644 "), 100);
-    header.set(encoder.encode("0000000 "), 108);
-    header.set(encoder.encode("0000000 "), 116);
-    header.set(encoder.encode(size.toString(8).padStart(11, "0") + " "), 124);
-    header.set(encoder.encode("00000000000 "), 136);
-    header.set(encoder.encode("        "), 148);
-    header[156] = (isDir ? "5" : "0").charCodeAt(0);
-    header.set(encoder.encode("ustar"), 257);
-    header.set(encoder.encode("00"), 263);
-    let checksum = 0;
-    for (const byte of header) checksum += byte;
-    header.set(encoder.encode(checksum.toString(8).padStart(6, "0") + "\0 "), 148);
-    return header;
-  }
-  const blocks: Uint8Array[] = [];
-  blocks.push(tarHeader("testowner-testrepo-aaaaaaa/", 0, true));
-  for (const [name, contents] of [
-    ["package.json", JSON.stringify({ name: "gh-dep", version: "1.0.0" })],
-    ["index.js", 'console.log("original");\n'],
-  ]) {
-    const bytes = new TextEncoder().encode(contents);
-    blocks.push(tarHeader(`testowner-testrepo-aaaaaaa/${name}`, bytes.length, false));
-    blocks.push(bytes);
-    if (bytes.length % 512 !== 0) blocks.push(new Uint8Array(512 - (bytes.length % 512)));
-  }
-  blocks.push(new Uint8Array(1024));
-  const tarball = Bun.gzipSync(Buffer.concat(blocks));
+  const tarball = await githubTarball("testowner-testrepo-aaaaaaa", {
+    "package.json": JSON.stringify({ name: "gh-dep", version: "1.0.0" }),
+    "index.js": 'console.log("original");\n',
+  });
 
   using server = Bun.serve({
     port: 0,
diff --git a/test/harness.ts b/test/harness.ts
index 543e60dca8e2..902c5ed663f0 100644
--- a/test/harness.ts
+++ b/test/harness.ts
@@ -1880,6 +1880,22 @@ export function textLockfile(version: number, pkgs: any): string {
   });
 }
 
+/**
+ * Builds the gzipped tarball GitHub serves for `/repos/<owner>/<repo>/tarball/<ref>`: one
+ * root directory, which GitHub names `<owner>-<repo>-<short sha>`, with the repository's
+ * files inside it. `bun install` reads the dependency's resolved commit (the lockfile's
+ * third tuple element and the installed `.bun-tag`) from the archive's first entry, which
+ * is why the root directory gets an entry of its own ahead of the files.
+ *
+ * Serve the bytes from a local server and pass its URL as `GITHUB_API_URL` to install
+ * `owner/repo#ref` dependencies without contacting api.github.com.
+ */
+export function githubTarball(rootDir: string, files: Record<string, string | Uint8Array>) {
+  const entries: Record<string, string | Uint8Array> = { [`${rootDir}/`]: "" };
+  for (const [path, contents] of Object.entries(files)) entries[`${rootDir}/${path}`] = contents;
+  return new Bun.Archive(entries, { compress: "gzip" }).bytes();
+}
+
 export class VerdaccioRegistry {
   #port: number | undefined;
   process: ChildProcess | undefined;

From f5a23812616a3f70e478effac130e67cb5ae0360 Mon Sep 17 00:00:00 2001
From: robobun <117481402+robobun@users.noreply.github.com>
Date: Mon, 17 Aug 2026 01:09:44 +0000
Subject: [PATCH 085/258] test: add a harness isRoot and skip the chmod-based
 ls and Bun.file cases as root (#39232)

---
 test/cli/install/bun-add-filter.test.ts       |  4 +--
 test/cli/install/bun-prune.test.ts            | 13 ++++++--
 test/cli/run/env.test.ts                      |  8 ++---
 test/cli/run/no-orphans.test.ts               |  4 +--
 test/harness.ts                               |  7 +++++
 test/js/bun/resolve/resolve.test.ts           |  3 +-
 ...esolver-permission-denied-ancestor.test.ts |  4 +--
 test/js/bun/shell/bunshell.test.ts            | 13 ++++++--
 test/js/bun/shell/commands/ls.test.ts         |  6 ++--
 test/js/bun/shell/commands/mv.test.ts         |  3 +-
 test/js/bun/spawn/spawn-cgroup.test.ts        |  4 +--
 test/js/bun/spawn/spawn.test.ts               |  3 +-
 test/js/bun/spawn/spawnSync.test.ts           |  4 +--
 .../node/child_process/child_process.test.ts  |  2 +-
 test/js/node/process/process.test.js          | 31 +++++++++----------
 test/js/node/watch/fs.watch.test.ts           |  5 ++-
 test/js/web/fetch/fetch.test.ts               |  6 ++--
 17 files changed, 67 insertions(+), 53 deletions(-)

diff --git a/test/cli/install/bun-add-filter.test.ts b/test/cli/install/bun-add-filter.test.ts
index 42b3f00aa574..3b9e90384dad 100644
--- a/test/cli/install/bun-add-filter.test.ts
+++ b/test/cli/install/bun-add-filter.test.ts
@@ -1,7 +1,7 @@
 import { file, write } from "bun";
 import { afterAll, beforeAll, expect, test } from "bun:test";
 import { chmod, exists, mkdir, rm } from "fs/promises";
-import { VerdaccioRegistry, bunEnv, bunExe, isWindows, normalizeBunSnapshot } from "harness";
+import { VerdaccioRegistry, bunEnv, bunExe, isRoot, isWindows, normalizeBunSnapshot } from "harness";
 import { join } from "path";
 
 const registry = new VerdaccioRegistry();
@@ -2141,7 +2141,7 @@ test.concurrent("remove --filter --dry-run touches nothing", async () => {
   expect(await exists(join(dir, "node_modules", "no-deps", "package.json"))).toBeTrue();
 });
 
-test.concurrent.skipIf(isWindows || process.getuid?.() === 0)(
+test.concurrent.skipIf(isWindows || isRoot)(
   "an unwritable target is reported by name, the rest is still written, exit code 1",
   async () => {
     const dir = await makeMonorepo();
diff --git a/test/cli/install/bun-prune.test.ts b/test/cli/install/bun-prune.test.ts
index adc4b67e87cb..dfb447a0b147 100644
--- a/test/cli/install/bun-prune.test.ts
+++ b/test/cli/install/bun-prune.test.ts
@@ -1,6 +1,15 @@
 import { file, write } from "bun";
 import { afterAll, beforeAll, expect, test } from "bun:test";
-import { bunEnv, bunExe, isWindows, normalizeBunSnapshot, runBunInstall, tempDir, VerdaccioRegistry } from "harness";
+import {
+  bunEnv,
+  bunExe,
+  isRoot,
+  isWindows,
+  normalizeBunSnapshot,
+  runBunInstall,
+  tempDir,
+  VerdaccioRegistry,
+} from "harness";
 import {
   chmodSync,
   closeSync,
@@ -2010,7 +2019,7 @@ test.concurrent("isolated + publicHoistPattern: hoisted links follow their store
   expect(await file(join(nm, "no-deps", "package.json")).json()).toMatchObject({ version: "1.0.0" });
 });
 
-test.concurrent.skipIf(isWindows || process.getuid?.() === 0)(
+test.concurrent.skipIf(isWindows || isRoot)(
   "a failed deletion is reported, the rest is removed, exit code 1",
   async () => {
     const dir = await setup({ name: "foo", dependencies: { "no-deps": "1.0.0" } });
diff --git a/test/cli/run/env.test.ts b/test/cli/run/env.test.ts
index 92b5f79aa494..76e03cb63018 100644
--- a/test/cli/run/env.test.ts
+++ b/test/cli/run/env.test.ts
@@ -9,6 +9,7 @@ import {
   isASAN,
   isDebug,
   isLinux,
+  isRoot,
   isWindows,
   tempDir,
   tempDirWithFiles,
@@ -1070,12 +1071,7 @@ function hasNobodyUser(): boolean {
   }
 }
 
-const canUseRunuser =
-  isLinux &&
-  typeof process.getuid === "function" &&
-  process.getuid() === 0 &&
-  !!Bun.which("runuser") &&
-  hasNobodyUser();
+const canUseRunuser = isLinux && isRoot && !!Bun.which("runuser") && hasNobodyUser();
 
 test.skipIf(!canUseRunuser)("process.env is preserved when cwd lacks read permission", () => {
   using dir = tempDir("env-eacces", {
diff --git a/test/cli/run/no-orphans.test.ts b/test/cli/run/no-orphans.test.ts
index 9ebcddfed0d2..954893df9fd1 100644
--- a/test/cli/run/no-orphans.test.ts
+++ b/test/cli/run/no-orphans.test.ts
@@ -1,6 +1,6 @@
 import { dlopen, FFIType } from "bun:ffi";
 import { describe, expect, setDefaultTimeout, test } from "bun:test";
-import { bunEnv, bunExe, isLinux, isMusl, isWindows, tempDir } from "harness";
+import { bunEnv, bunExe, isLinux, isMusl, isRoot, isWindows, tempDir } from "harness";
 import { chmodSync, readFileSync } from "node:fs";
 import { setTimeout as sleep } from "node:timers/promises";
 
@@ -219,7 +219,7 @@ test.concurrent.skipIf(!isPosix)(
 // Same as above but the grandchild is spawned with uid/gid. The credential
 // change clears the pdeathsig the spawn armed (prctl(2)), so this proves it
 // gets re-armed after setgid/setuid. Needs root to setuid.
-test.concurrent.skipIf(!isPosix || process.getuid?.() !== 0)(
+test.concurrent.skipIf(!isPosix || !isRoot)(
   "BUN_FEATURE_FLAG_NO_ORPHANS=1: a non-Bun grandchild spawned with uid/gid is reaped",
   async () => {
     const { sh, bunPid, grandchildPid } = await spawnTree("1", "child-nonbun-uid.js");
diff --git a/test/harness.ts b/test/harness.ts
index 902c5ed663f0..aafc014d44f6 100644
--- a/test/harness.ts
+++ b/test/harness.ts
@@ -24,6 +24,13 @@ export const isFreeBSD = process.platform === "freebsd";
 export const isAndroid = process.platform === "android";
 export const isPosix = isMacOS || isLinux || isFreeBSD || isAndroid;
 export const isWindows = process.platform === "win32";
+/**
+ * Whether the tests are running as uid 0. Root bypasses file and directory
+ * mode bits, so tests that expect EACCES from a `chmod 000` fixture skip on it,
+ * while tests that need to setuid/setgid a child only run on it. Always false
+ * on Windows, where `process.getuid` does not exist.
+ */
+export const isRoot = process.getuid?.() === 0;
 export const isIntelMacOS = isMacOS && process.arch === "x64";
 export const isArm64 = process.arch === "arm64";
 export const isDebug = Bun.version.includes("debug");
diff --git a/test/js/bun/resolve/resolve.test.ts b/test/js/bun/resolve/resolve.test.ts
index ed4bacadbae5..67a3d4c93643 100644
--- a/test/js/bun/resolve/resolve.test.ts
+++ b/test/js/bun/resolve/resolve.test.ts
@@ -1,7 +1,7 @@
 import { pathToFileURL } from "bun";
 import { describe, expect, it, test } from "bun:test";
 import { chmodSync, chownSync, mkdirSync, readFileSync, realpathSync, symlinkSync, writeFileSync } from "fs";
-import { bunEnv, bunExe, bunRun, isLinux, isMacOS, isWindows, joinP, tempDir, tempDirWithFiles } from "harness";
+import { bunEnv, bunExe, bunRun, isLinux, isMacOS, isRoot, isWindows, joinP, tempDir, tempDirWithFiles } from "harness";
 import { join, resolve, sep } from "path";
 
 const fixture = (...segs: string[]) => resolve(import.meta.dir, "fixtures", ...segs);
@@ -1043,7 +1043,6 @@ describe("dangling symlinks in node_modules", () => {
   // Root bypasses DAC, so chmod 0 won't yield EACCES. When running as root on
   // Linux we drop to `nobody` via runuser (and chown the temp dir so the
   // fixture can chmod it back). Otherwise we run the fixture directly.
-  const isRoot = !isWindows && process.getuid?.() === 0;
   const nobody = (() => {
     try {
       // /etc/passwd format: name:x:uid:gid:gecos:home:shell
diff --git a/test/js/bun/resolve/resolver-permission-denied-ancestor.test.ts b/test/js/bun/resolve/resolver-permission-denied-ancestor.test.ts
index 7e09bc0e40e8..ce860da4f6a3 100644
--- a/test/js/bun/resolve/resolver-permission-denied-ancestor.test.ts
+++ b/test/js/bun/resolve/resolver-permission-denied-ancestor.test.ts
@@ -1,6 +1,6 @@
 import { describe, expect, test } from "bun:test";
 import { chmodSync, rmSync } from "fs";
-import { bunEnv, bunExe, isWindows, tempDir } from "harness";
+import { bunEnv, bunExe, isRoot, isWindows, tempDir } from "harness";
 import { join } from "path";
 
 // An ancestor directory the process may traverse but not read (mode 0o111 —
@@ -8,7 +8,7 @@ import { join } from "path";
 // for readable subtrees: the resolver treats it as an opaque, empty
 // directory. Previously the whole walk failed with "error loading current
 // directory". Root bypasses permission checks, so skip there.
-describe.skipIf(isWindows || process.getuid?.() === 0)("resolver with unreadable ancestor", () => {
+describe.skipIf(isWindows || isRoot)("resolver with unreadable ancestor", () => {
   test("bun run works under an execute-only ancestor", () => {
     using dir = tempDir("xonly-ancestor", {
       "outer/project/package.json": JSON.stringify({
diff --git a/test/js/bun/shell/bunshell.test.ts b/test/js/bun/shell/bunshell.test.ts
index 2d57ca0587c9..69979c631d76 100644
--- a/test/js/bun/shell/bunshell.test.ts
+++ b/test/js/bun/shell/bunshell.test.ts
@@ -8,7 +8,17 @@ import { $ } from "bun";
 import { afterAll, beforeAll, describe, expect, it, test } from "bun:test";
 import { chmodSync, mkdirSync } from "fs";
 import { mkdir, rm, stat } from "fs/promises";
-import { bunExe, isPosix, isWindows, rss, runWithErrorPromise, tempDir, tempDirWithFiles, tmpdirSync } from "harness";
+import {
+  bunExe,
+  isPosix,
+  isRoot,
+  isWindows,
+  rss,
+  runWithErrorPromise,
+  tempDir,
+  tempDirWithFiles,
+  tmpdirSync,
+} from "harness";
 import { join, sep } from "path";
 import { createTestBuilder, sortedShellOutput } from "./util";
 const TestBuilder = createTestBuilder(import.meta.path);
@@ -54,7 +64,6 @@ afterAll(async () => {
 });
 
 const BUN = bunExe();
-const isRoot = process.getuid?.() === 0;
 
 describe("bunshell", () => {
   describe("exit codes", async () => {
diff --git a/test/js/bun/shell/commands/ls.test.ts b/test/js/bun/shell/commands/ls.test.ts
index 3c7ea5176cc3..66f2d5218bf6 100644
--- a/test/js/bun/shell/commands/ls.test.ts
+++ b/test/js/bun/shell/commands/ls.test.ts
@@ -1,6 +1,6 @@
 import { $ } from "bun";
 import { beforeAll, describe, expect, setDefaultTimeout, test } from "bun:test";
-import { isPosix, tempDir, tempDirWithFiles } from "harness";
+import { isPosix, isRoot, tempDir, tempDirWithFiles } from "harness";
 import { createTestBuilder } from "../util";
 const TestBuilder = createTestBuilder(import.meta.path);
 
@@ -301,7 +301,7 @@ describe.concurrent("bunshell ls", () => {
         .run();
     });
 
-    test.if(isPosix)("permission denied directory", async () => {
+    test.if(isPosix && !isRoot)("permission denied directory", async () => {
       await using tempdir = tempDir("ls-permission", {});
       await $`mkdir restricted; chmod 000 restricted`.quiet().throws(true).cwd(tempdir);
       await TestBuilder.command`ls restricted`
@@ -312,7 +312,7 @@ describe.concurrent("bunshell ls", () => {
       await $`chmod 755 restricted`.quiet().throws(true).cwd(tempdir); // cleanup
     });
 
-    test.if(isPosix)("permission denied directory recursive", async () => {
+    test.if(isPosix && !isRoot)("permission denied directory recursive", async () => {
       await using tempdir = tempDir("ls-permission-recursive", {});
       // Create 3-level deep directory structure with 3+ items per level
       await $`mkdir -p level1/level2/level3; 
diff --git a/test/js/bun/shell/commands/mv.test.ts b/test/js/bun/shell/commands/mv.test.ts
index 4389044ae861..4d6d532fada8 100644
--- a/test/js/bun/shell/commands/mv.test.ts
+++ b/test/js/bun/shell/commands/mv.test.ts
@@ -1,6 +1,6 @@
 import { $ } from "bun";
 import { describe, expect, test } from "bun:test";
-import { isPosix } from "harness";
+import { isPosix, isRoot } from "harness";
 import {
   accessSync,
   chmodSync,
@@ -20,7 +20,6 @@ import { join } from "path";
 import { createTestBuilder } from "../test_builder";
 import { sortedShellOutput } from "../util";
 const TestBuilder = createTestBuilder(import.meta.path);
-const isRoot = process.getuid?.() === 0;
 
 $.nothrow();
 
diff --git a/test/js/bun/spawn/spawn-cgroup.test.ts b/test/js/bun/spawn/spawn-cgroup.test.ts
index f951b0208278..c5218344e638 100644
--- a/test/js/bun/spawn/spawn-cgroup.test.ts
+++ b/test/js/bun/spawn/spawn-cgroup.test.ts
@@ -1,5 +1,5 @@
 import { afterAll, describe, expect, test } from "bun:test";
-import { bunEnv, bunExe, isLinux, tempDir } from "harness";
+import { bunEnv, bunExe, isLinux, isRoot, tempDir } from "harness";
 import { spawn as cpSpawn, spawnSync as cpSpawnSync, execFile, fork } from "node:child_process";
 import { closeSync, constants, existsSync, mkdirSync, openSync, readFileSync, rmdirSync, writeFileSync } from "node:fs";
 import { dirname, join } from "node:path";
@@ -9,7 +9,7 @@ import { dirname, join } from "node:path";
 // controller). v2: a sibling of our own cgroup (children of a populated cgroup
 // can't get controllers). v1: directly under the memory hierarchy root.
 function setupCgroup(): { dir: string; version: 1 | 2; relative: string; canOOM: boolean } | null {
-  if (!isLinux || process.getuid?.() !== 0) return null;
+  if (!isLinux || !isRoot) return null;
   const name = `bun-spawn-test-${process.pid}`;
   const candidates: { dir: string; version: 1 | 2; relative: string }[] = [];
 
diff --git a/test/js/bun/spawn/spawn.test.ts b/test/js/bun/spawn/spawn.test.ts
index 327683631745..e77a2dcafe99 100644
--- a/test/js/bun/spawn/spawn.test.ts
+++ b/test/js/bun/spawn/spawn.test.ts
@@ -11,6 +11,7 @@ import {
   isDebug,
   isLinux,
   isPosix,
+  isRoot,
   isWindows,
   shellExe,
   tempDir,
@@ -1593,8 +1594,6 @@ describe("option combinations", () => {
 });
 
 describe("uid/gid", () => {
-  const isRoot = process.getuid?.() === 0;
-
   it.if(isPosix && isRoot)("applies uid and gid to the child", async () => {
     await using proc = spawn({ cmd: ["id", "-u"], uid: 65534, gid: 65534, stdout: "pipe" });
     const [stdout, exitCode] = await Promise.all([proc.stdout.text(), proc.exited]);
diff --git a/test/js/bun/spawn/spawnSync.test.ts b/test/js/bun/spawn/spawnSync.test.ts
index 6b6094ff9044..d6a020faeb5d 100644
--- a/test/js/bun/spawn/spawnSync.test.ts
+++ b/test/js/bun/spawn/spawnSync.test.ts
@@ -1,5 +1,5 @@
 import { describe, expect, it } from "bun:test";
-import { bunEnv, bunExe, bunRun, isLinux, isMusl, isPosix, isWindows } from "harness";
+import { bunEnv, bunExe, bunRun, isLinux, isMusl, isPosix, isRoot, isWindows } from "harness";
 import { join } from "path";
 describe("spawnSync", () => {
   it("should throw a RangeError if timeout is less than 0", () => {
@@ -100,8 +100,6 @@ describe("spawnSync", () => {
 });
 
 describe("uid/gid", () => {
-  const isRoot = process.getuid?.() === 0;
-
   it("rejects a non-integer uid", () => {
     expect(() => Bun.spawnSync({ cmd: [bunExe()], env: bunEnv, uid: 1.5 })).toThrow();
     expect(() => Bun.spawnSync({ cmd: [bunExe()], env: bunEnv, gid: 1.5 })).toThrow();
diff --git a/test/js/node/child_process/child_process.test.ts b/test/js/node/child_process/child_process.test.ts
index acac21c9b10b..489974acede8 100644
--- a/test/js/node/child_process/child_process.test.ts
+++ b/test/js/node/child_process/child_process.test.ts
@@ -6,6 +6,7 @@ import {
   bunExe,
   isLinux,
   isPosix,
+  isRoot,
   isWindows,
   nodeExe,
   runBunInstall,
@@ -1008,7 +1009,6 @@ done
 });
 
 describe("uid/gid options", () => {
-  const isRoot = process.getuid?.() === 0;
   // 65534 is "nobody" on every Linux distro and on macOS.
   const NOBODY = 65534;
 
diff --git a/test/js/node/process/process.test.js b/test/js/node/process/process.test.js
index b2e793ed3f77..a0f2a067002b 100644
--- a/test/js/node/process/process.test.js
+++ b/test/js/node/process/process.test.js
@@ -1,7 +1,7 @@
 import { spawnSync, which } from "bun";
 import { describe, expect, it } from "bun:test";
 import { familySync } from "detect-libc";
-import { bunEnv, bunExe, isMacOS, isWindows, tempDir, tmpdirSync } from "harness";
+import { bunEnv, bunExe, isMacOS, isRoot, isWindows, tempDir, tmpdirSync } from "harness";
 import { basename, join, resolve } from "path";
 
 const process_sleep = resolve(import.meta.dir, "process-sleep.js");
@@ -1111,7 +1111,7 @@ describe.concurrent(() => {
     // bmalloc scavenger) had signal-suspended a thread, it could never ack the barrier
     // and the whole process wedged at 0% CPU. The race is probabilistic, so hammer
     // seteuid under GC pressure from many processes at once and require each to exit.
-    it.skipIf(process.platform !== "linux" || process.getuid() !== 0)(
+    it.skipIf(process.platform !== "linux" || !isRoot)(
       "seteuid under GC pressure does not deadlock",
       async () => {
         using dir = tempDir("seteuid-deadlock", {
@@ -2335,21 +2335,18 @@ it("_rawDebug never throws when fd 2 is closed", async () => {
   expect(exitCode).toBe(0);
 });
 
-it.skipIf(isWindows || process.getuid?.() === 0)(
-  "process.initgroups passes an unknown string user straight to initgroups(3)",
-  () => {
-    // Node hands string users to initgroups(3) as-is (no getpwnam pre-resolve),
-    // so as non-root we see the syscall's EPERM, not ERR_UNKNOWN_CREDENTIAL.
-    let err;
-    try {
-      process.initgroups("zz_no_user_zz", 0);
-    } catch (e) {
-      err = e;
-    }
-    expect(err?.code).toBe("EPERM");
-    expect(err?.syscall).toBe("initgroups");
-  },
-);
+it.skipIf(isWindows || isRoot)("process.initgroups passes an unknown string user straight to initgroups(3)", () => {
+  // Node hands string users to initgroups(3) as-is (no getpwnam pre-resolve),
+  // so as non-root we see the syscall's EPERM, not ERR_UNKNOWN_CREDENTIAL.
+  let err;
+  try {
+    process.initgroups("zz_no_user_zz", 0);
+  } catch (e) {
+    err = e;
+  }
+  expect(err?.code).toBe("EPERM");
+  expect(err?.syscall).toBe("initgroups");
+});
 
 it.skipIf(isWindows)("process.initgroups pre-resolves a numeric uid through passwd", () => {
   // Numeric users go through getpwuid_r first, so an unknown uid surfaces
diff --git a/test/js/node/watch/fs.watch.test.ts b/test/js/node/watch/fs.watch.test.ts
index 9d018598ce7e..311dce64976e 100644
--- a/test/js/node/watch/fs.watch.test.ts
+++ b/test/js/node/watch/fs.watch.test.ts
@@ -6,6 +6,7 @@ import {
   bunRunAsScript,
   isLinux,
   isMacOS,
+  isRoot,
   isWindows,
   tempDir,
   tempDirWithFiles,
@@ -532,8 +533,6 @@ describe("fs.watch", () => {
   // on windows 0o200 will be readable (match nodejs behavior)
   // Root has CAP_DAC_OVERRIDE, so the chmod 0o200 below never yields the
   // EACCES these two tests expect; they only make sense as a non-root user.
-  const isRoot = process.getuid?.() === 0;
-
   test.skipIf(isWindows || isRoot)("should throw if no permission to watch the directory", async () => {
     const filepath = path.join(testDir, "permission-dir");
     fs.mkdirSync(filepath, { recursive: true });
@@ -708,7 +707,7 @@ describe("fs.watch", () => {
   // seccomp. The same `add_one` error branch is reachable with EACCES by
   // watching a tree that contains one unreadable subdirectory as an
   // unprivileged user, so this test drops privileges to trigger it.
-  test.skipIf(!isLinux || process.getuid?.() !== 0)(
+  test.skipIf(!isLinux || !isRoot)(
     "recursive watch surfaces inotify_add_watch failure on a subdirectory as an 'error' event",
     async () => {
       const NOBODY = 65534;
diff --git a/test/js/web/fetch/fetch.test.ts b/test/js/web/fetch/fetch.test.ts
index 20a0e898e0d8..0df70a8da4b8 100644
--- a/test/js/web/fetch/fetch.test.ts
+++ b/test/js/web/fetch/fetch.test.ts
@@ -13,6 +13,7 @@ import {
   isDebug,
   isFlaky,
   isMacOS,
+  isRoot,
   isWindows,
   rss,
   runFixtureMaxRSS,
@@ -1111,8 +1112,9 @@ describe.concurrent("Bun.file", () => {
     }
   }
 
-  // on Windows the creator of the file will be able to read from it so this test is disabled on it
-  describe.skipIf(isWindows)("bad permissions throws", () => {
+  // on Windows the creator of the file will be able to read from it so this test is disabled on it;
+  // root can read it anywhere, so it is disabled there as well
+  describe.skipIf(isWindows || isRoot)("bad permissions throws", () => {
     const path = join(tmp_dir, "my-new-file");
     beforeAll(async () => {
       await Bun.write(path, "hey");

From 67ebfdb34ef3b849f7b385d5a427009e79966f22 Mon Sep 17 00:00:00 2001
From: robobun <117481402+robobun@users.noreply.github.com>
Date: Mon, 17 Aug 2026 01:09:49 +0000
Subject: [PATCH 086/258] install: schedule the Windows hardlink task through
 the allocation's own pointer (#37865)

---
 src/install/PackageInstall.rs                 |  37 ++-
 .../thread-pool-batch-field-ref.test.ts       | 225 ++++++++++++++++++
 2 files changed, 241 insertions(+), 21 deletions(-)
 create mode 100644 test/internal/source-lints/thread-pool-batch-field-ref.test.ts

diff --git a/src/install/PackageInstall.rs b/src/install/PackageInstall.rs
index 7fbfc8f2b02d..37c7cc6c8ef0 100644
--- a/src/install/PackageInstall.rs
+++ b/src/install/PackageInstall.rs
@@ -13,7 +13,7 @@ use bun_sys::{self as sys, Dir, EntryKind, Fd, FdExt, walker_skippable};
 use bun_threading::thread_pool::{Batch, Node as ThreadPoolNode};
 use bun_threading::work_pool::Task as WorkPoolTask;
 #[cfg(windows)]
-use bun_threading::{ThreadPool, WaitGroup};
+use bun_threading::{IntrusiveWorkTask, ThreadPool, WaitGroup};
 
 use crate::package_installer::NodeModulesFolder;
 use crate::{
@@ -498,18 +498,20 @@ impl<TaskType> NewTaskQueue<TaskType> {
     }
 
     /// # Safety
-    /// `task` must point to a live, Box-allocated `TaskType` whose ownership is
-    /// being handed to the thread pool; the worker reclaims it in its callback.
+    /// `task` must be the pointer `bun_core::heap::into_raw` returned for a live
+    /// `TaskType` whose ownership is being handed to the thread pool; the worker
+    /// reclaims it through the pointer scheduled here (`from_task_ptr` + `heap::take`).
     pub(crate) unsafe fn push(&self, task: *mut TaskType)
     where
-        TaskType: HasWorkPoolTask,
+        TaskType: IntrusiveWorkTask,
     {
         self.wait_group.add_one();
-        // SAFETY: caller contract — `task` is a valid Box-allocated task; `.task()`
-        // is the intrusive node field.
-        self.thread_pool.schedule(Batch::from(unsafe {
-            std::ptr::from_mut::<WorkPoolTask>((*task).task())
-        }));
+        // SAFETY: caller contract — `task` is a live allocation. The projection goes
+        // through `task` itself (not through a `&mut` to the field) so the pointer the
+        // pool hands back carries the whole allocation's provenance, which the worker's
+        // container-of and `heap::take` need.
+        self.thread_pool
+            .schedule(Batch::from(unsafe { TaskType::field_of(task) }));
     }
 
     pub(crate) fn wait(&self) {
@@ -517,11 +519,6 @@ impl<TaskType> NewTaskQueue<TaskType> {
     }
 }
 
-#[cfg(windows)]
-pub(crate) trait HasWorkPoolTask {
-    fn task(&mut self) -> &mut WorkPoolTask;
-}
-
 // ───────────────────────────── HardLinkWindowsInstallTask ─────────────────────────────
 
 #[cfg(windows)]
@@ -538,11 +535,7 @@ struct HardLinkWindowsInstallTask {
 }
 
 #[cfg(windows)]
-impl HasWorkPoolTask for HardLinkWindowsInstallTask {
-    fn task(&mut self) -> &mut WorkPoolTask {
-        &mut self.task
-    }
-}
+bun_threading::intrusive_work_task!(HardLinkWindowsInstallTask, task);
 
 #[cfg(windows)]
 type HardLinkQueue = NewTaskQueue<HardLinkWindowsInstallTask>;
@@ -617,8 +610,10 @@ impl HardLinkWindowsInstallTask {
     }
 
     fn run_from_thread_pool(task: *mut WorkPoolTask) {
-        // SAFETY: task points to the `task` field of a HardLinkWindowsInstallTask.
-        let self_: *mut Self = unsafe { bun_core::from_field_ptr!(Self, task, task) };
+        // SAFETY: `task` is the pointer `NewTaskQueue::push` projected out of the
+        // `init()` allocation, so it points at our `task` field with provenance for
+        // the whole allocation, which the `heap::take` calls below rely on.
+        let self_: *mut Self = unsafe { Self::from_task_ptr(task) };
         // SAFETY: HARDLINK_QUEUE initialized by init_queue() before scheduling.
         let queue = unsafe { (*HARDLINK_QUEUE.get()).assume_init_ref() };
         scopeguard::defer! { queue.complete_one(); }
diff --git a/test/internal/source-lints/thread-pool-batch-field-ref.test.ts b/test/internal/source-lints/thread-pool-batch-field-ref.test.ts
new file mode 100644
index 000000000000..28de0b9ba417
--- /dev/null
+++ b/test/internal/source-lints/thread-pool-batch-field-ref.test.ts
@@ -0,0 +1,225 @@
+import { file } from "bun";
+import { expect, test } from "bun:test";
+import { realpathSync } from "fs";
+import path from "path";
+import { globAllSources } from "../../../scripts/glob-sources.ts";
+
+// The `*mut Task` a `Batch::from(..)` hands to the thread pool must be
+// projected out of a pointer to the object that embeds the task, never out of
+// a reference to the task field itself:
+//
+//   Batch::from(ptr::from_mut((*task).task()))   // accessor returns &mut Task
+//   Batch::from(this.task())
+//   Batch::from(&mut self.task)                   // coerces to *mut Task
+//
+// are banned; `&raw mut (*p).task`, `addr_of_mut!((*p).task)`, `&raw mut
+// self.task`, `T::field_of(p)` (an associated fn given the object's pointer)
+// and a local are the shapes to use.
+//
+// The pool calls back with exactly the pointer it was given, and the
+// trampolines behind these sites (`from_task_ptr`, `from_field_ptr!`)
+// container-of it back to the embedding object and then use the rest of the
+// object through the result, often ending in `heap::take`. A reference to a
+// field carries provenance for that field only, so a pointer taken through one
+// stops at the field's bounds: the sibling fields the callback reads and
+// writes, and the allocation it frees, are outside it (`bun_core::container_of`
+// spells this out: "a `&mut field` reborrow does not suffice"). Stacked
+// Borrows rejects every out-of-range access; Tree Borrows (what `bun run
+// rust:miri` uses) rejects the writes and the free. A raw projection from the
+// object's own pointer keeps that pointer's provenance, which is what
+// `WorkPool::schedule_owned` (src/threading/work_pool.rs) does and what
+// `NewTaskQueue::push` in src/install/PackageInstall.rs, the instance this was
+// written for, does now via `IntrusiveField::field_of`.
+//
+// Scope: the argument expression of every `Batch::from(` call, which is the
+// one way a task enters a `ThreadPool` batch (`.schedule(Batch::from(..))`,
+// `batch.push(Batch::from(..))`, `HTTPThread::schedule(Batch::from(..))`). A
+// pointer projected the wrong way somewhere else and passed in through a local
+// is the same bug and is not caught here. This lint is about the range of the
+// pointer the pool gets; `&raw mut self.task` has the whole object's range and
+// passes. `WorkPool::schedule(..)`, the other hand-over, takes a `*mut Task`
+// directly and is the subject of the same rule in #37772. Siblings:
+// self-receiver-reclaim.test.ts, fn-long-mut-reborrow.test.ts,
+// frozen-nonnull-reborrow.test.ts.
+
+const root = path.resolve(import.meta.dir, "..", "..", "..");
+const rustSources = globAllSources().rust.filter(p => p.endsWith(".rs"));
+
+// Only scan files tracked in HEAD (a `git stash` round-trip can leave stray
+// `.rs` files in the working tree; CI runs on a clean checkout). Same guard as
+// dead-code-escapes.test.ts.
+const tracked: Set<string> | null = (() => {
+  const r = Bun.spawnSync({
+    cmd: ["git", "-C", root, "ls-tree", "-r", "--name-only", "-z", "HEAD"],
+    stdout: "pipe",
+    stderr: "ignore",
+  });
+  if (!r.success) return null;
+  return new Set(r.stdout.toString().split("\0").filter(Boolean));
+})();
+
+// `Batch::from(`, however the type is reached: `thread_pool::Batch::from(`,
+// `ThreadPoolLib::Batch::from(`, and the `use .. Batch as PoolBatch` /
+// `ThreadPoolBatch` aliases in the tree.
+const BATCH_FROM = /\b\w*Batch::from\s*\(/g;
+
+// A method-call chain rooted at a receiver (`(*task).task()`, `this.task()`,
+// `self.task.as_ptr()`, `self.task_mut()`): an accessor auto-refs the field or
+// returns a reference to it, so the pointer that comes out covers the field
+// only. Associated-fn calls (`T::field_of(p)`) are not rooted at a receiver and
+// do not match.
+const METHOD_CHAIN = /^(?:[\w:]+|\(\s*\*\s*[\w.]+\s*\))(?:\.\w+)*(?:\.\w+\s*\([^()]*\)\s*)+$/;
+// A reference formed anywhere in the argument: `&mut self.task` coercing to
+// `*mut Task`, `from_mut(&mut self.task)`. `&raw mut` / `&raw const` are the
+// raw projections this lint asks for.
+const REFERENCE = /&(?!\s*raw\b)/;
+// The reference-to-pointer conversions, for when the reference comes out of an
+// accessor and is never spelled with `&` (the shape this lint was written for).
+const FROM_REF = /\bfrom_(?:mut|ref)\b/;
+
+/** The argument text of the call whose opening paren is at `open`, or null if unbalanced. */
+function argumentAt(source: string, open: number): string | null {
+  for (let depth = 0, i = open; i < source.length; i++) {
+    const c = source[i];
+    if (c === "(" || c === "{" || c === "[") depth++;
+    else if (c === ")" || c === "}" || c === "]") {
+      if (--depth === 0) return source.slice(open + 1, i);
+    }
+  }
+  return null;
+}
+
+function normalize(argument: string): string {
+  let arg = argument.replace(/\s+/g, " ").trim().replace(/,$/, "").trim();
+  const unsafeBlock = /^unsafe\s*\{(.*)\}$/.exec(arg);
+  if (unsafeBlock) arg = unsafeBlock[1].trim();
+  return arg;
+}
+
+function isBanned(argument: string): boolean {
+  const arg = normalize(argument);
+  return METHOD_CHAIN.test(arg) || REFERENCE.test(arg) || FROM_REF.test(arg);
+}
+
+/** Byte offsets (into `stripped`) of every banned `Batch::from` call in one file. */
+function findBannedBatches(stripped: string): number[] {
+  const hits: number[] = [];
+  for (const m of stripped.matchAll(BATCH_FROM)) {
+    const argument = argumentAt(stripped, m.index + m[0].length - 1);
+    if (argument !== null && isBanned(argument)) hits.push(m.index);
+  }
+  return hits;
+}
+
+function lineOf(text: string, offset: number): number {
+  return text.slice(0, offset).split("\n").length;
+}
+
+// Documented, ratcheted exceptions: files allowed to keep exactly N of the
+// shape. Prefer converting over adding an entry here.
+const ALLOW: Record<string, number> = {};
+
+const counts: Record<string, number> = {};
+const offenders: string[] = [];
+let scanned = 0;
+let batchSites = 0;
+for (const abs of rustSources) {
+  const source = path.relative(root, abs).replaceAll(path.sep, "/");
+  // `src/cli` is a symlink into `src/runtime/cli`; count each file once under
+  // its canonical path.
+  if (path.relative(root, realpathSync(abs)).replaceAll(path.sep, "/") !== source) continue;
+  if (tracked !== null && !tracked.has(source)) continue;
+  scanned++;
+  const content = await file(abs).text();
+  // Strip full-line comments so prose mentions (including the in-tree comments
+  // describing this hazard) don't count. `[ \t]*`, not `\s*`: `\s` crosses
+  // newlines and would swallow blank lines, shifting the reported line numbers.
+  const stripped = content.replace(/^[ \t]*\/\/.*$/gm, "");
+  batchSites += [...stripped.matchAll(BATCH_FROM)].length;
+  for (const offset of findBannedBatches(stripped)) {
+    counts[source] = (counts[source] ?? 0) + 1;
+    if (counts[source] > (ALLOW[source] ?? 0)) {
+      offenders.push(`${source}:${lineOf(stripped, offset)}`);
+    }
+  }
+}
+
+test("scans a non-empty set of tracked Rust sources containing Batch::from calls", () => {
+  // Guards against the tracked/realpath filters (or the call pattern) failing
+  // to match anything, which would make the ban below pass vacuously.
+  expect(scanned).toBeGreaterThan(0);
+  expect(batchSites).toBeGreaterThan(0);
+});
+
+test("the classifier recognizes the spellings it claims to", () => {
+  const banned = [
+    // `NewTaskQueue::push` before `field_of`: `HasWorkPoolTask::task()`
+    // returned `&mut WorkPoolTask`.
+    "unsafe { std::ptr::from_mut::<WorkPoolTask>((*task).task()) }",
+    "unsafe {\n            std::ptr::from_mut::<WorkPoolTask>((*task).task())\n        }",
+    "(*task).task()",
+    "this.task()",
+    "self.task_mut()",
+    "self.task.as_ptr()",
+    "(*this).task.as_ptr()",
+    "&mut self.task",
+    "&mut (*task).task",
+    "&self.task as *const _ as *mut _",
+    "ptr::from_mut(&mut self.task)",
+    "core::ptr::from_ref(&self.task).cast_mut()",
+    "unsafe { ptr::from_mut((*task).task_mut()) }",
+    // rustfmt-wrapped.
+    "\n            &mut task.task,\n        ",
+  ];
+  const allowed = [
+    // The shapes in the tree.
+    "unsafe { TaskType::field_of(task) }",
+    "unsafe { core::ptr::addr_of_mut!((*task).task) }",
+    "unsafe {\n                        core::ptr::addr_of_mut!((*task).task)\n                    }",
+    "core::ptr::addr_of_mut!(\n                            (*this.parse_task.as_ptr()).task\n                        )",
+    "ptr::addr_of_mut!(runner_task.task)",
+    "core::ptr::addr_of_mut!(async_http.task)",
+    "core::ptr::addr_of_mut!(self.task)",
+    "&raw mut task.task",
+    "&raw mut self.task",
+    "&raw mut (*parse_task).task",
+    "&raw mut (*parse_task).io_task",
+    "&raw mut line_offset.thread_task",
+    "\n                                &raw mut combined_part_ranges.last_mut().unwrap().task,\n                            ",
+    // A pointer projected elsewhere is out of scope.
+    "task",
+    "queued",
+  ];
+  expect(banned.filter(s => !isBanned(s))).toEqual([]);
+  expect(allowed.filter(s => isBanned(s))).toEqual([]);
+});
+
+test("the call matcher finds every spelling of the call and takes its whole argument", () => {
+  const source = [
+    "unsafe fn push(&self, task: *mut TaskType) {",
+    "    self.thread_pool.schedule(Batch::from(unsafe {",
+    "        std::ptr::from_mut::<WorkPoolTask>((*task).task())",
+    "    }));",
+    "    batch.push(ThreadPoolLib::Batch::from(&mut task.task));",
+    "    let batch = PoolBatch::from(",
+    "        this.task(),",
+    "    );",
+    "    manager.task_batch.push(ThreadPoolBatch::from(queued));",
+    "    self.thread_pool.schedule(Batch::from(unsafe { TaskType::field_of(task) }));",
+    "    batch.push(thread_pool::Batch::from(&raw mut task.task));",
+    "}",
+  ].join("\n");
+  expect(findBannedBatches(source).map(offset => lineOf(source, offset))).toEqual([2, 5, 6]);
+});
+
+test("no Batch::from call projects the task out of a reference to the field", () => {
+  expect(offenders).toEqual([]);
+});
+
+test("allowlisted files still carry exactly their documented count", () => {
+  // Ratchet: once an allowlisted instance is converted, delete its entry so
+  // a new one cannot take its place.
+  for (const [f, n] of Object.entries(ALLOW)) {
+    expect(counts[f] ?? 0).toBe(n);
+  }
+});

From ecbcc871bba817f74fc75f0f5bb2d0d952690114 Mon Sep 17 00:00:00 2001
From: robobun <117481402+robobun@users.noreply.github.com>
Date: Mon, 17 Aug 2026 01:09:53 +0000
Subject: [PATCH 087/258] install.ps1: make the "another bun.exe is already in
 PATH" check work (#38567)

---
 src/runtime/cli/install.ps1       |   7 +-
 test/internal/install-ps1.test.ts | 149 ++++++++++++++++++++++++++++++
 2 files changed, 153 insertions(+), 3 deletions(-)
 create mode 100644 test/internal/install-ps1.test.ts

diff --git a/src/runtime/cli/install.ps1 b/src/runtime/cli/install.ps1
index a03faa1585c2..65033374c9af 100644
--- a/src/runtime/cli/install.ps1
+++ b/src/runtime/cli/install.ps1
@@ -29,7 +29,8 @@ $MinBuildName = "Windows 10 1809 / Windows Server 2019"
 
 $WinVer = [System.Environment]::OSVersion.Version
 if ($WinVer.Major -lt 10 -or ($WinVer.Major -eq 10 -and $WinVer.Build -lt $MinBuild)) {
-  Write-Warning "Bun requires at ${MinBuildName} or newer.`n`nThe install will still continue but it may not work.`n"
+  Write-Output "Install Failed:"
+  Write-Output "Bun requires ${MinBuildName} or newer.`n"
   return 1
 }
 
@@ -274,8 +275,8 @@ function Install-Bun {
 
   $hasExistingOther = $false;
   try {
-    $existing = Get-Command bun -ErrorAction
-    if ($existing.Source -ne "${BunBin}\bun.exe") {
+    $existing = Get-Command bun -ErrorAction SilentlyContinue
+    if ($existing -and $existing.Source -ne "${BunBin}\bun.exe") {
       Write-Warning "Note: Another bun.exe is already in %PATH% at $($existing.Source)`nTyping 'bun' in your terminal will not use what was just installed.`n"
       $hasExistingOther = $true;
     }
diff --git a/test/internal/install-ps1.test.ts b/test/internal/install-ps1.test.ts
new file mode 100644
index 000000000000..755811a53029
--- /dev/null
+++ b/test/internal/install-ps1.test.ts
@@ -0,0 +1,149 @@
+/**
+ * Coverage for the PowerShell scripts in the repo, mainly src/runtime/cli/install.ps1
+ * (what `irm bun.sh/install.ps1 | iex` runs). The installer cannot run end to end
+ * without downloading a release, so this file
+ *
+ *   1. lints every .ps1 for a common parameter that was given no value. PowerShell
+ *      parses `Get-Command bun -ErrorAction` fine and only rejects it when the
+ *      command binds its parameters, so the mistake surfaces as a runtime exception
+ *      (and not at all inside a `try {} catch {}`), and
+ *   2. runs the installer's "is some other bun already in PATH?" block, extracted
+ *      from the script, in real Windows PowerShell and pwsh against a fake PATH.
+ *
+ * Part 2 needs the Windows lanes, which do not run test/internal/source-lints/,
+ * which is why the lint in part 1 lives here too.
+ */
+import { Glob } from "bun";
+import { describe, expect, test } from "bun:test";
+import { isWindows, tempDir } from "harness";
+import { readFileSync } from "node:fs";
+import path from "node:path";
+
+const repoRoot = path.resolve(import.meta.dir, "..", "..");
+const installScript = path.join(repoRoot, "src", "runtime", "cli", "install.ps1");
+
+test("no PowerShell script passes a value-taking common parameter without a value", async () => {
+  // Common parameters (about_CommonParameters) that take an argument. A line
+  // where one of them is followed by nothing, a statement terminator, a comment,
+  // or the next parameter is missing its argument.
+  const dangling =
+    /-(?:ErrorAction|WarningAction|InformationAction|ProgressAction|ErrorVariable|WarningVariable|InformationVariable|OutVariable|OutBuffer|PipelineVariable)\b[ \t]*(?:$|[;|)}#]|-[A-Za-z])/i;
+
+  const violations: string[] = [];
+  let scanned = 0;
+  for (const root of ["src", "scripts", ".buildkite"]) {
+    for await (const rel of new Glob("**/*.ps1").scan({ cwd: path.join(repoRoot, root) })) {
+      scanned++;
+      const relFromRepo = path.join(root, rel).replaceAll("\\", "/");
+      const source = readFileSync(path.join(repoRoot, root, rel), "utf8")
+        .replaceAll("\r\n", "\n")
+        .replace(/<#[\s\S]*?#>/g, m => m.replace(/[^\n]/g, ""));
+      for (const [index, line] of source.split("\n").entries()) {
+        if (line.trimStart().startsWith("#")) continue;
+        if (dangling.test(line)) violations.push(`${relFromRepo}:${index + 1}: ${line.trim()}`);
+      }
+    }
+  }
+
+  // install.ps1 and uninstall.ps1 at least; guards against the scan silently
+  // matching nothing if the scripts move.
+  expect(scanned).toBeGreaterThanOrEqual(2);
+  expect(violations).toEqual([]);
+});
+
+// The block that decides whether typing `bun` after the install would run
+// something other than the bun.exe that was just installed. Its outputs are the
+// warning it prints and $hasExistingOther, which the rest of the script uses to
+// decide whether adding the install dir to PATH is worth anything.
+function existingBunCheck(): string {
+  const source = readFileSync(installScript, "utf8");
+  const startMarker = "$hasExistingOther = $false";
+  const endMarker = "} catch {}";
+  const start = source.indexOf(startMarker);
+  expect(start).toBeGreaterThan(-1);
+  const end = source.indexOf(endMarker, start);
+  expect(end).toBeGreaterThan(start);
+  return source.slice(start, end + endMarker.length);
+}
+
+// Runs the block once per PATH layout. Mirrors what the installer has set up by
+// the time the block runs: $ErrorActionPreference is Stop, $BunBin is the
+// DirectoryInfo returned by `mkdir -Force`, and the string form of that object is
+// what an earlier install would have written into PATH.
+const driver = (block: string) => `
+[Console]::OutputEncoding = [System.Text.Encoding]::UTF8
+$ErrorActionPreference = "Stop"
+$BunBin = mkdir -Force "$PSScriptRoot\\bun\\bin"
+$other = "$PSScriptRoot\\other"
+$shim = "$PSScriptRoot\\npm"
+
+$layouts = [ordered]@{
+  "nothing named bun in PATH" = "$PSScriptRoot\\empty"
+  "only the installed bun.exe in PATH" = "$BunBin"
+  "another bun.exe in PATH" = "$other"
+  "a bun.cmd shim in PATH" = "$shim"
+  "another bun.exe ahead of the installed one" = "$other;$BunBin"
+  "the installed one ahead of another bun.exe" = "$BunBin;$other"
+}
+
+$check = @'
+${block}
+'@
+
+$results = [ordered]@{}
+foreach ($name in $layouts.Keys) {
+  $env:Path = $layouts[$name]
+  $hasExistingOther = $null
+  $warnings = @(Invoke-Expression $check 3>&1 | Where-Object { $_ -is [System.Management.Automation.WarningRecord] })
+  $results[$name] = [ordered]@{
+    hasExistingOther = $hasExistingOther
+    warning = if ($warnings.Count -gt 0) { $warnings[0].Message } else { $null }
+  }
+}
+$results | ConvertTo-Json -Compress -Depth 3
+`;
+
+describe.skipIf(!isWindows).concurrent("install.ps1: existing bun in PATH check", () => {
+  // `powershell` (Windows PowerShell 5.1) is what the documented install command
+  // uses; pwsh is what scripts/bootstrap.ps1 runs the installer with.
+  test.each(["powershell", "pwsh"])("%s", async shell => {
+    using dir = tempDir("install-ps1", {
+      "driver.ps1": driver(existingBunCheck()),
+      // Get-Command only looks at names and PATHEXT; nothing here is executed.
+      "bun/bin/bun.exe": "",
+      "other/bun.exe": "",
+      "npm/bun.cmd": "",
+      "empty/.keep": "",
+    });
+
+    await using proc = Bun.spawn({
+      cmd: [
+        shell,
+        "-NoProfile",
+        "-NonInteractive",
+        "-ExecutionPolicy",
+        "Bypass",
+        "-File",
+        path.join(String(dir), "driver.ps1"),
+      ],
+      stdout: "pipe",
+      stderr: "pipe",
+    });
+    const [stdout, stderr, exitCode] = await Promise.all([proc.stdout.text(), proc.stderr.text(), proc.exited]);
+
+    expect(stderr).toBe("");
+    const otherExe = path.join(String(dir), "other", "bun.exe");
+    const shimCmd = path.join(String(dir), "npm", "bun.cmd");
+    const shadowed = (by: string) => ({ hasExistingOther: true, warning: expect.stringContaining(by) });
+    const usesNewInstall = { hasExistingOther: false, warning: null };
+    expect(JSON.parse(stdout)).toEqual({
+      "nothing named bun in PATH": usesNewInstall,
+      "only the installed bun.exe in PATH": usesNewInstall,
+      "another bun.exe in PATH": shadowed(otherExe),
+      "a bun.cmd shim in PATH": shadowed(shimCmd),
+      "another bun.exe ahead of the installed one": shadowed(otherExe),
+      "the installed one ahead of another bun.exe": usesNewInstall,
+    });
+    expect(exitCode).toBe(0);
+  });
+});

From 6dd1b743a4cc069f1c14be54e6302ece0b26b040 Mon Sep 17 00:00:00 2001
From: robobun <117481402+robobun@users.noreply.github.com>
Date: Mon, 17 Aug 2026 01:09:57 +0000
Subject: [PATCH 088/258] install: don't issue openat2/fchmodat2 on Android
 (seccomp SIGSYS) (#39084)

---
 src/bun_core/env_var.rs                       |   4 +
 src/sys/lib.rs                                |  82 +++++++++-
 .../bun-install-android-seccomp.test.ts       | 153 ++++++++++++++++++
 3 files changed, 238 insertions(+), 1 deletion(-)
 create mode 100644 test/cli/install/bun-install-android-seccomp.test.ts

diff --git a/src/bun_core/env_var.rs b/src/bun_core/env_var.rs
index 1c5082acfb23..3698c291e64c 100644
--- a/src/bun_core/env_var.rs
+++ b/src/bun_core/env_var.rs
@@ -39,6 +39,10 @@ use crate::ZStr;
 // ──────────────────────────────────────────────────────────────────────────────
 
 new!(pub AGENT: string, "AGENT", {});
+// Set by Android init for every process; read by bun_sys's runtime Android
+// detection (`is_android_kernel`).
+new!(pub ANDROID_DATA: string, "ANDROID_DATA", {});
+new!(pub ANDROID_ROOT: string, "ANDROID_ROOT", {});
 new!(pub BUN_AGENT_RULE_DISABLED: boolean, "BUN_AGENT_RULE_DISABLED", { default: false });
 new!(pub BUN_COMPILE_TARGET_TARBALL_URL: string, "BUN_COMPILE_TARGET_TARBALL_URL", {});
 new!(pub BUN_CONFIG_DISABLE_COPY_FILE_RANGE: boolean, "BUN_CONFIG_DISABLE_COPY_FILE_RANGE", { default: false });
diff --git a/src/sys/lib.rs b/src/sys/lib.rs
index 75ea40183bca..7ea131c9789d 100644
--- a/src/sys/lib.rs
+++ b/src/sys/lib.rs
@@ -1977,22 +1977,54 @@ mod posix_impl {
             Ok(Fd::from_native(rc))
         }
     }
+    /// Runtime Android detection. Android's app seccomp policy kills the
+    /// process with SIGSYS instead of returning ENOSYS for syscalls outside
+    /// its allowlist, so `openat2(2)`/`fchmodat2(2)` must never be issued
+    /// there, not even as a probe. Shipped linux builds run under Termux as
+    /// plain `target_os = "linux"`, hence runtime detection: the kernel
+    /// release string, or the `ANDROID_ROOT`/`ANDROID_DATA` env vars Android
+    /// init sets for every process.
+    #[cfg(any(target_os = "linux", target_os = "android"))]
+    fn is_android_kernel() -> bool {
+        if cfg!(target_os = "android") {
+            return true;
+        }
+        use core::sync::atomic::{AtomicU8, Ordering};
+        // 0 = unprobed, 1 = not Android, 2 = Android.
+        static CACHED: AtomicU8 = AtomicU8::new(0);
+        match CACHED.load(Ordering::Relaxed) {
+            0 => {}
+            v => return v == 2,
+        }
+        let release = bun_core::ffi::c_field_bytes(&bun_core::ffi::cached_uname().release);
+        let detected = bun_core::strings::contains_case_insensitive_ascii(release, b"android")
+            || (bun_core::env_var::ANDROID_ROOT::get_not_empty().is_some()
+                && bun_core::env_var::ANDROID_DATA::get_not_empty().is_some());
+        CACHED.store(if detected { 2 } else { 1 }, Ordering::Relaxed);
+        detected
+    }
+    /// `openat2(RESOLVE_BENEATH)`; ENOSYS on Android without issuing the
+    /// syscall (see [`is_android_kernel`]).
     #[cfg(any(target_os = "linux", target_os = "android"))]
     pub fn openat2_beneath(dir: impl AsFd, path: &ZStr, flags: i32, mode: Mode) -> Maybe<Fd> {
         let dir = dir.as_fd();
+        if is_android_kernel() {
+            return Err(Error::from_code_int(libc::ENOSYS, Tag::open).with_path(path.as_bytes()));
+        }
         super::linux_syscall::openat2_beneath(dir, path, flags, mode)
             .map_err(|e| Error::from_code_int(e, Tag::open).with_path(path.as_bytes()))
     }
     /// `openat2(RESOLVE_IN_ROOT | RESOLVE_NO_MAGICLINKS)`: resolves `path` as
     /// if `dir` were `/`. Falls back to plain `openat` on kernels without
     /// `openat2` (or when seccomp blocks it), caching the unavailability.
+    /// Never issued on Android (see [`is_android_kernel`]).
     #[cfg(any(target_os = "linux", target_os = "android"))]
     pub fn openat2_in_root(dir: impl AsFd, path: &ZStr, flags: i32, mode: Mode) -> Maybe<Fd> {
         use core::sync::atomic::{AtomicBool, Ordering};
         static UNAVAILABLE: AtomicBool = AtomicBool::new(false);
 
         let dir = dir.as_fd();
-        if !UNAVAILABLE.load(Ordering::Relaxed) {
+        if !UNAVAILABLE.load(Ordering::Relaxed) && !is_android_kernel() {
             match super::linux_syscall::openat2_in_root(dir, path, flags, mode) {
                 Ok(fd) => return Ok(fd),
                 Err(e @ (libc::ENOSYS | libc::EPERM | libc::EINVAL | libc::E2BIG)) => {
@@ -2865,6 +2897,12 @@ mod posix_impl {
         }
         #[cfg(not(any(target_os = "macos", target_os = "freebsd")))]
         {
+            #[cfg(any(target_os = "linux", target_os = "android"))]
+            if is_android_kernel() {
+                // libc's `fchmodat(.., AT_SYMLINK_NOFOLLOW)` is no escape
+                // hatch here: current glibc/musl try `fchmodat2(2)` inside it.
+                return lchmod_no_fchmodat2(path, mode);
+            }
             const SYS_FCHMODAT2: libc::c_long = 452;
             loop {
                 // SAFETY: `ZStr::as_ptr()` yields a valid NUL-terminated C string.
@@ -2891,6 +2929,48 @@ mod posix_impl {
             }
         }
     }
+    /// `lchmod` without `fchmodat2(2)`: `O_PATH` + `chmod("/proc/self/fd/N")`,
+    /// musl's own fallback strategy. Symlinks are rejected with EOPNOTSUPP,
+    /// matching libc.
+    #[cfg(any(target_os = "linux", target_os = "android"))]
+    fn lchmod_no_fchmodat2(path: &ZStr, mode: Mode) -> Maybe<()> {
+        let fd = match open(path, O::PATH | O::NOFOLLOW | O::CLOEXEC, 0) {
+            Ok(fd) => fd,
+            Err(mut err) => {
+                err.syscall = Tag::lchmod;
+                return Err(err);
+            }
+        };
+        let st = match fstat(fd) {
+            Ok(st) => st,
+            Err(mut err) => {
+                let _ = close(fd);
+                err.syscall = Tag::lchmod;
+                return Err(err.with_path(path.as_bytes()));
+            }
+        };
+        if (st.st_mode as u32 & libc::S_IFMT as u32) == libc::S_IFLNK as u32 {
+            let _ = close(fd);
+            return Err(
+                Error::from_code_int(libc::EOPNOTSUPP, Tag::lchmod).with_path(path.as_bytes())
+            );
+        }
+        let mut proc = [0u8; 32];
+        let n = {
+            use std::io::Write as _;
+            let mut c = std::io::Cursor::new(&mut proc[..]);
+            let _ = write!(c, "/proc/self/fd/{}\0", fd.native());
+            c.position() as usize - 1
+        };
+        // SAFETY: NUL written above.
+        let z = ZStr::from_buf(&proc[..], n);
+        let result = chmod(z, mode);
+        let _ = close(fd);
+        result.map_err(|mut err| {
+            err.syscall = Tag::lchmod;
+            err.with_path(path.as_bytes())
+        })
+    }
     pub fn chown(path: &ZStr, uid: u32, gid: u32) -> Maybe<()> {
         check_p!(
             // SAFETY: `ZStr::as_ptr()` yields a valid NUL-terminated C string.
diff --git a/test/cli/install/bun-install-android-seccomp.test.ts b/test/cli/install/bun-install-android-seccomp.test.ts
new file mode 100644
index 000000000000..9ffee386e75d
--- /dev/null
+++ b/test/cli/install/bun-install-android-seccomp.test.ts
@@ -0,0 +1,153 @@
+import { expect, test } from "bun:test";
+import { bunEnv, bunExe, isLinux, tempDir, tempDirWithFiles } from "harness";
+import { spawnSync } from "node:child_process";
+import { existsSync, lstatSync, statSync } from "node:fs";
+import { join } from "node:path";
+
+// Android's app seccomp policy denies openat2(2) and fchmodat2(2) with
+// SECCOMP_RET_TRAP: the process is killed by SIGSYS instead of seeing ENOSYS,
+// so the errno-based fallbacks never run and `bun install` dies while linking
+// package bins (issue #39060, Termux). Bun detects Android at runtime (the
+// ANDROID_ROOT/ANDROID_DATA env vars Android init sets for every process, or
+// an "android" kernel release string) and skips those syscalls entirely.
+// This test reproduces the Android policy with an equivalent seccomp filter.
+const helperSrc = `
+#define _GNU_SOURCE
+#include <errno.h>
+#include <linux/audit.h>
+#include <linux/filter.h>
+#include <linux/seccomp.h>
+#include <stddef.h>
+#include <stdio.h>
+#include <stdlib.h>
+#include <sys/prctl.h>
+#include <sys/syscall.h>
+#include <unistd.h>
+
+#if defined(__x86_64__)
+  #define MY_AUDIT_ARCH AUDIT_ARCH_X86_64
+#elif defined(__aarch64__)
+  #define MY_AUDIT_ARCH AUDIT_ARCH_AARCH64
+#else
+  #define MY_AUDIT_ARCH 0
+#endif
+
+int main(int argc, char **argv) {
+  if (argc < 2) return 2;
+  if (MY_AUDIT_ARCH == 0) return 77; /* unsupported arch, skip */
+
+  struct sock_filter filter[] = {
+    /* arch check */
+    BPF_STMT(BPF_LD | BPF_W | BPF_ABS, offsetof(struct seccomp_data, arch)),
+    BPF_JUMP(BPF_JMP | BPF_JEQ | BPF_K, MY_AUDIT_ARCH, 1, 0),
+    BPF_STMT(BPF_RET | BPF_K, SECCOMP_RET_ALLOW),
+    /* load syscall nr */
+    BPF_STMT(BPF_LD | BPF_W | BPF_ABS, offsetof(struct seccomp_data, nr)),
+    /* openat2 (437) and fchmodat2 (452) -> SIGSYS, like Android */
+    BPF_JUMP(BPF_JMP | BPF_JEQ | BPF_K, 437, 1, 0),
+    BPF_JUMP(BPF_JMP | BPF_JEQ | BPF_K, 452, 0, 1),
+    BPF_STMT(BPF_RET | BPF_K, SECCOMP_RET_TRAP),
+    BPF_STMT(BPF_RET | BPF_K, SECCOMP_RET_ALLOW),
+  };
+  struct sock_fprog prog = {
+    .len = (unsigned short)(sizeof(filter) / sizeof(filter[0])),
+    .filter = filter,
+  };
+
+  if (prctl(PR_SET_NO_NEW_PRIVS, 1, 0, 0, 0) != 0) {
+    perror("prctl(PR_SET_NO_NEW_PRIVS)");
+    return 77; /* cannot install filter, skip */
+  }
+  if (syscall(__NR_seccomp, SECCOMP_SET_MODE_FILTER, 0, &prog) != 0) {
+    perror("seccomp");
+    return 77; /* cannot install filter, skip */
+  }
+
+  execvp(argv[1], &argv[1]);
+  perror("execvp");
+  return 127;
+}
+`;
+
+// Compile the seccomp helper. Returns the binary path, or null if the host
+// genuinely can't build it (no cc, missing kernel headers). Any other compile
+// failure throws so a source regression isn't silently hidden as a skip.
+const tryBuild = (): string | null => {
+  const dir = tempDirWithFiles("android-seccomp", {
+    "sigsys_wrap.c": helperSrc,
+  });
+  const src = join(dir, "sigsys_wrap.c");
+  const bin = join(dir, "sigsys_wrap");
+  const compile = spawnSync("cc", ["-O0", "-o", bin, src], { stdio: "pipe" });
+
+  // compiler not on PATH — expected skip
+  if ((compile.error as NodeJS.ErrnoException | undefined)?.code === "ENOENT") return null;
+
+  if (compile.status !== 0) {
+    const stderr = compile.stderr?.toString() ?? "";
+    // missing linux/*.h on the host — expected skip
+    if (/linux\/(seccomp|filter|audit)\.h|sys\/prctl\.h/.test(stderr)) return null;
+    throw new Error(`failed to compile seccomp helper:\n${stderr}`);
+  }
+  if (!existsSync(bin)) {
+    throw new Error("seccomp helper compiled successfully but output binary is missing");
+  }
+  return bin;
+};
+
+// Android env vars are how bun's runtime detection recognizes Android here
+// (the kernel release string of the test host obviously isn't Android's).
+const androidEnv = { ...bunEnv, ANDROID_ROOT: "/system", ANDROID_DATA: "/data" };
+
+test.skipIf(!isLinux)("bun install survives Android-style seccomp (openat2/fchmodat2 SIGSYS)", async () => {
+  const helperBin = tryBuild();
+  if (helperBin == null) {
+    // bun:test has no runtime-skip; log loudly so CI output distinguishes
+    // this from a real pass.
+    console.warn("SKIP bun install android seccomp: cc or seccomp headers not available");
+    return;
+  }
+
+  using dir = tempDir("install-android-seccomp", {
+    "package.json": JSON.stringify({
+      name: "app",
+      version: "1.0.0",
+      dependencies: { dep: "file:./dep" },
+    }),
+    "dep/package.json": JSON.stringify({
+      name: "dep",
+      version: "1.0.0",
+      bin: { dep: "bin/dep.js" },
+    }),
+    // bin in a subdirectory so bin linking validates the parent dir with
+    // openat2(RESOLVE_BENEATH), then chmods the target (fchmodat2).
+    "dep/bin/dep.js": "#!/usr/bin/env node\nconsole.log('ok');\n",
+  });
+
+  await using proc = Bun.spawn({
+    cmd: [helperBin, bunExe(), "install"],
+    cwd: String(dir),
+    env: androidEnv,
+    stdout: "pipe",
+    stderr: "pipe",
+  });
+  const [stdout, stderr, exitCode] = await Promise.all([proc.stdout.text(), proc.stderr.text(), proc.exited]);
+  if (exitCode === 77) {
+    console.warn("SKIP bun install android seccomp: seccomp not permitted in this environment");
+    return;
+  }
+
+  // Without the runtime Android detection the install dies with SIGSYS
+  // (exit 159) in bin linking.
+  expect({ stdout, stderr, signalCode: proc.signalCode ?? null, exitCode }).toMatchObject({
+    signalCode: null,
+    exitCode: 0,
+  });
+
+  // The bin link was created and the target was made executable — proving
+  // the lchmod fallback actually chmod'd instead of silently skipping.
+  const binLink = join(String(dir), "node_modules", ".bin", "dep");
+  expect(lstatSync(binLink).isSymbolicLink()).toBe(true);
+  const targetMode = statSync(join(String(dir), "node_modules", "dep", "bin", "dep.js")).mode;
+  expect(targetMode & 0o111).not.toBe(0);
+});

From ebaa3abeb9391500a3de13c86dbda703d6b61345 Mon Sep 17 00:00:00 2001
From: robobun <117481402+robobun@users.noreply.github.com>
Date: Mon, 17 Aug 2026 01:10:02 +0000
Subject: [PATCH 089/258] bunx: serialize concurrent installs into the shared
 cache dir with a file lock (#37851)

---
 src/runtime/cli/bunx_command.rs          | 461 +++++++++++++++++------
 src/sys/lib.rs                           |  69 +++-
 src/windows_sys/externs.rs               |  15 +
 test/cli/install/bunx-concurrent.test.ts | 157 ++++++++
 4 files changed, 579 insertions(+), 123 deletions(-)
 create mode 100644 test/cli/install/bunx-concurrent.test.ts

diff --git a/src/runtime/cli/bunx_command.rs b/src/runtime/cli/bunx_command.rs
index 67f117ca91d8..67af695c3a06 100644
--- a/src/runtime/cli/bunx_command.rs
+++ b/src/runtime/cli/bunx_command.rs
@@ -473,8 +473,18 @@ impl BunxCommand {
 
             if is_stale {
                 let _ = target_package_json.close();
-                // If delete fails, oh well. Hope installation takes care of it.
-                let _ = bun_sys::Dir::cwd().delete_tree(tempdir_name);
+                // Delete only while holding the exclusive lock, so the tree
+                // (lock file included) never vanishes under a process that
+                // is installing into or about to run from it. Contended or
+                // unlockable → skip; the reinstall refreshes the tree. If
+                // delete fails, oh well. Hope installation takes care of it.
+                if let Some(_lock) = Self::lock_cache_dir(
+                    tempdir_name,
+                    bun_sys::FileLockMode::Exclusive,
+                    /* nonblocking */ true,
+                ) {
+                    let _ = bun_sys::Dir::cwd().delete_tree(tempdir_name);
+                }
                 return Err(crate::Error::NeedToInstall);
             }
             let _ = target_package_json.close();
@@ -678,6 +688,129 @@ impl BunxCommand {
         Global::exit(1);
     }
 
+    /// The lock taken on `.bunx-lock` only serializes anything if the path
+    /// still names the file we locked — the stale-tree cleanup deletes the
+    /// whole cache dir, lock file included (Windows included: `bun_sys`
+    /// opens with `FILE_SHARE_DELETE` and deletes with POSIX semantics), so
+    /// a lock on an unlinked file guards nothing. Compare identity via
+    /// `fstat` on the held fd and on a freshly opened probe fd: both map to
+    /// ino/dev on POSIX and NTFS file index/volume serial on Windows.
+    fn lock_file_identity_ok(fd: Fd, path_z: &ZStr) -> bool {
+        let probe = match bun_sys::openat(Fd::cwd(), path_z, O::RDONLY | O::CLOEXEC, 0) {
+            Ok(fd) => fd,
+            Err(_) => return false,
+        };
+        let probe_file = bun_sys::File::from_fd(probe);
+        match (bun_sys::fstat(fd), bun_sys::fstat(probe_file.fd())) {
+            (Ok(held), Ok(on_disk)) => {
+                held.st_ino == on_disk.st_ino && held.st_dev == on_disk.st_dev
+            }
+            _ => false,
+        }
+    }
+
+    /// Width of the zero-padded decimal timestamp stored in the lock file.
+    /// Fixed-width so rewrites never need a truncation.
+    const LOCK_TIMESTAMP_LEN: usize = 20;
+
+    /// After a successful install, the exclusive lock holder records the
+    /// completion time in the lock file so waiters can tell the tree was
+    /// just (re)installed.
+    fn mark_install_completed(lock: &bun_sys::File) {
+        let mut buf = [0u8; Self::LOCK_TIMESTAMP_LEN];
+        let mut cursor: &mut [u8] = &mut buf[..];
+        write!(cursor, "{:020}", bun_core::time::timestamp()).expect("unreachable");
+        // Best-effort: on failure waiters reinstall, so only log it.
+        if let Err(err) = bun_sys::pwrite(lock.fd(), &buf, 0) {
+            bun_output::scoped_log!(bunx, "failed to record install completion: {}", err);
+        }
+    }
+
+    /// Stamp the completion time and release the exclusive lock. The stamp
+    /// must be the last write before release: a waiter that arrived while
+    /// the holder ran its post-install probes compares its own start time
+    /// against it, and an earlier stamp can land in the previous second.
+    fn release_install_lock(install_lock: &mut Option<bun_sys::File>) {
+        if let Some(lock) = install_lock.take() {
+            Self::mark_install_completed(&lock);
+        }
+    }
+
+    /// Whether a concurrent `bun x` finished installing into this directory
+    /// at or after `wait_start`. Rerunning `bun add` then (`--force` for
+    /// dist-tag installs) would mutate the tree out from under the process
+    /// that just started executing it, so the caller skips the install and
+    /// runs the freshly installed tree instead.
+    fn install_completed_while_waiting(lock: &bun_sys::File, wait_start: i64) -> bool {
+        let mut buf = [0u8; Self::LOCK_TIMESTAMP_LEN];
+        match bun_sys::pread(lock.fd(), &mut buf, 0) {
+            Ok(n) if n == buf.len() => {}
+            _ => return false,
+        }
+        let mut ts: i64 = 0;
+        for &b in &buf {
+            if !b.is_ascii_digit() {
+                return false;
+            }
+            ts = match ts
+                .checked_mul(10)
+                .and_then(|v| v.checked_add(i64::from(b - b'0')))
+            {
+                Some(v) => v,
+                None => return false,
+            };
+        }
+        ts >= wait_start
+    }
+
+    /// Opens (creating if needed) `<bunx_cache_dir>/.bunx-lock` and takes an
+    /// advisory lock on it. Returns `None` when the lock can't be acquired
+    /// (including contention in `nonblocking` mode). Dropping the returned
+    /// file releases the lock; the fd is CLOEXEC so exec'ing the target
+    /// binary releases it too.
+    ///
+    /// Concurrent `bun x` processes for the same package share one install
+    /// directory. The exclusive lock serializes installs so they don't
+    /// corrupt each other's node_modules; the shared lock keeps a process
+    /// from executing a tree another process is mutating mid-install.
+    fn lock_cache_dir(
+        bunx_cache_dir: &[u8],
+        mode: bun_sys::FileLockMode,
+        nonblocking: bool,
+    ) -> Option<bun_sys::File> {
+        let mut path = PathBuffer::uninit();
+        let len = {
+            let total = path.len();
+            let mut cursor: &mut [u8] = &mut path[..];
+            write!(
+                cursor,
+                "{dir}{sep}.bunx-lock",
+                dir = BStr::new(bunx_cache_dir),
+                sep = bun_paths::SEP as char,
+            )
+            .ok()?;
+            total - cursor.len()
+        };
+        path[len] = 0;
+        // SAFETY: path[len] == 0 written above
+        let path_z = ZStr::from_buf(&path[..], len);
+
+        for _ in 0..5 {
+            let fd =
+                bun_sys::openat(Fd::cwd(), path_z, O::CREAT | O::RDWR | O::CLOEXEC, 0o600).ok()?;
+            let file = bun_sys::File::from_fd(fd);
+            match bun_sys::flock(fd, mode, nonblocking) {
+                Ok(true) => {}
+                Ok(false) | Err(_) => return None,
+            }
+            if Self::lock_file_identity_ok(fd, path_z) {
+                return Some(file);
+            }
+            // Unlinked while we waited; `file` closes on drop. Reopen.
+        }
+        None
+    }
+
     pub(crate) fn exec(ctx: &mut ContextData, argv: &[&'static ZStr]) -> crate::Result<()> {
         // Don't log stuff
         ctx.debug.silent = true;
@@ -1070,6 +1203,7 @@ impl BunxCommand {
                 };
                 if let Some(destination) = dest_or_cache {
                     let out: &[u8] = destination.as_bytes();
+                    let mut cache_read_lock: Option<bun_sys::File> = None;
 
                     // If this directory was installed by bunx, we want to perform cache invalidation on it
                     // this way running `bunx hello` will update hello automatically to the latest version
@@ -1152,6 +1286,28 @@ impl BunxCommand {
                                 break 'try_run_existing;
                             }
                         }
+
+                        // Another bunx process may be mid-install into this
+                        // shared directory; running now risks a partially
+                        // copied tree. Busy → take the install path, which
+                        // waits for the installer to finish. With
+                        // --no-install the install path is a hard error, so
+                        // keep the old behavior and run what was found.
+                        if !opts.no_install {
+                            cache_read_lock = Self::lock_cache_dir(
+                                bunx_cache_dir,
+                                bun_sys::FileLockMode::Shared,
+                                /* nonblocking */ true,
+                            );
+                            if cache_read_lock.is_none() {
+                                bun_output::scoped_log!(
+                                    bunx,
+                                    "install in progress for {}, waiting",
+                                    BStr::new(bunx_cache_dir)
+                                );
+                                break 'try_run_existing;
+                            }
+                        }
                     }
 
                     bun_output::scoped_log!(
@@ -1160,6 +1316,7 @@ impl BunxCommand {
                         BStr::new(destination.as_bytes())
                     );
                     let stored = fs.dirname_store.append_slice(out)?;
+                    drop(cache_read_lock);
                     Run::run_binary(
                         ctx,
                         stored,
@@ -1258,7 +1415,31 @@ impl BunxCommand {
                                         do_cache_bust = true;
                                         break 'try_run_existing;
                                     }
+                                    // Same mid-install guard as the first
+                                    // cache probe.
+                                    let cache_read_lock = if !opts.no_install
+                                        && strings::has_prefix(out, bunx_cache_dir)
+                                    {
+                                        match Self::lock_cache_dir(
+                                            bunx_cache_dir,
+                                            bun_sys::FileLockMode::Shared,
+                                            /* nonblocking */ true,
+                                        ) {
+                                            Some(lock) => Some(lock),
+                                            None => {
+                                                bun_output::scoped_log!(
+                                                    bunx,
+                                                    "install in progress for {}, waiting",
+                                                    BStr::new(bunx_cache_dir)
+                                                );
+                                                break 'try_run_existing;
+                                            }
+                                        }
+                                    } else {
+                                        None
+                                    };
                                     let stored = fs.dirname_store.append_slice(out)?;
+                                    drop(cache_read_lock);
                                     Run::run_binary(
                                         ctx,
                                         stored,
@@ -1320,115 +1501,165 @@ impl BunxCommand {
             Global::exit(1);
         }
 
-        'create_package_json: {
-            // create package.json, but only if it doesn't exist
-            let package_json = match bun_sys::File::create(
-                bunx_install_dir.fd,
-                b"package.json",
-                /* truncate */ true,
-            ) {
-                Ok(f) => f,
-                Err(_) => break 'create_package_json,
-            };
-            let _ = package_json.write_all(b"{}\n");
+        // Serialize concurrent `bun x` installs into this shared directory.
+        // Without the lock, simultaneous cold-cache spawns of the same
+        // package install into the same node_modules at once and fail with
+        // EEXIST/ENOENT ("failed copying files from cache to destination")
+        // or execute a half-written tree. Held (blocking) through the
+        // install and the post-install bin probes; released right before
+        // exec'ing the target. On failure, fall back to the old unlocked
+        // behavior rather than refusing to run.
+        let install_wait_start = bun_core::time::timestamp();
+        let mut install_lock = Self::lock_cache_dir(
+            bunx_cache_dir,
+            bun_sys::FileLockMode::Exclusive,
+            /* nonblocking */ false,
+        );
+        if install_lock.is_none() {
+            bun_output::scoped_log!(
+                bunx,
+                "could not lock {}, installing without the lock",
+                BStr::new(bunx_cache_dir)
+            );
         }
 
-        let install_args: [&[u8]; 4] = [
-            bun_core::self_exe_path()?.as_bytes(),
-            b"add",
-            install_param.as_slice(),
-            b"--no-summary",
-        ];
-        let mut args: BoundedArray<&[u8], 8> =
-            BoundedArray::from_slice(&install_args).expect("unreachable"); // upper bound is known
-
-        if do_cache_bust {
-            // disable the manifest cache when a tag is specified
-            // so that @latest is fetched from the registry
-            args.append(b"--no-cache").expect("unreachable"); // upper bound is known
-
-            // forcefully re-install packages in this mode too
-            args.append(b"--force").expect("unreachable"); // upper bound is known
-        }
+        let skip_install = match &install_lock {
+            Some(lock) => Self::install_completed_while_waiting(lock, install_wait_start),
+            None => false,
+        };
+        if skip_install {
+            bun_output::scoped_log!(
+                bunx,
+                "concurrent bunx finished installing {}, skipping reinstall",
+                BStr::new(&install_param)
+            );
+        } else {
+            'create_package_json: {
+                // create package.json, but only if it doesn't exist
+                let package_json = match bun_sys::File::create(
+                    bunx_install_dir.fd,
+                    b"package.json",
+                    /* truncate */ true,
+                ) {
+                    Ok(f) => f,
+                    Err(_) => break 'create_package_json,
+                };
+                let _ = package_json.write_all(b"{}\n");
+            }
 
-        if opts.verbose_install {
-            args.append(b"--verbose").expect("unreachable"); // upper bound is known
-        }
+            let install_args: [&[u8]; 4] = [
+                bun_core::self_exe_path()?.as_bytes(),
+                b"add",
+                install_param.as_slice(),
+                b"--no-summary",
+            ];
+            let mut args: BoundedArray<&[u8], 8> =
+                BoundedArray::from_slice(&install_args).expect("unreachable"); // upper bound is known
+
+            if do_cache_bust {
+                // disable the manifest cache when a tag is specified
+                // so that @latest is fetched from the registry
+                args.append(b"--no-cache").expect("unreachable"); // upper bound is known
+
+                // forcefully re-install packages in this mode too
+                args.append(b"--force").expect("unreachable"); // upper bound is known
+            }
 
-        if opts.silent_install {
-            args.append(b"--silent").expect("unreachable"); // upper bound is known
-        }
+            if opts.verbose_install {
+                args.append(b"--verbose").expect("unreachable"); // upper bound is known
+            }
 
-        let argv_to_use = args.slice();
+            if opts.silent_install {
+                args.append(b"--silent").expect("unreachable"); // upper bound is known
+            }
 
-        bun_output::scoped_log!(
-            bunx,
-            "installing package: {}",
-            bun_core::fmt::fmt_slice(argv_to_use, " "),
-        );
-        env_loader
-            .map
-            .put(b"BUN_INTERNAL_BUNX_INSTALL", b"true")
-            .expect("oom");
+            let argv_to_use = args.slice();
+
+            bun_output::scoped_log!(
+                bunx,
+                "installing package: {}",
+                bun_core::fmt::fmt_slice(argv_to_use, " "),
+            );
+            env_loader
+                .map
+                .put(b"BUN_INTERNAL_BUNX_INSTALL", b"true")
+                .expect("oom");
 
-        let envp = env_loader.map.create_null_delimited_env_map()?;
+            let envp = env_loader.map.create_null_delimited_env_map()?;
 
-        let spawn_result = match proc_sync::spawn(&proc_sync::Options {
-            argv: argv_to_use.iter().map(|s| Box::<[u8]>::from(*s)).collect(),
+            let spawn_result = match proc_sync::spawn(&proc_sync::Options {
+                argv: argv_to_use.iter().map(|s| Box::<[u8]>::from(*s)).collect(),
 
-            envp: Some(envp.as_ptr().cast::<*const ::core::ffi::c_char>()),
+                envp: Some(envp.as_ptr().cast::<*const ::core::ffi::c_char>()),
 
-            cwd: Box::<[u8]>::from(bunx_cache_dir),
-            stderr: proc_sync::SyncStdio::Inherit,
-            stdout: proc_sync::SyncStdio::Inherit,
-            stdin: proc_sync::SyncStdio::Inherit,
+                cwd: Box::<[u8]>::from(bunx_cache_dir),
+                stderr: proc_sync::SyncStdio::Inherit,
+                stdout: proc_sync::SyncStdio::Inherit,
+                stdin: proc_sync::SyncStdio::Inherit,
 
-            #[cfg(windows)]
-            windows: proc_sync::WindowsOptions {
-                loop_: bun_jsc::EventLoopHandle::init_mini(
-                    bun_event_loop::MiniEventLoop::init_global(
-                        // `this_transpiler.env` is the process-lifetime loader
-                        // singleton populated during transpiler init.
-                        //
-                        // Aliasing: do NOT call `this_transpiler.env_mut()` here —
-                        // `env_loader` (line 594) is still live and is used again below at the
-                        // post-install `Run::run_binary` calls. A second `env_mut()` would
-                        // `unsafe { &mut *self.env }` from the raw field, popping `env_loader`'s
-                        // Unique tag under Stacked Borrows (UB on later use). Instead reborrow
-                        // *through* `env_loader` so the new `&mut` is a child of its tag; the
-                        // child is consumed by `init_global` (converted to `NonNull`) before
-                        // `env_loader` is touched again.
-                        // SAFETY: `env_loader` is a valid `&'static mut Loader`; this is a
-                        // stacked reborrow, not a sibling alias.
-                        Some(unsafe { &mut *(env_loader as *mut _) }),
-                        None,
+                #[cfg(windows)]
+                windows: proc_sync::WindowsOptions {
+                    loop_: bun_jsc::EventLoopHandle::init_mini(
+                        bun_event_loop::MiniEventLoop::init_global(
+                            // `this_transpiler.env` is the process-lifetime loader
+                            // singleton populated during transpiler init.
+                            //
+                            // Aliasing: do NOT call `this_transpiler.env_mut()` here —
+                            // `env_loader` (line 594) is still live and is used again below at the
+                            // post-install `Run::run_binary` calls. A second `env_mut()` would
+                            // `unsafe { &mut *self.env }` from the raw field, popping `env_loader`'s
+                            // Unique tag under Stacked Borrows (UB on later use). Instead reborrow
+                            // *through* `env_loader` so the new `&mut` is a child of its tag; the
+                            // child is consumed by `init_global` (converted to `NonNull`) before
+                            // `env_loader` is touched again.
+                            // SAFETY: `env_loader` is a valid `&'static mut Loader`; this is a
+                            // stacked reborrow, not a sibling alias.
+                            Some(unsafe { &mut *(env_loader as *mut _) }),
+                            None,
+                        ),
                     ),
-                ),
+                    ..Default::default()
+                },
                 ..Default::default()
-            },
-            ..Default::default()
-        }) {
-            Err(err) => {
-                bun_core::pretty_errorln!(
-                    "<r><red>error<r>: bunx failed to install <b>{}<r> due to error <b>{}<r>",
-                    BStr::new(&install_param),
-                    err.name(),
-                );
-                Global::exit(1);
-            }
-            Ok(maybe) => match maybe {
-                bun_sys::Result::Err(_err) => {
+            }) {
+                Err(err) => {
+                    bun_core::pretty_errorln!(
+                        "<r><red>error<r>: bunx failed to install <b>{}<r> due to error <b>{}<r>",
+                        BStr::new(&install_param),
+                        err.name(),
+                    );
                     Global::exit(1);
                 }
-                bun_sys::Result::Ok(result) => result,
-            },
-        };
+                Ok(maybe) => match maybe {
+                    bun_sys::Result::Err(_err) => {
+                        Global::exit(1);
+                    }
+                    bun_sys::Result::Ok(result) => result,
+                },
+            };
+
+            match &spawn_result.status {
+                SpawnStatus::Exited(exited) => {
+                    // Any non-zero byte (incl. RT signals >31) is a valid signal.
+                    // `signal_code()` would drop RT signals, so check the raw byte directly.
+                    if exited.signal != 0 {
+                        if bun_core::env_var::feature_flag::BUN_INTERNAL_SUPPRESS_CRASH_IN_BUN_RUN
+                            .get()
+                            .unwrap_or(false)
+                        {
+                            bun_crash_handler::suppress_reporting();
+                        }
 
-        match &spawn_result.status {
-            SpawnStatus::Exited(exited) => {
-                // Any non-zero byte (incl. RT signals >31) is a valid signal.
-                // `signal_code()` would drop RT signals, so check the raw byte directly.
-                if exited.signal != 0 {
+                        Global::raise_ignoring_panic_handler_raw(core::ffi::c_int::from(
+                            exited.signal,
+                        ));
+                    }
+
+                    if exited.code != 0 {
+                        Global::exit(exited.code as u32);
+                    }
+                }
+                SpawnStatus::Signaled(sig) => {
                     if bun_core::env_var::feature_flag::BUN_INTERNAL_SUPPRESS_CRASH_IN_BUN_RUN
                         .get()
                         .unwrap_or(false)
@@ -1436,35 +1667,21 @@ impl BunxCommand {
                         bun_crash_handler::suppress_reporting();
                     }
 
-                    Global::raise_ignoring_panic_handler_raw(core::ffi::c_int::from(exited.signal));
-                }
-
-                if exited.code != 0 {
-                    Global::exit(exited.code as u32);
+                    // RT signals (>31) are valid payloads; forward the
+                    // raw byte instead of lossy `signal_code()` so this arm always
+                    // diverges with the *actual* signal.
+                    Global::raise_ignoring_panic_handler_raw(core::ffi::c_int::from(*sig));
                 }
-            }
-            SpawnStatus::Signaled(sig) => {
-                if bun_core::env_var::feature_flag::BUN_INTERNAL_SUPPRESS_CRASH_IN_BUN_RUN
-                    .get()
-                    .unwrap_or(false)
-                {
-                    bun_crash_handler::suppress_reporting();
+                SpawnStatus::Err(err) => {
+                    bun_core::pretty_errorln!(
+                        "<r><red>error<r>: bunx failed to install <b>{}<r> due to error:\n{}",
+                        BStr::new(&install_param),
+                        err,
+                    );
+                    Global::exit(1);
                 }
-
-                // RT signals (>31) are valid payloads; forward the
-                // raw byte instead of lossy `signal_code()` so this arm always
-                // diverges with the *actual* signal.
-                Global::raise_ignoring_panic_handler_raw(core::ffi::c_int::from(*sig));
-            }
-            SpawnStatus::Err(err) => {
-                bun_core::pretty_errorln!(
-                    "<r><red>error<r>: bunx failed to install <b>{}<r> due to error:\n{}",
-                    BStr::new(&install_param),
-                    err,
-                );
-                Global::exit(1);
+                _ => {}
             }
-            _ => {}
         }
 
         absolute_in_cache_dir = {
@@ -1504,6 +1721,7 @@ impl BunxCommand {
             // Bail out to the generic error rather than execute it.
             if Self::is_trusted_cached_binary(destination, uid) {
                 let stored = fs.dirname_store.append_slice(out)?;
+                Self::release_install_lock(&mut install_lock);
                 Run::run_binary(
                     ctx,
                     stored,
@@ -1564,6 +1782,7 @@ impl BunxCommand {
                         // Same TOCTOU hardening as the post-install probe above.
                         if Self::is_trusted_cached_binary(destination, uid) {
                             let stored = fs.dirname_store.append_slice(out)?;
+                            Self::release_install_lock(&mut install_lock);
                             Run::run_binary(
                                 ctx,
                                 stored,
diff --git a/src/sys/lib.rs b/src/sys/lib.rs
index 7ea131c9789d..1d93453639ec 100644
--- a/src/sys/lib.rs
+++ b/src/sys/lib.rs
@@ -1095,6 +1095,15 @@ impl error::IntoErrnoInt for bun_windows_sys::NTSTATUS {
     }
 }
 
+/// Mode for [`flock`] — a whole-file lock: advisory `flock(2)` on POSIX,
+/// mandatory `LockFileEx` on Windows (other handles' reads and writes into
+/// the locked range fail there). Released when the fd is closed.
+#[derive(Clone, Copy, PartialEq, Eq)]
+pub enum FileLockMode {
+    Shared,
+    Exclusive,
+}
+
 /// `Exchange` and `NoReplace` are mutually exclusive at the kernel level.
 #[derive(Clone, Copy, Default, PartialEq, Eq)]
 pub enum RenameMode {
@@ -1436,6 +1445,7 @@ impl Tag {
     #[cfg(not(windows))]
     pub(crate) const setrlimit: Tag = Tag(106);
     pub const clone3: Tag = Tag(107);
+    pub const flock: Tag = Tag(108);
     // `inotify_init1`/`inotify_add_watch` fold under the generic `.watch`
     // tag; `INotifyWatcher.rs` spells it `.inotify`. Alias to `.watch`
     // so the JS-facing `err.syscall == "watch"` string stays node-compatible.
@@ -1443,7 +1453,7 @@ impl Tag {
     /// The tag name — spelling is frozen (JS-facing
     /// `err.syscall` string; node-compat code matches on it).
     pub fn name(self) -> &'static str {
-        const NAMES: [&str; 108] = [
+        const NAMES: [&str; 109] = [
             "TODO",
             "dup",
             "access",
@@ -1553,6 +1563,7 @@ impl Tag {
             "getrlimit",
             "setrlimit",
             "clone3",
+            "flock",
         ];
         NAMES.get(self.0 as usize).copied().unwrap_or("unknown")
     }
@@ -2721,6 +2732,32 @@ mod posix_impl {
         check!(safe_libc::ftruncate(fd.native(), len), Tag::ftruncate);
         Ok(())
     }
+    /// Advisory whole-file lock. Returns `Ok(false)` when `nonblocking` and
+    /// the lock is held elsewhere; retries `EINTR` internally.
+    pub fn flock(fd: Fd, mode: FileLockMode, nonblocking: bool) -> Maybe<bool> {
+        let mut op = match mode {
+            FileLockMode::Shared => libc::LOCK_SH,
+            FileLockMode::Exclusive => libc::LOCK_EX,
+        };
+        if nonblocking {
+            op |= libc::LOCK_NB;
+        }
+        loop {
+            // SAFETY: `fd` is a live descriptor; `op` is a valid flock op.
+            let rc = unsafe { libc::flock(fd.native(), op) };
+            if rc == 0 {
+                return Ok(true);
+            }
+            let e = last_errno();
+            if e == libc::EINTR {
+                continue;
+            }
+            if nonblocking && (e == libc::EWOULDBLOCK || e == libc::EAGAIN) {
+                return Ok(false);
+            }
+            return Err(Error::from_code_int(e, Tag::flock).with_fd(fd));
+        }
+    }
     pub fn getcwd(buf: &mut [u8]) -> Maybe<usize> {
         // SAFETY: `buf` is a valid exclusive slice; `getcwd` writes at most
         // `buf.len()` bytes (including the NUL).
@@ -3760,6 +3797,34 @@ mod windows_impl {
         }
         Ok(bytes_written as usize)
     }
+    /// Whole-file lock via `LockFileEx` (mandatory on Windows: other
+    /// handles' reads and writes into the range fail). Returns `Ok(false)` when
+    /// `nonblocking` and the lock is held elsewhere. Unlike POSIX `flock`,
+    /// `LockFileEx` does not upgrade/downgrade an already-held lock, but the
+    /// only caller pattern is acquire-once/close, which behaves identically.
+    pub fn flock(fd: Fd, mode: FileLockMode, nonblocking: bool) -> Maybe<bool> {
+        let mut flags: w::DWORD = 0;
+        if mode == FileLockMode::Exclusive {
+            flags |= w::kernel32::LOCKFILE_EXCLUSIVE_LOCK;
+        }
+        if nonblocking {
+            flags |= w::kernel32::LOCKFILE_FAIL_IMMEDIATELY;
+        }
+        let mut overlapped: w::OVERLAPPED = bun_core::ffi::zeroed();
+        // SAFETY: FFI; `fd.native()` is a valid HANDLE and `overlapped` is a
+        // valid out-param selecting range start 0.
+        let rc = unsafe {
+            w::kernel32::LockFileEx(fd.native(), flags, 0, u32::MAX, u32::MAX, &mut overlapped)
+        };
+        if rc != 0 {
+            return Ok(true);
+        }
+        let er = w::Win32Error::get();
+        if nonblocking && er == w::Win32Error::LOCK_VIOLATION {
+            return Ok(false);
+        }
+        Err(Error::new(er.to_e(), Tag::flock).with_fd(fd))
+    }
     pub fn pread(fd: Fd, buf: &mut [u8], off: i64) -> Maybe<usize> {
         // Positioned-I/O lowering:
         // libuv path for uv-kind fds, kernel32 ReadFile+OVERLAPPED for system
@@ -3802,7 +3867,7 @@ mod windows_impl {
             return Ok(amount_read as usize);
         }
     }
-    pub(crate) fn pwrite(fd: Fd, buf: &[u8], off: i64) -> Maybe<usize> {
+    pub fn pwrite(fd: Fd, buf: &[u8], off: i64) -> Maybe<usize> {
         // Same lowering as `pread`: kernel32 WriteFile with an
         // `OVERLAPPED.Offset` for HANDLE-kind fds.
         if fd.kind() == FdKind::Uv {
diff --git a/src/windows_sys/externs.rs b/src/windows_sys/externs.rs
index f3996922cf55..7c38f7d09812 100644
--- a/src/windows_sys/externs.rs
+++ b/src/windows_sys/externs.rs
@@ -845,6 +845,10 @@ pub mod kernel32 {
     pub const PAGE_EXECUTE_WRITECOPY: u32 = 0x80;
     pub const PAGE_GUARD: u32 = 0x100;
 
+    // `LockFileEx` dwFlags (`minwinbase.h`).
+    pub const LOCKFILE_FAIL_IMMEDIATELY: DWORD = 0x0000_0001;
+    pub const LOCKFILE_EXCLUSIVE_LOCK: DWORD = 0x0000_0002;
+
     #[cfg_attr(windows, link(name = "kernel32"))]
     unsafe extern "system" {
         /// No preconditions; reads thread-local Win32 error slot.
@@ -895,6 +899,17 @@ pub mod kernel32 {
         pub fn GetExitCodeProcess(hProcess: HANDLE, lpExitCode: *mut DWORD) -> BOOL;
         /// `FlushFileBuffers` — fsync(2)-equivalent for HANDLE-backed files.
         pub fn FlushFileBuffers(hFile: HANDLE) -> BOOL;
+        /// `LockFileEx` (`fileapi.h`) — mandatory byte-range lock. The
+        /// `lpOverlapped` out-param is required even for synchronous handles
+        /// (its `Offset`/`OffsetHigh` select the range start).
+        pub fn LockFileEx(
+            hFile: HANDLE,
+            dwFlags: DWORD,
+            dwReserved: DWORD,
+            nNumberOfBytesToLockLow: DWORD,
+            nNumberOfBytesToLockHigh: DWORD,
+            lpOverlapped: *mut OVERLAPPED,
+        ) -> BOOL;
         /// `SetFileTime` (`fileapi.h`). Any of the three `FILETIME` pointers
         /// may be null to leave that timestamp unchanged.
         pub fn SetFileTime(
diff --git a/test/cli/install/bunx-concurrent.test.ts b/test/cli/install/bunx-concurrent.test.ts
new file mode 100644
index 000000000000..a71d796066ab
--- /dev/null
+++ b/test/cli/install/bunx-concurrent.test.ts
@@ -0,0 +1,157 @@
+import { gzipSync, spawn } from "bun";
+import { expect, test } from "bun:test";
+import { bunEnv, bunExe, tempDir } from "harness";
+
+// https://github.com/oven-sh/bun/issues/37830
+// Concurrent `bun x <pkg>` processes share one install directory
+// (<tmpdir>/bunx-<uid>-<pkg>@<ver>). With a cold cache they all installed
+// into it at the same time and raced each other: some died with
+// "EEXIST/ENOENT: failed copying files from cache to destination", others
+// executed a half-written node_modules ("Cannot find module ...").
+
+/** Minimal ustar + gzip writer: enough for an npm package tarball. */
+function makeTarball(files: Record<string, string>): Uint8Array {
+  const blocks: Uint8Array[] = [];
+  const encoder = new TextEncoder();
+  for (const [name, contents] of Object.entries(files)) {
+    const data = encoder.encode(contents);
+    const header = new Uint8Array(512);
+    const put = (offset: number, value: string) => header.set(encoder.encode(value), offset);
+    put(0, `package/${name}`);
+    put(100, "0000755\0"); // mode: executable so bin entries work without chmod
+    put(108, "0000000\0"); // uid
+    put(116, "0000000\0"); // gid
+    put(124, data.length.toString(8).padStart(11, "0") + "\0");
+    put(136, "00000000000\0"); // mtime
+    header[156] = 0x30; // typeflag: regular file
+    put(257, "ustar\0"); // magic
+    put(263, "00"); // version
+    // checksum: sum of the header with the checksum field filled with spaces
+    header.fill(0x20, 148, 156);
+    let sum = 0;
+    for (const byte of header) sum += byte;
+    put(148, sum.toString(8).padStart(6, "0") + "\0 ");
+    blocks.push(header, data);
+    const partial = data.length % 512;
+    if (partial !== 0) blocks.push(new Uint8Array(512 - partial));
+  }
+  blocks.push(new Uint8Array(1024)); // end-of-archive
+  const flat = new Uint8Array(blocks.reduce((n, b) => n + b.length, 0));
+  let offset = 0;
+  for (const block of blocks) {
+    flat.set(block, offset);
+    offset += block.length;
+  }
+  return gzipSync(flat);
+}
+
+// A dependency with many files widens the cache-to-destination copy window
+// so the racing processes reliably overlap.
+const FILE_COUNT = 300;
+const filler = Buffer.alloc(1024, "x").toString();
+function manyFilesPackage(name: string): Record<string, string> {
+  const files: Record<string, string> = {
+    "package.json": JSON.stringify({ name, version: "1.0.0", main: "index.js" }),
+    "index.js":
+      Array.from({ length: FILE_COUNT }, (_, i) => `require("./file${i}.js");`).join("\n") +
+      `\nmodule.exports = ${FILE_COUNT};\n`,
+  };
+  for (let i = 0; i < FILE_COUNT; i++) {
+    files[`file${i}.js`] = `module.exports = ${i}; // ${filler}\n`;
+  }
+  return files;
+}
+
+test("concurrent bunx spawns of the same package do not corrupt the shared install dir", async () => {
+  const packages: Record<string, { tarball: Uint8Array; meta: object }> = {};
+  const registerPackage = (name: string, files: Record<string, string>, extra: object = {}) => {
+    packages[name] = {
+      tarball: makeTarball(files),
+      meta: { name, version: "1.0.0", ...extra },
+    };
+  };
+
+  registerPackage("dep-a-37830", manyFilesPackage("dep-a-37830"));
+  registerPackage("dep-b-37830", manyFilesPackage("dep-b-37830"));
+  registerPackage(
+    "pkg-37830",
+    {
+      "package.json": JSON.stringify({
+        name: "pkg-37830",
+        version: "1.0.0",
+        bin: { "pkg-37830": "cli.js" },
+        dependencies: { "dep-a-37830": "1.0.0", "dep-b-37830": "1.0.0" },
+      }),
+      "cli.js": `#!/usr/bin/env node\nconsole.log("OK-37830", require("dep-a-37830") + require("dep-b-37830"));\n`,
+    },
+    {
+      bin: { "pkg-37830": "cli.js" },
+      dependencies: { "dep-a-37830": "1.0.0", "dep-b-37830": "1.0.0" },
+    },
+  );
+
+  await using server = Bun.serve({
+    port: 0,
+    fetch(req) {
+      const path = decodeURIComponent(new URL(req.url).pathname);
+      const tarballMatch = path.match(/^\/([^/]+)-1\.0\.0\.tgz$/);
+      if (tarballMatch && packages[tarballMatch[1]]) {
+        return new Response(packages[tarballMatch[1]].tarball);
+      }
+      const name = path.slice(1);
+      if (packages[name]) {
+        return Response.json({
+          name,
+          "dist-tags": { latest: "1.0.0" },
+          versions: {
+            "1.0.0": {
+              ...packages[name].meta,
+              dist: { tarball: `http://localhost:${server.port}/${name}-1.0.0.tgz` },
+            },
+          },
+        });
+      }
+      return new Response("not found", { status: 404 });
+    },
+  });
+
+  // A fresh temp dir gives this run its own bunx install dir
+  // (<tmpdir>/bunx-<uid>-pkg-37830@latest) and a cold install cache.
+  using tmp = tempDir("bunx-concurrent-tmp", {});
+  using cache = tempDir("bunx-concurrent-cache", {});
+  using cwd = tempDir("bunx-concurrent-cwd", {});
+  const env = {
+    ...bunEnv,
+    TMPDIR: String(tmp),
+    BUN_TMPDIR: String(tmp),
+    TEMP: String(tmp),
+    BUN_INSTALL_CACHE_DIR: String(cache),
+    npm_config_registry: `http://localhost:${server.port}/`,
+  };
+
+  const CONCURRENCY = 8;
+  const procs = Array.from({ length: CONCURRENCY }, () =>
+    spawn({
+      cmd: [bunExe(), "x", "pkg-37830"],
+      env,
+      cwd: String(cwd),
+      stdout: "pipe",
+      stderr: "pipe",
+    }),
+  );
+  const results = await Promise.all(
+    procs.map(async proc => {
+      const [stdout, stderr, exitCode] = await Promise.all([proc.stdout.text(), proc.stderr.text(), proc.exited]);
+      return { stdout, stderr, exitCode };
+    }),
+  );
+
+  for (const { stdout, stderr, exitCode } of results) {
+    expect(stderr).not.toContain("failed copying files from cache to destination");
+    expect(stderr).not.toContain("Cannot find module");
+    expect(stdout).toContain("OK-37830 600");
+    expect(exitCode).toBe(0);
+  }
+  // Outlier timeout: 8 serialized cold-cache installs of ~600 files each;
+  // shrinking the workload loses the repro on unfixed builds.
+}, 60_000);

From e71ecab61a7fac19e4e1726acdf7e48b893a5b00 Mon Sep 17 00:00:00 2001
From: robobun <117481402+robobun@users.noreply.github.com>
Date: Mon, 17 Aug 2026 01:17:07 +0000
Subject: [PATCH 090/258] install: resolve deferred `*` peers after their
 siblings, not on arrival order (#37713)

---
 .../PackageManager/PackageManagerEnqueue.rs   |  21 +-
 src/install/lockfile/bun.lock.rs              |  17 +-
 test/cli/install/bun-install-registry.test.ts | 265 ++++++++++++------
 3 files changed, 196 insertions(+), 107 deletions(-)

diff --git a/src/install/PackageManager/PackageManagerEnqueue.rs b/src/install/PackageManager/PackageManagerEnqueue.rs
index 1c703e23f664..e962f4e8aef5 100644
--- a/src/install/PackageManager/PackageManagerEnqueue.rs
+++ b/src/install/PackageManager/PackageManagerEnqueue.rs
@@ -2128,23 +2128,10 @@ fn get_or_put_resolved_package_with_find_result(
 
     // Was this package already allocated? Let's reuse the existing one.
     //
-    // Determinism: passing `version` here unconditionally lets a
-    // peer like `>= 1.0.2` collapse onto whichever sibling-appended entry
-    // (e.g. `1.0.9`) happens to be highest in the index *at this instant* — a
-    // network-order artefact that the `^1.0.2` peer-hoisting test already
-    // todoIf's on macOS. The floor guard in `get_package_id` was
-    // meant to close that, but its exact-pinned/same-major exemptions reopen
-    // it when *every* candidate is an exact-pinned same-major sibling
-    // (`uses-a-dep-1..10`). For deferred peers, suppress the satisfies-
-    // fallback so only an exact `eql(find_result)` can bind here; everything
-    // else falls through to the `is_peer && !install_peer` defer below and is
-    // resolved deterministically by phase 2's descending-index scan in
-    // `get_or_put_resolved_package`. `*` is left alone — it expresses no
-    // version preference, and the "peer *" hoisting test depends on it
-    // deduping to whatever sibling pin exists rather than the manifest floor.
-    let suppress_peer_satisfies = behavior.is_peer()
-        && !install_peer
-        && !(version.tag == dependency::version::Tag::Npm && version.npm().version.is_star());
+    // A peer that is still deferred may only reuse an exact match: which
+    // siblings exist at this point depends on response arrival order, so the
+    // range match waits for the `install_peer` pass, when all of them exist.
+    let suppress_peer_satisfies = behavior.is_peer() && !install_peer;
     if let Some(id) = this.lockfile.get_package_id(
         name_hash,
         if should_update || suppress_peer_satisfies {
diff --git a/src/install/lockfile/bun.lock.rs b/src/install/lockfile/bun.lock.rs
index 412151d0196b..4110ae30567b 100644
--- a/src/install/lockfile/bun.lock.rs
+++ b/src/install/lockfile/bun.lock.rs
@@ -3372,13 +3372,10 @@ pub(crate) fn parse_into_binary_lockfile(
     Ok(())
 }
 
-/// The catalog-resolved range of a peer edge the fresh resolver defers to its second phase
-/// (`install_peer`) and binds by version there. Two exemptions, matching
-/// `enqueue_dependency_with_main_and_success_fn`: optional peers return
-/// before the deferred phase and are bound to the hoisted-tree sibling by
-/// `process_subtree` instead, and `*` peers express no version preference
-/// and bind to whatever sibling pin existed first. Both of those are
-/// exactly what the printed tree's path walk reproduces, so they keep it.
+/// The catalog-resolved range of a peer edge the fresh resolver binds by
+/// version in its `install_peer` pass. Optional peers are bound to the
+/// hoisted-tree sibling by `process_subtree` instead, which is what the path
+/// walk reproduces.
 fn deferred_peer_range<'a>(
     dep: &'a Dependency,
     catalogs: &'a CatalogMap,
@@ -3387,11 +3384,7 @@ fn deferred_peer_range<'a>(
     if !dep.behavior.is_peer() || dep.behavior.is_optional_peer() {
         return None;
     }
-    let range = catalogs.resolve_range(string_buf, dep);
-    if range.tag == DependencyVersionTag::Npm && range.npm().version.is_star() {
-        return None;
-    }
-    Some(range)
+    Some(catalogs.resolve_range(string_buf, dep))
 }
 
 /// Resolve a peer dependency edge the way the fresh resolver's
diff --git a/test/cli/install/bun-install-registry.test.ts b/test/cli/install/bun-install-registry.test.ts
index 4eda69b7a7d9..7b38512f9d8f 100644
--- a/test/cli/install/bun-install-registry.test.ts
+++ b/test/cli/install/bun-install-registry.test.ts
@@ -8,7 +8,6 @@ import {
   bunExe,
   bunEnv as env,
   isFlaky,
-  isMacOS,
   isWindows,
   mergeWindowEnvs,
   normalizeBunSnapshot,
@@ -4207,6 +4206,11 @@ describe("hoisting", async () => {
     expect(lockfile).toMatchNodeModulesAt(packageDir);
   });
 
+  // Compare the exact version: `toContain("1.0.1")` also matches "1.0.10".
+  async function hoistedADepVersion(): Promise<string> {
+    return (await file(join(packageDir, "node_modules", "a-dep", "package.json")).json()).version;
+  }
+
   var tests: any = [
     {
       situation: "1.0.0 - 1.0.10 is in order",
@@ -4316,7 +4320,7 @@ describe("hoisting", async () => {
       expect(await exited).toBe(0);
       assertManifestsPopulated(join(packageDir, ".bun-cache"), registryUrl());
 
-      expect(await file(join(packageDir, "node_modules", "a-dep", "package.json")).text()).toContain(expected);
+      expect(await hoistedADepVersion()).toBe(expected);
 
       await rm(join(packageDir, "bun.lockb"));
 
@@ -4425,7 +4429,9 @@ describe("hoisting", async () => {
           "uses-a-dep-10": "1.0.0",
           "peer-a-dep-star": "1.0.0",
         },
-        expected: "1.0.1",
+        // `*` is satisfied by every a-dep in the tree, so the peer takes the
+        // highest one, regardless of which manifest the registry returned first.
+        expected: "1.0.10",
       },
       {
         situation: "peer * and peer 1.0.2",
@@ -4447,88 +4453,191 @@ describe("hoisting", async () => {
       },
     ];
     for (const { dependencies, expected, situation } of peerTests) {
-      test.todoIf(isFlaky && isMacOS && situation === "peer ^1.0.2")(
-        `it should hoist ${expected} when ${situation}`,
-        async () => {
-          await writeFile(
-            packageJson,
-            JSON.stringify({
-              name: "foo",
-              dependencies,
-            }),
-          );
-
-          var { stdout, stderr, exited } = spawn({
-            cmd: [bunExe(), "install"],
-            cwd: packageDir,
-            stdout: "pipe",
-            stdin: "pipe",
-            stderr: "pipe",
-            env,
-          });
+      test(`it should hoist ${expected} when ${situation}`, async () => {
+        await writeFile(
+          packageJson,
+          JSON.stringify({
+            name: "foo",
+            dependencies,
+          }),
+        );
 
-          var err = await stderr.text();
-          var out = await stdout.text();
-          expect(err).toContain("Saved lockfile");
-          expect(err).not.toContain("not found");
-          expect(err).not.toContain("error:");
-          for (const dep of Object.keys(dependencies)) {
-            expect(out).toContain(`+ ${dep}@${dependencies[dep]}`);
-          }
-          expect(await exited).toBe(0);
-          assertManifestsPopulated(join(packageDir, ".bun-cache"), registryUrl());
+        var { stdout, stderr, exited } = spawn({
+          cmd: [bunExe(), "install"],
+          cwd: packageDir,
+          stdout: "pipe",
+          stdin: "pipe",
+          stderr: "pipe",
+          env,
+        });
 
-          expect(await file(join(packageDir, "node_modules", "a-dep", "package.json")).text()).toContain(expected);
-
-          await rm(join(packageDir, "bun.lockb"));
-
-          ({ stdout, stderr, exited } = spawn({
-            cmd: [bunExe(), "install"],
-            cwd: packageDir,
-            stdout: "pipe",
-            stdin: "pipe",
-            stderr: "pipe",
-            env,
-          }));
-
-          err = await stderr.text();
-          out = await stdout.text();
-          expect(err).toContain("Saved lockfile");
-          expect(err).not.toContain("not found");
-          expect(err).not.toContain("error:");
-          if (out.includes("installed")) {
-            console.log("stdout:", out);
-          }
-          expect(out).not.toContain("package installed");
-          expect(await exited).toBe(0);
-          assertManifestsPopulated(join(packageDir, ".bun-cache"), registryUrl());
+        var err = await stderr.text();
+        var out = await stdout.text();
+        expect(err).toContain("Saved lockfile");
+        expect(err).not.toContain("not found");
+        expect(err).not.toContain("error:");
+        for (const dep of Object.keys(dependencies)) {
+          expect(out).toContain(`+ ${dep}@${dependencies[dep]}`);
+        }
+        expect(await exited).toBe(0);
+        assertManifestsPopulated(join(packageDir, ".bun-cache"), registryUrl());
 
-          expect(await file(join(packageDir, "node_modules", "a-dep", "package.json")).text()).toContain(expected);
+        expect(await hoistedADepVersion()).toBe(expected);
 
-          await rm(join(packageDir, "node_modules"), { recursive: true, force: true });
+        await rm(join(packageDir, "bun.lockb"));
 
-          ({ stdout, stderr, exited } = spawn({
-            cmd: [bunExe(), "install"],
-            cwd: packageDir,
-            stdout: "pipe",
-            stdin: "pipe",
-            stderr: "pipe",
-            env,
-          }));
-
-          err = await stderr.text();
-          out = await stdout.text();
-          expect(err).not.toContain("Saved lockfile");
-          expect(err).not.toContain("not found");
-          expect(err).not.toContain("error:");
-          expect(out).not.toContain("package installed");
-          expect(await exited).toBe(0);
-          assertManifestsPopulated(join(packageDir, ".bun-cache"), registryUrl());
+        ({ stdout, stderr, exited } = spawn({
+          cmd: [bunExe(), "install"],
+          cwd: packageDir,
+          stdout: "pipe",
+          stdin: "pipe",
+          stderr: "pipe",
+          env,
+        }));
 
-          expect(await file(join(packageDir, "node_modules", "a-dep", "package.json")).text()).toContain(expected);
-        },
-      );
+        err = await stderr.text();
+        out = await stdout.text();
+        expect(err).toContain("Saved lockfile");
+        expect(err).not.toContain("not found");
+        expect(err).not.toContain("error:");
+        expect(out).not.toContain("package installed");
+        expect(await exited).toBe(0);
+        assertManifestsPopulated(join(packageDir, ".bun-cache"), registryUrl());
+
+        expect(await hoistedADepVersion()).toBe(expected);
+
+        await rm(join(packageDir, "node_modules"), { recursive: true, force: true });
+
+        ({ stdout, stderr, exited } = spawn({
+          cmd: [bunExe(), "install"],
+          cwd: packageDir,
+          stdout: "pipe",
+          stdin: "pipe",
+          stderr: "pipe",
+          env,
+        }));
+
+        err = await stderr.text();
+        out = await stdout.text();
+        expect(err).not.toContain("Saved lockfile");
+        expect(err).not.toContain("not found");
+        expect(err).not.toContain("error:");
+        expect(out).not.toContain("package installed");
+        expect(await exited).toBe(0);
+        assertManifestsPopulated(join(packageDir, ".bun-cache"), registryUrl());
+
+        expect(await hoistedADepVersion()).toBe(expected);
+      });
     }
+
+    test("peer * hoists the same version no matter which manifest the registry answers first", async () => {
+      // Proxy in front of verdaccio that forces the arrival order seen on slow
+      // CI machines: the a-dep manifest gets processed (so a-dep@1.0.1..1.0.9
+      // exist in the lockfile) before peer-a-dep-star's manifest arrives, and
+      // uses-a-dep-10's manifest (the one pinning a-dep@1.0.10) arrives after
+      // peer-a-dep-star has been processed. Each held response is released by
+      // a request bun only makes once the earlier step has happened, so no
+      // timers are involved.
+      const upstream = registryUrl().replace(/\/$/, "");
+      const aDepTarballRequested = Promise.withResolvers<void>();
+      const peerTarballRequested = Promise.withResolvers<void>();
+      using proxy = Bun.serve({
+        port: 0,
+        // The held responses stay open for as long as bun takes to reach the next step.
+        idleTimeout: 0,
+        async fetch(req) {
+          const { pathname } = new URL(req.url);
+          const isTarball = pathname.includes("/-/");
+          if (pathname.startsWith("/a-dep/-/")) aDepTarballRequested.resolve();
+          if (pathname.startsWith("/peer-a-dep-star/-/")) peerTarballRequested.resolve();
+          if (pathname === "/peer-a-dep-star") await aDepTarballRequested.promise;
+          if (pathname === "/uses-a-dep-10") await peerTarballRequested.promise;
+
+          const res = await fetch(upstream + pathname, { headers: { accept: req.headers.get("accept") ?? "*/*" } });
+          if (isTarball) return new Response(await res.arrayBuffer(), { status: res.status });
+          // Tarball urls inside the manifests point at verdaccio; keep every request on the proxy.
+          return new Response((await res.text()).replaceAll(upstream, proxy.url.origin), {
+            status: res.status,
+            headers: { "content-type": "application/json" },
+          });
+        },
+      });
+
+      const dependencies: Record<string, string> = { "peer-a-dep-star": "1.0.0" };
+      for (let i = 1; i <= 10; i++) dependencies[`uses-a-dep-${i}`] = "1.0.0";
+      await writeFile(packageJson, JSON.stringify({ name: "foo", dependencies }));
+
+      await using proc = spawn({
+        cmd: [bunExe(), "install", "--registry", proxy.url.href],
+        cwd: packageDir,
+        stdout: "pipe",
+        stdin: "pipe",
+        stderr: "pipe",
+        env,
+      });
+      const [err, out, exitCode] = await Promise.all([proc.stderr.text(), proc.stdout.text(), proc.exited]);
+      expect(err).toContain("Saved lockfile");
+      expect(err).not.toContain("error:");
+      expect(out).toContain("21 packages installed");
+      expect(exitCode).toBe(0);
+
+      expect(await hoistedADepVersion()).toBe("1.0.10");
+    });
+
+    test("peer * binds to the same version when bun.lock is loaded as when it was resolved", async () => {
+      // Nothing above `peer-a-dep-star` provides a-dep, so the isolated linker
+      // installs the peer from the version the edge resolved to and keys the
+      // store entry by it. The root of the printed tree holds a-dep@1.0.1 (from
+      // uses-a-dep-1), while the resolver picks the highest a-dep, 1.0.5. The
+      // second install loads bun.lock and has to arrive at the same 1.0.5, or it
+      // creates a second store entry for peer-a-dep-star.
+      await Promise.all([
+        write(
+          packageJson,
+          JSON.stringify({
+            name: "foo",
+            workspaces: ["packages/*"],
+            dependencies: { "uses-a-dep-1": "1.0.0", "uses-a-dep-5": "1.0.0" },
+          }),
+        ),
+        write(
+          join(packageDir, "packages", "pkg", "package.json"),
+          JSON.stringify({ name: "pkg", dependencies: { "peer-a-dep-star": "1.0.0" } }),
+        ),
+      ]);
+      const store = join(packageDir, "node_modules", ".bun");
+
+      async function install() {
+        await using proc = spawn({
+          cmd: [bunExe(), "install", "--save-text-lockfile", "--linker", "isolated"],
+          cwd: packageDir,
+          stdout: "pipe",
+          stdin: "pipe",
+          stderr: "pipe",
+          env,
+        });
+        const [err, out, exitCode] = await Promise.all([proc.stderr.text(), proc.stdout.text(), proc.exited]);
+        expect(err).not.toContain("error:");
+        expect(exitCode).toBe(0);
+        return {
+          err,
+          out,
+          entries: (await readdirSorted(store)).filter(entry => entry.startsWith("peer-a-dep-star@")),
+        };
+      }
+
+      const first = await install();
+      expect(first.err).toContain("Saved lockfile");
+      expect(first.entries).toHaveLength(1);
+      expect(await file(join(store, first.entries[0], "node_modules", "a-dep", "package.json")).json()).toMatchObject({
+        version: "1.0.5",
+      });
+
+      const second = await install();
+      expect(second.err).not.toContain("Saved lockfile");
+      expect(second.out).toContain("(no changes)");
+      expect(second.entries).toEqual(first.entries);
+    });
   });
 
   test("hoisting/using incorrect peer dep after install", async () => {

From d07fe1278e19a7b814f5dc254225db3a4014aaaf Mon Sep 17 00:00:00 2001
From: robobun <117481402+robobun@users.noreply.github.com>
Date: Mon, 17 Aug 2026 01:20:15 +0000
Subject: [PATCH 091/258] install: rebind ranged peers whose target the saved
 tree drops (#38768)

---
 src/install/lockfile.rs                       |  2 +
 src/install/lockfile/bun.lock.rs              | 95 ++++++++++++++++++-
 test/cli/install/isolated-install.test.ts     | 63 ++++++++++++
 .../install/migration/pnpm-lock-v9.test.ts    | 86 +++++++++++++++++
 4 files changed, 242 insertions(+), 4 deletions(-)

diff --git a/src/install/lockfile.rs b/src/install/lockfile.rs
index 71018aac06a9..ff296b75ea27 100644
--- a/src/install/lockfile.rs
+++ b/src/install/lockfile.rs
@@ -1323,8 +1323,10 @@ impl<'a> Cloner<'a> {
 
 impl Lockfile {
     /// Re-hoists while a pass bound a peer late; a reload has that binding up front.
+    /// Ranged peers bound to a package the tree left out are rebound the way a reload binds them.
     pub(crate) fn resolve(&mut self, log: &mut bun_ast::Log) -> Result<(), tree::SubtreeError> {
         while self.hoist::<{ tree::BuilderMethod::Resolvable }>(log, None, true, &[], None)? {}
+        TextLockfile::rebind_peers_to_printed_packages(self)?;
         Ok(())
     }
 
diff --git a/src/install/lockfile/bun.lock.rs b/src/install/lockfile/bun.lock.rs
index 4110ae30567b..3e002201f23a 100644
--- a/src/install/lockfile/bun.lock.rs
+++ b/src/install/lockfile/bun.lock.rs
@@ -4,7 +4,7 @@ use core::fmt::Write as _;
 
 use crate::bun_json as JSON;
 use bun_ast::{Expr, expr::Data as ExprData};
-use bun_collections::{HashContext, HashMap, StringHashMap};
+use bun_collections::{DynamicBitSet, HashContext, HashMap, StringHashMap};
 use bun_core::strings;
 use bun_core::{self};
 use bun_paths::PathBuffer;
@@ -3422,6 +3422,28 @@ pub(crate) fn resolve_peer_dep_version_based(
     overrides: &OverrideMap,
     pkg_resolutions: &[Resolution],
     string_buf: &[u8],
+) -> Option<PackageID> {
+    resolve_peer_dep_version_based_among(
+        dep,
+        catalogs,
+        package_index,
+        overrides,
+        pkg_resolutions,
+        string_buf,
+        |_| true,
+    )
+}
+
+/// `resolve_peer_dep_version_based` over the candidates `is_candidate` accepts, for callers
+/// whose lockfile holds packages a reload will not see (`rebind_peers_to_printed_packages`).
+pub(crate) fn resolve_peer_dep_version_based_among(
+    dep: &Dependency,
+    catalogs: &CatalogMap,
+    package_index: &PackageIndexMap,
+    overrides: &OverrideMap,
+    pkg_resolutions: &[Resolution],
+    string_buf: &[u8],
+    is_candidate: impl Fn(PackageID) -> bool,
 ) -> Option<PackageID> {
     let range = deferred_peer_range(dep, catalogs, string_buf)?;
     // `package_index` is keyed by real package names; `range` (not `dep.name`) carries them for aliases.
@@ -3464,12 +3486,77 @@ pub(crate) fn resolve_peer_dep_version_based(
 
     let candidates = package_index.get(&name_hash)?.as_slice();
     candidates.iter().copied().find(|&id| {
-        pkg_resolutions
-            .get(id as usize)
-            .is_some_and(|res| res.satisfies_dependency_version(range, string_buf, string_buf))
+        is_candidate(id)
+            && pkg_resolutions
+                .get(id as usize)
+                .is_some_and(|res| res.satisfies_dependency_version(range, string_buf, string_buf))
     })
 }
 
+/// Call after hoisting. The printed tree is the lockfile's only record of which packages
+/// exist, and a package whose incoming edges are all ranged peers that `Tree::hoist_dependency`
+/// deduped onto another version of the same name is in no tree at all (pnpm's auto-installed
+/// peers arrive like this from pnpm-lock.yaml; adding a pinned version of a package that was
+/// only auto-installed for a peer creates the same shape). `resolve_peer_dep_version_based`
+/// therefore binds such edges to another package on reload, and the install that wrote the
+/// lockfile links something different from every install that reads it. Binding them here over
+/// the packages the print will contain makes the writing install match its readers.
+///
+/// Every edge rebound here was deduped during hoisting, so it is not in `hoisted_dependencies`
+/// and the tree stays valid; the old target is dropped by the next `clean_with_logger`.
+pub(crate) fn rebind_peers_to_printed_packages(
+    lockfile: &mut BinaryLockfile,
+) -> Result<(), bun_alloc::AllocError> {
+    let pkg_resolutions: &[Resolution] = lockfile.packages.items_resolution();
+    let package_index = &lockfile.package_index;
+    let catalogs = &lockfile.catalogs;
+    let overrides = &lockfile.overrides;
+    let super::Buffers {
+        hoisted_dependencies,
+        resolutions,
+        dependencies,
+        string_bytes,
+        ..
+    } = &mut lockfile.buffers;
+    let string_buf: &[u8] = string_bytes.as_slice();
+
+    // Root and workspaces are printed from the `workspaces` section, everything else from the tree.
+    let mut printed = DynamicBitSet::init_empty(pkg_resolutions.len())?;
+    for (pkg_id, res) in pkg_resolutions.iter().enumerate() {
+        if matches!(res.tag, ResolutionTag::Root | ResolutionTag::Workspace) {
+            printed.set(pkg_id);
+        }
+    }
+    for &dep_id in hoisted_dependencies.iter() {
+        let pkg_id = resolutions[dep_id as usize];
+        if (pkg_id as usize) < pkg_resolutions.len() {
+            printed.set(pkg_id as usize);
+        }
+    }
+
+    for (dep, target) in dependencies.iter().zip(resolutions.iter_mut()) {
+        if (*target as usize) >= pkg_resolutions.len()
+            || printed.is_set(*target as usize)
+            || !dep.behavior.is_peer()
+        {
+            continue;
+        }
+        if let Some(printed_target) = resolve_peer_dep_version_based_among(
+            dep,
+            catalogs,
+            package_index,
+            overrides,
+            pkg_resolutions,
+            string_buf,
+            |id| printed.is_set(id as usize),
+        ) {
+            *target = printed_target;
+        }
+    }
+
+    Ok(())
+}
+
 // Taking `&mut BinaryLockfile` plus a `&mut Dependency` that
 // points into `lockfile.buffers.dependencies` would be illegal aliasing.
 // The function only touches `buffers.resolutions[dep_id]` and reads
diff --git a/test/cli/install/isolated-install.test.ts b/test/cli/install/isolated-install.test.ts
index 1f5cfcf1aef5..4934d55a7d93 100644
--- a/test/cli/install/isolated-install.test.ts
+++ b/test/cli/install/isolated-install.test.ts
@@ -1320,6 +1320,69 @@ test("ranged peer rebinds in the install that adds a higher satisfying version,
   );
 });
 
+test("a ranged peer whose auto-installed version drops out of the saved tree is rebound before linking", async () => {
+  // The first install auto-installs no-deps@1.1.0 for peer-deps-fixed's
+  // `no-deps@^1.0.0`; nothing else depends on it. Adding one-dep pins
+  // no-deps@1.0.1, which is hoisted to the root of the saved tree, so the
+  // peer edge dedupes onto it and 1.1.0 is no longer written to bun.lock.
+  // Reloading that bun.lock binds the edge to 1.0.1, so the install that
+  // writes it has to link 1.0.1 as well, or the next install re-keys the
+  // entry.
+  const { packageJson, packageDir } = await registry.createTestDir({
+    bunfigOpts: { linker: "isolated" },
+  });
+
+  await write(
+    packageJson,
+    JSON.stringify({
+      name: "dropped-peer-target",
+      dependencies: {
+        "peer-deps-fixed": "1.0.0",
+      },
+    }),
+  );
+
+  await runBunInstall(bunEnv, packageDir);
+
+  const bunDir = join(packageDir, "node_modules", ".bun");
+  const autoInstalledEntry = "peer-deps-fixed@1.0.0+7ff199101204a65d";
+  const reboundEntry = "peer-deps-fixed@1.0.0+f8a822eca018d0a1";
+  expect(await readdirSorted(bunDir)).toContain(autoInstalledEntry);
+  expect(await file(join(bunDir, autoInstalledEntry, "node_modules", "no-deps", "package.json")).json()).toMatchObject({
+    version: "1.1.0",
+  });
+
+  await write(
+    packageJson,
+    JSON.stringify({
+      name: "dropped-peer-target",
+      dependencies: {
+        "one-dep": "1.0.0",
+        "peer-deps-fixed": "1.0.0",
+      },
+    }),
+  );
+
+  await runBunInstall(bunEnv, packageDir);
+
+  const bunLock = await file(join(packageDir, "bun.lock")).text();
+  expect(bunLock).toContain(`"no-deps": ["no-deps@1.0.1"`);
+  expect(bunLock).not.toContain("no-deps@1.1.0");
+  expect(await readlink(join(packageDir, "node_modules", "peer-deps-fixed"))).toBe(
+    join(".bun", reboundEntry, "node_modules", "peer-deps-fixed"),
+  );
+  expect(await file(join(bunDir, reboundEntry, "node_modules", "no-deps", "package.json")).json()).toMatchObject({
+    version: "1.0.1",
+  });
+  const entries = await readdirSorted(bunDir);
+
+  const { out } = await runBunInstall(bunEnv, packageDir, { savesLockfile: false });
+
+  expect(out).toContain("(no changes)");
+  expect(await readdirSorted(bunDir)).toEqual(entries);
+  expect(await file(join(packageDir, "bun.lock")).text()).toBe(bunLock);
+});
+
 test("aliased peer dependency binds to its real package across installs from bun.lock", async () => {
   // The peer alias `no-deps` points at `npm:a-dep@^1.0.2` while the real
   // no-deps package (in two versions) is also in the graph. Loading bun.lock
diff --git a/test/cli/install/migration/pnpm-lock-v9.test.ts b/test/cli/install/migration/pnpm-lock-v9.test.ts
index d86648e17ccb..5beb161d199a 100644
--- a/test/cli/install/migration/pnpm-lock-v9.test.ts
+++ b/test/cli/install/migration/pnpm-lock-v9.test.ts
@@ -84,6 +84,8 @@ const NO_DEPS_1_0_0_INTEGRITY =
   "sha512-v4w12JRjUGvfHDUP8vFDwu0gUWu04j0cv9hLb1Abf9VdaXu4XcrddYFTMVBVvmldKViGWH7jrb6xPJRF0wq6gw==";
 const NO_DEPS_1_0_1_INTEGRITY =
   "sha512-3X6cn4+UJdXJuLPu11v8i/fGLe2PdI6v1yKTELam04lY5esCAFdG/qQts6N6rLrL6g1YRq+MKBAwxbmUQk355A==";
+const NO_DEPS_1_1_0_INTEGRITY =
+  "sha512-ebG2pipYAKINcNI3YxdsiAgFvNGp2gdRwxAKN2LYBm9+YxuH/lHH2sl+GKQTuGiNfCfNZRMHUyyLPEJD6HWm7w==";
 const NO_DEPS_2_0_0_INTEGRITY =
   "sha512-W3duJKZPcMIG5rA1io5cSK/bhW9rWFz+jFxZsKS/3suK4qHDkQNxUTEXee9/hTaAoDCeHWQqogukWYKzfr6X4g==";
 const ONE_DEP_1_0_0_INTEGRITY =
@@ -1942,6 +1944,90 @@ ${variants}`;
       expect(peerDepsDirs[0]).not.toBe(peerDepsDirs[1]);
     });
 
+    test("the migrating install links the peer version its bun.lock reloads with the isolated linker", async () => {
+      // pnpm auto-installed no-deps@1.1.0 for peer-deps-fixed's `no-deps: ^1.0.0` while one-dep pins
+      // no-deps@1.0.1, so 1.1.0 is only reachable through the peer edge. The hoisted tree dedupes that
+      // edge onto 1.0.1, bun.lock never records 1.1.0, and reloading binds the edge to 1.0.1. The
+      // migrating install has to link the same binding, or the next install relinks the entry.
+      const { packageDir } = await verdaccio.createTestDir({
+        bunfigOpts: { linker: "isolated" },
+        files: {
+          "package.json": JSON.stringify({
+            name: "v9-auto-installed-peer",
+            dependencies: { "one-dep": "1.0.0", "peer-deps-fixed": "1.0.0" },
+          }),
+          "pnpm-lock.yaml": `lockfileVersion: '9.0'
+
+importers:
+
+  .:
+    dependencies:
+      one-dep:
+        specifier: 1.0.0
+        version: 1.0.0
+      peer-deps-fixed:
+        specifier: 1.0.0
+        version: 1.0.0(no-deps@1.1.0)
+
+packages:
+
+  no-deps@1.0.1:
+    resolution: {integrity: ${NO_DEPS_1_0_1_INTEGRITY}}
+
+  no-deps@1.1.0:
+    resolution: {integrity: ${NO_DEPS_1_1_0_INTEGRITY}}
+
+  one-dep@1.0.0:
+    resolution: {integrity: ${ONE_DEP_1_0_0_INTEGRITY}}
+
+  peer-deps-fixed@1.0.0:
+    resolution: {integrity: ${PEER_DEPS_FIXED_1_0_0_INTEGRITY}}
+    peerDependencies:
+      no-deps: ^1.0.0
+
+snapshots:
+
+  no-deps@1.0.1: {}
+
+  no-deps@1.1.0: {}
+
+  one-dep@1.0.0:
+    dependencies:
+      no-deps: 1.0.1
+
+  peer-deps-fixed@1.0.0(no-deps@1.1.0):
+    dependencies:
+      no-deps: 1.1.0
+`,
+        },
+      });
+
+      const migrating = await run(packageDir, "install");
+
+      expect(migrating.stderr).toContain("migrated lockfile from pnpm-lock.yaml");
+      expect(migrating.stderr).not.toContain("error:");
+      expect(migrating.exitCode).toBe(0);
+
+      const bunLock = await bunLockOf(packageDir);
+      expect(bunLock).toContain(`"no-deps": ["no-deps@1.0.1"`);
+      expect(bunLock).not.toContain("no-deps@1.1.0");
+
+      const storeDir = join(packageDir, "node_modules", ".bun");
+      const peerDepsFixedDir = realpathSync(join(packageDir, "node_modules", "peer-deps-fixed"));
+      expect((await Bun.file(join(dirname(peerDepsFixedDir), "no-deps", "package.json")).json()).version).toBe("1.0.1");
+      const store = readdirSync(storeDir).sort();
+      expect(store).not.toContain("no-deps@1.1.0");
+
+      const reinstall = await run(packageDir, "install");
+
+      expect(reinstall.stderr).not.toContain("error:");
+      expect(reinstall.stdout).toContain("(no changes)");
+      expect(reinstall.exitCode).toBe(0);
+      expect(readdirSync(storeDir).sort()).toEqual(store);
+      expect(realpathSync(join(packageDir, "node_modules", "peer-deps-fixed"))).toBe(peerDepsFixedDir);
+      expect(await bunLockOf(packageDir)).toBe(bunLock);
+    });
+
     test("a peer met in one importer and unmet in another is bound from the met variant", async () => {
       // pnpm sorts the unsuffixed (peer-unmet) variant first; the met variant must still bind the peer
       const { packageDir } = await verdaccio.createTestDir({

From c322e02f5b92717c45a41564f06e91d69cba3baf Mon Sep 17 00:00:00 2001
From: robobun <117481402+robobun@users.noreply.github.com>
Date: Mon, 17 Aug 2026 01:23:49 +0000
Subject: [PATCH 092/258] install: resolve a range onto an existing version
 only when every install has it (#38832)

---
 .../PackageManager/PackageManagerEnqueue.rs   |  21 +-
 .../PackageManager/install_with_manager.rs    |   1 +
 src/install/lockfile.rs                       | 246 +++++++++---------
 test/cli/install/bun-lock.test.ts             | 244 +++++++++++++++++
 4 files changed, 375 insertions(+), 137 deletions(-)

diff --git a/src/install/PackageManager/PackageManagerEnqueue.rs b/src/install/PackageManager/PackageManagerEnqueue.rs
index e962f4e8aef5..6572676d7760 100644
--- a/src/install/PackageManager/PackageManagerEnqueue.rs
+++ b/src/install/PackageManager/PackageManagerEnqueue.rs
@@ -2132,6 +2132,12 @@ fn get_or_put_resolved_package_with_find_result(
     // siblings exist at this point depends on response arrival order, so the
     // range match waits for the `install_peer` pass, when all of them exist.
     let suppress_peer_satisfies = behavior.is_peer() && !install_peer;
+    // Which peer rows have landed on a version by any given moment depends on
+    // what has arrived (they bind on sight or in the peer pass), so only
+    // regular rows' pins are recorded (`AppendedFor::pinned`).
+    let pins = !behavior.is_peer()
+        && version.tag == dependency::version::Tag::Npm
+        && version.npm().version.is_exact();
     if let Some(id) = this.lockfile.get_package_id(
         name_hash,
         if should_update || suppress_peer_satisfies {
@@ -2144,6 +2150,9 @@ fn get_or_put_resolved_package_with_find_result(
             url: find_result.package.tarball_url.value,
         })),
     ) {
+        if pins {
+            this.lockfile.mark_pinned_by_reuse(id);
+        }
         success_fn(this, dependency_id, id);
         return Ok(Some(ResolvedPackageResult {
             package: *this.lockfile.packages.get(id as usize),
@@ -2171,15 +2180,9 @@ fn get_or_put_resolved_package_with_find_result(
     )?)?;
 
     debug_assert!(package.meta.id != invalid_package_id);
-    // Record exact-version pins so `Lockfile::get_package_id`'s
-    // order-independence guard can tell them apart from range-resolved
-    // entries (which it treats as network-order artefacts).
-    if version.tag == dependency::version::Tag::Npm && version.npm().version.is_exact() {
-        // SAFETY: `this_ptr` is the sole live `&mut PackageManager` here;
-        // `lockfile.exact_pinned` is disjoint from `package` (returned
-        // by-value above).
-        unsafe { &mut *(*this_ptr).lockfile }.mark_exact_pin(package.meta.id);
-    }
+    // SAFETY: `this_ptr` is the sole live `&mut PackageManager` here; `package`
+    // was returned by value above.
+    unsafe { &mut *(*this_ptr).lockfile }.mark_appended_for(package.meta.id, dependency_id, pins);
     // Use scopeguard so success_fn runs on every
     // return below (including the `?` paths). The guard owns the raw pointer so the
     // `this` reborrow below doesn't conflict with the closure capture.
diff --git a/src/install/PackageManager/install_with_manager.rs b/src/install/PackageManager/install_with_manager.rs
index 5235a3b5e344..3288cc0f93a6 100644
--- a/src/install/PackageManager/install_with_manager.rs
+++ b/src/install/PackageManager/install_with_manager.rs
@@ -2059,6 +2059,7 @@ fn wait_for_resolution(manager: &mut PackageManager) -> crate::Result<()> {
     if manager.pending_task_count() > 0 {
         wait_for_everything_except_peers(manager)?;
     }
+    manager.lockfile.mark_settled_packages();
 
     // Resolving a peer dep can create a NEW package whose own peer deps
     // get re-queued to `peer_dependencies` during `drainDependencyList`.
diff --git a/src/install/lockfile.rs b/src/install/lockfile.rs
index ff296b75ea27..540f36f4e723 100644
--- a/src/install/lockfile.rs
+++ b/src/install/lockfile.rs
@@ -190,17 +190,9 @@ pub struct Lockfile {
 
     pub(crate) saved_config_version: Option<ConfigVersion>,
 
-    /// `packages.len()` at the moment lockfile load (including npm/pnpm/yarn
-    /// migration) finished. Packages with `id < this` were carried in from a
-    /// lockfile and represent a user-pinned resolution; packages with
-    /// `id >= this` were appended by manifest fetches in the current
-    /// resolve session. `get_package_id` uses this to keep its
-    /// order-independence guard from overriding lockfile pins. Set by
-    /// `mark_loaded_packages`; defaults to `invalid_package_id` (no lockfile
-    /// loaded → guard applies to nothing, equivalent to "all entries are
-    /// session-appended").
-    ///
-    /// Runtime-only — never serialised.
+    /// `packages.len()` once the lockfile (or a migrated one) was loaded:
+    /// packages below it came from the lockfile, the rest were appended in
+    /// this run (`mark_loaded_packages`). Runtime-only, never serialised.
     pub(crate) loaded_package_count: PackageID,
 
     /// `bit[id] == true` ⇔ a dependency other than an optional peer resolved
@@ -216,14 +208,26 @@ pub struct Lockfile {
     /// `mark_loaded_packages`; runtime-only — never serialised.
     pub(crate) held_at_load: DynamicBitSet,
 
-    /// `bit[id] == true` ⇔ package `id` was appended for a dependency whose
-    /// version range was an exact `=X.Y.Z` (i.e. the user — root or workspace
-    /// — pinned this exact version somewhere in the tree). `get_package_id`'s
-    /// order-independence guard never blocks deduping to one of these: an
-    /// exact pin is a deliberate choice, not an artifact of which manifest
-    /// happened to land first. Runtime-only — never serialised; sized lazily
-    /// in `mark_exact_pin`.
-    pub(crate) exact_pinned: DynamicBitSet,
+    /// Packages below this were loaded or appended before resolution last
+    /// drained (`mark_settled_packages`), so they exist on every install; see
+    /// `is_reusable`. Runtime-only, never serialised.
+    pub(crate) settled_package_count: PackageID,
+
+    /// Indexed by `PackageID`, filled by `mark_appended_for` for the packages
+    /// appended from a manifest in this run. Runtime-only, never serialised.
+    appended_for_by_id: Vec<AppendedFor>,
+}
+
+/// The rows a package appended in this run was resolved for; see
+/// `Lockfile::get_package_id`.
+#[derive(Clone, Copy, Debug, Default)]
+pub(crate) struct AppendedFor {
+    /// The row it was appended for is declared by the root or a workspace.
+    pub direct: bool,
+    /// A regular (non-peer) row's range, after overrides and catalogs, was
+    /// this exact version: the appending row's, or a later one's while the
+    /// package was not yet reusable (`mark_pinned_by_reuse`).
+    pub pinned: bool,
 }
 
 pub(crate) type PackageList = self::package::List<u64>;
@@ -2047,12 +2051,10 @@ impl Lockfile {
             meta_hash: ZERO_HASH,
             patched_dependencies: PatchedDependenciesMap::default(),
             saved_config_version: None,
-            // Fresh lockfile (no load): every package appended later is
-            // session-appended, so the order-independence guard in
-            // `get_package_id` applies from id 0.
             loaded_package_count: 0,
             held_at_load: DynamicBitSet::default(),
-            exact_pinned: DynamicBitSet::default(),
+            settled_package_count: 0,
+            appended_for_by_id: Vec::new(),
         }
     }
 
@@ -2065,6 +2067,7 @@ impl Lockfile {
     pub(crate) fn mark_loaded_packages(&mut self) -> Result<(), AllocError> {
         let packages_len = self.packages.len();
         self.loaded_package_count = packages_len as PackageID;
+        self.settled_package_count = self.loaded_package_count;
         let mut held = DynamicBitSet::init_empty(packages_len)?;
         // A load that failed partway leaves `resolutions` shorter than `dependencies`;
         // that lockfile is replaced by `init_empty` before anything reads the set.
@@ -2079,131 +2082,118 @@ impl Lockfile {
         Ok(())
     }
 
-    /// Record that package `id` was appended via an exact-version dependency
-    /// (`=X.Y.Z`). See the `exact_pinned` field doc.
+    /// Call only while nothing is being resolved (no row enqueued, no manifest
+    /// in flight); see `get_package_id`.
     #[inline]
-    pub(crate) fn mark_exact_pin(&mut self, id: PackageID) {
+    pub(crate) fn mark_settled_packages(&mut self) {
+        self.settled_package_count = self.packages.len() as PackageID;
+    }
+
+    pub(crate) fn mark_appended_for(
+        &mut self,
+        id: PackageID,
+        dependency_id: DependencyID,
+        pinned: bool,
+    ) {
+        let direct = self.is_workspace_dependency(dependency_id);
+        *self.appended_for_mut(id) = AppendedFor { direct, pinned };
+    }
+
+    /// A regular row whose range is exactly `id`'s version resolved to it.
+    /// Ignored once the package is reusable: from then on rows read
+    /// `pinned`, and which rows have resolved to it by any given moment
+    /// depends on registry timing.
+    pub(crate) fn mark_pinned_by_reuse(&mut self, id: PackageID) {
+        if !self.is_reusable(id) {
+            self.appended_for_mut(id).pinned = true;
+        }
+    }
+
+    fn appended_for_mut(&mut self, id: PackageID) -> &mut AppendedFor {
         let i = id as usize;
-        if self.exact_pinned.bit_length() <= i {
-            bun_core::handle_oom(self.exact_pinned.resize(i + 1, false));
+        if self.appended_for_by_id.len() <= i {
+            self.appended_for_by_id
+                .resize(i + 1, AppendedFor::default());
         }
-        self.exact_pinned.set(i);
+        &mut self.appended_for_by_id[i]
+    }
+
+    fn appended_for(&self, id: PackageID) -> AppendedFor {
+        self.appended_for_by_id
+            .get(id as usize)
+            .copied()
+            .unwrap_or_default()
     }
 
+    /// Whether package `id` exists on every install of this package.json, so a
+    /// range it merely satisfies may resolve to it: it was loaded or settled,
+    /// or appended for a direct row. Direct rows are enqueued before any
+    /// manifest is processed and a manifest's waiting rows resolve FIFO, so
+    /// for one name they resolve before every transitive row; which packages
+    /// transitive rows have appended so far depends on registry timing.
+    fn is_reusable(&self, id: PackageID) -> bool {
+        id < self.settled_package_count || self.appended_for(id).direct
+    }
+
+    /// The package `resolution` is already stored as, if any.
+    ///
+    /// For an npm range `version`, `resolution` is its best match from the
+    /// manifest, and the highest reusable version the range accepts is
+    /// preferred over it (`is_reusable`; a lockfile version always, an
+    /// appended one when a row pinned it or it is of the best match's major).
+    /// Anything else only answers for a range whose best match it is.
     pub(crate) fn get_package_id(
         &self,
         name_hash: u64,
-        // If non-null, attempt to use an existing package
-        // that satisfies this version range.
         version: Option<&DependencyVersion>,
         resolution: &Resolution,
     ) -> Option<PackageID> {
-        let entry = self.package_index.get(&name_hash)?;
-        let resolutions: &[Resolution] = self.packages.items_resolution();
-        // Borrow the `npm` arm's `Semver::Group` (not `Copy` — owns a linked
-        // list head). `version` is held by-value for the whole fn body so the
-        // borrow is sound.
-        let npm_version = match version {
-            Some(v) if v.tag == dependency::Tag::Npm => Some(&v.npm().version),
-            _ => None,
-        };
-        // Order-independence guard for the `satisfies` fallback below: when the
-        // caller already knows the manifest's best-match version (the npm
-        // `resolution` it passes), only dedupe to an existing entry whose
-        // version is at least that. Without this, the result depends on which
-        // sibling's manifest happened to land first — `*` deduping to a
-        // previously-appended `1.0.2` instead of resolving to `2.0.2` is the
-        // long-standing "text lockfile is hoisted" flake. Lockfile-pinned deps
-        // are kept out of this codepath by `Diff::generate`'s
-        // satisfies-preserves-mapping rule (which keeps the resolution slot
-        // populated so the early return in `get_or_put_resolved_package` fires
-        // before we get here).
-        let resolved_npm_floor = if resolution.tag == ResolutionTag::Npm {
-            Some(resolution.npm().version)
-        } else {
-            None
+        // Highest version first (`get_or_put_id`).
+        let ids: &[PackageID] = match self.package_index.get(&name_hash)? {
+            PackageIndexEntry::Id(id) => core::slice::from_ref(id),
+            PackageIndexEntry::Ids(ids) => ids.as_slice(),
         };
+        let resolutions: &[Resolution] = self.packages.items_resolution();
+        debug_assert!(ids.iter().all(|&id| (id as usize) < resolutions.len()));
         let buf = self.buffers.string_bytes.as_slice();
 
-        let loaded_watermark = self.loaded_package_count;
-        let exact_pinned = &self.exact_pinned;
-        let try_satisfies_dedupe = |id: PackageID| -> bool {
-            let existing = &resolutions[id as usize];
-            if existing.tag != ResolutionTag::Npm {
-                return false;
-            }
-            let Some(npm_v) = npm_version else {
-                return false;
-            };
-            let existing_ver = existing.npm().version;
-            if !npm_v.satisfies(existing_ver, buf, buf) {
-                return false;
-            }
-            // Order-independence guard. We refuse to dedupe a wide range to a
-            // *lower* existing entry only when ALL of the following hold:
-            //   - the entry was appended in this resolve session
-            //     (lockfile-loaded entries are the user's existing pin),
-            //   - the entry was NOT appended for an exact-`=X.Y.Z` dependency
-            //     (an exact pin anywhere in the tree is a deliberate choice,
-            //     not a network-order artefact — `dragon test 2` /
-            //     "dependency from root satisfies range from dependency"),
-            //   - no dependency declared by the root or a workspace resolves
-            //     to the entry. Those rows are enqueued before any package's
-            //     dependency list is drained, so whatever they resolved to is
-            //     already in place by the time a transitive row on the same
-            //     name gets here, whichever order the manifests landed in.
-            //     This is what keeps a project's `@types/node: ~20` as the
-            //     single copy every `@types/*` package's `@types/node: *`
-            //     collapses onto, instead of each nesting the latest major.
-            //   - the manifest's best-match is a *different major* (within a
-            //     major, deduping to an older patch is the long-standing
-            //     behaviour and the worst case is still ^-compatible).
-            // What this leaves is exactly the cross-parent network-order
-            // flake: a wide range (`*`, `>=X`) collapsing onto a sibling's
-            // *range-resolved* lower major depending on whose manifest landed
-            // first ("text lockfile is hoisted").
-            if id >= loaded_watermark && !exact_pinned.is_set_allow_out_of_bound(id as usize, false)
-            {
-                if let Some(floor) = resolved_npm_floor {
-                    if existing_ver.order(floor, buf, buf) == Ordering::Less
-                        && existing_ver.major != floor.major
-                        && !self.is_direct_dependency_resolution(id)
-                    {
-                        return false;
-                    }
-                }
-            }
-            true
-        };
-
-        match entry {
-            PackageIndexEntry::Id(id) => {
-                debug_assert!((*id as usize) < resolutions.len());
-
-                if resolutions[*id as usize].eql(resolution, buf, buf) {
-                    return Some(*id);
+        if let Some(range) = version
+            .filter(|v| v.tag == dependency::Tag::Npm)
+            .map(|v| &v.npm().version)
+        {
+            let best_match =
+                (resolution.tag == ResolutionTag::Npm).then(|| resolution.npm().version);
+            let reusable = ids.iter().copied().find(|&id| {
+                let existing = &resolutions[id as usize];
+                if existing.tag != ResolutionTag::Npm {
+                    return false;
                 }
-
-                if try_satisfies_dedupe(*id) {
-                    return Some(*id);
+                let existing_version = existing.npm().version;
+                if !range.satisfies(existing_version, buf, buf) {
+                    return false;
                 }
-            }
-            PackageIndexEntry::Ids(ids) => {
-                for &id in ids.iter() {
-                    debug_assert!((id as usize) < resolutions.len());
-
-                    if resolutions[id as usize].eql(resolution, buf, buf) {
-                        return Some(id);
-                    }
-
-                    if try_satisfies_dedupe(id) {
-                        return Some(id);
-                    }
+                if id < self.loaded_package_count {
+                    return true;
                 }
+                // A copy a root or workspace row resolves to is in place before
+                // any transitive row on the name gets here (those rows are
+                // enqueued first), so every `@types/*` package's `@types/node: *`
+                // lands on the project's `@types/node: ~20` instead of nesting
+                // the latest major.
+                self.is_reusable(id)
+                    && (self.appended_for(id).pinned
+                        || self.is_direct_dependency_resolution(id)
+                        || best_match
+                            .is_none_or(|best_match| existing_version.major == best_match.major))
+            });
+            if reusable.is_some() {
+                return reusable;
             }
         }
 
-        None
+        ids.iter()
+            .copied()
+            .find(|&id| resolutions[id as usize].eql(resolution, buf, buf))
     }
 
     /// Appends `pkg` to `this.packages`, and adds to `this.package_index`.
diff --git a/test/cli/install/bun-lock.test.ts b/test/cli/install/bun-lock.test.ts
index 72dca187142a..f330c1210d32 100644
--- a/test/cli/install/bun-lock.test.ts
+++ b/test/cli/install/bun-lock.test.ts
@@ -2333,3 +2333,247 @@ describe("loading bun.lock binds the edges of a package printed at several paths
     await run(["install", "--frozen-lockfile", "--dry-run"]);
   });
 });
+
+// A fresh install resolves transitive rows as their parents' manifests come back
+// from the registry, so whether some other version of a package exists yet when
+// a row is resolved depends on network timing. Each shape below is installed
+// under arrival orders forced by holding one manifest back until a request that
+// can only be made once the other parent's row is resolved (the tarball of the
+// version it resolved to) has come in; every order has to write the same
+// bun.lock. `z`, the package the rows disagree on, has 1.0.0, 1.0.5, 1.1.0 and 2.0.0.
+type OrderedManifests = Record<string, Record<string, Record<string, Record<string, string>>>>;
+type Hold = { manifest: string; until: string };
+const zVersions = { "1.0.0": {}, "1.0.5": {}, "1.1.0": {}, "2.0.0": {} };
+
+async function registryWithHolds(manifests: OrderedManifests) {
+  const tarballs = new Map<string, Uint8Array>();
+  for (const [name, versions] of Object.entries(manifests)) {
+    for (const [version, extra] of Object.entries(versions)) {
+      const archive = new Bun.Archive(
+        { "package/package.json": JSON.stringify({ name, version, ...extra }) },
+        { compress: "gzip" },
+      );
+      tarballs.set(`/${name}-${version}.tgz`, await archive.bytes());
+    }
+  }
+  let gates = new Map<string, PromiseWithResolvers<void>>();
+  let heldUntil = new Map<string, string>();
+  const server = Bun.serve({
+    port: 0,
+    async fetch(request) {
+      const { origin, pathname } = new URL(request.url);
+      gates.get(pathname)?.resolve();
+      const tarball = tarballs.get(pathname);
+      if (tarball) return new Response(tarball);
+      const name = pathname.slice(1);
+      const entry = manifests[name];
+      if (!entry) return new Response("not found", { status: 404 });
+      const until = heldUntil.get(name);
+      if (until) await gates.get(until)!.promise;
+      const versions: Record<string, unknown> = {};
+      for (const [version, extra] of Object.entries(entry)) {
+        versions[version] = { name, version, dist: { tarball: `${origin}/${name}-${version}.tgz` }, ...extra };
+      }
+      const latest = Object.keys(entry).sort(Bun.semver.order).at(-1);
+      return Response.json({ name, versions, "dist-tags": { latest } });
+    },
+  });
+  return {
+    server,
+    hold(holds: Hold[]) {
+      gates = new Map(holds.map(({ until }) => [until, Promise.withResolvers<void>()]));
+      heldUntil = new Map(holds.map(({ manifest, until }) => [manifest, until]));
+    },
+  };
+}
+
+async function freshInstallLock(server: Bun.Server, files: Record<string, object>) {
+  using dir = tempDir("lock-arrival-order", {
+    ...Object.fromEntries(Object.entries(files).map(([path, json]) => [path, JSON.stringify(json)])),
+    "bunfig.toml": `[install]\nregistry = "${server.url.href}"\nlinker = "hoisted"\nsaveTextLockfile = true\n`,
+  });
+  await using proc = spawn({
+    cmd: [bunExe(), "install"],
+    cwd: String(dir),
+    env: { ...env, BUN_INSTALL_CACHE_DIR: join(String(dir), ".bun-cache") },
+    stdout: "pipe",
+    stderr: "pipe",
+  });
+  const [out, err, code] = await Promise.all([proc.stdout.text(), proc.stderr.text(), proc.exited]);
+  expect({ out, err, code }).toMatchObject({ err: expect.stringContaining("Saved lockfile"), code: 0 });
+  return await file(join(String(dir), "bun.lock")).text();
+}
+
+// `{ "z": "z@1.0.0", "b/z": "z@1.1.0" }`: every instance of `name`, keyed by where it is placed.
+function instancesOf(lock: string, name: string): Record<string, string> {
+  const { packages } = Bun.JSONC.parse(lock) as { packages: Record<string, [string, ...unknown[]]> };
+  return Object.fromEntries(
+    Object.entries(packages)
+      .filter(([key]) => key === name || key.endsWith(`/${name}`))
+      .map(([key, [resolution]]) => [key, resolution]),
+  );
+}
+
+it.each<{
+  shape: string;
+  manifests: OrderedManifests;
+  files: Record<string, object>;
+  orders: Record<string, Hold[]>;
+  z: Record<string, string>;
+}>([
+  {
+    shape: "a -> z@1.0.0 next to b -> z@^1.0.0",
+    manifests: {
+      a: { "1.0.0": { dependencies: { z: "1.0.0" } } },
+      b: { "1.0.0": { dependencies: { z: "^1.0.0" } } },
+      z: zVersions,
+    },
+    files: { "package.json": { name: "foo", dependencies: { a: "1.0.0", b: "1.0.0" } } },
+    orders: {
+      "a's manifest last": [{ manifest: "a", until: "/z-1.1.0.tgz" }],
+      "b's manifest last": [{ manifest: "b", until: "/z-1.0.0.tgz" }],
+    },
+    z: { "z": "z@1.0.0", "b/z": "z@1.1.0" },
+  },
+  {
+    shape: "a -> z@~1.0.0 next to b -> z@^1.0.0",
+    manifests: {
+      a: { "1.0.0": { dependencies: { z: "~1.0.0" } } },
+      b: { "1.0.0": { dependencies: { z: "^1.0.0" } } },
+      z: zVersions,
+    },
+    files: { "package.json": { name: "foo", dependencies: { a: "1.0.0", b: "1.0.0" } } },
+    orders: {
+      "a's manifest last": [{ manifest: "a", until: "/z-1.1.0.tgz" }],
+      "b's manifest last": [{ manifest: "b", until: "/z-1.0.5.tgz" }],
+    },
+    z: { "z": "z@1.0.5", "b/z": "z@1.1.0" },
+  },
+  {
+    // b's range accepts the root's pin; c puts b's own best match in place, which must not change what b gets.
+    shape: "root z@1.0.0, b -> z@^1.0.0, c -> z@~1.1.0",
+    manifests: {
+      b: { "1.0.0": { dependencies: { z: "^1.0.0" } } },
+      c: { "1.0.0": { dependencies: { z: "~1.1.0" } } },
+      z: zVersions,
+    },
+    files: { "package.json": { name: "foo", dependencies: { b: "1.0.0", c: "1.0.0", z: "1.0.0" } } },
+    orders: {
+      "b's manifest last": [{ manifest: "b", until: "/z-1.1.0.tgz" }],
+      // b's row is resolved (against the root's z alone) before b's tarball is requested.
+      "c's manifest last": [
+        { manifest: "b", until: "/z" },
+        { manifest: "c", until: "/b-1.0.0.tgz" },
+      ],
+    },
+    z: { "z": "z@1.0.0", "c/z": "z@1.1.0" },
+  },
+  {
+    // a and b resolve to the same z, so either of them may be the one that appends it; a's pin has to count
+    // either way when p (installed as a's peer after every regular row) brings a range from another major.
+    shape: "a -> z@1.1.0 and b -> z@^1.0.0 share a z that absorbs peer p -> z@*",
+    manifests: {
+      a: { "1.0.0": { dependencies: { z: "1.1.0" }, peerDependencies: { p: "1.0.0" } } },
+      b: { "1.0.0": { dependencies: { z: "^1.0.0" } } },
+      p: { "1.0.0": { dependencies: { z: "*" } } },
+      z: zVersions,
+    },
+    files: { "package.json": { name: "foo", dependencies: { a: "1.0.0", b: "1.0.0" } } },
+    orders: {
+      "a's manifest last": [{ manifest: "a", until: "/z-1.1.0.tgz" }],
+      "b's manifest last": [{ manifest: "b", until: "/z-1.1.0.tgz" }],
+    },
+    z: { "z": "z@1.1.0" },
+  },
+  {
+    shape: "root z@1.0.0 absorbs b -> z@^1.0.0",
+    manifests: { b: { "1.0.0": { dependencies: { z: "^1.0.0" } } }, z: zVersions },
+    files: { "package.json": { name: "foo", dependencies: { b: "1.0.0", z: "1.0.0" } } },
+    orders: {
+      "b's manifest last": [{ manifest: "b", until: "/z-1.0.0.tgz" }],
+      "z's manifest last": [{ manifest: "z", until: "/b-1.0.0.tgz" }],
+    },
+    z: { "z": "z@1.0.0" },
+  },
+  {
+    shape: "workspace z@1.0.0 absorbs b -> z@^1.0.0",
+    manifests: { b: { "1.0.0": { dependencies: { z: "^1.0.0" } } }, z: zVersions },
+    files: {
+      "package.json": { name: "foo", workspaces: ["pkg"], dependencies: { b: "1.0.0" } },
+      "pkg/package.json": { name: "pkg", dependencies: { z: "1.0.0" } },
+    },
+    orders: {
+      "b's manifest last": [{ manifest: "b", until: "/z-1.0.0.tgz" }],
+      "z's manifest last": [{ manifest: "z", until: "/b-1.0.0.tgz" }],
+    },
+    z: { "z": "z@1.0.0" },
+  },
+  {
+    shape: "root z@~1.0.0 absorbs b -> z@^1.0.0",
+    manifests: { b: { "1.0.0": { dependencies: { z: "^1.0.0" } } }, z: zVersions },
+    files: { "package.json": { name: "foo", dependencies: { b: "1.0.0", z: "~1.0.0" } } },
+    orders: {
+      "b's manifest last": [{ manifest: "b", until: "/z-1.0.5.tgz" }],
+      "z's manifest last": [{ manifest: "z", until: "/b-1.0.0.tgz" }],
+    },
+    z: { "z": "z@1.0.5" },
+  },
+  {
+    // The root's z is in place for every later row, so a's pin on it must not change what c gets,
+    // whether a's row is resolved before c's or after.
+    shape: "a -> z@1.0.5 pinning the root's z@~1.0.0 does not make it absorb c -> z@*",
+    manifests: {
+      a: { "1.0.0": { dependencies: { z: "1.0.5" } } },
+      c: { "1.0.0": { dependencies: { z: "*" } } },
+      z: zVersions,
+    },
+    files: { "package.json": { name: "foo", dependencies: { a: "1.0.0", c: "1.0.0", z: "~1.0.0" } } },
+    orders: {
+      "a's manifest last": [{ manifest: "a", until: "/z-2.0.0.tgz" }],
+      "c's manifest last": [
+        { manifest: "a", until: "/z" },
+        { manifest: "c", until: "/a-1.0.0.tgz" },
+      ],
+    },
+    z: { "z": "z@1.0.5", "c/z": "z@2.0.0" },
+  },
+  {
+    shape: "root z@^1.0.0 does not absorb c -> z@* from another major",
+    manifests: { c: { "1.0.0": { dependencies: { z: "*" } } }, z: zVersions },
+    files: { "package.json": { name: "foo", dependencies: { c: "1.0.0", z: "^1.0.0" } } },
+    orders: {
+      "c's manifest last": [{ manifest: "c", until: "/z-1.1.0.tgz" }],
+      "z's manifest last": [{ manifest: "z", until: "/c-1.0.0.tgz" }],
+    },
+    z: { "z": "z@1.1.0", "c/z": "z@2.0.0" },
+  },
+  {
+    // p is installed as a's peer once every regular row is resolved; by then a's z is in place on every install.
+    shape: "a -> z@1.0.0 absorbs peer p -> z@^1.0.0",
+    manifests: {
+      a: { "1.0.0": { dependencies: { z: "1.0.0" }, peerDependencies: { p: "1.0.0" } } },
+      p: { "1.0.0": { dependencies: { z: "^1.0.0" } } },
+      z: zVersions,
+    },
+    files: { "package.json": { name: "foo", dependencies: { a: "1.0.0" } } },
+    orders: {
+      "z's manifest last": [{ manifest: "z", until: "/a-1.0.0.tgz" }],
+      "p's manifest last": [{ manifest: "p", until: "/z-1.0.0.tgz" }],
+    },
+    z: { "z": "z@1.0.0" },
+  },
+])(
+  "a fresh install writes the same bun.lock whichever manifest arrives last: $shape",
+  async ({ manifests, files, orders, z }) => {
+    const ordered = await registryWithHolds(manifests);
+    using server = ordered.server;
+    let expected: string | undefined;
+    for (const [order, holds] of Object.entries(orders)) {
+      ordered.hold(holds);
+      const lock = await freshInstallLock(server, files);
+      expected ??= lock;
+      expect({ order, lock }).toEqual({ order, lock: expected });
+    }
+    expect(instancesOf(expected!, "z")).toEqual(z);
+  },
+);

From a28a204fed95ea9baa7e27d1997505535dc308d4 Mon Sep 17 00:00:00 2001
From: robobun <117481402+robobun@users.noreply.github.com>
Date: Mon, 17 Aug 2026 01:24:25 +0000
Subject: [PATCH 093/258] install: keep a bundle's dependency out of a slot the
 bundling package resolves through (#38848)

---
 src/install/lockfile/Tree.rs                  |  98 ++++++++++
 test/cli/install/bun-lock.test.ts             | 172 ++++++++++++++++++
 .../bundled-shadow-consumer-1.0.0.tgz         | Bin 0 -> 201 bytes
 .../bundled-shadow-consumer-2.0.0.tgz         | Bin 0 -> 171 bytes
 .../bundled-shadow-consumer/package.json      |  32 ++++
 .../bundled-shadow-deep-host-1.0.0.tgz        | Bin 0 -> 356 bytes
 .../bundled-shadow-deep-host/package.json     |  26 +++
 .../bundled-shadow-host-1.0.0.tgz             | Bin 0 -> 309 bytes
 .../packages/bundled-shadow-host/package.json |  26 +++
 .../bundled-shadow-inner-1.0.0.tgz            | Bin 0 -> 203 bytes
 .../bundled-shadow-inner/package.json         |  22 +++
 .../bundled-shadow-mid-1.0.0.tgz              | Bin 0 -> 199 bytes
 .../bundled-shadow-mid-2.0.0.tgz              | Bin 0 -> 167 bytes
 .../packages/bundled-shadow-mid/package.json  |  32 ++++
 .../bundled-shadow-peer-host-1.0.0.tgz        | Bin 0 -> 397 bytes
 .../bundled-shadow-peer-host/package.json     |  26 +++
 .../bundled-shadow-peer-inner-1.0.0.tgz       | Bin 0 -> 249 bytes
 .../bundled-shadow-peer-inner/package.json    |  30 +++
 .../bundled-shadow-peer-leaf-1.0.0.tgz        | Bin 0 -> 207 bytes
 .../bundled-shadow-peer-leaf/package.json     |  22 +++
 .../bundled-shadow-shared-1.0.0.tgz           | Bin 0 -> 170 bytes
 .../bundled-shadow-shared-2.0.0.tgz           | Bin 0 -> 170 bytes
 .../bundled-shadow-shared/package.json        |  29 +++
 .../bundled-shadow-wrapper-1.0.0.tgz          | Bin 0 -> 202 bytes
 .../bundled-shadow-wrapper/package.json       |  22 +++
 .../create-bundled-shadow-packages.ts         | 153 ++++++++++++++++
 26 files changed, 690 insertions(+)
 create mode 100644 test/cli/install/registry/packages/bundled-shadow-consumer/bundled-shadow-consumer-1.0.0.tgz
 create mode 100644 test/cli/install/registry/packages/bundled-shadow-consumer/bundled-shadow-consumer-2.0.0.tgz
 create mode 100644 test/cli/install/registry/packages/bundled-shadow-consumer/package.json
 create mode 100644 test/cli/install/registry/packages/bundled-shadow-deep-host/bundled-shadow-deep-host-1.0.0.tgz
 create mode 100644 test/cli/install/registry/packages/bundled-shadow-deep-host/package.json
 create mode 100644 test/cli/install/registry/packages/bundled-shadow-host/bundled-shadow-host-1.0.0.tgz
 create mode 100644 test/cli/install/registry/packages/bundled-shadow-host/package.json
 create mode 100644 test/cli/install/registry/packages/bundled-shadow-inner/bundled-shadow-inner-1.0.0.tgz
 create mode 100644 test/cli/install/registry/packages/bundled-shadow-inner/package.json
 create mode 100644 test/cli/install/registry/packages/bundled-shadow-mid/bundled-shadow-mid-1.0.0.tgz
 create mode 100644 test/cli/install/registry/packages/bundled-shadow-mid/bundled-shadow-mid-2.0.0.tgz
 create mode 100644 test/cli/install/registry/packages/bundled-shadow-mid/package.json
 create mode 100644 test/cli/install/registry/packages/bundled-shadow-peer-host/bundled-shadow-peer-host-1.0.0.tgz
 create mode 100644 test/cli/install/registry/packages/bundled-shadow-peer-host/package.json
 create mode 100644 test/cli/install/registry/packages/bundled-shadow-peer-inner/bundled-shadow-peer-inner-1.0.0.tgz
 create mode 100644 test/cli/install/registry/packages/bundled-shadow-peer-inner/package.json
 create mode 100644 test/cli/install/registry/packages/bundled-shadow-peer-leaf/bundled-shadow-peer-leaf-1.0.0.tgz
 create mode 100644 test/cli/install/registry/packages/bundled-shadow-peer-leaf/package.json
 create mode 100644 test/cli/install/registry/packages/bundled-shadow-shared/bundled-shadow-shared-1.0.0.tgz
 create mode 100644 test/cli/install/registry/packages/bundled-shadow-shared/bundled-shadow-shared-2.0.0.tgz
 create mode 100644 test/cli/install/registry/packages/bundled-shadow-shared/package.json
 create mode 100644 test/cli/install/registry/packages/bundled-shadow-wrapper/bundled-shadow-wrapper-1.0.0.tgz
 create mode 100644 test/cli/install/registry/packages/bundled-shadow-wrapper/package.json
 create mode 100644 test/cli/install/registry/packages/create-bundled-shadow-packages.ts

diff --git a/src/install/lockfile/Tree.rs b/src/install/lockfile/Tree.rs
index 84307e85cd52..2884c42989bf 100644
--- a/src/install/lockfile/Tree.rs
+++ b/src/install/lockfile/Tree.rs
@@ -1079,12 +1079,110 @@ impl Tree {
             }
         }
 
+        // a bundle's dependency stops here, but must not shadow what resolves through here
+        if !AS_DEFINED
+            && this.id == hoist_root_id
+            && Tree::hoist_root_resolves_elsewhere(
+                this.id,
+                package_id,
+                dependency.name_hash,
+                builder,
+            )
+        {
+            return Ok(HoistDependencyResult::DependencyLoop); // 3
+        }
+
         // place the dependency in the current tree
         HoistDependencyResult::Placement(Placement {
             id: this.id,
             bundled: false,
         }) // 2
     }
+
+    /// Whether a `name_hash` edge that a loaded `bun.lock` would rebind to `hoist_root` resolves elsewhere.
+    fn hoist_root_resolves_elsewhere<const METHOD: BuilderMethod>(
+        hoist_root: Id,
+        package_id: PackageID,
+        name_hash: PackageNameHash,
+        builder: &Builder<'_, METHOD>,
+    ) -> bool {
+        // an unbound optional peer saves no entry; once bound, `Lockfile::resolve` hoists again
+        if package_id == invalid_package_id {
+            return false;
+        }
+
+        let trees = builder.list.items_tree();
+        if trees[hoist_root as usize].parent == INVALID_ID {
+            return false;
+        }
+
+        let entry_lists = builder.list.items_dependencies();
+        let deps: &[Dependency] = builder.dependencies;
+        let resolutions: &[PackageID] = &*builder.resolutions;
+        let resolution_lists = builder.resolution_lists;
+
+        let resolves_elsewhere = |pkg_id: PackageID| -> bool {
+            let pkg_deps = resolution_lists[pkg_id as usize];
+            (pkg_deps.begin()..pkg_deps.end()).any(|dep_id| {
+                let dep = &deps[dep_id as usize];
+                dep.name_hash == name_hash
+                    && !dep.behavior.is_bundled()
+                    && resolutions[dep_id as usize] != package_id
+            })
+        };
+
+        // `tree_owner`'s regular dependencies placed in its own node_modules, `tree_id`
+        let nested_in = move |tree_id: Id, tree_owner: PackageID| {
+            let own_deps = resolution_lists[tree_owner as usize];
+            trees[tree_id as usize]
+                .dependencies
+                .get(entry_lists[tree_id as usize].as_slice())
+                .iter()
+                .filter(move |&&dep_id| {
+                    own_deps.contains(dep_id) && !deps[dep_id as usize].behavior.is_bundled()
+                })
+                .map(move |&dep_id| resolutions[dep_id as usize])
+                .filter(|&pkg_id| pkg_id != invalid_package_id)
+        };
+
+        let owner = resolutions[trees[hoist_root as usize].dependency_id as usize];
+        if resolves_elsewhere(owner) {
+            return true;
+        }
+
+        let mut any_nested = false;
+        for pkg_id in nested_in(hoist_root, owner) {
+            if resolves_elsewhere(pkg_id) {
+                return true;
+            }
+            any_nested = true;
+        }
+        if !any_nested {
+            return false;
+        }
+
+        // The nested packages' own trees hold more of them. A tree comes after its parent.
+        let mut scope: Vec<(Id, PackageID)> = vec![(hoist_root, owner)];
+        for (id, tree) in trees.iter().enumerate().skip(hoist_root as usize + 1) {
+            let Some(&(_, parent_owner)) =
+                scope.iter().find(|(scope_id, _)| *scope_id == tree.parent)
+            else {
+                continue;
+            };
+            if !resolution_lists[parent_owner as usize].contains(tree.dependency_id)
+                || deps[tree.dependency_id as usize].behavior.is_bundled()
+            {
+                continue;
+            }
+            let tree_owner = resolutions[tree.dependency_id as usize];
+            if nested_in(id as Id, tree_owner).any(&resolves_elsewhere) {
+                return true;
+            }
+            scope.push((id as Id, tree_owner));
+        }
+
+        false
+    }
 }
 
 // ──────────────────────────────────────────────────────────────────────────
diff --git a/test/cli/install/bun-lock.test.ts b/test/cli/install/bun-lock.test.ts
index f330c1210d32..5ab520553488 100644
--- a/test/cli/install/bun-lock.test.ts
+++ b/test/cli/install/bun-lock.test.ts
@@ -2577,3 +2577,175 @@ it.each<{
     expect(instancesOf(expected!, "z")).toEqual(z);
   },
 );
+
+// The bundled-shadow-* fixtures are described in
+// registry/packages/create-bundled-shadow-packages.ts. In short: host depends
+// on shared@1.0.0, which is hoisted to the root, and bundles inner, which
+// depends on shared@2.0.0. A bundle's dependencies hoist no further than the
+// bundling package's node_modules, but `host/shared` in bun.lock is also what
+// host's own `shared` edge resolves to when the lockfile is loaded again, and
+// likewise for anything nested under host that resolves shared from the root.
+// https://github.com/oven-sh/bun/issues/29263
+it("a bundled dependency's dependency does not take a slot the bundling package resolves through", async () => {
+  const { packageDir, packageJson } = await registry.createTestDir({
+    bunfigOpts: { saveTextLockfile: true, linker: "hoisted" },
+  });
+  const run = makeInstallRunner(packageDir);
+  const hostNodeModules = join(packageDir, "node_modules", "bundled-shadow-host", "node_modules");
+
+  await write(
+    packageJson,
+    JSON.stringify({
+      name: "foo",
+      dependencies: { "bundled-shadow-host": "1.0.0", "bundled-shadow-shared": "1.0.0" },
+    }),
+  );
+  await run(["install"]);
+  const fresh = await file(join(packageDir, "bun.lock")).text();
+  expect(fresh).toContain('"bundled-shadow-shared": ["bundled-shadow-shared@1.0.0"');
+  expect(fresh).toContain(
+    '"bundled-shadow-host/bundled-shadow-inner/bundled-shadow-shared": ["bundled-shadow-shared@2.0.0"',
+  );
+  expect(fresh).not.toContain('"bundled-shadow-host/bundled-shadow-shared"');
+
+  // inner's shared@2.0.0 ships inside host's tarball; host itself uses the root copy.
+  const layout = async () => ({
+    root: (await file(join(packageDir, "node_modules", "bundled-shadow-shared", "package.json")).json()).version,
+    host: await readdirSorted(hostNodeModules),
+    inner: (
+      await file(
+        join(hostNodeModules, "bundled-shadow-inner", "node_modules", "bundled-shadow-shared", "package.json"),
+      ).json()
+    ).version,
+  });
+  const expectedLayout = { root: "1.0.0", host: ["bundled-shadow-inner"], inner: "2.0.0" };
+  expect(await layout()).toEqual(expectedLayout);
+
+  // Every install that starts from the lockfile has to give host the same
+  // shared as the install that wrote it.
+  await run(["install"]);
+  expect(await layout()).toEqual(expectedLayout);
+
+  await rm(join(packageDir, "node_modules"), { recursive: true, force: true });
+  await run(["install", "--frozen-lockfile"]);
+  expect(await layout()).toEqual(expectedLayout);
+
+  await run(["install", "--lockfile-only"]);
+  expect(await file(join(packageDir, "bun.lock")).text()).toBe(fresh);
+});
+
+it("the isolated linker links the bundling package against the same dependency on a reinstall", async () => {
+  const { packageDir, packageJson } = await registry.createTestDir({
+    bunfigOpts: { saveTextLockfile: true, linker: "isolated" },
+  });
+  const run = makeInstallRunner(packageDir);
+  const hostStoreEntry = join(packageDir, "node_modules", ".bun", "bundled-shadow-host@1.0.0", "node_modules");
+  const sharedVersion = async (...dir: string[]) =>
+    (await file(join(...dir, "bundled-shadow-shared", "package.json")).json()).version;
+  // `host` is what gets linked next to host in its store entry; `inner` is the
+  // copy that came out of host's tarball.
+  const layout = async () => ({
+    host: await sharedVersion(hostStoreEntry),
+    inner: await sharedVersion(
+      hostStoreEntry,
+      "bundled-shadow-host",
+      "node_modules",
+      "bundled-shadow-inner",
+      "node_modules",
+    ),
+  });
+
+  await write(
+    packageJson,
+    JSON.stringify({
+      name: "foo",
+      dependencies: { "bundled-shadow-host": "1.0.0", "bundled-shadow-shared": "1.0.0" },
+    }),
+  );
+  await run(["install"]);
+  expect(await layout()).toEqual({ host: "1.0.0", inner: "2.0.0" });
+
+  // The store is rebuilt from the resolutions bun.lock loads, which come from
+  // the saved paths.
+  await rm(join(packageDir, "node_modules"), { recursive: true, force: true });
+  await run(["install", "--frozen-lockfile"]);
+  expect(await layout()).toEqual({ host: "1.0.0", inner: "2.0.0" });
+});
+
+it("a bundled dependency's dependency does not take a slot a dependency nested under the bundling package resolves through", async () => {
+  const { packageDir, packageJson } = await registry.createTestDir({
+    bunfigOpts: { saveTextLockfile: true, linker: "hoisted" },
+  });
+  const run = makeInstallRunner(packageDir);
+
+  // deep-host itself does not depend on shared. consumer@1.0.0 nests under it
+  // (consumer@2.0.0 holds the root), mid@1.0.0 nests under consumer (mid@2.0.0
+  // holds the root), and mid's shared@1.0.0 is hoisted to the root, up through
+  // deep-host's node_modules. deep-host bundles wrapper, whose inner depends on
+  // shared@2.0.0, and that is hoisted after mid's shared is already at the root.
+  await write(
+    packageJson,
+    JSON.stringify({
+      name: "foo",
+      dependencies: {
+        "bundled-shadow-deep-host": "1.0.0",
+        "bundled-shadow-consumer": "2.0.0",
+        "bundled-shadow-mid": "2.0.0",
+      },
+    }),
+  );
+  await run(["install"]);
+  const fresh = await file(join(packageDir, "bun.lock")).text();
+  expect(fresh).toContain('"bundled-shadow-shared": ["bundled-shadow-shared@1.0.0"');
+  expect(fresh).toContain(
+    '"bundled-shadow-deep-host/bundled-shadow-consumer/bundled-shadow-mid": ["bundled-shadow-mid@1.0.0"',
+  );
+  expect(fresh).toContain(
+    '"bundled-shadow-deep-host/bundled-shadow-inner/bundled-shadow-shared": ["bundled-shadow-shared@2.0.0"',
+  );
+  expect(fresh).not.toContain('"bundled-shadow-deep-host/bundled-shadow-shared"');
+
+  // mid@1.0.0 has to keep finding shared@1.0.0 at the root on a reinstall.
+  await rm(join(packageDir, "node_modules"), { recursive: true, force: true });
+  await run(["install", "--frozen-lockfile"]);
+  expect({
+    root: (await file(join(packageDir, "node_modules", "bundled-shadow-shared", "package.json")).json()).version,
+    deepHost: await readdirSorted(join(packageDir, "node_modules", "bundled-shadow-deep-host", "node_modules")),
+  }).toEqual({ root: "1.0.0", deepHost: ["bundled-shadow-consumer", "bundled-shadow-wrapper"] });
+
+  await run(["install", "--lockfile-only"]);
+  expect(await file(join(packageDir, "bun.lock")).text()).toBe(fresh);
+});
+
+it("a bundled dependency's optional peer bound late does not take a slot the bundling package resolves through", async () => {
+  const { packageDir, packageJson } = await registry.createTestDir({
+    bunfigOpts: { saveTextLockfile: true, linker: "hoisted" },
+  });
+  const run = makeInstallRunner(packageDir);
+
+  // peer-inner (bundled) has an optional peer on shared and depends on
+  // peer-leaf, which depends on shared@2.0.0. The peer is still unbound when
+  // peer-inner is hoisted and gets bound to peer-leaf's shared@2.0.0 inside the
+  // bundle; peer-host's own shared@1.0.0 at the root must not be shadowed by
+  // either of them.
+  await write(packageJson, JSON.stringify({ name: "foo", dependencies: { "bundled-shadow-peer-host": "1.0.0" } }));
+  await run(["install"]);
+  const fresh = await file(join(packageDir, "bun.lock")).text();
+  expect(fresh).toContain('"bundled-shadow-shared": ["bundled-shadow-shared@1.0.0"');
+  expect(fresh).toContain(
+    '"bundled-shadow-peer-host/bundled-shadow-peer-inner/bundled-shadow-shared": ["bundled-shadow-shared@2.0.0"',
+  );
+  expect(fresh).toContain(
+    '"bundled-shadow-peer-host/bundled-shadow-peer-leaf/bundled-shadow-shared": ["bundled-shadow-shared@2.0.0"',
+  );
+  expect(fresh).not.toContain('"bundled-shadow-peer-host/bundled-shadow-shared"');
+
+  await rm(join(packageDir, "node_modules"), { recursive: true, force: true });
+  await run(["install", "--frozen-lockfile"]);
+  expect(await readdirSorted(join(packageDir, "node_modules", "bundled-shadow-peer-host", "node_modules"))).toEqual([
+    "bundled-shadow-peer-inner",
+  ]);
+
+  await run(["install", "--lockfile-only"]);
+  expect(await file(join(packageDir, "bun.lock")).text()).toBe(fresh);
+});
diff --git a/test/cli/install/registry/packages/bundled-shadow-consumer/bundled-shadow-consumer-1.0.0.tgz b/test/cli/install/registry/packages/bundled-shadow-consumer/bundled-shadow-consumer-1.0.0.tgz
new file mode 100644
index 0000000000000000000000000000000000000000..9009eb4ab9e243d504752ff181a8906823dd46a4
GIT binary patch
literal 201
zcmb2|=3oGW|8LJbW*s&VXiZ#O+U5BAnC#I)o_)Ppo!4@8rB~;PE0*h<bUSVG;b8ff
z|2ZKct)lpa{h{otdH#`mr)$oZ4!-&~Pu=bRoaL+XLu)p#y}fPa_kDt2x8AQ(&U%-i
z8=q)c^>zK{BK}7St}%ScMRRvdH$8q{#Qdr5k(cS0{dcZOj=D2hwD5kW=HV%^>gU3v
vUS>*No>SzrQ$DD0uFRT_7#XSdAN$i>`@UsB91A1Ef3j+A=?i7hU|;|M5HnX)

literal 0
HcmV?d00001

diff --git a/test/cli/install/registry/packages/bundled-shadow-consumer/bundled-shadow-consumer-2.0.0.tgz b/test/cli/install/registry/packages/bundled-shadow-consumer/bundled-shadow-consumer-2.0.0.tgz
new file mode 100644
index 0000000000000000000000000000000000000000..4a0528c331dd02c8ad48d70e6a40e27250726194
GIT binary patch
literal 171
zcmb2|=3oGW|8LLRavgFIaecUQbJy`JQt?8^8+J>ceeho;rAO@1J=V9Ew7LrRJ)1K9
z_Rp^e^AD}5Hod>xY!-j;)uT0fZu5_YUcKe{@YJexv0F9fWCV&XHD2_LyRGEg-izC}
zAAA1qh_3L)i}RaeyJC4aTDGOl+O{uq{pC{W%LQC}=cXuq6Z*9!dvR=+Zt>ZxY30li
T_dv-XQ`w^z`&?zvU|;|Mtrbv3

literal 0
HcmV?d00001

diff --git a/test/cli/install/registry/packages/bundled-shadow-consumer/package.json b/test/cli/install/registry/packages/bundled-shadow-consumer/package.json
new file mode 100644
index 000000000000..1b72e9817278
--- /dev/null
+++ b/test/cli/install/registry/packages/bundled-shadow-consumer/package.json
@@ -0,0 +1,32 @@
+{
+  "_id": "bundled-shadow-consumer",
+  "name": "bundled-shadow-consumer",
+  "dist-tags": {
+    "latest": "2.0.0"
+  },
+  "versions": {
+    "1.0.0": {
+      "name": "bundled-shadow-consumer",
+      "version": "1.0.0",
+      "dependencies": {
+        "bundled-shadow-mid": "1.0.0"
+      },
+      "_id": "bundled-shadow-consumer@1.0.0",
+      "dist": {
+        "integrity": "sha512-bYPAnSxRZS5jNQuvfR+PV/RC9MhWSCW0C+aB2GZi0xEQ9jmhUO+HAgK18dvtgF7IaXTqXM3F2ToI1eH5nsVLTA==",
+        "shasum": "825e428cd7ddc7af4be726cc1728ab0c735385da",
+        "tarball": "http://localhost:4873/bundled-shadow-consumer/-/bundled-shadow-consumer-1.0.0.tgz"
+      }
+    },
+    "2.0.0": {
+      "name": "bundled-shadow-consumer",
+      "version": "2.0.0",
+      "_id": "bundled-shadow-consumer@2.0.0",
+      "dist": {
+        "integrity": "sha512-5rOVsz3v9j2P1FaFAxsgnp50QmpGwjlPs3KO29gvUoO3RWlmYS5WQDJStSGMO8lzyWW+UCoR08IW3/WodfMjSg==",
+        "shasum": "79c93410f8ab5a6135323994a946978174e46dca",
+        "tarball": "http://localhost:4873/bundled-shadow-consumer/-/bundled-shadow-consumer-2.0.0.tgz"
+      }
+    }
+  }
+}
\ No newline at end of file
diff --git a/test/cli/install/registry/packages/bundled-shadow-deep-host/bundled-shadow-deep-host-1.0.0.tgz b/test/cli/install/registry/packages/bundled-shadow-deep-host/bundled-shadow-deep-host-1.0.0.tgz
new file mode 100644
index 0000000000000000000000000000000000000000..994e7975304a9b50825d45889a3fee351bc509ec
GIT binary patch
literal 356
zcmV-q0h|6GiwFP!00000|LxY_YQiuS$MIhGDGs@wdeXnp>%GMoBQs&TX;K<HFT{5r
zSO>FiDbC>(exI8{Ic;dmH?&sMH}zsBb$1-UdS|0Q#>_>QQN%m_BXgQbl6jJrWu6u?
zCzh#9WJDZYK<ihkiTLcb`VV&_HZhT~YH378;<>eYVf4t)ly>WpHl`lUoL`B%m`J>v
z#?PG<6$v@!F?VORsg2dfPUpspiZ(G39o=c_tZ$d5IlT6GZr!N5{yG*DZFkFbgZGDv
zJp^wO6FtV;2txMVPps4CY3X#kFn;p=3;p#TG1R{-d;KSg%yaaA38DT!LprzqxwZYK
z(dCsmrT@^(?i>HGLk#!NhyABqWC{Aegi!xox98UHXR0w;R3sAQe|3hN4o!65cId}o
zsDCcgUjJpr#f|rW!p0i?qfr0*a{C*=K4T;d00000000000001RjXnU}Vx6o2C;$Nb
Cud$2(

literal 0
HcmV?d00001

diff --git a/test/cli/install/registry/packages/bundled-shadow-deep-host/package.json b/test/cli/install/registry/packages/bundled-shadow-deep-host/package.json
new file mode 100644
index 000000000000..e6e2a50f9d52
--- /dev/null
+++ b/test/cli/install/registry/packages/bundled-shadow-deep-host/package.json
@@ -0,0 +1,26 @@
+{
+  "_id": "bundled-shadow-deep-host",
+  "name": "bundled-shadow-deep-host",
+  "dist-tags": {
+    "latest": "1.0.0"
+  },
+  "versions": {
+    "1.0.0": {
+      "name": "bundled-shadow-deep-host",
+      "version": "1.0.0",
+      "dependencies": {
+        "bundled-shadow-consumer": "1.0.0",
+        "bundled-shadow-wrapper": "1.0.0"
+      },
+      "bundleDependencies": [
+        "bundled-shadow-wrapper"
+      ],
+      "_id": "bundled-shadow-deep-host@1.0.0",
+      "dist": {
+        "integrity": "sha512-0AapvZZN+czyjr1l05qbGQaBHKNiLw+2BFxouwkst7BvNfJUv09ZgHtRL1tb7QGHhm1VwwR/Vg70Uz+IOzmeXA==",
+        "shasum": "9e14944bae0586dc76c6ec9f0cd68af710da5a94",
+        "tarball": "http://localhost:4873/bundled-shadow-deep-host/-/bundled-shadow-deep-host-1.0.0.tgz"
+      }
+    }
+  }
+}
\ No newline at end of file
diff --git a/test/cli/install/registry/packages/bundled-shadow-host/bundled-shadow-host-1.0.0.tgz b/test/cli/install/registry/packages/bundled-shadow-host/bundled-shadow-host-1.0.0.tgz
new file mode 100644
index 0000000000000000000000000000000000000000..ddd4d8f53a08ff9da3c8549451eae73f64f3489f
GIT binary patch
literal 309
zcmV-50m}X#iwFP!00000|LxS@YJ)Ho$8oQHibJl~_Qd!Hyxv=kF<cX-TN}mH?V|ME
z2US+In=Lq`h2Q5UAkm=mJyo{;$llDVYS-nvE3Nm>m^ltZ^7v@DGOHja83igyA{EPs
zSSlHW9<eur#_h7&<H=_YU+zxqeIjAAtr01S*T(9N(F>Pny8K$?rQ3-IpGbU~+7+c0
zDG9mcCAU|#sf^Xet_$NtN_(G(&K^=&YwG@u=bK!f)kdFo`9z1~5$(Rm{y|S82l+(L
z{=tJQb=|LQsm;r_)Xm1Y)o)*R!i2cgzf8E_e;{K{(El99`frPxIsi^>2S072&|7hR
z|6@DafBe^oxYR!<s^7ojPzC6J4rBdy<qiixmoX9s0000000000000000JtUJ@|>+9
H04M+egSwgZ

literal 0
HcmV?d00001

diff --git a/test/cli/install/registry/packages/bundled-shadow-host/package.json b/test/cli/install/registry/packages/bundled-shadow-host/package.json
new file mode 100644
index 000000000000..ffe6427964d9
--- /dev/null
+++ b/test/cli/install/registry/packages/bundled-shadow-host/package.json
@@ -0,0 +1,26 @@
+{
+  "_id": "bundled-shadow-host",
+  "name": "bundled-shadow-host",
+  "dist-tags": {
+    "latest": "1.0.0"
+  },
+  "versions": {
+    "1.0.0": {
+      "name": "bundled-shadow-host",
+      "version": "1.0.0",
+      "dependencies": {
+        "bundled-shadow-inner": "1.0.0",
+        "bundled-shadow-shared": "1.0.0"
+      },
+      "bundleDependencies": [
+        "bundled-shadow-inner"
+      ],
+      "_id": "bundled-shadow-host@1.0.0",
+      "dist": {
+        "integrity": "sha512-8OfobtACp9H+WHwCFhoRxW43zR9DIrtdPucaIwom3zp5jNJYQ1d6yu7y4x2FG8bixlhxR+iQ8E3/p0P+c4Ir1A==",
+        "shasum": "44e59de3f83ac5536a0391ec996b6a7cda06d203",
+        "tarball": "http://localhost:4873/bundled-shadow-host/-/bundled-shadow-host-1.0.0.tgz"
+      }
+    }
+  }
+}
\ No newline at end of file
diff --git a/test/cli/install/registry/packages/bundled-shadow-inner/bundled-shadow-inner-1.0.0.tgz b/test/cli/install/registry/packages/bundled-shadow-inner/bundled-shadow-inner-1.0.0.tgz
new file mode 100644
index 0000000000000000000000000000000000000000..3d693f9f0948b04aaa619a7a41f663520981acb9
GIT binary patch
literal 203
zcmb2|=3oGW|8LKq&N^%$(3-gRt4Q;;Uh7SdCH|OYnV7tDH4D3}=X7uHgg2K`y%v6`
zpUuo{d^qybKU3S=kBiPeTYB#3U!%~wx!WIod1My)c!ALGZPIP~ZXb;^DcjiVcja$m
z@?VeDmv`6So%UPZFHU93m%PL&A4+t7p8d2;E@<9<vtZ3_ZS49&cDZXW#~jj7G`sbp
zbXM-hNo(JzuTGpYS$v{=_$$S=(++Da+?!K1akITO#JN!NK<qw7#pd%>3>pj!0N|Kl
AB>(^b

literal 0
HcmV?d00001

diff --git a/test/cli/install/registry/packages/bundled-shadow-inner/package.json b/test/cli/install/registry/packages/bundled-shadow-inner/package.json
new file mode 100644
index 000000000000..c93e775a16fb
--- /dev/null
+++ b/test/cli/install/registry/packages/bundled-shadow-inner/package.json
@@ -0,0 +1,22 @@
+{
+  "_id": "bundled-shadow-inner",
+  "name": "bundled-shadow-inner",
+  "dist-tags": {
+    "latest": "1.0.0"
+  },
+  "versions": {
+    "1.0.0": {
+      "name": "bundled-shadow-inner",
+      "version": "1.0.0",
+      "dependencies": {
+        "bundled-shadow-shared": "2.0.0"
+      },
+      "_id": "bundled-shadow-inner@1.0.0",
+      "dist": {
+        "integrity": "sha512-vLarWIx0f5OlsgpY6rtzIKtoQAjH7HRTrhDBpFtK5eMreRh8i9MmNNBIkmQogQGHxnl8f/A2aqYwUPtmMKb84A==",
+        "shasum": "9247c2d44500bedc5f78cff3e90fd15d0facfd71",
+        "tarball": "http://localhost:4873/bundled-shadow-inner/-/bundled-shadow-inner-1.0.0.tgz"
+      }
+    }
+  }
+}
\ No newline at end of file
diff --git a/test/cli/install/registry/packages/bundled-shadow-mid/bundled-shadow-mid-1.0.0.tgz b/test/cli/install/registry/packages/bundled-shadow-mid/bundled-shadow-mid-1.0.0.tgz
new file mode 100644
index 0000000000000000000000000000000000000000..c988ee89e6497f3a4da9bf6a96d5b7c5ba3cb833
GIT binary patch
literal 199
zcmb2|=3oGW|8LJ9%wjSWIQDVQXA$RfrPhUaIewe1<Se~CE7okQZO8k#73_}vT?&8d
zr}ML=wdHrsKL2B0{PJKk`BI%{=R!=^ge85spStRoz>)IPWqaS<dSD%R|5vKPqGycX
zzFMDi%l}sz`OZ^jO^0^j^jQ6Ox$&36{knJcX8wtN)Al58O~>z(#j?j9RTb{L=;nWU
v%JP^Xz1fQ4*H0hpI&rmkS8uW3b6@SEE$++^w?fGs7v=BU9;#r_U|;|MlU7}A

literal 0
HcmV?d00001

diff --git a/test/cli/install/registry/packages/bundled-shadow-mid/bundled-shadow-mid-2.0.0.tgz b/test/cli/install/registry/packages/bundled-shadow-mid/bundled-shadow-mid-2.0.0.tgz
new file mode 100644
index 0000000000000000000000000000000000000000..b229926d5279a74ea7d40e8b375667827c4feeb1
GIT binary patch
literal 167
zcmb2|=3oGW|8LLl<~rmc;(BrAXVK{^efLy4|4TD*T>Q-OScc-i-3wx)Tm`>nl~r0S
zzAblmU1a}yH+K6k&kl!dJz-?{Ys;Ed)3gfbElHiZ+;vX(vCKIu1Wn@&es7-Lvv2QK
zoA2s*jU8`euix-`llJa)aBzFw`&SR8%5rnV8$0%zOwMn=7nU^HLwW1LyAY?q$hudI
NoAxd;Wzb+?002~-Oo{*i

literal 0
HcmV?d00001

diff --git a/test/cli/install/registry/packages/bundled-shadow-mid/package.json b/test/cli/install/registry/packages/bundled-shadow-mid/package.json
new file mode 100644
index 000000000000..3bf3734455ff
--- /dev/null
+++ b/test/cli/install/registry/packages/bundled-shadow-mid/package.json
@@ -0,0 +1,32 @@
+{
+  "_id": "bundled-shadow-mid",
+  "name": "bundled-shadow-mid",
+  "dist-tags": {
+    "latest": "2.0.0"
+  },
+  "versions": {
+    "1.0.0": {
+      "name": "bundled-shadow-mid",
+      "version": "1.0.0",
+      "dependencies": {
+        "bundled-shadow-shared": "1.0.0"
+      },
+      "_id": "bundled-shadow-mid@1.0.0",
+      "dist": {
+        "integrity": "sha512-4MOqBV/VRn5PtCNewlOA7+eOJKtsuccEieFuQ96Lu4OTZS1OPnyUJzIRa2HeRi5WK35gljqjl8CyPrIqscI6zw==",
+        "shasum": "f91280a96d184e738029c7b5aeb4f71f23e547b6",
+        "tarball": "http://localhost:4873/bundled-shadow-mid/-/bundled-shadow-mid-1.0.0.tgz"
+      }
+    },
+    "2.0.0": {
+      "name": "bundled-shadow-mid",
+      "version": "2.0.0",
+      "_id": "bundled-shadow-mid@2.0.0",
+      "dist": {
+        "integrity": "sha512-j+uNZ9sZt6/3vbWIGpYJ47vFQA7LA1LbcLvYxkr5uqWqwwJKl80HhTaad/HJ34sT9se8bZdEEk5ZGHKQQUHuUA==",
+        "shasum": "80339c1747d9733eeddfa4d67045ce92191a510e",
+        "tarball": "http://localhost:4873/bundled-shadow-mid/-/bundled-shadow-mid-2.0.0.tgz"
+      }
+    }
+  }
+}
\ No newline at end of file
diff --git a/test/cli/install/registry/packages/bundled-shadow-peer-host/bundled-shadow-peer-host-1.0.0.tgz b/test/cli/install/registry/packages/bundled-shadow-peer-host/bundled-shadow-peer-host-1.0.0.tgz
new file mode 100644
index 0000000000000000000000000000000000000000..813157da0bcfa296dd23dc2cf6caddbd4ead8ec6
GIT binary patch
literal 397
zcmV;80doEyiwFP!00000|LvAvZ-Ouoz<K6VTzFijwm>EE+1Gu7Wm!6Vn{3z;3fsft
zcV7@Q15>Nh_$S^kAx+xrU7-0L&E@1nzTqHm#{RoC+B-6gv0)rTJu=3+BV$o4fQv9n
z5)lo#0LCL83J;if0xDa|!ea;5>b~5S@a+QxTFx*SLGV&(m7(g{sZ{2xmm?Ovsj+2n
zUq^jnVN;{)K;CD4*32r*Q7hDw6m2kqIv=dhlxmGdd-vZ+JCy~hRg@1fU({*h#_ej4
zu4+EOlRx)}O)R}1Xru6XW>l4-9c=ub|7#O2|KliX`yYlP4$1#h;Pk)o=qL>!L;1SK
z?0RjyOOjP@xZAw@0ZZx5&@2N4CNEQ?WfqK}EGk?~&;9zjjjpk$|IV=bjJsXJ<v&m2
zw*L`NL_+?b0;m5AX%E$ZWp4QE{*4HB;p`^#wy5T8x7`d}{<Ea>|BspA*Y5v*jnz9B
r+x%Zz+m(N*FzHJW1VIo4K@bE%5ClOG1VIo4af$o@M~;`;04M+etsKIU

literal 0
HcmV?d00001

diff --git a/test/cli/install/registry/packages/bundled-shadow-peer-host/package.json b/test/cli/install/registry/packages/bundled-shadow-peer-host/package.json
new file mode 100644
index 000000000000..4ac11bd1435e
--- /dev/null
+++ b/test/cli/install/registry/packages/bundled-shadow-peer-host/package.json
@@ -0,0 +1,26 @@
+{
+  "_id": "bundled-shadow-peer-host",
+  "name": "bundled-shadow-peer-host",
+  "dist-tags": {
+    "latest": "1.0.0"
+  },
+  "versions": {
+    "1.0.0": {
+      "name": "bundled-shadow-peer-host",
+      "version": "1.0.0",
+      "dependencies": {
+        "bundled-shadow-peer-inner": "1.0.0",
+        "bundled-shadow-shared": "1.0.0"
+      },
+      "bundleDependencies": [
+        "bundled-shadow-peer-inner"
+      ],
+      "_id": "bundled-shadow-peer-host@1.0.0",
+      "dist": {
+        "integrity": "sha512-hOrxItd+YcG100DXs5GSOSc+o+Uvcd5KBgJjhvmd6LWQivdoKo02bPCPD+Rijug4zHwIQQeQFbnBazfPg88TAw==",
+        "shasum": "4ff479a3931d1864c8f082429009e8a2ac0db57f",
+        "tarball": "http://localhost:4873/bundled-shadow-peer-host/-/bundled-shadow-peer-host-1.0.0.tgz"
+      }
+    }
+  }
+}
\ No newline at end of file
diff --git a/test/cli/install/registry/packages/bundled-shadow-peer-inner/bundled-shadow-peer-inner-1.0.0.tgz b/test/cli/install/registry/packages/bundled-shadow-peer-inner/bundled-shadow-peer-inner-1.0.0.tgz
new file mode 100644
index 0000000000000000000000000000000000000000..ec2ee59ff739af8a45c1055b6ef28235abe5ddcb
GIT binary patch
literal 249
zcmb2|=3oGW|8LJ9^g3c7!1iFyXOY7)N3WG!e&=*PuC`-`<lQV^=S!~=U+(69>lh)z
z>RR^jzaF#k8GE0S-|62q%nR2(4VG*Am3(YQZtP^E?#o#|xw@fekG(7Fy&J|m^HiAh
z>JuyK4W3?9O|7ea{beV2;T0E|JKY7|HTJCcyY)XE{P}QghtkRyP7{t?pVbks`ZSN@
zj!^hg&9k?@3aM6b{`NE4UUJ3dOJ#`uyNAh<!e_l5L_D|KbDm_Mex%sD=IhsQb9>(X
rZYlLS;w-aUamT!9smm(f)z@4$&l81s42e8oS<QZjO=~NI1_J{C#Dj3M

literal 0
HcmV?d00001

diff --git a/test/cli/install/registry/packages/bundled-shadow-peer-inner/package.json b/test/cli/install/registry/packages/bundled-shadow-peer-inner/package.json
new file mode 100644
index 000000000000..b53b73ad4800
--- /dev/null
+++ b/test/cli/install/registry/packages/bundled-shadow-peer-inner/package.json
@@ -0,0 +1,30 @@
+{
+  "_id": "bundled-shadow-peer-inner",
+  "name": "bundled-shadow-peer-inner",
+  "dist-tags": {
+    "latest": "1.0.0"
+  },
+  "versions": {
+    "1.0.0": {
+      "name": "bundled-shadow-peer-inner",
+      "version": "1.0.0",
+      "dependencies": {
+        "bundled-shadow-peer-leaf": "1.0.0"
+      },
+      "peerDependencies": {
+        "bundled-shadow-shared": "*"
+      },
+      "peerDependenciesMeta": {
+        "bundled-shadow-shared": {
+          "optional": true
+        }
+      },
+      "_id": "bundled-shadow-peer-inner@1.0.0",
+      "dist": {
+        "integrity": "sha512-9WVtLLR333oOU/3JH65YiSFv5AcBi3fVnlfCXxN2bOKOuIyqiTTJUZ3Pnm2zhYWeYmtfCv8jCL0BQamya58d+A==",
+        "shasum": "e86fb60082902406bd3b88240bda768635c6d9f9",
+        "tarball": "http://localhost:4873/bundled-shadow-peer-inner/-/bundled-shadow-peer-inner-1.0.0.tgz"
+      }
+    }
+  }
+}
\ No newline at end of file
diff --git a/test/cli/install/registry/packages/bundled-shadow-peer-leaf/bundled-shadow-peer-leaf-1.0.0.tgz b/test/cli/install/registry/packages/bundled-shadow-peer-leaf/bundled-shadow-peer-leaf-1.0.0.tgz
new file mode 100644
index 0000000000000000000000000000000000000000..14808068ca003513da09d5ce0875825f8d88536c
GIT binary patch
literal 207
zcmb2|=3oGW|8LLxdLMQWIQG%@c`#44S)rLe?~~hW?p_Rgt(LM@&TIef3-@06x(fW;
zf0~)u`0(Z<Z@p_a{eC*@Z1K#^zf)K3dRbjqRXBT9;u}?-T=PEX?VQaSFPy9`0>88O
zJ=I<3SO4erwmbHPt6XaO)<0AK$bWne-?Ueox-<W+5Z}DjE~4g3`P7d3?OWeGf200!
z;YGLgms7f*rd00U{z%<2RO!>xpqodpPMUvY`}DJ3Ph#fELYxdGAKbQMOe=fK$e_W%
F002s(Wl#VB

literal 0
HcmV?d00001

diff --git a/test/cli/install/registry/packages/bundled-shadow-peer-leaf/package.json b/test/cli/install/registry/packages/bundled-shadow-peer-leaf/package.json
new file mode 100644
index 000000000000..66288fe681c2
--- /dev/null
+++ b/test/cli/install/registry/packages/bundled-shadow-peer-leaf/package.json
@@ -0,0 +1,22 @@
+{
+  "_id": "bundled-shadow-peer-leaf",
+  "name": "bundled-shadow-peer-leaf",
+  "dist-tags": {
+    "latest": "1.0.0"
+  },
+  "versions": {
+    "1.0.0": {
+      "name": "bundled-shadow-peer-leaf",
+      "version": "1.0.0",
+      "dependencies": {
+        "bundled-shadow-shared": "2.0.0"
+      },
+      "_id": "bundled-shadow-peer-leaf@1.0.0",
+      "dist": {
+        "integrity": "sha512-cqixyTfl9uvul3XQXjIPUW07Sbfh8ueHWgS7hMcE8EtbFCZABZhpgoGE+NLav9EzAtTuwFMr2JV/LjnwhZHQrA==",
+        "shasum": "37e2dbd482682fc7a7a5729a3cfd616bea0ba8ee",
+        "tarball": "http://localhost:4873/bundled-shadow-peer-leaf/-/bundled-shadow-peer-leaf-1.0.0.tgz"
+      }
+    }
+  }
+}
\ No newline at end of file
diff --git a/test/cli/install/registry/packages/bundled-shadow-shared/bundled-shadow-shared-1.0.0.tgz b/test/cli/install/registry/packages/bundled-shadow-shared/bundled-shadow-shared-1.0.0.tgz
new file mode 100644
index 0000000000000000000000000000000000000000..7392ac9187d538f6c2b8760f0f81d9039856612a
GIT binary patch
literal 170
zcmb2|=3oGW|8LLRavgFIaecUQbJy`JQui&6HSCr=oAAfm=~#y1yVwhQYZq}m&-Sa_
z8GA$KklDFi;h$@>q(3LF+7+X7<i+J3tD>q3kKUP{`f&O>fzo?t_X?WE8!Rb)(YtT2
zsoi(=yqO)jhcs_Zz47%z$ngl@VA)mQtb9vfB&Vv+?AUw6?(MB(>yGS-Dc*YXF2pr3
QvhF$Kp?7m688jFe0N3PDFaQ7m

literal 0
HcmV?d00001

diff --git a/test/cli/install/registry/packages/bundled-shadow-shared/bundled-shadow-shared-2.0.0.tgz b/test/cli/install/registry/packages/bundled-shadow-shared/bundled-shadow-shared-2.0.0.tgz
new file mode 100644
index 0000000000000000000000000000000000000000..e295a9a5dd2b36be454b6e134837c841bab5f0f6
GIT binary patch
literal 170
zcmb2|=3oGW|8LLR@-;b#xISDNdGz#^E`B$aMDxWyN9+}PG7|6X?kw9P)qC>itl)ch
z?&b5<NsIkm{nD;%?N5WySl#JKUoxXYb?2tIzB{$4VD%b-voX`Gm9zFG^rYKM)K+I#
zz4N~#BzXH*@P?^3zTUWYJm7rt<Ja%3`g`S_a??9I_O>X#+jT80>2pZ%){}Q3u7Qzt
P&lwwYcIGi?FfafBAHz%Z

literal 0
HcmV?d00001

diff --git a/test/cli/install/registry/packages/bundled-shadow-shared/package.json b/test/cli/install/registry/packages/bundled-shadow-shared/package.json
new file mode 100644
index 000000000000..5e5214bdad4f
--- /dev/null
+++ b/test/cli/install/registry/packages/bundled-shadow-shared/package.json
@@ -0,0 +1,29 @@
+{
+  "_id": "bundled-shadow-shared",
+  "name": "bundled-shadow-shared",
+  "dist-tags": {
+    "latest": "2.0.0"
+  },
+  "versions": {
+    "1.0.0": {
+      "name": "bundled-shadow-shared",
+      "version": "1.0.0",
+      "_id": "bundled-shadow-shared@1.0.0",
+      "dist": {
+        "integrity": "sha512-Zm9lIGft1cDn7OnUPkhkl+SKTLspMB6yNbab9WxVTeopTuHTQUMmtdmhHWIjorE1vdVoAmsM6C0LiqR3NHGORg==",
+        "shasum": "6332e8de0bed6ca017cbfce4fb476b06bdcad9f5",
+        "tarball": "http://localhost:4873/bundled-shadow-shared/-/bundled-shadow-shared-1.0.0.tgz"
+      }
+    },
+    "2.0.0": {
+      "name": "bundled-shadow-shared",
+      "version": "2.0.0",
+      "_id": "bundled-shadow-shared@2.0.0",
+      "dist": {
+        "integrity": "sha512-a32XNaBdL5ammNQNPz/iWcW9iYJAC+vAu7XGu5ZeXTgxEBwJferXAWsdvrpR8UKbqc1AkwVlhW9q+Ygqrb0VQg==",
+        "shasum": "ffde31aa884a9e9b1b8e7e18a85aa07a99e55dfc",
+        "tarball": "http://localhost:4873/bundled-shadow-shared/-/bundled-shadow-shared-2.0.0.tgz"
+      }
+    }
+  }
+}
\ No newline at end of file
diff --git a/test/cli/install/registry/packages/bundled-shadow-wrapper/bundled-shadow-wrapper-1.0.0.tgz b/test/cli/install/registry/packages/bundled-shadow-wrapper/bundled-shadow-wrapper-1.0.0.tgz
new file mode 100644
index 0000000000000000000000000000000000000000..01a0188e0a9eaa75799bee83b32c25ede33c2bed
GIT binary patch
literal 202
zcmb2|=3oGW|8LKq&N^%$(3-gRt4Q;;Uh7SdCH|OYsYHEO;$E34ruaTCL#(xAW{}38
z`_B#>I8)$tV}Hx>l6bwFw%bi-$1hv8`)ycH-A=zy`^t~W_CA*_-u%&c#eV<0+m%0!
z&ei-^U!2{)?(|<_b?rw*72bJb-wRHBG(GBD%~fcd*JnCq(yHB?mEI{|-L~fD*+(_Y
y=f*8FoH`}>)NfT&^V280PV`%QpIcd{A2o5atu(~7Q1XDT9V3H(>NW-q1_l5ZqFo69

literal 0
HcmV?d00001

diff --git a/test/cli/install/registry/packages/bundled-shadow-wrapper/package.json b/test/cli/install/registry/packages/bundled-shadow-wrapper/package.json
new file mode 100644
index 000000000000..932ba9ccd212
--- /dev/null
+++ b/test/cli/install/registry/packages/bundled-shadow-wrapper/package.json
@@ -0,0 +1,22 @@
+{
+  "_id": "bundled-shadow-wrapper",
+  "name": "bundled-shadow-wrapper",
+  "dist-tags": {
+    "latest": "1.0.0"
+  },
+  "versions": {
+    "1.0.0": {
+      "name": "bundled-shadow-wrapper",
+      "version": "1.0.0",
+      "dependencies": {
+        "bundled-shadow-inner": "1.0.0"
+      },
+      "_id": "bundled-shadow-wrapper@1.0.0",
+      "dist": {
+        "integrity": "sha512-oNjMSn8UuncNL0QOe+g4H/lnBTdDaHblibo3/FIwXQhtj/stdtrckJBW3svJII23M03kpIQT9zL86LOVokMo4w==",
+        "shasum": "89b99e0d115ec1c580bde8f72344e9b8d4878d81",
+        "tarball": "http://localhost:4873/bundled-shadow-wrapper/-/bundled-shadow-wrapper-1.0.0.tgz"
+      }
+    }
+  }
+}
\ No newline at end of file
diff --git a/test/cli/install/registry/packages/create-bundled-shadow-packages.ts b/test/cli/install/registry/packages/create-bundled-shadow-packages.ts
new file mode 100644
index 000000000000..0d97d938cb30
--- /dev/null
+++ b/test/cli/install/registry/packages/create-bundled-shadow-packages.ts
@@ -0,0 +1,153 @@
+#!/usr/bin/env bun
+/**
+ * Generates the `bundled-shadow-*` fixtures used by bun-lock.test.ts.
+ *
+ * The dependencies of a bundled dependency are hoisted no further than the
+ * bundling package's node_modules. That folder is also what the bundling
+ * package itself, and any regular dependency nested inside it, resolve through
+ * on their way up the tree, and a loaded bun.lock rebinds their edges by
+ * walking up the saved paths. So a dependency of the bundle may only land
+ * there if none of them resolve that name to something else higher up.
+ *
+ * The bundling package resolves the name higher up:
+ *
+ * - bundled-shadow-host@1.0.0    -> shared@1.0.0, and bundles inner@1.0.0
+ * - bundled-shadow-inner@1.0.0   -> shared@2.0.0
+ * - bundled-shadow-shared@1.0.0  no dependencies
+ * - bundled-shadow-shared@2.0.0  no dependencies
+ *
+ * host's shared@1.0.0 is hoisted to the root, so inner's shared@2.0.0 has to
+ * stay at `host/inner/shared` in bun.lock; at `host/shared` it would be what
+ * host's own `shared` edge resolves to when the lockfile is loaded again.
+ *
+ * The same through an optional peer that is still unbound when the bundle is
+ * hoisted, and gets bound to the bundle's own copy:
+ *
+ * - bundled-shadow-peer-host@1.0.0   -> shared@1.0.0, and bundles peer-inner@1.0.0
+ * - bundled-shadow-peer-inner@1.0.0  -> peer-leaf@1.0.0, optional peer on shared
+ * - bundled-shadow-peer-leaf@1.0.0   -> shared@2.0.0
+ *
+ * And a regular dependency nested inside the bundling package resolves the
+ * name higher up (installed next to consumer@2.0.0 and mid@2.0.0 at the root so
+ * that consumer@1.0.0 nests under deep-host and mid@1.0.0 under consumer):
+ *
+ * - bundled-shadow-deep-host@1.0.0  -> consumer@1.0.0, and bundles wrapper@1.0.0
+ * - bundled-shadow-consumer@1.0.0   -> mid@1.0.0
+ * - bundled-shadow-consumer@2.0.0   no dependencies
+ * - bundled-shadow-mid@1.0.0        -> shared@1.0.0
+ * - bundled-shadow-mid@2.0.0        no dependencies
+ * - bundled-shadow-wrapper@1.0.0    -> inner@1.0.0
+ *
+ * Hoisting is breadth-first and consumer sorts before wrapper, so mid's
+ * shared@1.0.0 has been hoisted to the root (up through deep-host's
+ * node_modules) by the time inner's shared@2.0.0 reaches that folder.
+ *
+ * The tarballs carry their bundled packages like `npm pack` would, so the
+ * bundled copies are what gets installed for them.
+ */
+
+import { mkdir, writeFile } from "fs/promises";
+import { join } from "path";
+
+const packagesDir = import.meta.dir;
+
+const prefix = "bundled-shadow-";
+
+type Manifest = {
+  version: string;
+  dependencies?: Record<string, string>;
+  peerDependencies?: Record<string, string>;
+  peerDependenciesMeta?: Record<string, { optional: true }>;
+  bundleDependencies?: string[];
+};
+
+const packages: Record<string, Manifest[]> = {
+  host: [
+    {
+      version: "1.0.0",
+      dependencies: { [`${prefix}inner`]: "1.0.0", [`${prefix}shared`]: "1.0.0" },
+      bundleDependencies: [`${prefix}inner`],
+    },
+  ],
+  inner: [{ version: "1.0.0", dependencies: { [`${prefix}shared`]: "2.0.0" } }],
+  shared: [{ version: "1.0.0" }, { version: "2.0.0" }],
+  "peer-host": [
+    {
+      version: "1.0.0",
+      dependencies: { [`${prefix}peer-inner`]: "1.0.0", [`${prefix}shared`]: "1.0.0" },
+      bundleDependencies: [`${prefix}peer-inner`],
+    },
+  ],
+  "peer-inner": [
+    {
+      version: "1.0.0",
+      dependencies: { [`${prefix}peer-leaf`]: "1.0.0" },
+      peerDependencies: { [`${prefix}shared`]: "*" },
+      peerDependenciesMeta: { [`${prefix}shared`]: { optional: true } },
+    },
+  ],
+  "peer-leaf": [{ version: "1.0.0", dependencies: { [`${prefix}shared`]: "2.0.0" } }],
+  "deep-host": [
+    {
+      version: "1.0.0",
+      dependencies: { [`${prefix}consumer`]: "1.0.0", [`${prefix}wrapper`]: "1.0.0" },
+      bundleDependencies: [`${prefix}wrapper`],
+    },
+  ],
+  consumer: [{ version: "1.0.0", dependencies: { [`${prefix}mid`]: "1.0.0" } }, { version: "2.0.0" }],
+  mid: [{ version: "1.0.0", dependencies: { [`${prefix}shared`]: "1.0.0" } }, { version: "2.0.0" }],
+  wrapper: [{ version: "1.0.0", dependencies: { [`${prefix}inner`]: "1.0.0" } }],
+};
+
+function manifestOf(name: string, version: string): Manifest {
+  const manifest = packages[name.slice(prefix.length)]?.find(m => m.version === version);
+  if (!manifest) throw new Error(`no manifest for ${name}@${version}`);
+  return manifest;
+}
+
+// Lays a package out under `dir` the way it would be inside a published
+// tarball, with each of its dependencies nested in its own node_modules.
+function addBundledTree(files: Record<string, string>, dir: string, name: string, version: string) {
+  const manifest = manifestOf(name, version);
+  files[`${dir}/package.json`] = JSON.stringify({ name, ...manifest }, null, 2);
+  for (const [dep, depVersion] of Object.entries(manifest.dependencies ?? {})) {
+    addBundledTree(files, `${dir}/node_modules/${dep}`, dep, depVersion);
+  }
+}
+
+for (const [suffix, manifests] of Object.entries(packages)) {
+  const name = prefix + suffix;
+  const dir = join(packagesDir, name);
+  await mkdir(dir, { recursive: true });
+
+  const versions: Record<string, object> = {};
+  let latest = "";
+  for (const manifest of manifests) {
+    const pkgJson = { name, ...manifest };
+    const files: Record<string, string> = { "package/package.json": JSON.stringify(pkgJson, null, 2) };
+    for (const bundled of manifest.bundleDependencies ?? []) {
+      addBundledTree(files, `package/node_modules/${bundled}`, bundled, manifest.dependencies![bundled]);
+    }
+    const tarball = join(dir, `${name}-${manifest.version}.tgz`);
+    await Bun.Archive.write(tarball, files, { compress: "gzip" });
+
+    const bytes = await Bun.file(tarball).bytes();
+    versions[manifest.version] = {
+      ...pkgJson,
+      _id: `${name}@${manifest.version}`,
+      dist: {
+        integrity: `sha512-${Buffer.from(new Bun.CryptoHasher("sha512").update(bytes).digest()).toString("base64")}`,
+        shasum: new Bun.CryptoHasher("sha1").update(bytes).digest("hex"),
+        tarball: `http://localhost:4873/${name}/-/${name}-${manifest.version}.tgz`,
+      },
+    };
+    latest = manifest.version;
+  }
+
+  await writeFile(
+    join(dir, "package.json"),
+    JSON.stringify({ _id: name, name, "dist-tags": { latest }, versions }, null, 2),
+  );
+}
+
+console.log("Created bundled-shadow test packages");

From 286db7b2c7fba66eb0cd47ab2b18ba9a5ba5656b Mon Sep 17 00:00:00 2001
From: robobun <117481402+robobun@users.noreply.github.com>
Date: Mon, 17 Aug 2026 01:24:43 +0000
Subject: [PATCH 094/258] test(install): pin both no-deps versions instead of
 racing a range against a pin (#38858)

---
 test/cli/install/bun-install-registry.test.ts | 19 ++++---
 test/cli/install/isolated-install.test.ts     | 54 ++++++++++++++++---
 2 files changed, 59 insertions(+), 14 deletions(-)

diff --git a/test/cli/install/bun-install-registry.test.ts b/test/cli/install/bun-install-registry.test.ts
index 7b38512f9d8f..2fba3410cad6 100644
--- a/test/cli/install/bun-install-registry.test.ts
+++ b/test/cli/install/bun-install-registry.test.ts
@@ -6551,7 +6551,11 @@ describe("update", () => {
           "optional-native": "^1.0.0",
           "peer-deps-too": "^1.0.0",
           "two-range-deps": "^1.0.0",
-          "one-fixed-dep": "^1.0.0",
+          // Pins no-deps@2.0.0, which two-range-deps' no-deps@^1.0.0 cannot dedupe onto,
+          // so every install has the same two copies of no-deps. one-fixed-dep@1.0.0 pins
+          // no-deps@1.0.0, and whether the range then added 1.1.0 or settled on that pin
+          // depended on manifest arrival order (the count below used to be 19 or 20).
+          "one-fixed-dep": "^2.0.0",
           "no-deps-bins": "^2.0.0",
           "left-pad": "^1.0.0",
           "native": "1.0.0",
@@ -6572,7 +6576,7 @@ describe("update", () => {
         "optional-native": "^1.0.0",
         "peer-deps-too": "^1.0.0",
         "two-range-deps": "^1.0.0",
-        "one-fixed-dep": "^1.0.0",
+        "one-fixed-dep": "^2.0.0",
         "no-deps-bins": "^2.0.0",
         "left-pad": "^1.0.0",
         "native": "1.0.0",
@@ -6599,15 +6603,14 @@ describe("update", () => {
       "+ left-pad@1.0.0",
       "+ native@1.0.0",
       "+ no-deps-bins@2.0.0",
-      expect.stringContaining("+ one-fixed-dep@1.0.0"),
+      "+ one-fixed-dep@2.0.0",
       "+ optional-native@1.0.0",
       "+ peer-deps-too@1.0.0",
       "+ two-range-deps@1.0.0",
       expect.stringContaining("+ uses-what-bin@1.5.0"),
       expect.stringContaining("+ what-bin@1.5.0"),
       "",
-      // Due to optional-native dependency, this can be either 20 or 19 packages
-      expect.stringMatching(/(?:20|19) packages installed/),
+      expect.stringContaining("20 packages installed"),
       "",
       "Blocked 1 postinstall. Run `bun pm untrusted` for details.",
       "",
@@ -6625,7 +6628,7 @@ describe("update", () => {
         "optional-native": "^1.0.0",
         "peer-deps-too": "^1.0.0",
         "two-range-deps": "^1.0.0",
-        "one-fixed-dep": "^1.0.0",
+        "one-fixed-dep": "^2.0.0",
         "no-deps-bins": "^2.0.0",
         "left-pad": "^1.0.0",
         "native": "1.0.0",
@@ -6663,7 +6666,7 @@ describe("update", () => {
         "optional-native": "^1.0.0",
         "peer-deps-too": "^1.0.0",
         "two-range-deps": "^1.0.0",
-        "one-fixed-dep": "^1.0.0",
+        "one-fixed-dep": "^2.0.0",
         "no-deps-bins": "^2.0.0",
         "left-pad": "^1.0.0",
         "native": "1.0.0",
@@ -6706,7 +6709,7 @@ describe("update", () => {
         "optional-native": "^1.0.0",
         "peer-deps-too": "^1.0.0",
         "two-range-deps": "^1.0.0",
-        "one-fixed-dep": "^1.0.0",
+        "one-fixed-dep": "^2.0.0",
         "no-deps-bins": "^2.0.0",
         "left-pad": "^1.0.0",
         "native": "1.0.0",
diff --git a/test/cli/install/isolated-install.test.ts b/test/cli/install/isolated-install.test.ts
index 4934d55a7d93..044c82f512c9 100644
--- a/test/cli/install/isolated-install.test.ts
+++ b/test/cli/install/isolated-install.test.ts
@@ -31,6 +31,21 @@ function urlHash(url: string): string {
   return Bun.hash(url).toString(16).padStart(16, "0");
 }
 
+// Every copy of `name` in the tree bun.lock saves, keyed by the node_modules
+// path it is written at, e.g. `{ "no-deps": "no-deps@1.0.1", "nd11": "no-deps@1.1.0" }`.
+// The peer tests below depend on the shape of this tree, not just on which
+// versions were resolved, so they assert it before looking at the store.
+async function savedTreeCopiesOf(packageDir: string, name: string): Promise<Record<string, string>> {
+  const { packages } = Bun.JSONC.parse(await file(join(packageDir, "bun.lock")).text()) as {
+    packages: Record<string, [string, ...unknown[]]>;
+  };
+  return Object.fromEntries(
+    Object.entries(packages)
+      .filter(([, [resolution]]) => resolution.startsWith(`${name}@`))
+      .map(([path, [resolution]]) => [path, resolution]),
+  );
+}
+
 beforeAll(async () => {
   await registry.start();
 });
@@ -1223,13 +1238,19 @@ for (const backend of ["clonefile", "hardlink", "copyfile"]) {
 test("ranged peer dependency resolution is stable across installs from bun.lock", async () => {
   // `peer-deps-fixed` has a peer on `no-deps@^1.0.0`. The graph contains both
   // no-deps@1.0.1 (exact pin via normal-dep-and-dev-dep, hoisted to the root
-  // of the saved tree) and no-deps@1.1.0 (via two-range-deps). The fresh
-  // resolve binds the peer edge to the highest satisfying version (1.1.0) in
-  // its deferred-peer phase; reloading bun.lock used to re-derive the edge
+  // of the saved tree) and no-deps@1.1.0 (exact pin via the `nd11` alias). The
+  // fresh resolve binds the peer edge to the highest satisfying version (1.1.0)
+  // in its deferred-peer phase; reloading bun.lock used to re-derive the edge
   // from the saved tree paths instead, rebinding it to the hoisted 1.0.1.
   // That silently changed the runtime dependency tree on the second install
   // and re-keyed the isolated store entry (`+<peer hash>` suffix) on every
   // warm install.
+  //
+  // Both copies are exact pins so that the graph does not depend on whether
+  // the resolver dedupes a range like two-range-deps' `no-deps@^1.0.0` onto
+  // the 1.0.1 pin. Today that depends on which manifest the registry answers
+  // first: the range only adds 1.1.0 when it is resolved before 1.0.1 is
+  // appended.
   const { packageJson, packageDir } = await registry.createTestDir({
     bunfigOpts: { linker: "isolated" },
   });
@@ -1241,13 +1262,21 @@ test("ranged peer dependency resolution is stable across installs from bun.lock"
       dependencies: {
         "peer-deps-fixed": "1.0.0",
         "normal-dep-and-dev-dep": "1.0.0",
-        "two-range-deps": "1.0.0",
+        "nd11": "npm:no-deps@1.1.0",
       },
     }),
   );
 
   await runBunInstall(bunEnv, packageDir);
 
+  // 1.0.1 holds the `no-deps` path the peer edge resolves through; the
+  // edge itself gets no path of its own, which is what made the load-time
+  // path walk rebind it.
+  expect(await savedTreeCopiesOf(packageDir, "no-deps")).toEqual({
+    "nd11": "no-deps@1.1.0",
+    "no-deps": "no-deps@1.0.1",
+  });
+
   const bunDir = join(packageDir, "node_modules", ".bun");
   // highest satisfying ^1.0.0 in the graph; `toContain` prints the full
   // listing when the entry is missing or keyed with a different peer hash
@@ -1398,7 +1427,7 @@ test("aliased peer dependency binds to its real package across installs from bun
         workspaces: ["packages/*"],
         dependencies: {
           "normal-dep-and-dev-dep": "1.0.0",
-          "two-range-deps": "1.0.0",
+          "nd11": "npm:no-deps@1.1.0",
         },
       }),
       "packages/m/package.json": JSON.stringify({
@@ -1410,6 +1439,12 @@ test("aliased peer dependency binds to its real package across installs from bun
   });
 
   await runBunInstall(bunEnv, packageDir);
+  // no-deps@1.1.0 is the decoy: the only real no-deps version that satisfies
+  // ^1.0.2, so a lookup under the alias name would rebind the edge to it
+  expect(Object.values(await savedTreeCopiesOf(packageDir, "no-deps")).sort()).toEqual([
+    "no-deps@1.0.1",
+    "no-deps@1.1.0",
+  ]);
   const aliasLink = join(packageDir, "packages", "m", "node_modules", "no-deps", "package.json");
   const fresh = await file(aliasLink).json();
   expect(fresh).toMatchObject({ name: "a-dep" });
@@ -1440,13 +1475,20 @@ test("optional ranged peer keeps its hoisted-tree binding across installs from b
       dependencies: {
         "one-optional-peer-dep": "1.0.2",
         "normal-dep-and-dev-dep": "1.0.0",
-        "two-range-deps": "1.0.0",
+        "nd11": "npm:no-deps@1.1.0",
       },
     }),
   );
 
   await runBunInstall(bunEnv, packageDir);
 
+  // 1.0.1 is the hoisted sibling the optional peer was bound to; 1.1.0 is
+  // the higher version a version scan on load would pick instead
+  expect(await savedTreeCopiesOf(packageDir, "no-deps")).toEqual({
+    "nd11": "no-deps@1.1.0",
+    "no-deps": "no-deps@1.0.1",
+  });
+
   const bunDir = join(packageDir, "node_modules", ".bun");
   const freshEntries = (await readdirSorted(bunDir)).filter(e => e.startsWith("one-optional-peer-dep@"));
   expect(freshEntries).toHaveLength(1);

From 45bc5436631a6b54e62ed9c3f183c7289a2bcbcc Mon Sep 17 00:00:00 2001
From: robobun <117481402+robobun@users.noreply.github.com>
Date: Mon, 17 Aug 2026 01:25:36 +0000
Subject: [PATCH 095/258] install: resolve file: dependencies loaded from the
 lockfile relative to the top-level dir (#38850)

---
 src/install/lockfile.rs                       |  87 +++++++++++++-
 src/install/lockfile/Package.rs               |  43 ++++---
 src/install/pnpm.rs                           |  43 +++++++
 test/cli/install/bun-lock.test.ts             | 110 ++++++++++++++++++
 .../__snapshots__/pnpm-lock-v9.test.ts.snap   |   2 +-
 test/cli/install/migration/migrate.test.ts    |  43 +++++++
 .../install/migration/pnpm-lock-v9.test.ts    |  12 +-
 7 files changed, 319 insertions(+), 21 deletions(-)

diff --git a/src/install/lockfile.rs b/src/install/lockfile.rs
index 540f36f4e723..2d500915e564 100644
--- a/src/install/lockfile.rs
+++ b/src/install/lockfile.rs
@@ -11,7 +11,7 @@ use bun_collections::{
     HashMap as BunHashMap, IdentityContext, LinearFifo, linear_fifo::DynamicBuffer,
 };
 use bun_core::fmt::PathSep;
-use bun_core::{Global, Output};
+use bun_core::{Global, Output, UnwrapOrOom as _};
 use bun_paths::{MAX_PATH_BYTES, PathBuffer, SEP, SEP_STR, platform, resolve_path};
 // `bun_install` sits above `bun_resolver` in the crate graph (no cycle), so use
 // the real resolver `FileSystem` directly — same as `PackageManager.rs`.
@@ -515,6 +515,21 @@ impl Lockfile {
     }
 
     pub fn load_from_dir<'a, const ATTEMPT_LOADING_FROM_OTHER_LOCKFILE: bool>(
+        &'a mut self,
+        dir: Fd,
+        manager: Option<&mut PackageManager>,
+        log: &mut bun_ast::Log,
+    ) -> LoadResult<'a> {
+        let mut result =
+            self.read_from_dir::<ATTEMPT_LOADING_FROM_OTHER_LOCKFILE>(dir, manager, log);
+        if let LoadResult::Ok(ok) = &mut result {
+            ok.lockfile.rebase_folder_dependencies().unwrap_or_oom();
+        }
+        result
+    }
+
+    /// bun.lock, bun.lockb or, failing both, a foreign lockfile to migrate from.
+    fn read_from_dir<'a, const ATTEMPT_LOADING_FROM_OTHER_LOCKFILE: bool>(
         &'a mut self,
         dir: Fd,
         mut manager: Option<&mut PackageManager>,
@@ -729,6 +744,76 @@ impl Lockfile {
         })
     }
 
+    /// A lockfile stores a folder dependency as its literal, relative to the
+    /// declaring package; give the rows of root, workspace and `file:` packages
+    /// the top-level relative `value.folder` that `Package::parse` gives them.
+    /// Idempotent, since the literal is left as is.
+    pub(crate) fn rebase_folder_dependencies(&mut self) -> Result<(), AllocError> {
+        let Lockfile {
+            packages,
+            buffers,
+            string_pool,
+            ..
+        } = self;
+        let Buffers {
+            string_bytes,
+            dependencies,
+            ..
+        } = buffers;
+        let pkgs = packages.slice();
+        let mut path_buf = bun_paths::path_buffer_pool::get();
+
+        for (pkg_resolution, pkg_dependencies) in pkgs
+            .items_resolution()
+            .iter()
+            .zip(pkgs.items_dependencies())
+        {
+            let pkg_dir: SemverString = match pkg_resolution.tag {
+                ResolutionTag::Root => SemverString::default(),
+                ResolutionTag::Workspace => *pkg_resolution.workspace(),
+                ResolutionTag::Folder => *pkg_resolution.folder(),
+                _ => continue,
+            };
+
+            for dep in pkg_dependencies.mut_(dependencies.as_mut_slice()) {
+                if dep.version.tag != dependency::Tag::Folder {
+                    continue;
+                }
+                let relative = {
+                    let buf = string_bytes.as_slice();
+                    let literal = dep.version.literal.sliced(buf);
+                    let Some(declared) = dependency::parse_with_tag(
+                        dep.name,
+                        Some(dep.name_hash),
+                        literal.slice,
+                        dependency::Tag::Folder,
+                        &literal,
+                        None,
+                        None,
+                    ) else {
+                        continue;
+                    };
+                    let declared_folder = *declared.folder();
+                    package::folder_relative_to_top_level_dir(
+                        pkg_dir.slice(buf),
+                        declared_folder.slice(buf),
+                        &mut path_buf[..],
+                    )
+                };
+                let Some(relative) = relative else {
+                    continue;
+                };
+                dep.version.value.folder = SemverStringBuf {
+                    bytes: &mut *string_bytes,
+                    pool: &mut *string_pool,
+                }
+                .append(relative)?;
+            }
+        }
+
+        Ok(())
+    }
+
     pub(crate) fn is_resolved_dependency_disabled(
         &self,
         dep_id: DependencyID,
diff --git a/src/install/lockfile/Package.rs b/src/install/lockfile/Package.rs
index 0582474b998b..7b5da1ac25b1 100644
--- a/src/install/lockfile/Package.rs
+++ b/src/install/lockfile/Package.rs
@@ -111,6 +111,28 @@ pub(crate) fn value_loc_of(source: &bun_ast::Source, key_loc: bun_ast::Loc) -> b
     crate::bun_json::property_value_loc(&source.contents, key_loc).unwrap_or(key_loc)
 }
 
+/// The form `Version.value.folder` has in root, workspace and `file:` packages (`None`: too long for `buf`).
+pub(crate) fn folder_relative_to_top_level_dir<'a>(
+    pkg_dir: &[u8],
+    folder: &[u8],
+    buf: &'a mut [u8],
+) -> Option<&'a [u8]> {
+    let top_level_dir = FileSystem::instance().top_level_dir();
+    let joined = resolve_path::join_abs_string_buf_checked::<path::platform::Auto>(
+        top_level_dir,
+        buf,
+        &[pkg_dir, folder],
+    )?;
+    let relative = resolve_path::relative(top_level_dir, joined);
+    // empty when the package depends on itself
+    let relative: &[u8] = if relative.is_empty() { b"." } else { relative };
+    let len = relative.len();
+    buf[..len].copy_from_slice(relative);
+    #[cfg(windows)]
+    path::dangerously_convert_path_to_posix_in_place::<u8>(&mut buf[..len]);
+    Some(&buf[..len])
+}
+
 #[cold]
 fn invalid_trusted_dependencies(
     log: &mut bun_ast::Log,
@@ -1887,10 +1909,10 @@ impl Package<u64> {
             {
                 let folder = *dependency_version.folder();
                 let mut folder_buf = PathBuffer::uninit();
-                let Some(joined) = resolve_path::join_abs_string_buf_checked::<path::platform::Auto>(
-                    FileSystem::instance().top_level_dir(),
+                let Some(relative) = folder_relative_to_top_level_dir(
+                    source.path.name().dir,
+                    folder.slice(buf),
                     &mut folder_buf.0,
-                    &[source.path.name().dir, folder.slice(buf)],
                 ) else {
                     log.add_error_fmt(
                         source,
@@ -1902,20 +1924,7 @@ impl Package<u64> {
                     );
                     return Err(crate::Error::InstallFailed);
                 };
-                let relative: &[u8] =
-                    resolve_path::relative(FileSystem::instance().top_level_dir(), joined);
-                #[cfg(windows)]
-                let relative: &[u8] = {
-                    let len = relative.len();
-                    folder_buf.0[..len].copy_from_slice(relative);
-                    path::dangerously_convert_path_to_posix_in_place::<u8>(
-                        &mut folder_buf.0[..len],
-                    );
-                    &folder_buf.0[..len]
-                };
-                // if relative is empty, we are linking the package to itself
-                dependency_version.value.folder = string_builder
-                    .append::<String>(if relative.is_empty() { b"." } else { relative });
+                dependency_version.value.folder = string_builder.append::<String>(relative);
             }
             dependency::version::Tag::Npm => {
                 if let Some(workspace_version) = workspace_version {
diff --git a/src/install/pnpm.rs b/src/install/pnpm.rs
index 17aa9c36d83b..410a1476b81e 100644
--- a/src/install/pnpm.rs
+++ b/src/install/pnpm.rs
@@ -1623,6 +1623,7 @@ pub(crate) fn migrate_pnpm_lockfile<'a>(
     // pnpm records `os`/`cpu` for every `packages:` entry whose manifest
     // declares them, including `file:` folders, tarballs, and git packages.
     crate::migration::clear_non_registry_platform_constraints(lockfile);
+    declare_folder_dependencies_relative_to_their_package(lockfile)?;
 
     lockfile.resolve(log)?;
 
@@ -1783,6 +1784,48 @@ fn declared_package_peers(
     Ok(peers)
 }
 
+/// pnpm records a folder package's `file:` dependencies relative to the lockfile
+/// (`file:sub-dep/child` for a declared `file:./child`), which the resolution
+/// pass above keys on; bun.lock stores them relative to the declaring package,
+/// as declared. Importers already carry the declared `specifier`.
+fn declare_folder_dependencies_relative_to_their_package(
+    lockfile: &mut Lockfile,
+) -> Result<(), AllocError> {
+    let mut literal: Vec<u8> = Vec::new();
+    for pkg_id in 0..lockfile.packages.len() {
+        let pkg_resolution = lockfile.packages.items_resolution()[pkg_id];
+        if pkg_resolution.tag != resolution::Tag::Folder {
+            continue;
+        }
+        let pkg_dir = *pkg_resolution.folder();
+        let rows = lockfile.packages.items_dependencies()[pkg_id];
+
+        for dep_id in rows.begin() as usize..rows.end() as usize {
+            let dep = &lockfile.buffers.dependencies[dep_id];
+            if dep.version.tag != dependency::VersionTag::Folder {
+                continue;
+            }
+            let folder = *dep.version.folder();
+
+            literal.clear();
+            literal.extend_from_slice(b"file:");
+            let relative = bun_paths::resolve_path::relative(
+                pkg_dir.slice(string_bytes!(lockfile)),
+                folder.slice(string_bytes!(lockfile)),
+            );
+            literal.extend_from_slice(if relative.is_empty() { b"." } else { relative });
+            #[cfg(windows)]
+            bun_paths::dangerously_convert_path_to_posix_in_place::<u8>(
+                &mut literal[b"file:".len()..],
+            );
+
+            let appended = sbuf!(lockfile).append(&literal)?;
+            lockfile.buffers.dependencies[dep_id].version.literal = appended;
+        }
+    }
+    Ok(())
+}
+
 fn parse_append_package_dependencies(
     lockfile: &mut Lockfile,
     package_obj: &Expr,
diff --git a/test/cli/install/bun-lock.test.ts b/test/cli/install/bun-lock.test.ts
index 5ab520553488..00347709004e 100644
--- a/test/cli/install/bun-lock.test.ts
+++ b/test/cli/install/bun-lock.test.ts
@@ -2749,3 +2749,113 @@ it("a bundled dependency's optional peer bound late does not take a slot the bun
   await run(["install", "--lockfile-only"]);
   expect(await file(join(packageDir, "bun.lock")).text()).toBe(fresh);
 });
+
+// A lockfile stores the `file:` path of a dependency exactly as the declaring
+// package.json wrote it, i.e. relative to that package.json, while a fresh parse
+// of the same package.json stores it relative to the project. The rows below
+// only get resolved again from the loaded lockfile (an override for their name
+// went away, or `bun update <name>` targets them), which is when the two forms
+// have to agree.
+describe.concurrent("re-resolving file: dependencies declared by a file: package or a workspace", () => {
+  const pkg = (name: string, version: string, dependencies?: Record<string, string>) =>
+    JSON.stringify({ name, version, dependencies });
+  const app = (overrides?: Record<string, string>) =>
+    JSON.stringify({ name: "app", dependencies: { a: "file:./vendor/a" }, overrides });
+  const installedVersion = async (packageDir: string, ...segments: string[]) =>
+    (await file(join(packageDir, ...segments, "package.json")).json()).version;
+
+  // `a` declares `b` relative to itself; the override redirects `b` elsewhere.
+  const vendored = {
+    "vendor/a/package.json": pkg("a", "1.0.0", { b: "file:../b" }),
+    "vendor/b/package.json": pkg("b", "1.0.0"),
+    "vendor/b2/package.json": pkg("b", "2.0.0"),
+  };
+
+  it.each([
+    ["bun.lock", true],
+    ["bun.lockb", false],
+  ])("removing an override resolves the file: package's dependency next to it again (%s)", async (_, text) => {
+    const { packageDir, packageJson } = await registry.createTestDir({
+      bunfigOpts: { linker: "hoisted", saveTextLockfile: text },
+      files: { ...vendored, "package.json": app({ b: "file:./vendor/b2" }) },
+    });
+    const run = makeInstallRunner(packageDir);
+
+    await run(["install"]);
+    expect(await installedVersion(packageDir, "node_modules", "a", "node_modules", "b")).toBe("2.0.0");
+    expect(await exists(join(packageDir, text ? "bun.lock" : "bun.lockb"))).toBe(true);
+
+    await write(packageJson, app());
+    await run(["install"]);
+    expect(await installedVersion(packageDir, "node_modules", "a", "node_modules", "b")).toBe("1.0.0");
+    await run(["install", "--frozen-lockfile"]);
+
+    await run(["install", "--save-text-lockfile", "--lockfile-only"]);
+    const lockfile = await file(join(packageDir, "bun.lock")).text();
+    expect(lockfile).toContain('"a": ["a@file:vendor/a", { "dependencies": { "b": "file:../b" } }]');
+    expect(lockfile).toContain('"a/b": ["b@file:vendor/b", {}]');
+  });
+
+  it("a path without .. is resolved from the declaring package, not from the project root", async () => {
+    const { packageDir, packageJson } = await registry.createTestDir({
+      bunfigOpts: { linker: "hoisted" },
+      files: {
+        "vendor/a/package.json": pkg("a", "1.0.0", { b: "file:./b" }),
+        "vendor/a/b/package.json": pkg("b", "1.0.0"),
+        // same relative path from the project root
+        "b/package.json": pkg("b", "9.9.9"),
+        "vendor/b2/package.json": pkg("b", "2.0.0"),
+        "package.json": app({ b: "file:./vendor/b2" }),
+      },
+    });
+    const run = makeInstallRunner(packageDir);
+
+    await run(["install"]);
+    await write(packageJson, app());
+    await run(["install"]);
+    expect(await file(join(packageDir, "bun.lock")).text()).toContain('"a/b": ["b@file:vendor/a/b", {}]');
+    expect(await installedVersion(packageDir, "node_modules", "a", "node_modules", "b")).toBe("1.0.0");
+  });
+
+  it("bun update <name> re-resolves the file: package's dependency", async () => {
+    const { packageDir } = await registry.createTestDir({
+      bunfigOpts: { linker: "hoisted" },
+      files: { ...vendored, "package.json": app() },
+    });
+    const run = makeInstallRunner(packageDir);
+
+    await run(["install"]);
+    const lockfile = await file(join(packageDir, "bun.lock")).text();
+    expect(lockfile).toContain('"a/b": ["b@file:vendor/b", {}]');
+
+    await run(["update", "b"]);
+    expect(await file(join(packageDir, "bun.lock")).text()).toBe(lockfile);
+    expect(await installedVersion(packageDir, "node_modules", "a", "node_modules", "b")).toBe("1.0.0");
+  });
+
+  it("removing an override resolves a workspace's file: dependency relative to the workspace again", async () => {
+    const workspaceRoot = (overrides?: Record<string, string>) =>
+      JSON.stringify({ name: "app", workspaces: ["packages/*"], overrides });
+    const { packageDir, packageJson } = await registry.createTestDir({
+      bunfigOpts: { linker: "hoisted" },
+      files: {
+        "packages/ws1/package.json": pkg("ws1", "1.0.0", { b: "file:../../vendor/b" }),
+        "vendor/b/package.json": pkg("b", "1.0.0"),
+        "vendor/b2/package.json": pkg("b", "2.0.0"),
+        "package.json": workspaceRoot({ b: "file:./vendor/b2" }),
+      },
+    });
+    const run = makeInstallRunner(packageDir);
+
+    await run(["install"]);
+    expect(await file(join(packageDir, "bun.lock")).text()).toContain('"ws1/b": ["b@file:vendor/b2", {}]');
+
+    await write(packageJson, workspaceRoot());
+    await run(["install"]);
+    const lockfile = await file(join(packageDir, "bun.lock")).text();
+    expect(lockfile).toContain('"b": "file:../../vendor/b"');
+    expect(lockfile).toContain('"ws1/b": ["b@file:vendor/b", {}]');
+    expect(await installedVersion(packageDir, "packages", "ws1", "node_modules", "b")).toBe("1.0.0");
+    await run(["install", "--frozen-lockfile"]);
+  });
+});
diff --git a/test/cli/install/migration/__snapshots__/pnpm-lock-v9.test.ts.snap b/test/cli/install/migration/__snapshots__/pnpm-lock-v9.test.ts.snap
index 7c9edc41e8a4..8f622d8afc82 100644
--- a/test/cli/install/migration/__snapshots__/pnpm-lock-v9.test.ts.snap
+++ b/test/cli/install/migration/__snapshots__/pnpm-lock-v9.test.ts.snap
@@ -42,7 +42,7 @@ exports[`pnpm-lock.yaml v9 snapshot alias whose dep-path version is a file: dire
   "packages": {
     "fork": ["bar@github:o/bar#aeb6b15f9c9957c8fa56f9731e914c4d8a6d2f2b", {}, ""],
 
-    "outer": ["outer@file:outer", { "dependencies": { "config": "file:shared/config", "fork": "https://codeload.github.com/o/bar/tar.gz/aeb6b15f9c9957c8fa56f9731e914c4d8a6d2f2b" } }],
+    "outer": ["outer@file:outer", { "dependencies": { "config": "file:../shared/config", "fork": "https://codeload.github.com/o/bar/tar.gz/aeb6b15f9c9957c8fa56f9731e914c4d8a6d2f2b" } }],
 
     "outer/config": ["hi2@file:shared/config", {}],
   }
diff --git a/test/cli/install/migration/migrate.test.ts b/test/cli/install/migration/migrate.test.ts
index 9d196aca88bf..a351d82f8bc4 100644
--- a/test/cli/install/migration/migrate.test.ts
+++ b/test/cli/install/migration/migrate.test.ts
@@ -276,6 +276,49 @@ test("npm lockfile migration skips extraneous packages that also declare inBundl
   expect(fs.existsSync(join(testDir, "bun.lock"))).toBeTrue();
 });
 
+test("bun update <name> re-resolves a file: dependency of a file: package in the same run as the migration", async () => {
+  // package-lock.json (as `npm install --package-lock-only` writes it) keeps `b` the way
+  // vendor/a/package.json declares it, relative to vendor/a. Updating `b` resolves that row again
+  // straight from the migrated lockfile, so it has to be looked up from vendor/a, not the project.
+  await using testDir = tempDir("migrate-nested-file-dep", {
+    "package.json": JSON.stringify({ name: "app", dependencies: { a: "file:./vendor/a" } }),
+    "vendor/a/package.json": JSON.stringify({ name: "a", version: "1.0.0", dependencies: { b: "file:../b" } }),
+    "vendor/b/package.json": JSON.stringify({ name: "b", version: "1.0.0" }),
+    "package-lock.json": JSON.stringify({
+      name: "app",
+      lockfileVersion: 3,
+      requires: true,
+      packages: {
+        "": { name: "app", dependencies: { a: "file:./vendor/a" } },
+        "node_modules/a": { resolved: "vendor/a", link: true },
+        "node_modules/b": { resolved: "vendor/b", link: true },
+        "vendor/a": { version: "1.0.0", dependencies: { b: "file:../b" } },
+        "vendor/b": { version: "1.0.0" },
+      },
+    }),
+  });
+
+  await using proc = Bun.spawn({
+    cmd: [bunExe(), "update", "b"],
+    cwd: String(testDir),
+    env: bunEnv,
+    stdout: "ignore",
+    stderr: "pipe",
+  });
+  const [stderr, exitCode] = await Promise.all([proc.stderr.text(), proc.exited]);
+  expect(stderr).toContain("migrated lockfile from package-lock.json");
+  expect(stderr).not.toContain("error:");
+  expect(exitCode).toBe(0);
+
+  const bunLock = await Bun.file(join(testDir, "bun.lock")).text();
+  expect(bunLock).toContain(`"a": ["a@file:vendor/a", { "dependencies": { "b": "file:../b" } }]`);
+  expect(bunLock).toContain(`"a/b": ["b@file:vendor/b", {}]`);
+  expect(await Bun.file(join(testDir, "node_modules", "a", "node_modules", "b", "package.json")).json()).toEqual({
+    name: "b",
+    version: "1.0.0",
+  });
+});
+
 test("package-lock.json migration requires integrity for tarball URLs outside the configured registry", async () => {
   // A package-lock.json entry whose `resolved` tarball URL points outside the configured
   // registry and that carries no `integrity` field must not be imported as-is. The bun.lock
diff --git a/test/cli/install/migration/pnpm-lock-v9.test.ts b/test/cli/install/migration/pnpm-lock-v9.test.ts
index 5beb161d199a..a79133b5a07c 100644
--- a/test/cli/install/migration/pnpm-lock-v9.test.ts
+++ b/test/cli/install/migration/pnpm-lock-v9.test.ts
@@ -1137,7 +1137,8 @@ snapshots:
     expect(exitCode).toBe(0);
 
     const bunLock = await bunLockOf(String(dir));
-    expect(bunLock).toContain(`"config": "file:shared/config"`);
+    // as outer/package.json declares it, not pnpm's lockfile-relative `file:shared/config`
+    expect(bunLock).toContain(`"config": "file:../shared/config"`);
     expect(bunLock).toContain(
       `"fork": "https://codeload.github.com/o/bar/tar.gz/aeb6b15f9c9957c8fa56f9731e914c4d8a6d2f2b"`,
     );
@@ -1219,8 +1220,15 @@ snapshots:
 
     const bunLock = await bunLockOf(String(dir));
     expect(bunLock).toContain(`"sub-dep": "file:./sub-dep"`);
-    expect(bunLock).toContain(`["sub-dep@file:sub-dep", { "dependencies": { "nested-child": "file:sub-dep/child" } }]`);
+    // pnpm-lock.yaml has `nested-child: file:sub-dep/child`; bun.lock stores the path relative to
+    // sub-dep, the way sub-dep/package.json declares it, and resolves it from there when loaded.
+    expect(bunLock).toContain(`["sub-dep@file:sub-dep", { "dependencies": { "nested-child": "file:child" } }]`);
     expect(bunLock).toContain(`["nested-child@file:sub-dep/child", {}]`);
+
+    const update = await run(String(dir), "update", "nested-child");
+    expect(update.stderr).not.toContain("error:");
+    expect(update.exitCode).toBe(0);
+    expect(await bunLockOf(String(dir))).toBe(bunLock);
   });
 
   test.concurrent("codeload tarballs with and without gitHosted: true", async () => {

From 0782bd8f615eeae550bcadfbb2313dfdeba2c799 Mon Sep 17 00:00:00 2001
From: robobun <117481402+robobun@users.noreply.github.com>
Date: Mon, 17 Aug 2026 01:25:41 +0000
Subject: [PATCH 096/258] install: link file: dependencies of registry packages
 from inside the package with the isolated linker (#38856)

---
 src/install/isolated_install.rs               | 166 +++++++++-
 src/install/isolated_install/Installer.rs     |  57 +++-
 src/install/isolated_install/Store.rs         |   6 +
 src/install/prune.rs                          |   6 +-
 test/cli/install/bun-prune.test.ts            |  24 ++
 test/cli/install/isolated-install.test.ts     | 300 ++++++++++++++++++
 .../create-file-dep-with-peer-packages.ts     |  67 ++++
 .../file-dep-with-peer-on-files-1.0.0.tgz     | Bin 0 -> 297 bytes
 .../file-dep-with-peer-on-files/package.json  |  23 ++
 .../packages/peer-on-files/package.json       |  27 ++
 .../peer-on-files/peer-on-files-1.0.0.tgz     | Bin 0 -> 313 bytes
 11 files changed, 661 insertions(+), 15 deletions(-)
 create mode 100644 test/cli/install/registry/packages/create-file-dep-with-peer-packages.ts
 create mode 100644 test/cli/install/registry/packages/file-dep-with-peer-on-files/file-dep-with-peer-on-files-1.0.0.tgz
 create mode 100644 test/cli/install/registry/packages/file-dep-with-peer-on-files/package.json
 create mode 100644 test/cli/install/registry/packages/peer-on-files/package.json
 create mode 100644 test/cli/install/registry/packages/peer-on-files/peer-on-files-1.0.0.tgz

diff --git a/src/install/isolated_install.rs b/src/install/isolated_install.rs
index 1e93f5542f9b..ddbda644a33b 100644
--- a/src/install/isolated_install.rs
+++ b/src/install/isolated_install.rs
@@ -225,6 +225,98 @@ pub(crate) enum Timings {
     Quiet,
 }
 
+/// `dep` is a `file:` dependency whose path is relative to the package declaring it
+/// (resolved as `declarer`): `Package::from_npm` stores these paths as declared,
+/// `Package::parse` and `overrides` store top-level relative ones. Such a folder is
+/// linked from inside the package and is not a peer provider for the packages below.
+fn dependency_is_contained_folder(
+    lockfile: &Lockfile,
+    declarer: &Resolution,
+    dep: &install::Dependency,
+) -> bool {
+    if matches!(
+        declarer.tag,
+        ResolutionTag::Root | ResolutionTag::Workspace | ResolutionTag::Folder
+    ) || dep.version.tag != VersionTag::Folder
+    {
+        return false;
+    }
+    let string_buf = lockfile.buffers.string_bytes.as_slice();
+    !lockfile
+        .overrides
+        .contains_name(dep.name_hash, dep.name.slice(string_buf), string_buf)
+}
+
+/// `dependency_is_contained_folder` evaluated once for the whole lockfile.
+struct ContainedFolders {
+    /// Indexed by `DependencyID`.
+    dependencies: DynamicBitSet,
+    /// Indexed by `PackageID`: folders only such dependencies resolve to. They get
+    /// no store entry (`store::entry::Entry::nested_folder`).
+    packages: DynamicBitSet,
+}
+
+fn contained_folders(lockfile: &Lockfile) -> Result<ContainedFolders, AllocError> {
+    let pkgs = lockfile.packages.slice();
+    let pkg_resolutions = pkgs.items_resolution();
+    let resolutions = &lockfile.buffers.resolutions[..];
+    let dependencies = &lockfile.buffers.dependencies[..];
+
+    let mut contained = ContainedFolders {
+        dependencies: DynamicBitSet::init_empty(dependencies.len())?,
+        packages: DynamicBitSet::init_empty(pkg_resolutions.len())?,
+    };
+    for (pkg_id, pkg_res) in pkg_resolutions.iter().enumerate() {
+        if pkg_res.tag == ResolutionTag::Folder {
+            contained.packages.set(pkg_id);
+        }
+    }
+    if contained.packages.count() == 0 {
+        return Ok(contained);
+    }
+
+    for (pkg_id, pkg_deps) in pkgs.items_dependencies().iter().enumerate() {
+        for dep_id in pkg_deps.begin()..pkg_deps.end() {
+            let target = resolutions[dep_id as usize];
+            if target == invalid_package_id
+                || target as usize >= pkg_resolutions.len()
+                || pkg_resolutions[target as usize].tag != ResolutionTag::Folder
+            {
+                continue;
+            }
+            if dependency_is_contained_folder(
+                lockfile,
+                &pkg_resolutions[pkg_id],
+                &dependencies[dep_id as usize],
+            ) {
+                contained.dependencies.set(dep_id as usize);
+            } else {
+                contained.packages.unset(target as usize);
+            }
+        }
+    }
+
+    Ok(contained)
+}
+
+/// `pkg_id` has a `dependency_is_contained_folder` dependency resolving to `folder_pkg_id`.
+pub(crate) fn folder_is_inside_package(
+    lockfile: &Lockfile,
+    pkg_id: PackageID,
+    folder_pkg_id: PackageID,
+) -> bool {
+    let pkgs = lockfile.packages.slice();
+    let declarer = &pkgs.items_resolution()[pkg_id as usize];
+    let pkg_deps = pkgs.items_dependencies()[pkg_id as usize];
+    let resolutions = &lockfile.buffers.resolutions[..];
+    let dependencies = &lockfile.buffers.dependencies[..];
+
+    (pkg_deps.begin()..pkg_deps.end()).any(|dep_id| {
+        resolutions[dep_id as usize] == folder_pkg_id
+            && dependency_is_contained_folder(lockfile, declarer, &dependencies[dep_id as usize])
+    })
+}
+
 pub(crate) fn build_store(
     manager: &PackageManager,
     lockfile: &Lockfile,
@@ -243,6 +335,9 @@ pub(crate) fn build_store(
     let dependencies = &lockfile.buffers.dependencies[..];
     let string_buf = &lockfile.buffers.string_bytes[..];
 
+    let contained = contained_folders(lockfile)?;
+    let is_contained_folder = |dep_id: DependencyID| contained.dependencies.is_set(dep_id as usize);
+
     let mut nodes: store::node::List = store::node::List::default();
 
     // DFS so a deduplicated node's full subtree (and therefore its `peers`)
@@ -301,7 +396,8 @@ pub(crate) fn build_store(
 
         // Per-package bits computed once: own peer-dep names, and non-peer
         // dependency names that will appear in `node_dependencies` (i.e., not
-        // filtered out by bundled/disabled/unresolved).
+        // filtered out by bundled/disabled/unresolved) and are peer providers for
+        // the packages below (contained folders are not, see the walk below).
         let own_peers: DynamicBitSetList =
             DynamicBitSetList::init_empty(lockfile.packages.len(), peer_name_count as usize)?;
         let provides: DynamicBitSetList =
@@ -317,15 +413,17 @@ pub(crate) fn build_store(
                 };
                 if dep.behavior.is_peer() {
                     own_peers.set(pkg_id as usize, bit);
-                } else if !is_filtered_dependency_or_workspace(
-                    dep_id,
-                    pkg_id,
-                    workspace_filters,
-                    install_root_dependencies,
-                    manager,
-                    lockfile,
-                    resolutions,
-                ) {
+                } else if !is_contained_folder(dep_id)
+                    && !is_filtered_dependency_or_workspace(
+                        dep_id,
+                        pkg_id,
+                        workspace_filters,
+                        install_root_dependencies,
+                        manager,
+                        lockfile,
+                        resolutions,
+                    )
+                {
                     provides.set(pkg_id as usize, bit);
                 }
             }
@@ -516,6 +614,7 @@ pub(crate) fn build_store(
                                         for ids in &node_dependencies[curr_id.get() as usize] {
                                             if dependencies[ids.dep_id as usize].name_hash
                                                 == peer_name_hash
+                                                && !is_contained_folder(ids.dep_id)
                                             {
                                                 break 'resolved ids.pkg_id;
                                             }
@@ -593,7 +692,9 @@ pub(crate) fn build_store(
                         let mut curr_id = entry.parent_id;
                         'walk: while curr_id != store::node::Id::INVALID {
                             for ids in &node_dependencies[curr_id.get() as usize] {
-                                if dependencies[ids.dep_id as usize].name_hash == peer_name_hash {
+                                if dependencies[ids.dep_id as usize].name_hash == peer_name_hash
+                                    && !is_contained_folder(ids.dep_id)
+                                {
                                     break 'walk;
                                 }
                             }
@@ -758,6 +859,11 @@ pub(crate) fn build_store(
                             continue;
                         }
 
+                        // private to the ancestor; a package's own one still satisfies its own peer
+                        if curr_id != node_id && is_contained_folder(ids.dep_id) {
+                            continue;
+                        }
+
                         let res = &pkg_resolutions[ids.pkg_id as usize];
 
                         if peer_dep.version.tag != VersionTag::Npm || res.tag != ResolutionTag::Npm
@@ -1019,8 +1125,11 @@ pub(crate) fn build_store(
 
         let new_entry_parents: Vec<store::entry::Id> = vec![entry.entry_parent_id];
 
+        // never hoisted, so it must not claim the hoist slots for its name below
+        let new_entry_nested_folder = contained.packages.is_set(pkg_id as usize);
+
         let hoisted = 'hoisted: {
-            if !manager.options.hoist {
+            if !manager.options.hoist || new_entry_nested_folder {
                 break 'hoisted false;
             }
 
@@ -1051,6 +1160,7 @@ pub(crate) fn build_store(
             parents: new_entry_parents,
             peer_hash: new_entry_peer_hash,
             hoisted,
+            nested_folder: new_entry_nested_folder,
             step: core::sync::atomic::AtomicU32::new(0),
             entry_hash: 0,
             scripts: core::cell::Cell::new(None),
@@ -1092,7 +1202,7 @@ pub(crate) fn build_store(
                             .name
                             .slice(string_buf);
                         public_hoisted.put(dep_name, ())?;
-                    } else {
+                    } else if !new_entry_nested_folder {
                         // transitive dependencies (also direct dependencies of workspaces!)
                         let dep_name = dependencies[new_entry_dep_id as usize]
                             .name
@@ -1122,6 +1232,10 @@ pub(crate) fn build_store(
             peers: node_peers[entry.node_id.get() as usize].clone(),
         });
 
+        debug_assert!(
+            !new_entry_nested_folder || node_nodes[entry.node_id.get() as usize].is_empty(),
+            "a folder declared by a remote package is resolved without dependencies"
+        );
         for &child_node_id in &node_nodes[entry.node_id.get() as usize] {
             entry_queue.write_item(QueuedEntry {
                 node_id: child_node_id,
@@ -1985,6 +2099,7 @@ pub(crate) fn install_isolated_packages(
         let entry_steps = entries.items_step();
         let entry_dependencies = entries.items_dependencies();
         let entry_hoisted = entries.items_hoisted();
+        let entry_nested_folder = entries.items_nested_folder();
 
         // Reborrow through a
         // `BackRef` so `string_buf` / `pkgs` don't tie up `&mut lockfile` for
@@ -2219,6 +2334,31 @@ pub(crate) fn install_isolated_packages(
                     continue;
                 }
                 ResolutionTag::Folder => {
+                    if entry_nested_folder[entry_id.get() as usize] {
+                        // linked by the packages containing it (`Installer::symlink_dependencies`)
+                        debug_assert!(entry_dependencies[entry_id.get() as usize].list.is_empty());
+                        let folder = pkg_res.folder().slice(string_buf);
+                        let state = if crate::bin::bin_target_escapes_package_dir(folder) {
+                            // the resolver rejects these; only an edited or old lockfile gets here
+                            Output::err_generic(
+                                "refusing to install dependency <b>{}<r> with unsafe folder path \"{}\"",
+                                (BStr::new(pkg_name.slice(string_buf)), BStr::new(folder)),
+                            );
+                            Output::flush();
+                            if installer.manager().options.enable.fail_early() {
+                                Global::exit(1);
+                            }
+                            installer::CompleteState::Fail
+                        } else {
+                            installer::CompleteState::Skipped
+                        };
+                        // .monotonic is okay because the task isn't running on another thread.
+                        entry_steps[entry_id.get() as usize]
+                            .store(installer::Step::Done as u32, Ordering::Relaxed);
+                        installer.on_task_complete(entry_id, state);
+                        continue;
+                    }
+
                     // folders are always hardlinked to keep them up-to-date
                     installer.start_task(entry_id);
                     continue;
diff --git a/src/install/isolated_install/Installer.rs b/src/install/isolated_install/Installer.rs
index 3be474cde889..4f98208fff2c 100644
--- a/src/install/isolated_install/Installer.rs
+++ b/src/install/isolated_install/Installer.rs
@@ -2340,8 +2340,32 @@ impl<'a> Installer<'a> {
             dest.set_length(base_len);
             append_dependency_link_name(&mut dest, dep_name, entry_node_modules_name);
 
+            let dep_node_id = self.store.entries.items_node_id()[dep.entry_id.get() as usize];
+            let dep_pkg_id = self.store.nodes.items_pkg_id()[dep_node_id.get() as usize];
+            let dep_res = &pkg_resolutions[dep_pkg_id as usize];
+            let folder_is_inside_this_package = dep_res.tag == ResolutionTag::Folder
+                && super::folder_is_inside_package(lockfile, pkg_id, dep_pkg_id);
+            let dep_is_nested_folder =
+                self.store.entries.items_nested_folder()[dep.entry_id.get() as usize];
+            // `build_store` only binds a nested folder to the packages containing it.
+            debug_assert!(folder_is_inside_this_package || !dep_is_nested_folder);
+
             let mut dep_store_path = AutoAbsPath::init_top_level_dir();
-            if uses_global_store {
+            if folder_is_inside_this_package {
+                let Some(package_dir_name) = entry_node_modules_name else {
+                    continue;
+                };
+                if !self.append_nested_folder_path(
+                    &mut dep_store_path,
+                    entry_id,
+                    package_dir_name,
+                    dep_res.folder().slice(string_buf),
+                )? {
+                    continue;
+                }
+            } else if dep_is_nested_folder {
+                continue;
+            } else if uses_global_store {
                 debug_assert!(self.entry_uses_global_store(dep.entry_id));
                 self.append_real_store_path(&mut dep_store_path, dep.entry_id, Which::Final);
             } else {
@@ -2947,6 +2971,37 @@ impl<'a> Installer<'a> {
         }
     }
 
+    /// Appends `<entry's store node_modules>/<package_dir_name>/<folder>` to `buf`.
+    /// `Ok(false)`: nothing to link (the path leaves the package, or no such directory).
+    fn append_nested_folder_path(
+        &self,
+        buf: &mut AutoAbsPath,
+        entry_id: StoreEntryId,
+        package_dir_name: &[u8],
+        folder: &[u8],
+    ) -> sys::Result<bool> {
+        if bin_real::bin_target_escapes_package_dir(folder) {
+            return Ok(false);
+        }
+
+        self.append_real_store_node_modules_path(buf, entry_id, Which::Staging);
+        buf.append(package_dir_name).assume_ok();
+        // `folder` comes from a third-party manifest, so its length is unchecked.
+        if buf.len() + 1 + folder.len() >= paths::MAX_PATH_BYTES {
+            return Err(sys::Error::from_code(
+                sys::Errno::ENAMETOOLONG,
+                sys::Tag::fstatat,
+            ));
+        }
+        buf.append_join(folder).assume_ok();
+
+        match sys::directory_exists_at(Fd::cwd(), buf.slice_z()) {
+            Ok(is_dir) => Ok(is_dir),
+            Err(err) if err.get_errno() == sys::Errno::ENOTDIR => Ok(false),
+            Err(err) => Err(err),
+        }
+    }
+
     /// The directory name for the entry store node_modules install
     /// folder.
     /// ./node_modules/.bun/jquery@3.7.1/node_modules/jquery
diff --git a/src/install/isolated_install/Store.rs b/src/install/isolated_install/Store.rs
index 25be802357ff..1c09a983d0ee 100644
--- a/src/install/isolated_install/Store.rs
+++ b/src/install/isolated_install/Store.rs
@@ -283,6 +283,10 @@ pub mod entry {
         // if true this entry gets symlinked to `node_modules/.bun/node_modules`
         pub hoisted: bool,
 
+        /// Exists only inside the packages declaring it (`isolated_install::ContainedFolders`):
+        /// no store directory, task or hoist slot; linked in `Installer::symlink_dependencies`.
+        pub nested_folder: bool,
+
         pub peer_hash: PeerHash,
 
         /// Content hash of (package + sorted resolved dependency global-store keys),
@@ -313,6 +317,7 @@ pub mod entry {
             parents: Vec<Id>,
             step: core::sync::atomic::AtomicU32,
             hoisted: bool,
+            nested_folder: bool,
             peer_hash: PeerHash,
             entry_hash: u64,
             scripts: core::cell::Cell<Option<*mut package::scripts::List>>,
@@ -328,6 +333,7 @@ pub mod entry {
                 // `Step::LinkPackage as u32 == 0`.
                 step: core::sync::atomic::AtomicU32::new(0),
                 hoisted: false,
+                nested_folder: false,
                 peer_hash: PeerHash::NONE,
                 entry_hash: 0,
                 scripts: core::cell::Cell::new(None),
diff --git a/src/install/prune.rs b/src/install/prune.rs
index 1684eae0de35..a92cbf3dc748 100644
--- a/src/install/prune.rs
+++ b/src/install/prune.rs
@@ -1553,11 +1553,15 @@ fn push_store_entry_names(
 ) {
     let pkg_res = lockfile.packages.items_resolution();
     let node_pkg_ids = store.nodes.items_pkg_id();
+    let entry_nested_folder = store.entries.items_nested_folder();
     names.reserve(store.entries.len());
     let mut name: Vec<u8> = Vec::new();
     for (entry_idx, node_id) in store.entries.items_node_id().iter().enumerate() {
         let pkg_id = node_pkg_ids[node_id.get() as usize] as usize;
-        if pkg_res[pkg_id].tag == ResolutionTag::Workspace || !wanted.is_set(pkg_id) {
+        if pkg_res[pkg_id].tag == ResolutionTag::Workspace
+            || entry_nested_folder[entry_idx]
+            || !wanted.is_set(pkg_id)
+        {
             continue;
         }
         name.clear();
diff --git a/test/cli/install/bun-prune.test.ts b/test/cli/install/bun-prune.test.ts
index dfb447a0b147..9b5420819412 100644
--- a/test/cli/install/bun-prune.test.ts
+++ b/test/cli/install/bun-prune.test.ts
@@ -2727,6 +2727,30 @@ test.concurrent(
   },
 );
 
+test.concurrent(
+  "isolated: a file: dependency declared by a registry package is not a store entry, a leftover one is removed",
+  async () => {
+    // file-dep@1.0.0 declares `"files": "file:./the-files"`; the installer links the
+    // folder inside the package's own store entry instead of creating one for it.
+    const dir = await setupWithLinker("isolated", { name: "foo", dependencies: { "file-dep": "1.0.0" } });
+    expect(storeEntries(dir)).toStrictEqual(["file-dep@1.0.0"]);
+    const filesLink = join(dir, "node_modules", ".bun", "file-dep@1.0.0", "node_modules", "files");
+    expect(isSymlink(filesLink)).toBeTrue();
+    plant(dir, "node_modules/.bun/files@file+.+the-files/node_modules/files");
+
+    const { stdout, stderr, exitCode } = await prune(dir, "--linker", "isolated");
+    expect(stderr).not.toContain("warn:");
+    expect(lines(stdout)).toContain("- files@file+.+the-files");
+    expect(exitCode).toBe(0);
+    expect(storeEntries(dir)).toStrictEqual(["file-dep@1.0.0"]);
+    expect(existsSync(join(filesLink, "package.json"))).toBeTrue();
+
+    const again = await prune(dir, "--linker", "isolated");
+    expect(out(again.stdout)).toEndWith(NOTHING(2, 2));
+    expect(again.exitCode).toBe(0);
+  },
+);
+
 test.concurrent(
   "workspaces: without --linker, a bun.lock with configVersion 1 is pruned with the isolated linker",
   async () => {
diff --git a/test/cli/install/isolated-install.test.ts b/test/cli/install/isolated-install.test.ts
index 044c82f512c9..f153ab3566a8 100644
--- a/test/cli/install/isolated-install.test.ts
+++ b/test/cli/install/isolated-install.test.ts
@@ -464,6 +464,306 @@ describe("link: dependencies", () => {
   });
 });
 
+// A `file:` dependency declared by a registry package points at a folder inside
+// that package (the same fixtures as "transitive file dependencies" in
+// bun-install-registry.test.ts, which covers the hoisted linker).
+describe("transitive file dependencies of registry packages", () => {
+  const dependencies = {
+    // depends on file-dep@1.0.0
+    "dep-file-dep": "1.0.0",
+    // "files": "file:./the-files"
+    "file-dep": "1.0.0",
+    // "files": "file:./missing-folder", which is not in the tarball
+    "missing-file-dep": "1.0.0",
+    // file-dep@1.0.1 has "files": "file:."
+    "aliased-file-dep": "npm:file-dep@1.0.1",
+    // both have "@scoped/files": "file:./the-files", so bun.lock holds one
+    // folder package with two dependents
+    "@scoped/file-dep": "1.0.0",
+    "@another-scope/file-dep": "1.0.0",
+    // "self-file-dep": "file:."
+    "self-file-dep": "1.0.0",
+  };
+
+  const storeEntries = [
+    "@another-scope+file-dep@1.0.0",
+    "@scoped+file-dep@1.0.0",
+    "dep-file-dep@1.0.0",
+    "file-dep@1.0.0",
+    "file-dep@1.0.1",
+    "missing-file-dep@1.0.0",
+    "node_modules",
+    "self-file-dep@1.0.0",
+  ];
+
+  async function checkStore(packageDir: string) {
+    const bunDir = join(packageDir, "node_modules", ".bun");
+    const storePackage = (entry: string, ...name: string[]) => join(bunDir, entry, "node_modules", ...name);
+
+    // the folders never become store entries of their own
+    expect(await readdirSorted(bunDir)).toEqual(storeEntries);
+
+    expect([
+      readlinkSync(storePackage("file-dep@1.0.0", "files")),
+      readlinkSync(storePackage("file-dep@1.0.1", "files")),
+      readlinkSync(storePackage("@scoped+file-dep@1.0.0", "@scoped", "files")),
+      readlinkSync(storePackage("@another-scope+file-dep@1.0.0", "@scoped", "files")),
+      readlinkSync(storePackage("self-file-dep@1.0.0", "self-file-dep", "node_modules", "self-file-dep")),
+      await readdirSorted(storePackage("missing-file-dep@1.0.0")),
+      await readdirSorted(storePackage("dep-file-dep@1.0.0")),
+    ]).toEqual([
+      join("file-dep", "the-files"),
+      "file-dep",
+      join("file-dep", "the-files"),
+      join("..", "@another-scope", "file-dep", "the-files"),
+      "..",
+      ["missing-file-dep"],
+      ["dep-file-dep", "file-dep"],
+    ]);
+
+    expect(
+      await Promise.all([
+        file(storePackage("file-dep@1.0.0", "files", "package.json")).json(),
+        file(storePackage("file-dep@1.0.1", "files", "package.json")).json(),
+        file(storePackage("@another-scope+file-dep@1.0.0", "@scoped", "files", "index.js")).text(),
+        file(
+          storePackage("self-file-dep@1.0.0", "self-file-dep", "node_modules", "self-file-dep", "package.json"),
+        ).json(),
+      ]),
+    ).toEqual([
+      { name: "files", version: "1.1.1", dependencies: { "no-deps": "2.0.0" } },
+      { name: "file-dep", version: "1.0.1", dependencies: { files: "file:." } },
+      'console.log("hello files");',
+      { name: "self-file-dep", version: "1.0.0", dependencies: { "self-file-dep": "file:." } },
+    ]);
+
+    // the packages resolve their folders from their real location in the store
+    const fromFileDep = createRequire(storePackage("file-dep@1.0.0", "file-dep", "package.json"));
+    expect(fromFileDep.resolve("files")).toEndWith(
+      join(".bun", "file-dep@1.0.0", "node_modules", "file-dep", "the-files", "index.js"),
+    );
+    const fromMissingFileDep = createRequire(
+      storePackage("missing-file-dep@1.0.0", "missing-file-dep", "package.json"),
+    );
+    expect(() => fromMissingFileDep.resolve("files")).toThrow(expect.objectContaining({ code: "MODULE_NOT_FOUND" }));
+  }
+
+  test("are linked from inside the package that declares them", async () => {
+    const { packageJson, packageDir } = await registry.createTestDir({ bunfigOpts: { linker: "isolated" } });
+    await write(packageJson, JSON.stringify({ name: "transitive-file-deps", dependencies }));
+
+    let { out } = await runBunInstall(bunEnv, packageDir);
+    expect(out).toContain("7 packages installed");
+    await checkStore(packageDir);
+
+    // from bun.lock, where the two `@scoped/files` rows load as one package
+    await rm(join(packageDir, "node_modules"), { recursive: true, force: true });
+    ({ out } = await runBunInstall(bunEnv, packageDir, { savesLockfile: false }));
+    expect(out).toContain("7 packages installed");
+    await checkStore(packageDir);
+
+    // relinking an existing node_modules
+    ({ out } = await runBunInstall(bunEnv, packageDir, { savesLockfile: false }));
+    expect(out).toContain("no changes");
+    await checkStore(packageDir);
+  });
+
+  test("a folder declared by the root keeps its store entry when a registry package peer-depends on it", async () => {
+    const { packageJson, packageDir } = await registry.createTestDir({ bunfigOpts: { linker: "isolated" } });
+    await Promise.all([
+      write(
+        packageJson,
+        JSON.stringify({
+          name: "root-folder-satisfies-peer",
+          dependencies: {
+            // peerDependencies: { "no-deps": "*" }
+            "peer-deps": "1.0.0",
+            "no-deps": "file:./no-deps",
+          },
+        }),
+      ),
+      write(join(packageDir, "no-deps", "package.json"), JSON.stringify({ name: "no-deps", version: "9.9.9" })),
+    ]);
+
+    await runBunInstall(bunEnv, packageDir);
+
+    const bunDir = join(packageDir, "node_modules", ".bun");
+    const entries = await readdirSorted(bunDir);
+    expect(entries).toContain("no-deps@file+no-deps");
+    const peerDeps = entries.find(entry => entry.startsWith("peer-deps@1.0.0"))!;
+    expect(readlinkSync(join(bunDir, peerDeps, "node_modules", "no-deps"))).toBe(
+      join("..", "..", "no-deps@file+no-deps", "node_modules", "no-deps"),
+    );
+    expect(await file(join(bunDir, peerDeps, "node_modules", "no-deps", "package.json")).json()).toEqual({
+      name: "no-deps",
+      version: "9.9.9",
+    });
+  });
+
+  // file-dep-with-peer-on-files@1.0.0 declares `"files": "file:the-files"` and depends on
+  // peer-on-files@1.0.0, which has an optional peer on `files` and ships an unrelated
+  // the-files folder of its own (registry/packages/create-file-dep-with-peer-packages.ts).
+  test("a folder is not bound to a peer dependency below the package containing it", async () => {
+    const { packageJson, packageDir } = await registry.createTestDir({ bunfigOpts: { linker: "isolated" } });
+    await write(
+      packageJson,
+      JSON.stringify({ name: "contained-folder-peer", dependencies: { "file-dep-with-peer-on-files": "1.0.0" } }),
+    );
+
+    await runBunInstall(bunEnv, packageDir);
+
+    const bunDir = join(packageDir, "node_modules", ".bun");
+    const declaring = join(bunDir, "file-dep-with-peer-on-files@1.0.0", "node_modules");
+    const peer = join(bunDir, "peer-on-files@1.0.0", "node_modules");
+    expect(
+      await Promise.all([
+        readdirSorted(bunDir),
+        readdirSorted(declaring),
+        readlink(join(declaring, "files")),
+        file(join(declaring, "files", "index.js")).text(),
+        // nothing provides the peer, so it is not linked even though peer-on-files
+        // ships a folder with the declared path itself
+        readdirSorted(peer),
+      ]),
+    ).toEqual([
+      ["file-dep-with-peer-on-files@1.0.0", "node_modules", "peer-on-files@1.0.0"],
+      ["file-dep-with-peer-on-files", "files", "peer-on-files"],
+      join("file-dep-with-peer-on-files", "the-files"),
+      'module.exports = "the-files shipped by file-dep-with-peer-on-files";\n',
+      ["peer-on-files"],
+    ]);
+    const fromPeer = createRequire(join(peer, "peer-on-files", "package.json"));
+    expect(() => fromPeer.resolve("files")).toThrow(expect.objectContaining({ code: "MODULE_NOT_FOUND" }));
+  });
+
+  test("a folder the root also declares: the root links its store entry, the package links its own copy, fresh and from bun.lock", async () => {
+    const { packageJson, packageDir } = await registry.createTestDir({ bunfigOpts: { linker: "isolated" } });
+    await Promise.all([
+      write(
+        packageJson,
+        JSON.stringify({
+          name: "shared-folder-row",
+          dependencies: {
+            "file-dep-with-peer-on-files": "1.0.0",
+            // normalizes to the-files, the path the registry package declares, so the
+            // two rows load from bun.lock as one folder package
+            "files": "file:./the-files",
+          },
+        }),
+      ),
+      write(join(packageDir, "the-files", "package.json"), JSON.stringify({ name: "files", version: "2.0.0" })),
+      write(join(packageDir, "the-files", "index.js"), 'module.exports = "the-files in the project";\n'),
+    ]);
+
+    const bunDir = join(packageDir, "node_modules", ".bun");
+    async function checkLayout() {
+      const entries = await readdirSorted(bunDir);
+      const declaring = join(
+        bunDir,
+        entries.find(entry => entry.startsWith("file-dep-with-peer-on-files@"))!,
+        "node_modules",
+      );
+      const peer = join(bunDir, entries.find(entry => entry.startsWith("peer-on-files@"))!, "node_modules");
+      expect(
+        await Promise.all([
+          entries.map(entry => entry.replace(/\+[0-9a-f]{16}$/, "")),
+          readlink(join(packageDir, "node_modules", "files")),
+          file(join(packageDir, "node_modules", "files", "index.js")).text(),
+          readlink(join(declaring, "files")),
+          file(join(declaring, "files", "index.js")).text(),
+          // the peer is satisfied by the root's folder, not by the copy inside its parent
+          readlink(join(peer, "files")),
+          file(join(peer, "files", "index.js")).text(),
+        ]),
+      ).toEqual([
+        ["file-dep-with-peer-on-files@1.0.0", "files@file+the-files", "node_modules", "peer-on-files@1.0.0"],
+        join(".bun", "files@file+the-files", "node_modules", "files"),
+        'module.exports = "the-files in the project";\n',
+        join("file-dep-with-peer-on-files", "the-files"),
+        'module.exports = "the-files shipped by file-dep-with-peer-on-files";\n',
+        join("..", "..", "files@file+the-files", "node_modules", "files"),
+        'module.exports = "the-files in the project";\n',
+      ]);
+      return entries;
+    }
+
+    await runBunInstall(bunEnv, packageDir);
+    const fresh = await checkLayout();
+
+    await rm(join(packageDir, "node_modules"), { recursive: true, force: true });
+    await runBunInstall(bunEnv, packageDir, { savesLockfile: false });
+    expect(await checkLayout()).toEqual(fresh);
+  });
+
+  test("does not take the hoist slots of a real package with the same name", async () => {
+    const { packageJson, packageDir } = await registry.createTestDir({
+      bunfigOpts: { linker: "isolated", publicHoistPattern: ["files"] },
+    });
+    await Promise.all([
+      write(
+        packageJson,
+        JSON.stringify({
+          name: "folder-hoist-slots",
+          // file-dep's `files` folder entry is created before mid's `files` below
+          dependencies: { "file-dep": "1.0.0", "mid": "file:./mid" },
+        }),
+      ),
+      write(
+        join(packageDir, "mid", "package.json"),
+        JSON.stringify({ name: "mid", version: "1.0.0", dependencies: { files: "npm:no-deps@1.0.0" } }),
+      ),
+    ]);
+
+    await runBunInstall(bunEnv, packageDir);
+
+    const bunDir = join(packageDir, "node_modules", ".bun");
+    expect(
+      await Promise.all([
+        readdirSorted(bunDir),
+        // publicHoistPattern and the hidden fallback directory both hold no-deps
+        readlink(join(packageDir, "node_modules", "files")),
+        readdirSorted(join(bunDir, "node_modules")),
+        readlink(join(bunDir, "file-dep@1.0.0", "node_modules", "files")),
+        readlink(join(bunDir, "mid@file+mid", "node_modules", "files")),
+      ]),
+    ).toEqual([
+      ["file-dep@1.0.0", "mid@file+mid", "no-deps@1.0.0", "node_modules"],
+      join(".bun", "no-deps@1.0.0", "node_modules", "no-deps"),
+      ["file-dep", "no-deps"],
+      join("file-dep", "the-files"),
+      join("..", "..", "no-deps@1.0.0", "node_modules", "no-deps"),
+    ]);
+  });
+
+  test("a folder path escaping its package is refused when it comes from bun.lock", async () => {
+    const { packageJson, packageDir } = await registry.createTestDir({ bunfigOpts: { linker: "isolated" } });
+    await write(packageJson, JSON.stringify({ name: "escaping-folder", dependencies: { "file-dep": "1.0.0" } }));
+
+    // the resolver refuses to record such a path, so install first and edit bun.lock
+    await runBunInstall(bunEnv, packageDir);
+    const lockfile = join(packageDir, "bun.lock");
+    const contents = await file(lockfile).text();
+    expect(contents).toContain('"files@file:./the-files"');
+    const bunDir = join(packageDir, "node_modules", ".bun");
+    await Promise.all([
+      write(lockfile, contents.replace('"files@file:./the-files"', '"files@file:../../../the-files"')),
+      // exists, so only the refusal keeps it from being linked: ../../../the-files
+      // from .bun/file-dep@1.0.0/node_modules/file-dep is .bun/the-files
+      write(join(bunDir, "the-files", "package.json"), JSON.stringify({ name: "files" })),
+      rm(join(bunDir, "file-dep@1.0.0"), { recursive: true, force: true }),
+    ]);
+
+    const { out, err } = await runBunInstall(bunEnv, packageDir, {
+      allowErrors: true,
+      expectedExitCode: 1,
+      savesLockfile: false,
+    });
+    expect(err).toContain('error: refusing to install dependency files with unsafe folder path "../../../the-files"');
+    expect(out).toContain("Failed to install 1 package");
+    expect(await readdirSorted(join(bunDir, "file-dep@1.0.0", "node_modules"))).toEqual(["file-dep"]);
+  });
+});
+
 describe("isolated workspaces", () => {
   test("basic", async () => {
     const { packageJson, packageDir } = await registry.createTestDir({ bunfigOpts: { linker: "isolated" } });
diff --git a/test/cli/install/registry/packages/create-file-dep-with-peer-packages.ts b/test/cli/install/registry/packages/create-file-dep-with-peer-packages.ts
new file mode 100644
index 000000000000..e242cd749583
--- /dev/null
+++ b/test/cli/install/registry/packages/create-file-dep-with-peer-packages.ts
@@ -0,0 +1,67 @@
+#!/usr/bin/env bun
+/**
+ * Generates the fixtures for a registry package that declares a `file:`
+ * dependency while one of its dependencies peer-depends on the same name
+ * (isolated-install.test.ts, "transitive file dependencies of registry packages").
+ *
+ * - file-dep-with-peer-on-files@1.0.0  "files": "file:the-files", -> peer-on-files@1.0.0;
+ *                                      ships the-files/
+ * - peer-on-files@1.0.0                optional peer on "files"; also ships a the-files/
+ *                                      folder of its own, which nothing declares
+ *
+ * The `file:` path is written without `./` so that a root dependency on a folder
+ * named the-files (normalized to the same path) loads as the same bun.lock row.
+ */
+
+import { mkdir, writeFile } from "fs/promises";
+import { join } from "path";
+
+const packagesDir = import.meta.dir;
+
+const packages: Record<string, object> = {
+  "file-dep-with-peer-on-files": {
+    dependencies: { "files": "file:the-files", "peer-on-files": "1.0.0" },
+  },
+  "peer-on-files": {
+    peerDependencies: { files: "*" },
+    peerDependenciesMeta: { files: { optional: true } },
+  },
+};
+
+for (const [name, manifest] of Object.entries(packages)) {
+  const version = "1.0.0";
+  const dir = join(packagesDir, name);
+  await mkdir(dir, { recursive: true });
+
+  const pkgJson = { name, version, ...manifest };
+  const tarball = join(dir, `${name}-${version}.tgz`);
+  await Bun.Archive.write(
+    tarball,
+    {
+      "package/package.json": JSON.stringify(pkgJson, null, 2),
+      "package/the-files/package.json": JSON.stringify({ name: "files", version }, null, 2),
+      "package/the-files/index.js": `module.exports = "the-files shipped by ${name}";\n`,
+    },
+    { compress: "gzip" },
+  );
+
+  const bytes = await Bun.file(tarball).bytes();
+  const versions = {
+    [version]: {
+      ...pkgJson,
+      _id: `${name}@${version}`,
+      dist: {
+        integrity: `sha512-${Buffer.from(new Bun.CryptoHasher("sha512").update(bytes).digest()).toString("base64")}`,
+        shasum: new Bun.CryptoHasher("sha1").update(bytes).digest("hex"),
+        tarball: `http://localhost:4873/${name}/-/${name}-${version}.tgz`,
+      },
+    },
+  };
+
+  await writeFile(
+    join(dir, "package.json"),
+    JSON.stringify({ _id: name, name, "dist-tags": { latest: version }, versions }, null, 2),
+  );
+}
+
+console.log("Created file-dep-with-peer-on-files and peer-on-files test packages");
diff --git a/test/cli/install/registry/packages/file-dep-with-peer-on-files/file-dep-with-peer-on-files-1.0.0.tgz b/test/cli/install/registry/packages/file-dep-with-peer-on-files/file-dep-with-peer-on-files-1.0.0.tgz
new file mode 100644
index 0000000000000000000000000000000000000000..c17184d1ba85a04791eb28a9f0bfc4ae23aae395
GIT binary patch
literal 297
zcmV+^0oMK>iwFP!00000|LxY_PJ=KM2Jl|<6eqnFcFI4K86O76QJ7n4DAO6UcQ*tj
z%A&h)Vl?0H<|Iw?5dvRRSFG-fJ6X74Mr+?#b!N<*rz!Q5nWvLEj&m|uoH8eQp2fr_
zF@_bfn!(O@MXUJR&zip6AMqRzX<KYXFG=6l8wpEs;bYxZp%ZDt#)kc>*BAZ92WfrX
z*nY2xIO1Wo6eqS6yQ;<OCH0Xsg!#ABWmn0&AR_%SeGCkU4#7deOkR7x7{AXCoCK%(
z&sj3*e|nkc=>Hs!`u|zeQObYmxc{{+Wgo4*I-67dH=IrTZ_)()pTo8(cN>Xh@0zyr
vbWM8v6UbM!b5hdH6Mc0vxC#^i0000000000000000Q|NW*}ayK04M+eo3V@X

literal 0
HcmV?d00001

diff --git a/test/cli/install/registry/packages/file-dep-with-peer-on-files/package.json b/test/cli/install/registry/packages/file-dep-with-peer-on-files/package.json
new file mode 100644
index 000000000000..b0560b594807
--- /dev/null
+++ b/test/cli/install/registry/packages/file-dep-with-peer-on-files/package.json
@@ -0,0 +1,23 @@
+{
+  "_id": "file-dep-with-peer-on-files",
+  "name": "file-dep-with-peer-on-files",
+  "dist-tags": {
+    "latest": "1.0.0"
+  },
+  "versions": {
+    "1.0.0": {
+      "name": "file-dep-with-peer-on-files",
+      "version": "1.0.0",
+      "dependencies": {
+        "files": "file:the-files",
+        "peer-on-files": "1.0.0"
+      },
+      "_id": "file-dep-with-peer-on-files@1.0.0",
+      "dist": {
+        "integrity": "sha512-ZmSsoAZOGAqssZPTcwdidOg1673007uwXYBG+uFVMARB3y6sjupPm+jGh3/5+bT/Jdp2usHUQWLc1nvsXGBvfQ==",
+        "shasum": "904c29b2d64c8a863793d0615f735094687b64a1",
+        "tarball": "http://localhost:4873/file-dep-with-peer-on-files/-/file-dep-with-peer-on-files-1.0.0.tgz"
+      }
+    }
+  }
+}
\ No newline at end of file
diff --git a/test/cli/install/registry/packages/peer-on-files/package.json b/test/cli/install/registry/packages/peer-on-files/package.json
new file mode 100644
index 000000000000..1714a5bdbd09
--- /dev/null
+++ b/test/cli/install/registry/packages/peer-on-files/package.json
@@ -0,0 +1,27 @@
+{
+  "_id": "peer-on-files",
+  "name": "peer-on-files",
+  "dist-tags": {
+    "latest": "1.0.0"
+  },
+  "versions": {
+    "1.0.0": {
+      "name": "peer-on-files",
+      "version": "1.0.0",
+      "peerDependencies": {
+        "files": "*"
+      },
+      "peerDependenciesMeta": {
+        "files": {
+          "optional": true
+        }
+      },
+      "_id": "peer-on-files@1.0.0",
+      "dist": {
+        "integrity": "sha512-hzameqZFR3zTGv4G767dFQyyq7nfOp6BegLlAdadjl0APSDLELkgjWnG+KFApM4H0qPdymVCekdPESCB9fusjg==",
+        "shasum": "a95df32378fdf3bcd591969a2427b1cfca78a0d9",
+        "tarball": "http://localhost:4873/peer-on-files/-/peer-on-files-1.0.0.tgz"
+      }
+    }
+  }
+}
\ No newline at end of file
diff --git a/test/cli/install/registry/packages/peer-on-files/peer-on-files-1.0.0.tgz b/test/cli/install/registry/packages/peer-on-files/peer-on-files-1.0.0.tgz
new file mode 100644
index 0000000000000000000000000000000000000000..c9064b05401af0c76e0f8fb7a214fb17eea61c81
GIT binary patch
literal 313
zcmV-90ml9xiwFP!00000|LxXYOT#b}2H;%xR~&LFt~>q8pyHjk{)oCBUFVjBrjv>6
zze}wM>%?6+hsygvIW!+FrFlbqHGixgWa@_+FN3q{#F*LSIrWv9$CWuP3?)UHGiSyW
zDRGh|Nv4R^8EisVwTi#}uJOnH5ib#uw$)m6N!p9F6K5y)%}Rp4?7N<%4UMyXZxVCN
zLu)_qM!eWs?7WenOX?p)q=%^`=?fhZ?LHlSD_wOsW4I;K&UcNo)k>GtwHtYB-bMYj
zQ*dJMxu13m8Gic@>;%X1&qX%Me?Bt?`9Fuf{C|~ugzsNE%ztBR*~ZJDPUdL-&1{_i
zq)3tfb6C52vyxc0-nCtzYtkPpfx@EkUTV5~ru~z_Ripp_000000000000000;CFci
LFAd@^04M+eggloh

literal 0
HcmV?d00001


From 2a252183416c295688d922c83b4b0f2dc1d48e4a Mon Sep 17 00:00:00 2001
From: Jarred Sumner <jarred@jarredsumner.com>
Date: Mon, 17 Aug 2026 01:25:47 +0000
Subject: [PATCH 097/258] install: bound isolated store entry names; tarball
 URL credentials; file: tarballs relative to their folder package (#38867)

---
 docs/pm/cli/add.mdx                           |   2 +
 docs/pm/isolated-installs.mdx                 |   2 +
 src/install/NetworkTask.rs                    |  65 +++-
 .../PackageManager/PackageManagerEnqueue.rs   |  64 ++--
 src/install/PackageManagerTask.rs             |   7 +-
 src/install/isolated_install/Store.rs         |  67 +++-
 src/install/lockfile.rs                       |  10 +
 test/cli/install/bun-install.test.ts          | 322 ++++++++++++++++++
 test/cli/install/bun-workspaces.test.ts       |  41 +++
 test/cli/install/isolated-install.test.ts     | 320 ++++++++++++++++-
 10 files changed, 856 insertions(+), 44 deletions(-)

diff --git a/docs/pm/cli/add.mdx b/docs/pm/cli/add.mdx
index 57b35501f44e..ee2f201fdd58 100644
--- a/docs/pm/cli/add.mdx
+++ b/docs/pm/cli/add.mdx
@@ -233,6 +233,8 @@ bun add zod@https://registry.npmjs.org/zod/-/zod-3.21.4.tgz
 }
 ```
 
+A tarball URL can carry credentials, such as `https://user:password@example.com/zod-3.21.4.tgz`. Bun sends them as an `Authorization: Basic` header and requests the URL without them, like npm. The URL, credentials included, is written to `package.json` and to the lockfile.
+
 ---
 
 <Add />
diff --git a/docs/pm/isolated-installs.mdx b/docs/pm/isolated-installs.mdx
index c34d0cdf3c26..0f322aa295ba 100644
--- a/docs/pm/isolated-installs.mdx
+++ b/docs/pm/isolated-installs.mdx
@@ -85,6 +85,8 @@ node_modules/
 └── package-name -> .bun/package@1.0.0/node_modules/package  # Symlinks
 ```
 
+The part of a store directory name after `@` is the package's resolution. For a registry package, that is its version. For a folder, tarball, git, or GitHub dependency, Bun derives it from the path or URL (plus the commit), so it can be long. Bun writes at most 80 bytes of it: it cuts a longer resolution to at most 63 bytes and appends `+` and 16 hex digits derived from the full resolution. The path of a package inside the store is therefore at most `34 + 2 * <name length> + 80` characters longer than your project directory (17 more when the package has peer dependencies). This matters on Windows, where a path longer than 260 characters still works for Bun itself, but not as the working directory of the package's lifecycle scripts.
+
 ### Resolution algorithm
 
 1. **Central store** — Bun installs all packages in `node_modules/.bun/package@version/` directories
diff --git a/src/install/NetworkTask.rs b/src/install/NetworkTask.rs
index e1fd9aaa0a9e..c0724ac12e7a 100644
--- a/src/install/NetworkTask.rs
+++ b/src/install/NetworkTask.rs
@@ -409,6 +409,40 @@ fn count_auth(header_builder: &mut HeaderBuilder, scope: &npm::registry::Scope)
     header_builder.count("npm-auth-type", "legacy");
 }
 
+/// Splits `http://user:pass@host/pkg.tgz` into `user:pass` and
+/// `http://host/pkg.tgz`. `None` when the authority has no `@`; the `@` of a
+/// scoped package in the path (`/@scope/pkg/-/pkg.tgz`) is not one.
+fn split_url_userinfo(url: &[u8]) -> Option<(&[u8], Box<[u8]>)> {
+    let authority_start = strings::index_of(url, b"://")? + b"://".len();
+    let rest = &url[authority_start..];
+    let authority = &rest[..strings::index_of_any(rest, b"/?#").unwrap_or(rest.len())];
+    let at = strings::last_index_of_char(authority, b'@')?;
+
+    let mut without_userinfo = Vec::with_capacity(url.len() - (at + 1));
+    without_userinfo.extend_from_slice(&url[..authority_start]);
+    without_userinfo.extend_from_slice(&rest[at + 1..]);
+    Some((&rest[..at], without_userinfo.into_boxed_slice()))
+}
+
+/// `Basic base64(userinfo)`, the header npm sends for credentials embedded in a
+/// tarball URL: minipass-fetch (`getNodeRequestOptions` in `lib/request.js`)
+/// hands the URL's `username:password` to node's `auth` option as is, so
+/// nothing is percent-decoded here either, and a userinfo without a `:` is a
+/// username with an empty password.
+fn basic_authorization_from_userinfo(userinfo: &[u8]) -> Vec<u8> {
+    const SCHEME: &[u8] = b"Basic ";
+    let mut user_pass = Vec::with_capacity(userinfo.len() + 1);
+    user_pass.extend_from_slice(userinfo);
+    if !strings::contains_char(userinfo, b':') {
+        user_pass.push(b':');
+    }
+    let mut value = vec![0u8; SCHEME.len() + bun_core::base64::encode_len(&user_pass)];
+    value[..SCHEME.len()].copy_from_slice(SCHEME);
+    let encoded_len = bun_core::base64::encode(&mut value[SCHEME.len()..], &user_pass);
+    value.truncate(SCHEME.len() + encoded_len);
+    value
+}
+
 #[derive(thiserror::Error, Debug, strum::IntoStaticStr)]
 pub enum ForManifestError {
     #[error("OutOfMemory")]
@@ -799,6 +833,21 @@ impl NetworkTask {
             return Err(ForTarballError::InvalidURL);
         }
 
+        // `"dep": "https://user:pass@host/dep.tgz"`: the credentials become a
+        // header, as npm sends them, and the URL is requested without them.
+        // They cannot stay in the URL: `bun_url` keeps the userinfo in `origin`,
+        // and the HTTP client compares origins to decide whether `Authorization`
+        // follows a redirect, so a redirect to the same host would lose it.
+        let url_authorization: Option<Vec<u8>> = match split_url_userinfo(&self.url_buf) {
+            Some((userinfo, url_without_userinfo)) => {
+                let value =
+                    (!userinfo.is_empty()).then(|| basic_authorization_from_userinfo(userinfo));
+                self.url_buf = url_without_userinfo;
+                value
+            }
+            None => None,
+        };
+
         // Only attach the registry `Authorization` header when the tarball URL
         // origin matches the configured registry scope origin. The npm manifest
         // is registry-controlled, so a malicious registry could otherwise point
@@ -830,9 +879,23 @@ impl NetworkTask {
             count_auth(&mut header_builder, scope);
         }
 
+        // Same precedence as npm, where node derives `Authorization` from the
+        // URL only when the request does not carry one already: credentials
+        // configured for the registry win over the ones embedded in the URL.
+        let url_authorization = match url_authorization {
+            Some(value) if header_builder.header_count == 0 => {
+                header_builder.count("Authorization", &value);
+                Some(value)
+            }
+            _ => None,
+        };
+
         let header_buf: &'static [u8] = if header_builder.header_count > 0 {
             header_builder.allocate()?;
-            append_auth(&mut header_builder, scope);
+            match &url_authorization {
+                Some(value) => header_builder.append("Authorization", value),
+                None => append_auth(&mut header_builder, scope),
+            }
             debug_assert_eq!(header_builder.content.len, header_builder.content.cap);
             self.header_buf = header_builder.content.move_to_slice();
             // SAFETY: `self.header_buf` outlives the request; it is freed when the slot returns to the pool.
diff --git a/src/install/PackageManager/PackageManagerEnqueue.rs b/src/install/PackageManager/PackageManagerEnqueue.rs
index 6572676d7760..49be1eb3b5a0 100644
--- a/src/install/PackageManager/PackageManagerEnqueue.rs
+++ b/src/install/PackageManager/PackageManagerEnqueue.rs
@@ -1915,31 +1915,18 @@ fn enqueue_local_tarball(
     // other dependencies (e.g. `appendPackage` / `StringBuilder.allocate`
     // in `Package.fromNPM`).
     let mut abs_buf = PathBuffer::uninit();
-    let (tarball_path, normalize): (&[u8], bool) = 'tarball_path: {
-        let workspace_pkg_id = this
-            .lockfile
-            .get_workspace_pkg_if_workspace_dep(dependency_id);
-        if workspace_pkg_id == invalid_package_id {
-            break 'tarball_path (path, true);
-        }
-
-        let workspace_res = this.lockfile.packages.items_resolution()[workspace_pkg_id as usize];
-        if workspace_res.tag != ResolutionTag::Workspace {
-            break 'tarball_path (path, true);
-        }
-
-        // Construct an absolute path to the tarball.
-        // Normally tarball paths are always relative to the root directory, but if a
-        // workspace depends on a tarball path, it should be relative to the workspace.
-        let workspace_str = *workspace_res.workspace();
-        let workspace_path = workspace_str.slice(this.lockfile.buffers.string_bytes.as_slice());
-        let joined = Path::resolve_path::join_abs_string_buf::<Path::platform::Auto>(
-            FileSystem::instance().top_level_dir(),
-            &mut abs_buf,
-            &[workspace_path, path],
-        );
-        break 'tarball_path (joined, false);
-    };
+    let (tarball_path, normalize): (&[u8], bool) =
+        match local_tarball_base_dir(&this.lockfile, dependency_id, path) {
+            None => (path, true),
+            Some(base_dir) => (
+                Path::resolve_path::join_abs_string_buf::<Path::platform::Auto>(
+                    FileSystem::instance().top_level_dir(),
+                    &mut abs_buf,
+                    &[base_dir, path],
+                ),
+                false,
+            ),
+        };
 
     // Build the `Task` value *before* claiming a hive slot — the `.expect()`s
     // below can unwind, and `Task` carries drop glue. See `enqueue_git_clone`.
@@ -1990,6 +1977,33 @@ fn enqueue_local_tarball(
     unsafe { &raw mut (*task).threadpool_task }
 }
 
+/// The workspace or `file:` folder directory that `path` is relative to; `None` is the top-level dir.
+fn local_tarball_base_dir<'a>(
+    lockfile: &'a Lockfile::Lockfile,
+    dependency_id: DependencyID,
+    path: &[u8],
+) -> Option<&'a [u8]> {
+    let declared = &lockfile.buffers.dependencies[dependency_id as usize].version;
+    let declared_by_parent = declared.tag == dependency::version::Tag::Tarball
+        && matches!(
+            &declared.tarball().uri,
+            dependency::tarball::Uri::Local(declared_path) if lockfile.str(declared_path) == path
+        );
+    if !declared_by_parent {
+        // Overrides, resolutions and catalogs are all written in the root package.json.
+        return None;
+    }
+
+    let declarer = lockfile.get_parent_pkg_of_dependency(dependency_id)?;
+    let declarer_res = &lockfile.packages.items_resolution()[declarer as usize];
+    let base_dir = match declarer_res.tag {
+        ResolutionTag::Workspace => declarer_res.workspace(),
+        ResolutionTag::Folder => declarer_res.folder(),
+        _ => return None,
+    };
+    Some(lockfile.str(base_dir))
+}
+
 fn update_name_and_name_hash_from_version_replacement(
     lockfile: &Lockfile::Lockfile,
     original_name: SemverString,
diff --git a/src/install/PackageManagerTask.rs b/src/install/PackageManagerTask.rs
index 18d868675bb0..82d62768f65d 100644
--- a/src/install/PackageManagerTask.rs
+++ b/src/install/PackageManagerTask.rs
@@ -699,12 +699,7 @@ pub struct GitCheckoutRequest {
 
 pub struct LocalTarballRequest {
     pub(crate) tarball: ExtractTarball,
-    /// Path to read the tarball from. May be the same as `tarball.url` (when
-    /// `normalize` is true) or an absolute path joined with a workspace
-    /// directory. Computed on the main thread in `enqueueLocalTarball` because
-    /// resolving it requires reading `lockfile.packages` / `string_bytes`,
-    /// which can be reallocated concurrently by the main thread while this
-    /// task runs on a ThreadPool worker.
+    /// Resolved by `enqueue_local_tarball` on the main thread; the worker must not read the lockfile.
     pub(crate) tarball_path: StringOrTinyString,
     /// When true, `tarball_path` is a user-provided path resolved relative to
     /// cwd. When false, it is already an absolute path.
diff --git a/src/install/isolated_install/Store.rs b/src/install/isolated_install/Store.rs
index 1c09a983d0ee..4e23e9758c4c 100644
--- a/src/install/isolated_install/Store.rs
+++ b/src/install/isolated_install/Store.rs
@@ -7,6 +7,7 @@ use bstr::BStr;
 use bun_alloc::AllocError;
 use bun_collections::{ArrayHashMap, MultiArrayList};
 use bun_semver::String as SemverString;
+use bun_wyhash::Wyhash;
 
 use crate::lockfile::{Lockfile, package};
 use crate::{Dependency, DependencyID, INVALID_DEPENDENCY_ID, PackageID, Resolution};
@@ -357,7 +358,58 @@ pub mod entry {
         }
     }
 
+    /// Max bytes of resolution (the text after `name@`; a folder path or git/tarball
+    /// URL otherwise makes it arbitrarily long) in an entry name. The package directory
+    /// under the entry is the cwd of its lifecycle scripts, which Windows' `CreateProcess`
+    /// rejects past MAX_PATH (ENOENT) although bun's own file I/O accepts such paths.
+    /// 80 keeps versions and `github+owner+repo+<sha>` verbatim.
+    const MAX_RESOLUTION_LEN: usize = 80;
+    /// Longer resolutions become `<leading bytes>+<16 hex wyhash of the whole text>`,
+    /// `MAX_RESOLUTION_LEN` bytes at most.
+    const CUT_RESOLUTION_LEN: usize = MAX_RESOLUTION_LEN - "+".len() - 16;
+
+    /// The first `MAX_RESOLUTION_LEN` bytes written, plus the length and hash of all of them.
+    struct ResolutionSink {
+        buf: [u8; MAX_RESOLUTION_LEN],
+        len: usize,
+        hasher: Wyhash,
+    }
+
+    impl fmt::Write for ResolutionSink {
+        fn write_str(&mut self, s: &str) -> fmt::Result {
+            let bytes = s.as_bytes();
+            if let Some(room) = self.buf.get_mut(self.len..) {
+                let n = bytes.len().min(room.len());
+                room[..n].copy_from_slice(&bytes[..n]);
+            }
+            self.len += bytes.len();
+            self.hasher.update(bytes);
+            Ok(())
+        }
+    }
+
+    fn write_resolution(f: &mut fmt::Formatter<'_>, resolution: fmt::Arguments<'_>) -> fmt::Result {
+        let mut sink = ResolutionSink {
+            buf: [0; MAX_RESOLUTION_LEN],
+            len: 0,
+            hasher: Wyhash::init(0),
+        };
+        fmt::write(&mut sink, resolution)?;
+
+        if sink.len <= MAX_RESOLUTION_LEN {
+            return f.write_str(bun_core::str_utf8(&sink.buf[..sink.len]).ok_or(fmt::Error)?);
+        }
+
+        let mut cut = CUT_RESOLUTION_LEN;
+        while !bun_core::strings::is_on_char_boundary(&sink.buf, cut) {
+            cut -= 1;
+        }
+        f.write_str(bun_core::str_utf8(&sink.buf[..cut]).ok_or(fmt::Error)?)?;
+        write!(f, "+{:016x}", sink.hasher.final_())
+    }
+
     /// `name@version` (or `name@file+path` / `name@root`) without the `+peerhash` suffix.
+    /// The resolution part is bounded by [`MAX_RESOLUTION_LEN`].
     pub struct StoreKeyFormatter<'a> {
         name: SemverString,
         resolution: &'a Resolution,
@@ -386,20 +438,15 @@ pub mod entry {
                 }
                 crate::resolution::Tag::Folder => {
                     let folder = *pkg_res.folder();
-                    write!(
+                    write!(f, "{}@", pkg_name.fmt_store_path(string_buf))?;
+                    write_resolution(
                         f,
-                        "{}@file+{}",
-                        pkg_name.fmt_store_path(string_buf),
-                        folder.fmt_store_path(string_buf),
+                        format_args!("file+{}", folder.fmt_store_path(string_buf)),
                     )
                 }
                 _ => {
-                    write!(
-                        f,
-                        "{}@{}",
-                        pkg_name.fmt_store_path(string_buf),
-                        pkg_res.fmt_store_path(string_buf),
-                    )
+                    write!(f, "{}@", pkg_name.fmt_store_path(string_buf))?;
+                    write_resolution(f, format_args!("{}", pkg_res.fmt_store_path(string_buf)))
                 }
             }
         }
diff --git a/src/install/lockfile.rs b/src/install/lockfile.rs
index 2d500915e564..81e61f76e9a4 100644
--- a/src/install/lockfile.rs
+++ b/src/install/lockfile.rs
@@ -901,6 +901,16 @@ impl Lockfile {
             })
     }
 
+    /// `None` for the edges `enqueue_dependency_to_root` appends outside of any package.
+    pub(crate) fn get_parent_pkg_of_dependency(&self, id: DependencyID) -> Option<PackageID> {
+        for (pkg_id, dependencies) in self.packages.items_dependencies().iter().enumerate() {
+            if dependencies.contains(id) {
+                return Some(PackageID::try_from(pkg_id).expect("int cast"));
+            }
+        }
+        None
+    }
+
     pub(crate) fn get_workspace_pkg_if_workspace_dep(&self, id: DependencyID) -> PackageID {
         let packages = self.packages.slice();
         let resolutions = packages.items_resolution();
diff --git a/test/cli/install/bun-install.test.ts b/test/cli/install/bun-install.test.ts
index 0e0f843e6ea5..1767e35a80fb 100644
--- a/test/cli/install/bun-install.test.ts
+++ b/test/cli/install/bun-install.test.ts
@@ -1042,6 +1042,223 @@ describe.concurrent("bun-install", () => {
     });
   });
 
+  // A tarball URL with credentials in it is downloaded the way npm downloads
+  // it: the userinfo becomes `Authorization: Basic base64(user:pass)` and the
+  // request goes to the URL without it (`NetworkTask::for_tarball`).
+  describe.concurrent("credentials embedded in a tarball URL", () => {
+    const tgz = join(import.meta.dir, "registry", "packages", "no-deps", "no-deps-1.0.0.tgz");
+    const tarballPath = "/cdn/no-deps-1.0.0.tgz";
+    const basic = (userPass: string) => `Basic ${Buffer.from(userPass).toString("base64")}`;
+    const installed = {
+      stdout: expect.stringContaining("1 package installed"),
+      stderr: expect.stringContaining("Saved lockfile"),
+      exitCode: 0,
+    };
+
+    type Received = { url: string; authorization: string | null };
+
+    function recording(received: Received[], handler: (req: Request, server: { port: number }) => Response) {
+      return (req: Request, server: { port: number }) => {
+        received.push({ url: req.url, authorization: req.headers.get("authorization") });
+        return handler(req, server);
+      };
+    }
+
+    // Serves `tgz` to `.tgz` requests carrying exactly `authorization` and
+    // answers 401 to the others. A request under `/redirect/` is first
+    // redirected to `redirectTo`, or to the same file under `/cdn/`.
+    function serveTarball(received: Received[], authorization: string | null, redirectTo?: string) {
+      return Bun.serve({
+        port: 0,
+        hostname: "127.0.0.1",
+        fetch: recording(received, (req, server) => {
+          const { pathname } = new URL(req.url);
+          if (pathname.startsWith("/redirect/")) {
+            const name = pathname.slice("/redirect/".length);
+            return Response.redirect(redirectTo ?? `http://127.0.0.1:${server.port}/cdn/${name}`, 302);
+          }
+          if (req.headers.get("authorization") !== authorization) {
+            return new Response("unauthorized", { status: 401 });
+          }
+          return new Response(file(tgz));
+        }),
+      });
+    }
+
+    // `bun install` of a project whose only dependency `no-deps` is `dependency`.
+    async function install(dependency: string, files: Record<string, string> = {}, args: string[] = []) {
+      using dir = tempDir("tarball-url-credentials", {
+        "package.json": JSON.stringify({ name: "app", version: "1.0.0", dependencies: { "no-deps": dependency } }),
+        ...files,
+      });
+      await using proc = spawn({
+        cmd: [bunExe(), "install", ...args],
+        cwd: String(dir),
+        env: { ...env, BUN_INSTALL_CACHE_DIR: join(String(dir), ".cache") },
+        stdout: "pipe",
+        stderr: "pipe",
+      });
+      const [stdout, stderr, exitCode] = await Promise.all([proc.stdout.text(), proc.stderr.text(), proc.exited]);
+      return { stdout, stderr, exitCode };
+    }
+
+    // Each row is the userinfo of the dependency URL and the `user:pass` the
+    // header must encode. It is sent as written: like npm (checked with npm
+    // 11), a missing password is sent as an empty one and percent-encoding is
+    // left alone. npm would percent-encode the second colon of the last row
+    // because it serializes the URL first.
+    it.each([
+      ["a username and a password", "carol:s3cret", "carol:s3cret", []],
+      ["a username and a password, isolated linker", "carol:s3cret", "carol:s3cret", ["--linker", "isolated"]],
+      ["a username only", "carol", "carol:", []],
+      ["a password only", ":s3cret", ":s3cret", []],
+      ["a percent-encoded password", "carol:s3%40cret", "carol:s3%40cret", []],
+      ["a password containing a colon", "carol:s3:cret", "carol:s3:cret", []],
+    ])("sends %s as Basic authorization", async (_, userinfo, userPass, args) => {
+      const authorization = basic(userPass);
+      const received: Received[] = [];
+      await using server = serveTarball(received, authorization);
+
+      const result = await install(`http://${userinfo}@127.0.0.1:${server.port}${tarballPath}`, {}, args);
+
+      expect({ received, ...result }).toEqual({
+        received: [{ url: `http://127.0.0.1:${server.port}${tarballPath}`, authorization }],
+        ...installed,
+      });
+    });
+
+    it("does not take the @ of a scoped package path for credentials", async () => {
+      const received: Received[] = [];
+      await using server = serveTarball(received, null);
+      const scopedPath = "/@scope/no-deps/-/no-deps-1.0.0.tgz";
+
+      const result = await install(`http://127.0.0.1:${server.port}${scopedPath}`);
+
+      expect({ received, ...result }).toEqual({
+        received: [{ url: `http://127.0.0.1:${server.port}${scopedPath}`, authorization: null }],
+        ...installed,
+      });
+    });
+
+    it("keeps the credentials across a redirect within the host", async () => {
+      const received: Received[] = [];
+      await using server = serveTarball(received, basic("carol:s3cret"));
+
+      const result = await install(`http://carol:s3cret@127.0.0.1:${server.port}/redirect/no-deps-1.0.0.tgz`);
+
+      expect({ received, ...result }).toEqual({
+        received: [
+          { url: `http://127.0.0.1:${server.port}/redirect/no-deps-1.0.0.tgz`, authorization: basic("carol:s3cret") },
+          { url: `http://127.0.0.1:${server.port}${tarballPath}`, authorization: basic("carol:s3cret") },
+        ],
+        ...installed,
+      });
+    });
+
+    it("drops the credentials on a redirect to another host", async () => {
+      // The same machine, reached under a hostname other than the one the
+      // credentials were written for. This host serves the tarball regardless.
+      const otherHostReceived: Received[] = [];
+      await using otherHost = Bun.serve({
+        port: 0,
+        fetch: recording(otherHostReceived, () => new Response(file(tgz))),
+      });
+      const received: Received[] = [];
+      await using server = serveTarball(received, null, `http://localhost:${otherHost.port}${tarballPath}`);
+
+      const result = await install(`http://carol:s3cret@127.0.0.1:${server.port}/redirect/no-deps-1.0.0.tgz`);
+
+      expect({ received, otherHostReceived, ...result }).toEqual({
+        received: [
+          { url: `http://127.0.0.1:${server.port}/redirect/no-deps-1.0.0.tgz`, authorization: basic("carol:s3cret") },
+        ],
+        otherHostReceived: [{ url: `http://localhost:${otherHost.port}${tarballPath}`, authorization: null }],
+        ...installed,
+      });
+    });
+
+    it("reports a rejected download by the URL without the credentials", async () => {
+      const received: Received[] = [];
+      await using server = serveTarball(received, basic("carol:s3cret"));
+
+      const result = await install(`http://carol:wrong@127.0.0.1:${server.port}${tarballPath}`);
+
+      expect({ received, ...result }).toEqual({
+        received: [{ url: `http://127.0.0.1:${server.port}${tarballPath}`, authorization: basic("carol:wrong") }],
+        stdout: expect.stringContaining("bun install v1."),
+        stderr: expect.stringContaining(`error: GET http://127.0.0.1:${server.port}${tarballPath} - 401`),
+        exitCode: 1,
+      });
+    });
+
+    // A registry whose manifest puts credentials into `dist.tarball`. As with
+    // npm, the credentials configured for the registry take precedence; the
+    // URL's are used when the registry has none.
+    describe.concurrent("in the dist.tarball URL of a registry manifest", () => {
+      const token = "registry-token";
+      const distPath = "/no-deps/-/no-deps-1.0.0.tgz";
+
+      function serveRegistry(received: Received[], tarballAuthorization: string | null) {
+        return Bun.serve({
+          port: 0,
+          hostname: "127.0.0.1",
+          fetch: recording(received, (req, server) => {
+            const { pathname } = new URL(req.url);
+            if (pathname === "/no-deps") {
+              return Response.json({
+                name: "no-deps",
+                "dist-tags": { latest: "1.0.0" },
+                versions: {
+                  "1.0.0": {
+                    name: "no-deps",
+                    version: "1.0.0",
+                    dist: { tarball: `http://dist:d1st@127.0.0.1:${server.port}${distPath}` },
+                  },
+                },
+              });
+            }
+            if (pathname === distPath && req.headers.get("authorization") === tarballAuthorization) {
+              return new Response(file(tgz));
+            }
+            return new Response("unauthorized", { status: 401 });
+          }),
+        });
+      }
+
+      it("sends the registry's credentials when it has some", async () => {
+        const received: Received[] = [];
+        await using registry = serveRegistry(received, `Bearer ${token}`);
+
+        const result = await install("1.0.0", {
+          ".npmrc": `registry=http://127.0.0.1:${registry.port}/\n//127.0.0.1:${registry.port}/:_authToken=${token}\n`,
+        });
+
+        expect({ received, ...result }).toEqual({
+          received: [
+            { url: `http://127.0.0.1:${registry.port}/no-deps`, authorization: `Bearer ${token}` },
+            { url: `http://127.0.0.1:${registry.port}${distPath}`, authorization: `Bearer ${token}` },
+          ],
+          ...installed,
+        });
+      });
+
+      it("sends the URL's credentials when the registry has none", async () => {
+        const received: Received[] = [];
+        await using registry = serveRegistry(received, basic("dist:d1st"));
+
+        const result = await install("1.0.0", { ".npmrc": `registry=http://127.0.0.1:${registry.port}/\n` });
+
+        expect({ received, ...result }).toEqual({
+          received: [
+            { url: `http://127.0.0.1:${registry.port}/no-deps`, authorization: null },
+            { url: `http://127.0.0.1:${registry.port}${distPath}`, authorization: basic("dist:d1st") },
+          ],
+          ...installed,
+        });
+      });
+    });
+  });
+
   it("--silent suppresses verbose output even when RUNNER_DEBUG is set", async () => {
     using dir = tempDir("install-silent-verbose", {
       "package.json": JSON.stringify({ name: "app", dependencies: {} }),
@@ -11348,6 +11565,111 @@ it.concurrent("fails to install a lockfile's transitive file: dependency whose f
   expect(exitCode).toBe(1);
 });
 
+describe.concurrent("file: tarball declared by a file: folder dependency", () => {
+  // `bar-0.0.2.tgz` is planted at the path the declaration means and
+  // `baz-0.0.3.tgz` at the other candidate path, so reading the tarball
+  // relative to the wrong directory installs `baz` instead of failing with ENOENT.
+  const expected = readFileSync(join(import.meta.dir, "bar-0.0.2.tgz"));
+  const decoy = readFileSync(join(import.meta.dir, "baz-0.0.3.tgz"));
+
+  const fixture = (root: object, lib: object, tarballs: Record<string, Buffer>) => ({
+    "package.json": JSON.stringify({
+      name: "my-app",
+      version: "1.0.0",
+      dependencies: { lib: "file:./vendor/lib" },
+      ...root,
+    }),
+    "vendor/lib/package.json": JSON.stringify({ name: "lib", version: "1.0.0", main: "index.js", ...lib }),
+    "vendor/lib/index.js": `const pkg = require("tool/package.json"); module.exports = pkg.name + "@" + pkg.version;`,
+    ...tarballs,
+  });
+
+  // The first install resolves `tool` from vendor/lib/package.json and reads
+  // the tarball in the process. The second one starts from the lockfile with
+  // an empty cache, so it has to read the tarball again from the path recorded
+  // there; both have to pick the same file.
+  async function installAndRequireLib(projectDir: string, linker: "hoisted" | "isolated") {
+    const cacheDir = join(projectDir, ".bun-cache");
+    const installed: string[] = [];
+
+    for (const args of [["install"], ["install", "--frozen-lockfile"]]) {
+      await Promise.all([
+        rm(join(projectDir, "node_modules"), { recursive: true, force: true }),
+        rm(cacheDir, { recursive: true, force: true }),
+      ]);
+
+      await using install = spawn({
+        cmd: [bunExe(), ...args, `--linker=${linker}`],
+        cwd: projectDir,
+        stdout: "pipe",
+        stderr: "pipe",
+        env: { ...env, BUN_INSTALL_CACHE_DIR: cacheDir },
+      });
+      const [installErr, installOut, installExit] = await Promise.all([
+        install.stderr.text(),
+        install.stdout.text(),
+        install.exited,
+      ]);
+      expect(installErr).not.toContain("error:");
+      expect(installOut).toContain("2 packages installed");
+      expect(installExit).toBe(0);
+
+      await using run = spawn({
+        cmd: [bunExe(), "-e", `console.log(require("lib"))`],
+        cwd: projectDir,
+        stdout: "pipe",
+        stderr: "pipe",
+        env,
+      });
+      const [runErr, runOut, runExit] = await Promise.all([run.stderr.text(), run.stdout.text(), run.exited]);
+      expect(runErr).toBe("");
+      expect(runExit).toBe(0);
+      installed.push(runOut.trim());
+    }
+
+    return { installed, lockfile: await file(join(projectDir, "bun.lock")).text() };
+  }
+
+  for (const linker of ["hoisted", "isolated"] as const) {
+    it(`is read relative to the folder (${linker} linker)`, async () => {
+      using dir = tempDir(
+        "folder-dep-tarball",
+        fixture(
+          {},
+          { dependencies: { tool: "file:./tool.tgz" } },
+          { "vendor/lib/tool.tgz": expected, "tool.tgz": decoy },
+        ),
+      );
+
+      const { installed, lockfile } = await installAndRequireLib(String(dir), linker);
+      expect(installed).toEqual(["bar@0.0.2", "bar@0.0.2"]);
+      // The lockfile records the path as declared; the name in front of it is
+      // read from the tarball that was extracted.
+      expect(lockfile).toContain('"lib": ["lib@file:vendor/lib", { "dependencies": { "tool": "file:./tool.tgz" } }]');
+      expect(lockfile).toContain('"tool": ["bar@./tool.tgz", {}, "sha512-');
+    });
+  }
+
+  it("is read relative to the project when a root override supplies the path", async () => {
+    // `overrides` can only be written in the root package.json, so the path it
+    // contains means the project directory even though the dependency it is
+    // applied to is declared by vendor/lib/package.json.
+    using dir = tempDir(
+      "folder-dep-tarball-override",
+      fixture(
+        { overrides: { tool: "file:./tool.tgz" } },
+        { dependencies: { tool: "^1.0.0" } },
+        { "tool.tgz": expected, "vendor/lib/tool.tgz": decoy },
+      ),
+    );
+
+    const { installed, lockfile } = await installAndRequireLib(String(dir), "hoisted");
+    expect(installed).toEqual(["bar@0.0.2", "bar@0.0.2"]);
+    expect(lockfile).toContain('"lib": ["lib@file:vendor/lib", { "dependencies": { "tool": "^1.0.0" } }]');
+    expect(lockfile).toContain('"tool": ["bar@./tool.tgz", {}, "sha512-');
+  });
+});
+
 it("does not extract a local file: tarball outside the temp dir for a dependency alias containing '..' path segments", async () => {
   // For `file:` tarball dependencies, the dependency alias (the key in
   // `dependencies`) is used to derive the temporary extraction folder name.
diff --git a/test/cli/install/bun-workspaces.test.ts b/test/cli/install/bun-workspaces.test.ts
index a5af15e6fd02..8ee98d0ed8d0 100644
--- a/test/cli/install/bun-workspaces.test.ts
+++ b/test/cli/install/bun-workspaces.test.ts
@@ -736,6 +736,47 @@ describe("relative tarballs", async () => {
       },
     });
   });
+  // The tarball path is written in the root package.json, so it is relative to
+  // the root even though the dependency it ends up satisfying is declared by
+  // the workspace (#25835 for overrides, #25752 for catalogs). The workspace
+  // gets a different tarball at the same relative path, so reading it relative
+  // to the workspace installs `baz` instead of failing.
+  for (const [source, root, specifier] of [
+    ["override", { overrides: { bar: "file:./bar.tgz" } }, "^0.0.2"],
+    ["catalog entry", { catalogs: { vendored: { bar: "file:./bar.tgz" } } }, "catalog:vendored"],
+  ] as const) {
+    test.concurrent(`from a root ${source} applied to a workspace dependency`, async () => {
+      using ctx = await setupTest();
+      const { packageDir, env } = ctx;
+      await Promise.all([
+        write(join(packageDir, "package.json"), JSON.stringify({ name: "foo", workspaces: ["pkgs/*"], ...root })),
+        write(
+          join(packageDir, "pkgs", "pkg1", "package.json"),
+          JSON.stringify({ name: "pkg1", dependencies: { bar: specifier } }),
+        ),
+        cp(join(import.meta.dir, "bar-0.0.2.tgz"), join(packageDir, "bar.tgz")),
+      ]);
+      await cp(join(import.meta.dir, "baz-0.0.3.tgz"), join(packageDir, "pkgs", "pkg1", "bar.tgz"));
+
+      // The second install starts from the lockfile and an empty cache, so it
+      // reads the tarball again from the path recorded there.
+      for (const frozenLockfile of [false, true]) {
+        await Promise.all([
+          rm(join(packageDir, "node_modules"), { recursive: true, force: true }),
+          rm(env.BUN_INSTALL_CACHE_DIR, { recursive: true, force: true }),
+        ]);
+
+        await runBunInstall(env, packageDir, { frozenLockfile });
+
+        expect(await file(join(packageDir, "node_modules", "bar", "package.json")).json()).toEqual({
+          name: "bar",
+          version: "0.0.2",
+        });
+      }
+
+      expect(await file(join(packageDir, "bun.lock")).text()).toContain('"bar": ["bar@./bar.tgz", {}, "sha512-');
+    });
+  }
 
   // Regression test for a data race where the `.local_tarball` task callback
   // (running on a ThreadPool worker) read `lockfile.packages` and
diff --git a/test/cli/install/isolated-install.test.ts b/test/cli/install/isolated-install.test.ts
index f153ab3566a8..de7c45200d7f 100644
--- a/test/cli/install/isolated-install.test.ts
+++ b/test/cli/install/isolated-install.test.ts
@@ -1,10 +1,11 @@
 import { file, spawn, write } from "bun";
 import { afterAll, beforeAll, describe, expect, test } from "bun:test";
-import { existsSync, lstatSync, readlinkSync, statSync } from "fs";
+import { existsSync, lstatSync, readFileSync, readlinkSync, statSync } from "fs";
 import { mkdir, readlink, rm, symlink } from "fs/promises";
 import { VerdaccioRegistry, bunEnv, bunExe, githubTarball, readdirSorted, runBunInstall, tempDir } from "harness";
 import { createRequire } from "module";
 import { basename, dirname, join } from "path";
+import { pathToFileURL } from "url";
 
 const registry = new VerdaccioRegistry();
 
@@ -46,6 +47,14 @@ async function savedTreeCopiesOf(packageDir: string, name: string): Promise<Reco
   );
 }
 
+// `<name>@<resolution>`, with the resolution cut and hashed past MAX_RESOLUTION_LEN (see "long store entry names").
+const MAX_RESOLUTION_LEN = 80;
+const CUT_RESOLUTION_LEN = MAX_RESOLUTION_LEN - "+".length - 16;
+function storeEntryName(name: string, resolution: string): string {
+  if (resolution.length <= MAX_RESOLUTION_LEN) return `${name}@${resolution}`;
+  return `${name}@${resolution.slice(0, CUT_RESOLUTION_LEN)}+${urlHash(resolution)}`;
+}
+
 beforeAll(async () => {
   await registry.start();
 });
@@ -2681,6 +2690,310 @@ test("tarball URL with query string resolves at runtime", async () => {
   expect(exitCode).toBe(0);
 });
 
+// The resolution part of a store entry name (`<name>@<resolution>`) embeds
+// folder paths, tarball URLs and git URLs verbatim. `write_resolution` in
+// src/install/isolated_install/Store.rs bounds it: a resolution longer than
+// MAX_RESOLUTION_LEN bytes is cut and suffixed with `+` and the wyhash of the
+// full text. Unbounded, the entry's absolute path passes MAX_PATH on Windows,
+// where the package's lifecycle scripts then fail to spawn with ENOENT, and a
+// resolution longer than NAME_MAX cannot be created at all.
+describe("long store entry names", () => {
+  async function storeEntries(packageDir: string): Promise<string[]> {
+    return (await readdirSorted(join(packageDir, "node_modules", ".bun"))).filter(entry => entry !== "node_modules");
+  }
+
+  test("a resolution at the limit is kept verbatim, a longer one is cut and hashed", async () => {
+    // `file+` plus this folder name is exactly MAX_RESOLUTION_LEN bytes; the
+    // other three folders are one byte longer.
+    const atLimit = Buffer.alloc(MAX_RESOLUTION_LEN - "file+".length, "a").toString();
+    const pastLimit = `${atLimit}b`;
+    // Two resolutions of the same package that only differ after the cut
+    // point: the hash is what keeps their entries apart.
+    const sharedPrefix1 = `${atLimit}1`;
+    const sharedPrefix2 = `${atLimit}2`;
+
+    const { packageJson, packageDir } = await registry.createTestDir({
+      bunfigOpts: { linker: "isolated" },
+      files: {
+        [`${atLimit}/package.json`]: JSON.stringify({ name: "at-limit", version: "1.0.0" }),
+        [`${pastLimit}/package.json`]: JSON.stringify({ name: "past-limit", version: "1.0.0" }),
+        [`${sharedPrefix1}/package.json`]: JSON.stringify({ name: "shared-prefix", version: "1.0.0" }),
+        [`${sharedPrefix2}/package.json`]: JSON.stringify({ name: "shared-prefix", version: "2.0.0" }),
+      },
+    });
+    await write(
+      packageJson,
+      JSON.stringify({
+        name: "test-long-store-entry-names",
+        dependencies: {
+          "at-limit": `file:./${atLimit}`,
+          "past-limit": `file:./${pastLimit}`,
+          "shared-prefix-1": `file:./${sharedPrefix1}`,
+          "shared-prefix-2": `file:./${sharedPrefix2}`,
+        },
+      }),
+    );
+
+    await runBunInstall(bunEnv, packageDir);
+
+    const pastLimitEntry = storeEntryName("past-limit", `file+${pastLimit}`);
+    expect(pastLimitEntry).toMatch(/^past-limit@file\+a{58}\+[0-9a-f]{16}$/);
+    const expectedEntries = [
+      `at-limit@file+${atLimit}`,
+      pastLimitEntry,
+      storeEntryName("shared-prefix", `file+${sharedPrefix1}`),
+      storeEntryName("shared-prefix", `file+${sharedPrefix2}`),
+    ].sort();
+    expect(await storeEntries(packageDir)).toEqual(expectedEntries);
+
+    expect(readlinkSync(join(packageDir, "node_modules", "past-limit"))).toBe(
+      join(".bun", pastLimitEntry, "node_modules", "past-limit"),
+    );
+    expect(
+      await Promise.all(
+        ["at-limit", "past-limit", "shared-prefix-1", "shared-prefix-2"].map(alias =>
+          file(join(packageDir, "node_modules", alias, "package.json")).json(),
+        ),
+      ),
+    ).toEqual([
+      { name: "at-limit", version: "1.0.0" },
+      { name: "past-limit", version: "1.0.0" },
+      { name: "shared-prefix", version: "1.0.0" },
+      { name: "shared-prefix", version: "2.0.0" },
+    ]);
+
+    // The cut name is a pure function of the resolution, so the next install
+    // finds the same entries again.
+    await runBunInstall(bunEnv, packageDir, { savesLockfile: false });
+    expect(await storeEntries(packageDir)).toEqual(expectedEntries);
+  });
+
+  test("the peer hash is appended after the cut resolution", async () => {
+    const folder = Buffer.alloc(MAX_RESOLUTION_LEN, "p").toString();
+    const { packageJson, packageDir } = await registry.createTestDir({
+      bunfigOpts: { linker: "isolated" },
+      files: {
+        [`${folder}/package.json`]: JSON.stringify({
+          name: "has-peer",
+          version: "1.0.0",
+          peerDependencies: { "no-deps": "1.0.0" },
+        }),
+      },
+    });
+    await write(
+      packageJson,
+      JSON.stringify({
+        name: "test-long-store-entry-name-with-peer",
+        dependencies: { "has-peer": `file:./${folder}`, "no-deps": "1.0.0" },
+      }),
+    );
+
+    await runBunInstall(bunEnv, packageDir);
+
+    // `+7347ae2d86f1441a` is the hash of the peer set `no-deps@1.0.0`.
+    const entry = `${storeEntryName("has-peer", `file+${folder}`)}+7347ae2d86f1441a`;
+    expect(await storeEntries(packageDir)).toEqual([entry, "no-deps@1.0.0"]);
+    expect(
+      await file(join(packageDir, "node_modules", ".bun", entry, "node_modules", "no-deps", "package.json")).json(),
+    ).toEqual({ name: "no-deps", version: "1.0.0" });
+  });
+
+  test("a cut that would split a multi-byte character backs up to the character boundary", async () => {
+    // `file+x` is 6 bytes and every character after it is 2 bytes wide, so
+    // byte 63 of the resolution falls inside a character and the cut ends at
+    // byte 62. Only the shape is asserted: how non-ASCII bytes are spelled in
+    // the name is a separate matter (#32304), the boundary handling is not.
+    const folder = `x${Buffer.alloc(40 * 2, "\u00e9").toString()}`;
+    const { packageJson, packageDir } = await registry.createTestDir({
+      bunfigOpts: { linker: "isolated" },
+      files: { [`${folder}/package.json`]: JSON.stringify({ name: "non-ascii", version: "1.0.0" }) },
+    });
+    await write(
+      packageJson,
+      JSON.stringify({ name: "test-non-ascii-store-entry-name", dependencies: { "non-ascii": `file:./${folder}` } }),
+    );
+
+    await runBunInstall(bunEnv, packageDir);
+
+    const entries = await storeEntries(packageDir);
+    expect(entries).toEqual([expect.stringMatching(/^non-ascii@file\+x.*\+[0-9a-f]{16}$/)]);
+    const [entry] = entries;
+    const cutResolution = entry.slice("non-ascii@".length, -"+0123456789abcdef".length);
+    expect(Buffer.byteLength(cutResolution)).toBe(CUT_RESOLUTION_LEN - 1);
+    expect(readlinkSync(join(packageDir, "node_modules", "non-ascii"))).toBe(
+      join(".bun", entry, "node_modules", "non-ascii"),
+    );
+    expect(await file(join(packageDir, "node_modules", "non-ascii", "package.json")).json()).toEqual({
+      name: "non-ascii",
+      version: "1.0.0",
+    });
+  });
+
+  test("a local tarball and a folder in a deep directory install when their paths are longer than NAME_MAX", async () => {
+    // Every directory on the way is short; only the resolution, which is the
+    // whole relative path (257 bytes here), would make the entry name longer
+    // than NAME_MAX. Unbounded, the install fails with ENAMETOOLONG.
+    const segment = Buffer.alloc(85, "d").toString();
+    const deep = `${segment}/${segment}/${segment}`;
+    const { packageJson, packageDir } = await registry.createTestDir({
+      bunfigOpts: { linker: "isolated" },
+      files: {
+        [`${deep}/bar-0.0.2.tgz`]: readFileSync(join(import.meta.dir, "bar-0.0.2.tgz")),
+        [`${deep}/pkg/package.json`]: JSON.stringify({ name: "folder-pkg", version: "1.0.0" }),
+      },
+    });
+    await write(
+      packageJson,
+      JSON.stringify({
+        name: "test-deep-local-tarball-and-folder",
+        dependencies: {
+          "bar": `file:./${deep}/bar-0.0.2.tgz`,
+          "folder-pkg": `file:./${deep}/pkg`,
+        },
+      }),
+    );
+
+    await runBunInstall(bunEnv, packageDir);
+
+    const tarballEntry = storeEntryName("bar", `.+${deep.replaceAll("/", "+")}+bar-0.0.2.tgz`);
+    const folderEntry = storeEntryName("folder-pkg", `file+${deep.replaceAll("/", "+")}+pkg`);
+    expect(tarballEntry).toMatch(/^bar@\.\+d{61}\+[0-9a-f]{16}$/);
+    expect(folderEntry).toMatch(/^folder-pkg@file\+d{58}\+[0-9a-f]{16}$/);
+    const expectedEntries = [tarballEntry, folderEntry].sort();
+    expect(await storeEntries(packageDir)).toEqual(expectedEntries);
+
+    const bunDir = join(packageDir, "node_modules", ".bun");
+    expect(
+      await Promise.all([
+        readlink(join(packageDir, "node_modules", "bar")),
+        readlink(join(packageDir, "node_modules", "folder-pkg")),
+        // The `.bun/node_modules` fallback directory links to the cut name too.
+        readlink(join(bunDir, "node_modules", "bar")),
+        file(join(packageDir, "node_modules", "bar", "package.json")).json(),
+        file(join(packageDir, "node_modules", "folder-pkg", "package.json")).json(),
+      ]),
+    ).toEqual([
+      join(".bun", tarballEntry, "node_modules", "bar"),
+      join(".bun", folderEntry, "node_modules", "folder-pkg"),
+      join("..", tarballEntry, "node_modules", "bar"),
+      { name: "bar", version: "0.0.2" },
+      { name: "folder-pkg", version: "1.0.0" },
+    ]);
+
+    await runBunInstall(bunEnv, packageDir, { savesLockfile: false });
+    expect(await storeEntries(packageDir)).toEqual(expectedEntries);
+  });
+
+  test("a tarball URL longer than NAME_MAX installs, also into the global store", async () => {
+    const tarball = file(join(import.meta.dir, "registry", "packages", "no-deps", "no-deps-1.0.0.tgz"));
+    const segment = Buffer.alloc(255, "t").toString();
+
+    using server = Bun.serve({
+      port: 0,
+      fetch(req) {
+        if (new URL(req.url).pathname !== `/${segment}/no-deps.tgz`) {
+          return new Response("Not found", { status: 404 });
+        }
+        return new Response(tarball, { headers: { "Content-Type": "application/octet-stream" } });
+      },
+    });
+    const url = `http://localhost:${server.port}/${segment}/no-deps.tgz`;
+
+    const { packageJson, packageDir } = await registry.createTestDir({
+      bunfigOpts: { linker: "isolated", globalStore: true },
+      files: { "index.mjs": `import pkg from "no-deps";\nconsole.log(pkg.version);` },
+    });
+    await write(packageJson, JSON.stringify({ name: "test-long-tarball-url", dependencies: { "no-deps": url } }));
+
+    await runBunInstall(bunEnv, packageDir);
+
+    const entry = storeEntryName("no-deps", url.replaceAll(/[/:]/g, "+"));
+    expect(entry).toMatch(/^no-deps@http\+\+\+localhost\+\d+\+t+\+[0-9a-f]{16}$/);
+    expect(await storeEntries(packageDir)).toEqual([entry]);
+
+    const localEntry = join(packageDir, "node_modules", ".bun", entry);
+    expect(lstatSync(localEntry).isSymbolicLink()).toBe(true);
+    expect(entryStoreName(readlinkSync(localEntry))).toMatch(
+      new RegExp(`^${entry.replaceAll("+", "\\+")}-[0-9a-f]{16}$`),
+    );
+
+    await using proc = spawn({
+      cmd: [bunExe(), "index.mjs"],
+      env: bunEnv,
+      cwd: packageDir,
+      stdout: "pipe",
+      stderr: "pipe",
+    });
+    const [stdout, stderr, exitCode] = await Promise.all([proc.stdout.text(), proc.stderr.text(), proc.exited]);
+    expect(stderr).toBe("");
+    expect(stdout).toBe("1.0.0\n");
+    expect(exitCode).toBe(0);
+  });
+
+  // The reported case: a git dependency's resolution is its repository URL
+  // (here: a path inside the temp directory) plus the commit, and the entry is
+  // the cwd its lifecycle scripts are spawned with.
+  test.skipIf(!gitExecutable)("a trusted git dependency with a long URL runs its lifecycle scripts", async () => {
+    const { packageJson, packageDir } = await registry.createTestDir({ bunfigOpts: { linker: "isolated" } });
+    const repoDir = join(packageDir, Buffer.alloc(60, "r").toString());
+    const gitEnv = {
+      ...bunEnv,
+      GIT_CONFIG_NOSYSTEM: "1",
+      GIT_CONFIG_GLOBAL: join(packageDir, "gitconfig"),
+      GIT_AUTHOR_NAME: "bun-test",
+      GIT_AUTHOR_EMAIL: "test@bun.sh",
+      GIT_COMMITTER_NAME: "bun-test",
+      GIT_COMMITTER_EMAIL: "test@bun.sh",
+    };
+    async function git(...args: string[]): Promise<string> {
+      await using proc = spawn({
+        cmd: [gitExecutable!, ...args],
+        cwd: repoDir,
+        env: gitEnv,
+        stdout: "pipe",
+        stderr: "pipe",
+      });
+      const [out, err, exitCode] = await Promise.all([proc.stdout.text(), proc.stderr.text(), proc.exited]);
+      expect(err).not.toContain("fatal:");
+      expect(exitCode).toBe(0);
+      return out;
+    }
+
+    await Promise.all([
+      write(join(packageDir, "gitconfig"), ""),
+      write(
+        join(repoDir, "package.json"),
+        JSON.stringify({
+          name: "git-dep",
+          version: "1.0.0",
+          scripts: { postinstall: `${bunExe()} -e "require('fs').writeFileSync('postinstall-ran.txt', 'ran')"` },
+        }),
+      ),
+    ]);
+    await git("init", "-q");
+    await git("add", "package.json");
+    await git("commit", "-qm", "init", "--no-gpg-sign");
+    const sha = (await git("rev-parse", "HEAD")).trim();
+
+    const repoUrl = pathToFileURL(repoDir).href;
+    await write(
+      packageJson,
+      JSON.stringify({
+        name: "test-long-git-url",
+        dependencies: { "git-dep": `git+${repoUrl}` },
+        trustedDependencies: ["git-dep"],
+      }),
+    );
+
+    await runBunInstall(gitEnv, packageDir);
+
+    const entry = storeEntryName("git-dep", `git+${repoUrl.replaceAll(/[/:]/g, "+")}+${sha}`);
+    expect(entry).toMatch(/^git-dep@git\+file\+\+\+\+.*\+[0-9a-f]{16}$/);
+    expect(await storeEntries(packageDir)).toEqual([entry]);
+    expect(await file(join(packageDir, "node_modules", "git-dep", "postinstall-ran.txt")).text()).toBe("ran");
+  });
+});
+
 // The store entry of a tarball or git dependency is named after its URL, and
 // that name ends up in every path under the entry (realpaths, stack traces,
 // `bun pm` output). Credentials travel in the userinfo (`user:token@`) or the
@@ -2875,7 +3188,10 @@ describe("store entry names of URL dependencies", () => {
 
       await runBunInstall(env, project);
 
-      const entry = `git-dep@git+http+++127.0.0.1+${server.port}+repo.git${hashed ? `+${urlHash(repo)}` : ""}+${sha}`;
+      const entry = storeEntryName(
+        "git-dep",
+        `git+http+++127.0.0.1+${server.port}+repo.git${hashed ? `+${urlHash(repo)}` : ""}+${sha}`,
+      );
       expect(await storeEntries(project)).toEqual([entry]);
       expect(readlinkSync(join(project, "node_modules", "git-dep"))).toBe(
         join(".bun", entry, "node_modules", "git-dep"),

From 8615ba76129bf18b9acf05721690e9307b5c61f7 Mon Sep 17 00:00:00 2001
From: robobun <117481402+robobun@users.noreply.github.com>
Date: Mon, 17 Aug 2026 01:25:52 +0000
Subject: [PATCH 098/258] install: refuse local tarball dependencies declared
 by packages installed from the cache (#38986)

---
 .../PackageManager/PackageManagerEnqueue.rs   |  43 +++
 src/install/lockfile.rs                       |  23 +-
 src/install/resolution.rs                     |   5 +
 test/cli/install/bun-install.test.ts          | 301 ++++++++++++++++++
 4 files changed, 370 insertions(+), 2 deletions(-)

diff --git a/src/install/PackageManager/PackageManagerEnqueue.rs b/src/install/PackageManager/PackageManagerEnqueue.rs
index 49be1eb3b5a0..94acaa738999 100644
--- a/src/install/PackageManager/PackageManagerEnqueue.rs
+++ b/src/install/PackageManager/PackageManagerEnqueue.rs
@@ -1529,6 +1529,19 @@ pub fn enqueue_dependency_with_main_and_success_fn(
         }
         dependency::version::Tag::Tarball => {
             let tarball = version.tarball();
+            if matches!(tarball.uri, dependency::tarball::Uri::Local(_))
+                && !version_was_replaced
+                && let Some(declarer) = this.lockfile.get_parent_pkg_of_dependency(id)
+                && !this.lockfile.packages.items_resolution()[declarer as usize]
+                    .tag
+                    .is_local_package()
+                && !this.lockfile.has_equal_root_dependency(dependency)
+            {
+                if dependency.behavior.is_required() {
+                    reject_local_tarball_of_remote_package(this, declarer, dependency);
+                }
+                return Ok(());
+            }
             let res: Resolution = match &tarball.uri {
                 dependency::tarball::Uri::Local(path) => {
                     Resolution::init(ResolutionTagged::LocalTarball(*path))
@@ -1672,6 +1685,36 @@ fn warn_unmet_peer_dependency(
     );
 }
 
+/// `enqueue_local_tarball` would read the path relative to the project, not to the declarer.
+#[cold]
+#[inline(never)]
+fn reject_local_tarball_of_remote_package(
+    this: &PackageManager,
+    declarer: PackageID,
+    dependency: &Dependency,
+) {
+    let buf = this.lockfile.buffers.string_bytes.as_slice();
+    let packages = this.lockfile.packages.slice();
+    let name = bstr::BStr::new(dependency.name.slice(buf));
+    let literal = bstr::BStr::new(dependency.version.literal.slice(buf));
+    let declarer_name = bstr::BStr::new(packages.items_name()[declarer as usize].slice(buf));
+    this.log_mut().add_range_error_fmt_with_notes(
+        None,
+        bun_ast::Range::NONE,
+        Box::new([bun_ast::range_data(
+            None,
+            bun_ast::Range::NONE,
+            bun_ast::alloc_print(format_args!(
+                "add \"{name}\": \"{literal}\" to the root package.json to install that tarball for {declarer_name} as well",
+            )),
+        )]),
+        format_args!(
+            "refusing to resolve \"{name}@{literal}\" declared by {declarer_name}@{}: local tarball dependencies are only allowed in the package.json files of this project",
+            packages.items_resolution()[declarer as usize].fmt(buf, bun_fmt::PathSep::Posix),
+        ),
+    );
+}
+
 /// Allocate and initialise an `.extract` Task for an npm tarball.
 /// Shared by the buffered path (`enqueueExtractNPMPackage`) and the
 /// streaming path (`createExtractTaskForStreaming`) so both produce
diff --git a/src/install/lockfile.rs b/src/install/lockfile.rs
index 81e61f76e9a4..6575bfcedd50 100644
--- a/src/install/lockfile.rs
+++ b/src/install/lockfile.rs
@@ -37,8 +37,8 @@ use crate::update_request::UpdateRequest;
 use crate::{
     self as Install, DependencyID, ExternalSlice, Features, PackageID, PackageManager,
     PackageNameAndVersionHash, PackageNameHash, TruncatedPackageNameHash, dependency,
-    dependency::Dependency, initialize_store, invalid_dependency_id, invalid_package_id,
-    npm as Npm,
+    dependency::Dependency, dependency::DependencyExt as _, initialize_store,
+    invalid_dependency_id, invalid_package_id, npm as Npm,
 };
 use bun_install_types::NodeLinker::NodeLinker;
 
@@ -911,6 +911,25 @@ impl Lockfile {
         None
     }
 
+    /// `None` for the edges `enqueue_dependency_to_root` appends outside of any package.
+    pub(crate) fn get_parent_pkg_of_dependency(&self, id: DependencyID) -> Option<PackageID> {
+        for (pkg_id, dependencies) in self.packages.items_dependencies().iter().enumerate() {
+            if dependencies.contains(id) {
+                return Some(PackageID::try_from(pkg_id).expect("int cast"));
+            }
+        }
+        None
+    }
+
+    /// Does the root package.json declare the same dependency (name and specifier) itself?
+    pub(crate) fn has_equal_root_dependency(&self, dependency: &Dependency) -> bool {
+        let buf = self.buffers.string_bytes.as_slice();
+        self.packages.items_dependencies()[0]
+            .get(self.buffers.dependencies.as_slice())
+            .iter()
+            .any(|root_dependency| root_dependency.eql(dependency, buf, buf))
+    }
+
     pub(crate) fn get_workspace_pkg_if_workspace_dep(&self, id: DependencyID) -> PackageID {
         let packages = self.packages.slice();
         let resolutions = packages.items_resolution();
diff --git a/src/install/resolution.rs b/src/install/resolution.rs
index bd665fdd674c..1acfc6dc5170 100644
--- a/src/install/resolution.rs
+++ b/src/install/resolution.rs
@@ -1021,6 +1021,11 @@ impl Tag {
         self == Tag::Root || self == Tag::Workspace || self == Tag::Folder
     }
 
+    /// The package.json is read from the project rather than extracted into the cache.
+    pub(crate) fn is_local_package(self) -> bool {
+        self == Tag::Root || self == Tag::Workspace || self == Tag::Folder
+    }
+
     pub(crate) fn can_enqueue_install_task(self) -> bool {
         self == Tag::Npm
             || self == Tag::LocalTarball
diff --git a/test/cli/install/bun-install.test.ts b/test/cli/install/bun-install.test.ts
index 1767e35a80fb..0d2d181cc143 100644
--- a/test/cli/install/bun-install.test.ts
+++ b/test/cli/install/bun-install.test.ts
@@ -10819,6 +10819,307 @@ describe.skipIf(isWindows)("file: dependency whose package.json path is around t
   });
 });
 
+// The tarball form of the above. A `file:` tarball path is read relative to the
+// project (or to the workspace declaring it), which is only meaningful for the
+// package.json files that are part of the project. The same path declared by a
+// package bun extracts from the cache (registry, git, tarball) used to be read
+// from the project too, so a published package declaring `"x": "file:./x.tgz"`
+// got whatever `x.tgz` the project directory held, and with `file:../x.tgz` or
+// an absolute path any tarball on the machine, installed under its name.
+describe.concurrent("file: tarballs declared by a package installed from the cache", () => {
+  // Copied to every path the declaring package names; installing it is the bug.
+  const planted = join(import.meta.dir, "baz-0.0.3.tgz");
+  const plantedManifest = { name: "baz", version: "0.0.3", bin: { "baz-run": "index.js" } };
+
+  // The project is <root>/project so that `../outside.tgz` stays inside the temp dir.
+  function declaredTarballs(root: string): Record<string, string> {
+    return {
+      inside: "file:./inside.tgz",
+      outside: "file:../outside.tgz",
+      absolute: `file:${join(root, "absolute.tgz").replaceAll("\\", "/")}`,
+    };
+  }
+
+  function plantDeclaredTarballs(root: string) {
+    return Promise.all([
+      cp(planted, join(root, "project", "inside.tgz")),
+      cp(planted, join(root, "outside.tgz")),
+      cp(planted, join(root, "absolute.tgz")),
+    ]);
+  }
+
+  function rootPackageJson(dependencies: Record<string, string>, extra: object = {}) {
+    return JSON.stringify({ name: "my-app", version: "1.0.0", dependencies, ...extra });
+  }
+
+  // <root>/project depends on `bar@0.0.2` from the dummy registry, whose manifest
+  // for it carries `barManifest`, plus whatever `root` adds to its package.json.
+  // Returns the URLs the registry gets asked for.
+  async function writeRegistryProject(
+    ctx: TestContext,
+    root: string,
+    barManifest: object,
+    { dependencies = {}, ...rootExtra }: { dependencies?: Record<string, string>; [field: string]: unknown } = {},
+  ) {
+    const urls: string[] = [];
+    setContextHandler(ctx, dummyRegistryForContext(ctx, urls, { "0.0.2": barManifest }));
+    await write(join(root, "project", "package.json"), rootPackageJson({ bar: "0.0.2", ...dependencies }, rootExtra));
+    await write(join(root, "project", "bunfig.toml"), `[install]\nregistry = "${ctx.registry_url}"\n`);
+    return urls;
+  }
+
+  // Packs `manifest` as the package.json of an otherwise empty package into `tarball`.
+  async function packManifest(tarball: string, manifest: object) {
+    using work = tempDir("pack-manifest", { "package/package.json": JSON.stringify(manifest) });
+    await using tar = spawn({
+      cmd: ["tar", "-czf", tarball, "-C", String(work), "package"],
+      stdout: "ignore",
+      stderr: "pipe",
+    });
+    const [tarStderr, tarExitCode] = await Promise.all([tar.stderr.text(), tar.exited]);
+    if (tarExitCode !== 0) {
+      throw new Error(`tar exited with ${tarExitCode}: ${tarStderr}`);
+    }
+  }
+
+  async function install(root: string) {
+    await using proc = spawn({
+      cmd: [bunExe(), "install"],
+      cwd: join(root, "project"),
+      env: { ...env, BUN_INSTALL_CACHE_DIR: join(root, "cache") },
+      stdout: "pipe",
+      stdin: "ignore",
+      stderr: "pipe",
+    });
+    const [err, out, exitCode] = await Promise.all([proc.stderr.text(), proc.stdout.text(), proc.exited]);
+    return { err, out, exitCode };
+  }
+
+  // What bun prints for an edge it refuses. The declaring package is always named
+  // `bar` here; `declarer` is how bun prints it, which depends on where it came from.
+  function refusal(name: string, spec: string, declarer: string) {
+    return [
+      `error: refusing to resolve "${name}@${spec}" declared by ${declarer}: local tarball dependencies are only allowed in the package.json files of this project`,
+      `note: add "${name}": "${spec}" to the root package.json to install that tarball for bar as well`,
+    ];
+  }
+
+  // The rest of stderr is progress output ("Resolving dependencies", ...).
+  function diagnostics(stderr: string) {
+    return stderr.split(/\r?\n/).filter(line => line.startsWith("error:") || line.startsWith("note:"));
+  }
+
+  async function expectRejected(root: string, declarer: string) {
+    const { err, out, exitCode } = await install(root);
+
+    const rejected = Object.entries(declaredTarballs(root));
+    const expected = [
+      ...rejected.flatMap(([name, spec]) => refusal(name, spec, declarer)),
+      ...rejected.map(([name, spec]) => `error: ${name}@${spec} failed to resolve`),
+    ];
+    // The dependencies are reported in the declaring package's dependency order,
+    // which differs between a registry manifest and a package.json.
+    expect(diagnostics(err).sort()).toEqual(expected.sort());
+    expect(err).not.toContain("Saved lockfile");
+    expect(out).not.toContain("installed");
+    expect(await exists(join(root, "project", "node_modules"))).toBe(false);
+    expect(await exists(join(root, "project", "bun.lock"))).toBe(false);
+    expect(exitCode).toBe(1);
+  }
+
+  it("rejects the ones declared by a tarball dependency", async () => {
+    using dir = tempDir("local-tarballs-of-tarball-dep", {
+      "project/package.json": rootPackageJson({ bar: "file:./bar.tgz" }),
+    });
+    const root = String(dir);
+    await plantDeclaredTarballs(root);
+    await packManifest(join(root, "project", "bar.tgz"), {
+      name: "bar",
+      version: "0.0.2",
+      dependencies: declaredTarballs(root),
+    });
+
+    await expectRejected(root, "bar@./bar.tgz");
+  });
+
+  it("rejects the ones declared by a git dependency", async () => {
+    using dir = tempDir("local-tarballs-of-git-dep", {});
+    const root = String(dir);
+    await write(
+      join(root, "work", "package.json"),
+      JSON.stringify({ name: "bar", version: "0.0.2", dependencies: declaredTarballs(root) }),
+    );
+    const sha = await createDumbHttpGitRepo(root, {});
+    using server = serveDirectory(root);
+    const repo = `git+http://localhost:${server.port}/repo.git`;
+    await write(join(root, "project", "package.json"), rootPackageJson({ bar: repo }));
+    await plantDeclaredTarballs(root);
+
+    await expectRejected(root, `bar@${repo}#${sha}`);
+  });
+
+  it("rejects the ones declared by a registry package", async () => {
+    await withContext(defaultOpts, async ctx => {
+      using dir = tempDir("local-tarballs-of-registry-dep", {});
+      const root = String(dir);
+      await writeRegistryProject(ctx, root, { dependencies: declaredTarballs(root) });
+      await plantDeclaredTarballs(root);
+
+      await expectRejected(root, "bar@0.0.2");
+    });
+  });
+
+  // Peers are installed too, so the same refusal applies; unlike a regular
+  // dependency, an unresolved peer is not reported a second time as
+  // "failed to resolve".
+  it("rejects the one a registry package declares as a peer dependency", async () => {
+    await withContext(defaultOpts, async ctx => {
+      using dir = tempDir("peer-local-tarball-of-registry-dep", {});
+      const root = String(dir);
+      await writeRegistryProject(ctx, root, { peerDependencies: { inside: "file:./inside.tgz" } });
+      await cp(planted, join(root, "project", "inside.tgz"));
+
+      const { err, exitCode } = await install(root);
+      expect(diagnostics(err)).toEqual(refusal("inside", "file:./inside.tgz", "bar@0.0.2"));
+      expect(await exists(join(root, "project", "node_modules", "inside"))).toBe(false);
+      expect(await exists(join(root, "project", "bun.lock"))).toBe(false);
+      expect(exitCode).toBe(1);
+    });
+  });
+
+  // The remedy the note describes: a tarball the root package.json itself depends
+  // on, under the same name, is the project's own, so a registry package asking
+  // for that exact dependency gets it too.
+  it("installs the one the root package.json declares as well", async () => {
+    await withContext(defaultOpts, async ctx => {
+      using dir = tempDir("root-declared-local-tarball-of-registry-dep", {});
+      const root = String(dir);
+      await writeRegistryProject(
+        ctx,
+        root,
+        { dependencies: { inside: "file:./inside.tgz" } },
+        { dependencies: { inside: "file:./inside.tgz" } },
+      );
+      await cp(planted, join(root, "project", "inside.tgz"));
+
+      const { err, out, exitCode } = await install(root);
+      expect(diagnostics(err)).toEqual([]);
+      expect(out).toContain("2 packages installed");
+      expect(await readdirSorted(join(root, "project", "node_modules"))).toEqual([".bin", "bar", "inside"]);
+      expect(await file(join(root, "project", "node_modules", "inside", "package.json")).json()).toEqual(
+        plantedManifest,
+      );
+      const lockfile = await file(join(root, "project", "bun.lock")).text();
+      expect(lockfile).toContain('"inside": ["baz@./inside.tgz"');
+      expect(lockfile).not.toContain('"bar/inside"');
+      expect(exitCode).toBe(0);
+    });
+  });
+
+  // Only the identical dependency counts: neither the name nor the path alone.
+  for (const [what, rootDependencies] of [
+    ["another tarball under the same name", { inside: "file:./vendored.tgz" }],
+    ["the same tarball under another name", { vendored: "file:./inside.tgz" }],
+  ] as const) {
+    it(`still rejects it when the root package.json declares ${what}`, async () => {
+      await withContext(defaultOpts, async ctx => {
+        using dir = tempDir("similar-root-local-tarball-of-registry-dep", {});
+        const root = String(dir);
+        await writeRegistryProject(
+          ctx,
+          root,
+          { dependencies: { inside: "file:./inside.tgz" } },
+          { dependencies: rootDependencies },
+        );
+        await Promise.all([
+          cp(planted, join(root, "project", "inside.tgz")),
+          cp(planted, join(root, "project", "vendored.tgz")),
+        ]);
+
+        const { err, exitCode } = await install(root);
+        expect(diagnostics(err)).toEqual([
+          ...refusal("inside", "file:./inside.tgz", "bar@0.0.2"),
+          "error: inside@file:./inside.tgz failed to resolve",
+        ]);
+        expect(await exists(join(root, "project", "node_modules"))).toBe(false);
+        expect(await exists(join(root, "project", "bun.lock"))).toBe(false);
+        expect(exitCode).toBe(1);
+      });
+    });
+  }
+
+  it("leaves the one a registry package declares as optional uninstalled", async () => {
+    await withContext(defaultOpts, async ctx => {
+      using dir = tempDir("optional-local-tarball-of-registry-dep", {});
+      const root = String(dir);
+      await writeRegistryProject(ctx, root, { optionalDependencies: { inside: "file:./inside.tgz" } });
+      await cp(planted, join(root, "project", "inside.tgz"));
+
+      const { err, out, exitCode } = await install(root);
+      expect(err).not.toContain("error:");
+      expect(out).toContain("1 package installed");
+      expect(await readdirSorted(join(root, "project", "node_modules"))).toEqual(["bar"]);
+      const lockfile = await file(join(root, "project", "bun.lock")).text();
+      expect(lockfile).toContain('"bar": ["bar@0.0.2"');
+      expect(lockfile).not.toContain("baz@./inside.tgz");
+      expect(exitCode).toBe(0);
+    });
+  });
+
+  // `overrides` / `resolutions` are written in the root package.json, so a tarball
+  // path coming from there is the project's own even when it replaces the
+  // dependency of a registry package.
+  for (const field of ["resolutions", "overrides"]) {
+    it(`installs the one a root "${field}" entry puts on a registry package's dependency`, async () => {
+      await withContext(defaultOpts, async ctx => {
+        using dir = tempDir(`${field}-local-tarball-on-registry-dep`, {});
+        const root = String(dir);
+        const urls = await writeRegistryProject(
+          ctx,
+          root,
+          { dependencies: { vendored: "0.0.1" } },
+          { [field]: { vendored: "file:./vendored.tgz" } },
+        );
+        await cp(planted, join(root, "project", "vendored.tgz"));
+
+        const { err, out, exitCode } = await install(root);
+        expect(err).not.toContain("error:");
+        expect(out).toContain("2 packages installed");
+        expect(await file(join(root, "project", "node_modules", "vendored", "package.json")).json()).toEqual(
+          plantedManifest,
+        );
+        expect(urls.sort()).toEqual([`${ctx.registry_url}bar`, `${ctx.registry_url}bar-0.0.2.tgz`]);
+        expect(exitCode).toBe(0);
+      });
+    });
+  }
+
+  // A `file:` folder's package.json is part of the project like a workspace's, so
+  // it may declare local tarballs. The tarball is planted in both directories the
+  // path could be taken relative to; which one bun reads is not what this pins.
+  it("installs the one declared by a file: folder dependency", async () => {
+    using dir = tempDir("local-tarball-of-folder-dep", {
+      "project/package.json": rootPackageJson({ lib: "file:./vendor/lib" }),
+      "project/vendor/lib/package.json": JSON.stringify({
+        name: "lib",
+        version: "1.0.0",
+        dependencies: { tool: "file:./tool.tgz" },
+      }),
+    });
+    const root = String(dir);
+    await Promise.all([
+      cp(planted, join(root, "project", "tool.tgz")),
+      cp(planted, join(root, "project", "vendor", "lib", "tool.tgz")),
+    ]);
+
+    const { err, out, exitCode } = await install(root);
+    expect(err).not.toContain("error:");
+    expect(out).toContain("2 packages installed");
+    expect(await file(join(root, "project", "node_modules", "tool", "package.json")).json()).toEqual(plantedManifest);
+    expect(exitCode).toBe(0);
+  });
+});
+
 for (const field of ["resolutions", "overrides"]) {
   it(`installs a file: dependency pointing outside the project when it came from root package.json "${field}"`, async () => {
     // `overrides` / `resolutions` can only be declared in the root package.json,

From f6f08d8547dca0da4e0c7e0f2735c75851c19cd1 Mon Sep 17 00:00:00 2001
From: robobun <117481402+robobun@users.noreply.github.com>
Date: Mon, 17 Aug 2026 01:25:57 +0000
Subject: [PATCH 099/258] install(hoisted): link a file: override applied to a
 dependency of an installed package (#38994)

---
 src/install/PackageInstaller.rs               |  12 +-
 src/install/lockfile.rs                       |   8 ++
 test/cli/install/bun-install-registry.test.ts |  49 +++++++
 test/cli/install/bun-install.test.ts          | 134 ++++++++++++++++++
 4 files changed, 199 insertions(+), 4 deletions(-)

diff --git a/src/install/PackageInstaller.rs b/src/install/PackageInstaller.rs
index a83f38d432cf..935b0e675cce 100644
--- a/src/install/PackageInstaller.rs
+++ b/src/install/PackageInstaller.rs
@@ -1901,11 +1901,15 @@ impl<'a> PackageInstaller<'a> {
                         // This is a transitive folder dependency. It is installed as a directory of symlinks
                         // to the target's files (see `PackageInstall::install`), and is not hoisted.
                         //
-                        // A transitive `Resolution::Folder` declared by a local `file:` package
-                        // is relative to the top-level dir (`Package::parse` normalized it), so
-                        // install it from `installer.cache_dir` (the cwd, set in the switch above).
+                        // A transitive `Resolution::Folder` is relative to the top-level dir when
+                        // a local `file:` package declared it (`Package::parse` normalized it) or
+                        // when a root `overrides`/`resolutions` rule, scoped or not, supplied the
+                        // path, so install it from `installer.cache_dir` (the cwd, set in the
+                        // switch above). Only the unsafe-path check in that switch is limited to
+                        // plain rules (see `OverrideMap::contains_name`).
                         if resolution.tag == resolution::Tag::Folder
-                            && self.lockfile().is_folder_tree_id(self.current_tree_id)
+                            && (self.lockfile().is_folder_tree_id(self.current_tree_id)
+                                || self.lockfile().is_overridden_dependency(dependency_id))
                         {
                             break 'result installer.install(
                                 self.skip_delete,
diff --git a/src/install/lockfile.rs b/src/install/lockfile.rs
index 6575bfcedd50..0879cc363463 100644
--- a/src/install/lockfile.rs
+++ b/src/install/lockfile.rs
@@ -997,6 +997,14 @@ impl Lockfile {
                 == ResolutionTag::Folder
     }
 
+    /// Is there a root `overrides`/`resolutions` rule (plain or scoped) for this dependency?
+    /// Rules are written in the root package.json, so a `file:` path applied through one is
+    /// relative to the top-level dir whichever package declares the dependency.
+    pub(crate) fn is_overridden_dependency(&self, id: DependencyID) -> bool {
+        let dependency = &self.buffers.dependencies[id as usize];
+        self.overrides.get(self, id, dependency.name_hash).is_some()
+    }
+
     /// Returns the package id of the workspace the install is taking place in.
     pub(crate) fn get_workspace_package_id(
         &self,
diff --git a/test/cli/install/bun-install-registry.test.ts b/test/cli/install/bun-install-registry.test.ts
index 2fba3410cad6..93d50e692d8a 100644
--- a/test/cli/install/bun-install-registry.test.ts
+++ b/test/cli/install/bun-install-registry.test.ts
@@ -5946,6 +5946,55 @@ describe("transitive file dependencies", () => {
       }
     });
   }
+
+  // `file-dep@1.0.0` declares `"files": "file:./the-files"` and ships `the-files/`
+  // (index.js + package.json) in its tarball.
+  test("a root override redirects a registry package's own file: dependency to a folder in the project", async () => {
+    await Promise.all([
+      write(
+        packageJson,
+        JSON.stringify({
+          name: "foo",
+          dependencies: { "file-dep": "1.0.0" },
+          overrides: { files: "file:./vendor/files" },
+        }),
+      ),
+      write(join(packageDir, "vendor", "files", "package.json"), JSON.stringify({ name: "files", version: "9.9.9" })),
+      write(join(packageDir, "vendor", "files", "vendored.js"), ""),
+    ]);
+
+    for (const frozenLockfile of [false, true]) {
+      await rm(join(packageDir, "node_modules"), { recursive: true, force: true });
+
+      const { out } = await runBunInstall(env, packageDir, { frozenLockfile });
+
+      expect(out).toContain("2 packages installed");
+      expect(await readdirSorted(join(packageDir, "node_modules", "file-dep", "node_modules", "files"))).toEqual([
+        "package.json",
+        "vendored.js",
+      ]);
+    }
+  });
+
+  test("a scoped override for another dependent leaves a registry package's own file: dependency alone", async () => {
+    await write(
+      packageJson,
+      JSON.stringify({
+        name: "foo",
+        dependencies: { "file-dep": "1.0.0" },
+        // Names `files`, but only as a dependency of `other`, which file-dep is not.
+        overrides: { other: { files: "file:./vendor/files" } },
+      }),
+    );
+
+    const { out } = await runBunInstall(env, packageDir);
+
+    expect(out).toContain("2 packages installed");
+    expect(await readdirSorted(join(packageDir, "node_modules", "file-dep", "node_modules", "files"))).toEqual([
+      "index.js",
+      "package.json",
+    ]);
+  });
 });
 
 test("name from manifest is scoped and url encoded", async () => {
diff --git a/test/cli/install/bun-install.test.ts b/test/cli/install/bun-install.test.ts
index 0d2d181cc143..69d85867817c 100644
--- a/test/cli/install/bun-install.test.ts
+++ b/test/cli/install/bun-install.test.ts
@@ -11439,8 +11439,142 @@ for (const field of ["resolutions", "overrides"]) {
       }"
     `);
   });
+
+  // Unlike `pkg-a` above, the package declaring the overridden dependency is a
+  // registry package here, so the hoisted installer cannot source the folder
+  // relative to a local declarer: the path only makes sense relative to the
+  // project, where the rule was written.
+  const isOddRules: [kind: string, rule: Record<string, unknown>][] = [
+    ["plain", { "is-odd": "file:./vendor/is-odd" }],
+    [
+      "nested",
+      field === "overrides"
+        ? { "is-even": { "is-odd": "file:./vendor/is-odd" } }
+        : { "is-even/is-odd": "file:./vendor/is-odd" },
+    ],
+  ];
+
+  for (const [kind, rule] of isOddRules) {
+    it.concurrent(`links a ${kind} "${field}" file: rule applied to a registry package's dependency`, async () => {
+      await withContext(defaultOpts, async ctx => {
+        const urls: string[] = [];
+        setContextHandler(
+          ctx,
+          dummyRegistryForContext(ctx, urls, { "1.0.0": { dependencies: { "is-odd": "^0.1.2" } } }),
+        );
+        await writeIsEvenProject(ctx.package_dir, { [field]: rule });
+
+        const { out } = await runBunInstall(env, ctx.package_dir, { saveTextLockfile: true });
+        expect(out).toContain("2 packages installed");
+        expect(urls.sort()).toEqual([`${ctx.registry_url}is-even`, `${ctx.registry_url}is-even-1.0.0.tgz`]);
+        expect(await file(join(ctx.package_dir, "bun.lock")).text()).toContain(
+          `"is-even/is-odd": ["is-odd@file:./vendor/is-odd", {}]`,
+        );
+        await expectVendoredIsOddLinked(ctx.package_dir);
+
+        // Installing again on top of the existing node_modules keeps it.
+        await runBunInstall(env, ctx.package_dir, { savesLockfile: false });
+        await expectVendoredIsOddLinked(ctx.package_dir);
+
+        // Installing from the lockfile goes through the installer without re-resolving.
+        await rm(join(ctx.package_dir, "node_modules"), { recursive: true, force: true });
+        await runBunInstall(env, ctx.package_dir, { frozenLockfile: true });
+        await expectVendoredIsOddLinked(ctx.package_dir);
+
+        expect(urls.filter(url => url.includes("is-odd"))).toEqual([]);
+      });
+    });
+
+    if (field !== "overrides") continue;
+
+    // The isolated linker already sources every folder package from the project; pin the parity.
+    it.concurrent(`isolated linker: a ${kind} file: override applied to a registry package's dependency`, async () => {
+      await withContext({ linker: "isolated" }, async ctx => {
+        const urls: string[] = [];
+        setContextHandler(
+          ctx,
+          dummyRegistryForContext(ctx, urls, { "1.0.0": { dependencies: { "is-odd": "^0.1.2" } } }),
+        );
+        await writeIsEvenProject(ctx.package_dir, { [field]: rule });
+
+        await runBunInstall(env, ctx.package_dir);
+        expect(urls.filter(url => url.includes("is-odd"))).toEqual([]);
+        await expectIsEvenUsesVendoredIsOdd(ctx.package_dir);
+      });
+    });
+  }
 }
 
+/**
+ * `is-even@1.0.0` (served by the dummy registry from the fixture tarball) does
+ * `require("is-odd")`. `vendor/is-odd` is what the override rules above point it at;
+ * it is recognizable at runtime by the line it prints.
+ */
+async function writeIsEvenProject(projectDir: string, rootPackageJsonFields: Record<string, unknown>) {
+  await Promise.all([
+    write(
+      join(projectDir, "package.json"),
+      JSON.stringify({
+        name: "foo",
+        version: "0.0.1",
+        dependencies: { "is-even": "1.0.0" },
+        ...rootPackageJsonFields,
+      }),
+    ),
+    write(join(projectDir, "vendor", "is-odd", "package.json"), JSON.stringify({ name: "is-odd", version: "9.9.9" })),
+    write(
+      join(projectDir, "vendor", "is-odd", "index.js"),
+      `module.exports = function isOdd() { console.log("vendored is-odd"); return true; };`,
+    ),
+  ]);
+}
+
+async function expectIsEvenUsesVendoredIsOdd(projectDir: string) {
+  await using proc = spawn({
+    cmd: [bunExe(), "-e", `console.log(require("is-even")(2))`],
+    cwd: projectDir,
+    env,
+    stdout: "pipe",
+    stderr: "pipe",
+  });
+  const [out, err, exitCode] = await Promise.all([proc.stdout.text(), proc.stderr.text(), proc.exited]);
+  expect(err).toBe("");
+  expect(out).toBe("vendored is-odd\nfalse\n");
+  expect(exitCode).toBe(0);
+}
+
+async function expectVendoredIsOddLinked(projectDir: string) {
+  // Folder dependencies are never hoisted: the rule's target is linked inside is-even.
+  expect(await readdirSorted(join(projectDir, "node_modules", "is-even", "node_modules"))).toEqual(["is-odd"]);
+  expect(await readdirSorted(join(projectDir, "node_modules", "is-even", "node_modules", "is-odd"))).toEqual([
+    "index.js",
+    "package.json",
+  ]);
+  await expectIsEvenUsesVendoredIsOdd(projectDir);
+}
+
+it.concurrent("fails when a file: override for a registry package's dependency names a missing folder", async () => {
+  await withContext(defaultOpts, async ctx => {
+    const urls: string[] = [];
+    setContextHandler(ctx, dummyRegistryForContext(ctx, urls, { "1.0.0": { dependencies: { "is-odd": "^0.1.2" } } }));
+    await write(
+      join(ctx.package_dir, "package.json"),
+      JSON.stringify({
+        name: "foo",
+        version: "0.0.1",
+        dependencies: { "is-even": "1.0.0" },
+        overrides: { "is-odd": "file:./vendor/is-odd" },
+      }),
+    );
+
+    const { out, err } = await runBunInstall(env, ctx.package_dir, { allowErrors: true, expectedExitCode: 1 });
+
+    expect(err).toContain('Could not find folder "file:./vendor/is-odd" for dependency "is-odd"');
+    expect(out).toContain("Failed to install 1 package");
+    expect(await readdirSorted(join(ctx.package_dir, "node_modules", "is-even", "node_modules"))).toEqual([]);
+  });
+});
+
 it("installs the transitive file: dependency of a file: dependency", async () => {
   using dir = tempDir("transitive-file-dep", {
     "package.json": JSON.stringify({

From ba53b8278cd98360df708f2f4188c66a7dfffbe5 Mon Sep 17 00:00:00 2001
From: robobun <117481402+robobun@users.noreply.github.com>
Date: Mon, 17 Aug 2026 01:26:02 +0000
Subject: [PATCH 100/258] install: refuse link: paths with .. or an absolute
 path declared by packages installed from the cache (#39023)

---
 .../PackageManager/PackageManagerEnqueue.rs   |  37 +++
 src/install/lockfile.rs                       |  10 +
 src/install/resolution.rs                     |   5 +
 test/cli/install/bun-install.test.ts          | 260 ++++++++++++++++++
 4 files changed, 312 insertions(+)

diff --git a/src/install/PackageManager/PackageManagerEnqueue.rs b/src/install/PackageManager/PackageManagerEnqueue.rs
index 94acaa738999..3fefb6fb4853 100644
--- a/src/install/PackageManager/PackageManagerEnqueue.rs
+++ b/src/install/PackageManager/PackageManagerEnqueue.rs
@@ -1420,6 +1420,20 @@ pub fn enqueue_dependency_with_main_and_success_fn(
         dependency::version::Tag::Symlink | dependency::version::Tag::Workspace => {
             let dependency_tag = version.tag;
 
+            if dependency_tag == dependency::version::Tag::Symlink
+                && !version_was_replaced
+                && crate::bin::bin_target_escapes_package_dir(this.lockfile.str(version.symlink()))
+                && let Some(declarer) = this.lockfile.get_parent_pkg_of_dependency(id)
+                && !this.lockfile.packages.items_resolution()[declarer as usize]
+                    .tag
+                    .is_local_package()
+            {
+                if dependency.behavior.is_required() {
+                    reject_escaping_link_of_remote_package(this, declarer, dependency);
+                }
+                return Ok(());
+            }
+
             let _result = match get_or_put_resolved_package(
                 this,
                 name_hash,
@@ -1715,6 +1729,29 @@ fn reject_local_tarball_of_remote_package(
     );
 }
 
+/// `normalize_package_json_path` resolves the value against the project, not the declaring package, so only package.json files read from the project may use `..` or an absolute path.
+#[cold]
+#[inline(never)]
+fn reject_escaping_link_of_remote_package(
+    this: &PackageManager,
+    declarer: PackageID,
+    dependency: &Dependency,
+) {
+    let buf = this.lockfile.buffers.string_bytes.as_slice();
+    let packages = this.lockfile.packages.slice();
+    this.log_mut().add_error_fmt(
+        None,
+        bun_ast::Loc::EMPTY,
+        format_args!(
+            "refusing to resolve \"{}@{}\" declared by {}@{}: link: paths with \"..\" or an absolute path are only allowed in the package.json files of this project",
+            bstr::BStr::new(dependency.name.slice(buf)),
+            bstr::BStr::new(dependency.version.literal.slice(buf)),
+            bstr::BStr::new(packages.items_name()[declarer as usize].slice(buf)),
+            packages.items_resolution()[declarer as usize].fmt(buf, bun_fmt::PathSep::Posix),
+        ),
+    );
+}
+
 /// Allocate and initialise an `.extract` Task for an npm tarball.
 /// Shared by the buffered path (`enqueueExtractNPMPackage`) and the
 /// streaming path (`createExtractTaskForStreaming`) so both produce
diff --git a/src/install/lockfile.rs b/src/install/lockfile.rs
index 0879cc363463..c7d35d4fab0a 100644
--- a/src/install/lockfile.rs
+++ b/src/install/lockfile.rs
@@ -930,6 +930,16 @@ impl Lockfile {
             .any(|root_dependency| root_dependency.eql(dependency, buf, buf))
     }
 
+    /// `None` for the edges `enqueue_dependency_to_root` appends outside of any package.
+    pub(crate) fn get_parent_pkg_of_dependency(&self, id: DependencyID) -> Option<PackageID> {
+        for (pkg_id, dependencies) in self.packages.items_dependencies().iter().enumerate() {
+            if dependencies.contains(id) {
+                return Some(PackageID::try_from(pkg_id).expect("int cast"));
+            }
+        }
+        None
+    }
+
     pub(crate) fn get_workspace_pkg_if_workspace_dep(&self, id: DependencyID) -> PackageID {
         let packages = self.packages.slice();
         let resolutions = packages.items_resolution();
diff --git a/src/install/resolution.rs b/src/install/resolution.rs
index 1acfc6dc5170..20b46cd37a89 100644
--- a/src/install/resolution.rs
+++ b/src/install/resolution.rs
@@ -1026,6 +1026,11 @@ impl Tag {
         self == Tag::Root || self == Tag::Workspace || self == Tag::Folder
     }
 
+    /// The package.json is read from the project rather than extracted into the cache.
+    pub(crate) fn is_local_package(self) -> bool {
+        self == Tag::Root || self == Tag::Workspace || self == Tag::Folder
+    }
+
     pub(crate) fn can_enqueue_install_task(self) -> bool {
         self == Tag::Npm
             || self == Tag::LocalTarball
diff --git a/test/cli/install/bun-install.test.ts b/test/cli/install/bun-install.test.ts
index 69d85867817c..4151ce42fad2 100644
--- a/test/cli/install/bun-install.test.ts
+++ b/test/cli/install/bun-install.test.ts
@@ -11781,6 +11781,266 @@ for (const [linker, libNodeModules, toolNodeModules, toolNodeModulesEntries] of
   });
 }
 
+// The link: form of the file: containment rule tested above. A link: target with
+// ".." or an absolute path names a directory of the machine running the install
+// (bun resolves it against the project and links it from the global link dir),
+// which only the package.json files read from the project can mean to do. A
+// package installed from the cache (registry, git, tarball) declaring one used
+// to get the directory's package.json read and recorded in bun.lock, and, when
+// the path was valid from both base directories, the directory symlinked into
+// node_modules under a name of its choosing.
+describe.concurrent("link: paths with .. or an absolute path declared by a dependency", () => {
+  // The project is <root>/project so that `../outside` stays inside the temp dir.
+  // `climbing` only climbs out after normalization.
+  function declaredLinks(root: string): Record<string, string> {
+    return {
+      outside: "link:../outside",
+      climbing: "link:x/../../climbing",
+      absolute: `link:${join(root, "absolute").replaceAll("\\", "/")}`,
+    };
+  }
+
+  // Every target exists, so resolving one of them is observable in bun.lock.
+  function linkTargets(): Record<string, string> {
+    return {
+      "outside/package.json": JSON.stringify({ name: "outside-dir", version: "1.0.0" }),
+      "climbing/package.json": JSON.stringify({ name: "climbing-dir", version: "1.0.0" }),
+      "absolute/package.json": JSON.stringify({ name: "absolute-dir", version: "1.0.0" }),
+    };
+  }
+
+  function rootPackageJson(dependencies: Record<string, string>, extra: object = {}) {
+    return JSON.stringify({ name: "my-app", version: "1.0.0", dependencies, ...extra });
+  }
+
+  // <root>/project depends on `bar@0.0.2` from the dummy registry, whose manifest
+  // for it carries `barManifest`.
+  async function writeRegistryProject(ctx: TestContext, root: string, barManifest: object, rootExtra: object = {}) {
+    setContextHandler(ctx, dummyRegistryForContext(ctx, [], { "0.0.2": barManifest }));
+    await write(join(root, "project", "package.json"), rootPackageJson({ bar: "0.0.2" }, rootExtra));
+    await write(join(root, "project", "bunfig.toml"), `[install]\nregistry = "${ctx.registry_url}"\n`);
+  }
+
+  // Packs <root>/tb-src into <root>/project/tb-1.0.0.tgz.
+  async function packDeclarer(root: string, manifest: object) {
+    await write(join(root, "tb-src", "package.json"), JSON.stringify({ name: "tb", version: "1.0.0", ...manifest }));
+    await using proc = spawn({
+      cmd: [bunExe(), "pm", "pack", "--destination", join(root, "project")],
+      cwd: join(root, "tb-src"),
+      env,
+      stdout: "ignore",
+      stderr: "pipe",
+    });
+    const [packErr, packExitCode] = await Promise.all([proc.stderr.text(), proc.exited]);
+    expect(packErr).not.toContain("error:");
+    expect(packExitCode).toBe(0);
+  }
+
+  async function install(root: string, ...args: string[]) {
+    await using proc = spawn({
+      cmd: [bunExe(), "install", ...args],
+      cwd: join(root, "project"),
+      env: { ...env, BUN_INSTALL_CACHE_DIR: join(root, "cache"), BUN_INSTALL_GLOBAL_DIR: join(root, "global") },
+      stdout: "pipe",
+      stdin: "ignore",
+      stderr: "pipe",
+    });
+    const [err, out, exitCode] = await Promise.all([proc.stderr.text(), proc.stdout.text(), proc.exited]);
+    return { err, out, exitCode };
+  }
+
+  // `declarer` is how bun prints the package declaring the dependency.
+  function refusal(name: string, spec: string, declarer: string) {
+    return `error: refusing to resolve "${name}@${spec}" declared by ${declarer}: link: paths with ".." or an absolute path are only allowed in the package.json files of this project`;
+  }
+
+  // The rest of stderr is progress output ("Resolving dependencies", ...).
+  function errorLines(stderr: string) {
+    return stderr.split(/\r?\n/).filter(line => line.startsWith("error:"));
+  }
+
+  async function expectRefused(root: string, declarer: string) {
+    const { err, out, exitCode } = await install(root);
+
+    const refused = Object.entries(declaredLinks(root));
+    const expected = [
+      ...refused.map(([name, spec]) => refusal(name, spec, declarer)),
+      ...refused.map(([name, spec]) => `error: ${name}@${spec} failed to resolve`),
+    ];
+    // Reported in the declaring package's dependency order, which differs between
+    // a registry manifest and a package.json.
+    expect(errorLines(err).sort()).toEqual(expected.sort());
+    expect(err).not.toContain("Saved lockfile");
+    expect(out).not.toContain("installed");
+    expect(await exists(join(root, "project", "bun.lock"))).toBe(false);
+    expect(await exists(join(root, "project", "node_modules"))).toBe(false);
+    expect(exitCode).toBe(1);
+  }
+
+  it("are refused when a tarball dependency declares them", async () => {
+    using dir = tempDir("escaping-links-of-tarball-dep", {
+      ...linkTargets(),
+      "project/package.json": rootPackageJson({ tb: "file:./tb-1.0.0.tgz" }),
+    });
+    const root = String(dir);
+    await packDeclarer(root, { dependencies: declaredLinks(root) });
+
+    await expectRefused(root, "tb@./tb-1.0.0.tgz");
+  });
+
+  it("are refused when a git dependency declares them", async () => {
+    using dir = tempDir("escaping-links-of-git-dep", linkTargets());
+    const root = String(dir);
+    await write(
+      join(root, "work", "package.json"),
+      JSON.stringify({ name: "bar", version: "0.0.2", dependencies: declaredLinks(root) }),
+    );
+    const sha = await createDumbHttpGitRepo(root, {});
+    using server = serveDirectory(root);
+    const repo = `git+http://localhost:${server.port}/repo.git`;
+    await write(join(root, "project", "package.json"), rootPackageJson({ bar: repo }));
+
+    await expectRefused(root, `bar@${repo}#${sha}`);
+  });
+
+  it("are refused when a registry package declares them", async () => {
+    await withContext(defaultOpts, async ctx => {
+      using dir = tempDir("escaping-links-of-registry-dep", linkTargets());
+      const root = String(dir);
+      await writeRegistryProject(ctx, root, { dependencies: declaredLinks(root) });
+
+      await expectRefused(root, "bar@0.0.2");
+    });
+  });
+
+  it("are refused when a registry package declares one as a peer dependency", async () => {
+    await withContext(defaultOpts, async ctx => {
+      using dir = tempDir("escaping-peer-link-of-registry-dep", linkTargets());
+      const root = String(dir);
+      await writeRegistryProject(ctx, root, { peerDependencies: { outside: "link:../outside" } });
+
+      // An unresolved peer is not reported a second time as "failed to resolve"
+      // and does not stop bar itself from being installed; the error still fails
+      // the install before the lockfile is saved.
+      const { err, exitCode } = await install(root);
+      expect(errorLines(err)).toEqual([refusal("outside", "link:../outside", "bar@0.0.2")]);
+      expect(await exists(join(root, "project", "bun.lock"))).toBe(false);
+      expect(await exists(join(root, "project", "node_modules", "outside"))).toBe(false);
+      expect(exitCode).toBe(1);
+    });
+  });
+
+  it("stay uninstalled when a registry package declares one as an optional dependency", async () => {
+    await withContext(defaultOpts, async ctx => {
+      using dir = tempDir("escaping-optional-link-of-registry-dep", linkTargets());
+      const root = String(dir);
+      await writeRegistryProject(ctx, root, { optionalDependencies: { outside: "link:../outside" } });
+
+      const { err, out, exitCode } = await install(root);
+      expect(err).not.toContain("error:");
+      expect(out).toContain("1 package installed");
+      expect(await readdirSorted(join(root, "project", "node_modules"))).toEqual(["bar"]);
+      const lockfile = await file(join(root, "project", "bun.lock")).text();
+      expect(lockfile).toContain('"bar": ["bar@0.0.2"');
+      expect(lockfile).not.toContain("outside-dir");
+      expect(exitCode).toBe(0);
+    });
+  });
+
+  // What stays allowed. These only assert the resolution (`--lockfile-only`):
+  // bun currently creates the link for a target with ".." relative to the global
+  // link dir rather than the directory it resolved the target from, which is a
+  // separate problem of the root-declared form.
+  it("are still resolved when the root package.json or a workspace declares them", async () => {
+    using dir = tempDir("escaping-links-of-root-and-workspace", {
+      ...linkTargets(),
+      "project/package.json": rootPackageJson({ outside: "link:../outside" }, { workspaces: ["packages/*"] }),
+      "project/packages/ws/package.json": JSON.stringify({
+        name: "ws",
+        version: "1.0.0",
+        dependencies: { climbing: "link:../climbing" },
+      }),
+    });
+    const root = String(dir);
+
+    const { err, exitCode } = await install(root, "--lockfile-only");
+    expect(err).not.toContain("error:");
+    const lockfile = await file(join(root, "project", "bun.lock")).text();
+    expect(lockfile).toContain('"outside": ["outside-dir@link:../outside"');
+    expect(lockfile).toContain('"climbing": ["climbing-dir@link:../climbing"');
+    expect(exitCode).toBe(0);
+  });
+
+  // `overrides` / `resolutions` are written in the root package.json, so a link:
+  // path coming from there is the project's own even when it replaces the
+  // dependency of a registry package.
+  for (const field of ["resolutions", "overrides"]) {
+    it(`are still resolved when a root "${field}" entry puts one on a registry package's dependency`, async () => {
+      await withContext(defaultOpts, async ctx => {
+        using dir = tempDir(`${field}-escaping-link-on-registry-dep`, linkTargets());
+        const root = String(dir);
+        await writeRegistryProject(
+          ctx,
+          root,
+          { dependencies: { vendored: "0.0.1" } },
+          { [field]: { vendored: "link:../outside" } },
+        );
+
+        const { err, exitCode } = await install(root, "--lockfile-only");
+        expect(err).not.toContain("error:");
+        const lockfile = await file(join(root, "project", "bun.lock")).text();
+        expect(lockfile).toContain('"vendored": ["outside-dir@link:../outside"');
+        expect(exitCode).toBe(0);
+      });
+    });
+  }
+
+  // A file: directory's package.json is read from the project like a workspace's,
+  // so it may declare one. The target is planted both where bun reads the path
+  // from today (the project) and next to the declaring directory; which of the
+  // two it reads is not what this pins.
+  it("are still resolved when a file: directory dependency declares them", async () => {
+    using dir = tempDir("escaping-link-of-folder-dep", {
+      ...linkTargets(),
+      "project/outside/package.json": linkTargets()["outside/package.json"],
+      "project/package.json": rootPackageJson({ lib: "file:./lib" }),
+      "project/lib/package.json": JSON.stringify({
+        name: "lib",
+        version: "1.0.0",
+        dependencies: { outside: "link:../outside" },
+      }),
+    });
+    const root = String(dir);
+
+    const { err, exitCode } = await install(root, "--lockfile-only");
+    expect(err).not.toContain("error:");
+    expect(await file(join(root, "project", "bun.lock")).text()).toContain('"outside": ["outside-dir@link:');
+    expect(exitCode).toBe(0);
+  });
+
+  // The documented form: `link:<name>` is looked up in the global link dir that
+  // `bun link` populates, whoever declares it.
+  it("do not affect a registry package linking a package by name", async () => {
+    await withContext(defaultOpts, async ctx => {
+      using dir = tempDir("named-link-of-registry-dep", {
+        "global/node_modules/linked-pkg/package.json": JSON.stringify({ name: "linked-pkg", version: "2.0.0" }),
+      });
+      const root = String(dir);
+      await writeRegistryProject(ctx, root, { dependencies: { "linked-pkg": "link:linked-pkg" } });
+
+      const { err, out, exitCode } = await install(root);
+      expect(err).not.toContain("error:");
+      expect(out).toContain("2 packages installed");
+      expect(await readdirSorted(join(root, "project", "node_modules"))).toEqual(["bar", "linked-pkg"]);
+      expect(await file(join(root, "project", "node_modules", "linked-pkg", "package.json")).json()).toEqual({
+        name: "linked-pkg",
+        version: "2.0.0",
+      });
+      expect(exitCode).toBe(0);
+    });
+  });
+});
+
 const fileDepCycleFixture = {
   "package.json": JSON.stringify({
     name: "my-app",

From 7c5f7be6edd4833497b8f3ecb2bdc47801ea5ef1 Mon Sep 17 00:00:00 2001
From: robobun <117481402+robobun@users.noreply.github.com>
Date: Mon, 17 Aug 2026 01:26:17 +0000
Subject: [PATCH 101/258] install: report ENAMETOOLONG for a --cwd value that
 does not fit the path buffer (#38375)

---
 .../PackageManager/CommandLineArguments.rs    | 78 +++++++++++--------
 test/cli/install/bun-install.test.ts          | 35 +++++++++
 2 files changed, 82 insertions(+), 31 deletions(-)

diff --git a/src/install/PackageManager/CommandLineArguments.rs b/src/install/PackageManager/CommandLineArguments.rs
index b7307ba874a6..c0f526223e2e 100644
--- a/src/install/PackageManager/CommandLineArguments.rs
+++ b/src/install/PackageManager/CommandLineArguments.rs
@@ -1584,37 +1584,8 @@ Full documentation is available at <magenta>https://bun.com/docs/pm/cli/prune<r>
             cli.concurrent_scripts = strings::parse_int::<usize>(concurrency, 10).ok();
         }
 
-        if let Some(cwd_) = args.option(b"--cwd") {
-            let mut buf = PathBuffer::uninit();
-            let mut buf2 = PathBuffer::uninit();
-
-            let final_path: &mut bun_core::ZStr = if !cwd_.is_empty() && cwd_[0] == b'.' {
-                let cwd_len = bun_sys::getcwd(&mut buf[..])?;
-                let cwd = &buf[..cwd_len];
-                let parts: [&[u8]; 1] = [cwd_];
-                let len = Path::resolve_path::join_abs_string_buf::<Path::platform::Auto>(
-                    cwd,
-                    &mut buf2[..],
-                    &parts,
-                )
-                .len();
-                buf2[len] = 0;
-                bun_core::ZStr::from_buf_mut(&mut buf2[..], len)
-            } else {
-                buf[..cwd_.len()].copy_from_slice(cwd_);
-                buf[cwd_.len()] = 0;
-                bun_core::ZStr::from_buf_mut(&mut buf[..], cwd_.len())
-            };
-            if let Err(err) = bun_sys::chdir(final_path) {
-                Output::err_generic(
-                    "failed to change directory to \"{}\": {}\n",
-                    (
-                        bstr::BStr::new(final_path.as_bytes()),
-                        bstr::BStr::new(err.name()),
-                    ),
-                );
-                Global::crash();
-            }
+        if let Some(cwd) = args.option(b"--cwd") {
+            change_directory(cwd)?;
         }
 
         if subcommand == Subcommand::Update {
@@ -1786,3 +1757,48 @@ Full documentation is available at <magenta>https://bun.com/docs/pm/cli/prune<r>
         Ok(cli)
     }
 }
+
+/// `--cwd`. Exits the process when the directory cannot be entered.
+fn change_directory(arg: &[u8]) -> Result<(), crate::Error> {
+    let mut buf = PathBuffer::uninit();
+    let mut buf2 = PathBuffer::uninit();
+    let too_long = || bun_sys::Error::from_code(bun_sys::E::ENAMETOOLONG, bun_sys::Tag::chdir);
+
+    // Either buffer keeps its last byte for the NUL terminator `chdir` needs.
+    let resolved: Result<&bun_core::ZStr, bun_sys::Error> = if arg.first() == Some(&b'.') {
+        let cwd_len = bun_sys::getcwd(&mut buf[..])?;
+        let out_len = buf2.len() - 1;
+        match Path::resolve_path::join_abs_string_buf_checked::<Path::platform::Auto>(
+            &buf[..cwd_len],
+            &mut buf2[..out_len],
+            &[arg],
+        )
+        .map(|joined| joined.len())
+        {
+            Some(len) => {
+                buf2[len] = 0;
+                Ok(bun_core::ZStr::from_buf(&buf2[..], len))
+            }
+            None => Err(too_long()),
+        }
+    } else if arg.len() < buf.len() {
+        buf[..arg.len()].copy_from_slice(arg);
+        buf[arg.len()] = 0;
+        Ok(bun_core::ZStr::from_buf(&buf[..], arg.len()))
+    } else {
+        Err(too_long())
+    };
+
+    let (path, err) = match resolved {
+        Ok(path) => match bun_sys::chdir(path) {
+            Ok(()) => return Ok(()),
+            Err(err) => (path.as_bytes(), err),
+        },
+        Err(err) => (arg, err),
+    };
+    Output::err_generic(
+        "failed to change directory to \"{}\": {}\n",
+        (bstr::BStr::new(path), bstr::BStr::new(err.name())),
+    );
+    Global::crash();
+}
diff --git a/test/cli/install/bun-install.test.ts b/test/cli/install/bun-install.test.ts
index 4151ce42fad2..3c0da3cdcf9c 100644
--- a/test/cli/install/bun-install.test.ts
+++ b/test/cli/install/bun-install.test.ts
@@ -7,6 +7,8 @@ import {
   bunExe,
   bunEnv as env,
   isLinux,
+  isAndroid,
+  isLinux,
   isWindows,
   joinP,
   normalizeBunSnapshot,
@@ -12829,3 +12831,36 @@ describe("progress bar with a name longer than its name buffer", () => {
     expect(await file(join(String(dir), "packages", "long", "postinstall-ran")).text()).toBe("ran\n");
   });
 });
+
+// `--cwd` is staged in a PATH_MAX-sized buffer (4096 bytes on Linux and Android, 1024 on macOS and
+// the BSDs) before chdir. Values that did not leave room for the NUL terminator used to abort the
+// process; the buffer on Windows (~96 KiB) is larger than any command line, so only POSIX is affected.
+describe.concurrent.skipIf(isWindows)("--cwd that does not fit the path buffer", () => {
+  const PATH_MAX = isLinux || isAndroid ? 4096 : 1024;
+  const name = (length: number) => Buffer.alloc(length, "a").toString();
+
+  it.each([
+    ["install, PATH_MAX - 1 bytes (rejected by the kernel)", "install", name(PATH_MAX - 1)],
+    ["install, exactly PATH_MAX bytes", "install", name(PATH_MAX)],
+    ["install, longer than PATH_MAX", "install", name(PATH_MAX + 1000)],
+    ["install, ./ prefix longer than PATH_MAX", "install", "./" + name(PATH_MAX + 1000)],
+    ["add, longer than PATH_MAX", "add", name(PATH_MAX + 1000)],
+  ])("%s", async (_, subcommand, cwd) => {
+    using dir = tempDir("install-cwd-too-long", {
+      "package.json": JSON.stringify({ name: "foo", version: "0.0.1" }),
+    });
+
+    await using proc = spawn({
+      cmd: [bunExe(), subcommand, "--cwd", cwd, ...(subcommand === "add" ? ["bar"] : [])],
+      cwd: String(dir),
+      stdout: "pipe",
+      stderr: "pipe",
+      env,
+    });
+    const [out, err, exitCode] = await Promise.all([proc.stdout.text(), proc.stderr.text(), proc.exited]);
+
+    expect(err).toContain(`failed to change directory to "${cwd}": ENAMETOOLONG`);
+    expect(out).toBe("");
+    expect(exitCode).toBe(1);
+  });
+});

From a000fd0fa9c6794d423543c090944909c4b01295 Mon Sep 17 00:00:00 2001
From: robobun <117481402+robobun@users.noreply.github.com>
Date: Mon, 17 Aug 2026 01:26:29 +0000
Subject: [PATCH 102/258] install: escape control characters in the bun pm
 untrusted/trust script listing (#38525)

---
 src/bun_core/fmt.rs                     | 44 ++++++++++++
 src/install/lockfile/Package/Scripts.rs | 15 ++--
 test/cli/install/bun-pm.test.ts         | 95 +++++++++++++++++++++++++
 3 files changed, 147 insertions(+), 7 deletions(-)

diff --git a/src/bun_core/fmt.rs b/src/bun_core/fmt.rs
index f52f07cbc9d5..1c729cc0b220 100644
--- a/src/bun_core/fmt.rs
+++ b/src/bun_core/fmt.rs
@@ -3407,6 +3407,50 @@ impl fmt::Write for EscapeControlCharsWriter<'_, '_> {
     }
 }
 
+// ───────────────────────────────────────────────────────────────────────────
+// escapeControlChars
+// ───────────────────────────────────────────────────────────────────────────
+
+/// `Display` adapter that spells out C0 controls, DEL and C1 controls
+/// (`\n`, `\x1b`, `\x7f`, `\u009b`, ...) so text authored by a dependency
+/// cannot erase, repaint or forge lines of terminal output when printed.
+pub struct EscapeControlChars<T>(pub T);
+
+/// [`EscapeControlChars`] over raw bytes; invalid UTF-8 renders as U+FFFD.
+pub fn escape_control_chars(text: &[u8]) -> EscapeControlChars<&bstr::BStr> {
+    EscapeControlChars(bstr::BStr::new(text))
+}
+
+impl<T: Display> Display for EscapeControlChars<T> {
+    fn fmt(&self, f: &mut Formatter<'_>) -> fmt::Result {
+        let mut writer = EscapeControlCharsWriter(f);
+        write!(writer, "{}", self.0)
+    }
+}
+
+struct EscapeControlCharsWriter<'a, 'f>(&'a mut Formatter<'f>);
+
+impl fmt::Write for EscapeControlCharsWriter<'_, '_> {
+    fn write_str(&mut self, s: &str) -> fmt::Result {
+        let mut start = 0;
+        for (i, c) in s.char_indices() {
+            if !matches!(c, '\0'..='\x1f' | '\x7f' | '\u{80}'..='\u{9f}') {
+                continue;
+            }
+            self.0.write_str(&s[start..i])?;
+            match c {
+                '\n' => self.0.write_str("\\n")?,
+                '\r' => self.0.write_str("\\r")?,
+                '\t' => self.0.write_str("\\t")?,
+                c if c.is_ascii() => write!(self.0, "\\x{:02x}", c as u32)?,
+                c => write!(self.0, "\\u{:04x}", c as u32)?,
+            }
+            start = i + c.len_utf8();
+        }
+        self.0.write_str(&s[start..])
+    }
+}
+
 // js_bindings (fmtString for highlighter.test.ts) lives in src/jsc/fmt_jsc.rs
 // alongside fmt_jsc.bind.ts; bun_core/ stays JSC-free.
 
diff --git a/src/install/lockfile/Package/Scripts.rs b/src/install/lockfile/Package/Scripts.rs
index 1991d56e783e..d6cef80c2417 100644
--- a/src/install/lockfile/Package/Scripts.rs
+++ b/src/install/lockfile/Package/Scripts.rs
@@ -1,7 +1,7 @@
 use bstr::BStr;
 
 use bun_core::ZBox;
-use bun_core::fmt::PathSep;
+use bun_core::fmt::{EscapeControlChars, PathSep, escape_control_chars};
 use bun_core::strings;
 use bun_install::lockfile::Lockfile;
 use bun_install::lockfile::Scripts as LockfileScripts;
@@ -444,21 +444,22 @@ impl List {
         resolution_buf: &[u8],
         format_type: PrintFormat,
     ) {
+        let resolution = EscapeControlChars(resolution.fmt(resolution_buf, PathSep::Posix));
         let needle = bun_paths::NODE_MODULES_NEEDLE;
         if let Some(i) = strings::index_of(self.cwd.as_bytes(), needle) {
             bun_core::pretty!(
                 "<d>.{s}{s} @{f}<r>\n",
                 BStr::new(SEP_STR.as_bytes()),
-                BStr::new(strings::without_trailing_slash(
+                escape_control_chars(strings::without_trailing_slash(
                     &self.cwd.as_bytes()[i + 1..]
                 )),
-                resolution.fmt(resolution_buf, PathSep::Posix),
+                resolution,
             );
         } else {
             bun_core::pretty!(
                 "<d>{s} @{f}<r>\n",
-                BStr::new(strings::without_trailing_slash(self.cwd.as_bytes())),
-                resolution.fmt(resolution_buf, PathSep::Posix),
+                escape_control_chars(strings::without_trailing_slash(self.cwd.as_bytes())),
+                resolution,
             );
         }
 
@@ -469,12 +470,12 @@ impl List {
                     PrintFormat::Completed => bun_core::pretty!(
                         " <green>✓<r> [{s}]<d>:<r> <cyan>{s}<r>\n",
                         BStr::new(name),
-                        BStr::new(script),
+                        escape_control_chars(script),
                     ),
                     PrintFormat::Untrusted => bun_core::pretty!(
                         " <yellow>»<r> [{s}]<d>:<r> <cyan>{s}<r>\n",
                         BStr::new(name),
-                        BStr::new(script),
+                        escape_control_chars(script),
                     ),
                 }
             }
diff --git a/test/cli/install/bun-pm.test.ts b/test/cli/install/bun-pm.test.ts
index 9f5fb0152216..81e06a5d0a03 100644
--- a/test/cli/install/bun-pm.test.ts
+++ b/test/cli/install/bun-pm.test.ts
@@ -1119,3 +1119,98 @@ describe.concurrent.skipIf(isWindows)("cache directory setting longer than the p
     expect(await exists(join(String(dir), "node_modules", ".cache"))).toBeTrue();
   });
 });
+
+async function runInDir(dir: string, ...args: string[]) {
+  await using proc = Bun.spawn({
+    cmd: [bunExe(), ...args],
+    cwd: dir,
+    stdout: "pipe",
+    stderr: "pipe",
+    env,
+  });
+  return await Promise.all([proc.stdout.text(), proc.stderr.text(), proc.exited]);
+}
+
+test("bun pm untrusted and bun pm trust escape control characters in dependency scripts", async () => {
+  // Both lines of the script are a shell comment after the echo, so only the echo runs once
+  // the package is trusted. Printed raw, though, the first comment erases the listing line
+  // (ESC[2K) and returns to column 1 (ESC[1G), and the newline lets the second one pose as
+  // a further listing entry. `\r`, `\t`, DEL and the 8-bit CSI (U+009B) are the remaining
+  // kinds of control character a terminal acts on.
+  const script = 'echo "real command" #\x1b[2K\x1b[1G\r\x7f\u009b\n#\t» [postinstall]: node scripts/postinstall.js';
+  const shown =
+    'echo "real command" #\\x1b[2K\\x1b[1G\\r\\x7f\\u009b\\n#\\t» [postinstall]: node scripts/postinstall.js';
+
+  using dir = tempDir("pm-untrusted-control-chars", {
+    "package.json": JSON.stringify({
+      name: "foo",
+      version: "1.0.0",
+      dependencies: {
+        "nice-pkg": "file:./nice-pkg",
+      },
+    }),
+    "nice-pkg/package.json": JSON.stringify({
+      name: "nice-pkg",
+      version: "1.0.0",
+      scripts: {
+        postinstall: script,
+      },
+    }),
+  });
+
+  let [stdout, stderr, exitCode] = await runInDir(String(dir), "install");
+  expect(stderr).not.toContain("error:");
+  expect(stdout).toContain("Blocked 1 postinstall");
+  expect(exitCode).toBe(0);
+
+  [stdout, stderr, exitCode] = await runInDir(String(dir), "pm", "untrusted");
+  expect(stderr).not.toContain("error:");
+  expect(stdout).toContain(` » [postinstall]: ${shown}\n`);
+  expect(stdout).not.toContain("\x1b");
+  expect(stdout).not.toContain("\x7f");
+  expect(stdout).not.toContain("\u009b");
+  expect(exitCode).toBe(0);
+
+  [stdout, stderr, exitCode] = await runInDir(String(dir), "pm", "trust", "nice-pkg");
+  expect(stderr).not.toContain("error:");
+  expect(stdout).toContain(` ✓ [postinstall]: ${shown}\n`);
+  expect(stdout).toContain("1 script ran across 1 package");
+  expect(stdout).not.toContain("\x1b");
+  expect(stdout).not.toContain("\x7f");
+  expect(stdout).not.toContain("\u009b");
+  expect(exitCode).toBe(0);
+});
+
+// The dependency alias becomes the node_modules folder and the file: target becomes the
+// resolution, so a dependent can put control characters in both. Windows does not allow
+// them in file names, so the packages cannot be installed there in the first place.
+test.skipIf(isWindows)("bun pm untrusted escapes control characters in the package path and resolution", async () => {
+  using dir = tempDir("pm-untrusted-control-chars-path", {
+    "package.json": JSON.stringify({
+      name: "foo",
+      version: "1.0.0",
+      dependencies: {
+        "nice\x1b[2Kpkg": "file:./real\rpkg",
+      },
+    }),
+    "real\rpkg/package.json": JSON.stringify({
+      name: "real-pkg",
+      version: "1.0.0",
+      scripts: {
+        postinstall: "exit 0",
+      },
+    }),
+  });
+
+  let [stdout, stderr, exitCode] = await runInDir(String(dir), "install");
+  expect(stderr).not.toContain("error:");
+  expect(stdout).toContain("Blocked 1 postinstall");
+  expect(exitCode).toBe(0);
+
+  [stdout, stderr, exitCode] = await runInDir(String(dir), "pm", "untrusted");
+  expect(stderr).not.toContain("error:");
+  expect(stdout).toContain("./node_modules/nice\\x1b[2Kpkg @real\\rpkg\n » [postinstall]: exit 0\n");
+  expect(stdout).not.toContain("\x1b");
+  expect(stdout).not.toContain("\r");
+  expect(exitCode).toBe(0);
+});

From 311d13af2270f39c2694365eb39de62130962947 Mon Sep 17 00:00:00 2001
From: robobun <117481402+robobun@users.noreply.github.com>
Date: Mon, 17 Aug 2026 01:26:42 +0000
Subject: [PATCH 103/258] install: reject dependency names containing control
 characters (#38615)

---
 src/bun_core/fmt.rs                           |  44 ++++
 src/install/PackageInstaller.rs               |  21 +-
 .../PackageManager/PackageManagerEnqueue.rs   |  49 ++++
 .../PackageManagerResolution.rs               |  12 +-
 src/install/TarballStream.rs                  |   2 +-
 src/install/dependency.rs                     |  22 +-
 src/install/error.rs                          |   3 +
 src/install/extract_tarball.rs                |   4 +-
 src/install/isolated_install.rs               |   2 +-
 src/install/lockfile/Tree.rs                  |  11 +-
 src/install/lockfile/bun.lock.rs              |   6 +-
 test/cli/install/bun-install-registry.test.ts |   6 +-
 test/cli/install/bun-install.test.ts          | 222 +++++++++++++++++-
 test/cli/install/isolated-install.test.ts     |   5 +-
 14 files changed, 368 insertions(+), 41 deletions(-)

diff --git a/src/bun_core/fmt.rs b/src/bun_core/fmt.rs
index 1c729cc0b220..d781d9554a45 100644
--- a/src/bun_core/fmt.rs
+++ b/src/bun_core/fmt.rs
@@ -3451,6 +3451,50 @@ impl fmt::Write for EscapeControlCharsWriter<'_, '_> {
     }
 }
 
+// ───────────────────────────────────────────────────────────────────────────
+// escapeControlChars
+// ───────────────────────────────────────────────────────────────────────────
+
+/// Renders the wrapped `Display` with C0 controls, DEL and C1 controls spelled
+/// out (`\n`, `\x1b`, `\x7f`, `\u009b`) instead of written raw, for text a
+/// registry or a package authored; everything else passes through unchanged.
+pub struct EscapeControlChars<T>(pub T);
+
+/// [`EscapeControlChars`] over raw bytes; invalid UTF-8 renders as U+FFFD.
+pub fn escape_control_chars(text: &[u8]) -> EscapeControlChars<&bstr::BStr> {
+    EscapeControlChars(bstr::BStr::new(text))
+}
+
+impl<T: Display> Display for EscapeControlChars<T> {
+    fn fmt(&self, f: &mut Formatter<'_>) -> fmt::Result {
+        let mut writer = EscapeControlCharsWriter(f);
+        write!(writer, "{}", self.0)
+    }
+}
+
+struct EscapeControlCharsWriter<'a, 'f>(&'a mut Formatter<'f>);
+
+impl fmt::Write for EscapeControlCharsWriter<'_, '_> {
+    fn write_str(&mut self, s: &str) -> fmt::Result {
+        let mut start = 0;
+        for (i, c) in s.char_indices() {
+            if !matches!(c, '\0'..='\x1f' | '\x7f' | '\u{80}'..='\u{9f}') {
+                continue;
+            }
+            self.0.write_str(&s[start..i])?;
+            match c {
+                '\n' => self.0.write_str("\\n")?,
+                '\r' => self.0.write_str("\\r")?,
+                '\t' => self.0.write_str("\\t")?,
+                c if c.is_ascii() => write!(self.0, "\\x{:02x}", c as u32)?,
+                c => write!(self.0, "\\u{:04x}", c as u32)?,
+            }
+            start = i + c.len_utf8();
+        }
+        self.0.write_str(&s[start..])
+    }
+}
+
 // js_bindings (fmtString for highlighter.test.ts) lives in src/jsc/fmt_jsc.rs
 // alongside fmt_jsc.bind.ts; bun_core/ stays JSC-free.
 
diff --git a/src/install/PackageInstaller.rs b/src/install/PackageInstaller.rs
index 935b0e675cce..6016c23ecf1f 100644
--- a/src/install/PackageInstaller.rs
+++ b/src/install/PackageInstaller.rs
@@ -410,24 +410,15 @@ impl<'a> LazyPackageDestinationDir<'a> {
     }
 }
 
-/// A dependency alias becomes the install destination inside `node_modules`
-/// (the existing entry is renamed aside, deleted, and re-created). Reject
-/// anything that could escape `node_modules`: empty names, `.`/`..`
-/// components, absolute paths, drive letters, backslashes, NUL bytes, and any
-/// separator other than the single `/` in a scoped name (`@scope/name`).
+/// The alias is the install destination inside `node_modules` (renamed aside,
+/// deleted and re-created), so on top of `is_safe_install_folder_name` it must
+/// be a single path component, or two for a scoped name.
 pub(crate) fn alias_is_safe_install_target(alias: &[u8]) -> bool {
-    if alias.is_empty() || alias.len() >= MAX_PATH_BYTES || strings::contains_any(alias, b"\\:\0") {
+    if alias.len() >= MAX_PATH_BYTES || !crate::dependency::is_safe_install_folder_name(alias) {
         return false;
     }
 
-    let mut component_count = 0usize;
-    for component in strings::split(alias, b"/") {
-        component_count += 1;
-        if component.is_empty() || component == b"." || component == b".." {
-            return false;
-        }
-    }
-
+    let component_count = strings::split(alias, b"/").count();
     component_count == 1 || (component_count == 2 && alias[0] == b'@')
 }
 
@@ -1334,7 +1325,7 @@ impl<'a> PackageInstaller<'a> {
             if log_level != Options::LogLevel::Silent {
                 bun_core::pretty_errorln!(
                     "<r><red>error<r>: refusing to install dependency with unsafe name <b>{}<r>",
-                    bstr::BStr::new(alias.slice(string_buf!())),
+                    bun_core::fmt::escape_control_chars(alias.slice(string_buf!())),
                 );
             }
             self.summary.fail += 1;
diff --git a/src/install/PackageManager/PackageManagerEnqueue.rs b/src/install/PackageManager/PackageManagerEnqueue.rs
index 3fefb6fb4853..883019bbcc17 100644
--- a/src/install/PackageManager/PackageManagerEnqueue.rs
+++ b/src/install/PackageManager/PackageManagerEnqueue.rs
@@ -770,6 +770,55 @@ pub fn enqueue_dependency_with_main_and_success_fn(
         version_was_replaced = false;
         break 'version dependency.version.clone();
     };
+
+    // Refuse an unsafe alias (the future `node_modules/` folder) or registry
+    // name (the request and the package name) here, before either is fetched
+    // or printed. Empty names are tolerated, as in the tree builder.
+    let invalid_name = {
+        let alias = this.lockfile.str(&dependency.name);
+        let alias_is_safe = if alias == this.lockfile.str(&dependency.version.literal) {
+            // `bun add <specifier>` uses the specifier as the alias until
+            // `assign_resolution` names it: never a folder, but still printed.
+            !dependency::contains_control_character(alias)
+        } else {
+            alias.is_empty() || dependency::is_safe_install_folder_name(alias)
+        };
+        if !alias_is_safe {
+            Some(alias)
+        } else {
+            match version.tag {
+                dependency::version::Tag::Npm | dependency::version::Tag::DistTag => {
+                    let registry_name = this.lockfile.str(&name);
+                    (!registry_name.is_empty()
+                        && !dependency::is_safe_install_folder_name(registry_name))
+                    .then_some(registry_name)
+                }
+                _ => None,
+            }
+        }
+    };
+    if let Some(invalid_name) = invalid_name {
+        if let Some(fail) = fail_fn {
+            fail(this, dependency, id, crate::Error::InvalidDependencyName);
+            return Ok(());
+        }
+        let name = bun_fmt::escape_control_chars(invalid_name);
+        if dependency.behavior.is_required() {
+            this.log_mut().add_error_fmt(
+                None,
+                bun_ast::Loc::EMPTY,
+                format_args!("Invalid dependency name \"{name}\""),
+            );
+        } else {
+            this.log_mut().add_warning_fmt(
+                None,
+                bun_ast::Loc::EMPTY,
+                format_args!("Invalid dependency name \"{name}\""),
+            );
+        }
+        return Ok(());
+    }
+
     let mut loaded_manifest: Option<Npm::PackageManifest> = None;
 
     match version.tag {
diff --git a/src/install/PackageManager/PackageManagerResolution.rs b/src/install/PackageManager/PackageManagerResolution.rs
index dede07e3df35..383d98846fec 100644
--- a/src/install/PackageManager/PackageManagerResolution.rs
+++ b/src/install/PackageManager/PackageManagerResolution.rs
@@ -387,14 +387,20 @@ impl PackageManager {
                     {
                         Output::err_generic(
                             "<b>{}<r><d> failed to resolve<r>",
-                            (failed_dep.version.literal.fmt(string_buf),),
+                            (bun_core::fmt::escape_control_chars(
+                                failed_dep.version.literal.slice(string_buf),
+                            ),),
                         );
                     } else {
                         Output::err_generic(
                             "<b>{}<r><d>@<b>{}<r><d> failed to resolve<r>",
                             (
-                                bstr::BStr::new(failed_dep.name.slice(string_buf)),
-                                failed_dep.version.literal.fmt(string_buf),
+                                bun_core::fmt::escape_control_chars(
+                                    failed_dep.name.slice(string_buf),
+                                ),
+                                bun_core::fmt::escape_control_chars(
+                                    failed_dep.version.literal.slice(string_buf),
+                                ),
                             ),
                         );
                     }
diff --git a/src/install/TarballStream.rs b/src/install/TarballStream.rs
index b30138842632..4b88143a651f 100644
--- a/src/install/TarballStream.rs
+++ b/src/install/TarballStream.rs
@@ -1089,7 +1089,7 @@ impl TarballStream {
                         bun_ast::Loc::EMPTY,
                         format_args!(
                             "Refusing to install package with invalid name \"{}\"",
-                            bun_fmt::s(tarball.name_and_basename().0),
+                            bun_fmt::escape_control_chars(tarball.name_and_basename().0),
                         ),
                     );
                 } else {
diff --git a/src/install/dependency.rs b/src/install/dependency.rs
index a5557f315caf..53fe20bb3636 100644
--- a/src/install/dependency.rs
+++ b/src/install/dependency.rs
@@ -555,11 +555,11 @@ pub fn is_scoped_package_name(name: &[u8]) -> Result<bool, PackageNameError> {
     Err(PackageNameError::InvalidPackageName)
 }
 
-/// A dependency name/alias becomes a directory under `node_modules/`. Names
-/// come from untrusted `package.json` / manifest keys, so reject anything that
-/// could resolve outside that directory. `@scope/name` stays valid.
+/// Names come from untrusted `package.json` / manifest keys and end up as
+/// `node_modules/` directories and in progress and error output, so reject path
+/// escapes and terminal control characters. `@scope/name` stays valid.
 pub(crate) fn is_safe_install_folder_name(name: &[u8]) -> bool {
-    if name.is_empty() {
+    if name.is_empty() || contains_control_character(name) {
         return false;
     }
 
@@ -567,7 +567,7 @@ pub(crate) fn is_safe_install_folder_name(name: &[u8]) -> bool {
         if component.is_empty() || component == b"." || component == b".." {
             return false;
         }
-        if strings::contains_any(component, b"\\:\0") {
+        if strings::contains_any(component, b"\\:") {
             return false;
         }
     }
@@ -575,6 +575,18 @@ pub(crate) fn is_safe_install_folder_name(name: &[u8]) -> bool {
     true
 }
 
+/// C0 controls and DEL, plus UTF-8 encoded C1 controls (`C2 80`..`C2 9F`,
+/// U+0080..=U+009F), which terminals interpret too.
+pub(crate) fn contains_control_character(name: &[u8]) -> bool {
+    name.iter().enumerate().any(|(i, &byte)| {
+        byte.is_ascii_control()
+            || (byte == 0xC2
+                && name
+                    .get(i + 1)
+                    .is_some_and(|next| (0x80..=0x9F).contains(next)))
+    })
+}
+
 /// assumes version is valid
 pub fn without_build_tag(version: &[u8]) -> &[u8] {
     if let Some(plus) = strings::index_of_char(version, b'+') {
diff --git a/src/install/error.rs b/src/install/error.rs
index 6219d1ed0dc8..ebe01be29377 100644
--- a/src/install/error.rs
+++ b/src/install/error.rs
@@ -70,6 +70,8 @@ pub enum Error {
     Failed,
     #[error("UnrecognizedDependencyFormat")]
     UnrecognizedDependencyFormat,
+    #[error("InvalidDependencyName")]
+    InvalidDependencyName,
     #[error("No global directory found")]
     NoGlobalDirectoryFound,
     #[error("InvalidPackageID")]
@@ -282,6 +284,7 @@ impl Error {
             Self::HTTPError => "HTTPError",
             Self::Failed => "Failed",
             Self::UnrecognizedDependencyFormat => "UnrecognizedDependencyFormat",
+            Self::InvalidDependencyName => "InvalidDependencyName",
             Self::NoGlobalDirectoryFound => "No global directory found",
             Self::InvalidPackageID => "InvalidPackageID",
             Self::PartialInstallFailed => "PartialInstallFailed",
diff --git a/src/install/extract_tarball.rs b/src/install/extract_tarball.rs
index 7f7e49125df5..01f15fae27a2 100644
--- a/src/install/extract_tarball.rs
+++ b/src/install/extract_tarball.rs
@@ -265,7 +265,7 @@ impl ExtractTarball {
                     bun_ast::Loc::EMPTY,
                     format_args!(
                         "Refusing to install package with invalid name \"{}\"",
-                        bun_fmt::s(name),
+                        bun_fmt::escape_control_chars(name),
                     ),
                 );
                 return Err(crate::Error::InstallFailed);
@@ -489,7 +489,7 @@ impl ExtractTarball {
                             bun_ast::Loc::EMPTY,
                             format_args!(
                                 "Refusing to install package with invalid name \"{}\"",
-                                bun_fmt::s(name),
+                                bun_fmt::escape_control_chars(name),
                             ),
                         );
                         return Err(crate::Error::InstallFailed);
diff --git a/src/install/isolated_install.rs b/src/install/isolated_install.rs
index ddbda644a33b..28b2c58f265d 100644
--- a/src/install/isolated_install.rs
+++ b/src/install/isolated_install.rs
@@ -2264,7 +2264,7 @@ pub(crate) fn install_isolated_packages(
                 if let Some(name) = unsafe_folder_name {
                     Output::err_generic(
                         "\"{}\" is not a valid install folder name",
-                        (BStr::new(name),),
+                        (bun_core::fmt::escape_control_chars(name),),
                     );
                     Output::flush();
                     Global::exit(1);
diff --git a/src/install/lockfile/Tree.rs b/src/install/lockfile/Tree.rs
index 2884c42989bf..589c389e6cde 100644
--- a/src/install/lockfile/Tree.rs
+++ b/src/install/lockfile/Tree.rs
@@ -370,7 +370,7 @@ pub(crate) fn relative_path_and_depth<'b, const PATH_STYLE: IteratorPathStyle>(
             if !folder_name_is_safe(name) {
                 Output::err_generic(
                     "Lockfile is malformed (dependency name \"{}\" is not a valid folder name)",
-                    (bstr::BStr::new(name),),
+                    (bun_core::fmt::escape_control_chars(name),),
                 );
                 bun_core::Global::crash();
             }
@@ -763,17 +763,18 @@ impl Tree {
             // don't treat it as unsafe — match the lockfile parser and isolated
             // installer (`bun.lock.rs`, `isolated_install.rs`) which guard
             // `!name.is_empty()` here rather than failing the whole install.
+            // Neither does an unresolved dependency, and if its name is why it
+            // did not resolve, enqueue already reported it.
             let dependency_name = dependency
                 .name
                 .slice(lockfile.buffers.string_bytes.as_slice());
-            if !dependency_name.is_empty()
+            if pkg_id != invalid_package_id
+                && !dependency_name.is_empty()
                 && !crate::dependency::is_safe_install_folder_name(dependency_name)
             {
                 builder.maybe_report_error(format_args!(
                     "Invalid dependency name \"{}\"",
-                    dependency
-                        .name
-                        .fmt(lockfile.buffers.string_bytes.as_slice()),
+                    bun_core::fmt::escape_control_chars(dependency_name),
                 ));
                 continue 'dep;
             }
diff --git a/src/install/lockfile/bun.lock.rs b/src/install/lockfile/bun.lock.rs
index 3e002201f23a..aaececb7c727 100644
--- a/src/install/lockfile/bun.lock.rs
+++ b/src/install/lockfile/bun.lock.rs
@@ -3709,8 +3709,8 @@ fn dependency_resolution_failure(
             format_args!(
                 "Failed to resolve {} dependency '{}' for package '{}'",
                 behavior_str,
-                bstr::BStr::new(dep.name.slice(buf)),
-                bstr::BStr::new(path),
+                bun_core::fmt::escape_control_chars(dep.name.slice(buf)),
+                bun_core::fmt::escape_control_chars(path),
             ),
         );
     } else {
@@ -3720,7 +3720,7 @@ fn dependency_resolution_failure(
             format_args!(
                 "Failed to resolve root {} dependency '{}'",
                 behavior_str,
-                bstr::BStr::new(dep.name.slice(buf)),
+                bun_core::fmt::escape_control_chars(dep.name.slice(buf)),
             ),
         );
     }
diff --git a/test/cli/install/bun-install-registry.test.ts b/test/cli/install/bun-install-registry.test.ts
index 93d50e692d8a..8b6927087b82 100644
--- a/test/cli/install/bun-install-registry.test.ts
+++ b/test/cli/install/bun-install-registry.test.ts
@@ -10159,8 +10159,10 @@ test("rejects npm aliases whose manifest URL resolves to a different host than t
   const err = await stderr.text();
   await stdout.text();
 
-  // The manifest request must be refused with a clear error...
-  expect(err).toContain("is not on registry");
+  // The manifest request must be refused with a clear error (today the name is
+  // already refused while resolving, before a URL is built; the URL check stays
+  // behind it as a second line of defense)...
+  expect(err).toMatch(/Invalid dependency name|is not on registry/);
   // ...and no request (carrying the registry Authorization header) may reach
   // a host other than the configured registry.
   expect(received).toEqual([]);
diff --git a/test/cli/install/bun-install.test.ts b/test/cli/install/bun-install.test.ts
index 3c0da3cdcf9c..6b64e00af404 100644
--- a/test/cli/install/bun-install.test.ts
+++ b/test/cli/install/bun-install.test.ts
@@ -10521,13 +10521,231 @@ it("does not extract a tarball for a dependency alias containing '..' path segme
     expect(await readdirSorted(zone)).toEqual(["a"]);
     expect(await readdirSorted(join(zone, "a"))).toEqual(["b"]);
     expect(await readdirSorted(join(zone, "a", "b"))).toEqual(["c"]);
-    // The unsafe alias is reported as an error and nothing is installed.
-    expect(err).toContain("Refusing to install package with invalid name");
+    // The unsafe alias is reported as an error before the tarball is even
+    // requested, and nothing is installed.
+    expect(err).toContain('Invalid dependency name "x/../../../.."');
+    expect(urls).toEqual([]);
     expect(out).not.toContain("1 package installed");
     expect(exitCode).not.toBe(0);
   });
 });
 
+describe("dependency names containing terminal control characters", () => {
+  // OSC 52 (write to the clipboard) followed by CSI 2J (clear the screen). A
+  // registry serves it as an ordinary JSON string (`"ev\u001b]52;..."`), so it
+  // reaches bun like any other dependency name.
+  const controlName = "ev\x1b]52;c;aGkK\x07\x1b[2Jil";
+  // How bun reports it: with the control characters spelled out.
+  const escapedName = String.raw`ev\x1b]52;c;aGkK\x07\x1b[2Jil`;
+  // Forces the progress line, which echoes the name of every manifest being
+  // fetched, even though stderr is a pipe here.
+  const progressEnv = { ...env, BUN_INSTALL_PROGRESS: "1" };
+
+  /**
+   * The dummy registry, which has a manifest for every name asked of it, plus:
+   * the control-character package really is installable (its tarball is
+   * bar's) and `bar@0.0.2` declares `barDeps`.
+   */
+  function registry(ctx: TestContext, urls: string[], barDeps: object = {}) {
+    const dummy = dummyRegistryForContext(ctx, urls);
+    return async (req: Request) => {
+      const name = decodeURIComponent(new URL(req.url).pathname.slice(`/${ctx.id}/`.length));
+      if (name.endsWith(".tgz") && name.includes(controlName)) {
+        urls.push(req.url);
+        return new Response(file(join(import.meta.dir, "bar-0.0.2.tgz")));
+      }
+      const res = await dummy(req);
+      if (name !== "bar") return res;
+      const manifest = await res.json();
+      Object.assign(manifest.versions["0.0.2"], barDeps);
+      return Response.json(manifest);
+    };
+  }
+
+  function assertNameNeverLeaked(out: string, err: string, urls: string[]) {
+    expect(out).not.toContain(controlName);
+    expect(err).not.toContain(controlName);
+    expect(err).not.toContain("\x1b]52;");
+    expect(urls.filter(url => url.includes("%1B") || url.includes("\x1b"))).toEqual([]);
+  }
+
+  /** Entries of node_modules other than the cache this registry setup (`cache = false`) puts there. */
+  async function installed(ctx: TestContext) {
+    const entries = await readdirSorted(join(ctx.package_dir, "node_modules")).catch(() => []);
+    return entries.filter(entry => entry !== ".cache");
+  }
+
+  // A dependency whose key repeats its specifier is how `bun add <specifier>`
+  // records a dependency it has not named yet, so such a key is exempt from the
+  // folder name rules, but not from this one: git tasks put it on the progress
+  // line as-is.
+  const gitSpecifier = `git+https://127.0.0.1:9/${controlName}.git`;
+  const escapedGitSpecifier = `git+https://127.0.0.1:9/${escapedName}.git`;
+  const manifestCases: [string, object, string][] = [
+    ["a dependency name", { dependencies: { [controlName]: "0.0.2" } }, escapedName],
+    ["an unnamed git dependency", { dependencies: { [gitSpecifier]: gitSpecifier } }, escapedGitSpecifier],
+  ];
+  for (const [description, barDeps, expectedName] of manifestCases) {
+    it(`rejects ${description} declared by a package manifest before requesting or printing it`, async () => {
+      await withContext(defaultOpts, async ctx => {
+        const urls: string[] = [];
+        setContextHandler(ctx, registry(ctx, urls, barDeps));
+        await writeFile(
+          join(ctx.package_dir, "package.json"),
+          JSON.stringify({ name: "foo", version: "0.0.1", dependencies: { bar: "0.0.2" } }),
+        );
+
+        const { stdout, stderr, exited } = spawn({
+          cmd: [bunExe(), "install"],
+          cwd: ctx.package_dir,
+          stdout: "pipe",
+          stderr: "pipe",
+          env: progressEnv,
+        });
+        const [out, err, exitCode] = await Promise.all([stdout.text(), stderr.text(), exited]);
+
+        expect(err).toContain(`error: Invalid dependency name "${expectedName}"`);
+        assertNameNeverLeaked(out, err, urls);
+        expect(urls).toContain(`${ctx.registry_url}bar`);
+        expect(await installed(ctx)).toEqual([]);
+        expect(exitCode).toBe(1);
+      });
+    });
+  }
+
+  it("keeps the unnamed form for specifiers without control characters", async () => {
+    await withContext(defaultOpts, async ctx => {
+      const urls: string[] = [];
+      setContextHandler(ctx, registry(ctx, urls));
+      await writeFile(join(ctx.package_dir, "package.json"), JSON.stringify({ name: "foo", version: "0.0.1" }));
+
+      // The alias of this dependency is the specifier until the tarball has
+      // been resolved: full of characters a folder name may not contain.
+      const { stdout, stderr, exited } = spawn({
+        cmd: [bunExe(), "add", `${ctx.registry_url}bar-0.0.2.tgz`],
+        cwd: ctx.package_dir,
+        stdout: "pipe",
+        stderr: "pipe",
+        env,
+      });
+      const [out, err, exitCode] = await Promise.all([stdout.text(), stderr.text(), exited]);
+
+      expect(err).not.toContain("Invalid dependency name");
+      expect(out).toContain("installed bar@");
+      expect(await installed(ctx)).toEqual(["bar"]);
+      expect(exitCode).toBe(0);
+    });
+  });
+
+  it("only warns when the name is declared as an optional dependency", async () => {
+    await withContext(defaultOpts, async ctx => {
+      const urls: string[] = [];
+      setContextHandler(ctx, registry(ctx, urls, { optionalDependencies: { [controlName]: "0.0.2" } }));
+      await writeFile(
+        join(ctx.package_dir, "package.json"),
+        JSON.stringify({ name: "foo", version: "0.0.1", dependencies: { bar: "0.0.2" } }),
+      );
+
+      const { stdout, stderr, exited } = spawn({
+        cmd: [bunExe(), "install"],
+        cwd: ctx.package_dir,
+        stdout: "pipe",
+        stderr: "pipe",
+        env: progressEnv,
+      });
+      const [out, err, exitCode] = await Promise.all([stdout.text(), stderr.text(), exited]);
+
+      expect(err).toContain(`warn: Invalid dependency name "${escapedName}"`);
+      assertNameNeverLeaked(out, err, urls);
+      expect(await installed(ctx)).toEqual(["bar"]);
+      expect(out).toContain("1 package installed");
+      expect(exitCode).toBe(0);
+    });
+  });
+
+  // [description, root dependencies, how the unresolved dependency is summarized]
+  const aliasCases: [string, Record<string, string>, string][] = [
+    ["as the alias of a dependency", { [controlName]: "npm:bar@0.0.2" }, `${escapedName}@npm:bar@0.0.2`],
+    [
+      "as the target of an npm: alias",
+      { "safe-alias": `npm:${controlName}@0.0.2` },
+      `safe-alias@npm:${escapedName}@0.0.2`,
+    ],
+  ];
+  for (const [description, dependencies, summary] of aliasCases) {
+    it(`rejects a name used ${description}`, async () => {
+      await withContext(defaultOpts, async ctx => {
+        const urls: string[] = [];
+        setContextHandler(ctx, registry(ctx, urls));
+        await writeFile(
+          join(ctx.package_dir, "package.json"),
+          JSON.stringify({ name: "foo", version: "0.0.1", dependencies }),
+        );
+
+        const { stdout, stderr, exited } = spawn({
+          cmd: [bunExe(), "install"],
+          cwd: ctx.package_dir,
+          stdout: "pipe",
+          stderr: "pipe",
+          env,
+        });
+        const [out, err, exitCode] = await Promise.all([stdout.text(), stderr.text(), exited]);
+
+        expect(err).toContain(`error: Invalid dependency name "${escapedName}"`);
+        expect(err).toContain(`error: ${summary} failed to resolve`);
+        assertNameNeverLeaked(out, err, urls);
+        expect(await installed(ctx)).toEqual([]);
+        expect(exitCode).toBe(1);
+      });
+    });
+  }
+
+  it("rejects a package name found in bun.lock instead of installing or listing it", async () => {
+    await withContext(defaultOpts, async ctx => {
+      const urls: string[] = [];
+      setContextHandler(ctx, registry(ctx, urls));
+      await Promise.all([
+        writeFile(
+          join(ctx.package_dir, "package.json"),
+          JSON.stringify({ name: "foo", version: "0.0.1", dependencies: { [controlName]: "0.0.2" } }),
+        ),
+        writeFile(
+          join(ctx.package_dir, "bun.lock"),
+          textLockfile(1, {
+            workspaces: { "": { name: "foo", dependencies: { [controlName]: "0.0.2" } } },
+            packages: { [controlName]: [`${controlName}@0.0.2`, `${ctx.registry_url}bar-0.0.2.tgz`, {}, ""] },
+          }),
+        ),
+      ]);
+
+      // `bun pm ls` prints straight from the lockfile, so it runs first, before
+      // `bun install` gets a chance to touch it.
+      const commands: [string[], string][] = [
+        [["pm", "ls", "--all"], "Error loading lockfile: InvalidLockfile"],
+        [["install"], "Invalid package name"],
+      ];
+      for (const [args, expectedError] of commands) {
+        const { stdout, stderr, exited } = spawn({
+          cmd: [bunExe(), ...args],
+          cwd: ctx.package_dir,
+          stdout: "pipe",
+          stderr: "pipe",
+          env,
+        });
+        const [out, err, exitCode] = await Promise.all([stdout.text(), stderr.text(), exited]);
+
+        expect(err).toContain(expectedError);
+        assertNameNeverLeaked(out, err, urls);
+        expect(exitCode).toBe(1);
+      }
+      // Ignoring the rejected lockfile must not make `bun install` fall back to
+      // resolving the same name from package.json either.
+      expect(urls).toEqual([]);
+      expect(await installed(ctx)).toEqual([]);
+    });
+  });
+});
+
 it("does not install transitive file: dependencies that point outside their package", async () => {
   // A dependency declared by a non-workspace package (here: a folder dependency
   // of the project) uses a file: specifier pointing at an absolute path outside
diff --git a/test/cli/install/isolated-install.test.ts b/test/cli/install/isolated-install.test.ts
index de7c45200d7f..addfa5ba4f5b 100644
--- a/test/cli/install/isolated-install.test.ts
+++ b/test/cli/install/isolated-install.test.ts
@@ -3936,7 +3936,8 @@ test("rejects dependency aliases that traverse outside node_modules", async () =
   // A (transitively) malicious package.json can use an arbitrary string as a
   // dependency alias. The alias becomes a `node_modules/<alias>` path
   // component in the isolated store layout, so a `..` segment lets it plant
-  // symlinks outside of node_modules.
+  // symlinks outside of node_modules. Such an alias is refused while resolving
+  // (the installer has its own check as well, see the next test).
   await write(
     packageJson,
     JSON.stringify({
@@ -3956,7 +3957,7 @@ test("rejects dependency aliases that traverse outside node_modules", async () =
   });
   const [stderr, exitCode] = await Promise.all([proc.stderr.text(), proc.exited]);
 
-  expect(stderr).toContain("is not a valid install folder name");
+  expect(stderr).toContain('Invalid dependency name "../pwned-by-alias"');
   // Nothing may be created outside of node_modules. `lstatSync` instead of
   // `existsSync` because the escaped artifact would be a dangling symlink.
   expect(() => lstatSync(join(packageDir, "pwned-by-alias"))).toThrow();

From d769b5010d391998e43ac66a36f27a6cb8fede53 Mon Sep 17 00:00:00 2001
From: robobun <117481402+robobun@users.noreply.github.com>
Date: Mon, 17 Aug 2026 01:26:55 +0000
Subject: [PATCH 104/258] http: escape control characters in the verbose
 request/response trace (#38673)

---
 src/bun_core/fmt.rs                  | 53 ++++++++++++++++++++++++--
 src/http/lib.rs                      |  7 ++--
 src/picohttp/lib.rs                  | 41 +++++++++++++-------
 test/cli/install/bun-install.test.ts | 48 ++++++++++++++++++++++++
 test/js/web/fetch/fetch.test.ts      | 56 ++++++++++++++++++++++++++++
 5 files changed, 186 insertions(+), 19 deletions(-)

diff --git a/src/bun_core/fmt.rs b/src/bun_core/fmt.rs
index d781d9554a45..d481f433a118 100644
--- a/src/bun_core/fmt.rs
+++ b/src/bun_core/fmt.rs
@@ -257,8 +257,11 @@ impl Display for RedactedNpmUrlFormatter<'_> {
             }
 
             // Emit the run of bytes up to the next position where a uuid/npm
-            // secret could possibly start, so multi-byte UTF-8 sequences are
-            // written intact (raw bytes, not Latin-1→UTF-8 chars).
+            // secret could possibly start. Runs split only at ASCII bytes, so
+            // multi-byte sequences stay intact; `BStr` turns invalid UTF-8 (the
+            // URL is package metadata, not guaranteed UTF-8) into U+FFFD instead
+            // of handing a bogus `&str` to a `Display` wrapper such as
+            // [`EscapeControlChars`].
             let mut next = i + 1;
             while next < self.url.len() {
                 let b = self.url[next];
@@ -271,7 +274,7 @@ impl Display for RedactedNpmUrlFormatter<'_> {
                 }
                 next += 1;
             }
-            write_bytes(f, &self.url[i..next])?;
+            write!(f, "{}", bstr::BStr::new(&self.url[i..next]))?;
             i = next;
         }
         Ok(())
@@ -3495,6 +3498,50 @@ impl fmt::Write for EscapeControlCharsWriter<'_, '_> {
     }
 }
 
+// ───────────────────────────────────────────────────────────────────────────
+// escapeControlChars
+// ───────────────────────────────────────────────────────────────────────────
+
+/// `Display` adapter that spells out C0 controls, DEL and C1 controls
+/// (`\n`, `\x1b`, `\x7f`, `\u009b`, ...) so text authored by a dependency
+/// cannot erase, repaint or forge lines of terminal output when printed.
+pub struct EscapeControlChars<T>(pub T);
+
+/// [`EscapeControlChars`] over raw bytes; invalid UTF-8 renders as U+FFFD.
+pub fn escape_control_chars(text: &[u8]) -> EscapeControlChars<&bstr::BStr> {
+    EscapeControlChars(bstr::BStr::new(text))
+}
+
+impl<T: Display> Display for EscapeControlChars<T> {
+    fn fmt(&self, f: &mut Formatter<'_>) -> fmt::Result {
+        let mut writer = EscapeControlCharsWriter(f);
+        write!(writer, "{}", self.0)
+    }
+}
+
+struct EscapeControlCharsWriter<'a, 'f>(&'a mut Formatter<'f>);
+
+impl fmt::Write for EscapeControlCharsWriter<'_, '_> {
+    fn write_str(&mut self, s: &str) -> fmt::Result {
+        let mut start = 0;
+        for (i, c) in s.char_indices() {
+            if !matches!(c, '\0'..='\x1f' | '\x7f' | '\u{80}'..='\u{9f}') {
+                continue;
+            }
+            self.0.write_str(&s[start..i])?;
+            match c {
+                '\n' => self.0.write_str("\\n")?,
+                '\r' => self.0.write_str("\\r")?,
+                '\t' => self.0.write_str("\\t")?,
+                c if c.is_ascii() => write!(self.0, "\\x{:02x}", c as u32)?,
+                c => write!(self.0, "\\u{:04x}", c as u32)?,
+            }
+            start = i + c.len_utf8();
+        }
+        self.0.write_str(&s[start..])
+    }
+}
+
 // js_bindings (fmtString for highlighter.test.ts) lives in src/jsc/fmt_jsc.rs
 // alongside fmt_jsc.bind.ts; bun_core/ stays JSC-free.
 
diff --git a/src/http/lib.rs b/src/http/lib.rs
index bd6db45186f6..484e65693f05 100644
--- a/src/http/lib.rs
+++ b/src/http/lib.rs
@@ -1012,6 +1012,7 @@ use bstr::BStr;
 use bun_boringssl as boringssl;
 use bun_collections::{ArrayHashMap, VecExt};
 use bun_core::StringBuilder;
+use bun_core::fmt::{EscapeControlChars, escape_control_chars};
 use bun_core::{FeatureFlags, Global, Output};
 use bun_core::{OwnedString, String as BunString, Tag as BunStringTag, strings};
 use bun_http_types::ETag::StringPointer;
@@ -1489,7 +1490,7 @@ pub(crate) fn print_request(
         "> {} {} {}",
         ver,
         BStr::new(request.method),
-        bun_core::fmt::redacted_npm_url(url),
+        EscapeControlChars(bun_core::fmt::redacted_npm_url(url)),
     );
     for header in request.headers {
         let name = header.name();
@@ -1500,8 +1501,8 @@ pub(crate) fn print_request(
             let scheme_len = strings::index_of_char_usize(value, b' ').map_or(0, |i| i + 1);
             bun_core::pretty_errorln!(
                 "> <r><cyan>{}<r><d>: <r>{}<d>[redacted]<r>",
-                BStr::new(name),
-                BStr::new(&value[..scheme_len]),
+                escape_control_chars(name),
+                escape_control_chars(&value[..scheme_len]),
             );
         } else {
             bun_core::pretty_errorln!("> {}", header);
diff --git a/src/picohttp/lib.rs b/src/picohttp/lib.rs
index ac1689919ff5..fe4749a251ee 100644
--- a/src/picohttp/lib.rs
+++ b/src/picohttp/lib.rs
@@ -4,6 +4,7 @@ use core::fmt;
 
 use bstr::BStr;
 
+use bun_core::fmt::escape_control_chars;
 use bun_core::output::enable_ansi_colors_stderr;
 use bun_core::pretty_fmt;
 
@@ -155,19 +156,29 @@ impl Header {
     }
 }
 
+// The `Display` impls in this file (except `Headers`, which is wire format)
+// render the `fetch(..., { verbose: true })` / `bun install --verbose` trace.
+// Names, values, status text and URLs are peer-supplied, so they go through
+// `escape_control_chars`: HTTP/1.1 admits HT and any byte >= 0x80 (so UTF-8
+// encoded C1 controls such as U+009B, CSI) in a field value or reason phrase,
+// and HPACK/QPACK only reject NUL, CR and LF.
 impl fmt::Display for Header {
     fn fmt(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result {
         // NOTE: pretty_fmt! is the compile-time ANSI-tag expander (`<r><cyan>` → escape
         // codes).
         if enable_ansi_colors_stderr() {
             if self.is_multiline() {
-                write!(f, pretty_fmt!("<r><cyan>{}", true), BStr::new(self.value()))
+                write!(
+                    f,
+                    pretty_fmt!("<r><cyan>{}", true),
+                    escape_control_chars(self.value())
+                )
             } else {
                 write!(
                     f,
                     pretty_fmt!("<r><cyan>{}<r><d>: <r>{}", true),
-                    BStr::new(self.name()),
-                    BStr::new(self.value()),
+                    escape_control_chars(self.name()),
+                    escape_control_chars(self.value()),
                 )
             }
         } else {
@@ -175,14 +186,14 @@ impl fmt::Display for Header {
                 write!(
                     f,
                     pretty_fmt!("<r><cyan>{}", false),
-                    BStr::new(self.value())
+                    escape_control_chars(self.value())
                 )
             } else {
                 write!(
                     f,
                     pretty_fmt!("<r><cyan>{}<r><d>: <r>{}", false),
-                    BStr::new(self.name()),
-                    BStr::new(self.value()),
+                    escape_control_chars(self.name()),
+                    escape_control_chars(self.value()),
                 )
             }
         }
@@ -203,11 +214,11 @@ impl fmt::Display for HeaderCurlFormatter<'_> {
             write!(
                 f,
                 "-H \"{}: {}\"",
-                BStr::new(header.name()),
-                BStr::new(header.value())
+                escape_control_chars(header.name()),
+                escape_control_chars(header.value())
             )
         } else {
-            write!(f, "-H \"{}\"", BStr::new(header.name()))
+            write!(f, "-H \"{}\"", escape_control_chars(header.name()))
         }
     }
 }
@@ -307,7 +318,7 @@ impl fmt::Display for Request<'_> {
             f,
             "> HTTP/1.1 {} {}",
             BStr::new(self.method),
-            BStr::new(self.path)
+            escape_control_chars(self.path)
         )?;
         for header in self.headers {
             if enable_ansi_colors_stderr() {
@@ -348,10 +359,14 @@ impl fmt::Display for RequestCurlFormatter<'_> {
             write!(
                 f,
                 pretty_fmt!("<b><cyan>curl<r> <d>--http1.1<r> <b>\"{}\"<r>", true),
-                BStr::new(request.path),
+                escape_control_chars(request.path),
             )?;
         } else {
-            write!(f, "curl --http1.1 \"{}\"", BStr::new(request.path))?;
+            write!(
+                f,
+                "curl --http1.1 \"{}\"",
+                escape_control_chars(request.path)
+            )?;
         }
 
         if request.method != b"GET" {
@@ -566,7 +581,7 @@ impl fmt::Display for Response<'_> {
             StatusCodeFormatter {
                 code: self.status_code as usize
             },
-            BStr::new(self.status),
+            escape_control_chars(self.status),
         )?;
         for header in self.headers.list {
             if enable_ansi_colors_stderr() {
diff --git a/test/cli/install/bun-install.test.ts b/test/cli/install/bun-install.test.ts
index 6b64e00af404..0b1b75dc6b58 100644
--- a/test/cli/install/bun-install.test.ts
+++ b/test/cli/install/bun-install.test.ts
@@ -1280,6 +1280,54 @@ describe.concurrent("bun-install", () => {
     expect(exitCode).toBe(0);
   });
 
+  it("--verbose escapes control characters in the tarball URL and response headers it traces", async () => {
+    // U+009B is the one-byte form of ESC [ (CSI), so "\u009b31m" written to a terminal as-is turns the
+    // rest of the line red. Header values are byte strings: the two Latin-1 characters below go out as
+    // the bytes C2 9B, the UTF-8 encoding of U+009B.
+    await using server = Bun.serve({
+      port: 0,
+      hostname: "127.0.0.1",
+      fetch() {
+        return new Response("not found", { status: 404, headers: { "x-evil": "a\u00c2\u009b31mb" } });
+      },
+    });
+
+    const origin = `http://127.0.0.1:${server.port}`;
+    using dir = tempDir("install-verbose-escape", {
+      "package.json": Buffer.concat([
+        Buffer.from(`{"name":"app","dependencies":{"csi":"${origin}/csi-\u009b31m.tgz","latin1":"${origin}/latin1-`),
+        // A Latin-1 encoded package.json: a lone 0x9B (the 8-bit CSI) and a stray continuation byte,
+        // neither of which is valid UTF-8.
+        Buffer.from([0x82, 0x41, 0x9b, 0x41]),
+        Buffer.from(`.tgz"}}`),
+      ]),
+    });
+
+    await using proc = spawn({
+      cmd: [bunExe(), "install", "--verbose"],
+      cwd: String(dir),
+      env: { ...env, BUN_INSTALL_CACHE_DIR: join(String(dir), ".cache") },
+      stdout: "ignore",
+      stderr: "pipe",
+    });
+    const [stderrBytes, exitCode] = await Promise.all([proc.stderr.bytes(), proc.exited]);
+    const stderr = new TextDecoder().decode(stderrBytes);
+
+    const requestedUrls = stderr.split(/\r?\n/).flatMap(line => {
+      const match = /^\s*>?\s*HTTP\/1\.1 GET (.*)$/.exec(line);
+      return match ? [match[1]] : [];
+    });
+    expect(requestedUrls.sort()).toEqual([`${origin}/csi-\\u009b31m.tgz`, `${origin}/latin1-\ufffdA\ufffdA.tgz`]);
+    expect(stderr.split(/\r?\n/).filter(line => line.startsWith("< x-evil:"))).toEqual([
+      "< x-evil: a\\u009b31mb",
+      "< x-evil: a\\u009b31mb",
+    ]);
+    // The lenient decode above also shows U+FFFD for the raw Latin-1 bytes themselves, so check
+    // separately that they were not copied to stderr as-is.
+    expect(() => new TextDecoder("utf-8", { fatal: true }).decode(stderrBytes)).not.toThrow();
+    expect(exitCode).toBe(1);
+  });
+
   it("fails cleanly for a git dependency specifier longer than the path buffer", async () => {
     const longPath = Buffer.alloc(isWindows ? 100_000 : 8192, "a").toString();
     using dir = tempDir("long-git-dep", {
diff --git a/test/js/web/fetch/fetch.test.ts b/test/js/web/fetch/fetch.test.ts
index 0df70a8da4b8..97a34a33c2db 100644
--- a/test/js/web/fetch/fetch.test.ts
+++ b/test/js/web/fetch/fetch.test.ts
@@ -3601,3 +3601,59 @@ it("verbose fetch logging prints [redacted] in place of Authorization credential
   expect(stderr).not.toContain("sekret-token");
   expect(exitCode).toBe(0);
 });
+
+it("verbose fetch logging escapes control characters coming from the peer", async () => {
+  // U+009B is the one-byte form of ESC [ (CSI), so "\u009b31m" written to a terminal as-is turns
+  // the rest of the line red. HTTP/1.1 lets a server put any byte >= 0x80 in a reason phrase or
+  // header value, which includes the UTF-8 encoding of U+009B.
+  let request = "";
+  using listener = Bun.listen({
+    hostname: "127.0.0.1",
+    port: 0,
+    socket: {
+      data(socket, chunk) {
+        request += chunk.toString("latin1");
+        if (!request.includes("\r\n\r\n")) return;
+        socket.end(
+          Buffer.from(
+            "HTTP/1.1 500 Server \u009bError\r\n" +
+              "x-evil: a\u009b31mb\r\n" +
+              "content-length: 0\r\n" +
+              "connection: close\r\n" +
+              "\r\n",
+          ),
+        );
+      },
+    },
+  });
+
+  // Header values are byte strings, so the two Latin-1 characters "\u00c2\u009b" are sent as the
+  // bytes C2 9B, i.e. the same UTF-8 encoded U+009B the server sends back.
+  await using proc = Bun.spawn({
+    cmd: [
+      bunExe(),
+      "-e",
+      `const res = await fetch(process.env.SERVER_URL, {
+         verbose: "curl",
+         headers: { "x-req": "v\\u00c2\\u009b31mq", authorization: "Bea\\u00c2\\u009brer sekret-token" },
+       });
+       console.log(res.status);`,
+    ],
+    env: { ...bunEnv, SERVER_URL: `http://127.0.0.1:${listener.port}/` },
+    stdout: "pipe",
+    stderr: "pipe",
+  });
+
+  const [stdout, stderr, exitCode] = await Promise.all([proc.stdout.text(), proc.stderr.text(), proc.exited]);
+
+  expect(stdout).toBe("500\n");
+  // The request line and the response status line are printed on their own lines; header lines
+  // are printed once per header in the "name: value" trace and once more in the curl command.
+  expect(stderr).toMatch(/^.*x-req: v\\u009b31mq$/im);
+  expect(stderr).toMatch(/^.*authorization: Bea\\u009brer \[redacted\]$/im);
+  expect(stderr).toMatch(/^< 500 Server \\u009bError$/m);
+  expect(stderr).toMatch(/^< x-evil: a\\u009b31mb$/m);
+  expect(stderr).toContain(`-H "x-req: v\\u009b31mq"`);
+  expect(stderr).not.toMatch(/[\x80-\x9f]/);
+  expect(exitCode).toBe(0);
+});

From 96939c36ae564a2f80ad0acdf2c82f6206a94e40 Mon Sep 17 00:00:00 2001
From: robobun <117481402+robobun@users.noreply.github.com>
Date: Mon, 17 Aug 2026 01:27:08 +0000
Subject: [PATCH 105/258] pm licenses: escape control characters in text
 output, including the name@version column (#39358)

---
 src/bun_core/fmt.rs                      | 57 ++++++++++++++++++++
 src/runtime/cli/pm_licenses_command.rs   | 26 +++------
 test/cli/install/bun-pm-licenses.test.ts | 68 ++++++++++++++++++------
 3 files changed, 115 insertions(+), 36 deletions(-)

diff --git a/src/bun_core/fmt.rs b/src/bun_core/fmt.rs
index d481f433a118..dcfa243435bb 100644
--- a/src/bun_core/fmt.rs
+++ b/src/bun_core/fmt.rs
@@ -3542,6 +3542,63 @@ impl fmt::Write for EscapeControlCharsWriter<'_, '_> {
     }
 }
 
+// ───────────────────────────────────────────────────────────────────────────
+// escapeControlChars
+// ───────────────────────────────────────────────────────────────────────────
+
+/// `Display` adapter that spells out C0 controls, DEL and C1 controls
+/// (`\n`, `\x1b`, `\x7f`, `\u009b`, ...) so text authored by a dependency
+/// cannot erase, repaint or forge lines of terminal output when printed.
+pub struct EscapeControlChars<T>(pub T);
+
+/// [`EscapeControlChars`] over raw bytes; invalid UTF-8 renders as U+FFFD.
+pub fn escape_control_chars(text: &[u8]) -> EscapeControlChars<&bstr::BStr> {
+    EscapeControlChars(bstr::BStr::new(text))
+}
+
+impl<T: Display> Display for EscapeControlChars<T> {
+    fn fmt(&self, f: &mut Formatter<'_>) -> fmt::Result {
+        let mut writer = EscapeControlCharsWriter(f);
+        write!(writer, "{}", self.0)
+    }
+}
+
+struct EscapeControlCharsWriter<'a, 'f>(&'a mut Formatter<'f>);
+
+impl fmt::Write for EscapeControlCharsWriter<'_, '_> {
+    fn write_str(&mut self, s: &str) -> fmt::Result {
+        let bytes = s.as_bytes();
+        let mut start = 0;
+        let mut cursor = 0;
+        // `\` doubles as the quote char so the scan stops at nothing else extra.
+        while let Some(offset) =
+            strings::index_of_needs_escape_for_java_script_string(&bytes[cursor..], b'\\')
+        {
+            let i = cursor + offset as usize;
+            let (code_point, len) = match bytes[i] {
+                byte @ (0x00..=0x1F | 0x7F) => (byte as u32, 1),
+                0xC2 if matches!(bytes.get(i + 1), Some(0x80..=0x9F)) => (bytes[i + 1] as u32, 2),
+                byte => {
+                    let char_len = strings::wtf8_byte_sequence_length(byte) as usize;
+                    cursor = (i + char_len).min(bytes.len());
+                    continue;
+                }
+            };
+            self.0.write_str(&s[start..i])?;
+            match code_point {
+                0x0A => self.0.write_str("\\n")?,
+                0x0D => self.0.write_str("\\r")?,
+                0x09 => self.0.write_str("\\t")?,
+                0x00..=0x7F => write!(self.0, "\\x{:02x}", code_point)?,
+                _ => write!(self.0, "\\u{:04x}", code_point)?,
+            }
+            start = i + len;
+            cursor = start;
+        }
+        self.0.write_str(&s[start..])
+    }
+}
+
 // js_bindings (fmtString for highlighter.test.ts) lives in src/jsc/fmt_jsc.rs
 // alongside fmt_jsc.bind.ts; bun_core/ stays JSC-free.
 
diff --git a/src/runtime/cli/pm_licenses_command.rs b/src/runtime/cli/pm_licenses_command.rs
index ad4da0f6fd8e..625782c17a43 100644
--- a/src/runtime/cli/pm_licenses_command.rs
+++ b/src/runtime/cli/pm_licenses_command.rs
@@ -1,11 +1,10 @@
-use std::borrow::Cow;
 use std::cmp::Ordering;
 use std::io::Write as _;
 
 use bstr::BStr;
 use bun_ast::{Expr, Log, Source};
 use bun_collections::{DynamicBitSet, StringHashMap, index_sort};
-use bun_core::fmt::PathSep;
+use bun_core::fmt::{PathSep, escape_control_chars};
 use bun_core::{FileKind, Global, Output, strings};
 use bun_install::isolated_install::store::entry::fmt_store_key;
 use bun_install::lockfile::{Lockfile, package::PackageColumns as _, reachable, tree};
@@ -349,19 +348,6 @@ fn license_order(a: &[u8], b: &[u8]) -> Ordering {
         .then_with(|| a.cmp(b))
 }
 
-fn printable(s: &[u8]) -> Cow<'_, [u8]> {
-    if s.iter().any(u8::is_ascii_control) {
-        Cow::Owned(
-            s.iter()
-                .copied()
-                .filter(|b| !b.is_ascii_control())
-                .collect(),
-        )
-    } else {
-        Cow::Borrowed(s)
-    }
-}
-
 fn tree_locations(lockfile: &Lockfile) -> Vec<Option<Box<[u8]>>> {
     let len = lockfile.packages.len();
     let mut out: Vec<Option<Box<[u8]>>> = vec![None; len];
@@ -732,7 +718,7 @@ fn print_text(entries: &[Entry], long: bool, checked: usize, summary: bool) {
         licenses += 1;
         bun_core::prettyln!(
             "<b>{}<r> <d>({})<r>",
-            BStr::new(&printable(license)),
+            escape_control_chars(license),
             end - start
         );
         for (i, entry) in entries[start..end].iter().enumerate() {
@@ -740,8 +726,8 @@ fn print_text(entries: &[Entry], long: bool, checked: usize, summary: bool) {
             bun_core::pretty!(
                 "<d>{}<r> {}<d>@{}<r>",
                 if last { "└──" } else { "├──" },
-                BStr::new(&entry.name),
-                BStr::new(&entry.version)
+                escape_control_chars(&entry.name),
+                escape_control_chars(&entry.version)
             );
             if entry.dev_only {
                 bun_core::pretty!(" <d>(dev)<r>");
@@ -753,9 +739,9 @@ fn print_text(entries: &[Entry], long: bool, checked: usize, summary: bool) {
                     .flatten()
                 {
                     if last {
-                        bun_core::prettyln!("    <d>{}<r>", BStr::new(&printable(field)));
+                        bun_core::prettyln!("    <d>{}<r>", escape_control_chars(field));
                     } else {
-                        bun_core::prettyln!("<d>│   {}<r>", BStr::new(&printable(field)));
+                        bun_core::prettyln!("<d>│   {}<r>", escape_control_chars(field));
                     }
                 }
             }
diff --git a/test/cli/install/bun-pm-licenses.test.ts b/test/cli/install/bun-pm-licenses.test.ts
index ec349296495a..19bda7b38109 100644
--- a/test/cli/install/bun-pm-licenses.test.ts
+++ b/test/cli/install/bun-pm-licenses.test.ts
@@ -71,6 +71,9 @@ function expectEmptyText(stdout: string, checked: number) {
 
 const MISSING_NOTE = "note: run 'bun install' first";
 
+// Text output is printable text and newlines; any other C0 byte, DEL or C1 character came through from a package.json unescaped.
+const RAW_CONTROL = /[\x00-\x09\x0b-\x1f\x7f\x80-\x9f]/;
+
 const fixturePackageJson = JSON.stringify({
   name: "licenses-fixture",
   version: "1.0.0",
@@ -770,7 +773,7 @@ describe("bun pm licenses", () => {
 
     const second = await licensesText(dir, "--long");
     expect(second).toContain(
-      "├── no-deps@1.0.0\n│   only a description\n├── no-deps@1.0.1\n│   newest winsline two\n│   https://example.com/new\n└── one-dep@1.0.0\n",
+      "├── no-deps@1.0.0\n│   only a description\n├── no-deps@1.0.1\n│   newest wins\\nline two\n│   https://example.com/new\n└── one-dep@1.0.0\n",
     );
     expect(second.split("\n").some(line => line.startsWith("line two"))).toBeFalse();
     const parsed = await licensesJson(dir);
@@ -838,7 +841,7 @@ describe("bun pm licenses", () => {
   });
 
   test.concurrent(
-    "control characters from package.json are stripped in text output but preserved in --json",
+    "control characters from package.json are escaped in text output but preserved in --json",
     async () => {
       const dir = await setup();
       const evilLicense = "MIT\u001b[31m\nEVIL";
@@ -847,17 +850,15 @@ describe("bun pm licenses", () => {
       patchInstalledManifest(dir, "no-deps", { license: "BSD\t2" });
 
       const stdout = await licensesText(dir, "--long");
-      expect(stdout).not.toContain("\u001b");
-      expect(stdout).not.toContain("\r");
-      expect(stdout).not.toContain("\t");
-      expect(stdout).toContain("MIT[31mEVIL (1)\n└── a-dep@1.0.1 (dev)\n    tabhere\n");
-      expect(stdout).toContain("ISCGPL-3.0 (1)\n└── one-dep@1.0.0\n");
-      expect(stdout).toContain("BSD2 (1)\n└── no-deps@1.0.0\n");
+      expect(stdout).not.toMatch(RAW_CONTROL);
+      expect(stdout).toContain("MIT\\x1b[31m\\nEVIL (1)\n└── a-dep@1.0.1 (dev)\n    tab\\there\\r\\n\n");
+      expect(stdout).toContain("ISC\\nGPL-3.0 (1)\n└── one-dep@1.0.0\n");
+      expect(stdout).toContain("BSD\\t2 (1)\n└── no-deps@1.0.0\n");
       expect(stdout.split("\n").filter(line => / \(\d+\)$/.test(line))).toStrictEqual([
-        "BSD2 (1)",
-        "ISCGPL-3.0 (1)",
+        "BSD\\t2 (1)",
+        "ISC\\nGPL-3.0 (1)",
         "MIT (2)",
-        "MIT[31mEVIL (1)",
+        "MIT\\x1b[31m\\nEVIL (1)",
         "Unknown (1)",
       ]);
       expect(stdout.split("\n").some(line => line.startsWith("GPL-3.0") || line.startsWith("EVIL"))).toBeFalse();
@@ -873,7 +874,7 @@ describe("bun pm licenses", () => {
     },
   );
 
-  test.concurrent("--long strips control characters from author, description and homepage", async () => {
+  test.concurrent("--long escapes control characters in author, description and homepage", async () => {
     const dir = await setup();
     const author = "Eve\u001b]8;;https://evil.example\u0007click\u001b]8;;\u0007";
     const description = "first\r\nsecond";
@@ -881,11 +882,13 @@ describe("bun pm licenses", () => {
     patchInstalledManifest(dir, "a-dep", { author, description, homepage });
 
     const stdout = await licensesText(dir, "--long");
-    expect(stdout).not.toContain("\u001b");
-    expect(stdout).not.toContain("\u0007");
-    expect(stdout).not.toContain("\r");
+    expect(stdout).not.toMatch(RAW_CONTROL);
     expect(stdout).toContain(
-      "├── a-dep@1.0.1 (dev)\n│   Eve]8;;https://evil.exampleclick]8;;\n│   firstsecond\n│   https://example.com/[2Jx\n├── no-deps@1.0.0\n",
+      "├── a-dep@1.0.1 (dev)\n" +
+        "│   Eve\\x1b]8;;https://evil.example\\x07click\\x1b]8;;\\x07\n" +
+        "│   first\\r\\nsecond\n" +
+        "│   https://example.com/\\x1b[2Jx\n" +
+        "├── no-deps@1.0.0\n",
     );
     expect(stdout.split("\n").some(line => line.startsWith("second"))).toBeFalse();
 
@@ -897,6 +900,39 @@ describe("bun pm licenses", () => {
     });
   });
 
+  // U+009B is the one-character form of ESC [ and, unlike the ASCII controls above, is accepted in a file name, so a
+  // tarball specifier carries it into the version column. A backslash and U+00A9 (encoded with the same lead byte as
+  // U+009B) must come through unchanged.
+  test.concurrent("C1 controls and DEL are escaped in the license, the version column and --long fields", async () => {
+    const C1 = "\u009b";
+    const tarball = `path-parse-${C1}.tgz`;
+    const { packageDir: dir } = await registry.createTestDir({
+      bunfigOpts: { linker: "hoisted" },
+      files: { "package.json": pkg({ dependencies: { pp: `file:./${tarball}` } }) },
+    });
+    copyFileSync(join(registry.packagesPath, "path-parse", "path-parse-1.0.6.tgz"), join(dir, tarball));
+    await install(dir, "hoisted");
+    const license = `MIT${C1}31m`;
+    const author = `Eve${C1}2J \\ \u007f \u00a9`;
+    const description = `one${C1}two`;
+    const homepage = `https://example.com/${C1}x`;
+    patchInstalledManifest(dir, "pp", { license, author, description, homepage });
+
+    const stdout = await licensesText(dir, "--long");
+    expect(stdout).not.toMatch(RAW_CONTROL);
+    expect(stdout).toContain(
+      "MIT\\u009b31m (1)\n" +
+        "└── path-parse@./path-parse-\\u009b.tgz\n" +
+        "    Eve\\u009b2J \\ \\x7f \u00a9\n" +
+        "    one\\u009btwo\n" +
+        "    https://example.com/\\u009bx\n",
+    );
+
+    expect(await licensesJson(dir)).toStrictEqual({
+      [license]: [{ name: "path-parse", versions: [`./${tarball}`], license, author, description, homepage }],
+    });
+  });
+
   test.concurrent("isolated linker matches hoisted: marker, --dev and --long", async () => {
     const dir = await setup("isolated");
     const [[expected], [stdout, stderr, exitCode]] = await Promise.all([licenses(hoistedDir), licenses(dir)]);

From 4208268c970c2edaea52d0b8084ff9b2cbaeb7e9 Mon Sep 17 00:00:00 2001
From: robobun <117481402+robobun@users.noreply.github.com>
Date: Mon, 17 Aug 2026 01:27:24 +0000
Subject: [PATCH 106/258] install: send credentials embedded in a registry URL
 that comes from an env var (#38834)

---
 src/install/npm.rs                   |   9 ++
 test/cli/install/bun-install.test.ts | 176 +++++++++++++++++++++++++++
 test/cli/install/bun-publish.test.ts |  39 ++++++
 3 files changed, 224 insertions(+)

diff --git a/src/install/npm.rs b/src/install/npm.rs
index a1bd26f3fda2..9ed05009b4ef 100644
--- a/src/install/npm.rs
+++ b/src/install/npm.rs
@@ -359,6 +359,15 @@ pub mod registry {
                 }
             }
 
+            // The config loaders split literal strings; an expanded $ENV_VAR is split here.
+            let from_url = api::NpmRegistry::from_url(&registry.url);
+            registry.url = from_url.url;
+            if !registry.has_credentials() {
+                registry.token = from_url.token;
+                registry.username = from_url.username;
+                registry.password = from_url.password;
+            }
+
             // `url` borrows the owned `registry_url` buffer for the duration
             // of parsing. The final href is moved into `Scope.url: OwnedURL`
             // (owned `Box<[u8]>`).
diff --git a/test/cli/install/bun-install.test.ts b/test/cli/install/bun-install.test.ts
index 0b1b75dc6b58..e4312eb01a6b 100644
--- a/test/cli/install/bun-install.test.ts
+++ b/test/cli/install/bun-install.test.ts
@@ -1261,6 +1261,182 @@ describe.concurrent("bun-install", () => {
     });
   });
 
+  // `registry = "https://user:pass@host/"` written literally is split into
+  // credentials while bunfig.toml is parsed. A `registry = "$ENV_VAR"` value is
+  // only expanded later, in `Scope::from_api`, so the credentials inside the
+  // variable's URL have to be split out there.
+  describe("credentials embedded in a registry URL taken from an env var", () => {
+    const tgz = join(import.meta.dir, "registry", "packages", "no-deps", "no-deps-1.0.0.tgz");
+    const integrity = "sha512-v4w12JRjUGvfHDUP8vFDwu0gUWu04j0cv9hLb1Abf9VdaXu4XcrddYFTMVBVvmldKViGWH7jrb6xPJRF0wq6gw==";
+    const basic = `Basic ${Buffer.from("alice:s3cret").toString("base64")}`;
+
+    async function installWith(opts: {
+      bunfig: (registryOrigin: string) => string;
+      env?: (registryOrigin: string) => Record<string, string>;
+      files?: (registryOrigin: string) => Record<string, string>;
+      dependency?: string;
+    }) {
+      const requests: { path: string; authorization: string | null }[] = [];
+      await using registry = Bun.serve({
+        port: 0,
+        hostname: "127.0.0.1",
+        fetch(req) {
+          const { pathname } = new URL(req.url);
+          requests.push({ path: pathname, authorization: req.headers.get("authorization") });
+          if (pathname.endsWith(".tgz")) {
+            return new Response(Bun.file(tgz));
+          }
+          const name = decodeURIComponent(pathname.slice(1));
+          if (name !== "no-deps" && name !== "@myorg/pkg") {
+            return new Response("not found", { status: 404 });
+          }
+          return Response.json({
+            name,
+            "dist-tags": { latest: "1.0.0" },
+            versions: {
+              "1.0.0": {
+                name,
+                version: "1.0.0",
+                dist: { integrity, tarball: `http://127.0.0.1:${registry.port}/${name}/-/pkg-1.0.0.tgz` },
+              },
+            },
+          });
+        },
+      });
+      const origin = `127.0.0.1:${registry.port}`;
+      const dependency = opts.dependency ?? "no-deps";
+
+      using dir = tempDir("registry-url-credentials", {
+        "package.json": JSON.stringify({ name: "app", version: "1.0.0", dependencies: { [dependency]: "1.0.0" } }),
+        "bunfig.toml": opts.bunfig(origin),
+        ...opts.files?.(origin),
+      });
+
+      await using proc = spawn({
+        cmd: [bunExe(), "install"],
+        cwd: String(dir),
+        env: { ...env, BUN_INSTALL_CACHE_DIR: join(String(dir), ".cache"), ...opts.env?.(origin) },
+        stdout: "pipe",
+        stderr: "pipe",
+      });
+      const [stdout, stderr, exitCode] = await Promise.all([proc.stdout.text(), proc.stderr.text(), proc.exited]);
+      return { requests, stdout, stderr, exitCode };
+    }
+
+    const basicAuthForms: [name: string, opts: Parameters<typeof installWith>[0]][] = [
+      [
+        "install.registry = $ENV_VAR",
+        {
+          bunfig: () => `[install]\nregistry = "$MY_REG"\n`,
+          env: origin => ({ MY_REG: `http://alice:s3cret@${origin}/` }),
+        },
+      ],
+      [
+        "install.registry = $ENV_VAR, set in the project's .env",
+        {
+          bunfig: () => `[install]\nregistry = "$MY_REG"\n`,
+          files: origin => ({ ".env": `MY_REG=http://alice:s3cret@${origin}/\n` }),
+        },
+      ],
+      [
+        "install.registry = { url = $ENV_VAR }",
+        {
+          bunfig: () => `[install]\nregistry = { url = "$MY_REG" }\n`,
+          env: origin => ({ MY_REG: `http://alice:s3cret@${origin}/` }),
+        },
+      ],
+      [
+        "install.scopes entry = $ENV_VAR",
+        {
+          bunfig: () => `[install.scopes]\n"@myorg" = "$MY_REG"\n`,
+          env: origin => ({ MY_REG: `http://alice:s3cret@${origin}/` }),
+          dependency: "@myorg/pkg",
+        },
+      ],
+    ];
+
+    for (const [name, opts] of basicAuthForms) {
+      it(`sends user:pass@ from the URL as Basic auth (${name})`, async () => {
+        const { requests, stdout, stderr, exitCode } = await installWith(opts);
+        const manifestPath = opts.dependency === "@myorg/pkg" ? "/@myorg%2fpkg" : "/no-deps";
+        const tarballPath = `/${opts.dependency ?? "no-deps"}/-/pkg-1.0.0.tgz`;
+        expect({ requests, stderr }).toEqual({
+          requests: [
+            { path: manifestPath, authorization: basic },
+            { path: tarballPath, authorization: basic },
+          ],
+          stderr: expect.not.stringContaining("s3cret"),
+        });
+        expect(stdout).toContain("1 package installed");
+        expect(exitCode).toBe(0);
+      });
+    }
+
+    it("sends :token@ from the URL as a Bearer token", async () => {
+      const { requests, stdout, stderr, exitCode } = await installWith({
+        bunfig: () => `[install]\nregistry = "$MY_REG"\n`,
+        env: origin => ({ MY_REG: `http://:tok-from-env@${origin}/` }),
+      });
+      expect({ requests, stderr }).toEqual({
+        requests: [
+          { path: "/no-deps", authorization: "Bearer tok-from-env" },
+          { path: "/no-deps/-/pkg-1.0.0.tgz", authorization: "Bearer tok-from-env" },
+        ],
+        stderr: expect.not.stringContaining("tok-from-env"),
+      });
+      expect(stdout).toContain("1 package installed");
+      expect(exitCode).toBe(0);
+    });
+
+    it("does not print the credentials with the request URL", async () => {
+      const { requests, stderr, exitCode } = await installWith({
+        bunfig: () => `[install]\nregistry = "$MY_REG"\n`,
+        env: origin => ({ MY_REG: `http://alice:s3cret@${origin}/` }),
+        dependency: "not-on-this-registry",
+      });
+      expect({ requests, stderr }).toEqual({
+        requests: [{ path: "/not-on-this-registry", authorization: basic }],
+        stderr: expect.stringMatching(/error: GET http:\/\/127\.0\.0\.1:\d+\/+not-on-this-registry - 404/),
+      });
+      expect(stderr).not.toContain("s3cret");
+      expect(exitCode).toBe(1);
+    });
+
+    // Either kind of configured credential has to win: `from_api` sends a token
+    // in preference to a username/password pair, so a token taken from the URL
+    // would otherwise displace an explicitly configured pair.
+    const explicitWins: [name: string, bunfig: string, urlUserinfo: string, expected: string][] = [
+      [
+        "configured token vs user:pass@ in the URL",
+        `[install]\nregistry = { url = "$MY_REG", token = "configured-token" }\n`,
+        "alice:s3cret",
+        "Bearer configured-token",
+      ],
+      [
+        "configured username/password vs :token@ in the URL",
+        `[install]\nregistry = { url = "$MY_REG", username = "configured-user", password = "configured-pass" }\n`,
+        ":s3cret",
+        `Basic ${Buffer.from("configured-user:configured-pass").toString("base64")}`,
+      ],
+    ];
+
+    for (const [name, bunfig, urlUserinfo, expected] of explicitWins) {
+      it(`credentials configured explicitly override the ones inside the URL (${name})`, async () => {
+        const { requests, stderr, exitCode } = await installWith({
+          bunfig: () => bunfig,
+          env: origin => ({ MY_REG: `http://${urlUserinfo}@${origin}/` }),
+          dependency: "not-on-this-registry",
+        });
+        expect({ requests, stderr }).toEqual({
+          requests: [{ path: "/not-on-this-registry", authorization: expected }],
+          stderr: expect.stringMatching(/error: GET http:\/\/127\.0\.0\.1:\d+\/+not-on-this-registry - 404/),
+        });
+        expect(stderr).not.toContain("s3cret");
+        expect(exitCode).toBe(1);
+      });
+    }
+  });
+
   it("--silent suppresses verbose output even when RUNNER_DEBUG is set", async () => {
     using dir = tempDir("install-silent-verbose", {
       "package.json": JSON.stringify({ name: "app", dependencies: {} }),
diff --git a/test/cli/install/bun-publish.test.ts b/test/cli/install/bun-publish.test.ts
index e360b7bcde7d..df424409099a 100644
--- a/test/cli/install/bun-publish.test.ts
+++ b/test/cli/install/bun-publish.test.ts
@@ -1607,6 +1607,45 @@ describe.concurrent("basic auth", () => {
   });
 });
 
+test("user:pass@ in a registry url taken from an env var is sent as Basic auth", async () => {
+  const requests: { method: string; pathname: string; authorization: string | null }[] = [];
+  using mock = Bun.serve({
+    port: 0,
+    fetch(req) {
+      requests.push({
+        method: req.method,
+        pathname: new URL(req.url).pathname,
+        authorization: req.headers.get("authorization"),
+      });
+      return new Response("OK", { status: 200 });
+    },
+  });
+
+  using packageDir = tempDir("publish-env-registry-userinfo", {
+    "package.json": JSON.stringify({ name: "env-userinfo-pkg", version: "1.0.0" }),
+    "bunfig.toml": `[install]\nregistry = "$PUBLISH_REGISTRY"\n`,
+  });
+
+  const { out, err, exitCode } = await publish(
+    { ...env, PUBLISH_REGISTRY: `http://pubuser:hunter2@localhost:${mock.port}/` },
+    String(packageDir),
+  );
+  expect({ requests, err }).toEqual({
+    requests: [
+      {
+        method: "PUT",
+        pathname: "/env-userinfo-pkg",
+        authorization: `Basic ${Buffer.from("pubuser:hunter2").toString("base64")}`,
+      },
+    ],
+    err: expect.not.stringContaining("error:"),
+  });
+  expect(out).toContain(`Registry: http://localhost:${mock.port}/\n`);
+  expect(out).toContain(" + env-userinfo-pkg@1.0.0");
+  expect(out).not.toContain("hunter2");
+  expect(exitCode).toBe(0);
+});
+
 describe("--tolerate-republish", async () => {
   test("republishing normally fails", async () => {
     const { packageDir, packageJson } = await registry.createTestDir();

From 3819c861f1c0b282b81919c507258799fe2acb3d Mon Sep 17 00:00:00 2001
From: robobun <117481402+robobun@users.noreply.github.com>
Date: Mon, 17 Aug 2026 01:27:31 +0000
Subject: [PATCH 107/258] install: send Basic auth for a registry URL with a
 username but no password (#39063)

---
 src/install/npm.rs                         |  2 +-
 src/options_types/schema.rs                | 17 +++--
 test/cli/install/bun-publish.test.ts       | 26 +++++++
 test/cli/install/config-precedence.test.ts | 80 ++++++++++++++++++++++
 test/cli/install/npmrc.test.ts             | 32 +++++++++
 5 files changed, 152 insertions(+), 5 deletions(-)

diff --git a/src/install/npm.rs b/src/install/npm.rs
index 9ed05009b4ef..2967296e2834 100644
--- a/src/install/npm.rs
+++ b/src/install/npm.rs
@@ -488,7 +488,7 @@ pub mod registry {
                     registry.password = env.get_auto(&registry.password).into();
 
                     if !registry.username.is_empty()
-                        && !registry.password.is_empty()
+                        && (!registry.password.is_empty() || registry.credentials_from_url)
                         && auth.is_empty()
                     {
                         let combo_len = registry.username.len() + registry.password.len() + 1;
diff --git a/src/options_types/schema.rs b/src/options_types/schema.rs
index ffde83bb9211..01d16fb5a241 100644
--- a/src/options_types/schema.rs
+++ b/src/options_types/schema.rs
@@ -150,6 +150,12 @@ pub mod api {
         pub token: Box<[u8]>,
         /// email
         pub email: Box<[u8]>,
+        /// Set by `from_url` when the credentials were written into the URL.
+        /// `Scope::from_api` takes those as complete as written: `http://user@host/`
+        /// authenticates as `user` with an empty password (what npm sends for that
+        /// URL), whereas a `username` configured on its own (`.npmrc` `username`
+        /// without `_password`, bunfig `username` without `password`) sends nothing.
+        pub credentials_from_url: bool,
     }
 
     impl NpmRegistry {
@@ -157,12 +163,15 @@ pub mod api {
             let url = bun_url::URL::parse(str);
             let mut registry = NpmRegistry::default();
 
-            if url.username.is_empty() && !url.password.is_empty() {
-                registry.token = Box::from(url.password);
-                registry.url = url.href_without_auth();
-            } else if !url.username.is_empty() && !url.password.is_empty() {
+            if !url.username.is_empty() {
                 registry.username = Box::from(url.username);
                 registry.password = Box::from(url.password);
+                registry.credentials_from_url = true;
+                registry.url = url.href_without_auth();
+            } else if !url.password.is_empty() {
+                // `http://:token@host/`
+                registry.token = Box::from(url.password);
+                registry.credentials_from_url = true;
                 registry.url = url.href_without_auth();
             } else {
                 // Do not include a trailing slash. There might be parameters at the end.
diff --git a/test/cli/install/bun-publish.test.ts b/test/cli/install/bun-publish.test.ts
index df424409099a..65184d20714e 100644
--- a/test/cli/install/bun-publish.test.ts
+++ b/test/cli/install/bun-publish.test.ts
@@ -1005,6 +1005,32 @@ describe.concurrent("credentials in the registry url", () => {
     expect(exitCode).toBe(0);
   });
 
+  // `http://user@host/` is `user` with an empty password (npm publishes with `Basic base64("user:")`);
+  // bun used to stop with "missing authentication". Spelled `user:@` because `user@host:port` does not
+  // get through bun's URL parser yet (#16181); both reach the registry config as a username without a password.
+  test("--registry with user:@ publishes with Basic auth and an empty password", async () => {
+    using mock = registryMock();
+    const packageDir = await packageDirFor("userinfo-no-password-pkg");
+
+    const { out, err, exitCode } = await publish(
+      env,
+      packageDir,
+      "--registry",
+      `http://pubuser:@localhost:${mock.port}/`,
+    );
+    expect(err).not.toContain("error:");
+    expect(out).toContain(`Registry: http://localhost:${mock.port}/\n`);
+    expect(out).toContain(" + userinfo-no-password-pkg@1.0.0");
+    expect(mock.requests).toEqual([
+      {
+        method: "PUT",
+        pathname: "/userinfo-no-password-pkg",
+        authorization: `Basic ${Buffer.from("pubuser:").toString("base64")}`,
+      },
+    ]);
+    expect(exitCode).toBe(0);
+  });
+
   test.each(["npm_config_registry", "NPM_CONFIG_REGISTRY", "BUN_CONFIG_REGISTRY"])(
     "%s with user:pass@ publishes with Basic auth",
     async key => {
diff --git a/test/cli/install/config-precedence.test.ts b/test/cli/install/config-precedence.test.ts
index 1dc220cff80c..c5ea0378093d 100644
--- a/test/cli/install/config-precedence.test.ts
+++ b/test/cli/install/config-precedence.test.ts
@@ -713,6 +713,86 @@ describe.concurrent("bun install config precedence", () => {
     expect(exitCode).toBe(0);
   });
 
+  // A username written into the URL without a password is Basic auth with an empty password, which is
+  // what npm sends for `http://user@host/`; bun used to leave the userinfo in the URL and send nothing.
+  // The URL is spelled `user:@host:port` because `user@host:port` does not get through bun's URL parser
+  // yet (#16181); both spellings reach the registry config as a username with an empty password. The
+  // verdaccio behind the capturing registry accepts any credentials for packages readable by everyone.
+  const emptyPasswordAuth = `Basic ${Buffer.from("config-precedence:").toString("base64")}`;
+  const userOnlyRegistrySources: [
+    source: string,
+    configure: (url: string) => {
+      files?: Record<string, string>;
+      args?: string[];
+      env?: Record<string, string>;
+      dependency?: string;
+    },
+  ][] = [
+    ["bunfig registry string", url => ({ files: { "project/bunfig.toml": bunfig({ registry: url }) } })],
+    ["bunfig registry object", url => ({ files: { "project/bunfig.toml": bunfig({ registry: { url } }) } })],
+    [
+      "bunfig scoped registry",
+      url => ({ files: { "project/bunfig.toml": bunfig({ scopes: { types: url } }) }, dependency: "@types/no-deps" }),
+    ],
+    [".npmrc registry=", url => ({ files: { "project/.npmrc": `registry=${url}\n` } })],
+    [
+      ".npmrc @scope:registry=",
+      url => ({ files: { "project/.npmrc": `@types:registry=${url}\n` }, dependency: "@types/no-deps" }),
+    ],
+    ["--registry", url => ({ args: ["--registry", url] })],
+    ["BUN_CONFIG_REGISTRY", url => ({ env: { BUN_CONFIG_REGISTRY: url } })],
+  ];
+
+  test.each(userOnlyRegistrySources)(
+    "%s with user:@ in the URL sends Basic auth with an empty password",
+    async (_, configure) => {
+      using capture = capturingRegistry();
+      const {
+        files = {},
+        args = [],
+        env = {},
+        dependency = "no-deps",
+      } = configure(withUserinfo(capture, "config-precedence:"));
+      using dir = tempDir("config-precedence", {
+        ...files,
+        "project/package.json": packageJson({ [dependency]: "1.0.0" }),
+      });
+      const { stderr, exitCode } = await install(String(dir), args, env);
+      expect(stderr).not.toContain("error:");
+      expect(new Set(capture.authorizations)).toStrictEqual(new Set([emptyPasswordAuth]));
+      expect(installed(String(dir), ...dependency.split("/"))).toBe(true);
+      expect(exitCode).toBe(0);
+    },
+  );
+
+  // Unlike a username written into the URL, a username configured on its own is not a credential: npm
+  // only uses the `username` / `_password` pair when both are set.
+  test("bunfig registry object with a username key but no password sends no credentials", async () => {
+    using capture = capturingRegistry();
+    using dir = tempDir("config-precedence", {
+      "project/bunfig.toml": bunfig({ registry: { url: capture.url, username: "config-precedence" } }),
+      "project/package.json": packageJson({ "no-deps": "1.0.0" }),
+    });
+    const { stderr, exitCode } = await install(String(dir));
+    expect(stderr).not.toContain("error:");
+    expect(new Set(capture.authorizations)).toStrictEqual(new Set([null]));
+    expect(installed(String(dir), "no-deps")).toBe(true);
+    expect(exitCode).toBe(0);
+  });
+
+  test(".npmrc :username= without :_password= sends no credentials", async () => {
+    using capture = capturingRegistry();
+    using dir = tempDir("config-precedence", {
+      "project/.npmrc": `registry=${capture.url}\n//localhost:${capture.port}/:username=config-precedence\n`,
+      "project/package.json": packageJson({ "no-deps": "1.0.0" }),
+    });
+    const { stderr, exitCode } = await install(String(dir));
+    expect(stderr).not.toContain("error:");
+    expect(new Set(capture.authorizations)).toStrictEqual(new Set([null]));
+    expect(installed(String(dir), "no-deps")).toBe(true);
+    expect(exitCode).toBe(0);
+  });
+
   test("user:pass@ in --registry replaces the .npmrc _authToken for the same host", async () => {
     using capture = capturingRegistry();
     using dir = tempDir("config-precedence", {
diff --git a/test/cli/install/npmrc.test.ts b/test/cli/install/npmrc.test.ts
index 7dca931cd5fd..e43a83aac091 100644
--- a/test/cli/install/npmrc.test.ts
+++ b/test/cli/install/npmrc.test.ts
@@ -742,6 +742,38 @@ registry=https://somehost.com/org1/npm/registry/
     });
   });
 
+  describe("credentials written into the registry= URL", () => {
+    // `http://user@host/` is `user` with an empty password (what `new URL()` reports and what npm
+    // authenticates with); it used to be left inside the URL like a URL without credentials.
+    test.each([
+      ["user:pass@ is split into a username and a password", "http://carol:s3cret@example.com/npm/", "carol", "s3cret"],
+      ["user@ is a username with an empty password", "http://carol@example.com/npm/", "carol", ""],
+      ["user:@ is a username with an empty password", "http://carol:@example.com/npm/", "carol", ""],
+    ])("%s", (_, registryUrl, username, password) => {
+      expect(loadNpmrc(`registry=${registryUrl}\n`)).toEqual({
+        default_registry_url: "http://example.com/npm/",
+        default_registry_token: "",
+        default_registry_username: username,
+        default_registry_password: password,
+        default_registry_email: "",
+      });
+    });
+
+    test("a password without a username is a token", () => {
+      expect(loadNpmrc(`registry=http://:s3cret@example.com/npm/\n`)).toEqual({
+        default_registry_url: "http://example.com/npm/",
+        default_registry_token: "s3cret",
+        default_registry_username: "",
+        default_registry_password: "",
+        default_registry_email: "",
+      });
+    });
+
+    test("a URL without credentials is kept as written", () => {
+      expect(loadNpmrc(`registry=http://example.com/npm\n`).default_registry_url).toBe("http://example.com/npm");
+    });
+  });
+
   it("does not print an undecodable _password value", async () => {
     const secret = "s!ecret!pass";
     using dir = tempDir("npmrc-password-decode", {

From 07d56915973af7a97ff9516a2ee00012ed92306f Mon Sep 17 00:00:00 2001
From: robobun <117481402+robobun@users.noreply.github.com>
Date: Mon, 17 Aug 2026 01:27:36 +0000
Subject: [PATCH 108/258] pm view: match the requested range against the buffer
 it was parsed from (#38671)

---
 src/runtime/cli/pm_view_command.rs |  8 ++--
 test/cli/install/bun-info.test.ts  | 65 ++++++++++++++++++++++++++++++
 2 files changed, 68 insertions(+), 5 deletions(-)

diff --git a/src/runtime/cli/pm_view_command.rs b/src/runtime/cli/pm_view_command.rs
index 205293552cce..fda09c89cb88 100644
--- a/src/runtime/cli/pm_view_command.rs
+++ b/src/runtime/cli/pm_view_command.rs
@@ -207,11 +207,9 @@ pub(crate) fn view(
                         // Parse as semver query and find best version
                         let sliced_literal = Semver::SlicedString::init(version, version);
                         let query = Semver::query::parse(version, sliced_literal)?;
-                        // `defer query.deinit()` — handled by Drop
-                        // Use the same pattern as outdated_command: findBestVersion(query.head, string_buf)
-                        if let Some(result) =
-                            parsed_manifest.find_best_version(&query, &parsed_manifest.string_buf)
-                        {
+                        // The query's prerelease/build tags are offsets into `version`, the
+                        // buffer it was parsed from, so that is the buffer to match it with.
+                        if let Some(result) = parsed_manifest.find_best_version(&query, version) {
                             break 'brk2 result.version;
                         }
                     }
diff --git a/test/cli/install/bun-info.test.ts b/test/cli/install/bun-info.test.ts
index 17715a244f57..fb8443ddf34e 100644
--- a/test/cli/install/bun-info.test.ts
+++ b/test/cli/install/bun-info.test.ts
@@ -467,6 +467,71 @@ describe.concurrent("bun info with control characters in the packument", () => {
   });
 });
 
+// Semver strings longer than 8 bytes are stored as offsets into the buffer they
+// were parsed from. A range given on the command line is parsed from the
+// argument, so its prerelease tags have to be read back out of the argument and
+// not out of the manifest's string buffer. The manifest buffer starts with the
+// package name, and the name is longer than any range below, so reading the
+// wrong buffer yields a piece of the name rather than the tag by coincidence.
+describe.concurrent("version ranges with prerelease tags longer than 8 bytes", () => {
+  const name = "long-prerelease-tags-pkg";
+  const published = ["1.0.0-beta.20240101", "1.0.0-beta.20240301"];
+  const packument = JSON.stringify({
+    name,
+    "dist-tags": { latest: "1.0.0-beta.20240301" },
+    versions: Object.fromEntries(
+      published.map(version => [
+        version,
+        { name, version, dist: { tarball: `http://localhost/${name}-${version}.tgz` } },
+      ]),
+    ),
+  });
+
+  async function view(subcommand: string[], spec: string) {
+    await using server = Bun.serve({
+      port: 0,
+      fetch: () => new Response(packument, { headers: { "content-type": "application/json" } }),
+    });
+    using dir = tempDir("view-long-prerelease", {
+      "package.json": JSON.stringify({ name: "test", version: "1.0.0" }),
+      "bunfig.toml": `[install]\nregistry = "http://localhost:${server.port}/"\n`,
+    });
+    await using proc = spawn({
+      cmd: [bunExe(), ...subcommand, `${name}@${spec}`, "version"],
+      cwd: String(dir),
+      env: { ...bunEnv, http_proxy: "", https_proxy: "", HTTP_PROXY: "", HTTPS_PROXY: "" },
+      stdout: "pipe",
+      stderr: "pipe",
+      stdin: "ignore",
+    });
+    const [stdout, stderr, exitCode] = await Promise.all([proc.stdout.text(), proc.stderr.text(), proc.exited]);
+    return { stdout, stderr, exitCode };
+  }
+
+  describe.each([
+    ["bun info", ["info"]],
+    ["bun pm view", ["pm", "view"]],
+  ])("%s", (_, subcommand) => {
+    test.each([
+      // resolved through the `latest` dist-tag
+      [">=1.0.0-beta.20240101", "1.0.0-beta.20240301"],
+      ["~1.0.0-beta.20240301", "1.0.0-beta.20240301"],
+      // `latest` is excluded, resolved by walking the prerelease list
+      ["<1.0.0-beta.20240201", "1.0.0-beta.20240101"],
+    ])(`${name}@%s resolves to %s`, async (spec, expected) => {
+      expect(await view(subcommand, spec)).toEqual({ stdout: `${expected}\n`, stderr: "", exitCode: 0 });
+    });
+
+    test(`${name}@<1.0.0-beta.20240101 matches nothing`, async () => {
+      expect(await view(subcommand, "<1.0.0-beta.20240101")).toEqual({
+        stdout: "",
+        stderr: expect.stringContaining(`No version of "${name}" satisfying "<1.0.0-beta.20240101" found`),
+        exitCode: 1,
+      });
+    });
+  });
+});
+
 // LSan's default conservative scan only flags the `send_sync` response-metadata
 // leak when no idle thread parks with a stale pointer in a callee-saved
 // register; excluding registers as roots makes the check deterministic.

From bc1fdc0231732dd1412cecfc3a45a94a12d80c09 Mon Sep 17 00:00:00 2001
From: Dylan Conway <dylan.conway567@gmail.com>
Date: Mon, 17 Aug 2026 01:28:16 +0000
Subject: [PATCH 109/258] install: remove the node_modules links of a renamed
 or removed workspace (#38511)

---
 src/install/PackageManager.rs                 |   2 +
 .../PackageManager/install_with_manager.rs    |   6 +
 .../remove_stale_workspace_links.rs           |  80 ++++++++
 test/cli/install/bun-workspaces.test.ts       | 176 ++++++++++++++++++
 4 files changed, 264 insertions(+)
 create mode 100644 src/install/PackageManager/remove_stale_workspace_links.rs

diff --git a/src/install/PackageManager.rs b/src/install/PackageManager.rs
index 4382e8d4aa5b..c37e1cd39d09 100644
--- a/src/install/PackageManager.rs
+++ b/src/install/PackageManager.rs
@@ -78,6 +78,8 @@ pub mod populate_manifest_cache;
 pub mod process_dependency_list;
 #[path = "PackageManager/ProgressStrings.rs"]
 pub mod progress_strings;
+#[path = "PackageManager/remove_stale_workspace_links.rs"]
+pub(crate) mod remove_stale_workspace_links;
 #[path = "PackageManager/runTasks.rs"]
 pub mod run_tasks;
 #[path = "PackageManager/security_scanner.rs"]
diff --git a/src/install/PackageManager/install_with_manager.rs b/src/install/PackageManager/install_with_manager.rs
index 3288cc0f93a6..2090a2839c56 100644
--- a/src/install/PackageManager/install_with_manager.rs
+++ b/src/install/PackageManager/install_with_manager.rs
@@ -39,6 +39,7 @@ use bun_install_types::NodeLinker::NodeLinker;
 
 // Free-function "methods" on `PackageManager` hosted in sibling modules
 // to avoid one giant `impl PackageManager` block.
+use crate::package_manager_real::remove_stale_workspace_links::remove_stale_workspace_links;
 use crate::package_manager_real::run_tasks::{RunTasksCallbacks, run_tasks};
 use crate::package_manager_real::{
     UpdateRequest, enqueue_dependency_list, enqueue_dependency_with_main, enqueue_patch_task_pre,
@@ -818,6 +819,11 @@ pub fn install_with_manager(
             break 'install_summary PackageInstallSummary::default();
         }
 
+        // Every workspace is a root dependency, so without a diff the workspace set is unchanged.
+        if had_any_diffs {
+            remove_stale_workspace_links(&lockfile_before_clean, &manager.lockfile);
+        }
+
         let mut linker = manager.options.node_linker;
         loop {
             match linker {
diff --git a/src/install/PackageManager/remove_stale_workspace_links.rs b/src/install/PackageManager/remove_stale_workspace_links.rs
new file mode 100644
index 000000000000..3540d66fc4f3
--- /dev/null
+++ b/src/install/PackageManager/remove_stale_workspace_links.rs
@@ -0,0 +1,80 @@
+use bstr::BStr;
+use bun_paths::AutoAbsPathChecked;
+
+use crate::lockfile::Lockfile;
+use crate::lockfile::package::PackageColumns as _;
+use crate::package_installer::alias_is_safe_install_target;
+use crate::package_manager_real::PackageManager;
+use crate::resolution::Tag as ResolutionTag;
+
+/// Linkers only visit names in the new lockfile; a workspace name that left it is unlinked here.
+pub(crate) fn remove_stale_workspace_links(previous: &Lockfile, current: &Lockfile) {
+    let previous_string_buf = previous.buffers.string_bytes.as_slice();
+    let previous_packages = previous.packages.slice();
+    let resolutions = previous_packages.items_resolution();
+    let name_hashes = previous_packages.items_name_hash();
+    let names = previous_packages.items_name();
+
+    for pkg_id in 0..previous_packages.len() {
+        if resolutions[pkg_id].tag != ResolutionTag::Workspace
+            || current.workspace_paths.contains_key(&name_hashes[pkg_id])
+        {
+            continue;
+        }
+
+        let name = names[pkg_id].slice(previous_string_buf);
+        if !alias_is_safe_install_target(name) {
+            continue;
+        }
+
+        remove_links_named(current, name);
+    }
+}
+
+#[cold]
+#[inline(never)]
+fn remove_links_named(current: &Lockfile, name: &[u8]) {
+    let current_string_buf = current.buffers.string_bytes.as_slice();
+
+    let mut path = AutoAbsPathChecked::init_top_level_dir();
+    let top_level_len = path.len();
+
+    remove_link(&mut path, b"", name);
+    for workspace_path in current.workspace_paths.values() {
+        path.set_length(top_level_len);
+        remove_link(&mut path, workspace_path.slice(current_string_buf), name);
+    }
+}
+
+/// `readlink` is the symlink (or junction) check; a real directory or file there is left alone.
+fn remove_link(path: &mut AutoAbsPathChecked, package_dir: &[u8], name: &[u8]) {
+    if path.append(package_dir).is_err()
+        || path.append(b"node_modules").is_err()
+        || path.append(name).is_err()
+    {
+        return;
+    }
+
+    let mut link_target = bun_paths::path_buffer_pool::get();
+    if bun_sys::readlink(path.slice_z(), &mut link_target).is_err() {
+        return;
+    }
+
+    bun_output::scoped_log!(
+        PackageManager,
+        "removing stale workspace link {}",
+        BStr::new(path.slice())
+    );
+
+    #[cfg(windows)]
+    {
+        // Directory symlinks and junctions need rmdir; a file symlink needs unlink.
+        if bun_sys::rmdir(path.slice_z()).is_err() {
+            let _ = bun_sys::unlink(path.slice_z());
+        }
+    }
+    #[cfg(not(windows))]
+    {
+        let _ = bun_sys::unlink(path.slice_z());
+    }
+}
diff --git a/test/cli/install/bun-workspaces.test.ts b/test/cli/install/bun-workspaces.test.ts
index 8ee98d0ed8d0..5d20d9c91d64 100644
--- a/test/cli/install/bun-workspaces.test.ts
+++ b/test/cli/install/bun-workspaces.test.ts
@@ -3051,3 +3051,179 @@ describe("workspace packages whose name is too long to link", () => {
     expect(exitCode).toBe(1);
   });
 });
+
+// Both linkers only create or repoint the `node_modules/<name>` links the current
+// lockfile asks for. When a workspace is renamed or removed, its name leaves the
+// lockfile and the links bun had created under that name (in the root's node_modules
+// and, with the isolated linker, in the node_modules of the workspaces depending on
+// it) used to stay behind, still resolving to the workspace folder.
+describe("links of a renamed or removed workspace", () => {
+  type Linker = "hoisted" | "isolated";
+  const linkers: Linker[] = ["hoisted", "isolated"];
+
+  async function install(ctx: TestCtx, linker: Linker, ...args: string[]): Promise<string> {
+    await using proc = spawn({
+      cmd: [bunExe(), "install", "--linker", linker, ...args],
+      cwd: ctx.packageDir,
+      stdout: "pipe",
+      stderr: "pipe",
+      env: ctx.env,
+    });
+    const [out, err, exitCode] = await Promise.all([proc.stdout.text(), proc.stderr.text(), proc.exited]);
+    expect(err).not.toContain("error:");
+    expect(exitCode).toBe(0);
+    return out;
+  }
+
+  function writeProject(
+    packageDir: string,
+    rootDependencies: Record<string, string>,
+    packages: Record<string, Record<string, unknown>>,
+  ) {
+    return Promise.all([
+      write(
+        join(packageDir, "package.json"),
+        JSON.stringify({ name: "foo", workspaces: ["packages/*"], devDependencies: rootDependencies }),
+      ),
+      ...Object.entries(packages).map(([dir, packageJson]) =>
+        write(join(packageDir, "packages", dir, "package.json"), JSON.stringify({ version: "1.0.0", ...packageJson })),
+      ),
+    ]);
+  }
+
+  // Package entries of a node_modules directory (no `.bun`/`.bin`), or [] when it does
+  // not exist. A listing (rather than `exists`) also sees links whose target is gone.
+  async function entries(nodeModules: string): Promise<string[]> {
+    try {
+      return (await readdirSorted(nodeModules)).filter(name => !name.startsWith("."));
+    } catch (err: any) {
+      if (err.code !== "ENOENT") throw err;
+      return [];
+    }
+  }
+
+  for (const linker of linkers) {
+    test.concurrent(`${linker}: renaming a workspace removes the links under its old name`, async () => {
+      using ctx = await setupTest();
+      const { packageDir } = ctx;
+      const rootNodeModules = join(packageDir, "node_modules");
+      const bNodeModules = join(packageDir, "packages", "b", "node_modules");
+
+      await writeProject(
+        packageDir,
+        { a: "*", b: "*" },
+        { a: { name: "a" }, b: { name: "b", dependencies: { a: "*" } } },
+      );
+      await install(ctx, linker);
+      expect(await entries(rootNodeModules)).toEqual(["a", "b"]);
+      expect(await entries(bNodeModules)).toEqual(linker === "isolated" ? ["a"] : []);
+
+      await writeProject(
+        packageDir,
+        { "a-renamed": "*", b: "*" },
+        { a: { name: "a-renamed" }, b: { name: "b", dependencies: { "a-renamed": "*" } } },
+      );
+      await install(ctx, linker);
+      expect(await entries(rootNodeModules)).toEqual(["a-renamed", "b"]);
+      expect(await entries(bNodeModules)).toEqual(linker === "isolated" ? ["a-renamed"] : []);
+      expect(await file(join(rootNodeModules, "a-renamed", "package.json")).json()).toMatchObject({
+        name: "a-renamed",
+      });
+
+      expect(await install(ctx, linker)).toContain("(no changes)");
+      expect(await entries(rootNodeModules)).toEqual(["a-renamed", "b"]);
+      expect(await entries(bNodeModules)).toEqual(linker === "isolated" ? ["a-renamed"] : []);
+    });
+
+    test.concurrent(`${linker}: renaming a scoped workspace removes the link under its old name`, async () => {
+      using ctx = await setupTest();
+      const { packageDir } = ctx;
+      const scopeDir = join(packageDir, "node_modules", "@repo");
+
+      await writeProject(
+        packageDir,
+        { "@repo/a": "*", "@repo/b": "*" },
+        { a: { name: "@repo/a" }, b: { name: "@repo/b" } },
+      );
+      await install(ctx, linker);
+      expect(await entries(scopeDir)).toEqual(["a", "b"]);
+
+      await writeProject(
+        packageDir,
+        { "@repo/a-renamed": "*", "@repo/b": "*" },
+        { a: { name: "@repo/a-renamed" }, b: { name: "@repo/b" } },
+      );
+      await install(ctx, linker);
+      expect(await entries(scopeDir)).toEqual(["a-renamed", "b"]);
+      expect(await file(join(scopeDir, "a-renamed", "package.json")).json()).toMatchObject({ name: "@repo/a-renamed" });
+    });
+
+    test.concurrent(`${linker}: removing a workspace from the project removes its link`, async () => {
+      using ctx = await setupTest();
+      const { packageDir } = ctx;
+      const rootNodeModules = join(packageDir, "node_modules");
+
+      await writeProject(packageDir, { a: "*", b: "*" }, { a: { name: "a" }, b: { name: "b" } });
+      await install(ctx, linker);
+      expect(await entries(rootNodeModules)).toEqual(["a", "b"]);
+
+      await rm(join(packageDir, "packages", "a"), { recursive: true });
+      await writeProject(packageDir, { b: "*" }, { b: { name: "b" } });
+      await install(ctx, linker);
+      expect(await entries(rootNodeModules)).toEqual(["b"]);
+    });
+
+    // The old name is unlinked before the linker runs, so a dependency that still
+    // wants that name (here an alias of the renamed workspace) is linked again.
+    test.concurrent(`${linker}: the old name is linked again when a dependency still uses it`, async () => {
+      using ctx = await setupTest();
+      const { packageDir } = ctx;
+      const rootNodeModules = join(packageDir, "node_modules");
+
+      await writeProject(packageDir, { a: "*" }, { a: { name: "a" } });
+      await install(ctx, linker);
+      expect(await entries(rootNodeModules)).toEqual(["a"]);
+
+      await writeProject(packageDir, { a: "workspace:a-renamed@*" }, { a: { name: "a-renamed" } });
+      await install(ctx, linker);
+      expect(await entries(rootNodeModules)).toEqual(linker === "isolated" ? ["a"] : ["a", "a-renamed"]);
+      expect(await file(join(rootNodeModules, "a", "package.json")).json()).toMatchObject({ name: "a-renamed" });
+    });
+  }
+
+  // The isolated linker only links the workspaces the root depends on, so nothing is
+  // ever linked for `a` here and the directory under its name is not bun's to remove.
+  test.concurrent("a directory under the old name is left alone", async () => {
+    using ctx = await setupTest();
+    const { packageDir } = ctx;
+    const rootNodeModules = join(packageDir, "node_modules");
+    const marker = join(rootNodeModules, "a", "marker.txt");
+
+    await writeProject(packageDir, { b: "*" }, { a: { name: "a" }, b: { name: "b" } });
+    await install(ctx, "isolated");
+    expect(await entries(rootNodeModules)).toEqual(["b"]);
+
+    await write(marker, "not a workspace link");
+    await writeProject(packageDir, { b: "*" }, { a: { name: "a-renamed" }, b: { name: "b" } });
+    await install(ctx, "isolated");
+    expect(await entries(rootNodeModules)).toEqual(["a", "b"]);
+    expect(await file(marker).text()).toBe("not a workspace link");
+  });
+
+  test.concurrent("--dry-run does not touch the links", async () => {
+    using ctx = await setupTest();
+    const { packageDir } = ctx;
+    const rootNodeModules = join(packageDir, "node_modules");
+
+    await writeProject(packageDir, { a: "*", b: "*" }, { a: { name: "a" }, b: { name: "b" } });
+    await install(ctx, "hoisted");
+    expect(await entries(rootNodeModules)).toEqual(["a", "b"]);
+
+    await writeProject(packageDir, { "a-renamed": "*", b: "*" }, { a: { name: "a-renamed" }, b: { name: "b" } });
+    await install(ctx, "hoisted", "--dry-run");
+    expect(await entries(rootNodeModules)).toEqual(["a", "b"]);
+
+    await install(ctx, "hoisted");
+    expect(await entries(rootNodeModules)).toEqual(["a-renamed", "b"]);
+  });
+});

From 1b83d8fbd442a5f2947575a224f6cf9963a63484 Mon Sep 17 00:00:00 2001
From: robobun <117481402+robobun@users.noreply.github.com>
Date: Mon, 17 Aug 2026 01:29:08 +0000
Subject: [PATCH 110/258] Fix bun install through subst drives, cross-drive
 junctions, and symlinked package.json (#39361)

---
 src/install/PackageManager.rs           |  30 ++++---
 src/paths/component_iterator.rs         |  56 +++++++++++-
 test/cli/install/bun-workspaces.test.ts | 110 +++++++++++++++++++++++-
 3 files changed, 184 insertions(+), 12 deletions(-)

diff --git a/src/install/PackageManager.rs b/src/install/PackageManager.rs
index c37e1cd39d09..8fd07d1aee4d 100644
--- a/src/install/PackageManager.rs
+++ b/src/install/PackageManager.rs
@@ -1709,13 +1709,20 @@ pub fn init(
                     let json_stat_size = json_file.get_end_pos()?;
                     let mut json_buf = vec![0u8; (json_stat_size + 64) as usize];
                     let json_len = json_file.pread_all(&mut json_buf, 0)?;
+                    // Use the cwd-space path the file was opened at, not the fd's
+                    // realpath: the realpath can sit on another drive letter
+                    // (subst / junction) or outside the project (symlink), and
+                    // relative paths cannot cross drives (#39357). Copied because
+                    // `parent_path_buf` is reused while `json_source` is live.
+                    let json_path_len =
+                        parent_without_trailing_slash.len() + b"/package.json".len();
                     // SAFETY: ROOT_PACKAGE_JSON_PATH_BUF is a process-global only touched on main
                     // thread; `&raw mut` + explicit reborrow avoids the 2024 `static_mut_refs` deny.
-                    let json_path = unsafe {
-                        bun_sys::get_fd_path(
-                            json_file.handle,
-                            &mut *ROOT_PACKAGE_JSON_PATH_BUF.get(),
-                        )?
+                    let json_path: &[u8] = unsafe {
+                        let root_buf = &mut *ROOT_PACKAGE_JSON_PATH_BUF.get();
+                        root_buf[..json_path_len]
+                            .copy_from_slice(&parent_path_buf[..json_path_len]);
+                        &root_buf[..json_path_len]
                     };
                     let json_source =
                         bun_ast::Source::init_path_string(&*json_path, &json_buf[..json_len]);
@@ -1865,11 +1872,14 @@ pub fn init(
         // until now). The slice excludes the NUL — `top_level_dir` is `[]u8`.
         // PathBuffer is repr(transparent) over [u8; N], so the raw cast is sound.
         fs.set_top_level_dir(bun_core::ffi::slice(CWD_BUF.get().cast::<u8>(), tld.len()));
-        // bun_sys exposes the non-Z `get_fd_path`;
-        // append the NUL ourselves so the static `&ZStr` invariant holds.
+        // Build the root package.json path from `top_level_dir` instead of
+        // realpath'ing the fd, so later relative-path computations against
+        // `top_level_dir` never cross onto a different drive letter (#39357).
         let root_buf = &mut *ROOT_PACKAGE_JSON_PATH_BUF.get();
-        let p = bun_sys::get_fd_path(root_package_json_file.handle, root_buf)?;
-        let plen = p.len();
+        let tld_no_slash = strings::without_trailing_slash(tld);
+        let plen = tld_no_slash.len() + SEP_PACKAGE_JSON.len();
+        root_buf[..tld_no_slash.len()].copy_from_slice(tld_no_slash);
+        root_buf[tld_no_slash.len()..plen].copy_from_slice(SEP_PACKAGE_JSON);
         root_buf[plen] = 0;
         ROOT_PACKAGE_JSON_PATH.write(ZStr::from_raw(root_buf.as_ptr(), plen));
     }
@@ -2187,7 +2197,7 @@ pub fn init(
         // make sure folder packages can find the root package without creating a new one
         // Posix-normalize the
         // separators before hashing; `FolderResolution.hash` is always fed `/`-separated
-        // bytes by every resolver-side caller. On Windows `get_fd_path` yields `\`, so
+        // bytes by every resolver-side caller. On Windows this path contains `\`, so
         // hashing the raw bytes would seed a key the resolver never looks up — copy into
         // a stack buffer and convert separators in place.
         // SAFETY: ROOT_PACKAGE_JSON_PATH set above on the main thread.
diff --git a/src/paths/component_iterator.rs b/src/paths/component_iterator.rs
index af82a17de28e..28146304fabc 100644
--- a/src/paths/component_iterator.rs
+++ b/src/paths/component_iterator.rs
@@ -207,15 +207,30 @@ pub fn make_path_with<'a, T: PathChar, E>(
     let Some(mut comp) = it.last() else {
         return Ok(());
     };
+    // A component that reports `NotFound` twice with no `Created` in between
+    // can never succeed (dangling symlink, or Windows OBJECT_NAME_INVALID
+    // surfacing as ENOENT); abort instead of ping-ponging forever (#39357).
+    let mut last_not_found: Option<usize> = None;
     loop {
         match mkdir(comp.path)? {
-            MakePathStep::Created | MakePathStep::Exists => {
+            MakePathStep::Created => {
+                last_not_found = None;
+                comp = match it.next() {
+                    Some(c) => c,
+                    None => return Ok(()),
+                };
+            }
+            MakePathStep::Exists => {
                 comp = match it.next() {
                     Some(c) => c,
                     None => return Ok(()),
                 };
             }
             MakePathStep::NotFound(e) => {
+                if last_not_found == Some(comp.path.len()) {
+                    return Err(e);
+                }
+                last_not_found = Some(comp.path.len());
                 comp = match it.previous() {
                     Some(c) => c,
                     None => return Err(e),
@@ -364,6 +379,45 @@ mod tests {
         assert!(ComponentIterator::<u8>::init(b"\\\\\\x", PathFormat::Windows).is_err());
     }
 
+    #[test]
+    fn make_path_terminates_on_uncreatable_component() {
+        // `x` always reports NotFound while its parent EEXISTs; the walk must
+        // return the error instead of ping-ponging Exists<->NotFound forever.
+        let it = ComponentIterator::init(&b"/t/dangling/x"[..], PathFormat::Posix).unwrap();
+        let mut calls = 0usize;
+        let result = make_path_with(it, |p| {
+            calls += 1;
+            assert!(calls < 100, "make_path_with did not terminate");
+            match p {
+                b"/t" | b"/t/dangling" => Ok(MakePathStep::Exists),
+                b"/t/dangling/x" => Ok(MakePathStep::NotFound("enoent")),
+                _ => panic!("unexpected prefix"),
+            }
+        });
+        assert_eq!(result, Err("enoent"));
+
+        // A NotFound that resolves after the parent is created still succeeds.
+        let it = ComponentIterator::init(&b"/t/a/b"[..], PathFormat::Posix).unwrap();
+        let mut created = std::collections::HashSet::new();
+        let result: Result<(), &str> = make_path_with(it, |p| {
+            if p == b"/t" {
+                return Ok(MakePathStep::Exists);
+            }
+            if created.contains(p) {
+                return Ok(MakePathStep::Exists);
+            }
+            let parent_ok = p == b"/t/a" || created.contains(b"/t/a".as_slice());
+            if parent_ok {
+                created.insert(p);
+                Ok(MakePathStep::Created)
+            } else {
+                Ok(MakePathStep::NotFound("enoent"))
+            }
+        });
+        assert_eq!(result, Ok(()));
+        assert!(created.contains(b"/t/a/b".as_slice()));
+    }
+
     #[test]
     fn back_then_forward() {
         let mut it = ComponentIterator::init(&b"/a/b/c"[..], PathFormat::Posix).unwrap();
diff --git a/test/cli/install/bun-workspaces.test.ts b/test/cli/install/bun-workspaces.test.ts
index 5d20d9c91d64..4a18038f9231 100644
--- a/test/cli/install/bun-workspaces.test.ts
+++ b/test/cli/install/bun-workspaces.test.ts
@@ -1,7 +1,7 @@
 import { file, spawn, write } from "bun";
 import { install_test_helpers } from "bun:internal-for-testing";
 import { afterAll, beforeAll, describe, expect, setDefaultTimeout, test } from "bun:test";
-import { mkdirSync, rmSync, writeFileSync } from "fs";
+import { mkdirSync, rmSync, symlinkSync, writeFileSync } from "fs";
 import { cp, exists, mkdir, rm } from "fs/promises";
 import {
   assertManifestsPopulated,
@@ -3227,3 +3227,111 @@ describe("links of a renamed or removed workspace", () => {
     expect(await entries(rootNodeModules)).toEqual(["a-renamed", "b"]);
   });
 });
+
+// #39357: `bun install` must identify the project root by the path it was
+// invoked through. It used to realpath the root package.json fd, so workspace
+// discovery and lockfile keys were computed against a different root than
+// `top_level_dir` (the cwd). On Windows a subst drive or cross-drive junction
+// put the two roots on different drive letters, where no relative path exists:
+// the hoisted linker wrote machine-absolute workspace keys into bun.lock and
+// the isolated linker looped forever. On POSIX a symlinked root package.json
+// made workspace discovery run in the symlink target's directory.
+describe("aliased project root", () => {
+  test.concurrent.skipIf(isWindows)("workspaces install when the root package.json is a symlink", async () => {
+    using ctx = await setupTest();
+    const { packageDir, env } = ctx;
+    await Promise.all([
+      write(
+        join(packageDir, "real", "package.json"),
+        JSON.stringify({
+          name: "ws-root",
+          private: true,
+          workspaces: ["packages/*"],
+          devDependencies: { "pkg-a": "workspace:*" },
+        }),
+      ),
+      write(
+        join(packageDir, "ws", "packages", "a", "package.json"),
+        JSON.stringify({ name: "pkg-a", version: "1.0.0" }),
+      ),
+    ]);
+    symlinkSync(join("..", "real", "package.json"), join(packageDir, "ws", "package.json"));
+
+    await using proc = Bun.spawn({
+      cmd: [bunExe(), "install"],
+      cwd: join(packageDir, "ws"),
+      env,
+      stdout: "pipe",
+      stderr: "pipe",
+    });
+    const [stdout, stderr, exitCode] = await Promise.all([proc.stdout.text(), proc.stderr.text(), proc.exited]);
+    expect(stderr).not.toContain("error:");
+    expect(stdout).not.toContain("No packages!");
+    expect(exitCode).toBe(0);
+
+    const lockfile = await file(join(packageDir, "ws", "bun.lock")).text();
+    expect(lockfile).toContain('"packages/a"');
+    expect(lockfile).not.toContain("real/packages");
+    expect(await exists(join(packageDir, "ws", "node_modules", "pkg-a", "package.json"))).toBe(true);
+  });
+
+  test.skipIf(!isWindows)("workspaces install when cwd is a subst drive for the project's real path", async () => {
+    using ctx = await setupTest();
+    const { packageDir, env } = ctx;
+    await Promise.all([
+      write(
+        join(packageDir, "ws", "package.json"),
+        JSON.stringify({
+          name: "ws-root",
+          private: true,
+          workspaces: ["packages/*"],
+          devDependencies: { "pkg-a": "workspace:*" },
+        }),
+      ),
+      write(
+        join(packageDir, "ws", "packages", "a", "package.json"),
+        JSON.stringify({ name: "pkg-a", version: "1.0.0" }),
+      ),
+    ]);
+
+    // Map a free drive letter onto packageDir so the cwd's drive letter
+    // differs from the files' physical drive.
+    let drive: string | undefined;
+    for (const letter of "ZYXWVUTSRQONMLKJIHGFE") {
+      const { exitCode } = Bun.spawnSync({ cmd: ["cmd", "/c", "subst", `${letter}:`, packageDir], env });
+      if (exitCode === 0) {
+        drive = letter;
+        break;
+      }
+    }
+    if (!drive) throw new Error("no free drive letter available for subst");
+
+    try {
+      for (const linker of ["hoisted", "isolated"]) {
+        rmSync(join(packageDir, "ws", "node_modules"), { recursive: true, force: true });
+        rmSync(join(packageDir, "ws", "bun.lock"), { force: true });
+
+        await using proc = Bun.spawn({
+          cmd: [bunExe(), "install", `--linker=${linker}`],
+          cwd: `${drive}:\\ws`,
+          env,
+          stdout: "pipe",
+          stderr: "pipe",
+          // the unfixed isolated linker spins forever; kill instead of hanging the runner
+          timeout: 120_000,
+        });
+        const [stdout, stderr, exitCode] = await Promise.all([proc.stdout.text(), proc.stderr.text(), proc.exited]);
+        expect({ linker, stderr }).toEqual({ linker, stderr: expect.not.stringContaining("error:") });
+        expect({ linker, exitCode }).toEqual({ linker, exitCode: 0 });
+
+        const lockfile = await file(join(packageDir, "ws", "bun.lock")).text();
+        // workspace keys must stay relative, never the machine-absolute realpath
+        expect(lockfile).toContain('"packages/a"');
+        expect(lockfile).not.toContain(packageDir.replaceAll("\\", "/"));
+        expect(await exists(join(packageDir, "ws", "node_modules", "pkg-a", "package.json"))).toBe(true);
+      }
+    } finally {
+      Bun.spawnSync({ cmd: ["cmd", "/c", "subst", `${drive}:`, "/d"], env });
+    }
+  });
+});

From 42790a51a09b960f254466a04f800a374f229c8b Mon Sep 17 00:00:00 2001
From: Jarred Sumner <jarred@jarredsumner.com>
Date: Mon, 17 Aug 2026 01:32:27 +0000
Subject: [PATCH 111/258] mega-merge fixup: drop duplicate definitions from
 add/add merges (get_parent_pkg_of_dependency, is_local_package,
 EscapeControlChars)

---
 src/bun_core/fmt.rs       | 189 --------------------------------------
 src/install/lockfile.rs   |  38 +-------
 src/install/resolution.rs |  10 --
 3 files changed, 3 insertions(+), 234 deletions(-)

diff --git a/src/bun_core/fmt.rs b/src/bun_core/fmt.rs
index dcfa243435bb..bbb8330e2761 100644
--- a/src/bun_core/fmt.rs
+++ b/src/bun_core/fmt.rs
@@ -3410,195 +3410,6 @@ impl fmt::Write for EscapeControlCharsWriter<'_, '_> {
     }
 }
 
-// ───────────────────────────────────────────────────────────────────────────
-// escapeControlChars
-// ───────────────────────────────────────────────────────────────────────────
-
-/// `Display` adapter that spells out C0 controls, DEL and C1 controls
-/// (`\n`, `\x1b`, `\x7f`, `\u009b`, ...) so text authored by a dependency
-/// cannot erase, repaint or forge lines of terminal output when printed.
-pub struct EscapeControlChars<T>(pub T);
-
-/// [`EscapeControlChars`] over raw bytes; invalid UTF-8 renders as U+FFFD.
-pub fn escape_control_chars(text: &[u8]) -> EscapeControlChars<&bstr::BStr> {
-    EscapeControlChars(bstr::BStr::new(text))
-}
-
-impl<T: Display> Display for EscapeControlChars<T> {
-    fn fmt(&self, f: &mut Formatter<'_>) -> fmt::Result {
-        let mut writer = EscapeControlCharsWriter(f);
-        write!(writer, "{}", self.0)
-    }
-}
-
-struct EscapeControlCharsWriter<'a, 'f>(&'a mut Formatter<'f>);
-
-impl fmt::Write for EscapeControlCharsWriter<'_, '_> {
-    fn write_str(&mut self, s: &str) -> fmt::Result {
-        let mut start = 0;
-        for (i, c) in s.char_indices() {
-            if !matches!(c, '\0'..='\x1f' | '\x7f' | '\u{80}'..='\u{9f}') {
-                continue;
-            }
-            self.0.write_str(&s[start..i])?;
-            match c {
-                '\n' => self.0.write_str("\\n")?,
-                '\r' => self.0.write_str("\\r")?,
-                '\t' => self.0.write_str("\\t")?,
-                c if c.is_ascii() => write!(self.0, "\\x{:02x}", c as u32)?,
-                c => write!(self.0, "\\u{:04x}", c as u32)?,
-            }
-            start = i + c.len_utf8();
-        }
-        self.0.write_str(&s[start..])
-    }
-}
-
-// ───────────────────────────────────────────────────────────────────────────
-// escapeControlChars
-// ───────────────────────────────────────────────────────────────────────────
-
-/// Renders the wrapped `Display` with C0 controls, DEL and C1 controls spelled
-/// out (`\n`, `\x1b`, `\x7f`, `\u009b`) instead of written raw, for text a
-/// registry or a package authored; everything else passes through unchanged.
-pub struct EscapeControlChars<T>(pub T);
-
-/// [`EscapeControlChars`] over raw bytes; invalid UTF-8 renders as U+FFFD.
-pub fn escape_control_chars(text: &[u8]) -> EscapeControlChars<&bstr::BStr> {
-    EscapeControlChars(bstr::BStr::new(text))
-}
-
-impl<T: Display> Display for EscapeControlChars<T> {
-    fn fmt(&self, f: &mut Formatter<'_>) -> fmt::Result {
-        let mut writer = EscapeControlCharsWriter(f);
-        write!(writer, "{}", self.0)
-    }
-}
-
-struct EscapeControlCharsWriter<'a, 'f>(&'a mut Formatter<'f>);
-
-impl fmt::Write for EscapeControlCharsWriter<'_, '_> {
-    fn write_str(&mut self, s: &str) -> fmt::Result {
-        let mut start = 0;
-        for (i, c) in s.char_indices() {
-            if !matches!(c, '\0'..='\x1f' | '\x7f' | '\u{80}'..='\u{9f}') {
-                continue;
-            }
-            self.0.write_str(&s[start..i])?;
-            match c {
-                '\n' => self.0.write_str("\\n")?,
-                '\r' => self.0.write_str("\\r")?,
-                '\t' => self.0.write_str("\\t")?,
-                c if c.is_ascii() => write!(self.0, "\\x{:02x}", c as u32)?,
-                c => write!(self.0, "\\u{:04x}", c as u32)?,
-            }
-            start = i + c.len_utf8();
-        }
-        self.0.write_str(&s[start..])
-    }
-}
-
-// ───────────────────────────────────────────────────────────────────────────
-// escapeControlChars
-// ───────────────────────────────────────────────────────────────────────────
-
-/// `Display` adapter that spells out C0 controls, DEL and C1 controls
-/// (`\n`, `\x1b`, `\x7f`, `\u009b`, ...) so text authored by a dependency
-/// cannot erase, repaint or forge lines of terminal output when printed.
-pub struct EscapeControlChars<T>(pub T);
-
-/// [`EscapeControlChars`] over raw bytes; invalid UTF-8 renders as U+FFFD.
-pub fn escape_control_chars(text: &[u8]) -> EscapeControlChars<&bstr::BStr> {
-    EscapeControlChars(bstr::BStr::new(text))
-}
-
-impl<T: Display> Display for EscapeControlChars<T> {
-    fn fmt(&self, f: &mut Formatter<'_>) -> fmt::Result {
-        let mut writer = EscapeControlCharsWriter(f);
-        write!(writer, "{}", self.0)
-    }
-}
-
-struct EscapeControlCharsWriter<'a, 'f>(&'a mut Formatter<'f>);
-
-impl fmt::Write for EscapeControlCharsWriter<'_, '_> {
-    fn write_str(&mut self, s: &str) -> fmt::Result {
-        let mut start = 0;
-        for (i, c) in s.char_indices() {
-            if !matches!(c, '\0'..='\x1f' | '\x7f' | '\u{80}'..='\u{9f}') {
-                continue;
-            }
-            self.0.write_str(&s[start..i])?;
-            match c {
-                '\n' => self.0.write_str("\\n")?,
-                '\r' => self.0.write_str("\\r")?,
-                '\t' => self.0.write_str("\\t")?,
-                c if c.is_ascii() => write!(self.0, "\\x{:02x}", c as u32)?,
-                c => write!(self.0, "\\u{:04x}", c as u32)?,
-            }
-            start = i + c.len_utf8();
-        }
-        self.0.write_str(&s[start..])
-    }
-}
-
-// ───────────────────────────────────────────────────────────────────────────
-// escapeControlChars
-// ───────────────────────────────────────────────────────────────────────────
-
-/// `Display` adapter that spells out C0 controls, DEL and C1 controls
-/// (`\n`, `\x1b`, `\x7f`, `\u009b`, ...) so text authored by a dependency
-/// cannot erase, repaint or forge lines of terminal output when printed.
-pub struct EscapeControlChars<T>(pub T);
-
-/// [`EscapeControlChars`] over raw bytes; invalid UTF-8 renders as U+FFFD.
-pub fn escape_control_chars(text: &[u8]) -> EscapeControlChars<&bstr::BStr> {
-    EscapeControlChars(bstr::BStr::new(text))
-}
-
-impl<T: Display> Display for EscapeControlChars<T> {
-    fn fmt(&self, f: &mut Formatter<'_>) -> fmt::Result {
-        let mut writer = EscapeControlCharsWriter(f);
-        write!(writer, "{}", self.0)
-    }
-}
-
-struct EscapeControlCharsWriter<'a, 'f>(&'a mut Formatter<'f>);
-
-impl fmt::Write for EscapeControlCharsWriter<'_, '_> {
-    fn write_str(&mut self, s: &str) -> fmt::Result {
-        let bytes = s.as_bytes();
-        let mut start = 0;
-        let mut cursor = 0;
-        // `\` doubles as the quote char so the scan stops at nothing else extra.
-        while let Some(offset) =
-            strings::index_of_needs_escape_for_java_script_string(&bytes[cursor..], b'\\')
-        {
-            let i = cursor + offset as usize;
-            let (code_point, len) = match bytes[i] {
-                byte @ (0x00..=0x1F | 0x7F) => (byte as u32, 1),
-                0xC2 if matches!(bytes.get(i + 1), Some(0x80..=0x9F)) => (bytes[i + 1] as u32, 2),
-                byte => {
-                    let char_len = strings::wtf8_byte_sequence_length(byte) as usize;
-                    cursor = (i + char_len).min(bytes.len());
-                    continue;
-                }
-            };
-            self.0.write_str(&s[start..i])?;
-            match code_point {
-                0x0A => self.0.write_str("\\n")?,
-                0x0D => self.0.write_str("\\r")?,
-                0x09 => self.0.write_str("\\t")?,
-                0x00..=0x7F => write!(self.0, "\\x{:02x}", code_point)?,
-                _ => write!(self.0, "\\u{:04x}", code_point)?,
-            }
-            start = i + len;
-            cursor = start;
-        }
-        self.0.write_str(&s[start..])
-    }
-}
-
 // js_bindings (fmtString for highlighter.test.ts) lives in src/jsc/fmt_jsc.rs
 // alongside fmt_jsc.bind.ts; bun_core/ stays JSC-free.
 
diff --git a/src/install/lockfile.rs b/src/install/lockfile.rs
index c7d35d4fab0a..c64ea9d912a2 100644
--- a/src/install/lockfile.rs
+++ b/src/install/lockfile.rs
@@ -911,16 +911,6 @@ impl Lockfile {
         None
     }
 
-    /// `None` for the edges `enqueue_dependency_to_root` appends outside of any package.
-    pub(crate) fn get_parent_pkg_of_dependency(&self, id: DependencyID) -> Option<PackageID> {
-        for (pkg_id, dependencies) in self.packages.items_dependencies().iter().enumerate() {
-            if dependencies.contains(id) {
-                return Some(PackageID::try_from(pkg_id).expect("int cast"));
-            }
-        }
-        None
-    }
-
     /// Does the root package.json declare the same dependency (name and specifier) itself?
     pub(crate) fn has_equal_root_dependency(&self, dependency: &Dependency) -> bool {
         let buf = self.buffers.string_bytes.as_slice();
@@ -930,16 +920,6 @@ impl Lockfile {
             .any(|root_dependency| root_dependency.eql(dependency, buf, buf))
     }
 
-    /// `None` for the edges `enqueue_dependency_to_root` appends outside of any package.
-    pub(crate) fn get_parent_pkg_of_dependency(&self, id: DependencyID) -> Option<PackageID> {
-        for (pkg_id, dependencies) in self.packages.items_dependencies().iter().enumerate() {
-            if dependencies.contains(id) {
-                return Some(PackageID::try_from(pkg_id).expect("int cast"));
-            }
-        }
-        None
-    }
-
     pub(crate) fn get_workspace_pkg_if_workspace_dep(&self, id: DependencyID) -> PackageID {
         let packages = self.packages.slice();
         let resolutions = packages.items_resolution();
@@ -960,29 +940,17 @@ impl Lockfile {
         invalid_package_id
     }
 
-    /// The package whose dependency list contains `id`, or `invalid_package_id` when
-    /// no package declares it.
-    pub(crate) fn get_parent_pkg_of_dependency(&self, id: DependencyID) -> PackageID {
-        self.packages
-            .items_dependencies()
-            .iter()
-            .position(|dependencies| dependencies.contains(id))
-            .map_or(invalid_package_id, |pkg_id| {
-                PackageID::try_from(pkg_id).expect("int cast")
-            })
-    }
-
     /// Is this a direct dependency of a local package (`resolution::Tag::is_local_package`)?
     ///
     /// A folder package declared by a registry package gets no dependency list (see the
     /// Folder arm of `get_or_put_resolved_package`), so every folder package that
     /// declares anything is reached from the root through local packages only.
     pub(crate) fn is_dependency_of_local_package(&self, id: DependencyID) -> bool {
-        let parent_id = self.get_parent_pkg_of_dependency(id);
-        parent_id != invalid_package_id
-            && self.packages.items_resolution()[parent_id as usize]
+        self.get_parent_pkg_of_dependency(id).is_some_and(|parent_id| {
+            self.packages.items_resolution()[parent_id as usize]
                 .tag
                 .is_local_package()
+        })
     }
 
     /// Does this tree id belong to a workspace (including workspace root)?
diff --git a/src/install/resolution.rs b/src/install/resolution.rs
index 20b46cd37a89..bd665fdd674c 100644
--- a/src/install/resolution.rs
+++ b/src/install/resolution.rs
@@ -1021,16 +1021,6 @@ impl Tag {
         self == Tag::Root || self == Tag::Workspace || self == Tag::Folder
     }
 
-    /// The package.json is read from the project rather than extracted into the cache.
-    pub(crate) fn is_local_package(self) -> bool {
-        self == Tag::Root || self == Tag::Workspace || self == Tag::Folder
-    }
-
-    /// The package.json is read from the project rather than extracted into the cache.
-    pub(crate) fn is_local_package(self) -> bool {
-        self == Tag::Root || self == Tag::Workspace || self == Tag::Folder
-    }
-
     pub(crate) fn can_enqueue_install_task(self) -> bool {
         self == Tag::Npm
             || self == Tag::LocalTarball

From 9341d22552bfda8346ed8bd77bba760b7491a424 Mon Sep 17 00:00:00 2001
From: robobun <117481402+robobun@users.noreply.github.com>
Date: Mon, 17 Aug 2026 01:33:27 +0000
Subject: [PATCH 112/258] install: keep bundled peer edges on their own
 bun.lock entry when loading (#38837)

---
 src/install/lockfile/bun.lock.rs  | 11 ++++++----
 test/cli/install/bun-lock.test.ts | 34 +++++++++++++++++++++++++++++++
 2 files changed, 41 insertions(+), 4 deletions(-)

diff --git a/src/install/lockfile/bun.lock.rs b/src/install/lockfile/bun.lock.rs
index aaececb7c727..7c5e868f498b 100644
--- a/src/install/lockfile/bun.lock.rs
+++ b/src/install/lockfile/bun.lock.rs
@@ -3373,15 +3373,18 @@ pub(crate) fn parse_into_binary_lockfile(
 }
 
 /// The catalog-resolved range of a peer edge the fresh resolver binds by
-/// version in its `install_peer` pass. Optional peers are bound to the
-/// hoisted-tree sibling by `process_subtree` instead, which is what the path
-/// walk reproduces.
+/// version in its `install_peer` pass. Two exemptions keep the printed tree's
+/// path walk, which reproduces their saved binding exactly: optional peers are
+/// bound to the hoisted-tree sibling by `process_subtree` instead, and a bundled
+/// peer is always placed under its own package by `process_subtree`, so its
+/// entry is always printed and, like every other bundled edge (`bun update` and
+/// dedupe hold them in place too), it stays on the version recorded there.
 fn deferred_peer_range<'a>(
     dep: &'a Dependency,
     catalogs: &'a CatalogMap,
     string_buf: &[u8],
 ) -> Option<&'a DependencyVersion> {
-    if !dep.behavior.is_peer() || dep.behavior.is_optional_peer() {
+    if !dep.behavior.is_peer() || dep.behavior.is_optional_peer() || dep.behavior.is_bundled() {
         return None;
     }
     Some(catalogs.resolve_range(string_buf, dep))
diff --git a/test/cli/install/bun-lock.test.ts b/test/cli/install/bun-lock.test.ts
index 00347709004e..5b62298ba891 100644
--- a/test/cli/install/bun-lock.test.ts
+++ b/test/cli/install/bun-lock.test.ts
@@ -2859,3 +2859,37 @@ describe.concurrent("re-resolving file: dependencies declared by a file: package
     await run(["install", "--frozen-lockfile"]);
   });
 });
+
+it("re-saving bun.lock keeps a bundled peer on the version its own entry records", async () => {
+  const { packageDir, packageJson } = await registry.createTestDir({ bunfigOpts: { saveTextLockfile: true } });
+  const run = makeInstallRunner(packageDir);
+
+  const dependencies = { "no-deps": "1.1.0", "peer-deps-fixed": "1.0.0" };
+  await write(packageJson, JSON.stringify({ name: "foo", dependencies }));
+
+  // peer-deps-fixed's peer on no-deps (^1.0.0) has a bundled entry of its own,
+  // the shape bundled subtrees have in existing lockfiles (for example
+  // @napi-rs/wasm-runtime's peer on @emnapi/core inside
+  // @tailwindcss/oxide-wasm32-wasi). It stays on the no-deps@1.0.0 recorded
+  // there even though the root has since moved on to no-deps@1.1.0, which the
+  // range would also accept. Without a configVersion the install re-saves the
+  // file, as it does for every lockfile written before configVersion existed.
+  await write(
+    join(packageDir, "bun.lock"),
+    JSON.stringify({
+      lockfileVersion: 1,
+      workspaces: { "": { name: "foo", dependencies } },
+      packages: {
+        "no-deps": ["no-deps@1.1.0", "", {}, ""],
+        "peer-deps-fixed": ["peer-deps-fixed@1.0.0", "", { peerDependencies: { "no-deps": "^1.0.0" } }, ""],
+        "peer-deps-fixed/no-deps": ["no-deps@1.0.0", "", { bundled: true }, ""],
+      },
+    }),
+  );
+
+  await run(["install"]);
+  const lockfile = await file(join(packageDir, "bun.lock")).text();
+  expect(lockfile).toContain('"configVersion": 0,');
+  expect(lockfile).toContain('"no-deps": ["no-deps@1.1.0", ');
+  expect(lockfile).toContain('"peer-deps-fixed/no-deps": ["no-deps@1.0.0", ');
+});

From 85ddaf3dc545fab73b57f5245c54eb11c42e2825 Mon Sep 17 00:00:00 2001
From: robobun <117481402+robobun@users.noreply.github.com>
Date: Mon, 17 Aug 2026 01:34:54 +0000
Subject: [PATCH 113/258] install: keep bundleDependencies from every
 dependency group when parsing a registry manifest (#38857)

---
 src/install/npm.rs                            | 127 ++++++-----------
 test/cli/install/bun-install-registry.test.ts | 133 ++++++++++++++++++
 .../bundled-peer/bundled-peer-1.0.0.tgz       | Bin 0 -> 283 bytes
 .../packages/bundled-peer/package.json        |  44 ++++++
 .../bundled-with-optional-1.0.0.tgz           | Bin 0 -> 364 bytes
 .../bundled-with-optional/package.json        |  50 +++++++
 6 files changed, 273 insertions(+), 81 deletions(-)
 create mode 100644 test/cli/install/registry/packages/bundled-peer/bundled-peer-1.0.0.tgz
 create mode 100644 test/cli/install/registry/packages/bundled-peer/package.json
 create mode 100644 test/cli/install/registry/packages/bundled-with-optional/bundled-with-optional-1.0.0.tgz
 create mode 100644 test/cli/install/registry/packages/bundled-with-optional/package.json

diff --git a/src/install/npm.rs b/src/install/npm.rs
index 2967296e2834..04320ef2965f 100644
--- a/src/install/npm.rs
+++ b/src/install/npm.rs
@@ -5,7 +5,7 @@ use crate::Error;
 use crate::bun_json as JSON;
 use crate::bun_schema::api;
 use bun_alloc::AllocError;
-use bun_collections::{HashMap, IdentityContext, StringSet};
+use bun_collections::{HashMap, IdentityContext};
 use bun_core::{Global, Output, fmt as bun_fmt};
 use bun_core::{MutableString, strings};
 use bun_dotenv::Loader as DotEnv;
@@ -944,8 +944,9 @@ pub mod package_manifest {
         // - v0.0.5: added bundled dependencies
         // - v0.0.6: changed semver major/minor/patch to each use u64 instead of u32
         // - v0.0.7: added version publish times and extended manifest flag for minimum release age
+        // - v0.0.8: fixed bundled dependencies being dropped from all but one dependency group
         const HEADER_BYTES: &'static str =
-            concat!("#!/usr/bin/env bun\n", "bun-npm-manifest-cache-v0.0.7\n");
+            concat!("#!/usr/bin/env bun\n", "bun-npm-manifest-cache-v0.0.8\n");
 
         // Field order is hardcoded (descending alignment). Re-verify if the
         // layout changes.
@@ -2071,35 +2072,6 @@ impl PackageManifest {
     }
 }
 
-/// Fills `set` with the names listed in `bundle(d)Dependencies`; returns whether it was `true` (bundle everything).
-fn collect_bundled_deps(
-    version_obj: Option<&JSON::E::ObjectJSON>,
-    set: &mut StringSet,
-) -> Result<bool, AllocError> {
-    set.map.clear_retaining_capacity();
-    let mut bundle_all_deps = false;
-    if let Some(bundled_deps_value) = version_obj
-        .and_then(|o| o.get(b"bundleDependencies"))
-        .or_else(|| version_obj.and_then(|o| o.get(b"bundledDependencies")))
-    {
-        match bundled_deps_value {
-            JSON::E::JsonValue::Boolean(boolean) => {
-                bundle_all_deps = *boolean;
-            }
-            JSON::E::JsonValue::Array(arr) => {
-                for bundled_dep in arr.get().items() {
-                    let Some(s) = bundled_dep.as_str() else {
-                        continue;
-                    };
-                    set.insert(s)?;
-                }
-            }
-            _ => {}
-        }
-    }
-    Ok(bundle_all_deps)
-}
-
 // Keys are pre-hashed string hashes, so don't re-hash them.
 type ExternalStringMapDeduper = HashMap<u64, ExternalStringList, IdentityContext<u64>>;
 
@@ -2111,6 +2083,16 @@ const DEPENDENCY_GROUPS: [DependencyGroup; 3] = [
     DependencyGroup::PEER,
 ];
 
+/// npm accepts both spellings; `bundleDependencies` is the documented one.
+fn bundled_dependencies_field(
+    version_obj: Option<&JSON::E::ObjectJSON>,
+) -> Option<&JSON::E::JsonValue> {
+    let version_obj = version_obj?;
+    version_obj
+        .get(b"bundleDependencies")
+        .or_else(|| version_obj.get(b"bundledDependencies"))
+}
+
 impl PackageManifest {
     /// This parses [Abbreviated metadata](https://github.com/npm/registry/blob/master/docs/responses/package-metadata.md#abbreviated-metadata-format)
     pub fn parse(
@@ -2164,9 +2146,6 @@ impl PackageManifest {
         let mut version_extern_strings_dedupe_map = ExternalStringMapDeduper::default();
         let mut optional_peer_dep_names: Vec<u64> = Vec::new();
 
-        let mut bundled_deps_set = StringSet::init();
-        let mut bundle_all_deps: bool;
-
         let mut bundled_deps_count: usize = 0;
 
         let mut string_builder = Semver::semver_string::Builder {
@@ -2299,7 +2278,16 @@ impl PackageManifest {
                     }
                 }
 
-                bundle_all_deps = collect_bundled_deps(version_obj, &mut bundled_deps_set)?;
+                if let Some(JSON::E::JsonValue::Array(arr)) =
+                    bundled_dependencies_field(version_obj)
+                {
+                    bundled_deps_count += arr
+                        .get()
+                        .items()
+                        .iter()
+                        .filter(|bundled_dep| bundled_dep.as_str().is_some())
+                        .count();
+                }
 
                 for pair in &DEPENDENCY_GROUPS {
                     if let Some(obj) = version_obj
@@ -2310,11 +2298,6 @@ impl PackageManifest {
                         dependency_sum += properties.len();
                         for property in properties {
                             let key = property.key.slice();
-                            if !bundle_all_deps && bundled_deps_set.swap_remove(key) {
-                                // swap remove the dependency name because it could exist in
-                                // multiple behavior groups.
-                                bundled_deps_count += 1;
-                            }
                             string_builder.count(key);
                             string_builder.count(property.value.as_str().unwrap_or(b""));
                         }
@@ -2503,10 +2486,30 @@ impl PackageManifest {
 
                 let version_obj = prop.value.as_object();
 
-                bundle_all_deps = collect_bundled_deps(version_obj, &mut bundled_deps_set)?;
-
                 let mut package_version: PackageVersion = empty_version;
 
+                // `Package::from_npm` matches these against the dependencies of every group.
+                package_version.bundled_dependencies = match bundled_dependencies_field(version_obj)
+                {
+                    Some(JSON::E::JsonValue::Boolean(true)) => ExternalPackageNameHashList::INVALID,
+                    Some(JSON::E::JsonValue::Array(arr)) => {
+                        let bundled_deps_begin = bundled_deps_offset;
+                        for bundled_dep in arr.get().items() {
+                            let Some(name) = bundled_dep.as_str() else {
+                                continue;
+                            };
+                            bundled_deps_buf[bundled_deps_offset] =
+                                Semver::semver_string::Builder::string_hash(name);
+                            bundled_deps_offset += 1;
+                        }
+                        ExternalPackageNameHashList::init(
+                            &bundled_deps_buf,
+                            &bundled_deps_buf[bundled_deps_begin..bundled_deps_offset],
+                        )
+                    }
+                    _ => ExternalPackageNameHashList::default(),
+                };
+
                 if let Some(cpu) = version_obj.and_then(|o| o.get(b"cpu")) {
                     package_version.cpu = negatable_from_json_value::<Architecture>(cpu);
                 }
@@ -2728,13 +2731,7 @@ impl PackageManifest {
                     // For peer deps, fall through with an empty `items`
                     // slice when `peerDependencies` is absent so that
                     // `peerDependenciesMeta`-only entries (synthesised
-                    // below) still get a build pass. The fallthrough must
-                    // stay scoped to packages that actually have a
-                    // `peerDependenciesMeta`: the body sets
-                    // `package_version.bundled_dependencies` from this
-                    // iteration's slice of `bundled_deps_buf`, so an
-                    // unconditional empty pass would clobber the value the
-                    // `dependencies` iteration just produced.
+                    // below) still get a build pass.
                     let items: &[JSON::E::PropertyJSON] = version_obj
                         .and_then(|o| o.get(pair.prop))
                         .and_then(|deps| deps.as_object())
@@ -2783,8 +2780,6 @@ impl PackageManifest {
                             }
                         }
 
-                        let bundled_deps_begin = bundled_deps_offset;
-
                         let mut i: usize = 0;
 
                         for item in items {
@@ -2805,15 +2800,6 @@ impl PackageManifest {
                             version_extern_strings[values_base + i] =
                                 string_builder.append::<ExternalString>(version_str);
 
-                            if !bundle_all_deps && bundled_deps_set.swap_remove(name_str) {
-                                // SAFETY: bundled_deps_buf sized in counting pass
-                                unsafe {
-                                    *bundled_deps_buf.as_mut_ptr().add(bundled_deps_offset) =
-                                        all_extern_strings[names_base + i].hash;
-                                }
-                                bundled_deps_offset += 1;
-                            }
-
                             if is_peer {
                                 if optional_peer_dep_names
                                     .iter()
@@ -2913,27 +2899,6 @@ impl PackageManifest {
                         let this_versions =
                             &version_extern_strings[values_base..values_base + count];
 
-                        // Bundled deps are matched against the
-                        // `dependencies`/`optionalDependencies` groups
-                        // only; the peer pass never adds to
-                        // `bundled_deps_buf`. With the meta-only
-                        // synthesis above the peer body now runs even
-                        // when `peerDependencies` is absent, so writing
-                        // here would clobber the value the dependencies
-                        // pass already produced with an empty slice.
-                        if !is_peer {
-                            if bundle_all_deps {
-                                package_version.bundled_dependencies =
-                                    ExternalPackageNameHashList::INVALID;
-                            } else {
-                                package_version.bundled_dependencies =
-                                    ExternalPackageNameHashList::init(
-                                        &bundled_deps_buf,
-                                        &bundled_deps_buf[bundled_deps_begin..bundled_deps_offset],
-                                    );
-                            }
-                        }
-
                         let mut name_list =
                             ExternalStringList::init(&all_extern_strings, this_names);
                         let mut version_list =
diff --git a/test/cli/install/bun-install-registry.test.ts b/test/cli/install/bun-install-registry.test.ts
index 8b6927087b82..8b670fba6490 100644
--- a/test/cli/install/bun-install-registry.test.ts
+++ b/test/cli/install/bun-install-registry.test.ts
@@ -1233,6 +1233,139 @@ describe("bundledDependencies", () => {
       await check();
     });
 
+    test(`(${textLockfile ? "bun.lock" : "bun.lockb"}) bundled names from dependencies and optionalDependencies`, async () => {
+      // bundled-with-optional@1.0.0 has dependencies { no-deps }, optionalDependencies { a-dep, basic-1 }
+      // and bundleDependencies [no-deps, a-dep, not-a-dependency]. Its tarball ships no-deps and a-dep.
+      // Only basic-1 should be installed from the registry; not-a-dependency is declared in no group
+      // (and does not exist in the registry), so listing it must have no effect.
+      await write(
+        packageJson,
+        JSON.stringify({
+          name: "bundled-mixed-groups",
+          dependencies: {
+            "bundled-with-optional": "1.0.0",
+          },
+        }),
+      );
+
+      await runBunInstall(env, packageDir, { saveTextLockfile: textLockfile });
+
+      async function check() {
+        expect(await readdirSorted(join(packageDir, "node_modules"))).toEqual(["basic-1", "bundled-with-optional"]);
+        const bundledNodeModules = join(packageDir, "node_modules", "bundled-with-optional", "node_modules");
+        expect(
+          await Promise.all([
+            file(join(bundledNodeModules, "no-deps", "package.json")).json(),
+            file(join(bundledNodeModules, "a-dep", "package.json")).json(),
+          ]),
+        ).toEqual([
+          { name: "no-deps", version: "1.0.0" },
+          { name: "a-dep", version: "1.0.1" },
+        ]);
+      }
+
+      await check();
+
+      let lockfile: string | undefined;
+      if (textLockfile) {
+        lockfile = await file(join(packageDir, "bun.lock")).text();
+        expect(lockfile.replaceAll(/localhost:\d+/g, "localhost:1234")).toMatchInlineSnapshot(`
+          "{
+            "lockfileVersion": 2,
+            "configVersion": 1,
+            "workspaces": {
+              "": {
+                "name": "bundled-mixed-groups",
+                "dependencies": {
+                  "bundled-with-optional": "1.0.0",
+                },
+              },
+            },
+            "packages": {
+              "basic-1": ["basic-1@1.0.0", "http://localhost:1234/basic-1/-/basic-1-1.0.0.tgz", {}, "sha512-NW5qBU1Kn7DzCjfVfnAbBBRGuQ7krbBtrnezZwOXutA9NvrCT4SI4EJMog3AGsNeK/1OygErysF8RN/FqDYunA=="],
+
+              "bundled-with-optional": ["bundled-with-optional@1.0.0", "http://localhost:1234/bundled-with-optional/-/bundled-with-optional-1.0.0.tgz", { "dependencies": { "no-deps": "1.0.0" }, "optionalDependencies": { "a-dep": "1.0.1", "basic-1": "1.0.0" } }, "sha512-rq4Jtdsk53QE4T00/KaOP5lyv3d8Gnt4VABtara3PFos+8POKMkRIQPYCXVRRBey7K+ttzkiA5MkHhe+T19eYA=="],
+
+              "bundled-with-optional/a-dep": ["a-dep@1.0.1", "http://localhost:1234/a-dep/-/a-dep-1.0.1.tgz", { "bundled": true }, "sha512-6nmTaPgO2U/uOODqOhbjbnaB4xHuZ+UB7AjKUA3g2dT4WRWeNxgp0dC8Db4swXSnO5/uLLUdFmUJKINNBO/3wg=="],
+
+              "bundled-with-optional/no-deps": ["no-deps@1.0.0", "http://localhost:1234/no-deps/-/no-deps-1.0.0.tgz", { "bundled": true }, "sha512-v4w12JRjUGvfHDUP8vFDwu0gUWu04j0cv9hLb1Abf9VdaXu4XcrddYFTMVBVvmldKViGWH7jrb6xPJRF0wq6gw=="],
+            }
+          }
+          "
+        `);
+      }
+
+      // The lockfile must record the bundled edges too: a cold install from it
+      // must not pull no-deps or a-dep from the registry either.
+      await rm(join(packageDir, "node_modules"), { recursive: true, force: true });
+      await runBunInstall(env, packageDir, { frozenLockfile: true });
+
+      await check();
+      if (textLockfile) {
+        expect(await file(join(packageDir, "bun.lock")).text()).toBe(lockfile!);
+      }
+    });
+
+    test(`(${textLockfile ? "bun.lock" : "bun.lockb"}) bundled name declared in peerDependencies`, async () => {
+      // bundled-peer@1.0.0 has peerDependencies { no-deps } and bundleDependencies [no-deps], and its
+      // tarball ships no-deps. The peer is satisfied by the bundled copy, so nothing else is installed.
+      await write(
+        packageJson,
+        JSON.stringify({
+          name: "bundled-peer-root",
+          dependencies: {
+            "bundled-peer": "1.0.0",
+          },
+        }),
+      );
+
+      await runBunInstall(env, packageDir, { saveTextLockfile: textLockfile });
+
+      async function check() {
+        expect(await readdirSorted(join(packageDir, "node_modules"))).toEqual(["bundled-peer"]);
+        expect(
+          await file(
+            join(packageDir, "node_modules", "bundled-peer", "node_modules", "no-deps", "package.json"),
+          ).json(),
+        ).toEqual({ name: "no-deps", version: "1.0.0" });
+      }
+
+      await check();
+
+      let lockfile: string | undefined;
+      if (textLockfile) {
+        lockfile = await file(join(packageDir, "bun.lock")).text();
+        expect(lockfile.replaceAll(/localhost:\d+/g, "localhost:1234")).toMatchInlineSnapshot(`
+          "{
+            "lockfileVersion": 2,
+            "configVersion": 1,
+            "workspaces": {
+              "": {
+                "name": "bundled-peer-root",
+                "dependencies": {
+                  "bundled-peer": "1.0.0",
+                },
+              },
+            },
+            "packages": {
+              "bundled-peer": ["bundled-peer@1.0.0", "http://localhost:1234/bundled-peer/-/bundled-peer-1.0.0.tgz", { "peerDependencies": { "no-deps": "1.0.0" } }, "sha512-rmaahOTDrcPuhmBskBLcKEEfTotY+xH6bDPnQopcNlmdePtEvAbAehSpK8JQAegpBir4omjiFqBy1LFqXQBfgA=="],
+
+              "bundled-peer/no-deps": ["no-deps@1.0.0", "http://localhost:1234/no-deps/-/no-deps-1.0.0.tgz", { "bundled": true }, "sha512-v4w12JRjUGvfHDUP8vFDwu0gUWu04j0cv9hLb1Abf9VdaXu4XcrddYFTMVBVvmldKViGWH7jrb6xPJRF0wq6gw=="],
+            }
+          }
+          "
+        `);
+      }
+
+      await rm(join(packageDir, "node_modules"), { recursive: true, force: true });
+      await runBunInstall(env, packageDir, { frozenLockfile: true });
+
+      await check();
+      if (textLockfile) {
+        expect(await file(join(packageDir, "bun.lock")).text()).toBe(lockfile!);
+      }
+    });
+
     test(`(${textLockfile ? "bun.lock" : "bun.lockb"}) git dependencies`, async () => {
       await Promise.all([
         write(
diff --git a/test/cli/install/registry/packages/bundled-peer/bundled-peer-1.0.0.tgz b/test/cli/install/registry/packages/bundled-peer/bundled-peer-1.0.0.tgz
new file mode 100644
index 0000000000000000000000000000000000000000..40e294dbcb5899a9129d2e975f94030c47e0ef5e
GIT binary patch
literal 283
zcmV+$0p$K4iwFP!000021MSp7Yr-%T2k@NxDMHV)CT&u|^S;Fx(wWC_(<C(OF2nC`
z8U?Z7L8lhB|L@SWFC>?L-}BA#vw5c}yCV_Jv`%X@T+_Q$S}7$&nd-Bu5{zs10A2WM
zTF%)&<q!E=XK1l;rdv~(j-9`ZPmTOX%ip?*A%C;~;PU*dN|(rg^!yK-#Yb@Vm-*L9
zozGv_gZy=^B;x}4-`!8fd2X8x<@31ibI+gp;y1Nn<!oP<g(yUxZ8HXcwEu6^>R0uD
zS*k(*%UUY*|HJ$Lt+QrLX5xw3GeaO%`~7F~WDVKnibCA(@8QP@avU0*Z_}Cm-Gfsv
hr>ElAE2azp00000000000002M)pn8QOIrXa005UIlnwv@

literal 0
HcmV?d00001

diff --git a/test/cli/install/registry/packages/bundled-peer/package.json b/test/cli/install/registry/packages/bundled-peer/package.json
new file mode 100644
index 000000000000..670e3938bcff
--- /dev/null
+++ b/test/cli/install/registry/packages/bundled-peer/package.json
@@ -0,0 +1,44 @@
+{
+	"name": "bundled-peer",
+	"versions": {
+		"1.0.0": {
+			"name": "bundled-peer",
+			"version": "1.0.0",
+			"peerDependencies": {
+				"no-deps": "1.0.0"
+			},
+			"bundleDependencies": [
+				"no-deps"
+			],
+			"_id": "bundled-peer@1.0.0",
+			"integrity": "sha512-rmaahOTDrcPuhmBskBLcKEEfTotY+xH6bDPnQopcNlmdePtEvAbAehSpK8JQAegpBir4omjiFqBy1LFqXQBfgA==",
+			"shasum": "32b15c8ab065db1e6b9383043f0dd002077cb65d",
+			"dist": {
+				"integrity": "sha512-rmaahOTDrcPuhmBskBLcKEEfTotY+xH6bDPnQopcNlmdePtEvAbAehSpK8JQAegpBir4omjiFqBy1LFqXQBfgA==",
+				"shasum": "32b15c8ab065db1e6b9383043f0dd002077cb65d",
+				"tarball": "http://localhost:4873/bundled-peer/-/bundled-peer-1.0.0.tgz"
+			},
+			"contributors": []
+		}
+	},
+	"time": {
+		"modified": "2024-12-30T18:14:22.143Z",
+		"created": "2024-12-30T18:14:22.143Z",
+		"1.0.0": "2024-12-30T18:14:22.143Z"
+	},
+	"users": {},
+	"dist-tags": {
+		"latest": "1.0.0"
+	},
+	"_uplinks": {},
+	"_distfiles": {},
+	"_attachments": {
+		"bundled-peer-1.0.0.tgz": {
+			"shasum": "32b15c8ab065db1e6b9383043f0dd002077cb65d",
+			"version": "1.0.0"
+		}
+	},
+	"_rev": "",
+	"_id": "bundled-peer",
+	"readme": ""
+}
diff --git a/test/cli/install/registry/packages/bundled-with-optional/bundled-with-optional-1.0.0.tgz b/test/cli/install/registry/packages/bundled-with-optional/bundled-with-optional-1.0.0.tgz
new file mode 100644
index 0000000000000000000000000000000000000000..940fd676286ea3f223aef91cafce7d2f22824810
GIT binary patch
literal 364
zcmV-y0h9h8iwFP!000021MQa4PJ=KMhPmb`8m?h$p@n4EzJ)QSgGNzS$N-Hodv{CO
zoRTd@Wh2@C?}CzZ=t+~G^Y>ITeU=Yu?wk;6NQAJfVYu3N#s%k`($L0}D54G#&KYRy
zMy?5Qu9Rx4zb-R%zbdn~Q1yIj{h4_R=s%hMGRRalpHlxMiJ<?)`fpRSr@GYt)<5R_
zxc-6<^cP`l{GUSqlk@Hp;%T{3-hy~mchB!aFKS)qrS76^MrX`(H?9M&qyKf;{RpGY
z0l)YEC=wz3e{%gtx&eOn|9I&CF=z1qv-|&6_k%Y8#SL)D{Xg2U_lN%HY&ie1m<ja%
z+53Ol>a0*%@R~P|L0L7X{bg~)4Q$l7h0>YQX|8IM>WY!QjqII+kd6I*SM%oJzJC1t
zoH+eHx|DUE2JAq!{<wo$x8Kj;e=Y6ra!p_Z{l2%Z;vL)#00000000000001RVSE4~
KL=TGqC;$MGtifOa

literal 0
HcmV?d00001

diff --git a/test/cli/install/registry/packages/bundled-with-optional/package.json b/test/cli/install/registry/packages/bundled-with-optional/package.json
new file mode 100644
index 000000000000..43c842c3bacb
--- /dev/null
+++ b/test/cli/install/registry/packages/bundled-with-optional/package.json
@@ -0,0 +1,50 @@
+{
+	"name": "bundled-with-optional",
+	"versions": {
+		"1.0.0": {
+			"name": "bundled-with-optional",
+			"version": "1.0.0",
+			"dependencies": {
+				"no-deps": "1.0.0"
+			},
+			"optionalDependencies": {
+				"a-dep": "1.0.1",
+				"basic-1": "1.0.0"
+			},
+			"bundleDependencies": [
+				"no-deps",
+				"a-dep",
+				"not-a-dependency"
+			],
+			"_id": "bundled-with-optional@1.0.0",
+			"integrity": "sha512-rq4Jtdsk53QE4T00/KaOP5lyv3d8Gnt4VABtara3PFos+8POKMkRIQPYCXVRRBey7K+ttzkiA5MkHhe+T19eYA==",
+			"shasum": "b5dbbcef38296b5a75d4e7441216dff1467d6ebd",
+			"dist": {
+				"integrity": "sha512-rq4Jtdsk53QE4T00/KaOP5lyv3d8Gnt4VABtara3PFos+8POKMkRIQPYCXVRRBey7K+ttzkiA5MkHhe+T19eYA==",
+				"shasum": "b5dbbcef38296b5a75d4e7441216dff1467d6ebd",
+				"tarball": "http://localhost:4873/bundled-with-optional/-/bundled-with-optional-1.0.0.tgz"
+			},
+			"contributors": []
+		}
+	},
+	"time": {
+		"modified": "2024-12-30T18:14:22.143Z",
+		"created": "2024-12-30T18:14:22.143Z",
+		"1.0.0": "2024-12-30T18:14:22.143Z"
+	},
+	"users": {},
+	"dist-tags": {
+		"latest": "1.0.0"
+	},
+	"_uplinks": {},
+	"_distfiles": {},
+	"_attachments": {
+		"bundled-with-optional-1.0.0.tgz": {
+			"shasum": "b5dbbcef38296b5a75d4e7441216dff1467d6ebd",
+			"version": "1.0.0"
+		}
+	},
+	"_rev": "",
+	"_id": "bundled-with-optional",
+	"readme": ""
+}

From f718dc60e5d00b3ca992aa71ae5f4e9916bd1509 Mon Sep 17 00:00:00 2001
From: robobun <117481402+robobun@users.noreply.github.com>
Date: Mon, 17 Aug 2026 01:36:03 +0000
Subject: [PATCH 114/258] Hold a transitive update that would re-fork a deduped
 package (#38919)

---
 src/install/update_transitive.rs              | 572 +++++++++++++++++-
 .../cli/install/bun-update-transitive.test.ts | 502 ++++++++++++++-
 2 files changed, 1032 insertions(+), 42 deletions(-)

diff --git a/src/install/update_transitive.rs b/src/install/update_transitive.rs
index b5358524a658..1b9f122e8392 100644
--- a/src/install/update_transitive.rs
+++ b/src/install/update_transitive.rs
@@ -9,7 +9,7 @@ use bun_semver as Semver;
 
 use crate::audit_fix;
 use crate::dedupe;
-use crate::dependency::{self, Behavior};
+use crate::dependency::{self, Behavior, TagExt as _};
 use crate::lockfile::package::PackageColumns as _;
 use crate::lockfile::{Lockfile, PackageIndexEntry};
 use crate::npm::PackageManifest;
@@ -280,6 +280,13 @@ struct Pin {
     to: Option<Semver::Version>,
 }
 
+struct Planned {
+    v: Semver::Version,
+    /// `None` re-resolves the edge through its own dist-tag.
+    to: Option<Semver::Version>,
+    later: Box<[u8]>,
+}
+
 /// The transitive half of a bare `bun update`: every edge owned by a non-workspace package the selected workspaces reach (all of them from the root or with -r) moves to the newest release its own range allows, or to wherever its dist-tag points now. A range edge sharing the package a root/workspace entry resolves to follows that entry instead (`deferred`).
 #[derive(Default)]
 pub struct TransitiveUpdate {
@@ -1225,6 +1232,7 @@ fn plan_edges(
     if instances.is_empty() {
         return Ok(plan);
     }
+    let edges_on = edges_on_instances(manager, &instances, direct);
 
     let ids: Vec<PackageID> = instances.iter().map(|inst| inst.pkg_id).collect();
     let msgs_before = manager.log_mut().msgs.len();
@@ -1240,7 +1248,7 @@ fn plan_edges(
     let mut unchecked: Vec<(Box<[u8]>, Box<[u8]>)> = Vec::new();
     // Non-inline prerelease strings of planned versions live in the manifest buffer; copied into the lockfile's below.
     let mut pre_strings: Vec<(core::ops::Range<usize>, u64, Box<[u8]>)> = Vec::new();
-    for inst in &instances {
+    for (inst_i, inst) in instances.iter().enumerate() {
         if inst.held {
             continue;
         }
@@ -1264,41 +1272,121 @@ fn plan_edges(
         let manifest: &PackageManifest = manifest;
         let manifest_buf: &[u8] = &manifest.string_buf;
         let rows_before = report.rows.len();
-        for want in &inst.wants {
-            let (v, to, later) = if want.version.tag == DependencyVersionTag::Npm {
-                let range = &want.version.npm().version;
-                let Some(found) = manifest
-                    .find_best_version_with_filter(range, buf, min_age, excludes)
-                    .unwrap()
-                else {
-                    continue;
-                };
-                let v = found.version;
-                if v.order(inst.current, manifest_buf, buf) != Ordering::Greater {
-                    continue;
-                }
-                if !v.tag.pre.value.is_inline() {
-                    let end = pins.len() + want.dep_ids.len();
-                    pre_strings.push((
-                        pins.len()..end,
-                        v.tag.pre.hash,
-                        Box::from(v.tag.pre.slice(manifest_buf)),
-                    ));
+        let planned: Vec<Option<Planned>> = inst
+            .wants
+            .iter()
+            .map(|want| {
+                if want.version.tag == DependencyVersionTag::Npm {
+                    let range = &want.version.npm().version;
+                    manifest
+                        .find_best_version_with_filter(range, buf, min_age, excludes)
+                        .unwrap()
+                        .map(|found| found.version)
+                        .filter(|&v| v.order(inst.current, manifest_buf, buf) == Ordering::Greater)
+                        .map(|v| Planned {
+                            v,
+                            to: Some(v),
+                            later: later_than(manifest, v, min_age, excludes),
+                        })
+                } else {
+                    let tag = want.version.dist_tag().tag.slice(buf);
+                    manifest
+                        .find_by_dist_tag_with_filter(tag, min_age, excludes)
+                        .unwrap()
+                        .map(|found| found.version)
+                        .filter(|&v| v.order(inst.current, manifest_buf, buf) != Ordering::Equal)
+                        .map(|v| Planned {
+                            v,
+                            to: None,
+                            later: Box::default(),
+                        })
                 }
-                (v, Some(v), later_than(manifest, v, min_age, excludes))
-            } else {
-                let tag = want.version.dist_tag().tag.slice(buf);
-                let Some(found) = manifest
-                    .find_by_dist_tag_with_filter(tag, min_age, excludes)
-                    .unwrap()
-                else {
+            })
+            .collect();
+        let edge_wants: Vec<(DependencyID, Option<usize>)> = edges_on.followers[inst_i]
+            .iter()
+            .map(|&edge| {
+                let owner = inst
+                    .wants
+                    .iter()
+                    .position(|want| want.dep_ids.contains(&edge));
+                (edge, owner)
+            })
+            .collect();
+        // Rows landing back on `current` are stayers the redirect can still carry; the first moved row's landing is the instance's only direct redirect target (`redirect` is first-wins over `moved_pairs`, both in owner order).
+        let mut direct_stayers: Vec<DependencyID> = Vec::new();
+        let mut direct_landing: Option<(Semver::Version, bool)> = None;
+        for &(dep_id, latest, keep, res_slot) in &edges_on.direct[inst_i] {
+            let Some((landing, in_manifest)) = direct_row_landing(
+                &manager.lockfile,
+                manifest,
+                dep_id,
+                latest,
+                keep,
+                min_age,
+                excludes,
+            ) else {
+                continue;
+            };
+            let landing_buf = if in_manifest { manifest_buf } else { buf };
+            if landing.order(inst.current, landing_buf, buf) == Ordering::Equal {
+                direct_stayers.push(dep_id);
+            } else if res_slot == inst_i as u32 && direct_landing.is_none() {
+                direct_landing = Some((landing, in_manifest));
+            }
+        }
+        // Holds cascade (a held want stays behind and can block another), so iterate to a fixed point.
+        let mut held_wants = vec![false; inst.wants.len()];
+        loop {
+            let mut changed = false;
+            for w in 0..inst.wants.len() {
+                let Some(plan) = &planned[w] else {
                     continue;
                 };
-                if found.version.order(inst.current, manifest_buf, buf) == Ordering::Equal {
+                if held_wants[w] || plan.to.is_none() {
                     continue;
                 }
-                (found.version, None, Box::default())
+                // The redirect carries every remaining edge toward the FIRST pinned want's target (dist-tag pins included).
+                let redirect_v = (0..inst.wants.len())
+                    .find(|&i| !held_wants[i] && planned[i].is_some())
+                    .and_then(|i| planned[i].as_ref().map(|plan| plan.v))
+                    .unwrap_or(plan.v);
+                if forks_surviving_instance(
+                    &manager.lockfile,
+                    inst,
+                    w,
+                    &planned,
+                    &held_wants,
+                    &edge_wants,
+                    &direct_stayers,
+                    direct_landing,
+                    redirect_v,
+                    manifest_buf,
+                ) {
+                    held_wants[w] = true;
+                    changed = true;
+                }
+            }
+            if !changed {
+                break;
+            }
+        }
+        for (w, want) in inst.wants.iter().enumerate() {
+            let Some(plan) = &planned[w] else {
+                continue;
             };
+            if held_wants[w] {
+                continue;
+            }
+            let (v, to) = (plan.v, plan.to);
+            if to.is_some() && !v.tag.pre.value.is_inline() {
+                let end = pins.len() + want.dep_ids.len();
+                pre_strings.push((
+                    pins.len()..end,
+                    v.tag.pre.hash,
+                    Box::from(v.tag.pre.slice(manifest_buf)),
+                ));
+            }
             pins.extend(want.dep_ids.iter().map(|&dep_id| Pin {
                 dep_id,
                 from: inst.pkg_id,
@@ -1308,7 +1396,7 @@ fn plan_edges(
                 name: Box::from(name),
                 from: text(inst.current.fmt(buf)),
                 to: text(v.fmt(manifest_buf)),
-                later,
+                later: plan.later.clone(),
             });
         }
         if report.rows.len() != rows_before {
@@ -1335,6 +1423,426 @@ fn plan_edges(
     Ok(plan)
 }
 
+/// Live rows per planned instance: `followers` move only via the post-resolve redirect; `direct` rows are the root/workspace rows the differ re-resolves, as `(dep_id, lands on the latest dist-tag, keep_locked_if_ahead model)` per `should_update`.
+struct InstanceEdges {
+    followers: Vec<Vec<DependencyID>>,
+    direct: Vec<Vec<(DependencyID, bool, KeepLocked, u32)>>,
+}
+
+fn edges_on_instances(
+    manager: &mut PackageManager,
+    instances: &[Instance],
+    direct_deps: &DirectDependencies,
+) -> InstanceEdges {
+    struct DirectRow {
+        dep_id: DependencyID,
+        inst: u32,
+        /// Slot of the instance the row currently resolves to, `u32::MAX` when unresolved or unplanned.
+        res_slot: u32,
+        /// The version of the npm instance the row resolved to (live or snapshot).
+        locked: Option<Semver::Version>,
+        catalog: bool,
+        /// The effective version is an npm range (as opposed to a dist-tag).
+        npm: bool,
+    }
+    let mut followers: Vec<Vec<DependencyID>> = vec![Vec::new(); instances.len()];
+    let mut direct: Vec<Vec<(DependencyID, bool, KeepLocked, u32)>> =
+        vec![Vec::new(); instances.len()];
+    let mut direct_rows: Vec<DirectRow> = Vec::new();
+    {
+        let lockfile: &Lockfile = &manager.lockfile;
+        let packages_len = lockfile.packages.len();
+        let mut slot_of: Vec<u32> = vec![u32::MAX; packages_len];
+        for (i, inst) in instances.iter().enumerate() {
+            slot_of[inst.pkg_id as usize] = i as u32;
+        }
+        let buf = lockfile.buffers.string_bytes.as_slice();
+        let pkg_res = lockfile.packages.items_resolution();
+        let pkg_names = lockfile.packages.items_name();
+        let name_hashes = lockfile.packages.items_name_hash();
+        let dep_slices = lockfile.packages.items_dependencies();
+        let deps = lockfile.buffers.dependencies.as_slice();
+        let resolutions = lockfile.buffers.resolutions.as_slice();
+
+        // Removed or superseded subtrees (a dropped workspace member included) are still in the buffers: only owners reachable from the root contribute rows.
+        let mut reachable = DynamicBitSet::init_empty(packages_len).unwrap_or_oom();
+        let mut queue: Vec<usize> = Vec::new();
+        for owner in 0..packages_len {
+            if pkg_res[owner].tag == ResolutionTag::Root {
+                reachable.set(owner);
+                queue.push(owner);
+            }
+        }
+        while let Some(owner) = queue.pop() {
+            let slice = dep_slices[owner];
+            let snapshot = matches!(
+                pkg_res[owner].tag,
+                ResolutionTag::Root | ResolutionTag::Workspace
+            );
+            for row in slice.begin() as usize..slice.end() as usize {
+                let mut target = resolutions[row] as usize;
+                if target >= packages_len && snapshot {
+                    target = snapshot_resolution(
+                        direct_deps,
+                        owner as PackageID,
+                        deps[row].name_hash,
+                        deps[row].behavior,
+                    )
+                    .map_or(usize::MAX, |resolved| resolved as usize);
+                }
+                if target < packages_len && !reachable.is_set(target) {
+                    reachable.set(target);
+                    queue.push(target);
+                }
+            }
+        }
+
+        for owner in 0..packages_len {
+            if !reachable.is_set(owner) {
+                continue;
+            }
+            let slice = dep_slices[owner];
+            let is_direct = matches!(
+                pkg_res[owner].tag,
+                ResolutionTag::Root | ResolutionTag::Workspace
+            );
+            for row in slice.begin() as usize..slice.end() as usize {
+                if !is_direct {
+                    let Some(&slot) = slot_of.get(resolutions[row] as usize) else {
+                        continue;
+                    };
+                    if slot != u32::MAX {
+                        followers[slot as usize].push(row as DependencyID);
+                    }
+                    continue;
+                }
+                let Some(version) =
+                    dedupe::effective_version(lockfile, row as DependencyID, &deps[row])
+                else {
+                    continue;
+                };
+                let names = match version.tag {
+                    DependencyVersionTag::Npm => version.npm().name,
+                    DependencyVersionTag::DistTag => version.dist_tag().name,
+                    _ => continue,
+                };
+                let row_hash = Semver::string::Builder::string_hash(names.slice(buf));
+                // The differ re-appends root rows unresolved; their pre-diff resolution lives in the snapshot.
+                let locked_id = if (resolutions[row] as usize) < packages_len {
+                    Some(resolutions[row])
+                } else {
+                    snapshot_resolution(
+                        direct_deps,
+                        owner as PackageID,
+                        deps[row].name_hash,
+                        deps[row].behavior,
+                    )
+                };
+                let res_slot = locked_id
+                    .and_then(|id| slot_of.get(id as usize).copied())
+                    .unwrap_or(u32::MAX);
+                let locked = locked_id.and_then(|id| {
+                    // An optional row the loaded lockfile left unresolved snapshots as invalid.
+                    let res = pkg_res.get(id as usize)?;
+                    (res.tag == ResolutionTag::Npm).then(|| res.npm().version)
+                });
+                for (i, inst) in instances.iter().enumerate() {
+                    if name_hashes[inst.pkg_id as usize] == row_hash
+                        && names.eql(pkg_names[inst.pkg_id as usize], buf, buf)
+                    {
+                        direct_rows.push(DirectRow {
+                            dep_id: row as DependencyID,
+                            inst: i as u32,
+                            res_slot,
+                            locked,
+                            catalog: deps[row].version.tag == DependencyVersionTag::Catalog,
+                            npm: version.tag == DependencyVersionTag::Npm,
+                        });
+                    }
+                }
+            }
+        }
+    }
+
+    let bare = manager.update_requests.is_empty();
+    let has_targets = manager.update_target_workspaces.is_some();
+    let to_latest = manager
+        .options
+        .do_
+        .contains(crate::package_manager::options::Do::UPDATE_TO_LATEST);
+    for row in direct_rows {
+        let in_targets = {
+            let lockfile: &Lockfile = &manager.lockfile;
+            manager
+                .update_target_workspaces
+                .as_deref()
+                .is_some_and(|targets| lockfile.is_dependency_of_workspace_in(targets, row.dep_id))
+        };
+        // Mirrors `should_update`: bare updates re-resolve the target (or cwd) workspaces' rows and catalog rows; named updates re-resolve the in-scope requested rows.
+        let reresolves = if bare {
+            row.catalog
+                || if has_targets {
+                    in_targets
+                } else {
+                    let this_ptr: *mut PackageManager = manager;
+                    // SAFETY: as in `should_update` — `is_root_dependency` reads
+                    // `manager.root_package_id` and the workspace package.json cache only,
+                    // disjoint from `manager.lockfile`.
+                    unsafe { &*(*this_ptr).lockfile }
+                        .is_root_dependency(unsafe { &mut *this_ptr }, row.dep_id)
+                }
+        } else {
+            named_row_in_scope(manager, row.dep_id)
+        };
+        if !reresolves {
+            // The row keeps its locked resolution, so it sits on exactly that instance; only the redirect can carry it.
+            if row.inst == row.res_slot {
+                followers[row.inst as usize].push(row.dep_id);
+            }
+            continue;
+        }
+        // Mirrors `latest_for_target` (catalog and overridden rows resolve by their range, never by `latest`); named rows reach plan_edges via the --latest-only path.
+        let overridden = overridden_row(&manager.lockfile, row.dep_id);
+        let latest = to_latest && (!bare || in_targets) && !row.catalog && !overridden;
+        // `keep_locked_if_ahead` finds a locked version only where its path can: the range's loaded lockfile instance for -r/--filter npm rows, the invoking workspace's rewritten rows otherwise (rows that were dist-tag literals follow their tag).
+        let keep = if !to_latest || row.catalog || overridden {
+            KeepLocked::No
+        } else if has_targets && in_targets && row.npm {
+            KeepLocked::Range
+        } else if !has_targets && !row.npm && !original_literal_is_dist_tag(manager, row.dep_id) {
+            row.locked.map_or(KeepLocked::No, KeepLocked::Version)
+        } else {
+            KeepLocked::No
+        };
+        direct[row.inst as usize].push((row.dep_id, latest, keep, row.res_slot));
+    }
+    InstanceEdges { followers, direct }
+}
+
+#[derive(Clone, Copy)]
+enum KeepLocked {
+    No,
+    /// The highest loaded instance the row's range accepts keeps the row when it is ahead.
+    Range,
+    /// The row's own locked version keeps it when ahead of the lookup.
+    Version(Semver::Version),
+}
+
+/// Mirrors `locked_version_of_invoking_workspace_row`'s dist-tag-literal exclusion.
+fn original_literal_is_dist_tag(manager: &PackageManager, dep_id: DependencyID) -> bool {
+    let lockfile: &Lockfile = &manager.lockfile;
+    let dep = &lockfile.buffers.dependencies[dep_id as usize];
+    manager
+        .updating_packages
+        .get(lockfile.str(&dep.name))
+        .is_some_and(|entry| {
+            DependencyVersionTag::infer(&entry.original_version_literal)
+                == DependencyVersionTag::DistTag
+        })
+}
+
+/// Mirrors `patched_package_satisfying`: a patched loaded instance the row's range accepts captures the row before any lookup.
+fn patched_capture(lockfile: &Lockfile, dep_id: DependencyID) -> Option<Semver::Version> {
+    if lockfile.patched_dependencies.count() == 0 {
+        return None;
+    }
+    let buf = lockfile.buffers.string_bytes.as_slice();
+    let dep = &lockfile.buffers.dependencies[dep_id as usize];
+    let version = dedupe::effective_version(lockfile, dep_id, dep)?;
+    if version.tag != DependencyVersionTag::Npm {
+        return None;
+    }
+    let hash = Semver::string::Builder::string_hash(version.npm().name.slice(buf));
+    let candidates = lockfile.package_index.get(&hash)?.as_slice();
+    let pkg_res = lockfile.packages.items_resolution();
+    let range = &version.npm().version;
+    candidates
+        .iter()
+        .copied()
+        .filter(|&id| (id as usize) < lockfile.packages.len())
+        .find(|&id| {
+            let res = &pkg_res[id as usize];
+            res.tag == ResolutionTag::Npm
+                && range.satisfies(res.npm().version, buf, buf)
+                && lockfile
+                    .patched_dependencies
+                    .contains(&Semver::string::Builder::string_hash(&dedupe::label(
+                        lockfile, id,
+                    )))
+        })
+        .map(|id| pkg_res[id as usize].npm().version)
+}
+
+/// Mirrors `locked_version_in_lockfile`: the highest loaded npm instance the row's range accepts.
+fn locked_in_lockfile(lockfile: &Lockfile, dep_id: DependencyID) -> Option<Semver::Version> {
+    let buf = lockfile.buffers.string_bytes.as_slice();
+    let dep = &lockfile.buffers.dependencies[dep_id as usize];
+    let version = dedupe::effective_version(lockfile, dep_id, dep)?;
+    if version.tag != DependencyVersionTag::Npm {
+        return None;
+    }
+    let hash = Semver::string::Builder::string_hash(version.npm().name.slice(buf));
+    let candidates = lockfile.package_index.get(&hash)?.as_slice();
+    let pkg_res = lockfile.packages.items_resolution();
+    let range = &version.npm().version;
+    candidates
+        .iter()
+        .copied()
+        .filter(|&id| id < lockfile.loaded_package_count)
+        .map(|id| &pkg_res[id as usize])
+        .filter(|res| res.tag == ResolutionTag::Npm)
+        .map(|res| res.npm().version)
+        .find(|&locked| range.satisfies(locked, buf, buf))
+}
+
+/// The pre-differ resolution of a root/workspace row, matched by owner, name hash and behavior like `moved_pairs`.
+fn snapshot_resolution(
+    direct_deps: &DirectDependencies,
+    owner: PackageID,
+    name_hash: PackageNameHash,
+    behavior: Behavior,
+) -> Option<PackageID> {
+    let &(_, start, len) = direct_deps
+        .owners
+        .iter()
+        .find(|&&(pkg, _, _)| pkg == owner)?;
+    direct_deps.rows[start as usize..(start + len) as usize]
+        .iter()
+        .find(|&&(row_hash, row_behavior, _)| row_hash == name_hash && row_behavior == behavior)
+        .map(|&(_, _, resolved)| resolved)
+}
+
+/// Mirrors `should_update`'s named branch: the row names a requested package and sits in the update scope.
+fn named_row_in_scope(manager: &PackageManager, dep_id: DependencyID) -> bool {
+    let lockfile: &Lockfile = &manager.lockfile;
+    let buf = lockfile.buffers.string_bytes.as_slice();
+    let dep = &lockfile.buffers.dependencies[dep_id as usize];
+    let aliased =
+        dedupe::effective_version(lockfile, dep_id, dep).and_then(|version| match version.tag {
+            DependencyVersionTag::Npm => Some(version.npm().name),
+            DependencyVersionTag::DistTag => Some(version.dist_tag().name),
+            _ => None,
+        });
+    let named = manager.is_update_request(dep.name_hash, dep.name.slice(buf))
+        || aliased.is_some_and(|name| {
+            let hash = Semver::string::Builder::string_hash(name.slice(buf));
+            hash != dep.name_hash && manager.is_update_request(hash, name.slice(buf))
+        });
+    named && UpdateScope::of(manager).contains_dependency(lockfile, dep_id)
+}
+
+/// Overridden rows resolve by the override range, never by `latest` (`!version_was_replaced` in `latest_for_target`).
+fn overridden_row(lockfile: &Lockfile, dep_id: DependencyID) -> bool {
+    let dep = &lockfile.buffers.dependencies[dep_id as usize];
+    !dep.behavior.is_workspace()
+        && !(dep.version.tag == DependencyVersionTag::Npm && dep.version.npm().is_alias)
+        && lockfile
+            .overrides
+            .get(lockfile, dep_id, dep.name_hash)
+            .is_some()
+}
+
+/// The release the differ lands this row on (with whether it lives in the manifest buffer): the patched capture, the keep-locked version, or the lookup (`latest` dist-tag for `--latest` target rows, else the row's own range or tag).
+fn direct_row_landing(
+    lockfile: &Lockfile,
+    manifest: &PackageManifest,
+    dep_id: DependencyID,
+    latest: bool,
+    keep: KeepLocked,
+    min_age: Option<f64>,
+    excludes: Option<&[&[u8]]>,
+) -> Option<(Semver::Version, bool)> {
+    let buf = lockfile.buffers.string_bytes.as_slice();
+    // `patched_package_satisfying` captures the row before any lookup; peer rows fall through.
+    if !lockfile.buffers.dependencies[dep_id as usize]
+        .behavior
+        .is_peer()
+    {
+        if let Some(patched) = patched_capture(lockfile, dep_id) {
+            return Some((patched, false));
+        }
+    }
+    let found = if latest {
+        manifest
+            .find_by_dist_tag_with_filter(b"latest", min_age, excludes)
+            .unwrap()
+    } else {
+        let dep = &lockfile.buffers.dependencies[dep_id as usize];
+        let version = dedupe::effective_version(lockfile, dep_id, dep)?;
+        match version.tag {
+            DependencyVersionTag::Npm => manifest
+                .find_best_version_with_filter(&version.npm().version, buf, min_age, excludes)
+                .unwrap(),
+            DependencyVersionTag::DistTag => manifest
+                .find_by_dist_tag_with_filter(version.dist_tag().tag.slice(buf), min_age, excludes)
+                .unwrap(),
+            _ => return None,
+        }
+    };
+    let found = found?;
+    // `keep_locked_if_ahead`: a lookup below the row's locked version lands it back on that version, when the manifest still has it.
+    let locked = match keep {
+        KeepLocked::No => None,
+        KeepLocked::Version(locked) => Some(locked),
+        KeepLocked::Range => locked_in_lockfile(lockfile, dep_id),
+    };
+    if let Some(locked) = locked {
+        if found.version.order(locked, &manifest.string_buf, buf) == Ordering::Less
+            && manifest.find_by_version(locked).is_some()
+        {
+            return Some((locked, false));
+        }
+    }
+    Some((found.version, true))
+}
+
+/// An edge left behind at a still-satisfying `current` would re-create the duplicate `bun dedupe` removes.
+#[allow(clippy::too_many_arguments)]
+fn forks_surviving_instance(
+    lockfile: &Lockfile,
+    inst: &Instance,
+    want_index: usize,
+    planned: &[Option<Planned>],
+    held_wants: &[bool],
+    edge_wants: &[(DependencyID, Option<usize>)],
+    direct_stayers: &[DependencyID],
+    direct_landing: Option<(Semver::Version, bool)>,
+    redirect_v: Semver::Version,
+    manifest_buf: &[u8],
+) -> bool {
+    let buf = lockfile.buffers.string_bytes.as_slice();
+    let want = &inst.wants[want_index];
+    if want.version.tag != DependencyVersionTag::Npm
+        || !want.version.npm().version.satisfies(inst.current, buf, buf)
+    {
+        return false;
+    }
+    let deps = lockfile.buffers.dependencies.as_slice();
+    let stays = |version: &dependency::Version| {
+        if version.tag != DependencyVersionTag::Npm {
+            return true;
+        }
+        let range = &version.npm().version;
+        !range.satisfies(redirect_v, buf, manifest_buf)
+            && !direct_landing.is_some_and(|(landing, in_manifest)| {
+                range.satisfies(landing, buf, if in_manifest { manifest_buf } else { buf })
+            })
+    };
+    let uncarried = |edge: DependencyID| {
+        let dep = &deps[edge as usize];
+        dep.behavior.is_bundled()
+            || dedupe::effective_npm_range(lockfile, edge, dep).is_none_or(|range| stays(&range))
+    };
+    if direct_stayers.iter().any(|&edge| uncarried(edge)) {
+        return true;
+    }
+    edge_wants.iter().any(|&(edge, owner)| match owner {
+        Some(w) if w == want_index => false,
+        Some(w) => (planned[w].is_none() || held_wants[w]) && stays(&inst.wants[w].version),
+        None => uncarried(edge),
+    })
+}
+
 /// The `latest` dist-tag when it is newer than the release `v` an in-range move stops at, like the `+` rows' `(vX available)`.
 fn later_than(
     manifest: &PackageManifest,
diff --git a/test/cli/install/bun-update-transitive.test.ts b/test/cli/install/bun-update-transitive.test.ts
index 8f2dd2194caf..0fc3236993e2 100644
--- a/test/cli/install/bun-update-transitive.test.ts
+++ b/test/cli/install/bun-update-transitive.test.ts
@@ -1,9 +1,11 @@
 import { file, write } from "bun";
-import { afterAll, beforeAll, expect, test } from "bun:test";
+import { afterAll, beforeAll, expect, setDefaultTimeout, test } from "bun:test";
 import { exists } from "fs/promises";
 import { VerdaccioRegistry, bunEnv, bunExe, tempDir } from "harness";
 import { join } from "path";
 
+setDefaultTimeout(1000 * 60 * 5);
+
 // Registry: no-deps 1.0.0/1.0.1/1.1.0/2.0.0, a-dep 1.0.1..1.0.10, @types/no-deps 1.0.0/2.0.0, one-range-dep@1.0.0 -> no-deps ^1.0.0, one-fixed-dep@1.0.0 -> no-deps 1.0.0, dep-with-tags latest=3.0.0, pre-2=2.0.1, 3.0.1 published above latest.
 
 const registry = new VerdaccioRegistry();
@@ -507,24 +509,501 @@ test.concurrent("a transitive dependency pinned exactly by its dependent stays p
   expect(exitCode).toBe(0);
 });
 
-// The root's no-deps@1.0.0 dedupes both dependents onto 1.0.0 before it is dropped; the update forks only the `^1.0.0` edge.
-test.concurrent("dependents with different ranges are resolved independently", async () => {
+// The root's no-deps@1.0.0 dedupes both dependents onto 1.0.0 before it is dropped; the fixed edge keeps 1.0.0 alive, so the `^1.0.0` edge is held instead of forked into the duplicate `bun dedupe` would remove.
+test.concurrent("a range edge is not forked off an instance a fixed sibling keeps alive", async () => {
   const dependents = { "one-fixed-dep": "1.0.0", "one-range-dep": "1.0.0" };
   const dir = await setup({ "package.json": pkgJson({ "no-deps": "1.0.0", ...dependents }) });
   const packageJson = pkgJson(dependents);
   await reinstall(dir, packageJson);
   expect(await lockedVersions(dir, "no-deps")).toStrictEqual(["1.0.0"]);
+  const before = await lockText(dir);
   const { stdout, stderr, exitCode } = await run(dir, "update");
-  expectSummary(stdout, NO_DEPS_ROW_HINTED, "", installed(1));
+  expectSummary(stdout, noChanges(3, 4));
   expectCleanStderr(stderr);
+  expect(stderr).not.toContain("Saved lockfile");
   expect(await packageJsonOf(dir)).toStrictEqual(packageJson);
+  expect(await lockText(dir)).toBe(before);
+  expect(await lockedVersions(dir, "no-deps")).toStrictEqual(["1.0.0"]);
+  await frozen(dir);
+  expect(exitCode).toBe(0);
+});
+
+// #38903: `bun update` and `bun dedupe` must reach a fixed point. After dedupe collapses the `^1.0.0`
+// edge onto the exact pin's 1.0.0, a bare update holds that edge instead of re-adding the duplicate.
+test.concurrent("a deduped lockfile is a fixed point of `bun update`", async () => {
+  const dir = await setup({ "package.json": pkgJson({ "one-range-dep": "1.0.0" }) });
+  const packageJson = pkgJson({ "one-range-dep": "1.0.0", "no-deps": "1.0.0" });
+  await reinstall(dir, packageJson);
   expect(await lockedVersions(dir, "no-deps")).toStrictEqual(["1.0.0", "1.1.0"]);
-  const { packages } = await lock(dir);
-  expect([packages["no-deps"][0], packages["one-range-dep/no-deps"][0]]).toStrictEqual([
-    "no-deps@1.0.0",
-    "no-deps@1.1.0",
-  ]);
+
+  const deduped = await run(dir, "dedupe");
+  expect(deduped.stderr).not.toContain("error:");
+  expect(deduped.exitCode).toBe(0);
+  expect(await lockedVersions(dir, "no-deps")).toStrictEqual(["1.0.0"]);
+  const before = await lockText(dir);
+
+  const { stdout, stderr, exitCode } = await run(dir, "update");
+  expectSummary(stdout, noChanges(2, 3));
+  expectCleanStderr(stderr);
+  expect(stderr).not.toContain("Saved lockfile");
+  expect(await packageJsonOf(dir)).toStrictEqual(packageJson);
+  expect(await lockText(dir)).toBe(before);
+  expect(exitCode).toBe(0);
+
+  const check = await run(dir, "dedupe", "--check");
+  expect(check.stderr).not.toContain("error:");
+  expect(check.exitCode).toBe(0);
+  expect(await lockText(dir)).toBe(before);
   await frozen(dir);
+});
+
+// Holds cascade: the peer's range rejects 2.0.0, holding bounded-dep's edge; that held edge in turn
+// rejects 4.0.0, so wide-dep's edge must be held too instead of forking leaf off the kept 1.0.0.
+test.concurrent("a held edge blocks its sibling from forking the instance", async () => {
+  using server = await serveRegistry({
+    "wide-dep": { "1.0.0": { dependencies: { leaf: ">=1.0.0" } } },
+    "bounded-dep": { "1.0.0": { dependencies: { leaf: ">=1.0.0 <3.0.0" } } },
+    "peer-host": { "1.0.0": { peerDependencies: { leaf: "1.0.0 || >=4.0.0" } } },
+    leaf: { "1.0.0": {}, "2.0.0": {}, "4.0.0": {} },
+  });
+  const packageJson = pkgJson({ "wide-dep": "1.0.0", "bounded-dep": "1.0.0", "peer-host": "1.0.0" });
+  const dir = await installServed(
+    server,
+    "update-hold-cascade-",
+    pkgJson({ ...packageJson.dependencies, leaf: "1.0.0" }),
+  );
+  const deduped = await run(dir, "dedupe");
+  expect(deduped.stderr).not.toContain("error:");
+  expect(deduped.exitCode).toBe(0);
+  expect(await lockedVersions(dir, "leaf")).toStrictEqual(["1.0.0"]);
+  await reinstall(dir, packageJson);
+  expect(await lockedVersions(dir, "leaf")).toStrictEqual(["1.0.0"]);
+  const before = await lockText(dir);
+
+  const { stdout, stderr, exitCode } = await run(dir, "update");
+  expectNoMoves(stdout);
+  expectCleanStderr(stderr);
+  expect(await lockedVersions(dir, "leaf")).toStrictEqual(["1.0.0"]);
+  expect(await lockText(dir)).toBe(before);
+  expect(exitCode).toBe(0);
+
+  const check = await run(dir, "dedupe", "--check");
+  expect(check.stderr).not.toContain("error:");
+  expect(check.exitCode).toBe(0);
+});
+
+// A direct range that will move is no reason to hold: root leaf `^1.0.0 || ^3.0.0` moves to 3.0.0,
+// so parent's `^1.0.0 || ^2.0.0` edge moves to 2.0.0 instead of being held at the 1.0.0 the root leaves.
+test.concurrent("a direct edge that moves away does not hold its transitive siblings", async () => {
+  using server = await serveRegistry({
+    parent: { "1.0.0": { dependencies: { leaf: "^1.0.0 || ^2.0.0" } } },
+    leaf: { "1.0.0": {}, "2.0.0": {}, "3.0.0": {} },
+  });
+  const dir = await installServed(server, "update-direct-moves-", pkgJson({ parent: "1.0.0", leaf: "1.0.0" }));
+  const deduped = await run(dir, "dedupe");
+  expect(deduped.stderr).not.toContain("error:");
+  expect(deduped.exitCode).toBe(0);
+  expect(await lockedVersions(dir, "leaf")).toStrictEqual(["1.0.0"]);
+
+  // Widen the root range in package.json and bun.lock, keeping the locked resolution at 1.0.0.
+  await write(join(dir, "package.json"), stringify(pkgJson({ parent: "1.0.0", leaf: "^1.0.0 || ^3.0.0" })));
+  const lockfile = await lockText(dir);
+  expect(lockfile.split(`"leaf": "1.0.0"`)).toHaveLength(2);
+  await write(join(dir, "bun.lock"), lockfile.replace(`"leaf": "1.0.0"`, `"leaf": "^1.0.0 || ^3.0.0"`));
+
+  const { stdout, stderr, exitCode } = await run(dir, "update");
+  // The summary prints one row per name; the direct move wins the slot.
+  expect(movedRows(stdout)).toStrictEqual([movedRow("leaf", "1.0.0", "3.0.0")]);
+  expectCleanStderr(stderr);
+  expect(await lockedVersions(dir, "leaf")).toStrictEqual(["2.0.0", "3.0.0"]);
+  expect(exitCode).toBe(0);
+  const before = await lockText(dir);
+
+  const again = await run(dir, "dedupe");
+  expect(again.stderr).not.toContain("error:");
+  expect(again.exitCode).toBe(0);
+  expect(await lockText(dir)).toBe(before);
+});
+
+// `--latest -r` resolves the targeted rows by the `latest` dist-tag, so the exact pin jumps to 2.0.0
+// and does not keep 1.0.0 alive; parent's `^1.0.0` edge must still move to its in-range best.
+test.concurrent("`bun update --latest -r`: a pin that jumps to latest does not hold its siblings", async () => {
+  using server = await serveRegistry({
+    parent: { "1.0.0": { dependencies: { leaf: "^1.0.0" } } },
+    leaf: { "1.0.0": {}, "1.5.0": {}, "2.0.0": {} },
+  });
+  const dir = await installServed(server, "update-latest-target-", pkgJson({ parent: "1.0.0", leaf: "1.0.0" }));
+  const deduped = await run(dir, "dedupe");
+  expect(deduped.stderr).not.toContain("error:");
+  expect(deduped.exitCode).toBe(0);
+  expect(await lockedVersions(dir, "leaf")).toStrictEqual(["1.0.0"]);
+
+  const { stderr, exitCode } = await run(dir, "update", "--latest", "-r");
+  expect(stderr).not.toContain("error:");
+  expect(await lockedVersions(dir, "leaf")).toStrictEqual(["1.5.0", "2.0.0"]);
+  expect(exitCode).toBe(0);
+});
+
+// A workspace member's row is not re-resolved by a bare update from the root, so its parked 1.0.0
+// keeps the instance alive and parent's `*` edge is held: the deduped lockfile stays a fixed point.
+test.concurrent("a member's parked edge holds its transitive siblings under a root update", async () => {
+  using server = await serveRegistry({
+    parent: { "1.0.0": { dependencies: { leaf: "*" } } },
+    leaf: { "1.0.0": {}, "1.5.0": {}, "2.0.0": {} },
+  });
+  using tmp = tempDir("update-member-hold-", {
+    "package.json": stringify({ name: "root", workspaces: ["packages/*"], dependencies: { leaf: "1.0.0" } }),
+    "packages/pkg1/package.json": stringify({ name: "pkg1", dependencies: { leaf: "^1.0.0", parent: "1.0.0" } }),
+  });
+  const dir = String(tmp);
+  await servedBunfig(server, dir);
+  await install(dir);
+  const deduped = await run(dir, "dedupe");
+  expect(deduped.stderr).not.toContain("error:");
+  expect(deduped.exitCode).toBe(0);
+  expect(await lockedVersions(dir, "leaf")).toStrictEqual(["1.0.0"]);
+  await reinstall(dir, { name: "root", workspaces: ["packages/*"] });
+  expect(await lockedVersions(dir, "leaf")).toStrictEqual(["1.0.0"]);
+  const before = await lockText(dir);
+
+  const { stdout, stderr, exitCode } = await run(dir, "update");
+  expectNoMoves(stdout);
+  expectCleanStderr(stderr);
+  expect(await lockedVersions(dir, "leaf")).toStrictEqual(["1.0.0"]);
+  expect(await lockText(dir)).toBe(before);
+  expect(exitCode).toBe(0);
+
+  const check = await run(dir, "dedupe", "--check");
+  expect(check.stderr).not.toContain("error:");
+  expect(check.exitCode).toBe(0);
+});
+
+// pkg1's `^1.0.0` sits on leaf@1.0.0 only; it must not hold parent-b's `>=2.0.0` edge on the
+// separate leaf@2.0.0 instance, which is free to move to 3.0.0.
+test.concurrent("a member's parked row does not hold wants on another instance of its package", async () => {
+  using server = await serveRegistry({
+    "parent-a": { "1.0.0": { dependencies: { leaf: "^1.0.0" } } },
+    "parent-b": { "1.0.0": { dependencies: { leaf: ">=2.0.0" } } },
+    leaf: { "1.0.0": {}, "2.0.0": {}, "3.0.0": {} },
+  });
+  const dependents = { "parent-a": "1.0.0", "parent-b": "1.0.0" };
+  using tmp = tempDir("update-member-other-instance-", {
+    "package.json": stringify({
+      name: "root",
+      workspaces: ["packages/*"],
+      dependencies: { ...dependents, leaf: "2.0.0" },
+    }),
+    "packages/pkg1/package.json": stringify({ name: "pkg1", dependencies: { leaf: "^1.0.0" } }),
+  });
+  const dir = String(tmp);
+  await servedBunfig(server, dir);
+  await install(dir);
+  const deduped = await run(dir, "dedupe");
+  expect(deduped.stderr).not.toContain("error:");
+  expect(deduped.exitCode).toBe(0);
+  expect(await lockedVersions(dir, "leaf")).toStrictEqual(["1.0.0", "2.0.0"]);
+  await reinstall(dir, { name: "root", workspaces: ["packages/*"], dependencies: dependents });
+  expect(await lockedVersions(dir, "leaf")).toStrictEqual(["1.0.0", "2.0.0"]);
+
+  const { stderr, exitCode } = await run(dir, "update");
+  expectCleanStderr(stderr);
+  expect(await lockedVersions(dir, "leaf")).toStrictEqual(["1.0.0", "3.0.0"]);
+  expect(exitCode).toBe(0);
+
+  const check = await run(dir, "dedupe", "--check");
+  expect(check.stderr).not.toContain("error:");
+  expect(check.exitCode).toBe(0);
+});
+
+// `--latest -r` bumps the catalog definition itself before resolving, so the catalog row is
+// modeled by its rewritten range (never the `latest` dist-tag) and every edge converges on 2.0.0.
+test.concurrent("`bun update --latest -r` with a catalog pin converges with dedupe", async () => {
+  using server = await serveRegistry({
+    parent: { "1.0.0": { dependencies: { leaf: "*" } } },
+    leaf: { "1.0.0": {}, "2.0.0": {} },
+  });
+  using tmp = tempDir("update-latest-catalog-", {
+    "package.json": stringify({ name: "root", workspaces: ["packages/*"], catalog: { leaf: "1.0.0" } }),
+    "packages/pkg1/package.json": stringify({ name: "pkg1", dependencies: { leaf: "catalog:", parent: "1.0.0" } }),
+  });
+  const dir = String(tmp);
+  await servedBunfig(server, dir);
+  await install(dir);
+  const deduped = await run(dir, "dedupe");
+  expect(deduped.stderr).not.toContain("error:");
+  expect(deduped.exitCode).toBe(0);
+  expect(await lockedVersions(dir, "leaf")).toStrictEqual(["1.0.0"]);
+
+  const { stderr, exitCode } = await run(dir, "update", "--latest", "-r");
+  expect(stderr).not.toContain("error:");
+  expect(await lockedVersions(dir, "leaf")).toStrictEqual(["2.0.0"]);
+  expect(exitCode).toBe(0);
+
+  const check = await run(dir, "dedupe", "--check");
+  expect(check.stderr).not.toContain("error:");
+  expect(check.exitCode).toBe(0);
+});
+
+// `--latest` never moves a row below bun.lock: with `latest` behind the locked 2.0.0, the exact pin
+// stays, so parent's `>=2.0.0` edge is held instead of re-forking what dedupe removed.
+test.concurrent("`bun update --latest -r`: a pin ahead of `latest` keeps holding its siblings", async () => {
+  using server = await serveRegistry(
+    {
+      parent: { "1.0.0": { dependencies: { leaf: ">=2.0.0" } } },
+      leaf: { "1.9.0": {}, "2.0.0": {}, "2.1.0": {} },
+    },
+    { leaf: { latest: "1.9.0" } },
+  );
+  const dir = await installServed(server, "update-latest-behind-", pkgJson({ parent: "1.0.0", leaf: "2.0.0" }));
+  const deduped = await run(dir, "dedupe");
+  expect(deduped.stderr).not.toContain("error:");
+  expect(deduped.exitCode).toBe(0);
+  expect(await lockedVersions(dir, "leaf")).toStrictEqual(["2.0.0"]);
+
+  const { stderr, exitCode } = await run(dir, "update", "--latest", "-r");
+  expect(stderr).not.toContain("error:");
+  expect(await lockedVersions(dir, "leaf")).toStrictEqual(["2.0.0"]);
+  expect(exitCode).toBe(0);
+
+  const check = await run(dir, "dedupe", "--check");
+  expect(check.stderr).not.toContain("error:");
+  expect(check.exitCode).toBe(0);
+});
+
+// Root rows are re-appended unresolved before the plan runs; the snapshot recovers where they sat,
+// so a root pin still holds a member-scoped update's wants even though root is out of scope.
+test.concurrent("a root pin holds transitive wants when updating from a member", async () => {
+  using server = await serveRegistry({
+    parent: { "1.0.0": { dependencies: { leaf: "*" } } },
+    leaf: { "1.0.0": {}, "2.0.0": {} },
+  });
+  using tmp = tempDir("update-member-cwd-", {
+    "package.json": stringify({ name: "root", workspaces: ["packages/*"], dependencies: { leaf: "1.0.0" } }),
+    "packages/pkg1/package.json": stringify({ name: "pkg1", dependencies: { parent: "1.0.0" } }),
+  });
+  const dir = String(tmp);
+  await servedBunfig(server, dir);
+  await install(dir);
+  const deduped = await run(dir, "dedupe");
+  expect(deduped.stderr).not.toContain("error:");
+  expect(deduped.exitCode).toBe(0);
+  expect(await lockedVersions(dir, "leaf")).toStrictEqual(["1.0.0"]);
+
+  const { stderr, exitCode } = await runIn(dir, "packages/pkg1", "update");
+  expect(stderr).not.toContain("error:");
+  expect(await lockedVersions(dir, "leaf")).toStrictEqual(["1.0.0"]);
+  expect(exitCode).toBe(0);
+
+  const check = await run(dir, "dedupe", "--check");
+  expect(check.stderr).not.toContain("error:");
+  expect(check.exitCode).toBe(0);
+});
+
+// `bun update parent --latest` moves parent 1.0.0 -> 3.0.0; the superseded parent@1.0.0's `~1.0.0`
+// row must not hold the new parent's `^1.0.0` child edge, which moves in-range to 1.5.0.
+test.concurrent("`bun update <name> --latest`: a superseded version's rows do not hold the new children", async () => {
+  using server = await serveRegistry({
+    parent: {
+      "1.0.0": { dependencies: { leaf: "~1.0.0" } },
+      "3.0.0": { dependencies: { leaf: "^1.0.0" } },
+    },
+    leaf: { "1.0.0": {}, "1.5.0": {} },
+  });
+  const dir = await installServed(server, "update-superseded-", pkgJson({ parent: "1.0.0" }));
+  expect(await lockedVersions(dir, "parent")).toStrictEqual(["1.0.0"]);
+  expect(await lockedVersions(dir, "leaf")).toStrictEqual(["1.0.0"]);
+
+  const { stderr, exitCode } = await run(dir, "update", "parent", "--latest");
+  expect(stderr).not.toContain("error:");
+  expect(await lockedVersions(dir, "parent")).toStrictEqual(["3.0.0"]);
+  expect(await lockedVersions(dir, "leaf")).toStrictEqual(["1.5.0"]);
+  expect(exitCode).toBe(0);
+});
+
+// Same through an intermediate package: the superseded parent@1.0.0 -> mid -> leaf `~1.0.0` chain
+// is unreachable once parent moves, so mid's row does not hold the new parent's `^1.0.0` edge.
+test.concurrent("`bun update <name> --latest`: a superseded chain's rows do not hold the new children", async () => {
+  using server = await serveRegistry({
+    parent: {
+      "1.0.0": { dependencies: { mid: "1.0.0" } },
+      "3.0.0": { dependencies: { leaf: "^1.0.0" } },
+    },
+    mid: { "1.0.0": { dependencies: { leaf: "~1.0.0" } } },
+    leaf: { "1.0.0": {}, "1.5.0": {} },
+  });
+  const dir = await installServed(server, "update-superseded-chain-", pkgJson({ parent: "1.0.0" }));
+  expect(await lockedVersions(dir, "leaf")).toStrictEqual(["1.0.0"]);
+
+  const { stderr, exitCode } = await run(dir, "update", "parent", "--latest");
+  expect(stderr).not.toContain("error:");
+  expect(await lockedVersions(dir, "parent")).toStrictEqual(["3.0.0"]);
+  expect(await lockedVersions(dir, "mid")).toStrictEqual([]);
+  expect(await lockedVersions(dir, "leaf")).toStrictEqual(["1.5.0"]);
+  expect(exitCode).toBe(0);
+});
+
+// Removing a root dependency and updating in one step: the removed subtree's rows are unreachable
+// and do not hold the remaining `^1.0.0` want at the 1.0.0 they used to share.
+test.concurrent("a removed root dependency's rows do not hold the remaining wants", async () => {
+  using server = await serveRegistry({
+    "parent-a": { "1.0.0": { dependencies: { leaf: "~1.0.0" } } },
+    "parent-b": { "1.0.0": { dependencies: { leaf: "^1.0.0" } } },
+    leaf: { "1.0.0": {}, "1.5.0": {} },
+  });
+  const dir = await installServed(
+    server,
+    "update-removed-root-",
+    pkgJson({ "parent-a": "1.0.0", "parent-b": "1.0.0" }),
+  );
+  const deduped = await run(dir, "dedupe");
+  expect(deduped.stderr).not.toContain("error:");
+  expect(deduped.exitCode).toBe(0);
+  expect(await lockedVersions(dir, "leaf")).toStrictEqual(["1.0.0"]);
+
+  await write(join(dir, "package.json"), stringify(pkgJson({ "parent-b": "1.0.0" })));
+  const { stderr, exitCode } = await run(dir, "update");
+  expect(stderr).not.toContain("error:");
+  expect(await lockedVersions(dir, "parent-a")).toStrictEqual([]);
+  expect(await lockedVersions(dir, "leaf")).toStrictEqual(["1.5.0"]);
+  expect(exitCode).toBe(0);
+});
+
+// The workspace analog: a member dropped from the glob keeps its Workspace tag until the clean,
+// but its rows are unreachable and do not hold the remaining `^1.0.0` want.
+test.concurrent("a removed workspace member's rows do not hold the remaining wants", async () => {
+  using server = await serveRegistry({
+    parent: { "1.0.0": { dependencies: { leaf: "^1.0.0" } } },
+    leaf: { "1.0.0": {}, "1.5.0": {} },
+  });
+  using tmp = tempDir("update-removed-member-", {
+    "package.json": stringify({ name: "root", workspaces: ["packages/*"], dependencies: { parent: "1.0.0" } }),
+    "packages/a/package.json": stringify({ name: "a", dependencies: { leaf: "~1.0.0" } }),
+  });
+  const dir = String(tmp);
+  await servedBunfig(server, dir);
+  await install(dir);
+  const deduped = await run(dir, "dedupe");
+  expect(deduped.stderr).not.toContain("error:");
+  expect(deduped.exitCode).toBe(0);
+  expect(await lockedVersions(dir, "leaf")).toStrictEqual(["1.0.0"]);
+
+  await write(
+    join(dir, "package.json"),
+    stringify({ name: "root", workspaces: [], dependencies: { parent: "1.0.0" } }),
+  );
+  const { stderr, exitCode } = await run(dir, "update");
+  expect(stderr).not.toContain("error:");
+  expect(await lockedVersions(dir, "leaf")).toStrictEqual(["1.5.0"]);
+  expect(exitCode).toBe(0);
+});
+
+// An optional dependency the registry cannot resolve is skipped at install and its row stays
+// unresolved in bun.lock; a later `bun update` must tolerate that row.
+test.concurrent("`bun update` tolerates an unresolved optional dependency row", async () => {
+  using server = await serveRegistry({
+    parent: { "1.0.0": { dependencies: { leaf: "^1.0.0" } } },
+    leaf: { "1.0.0": {}, "1.5.0": {} },
+  });
+  using tmp = tempDir("update-optional-unresolved-", {
+    "package.json": stringify({ name: "root", workspaces: ["packages/*"], dependencies: { parent: "1.0.0" } }),
+    "packages/a/package.json": stringify({ name: "a", optionalDependencies: { gone: "^1.0.0" } }),
+  });
+  const dir = String(tmp);
+  await servedBunfig(server, dir);
+  const first = await run(dir, "install");
+  expect(first.exitCode).toBe(0);
+
+  const { stderr, exitCode } = await run(dir, "update");
+  expect(stderr).not.toContain("error:");
+  expect(await lockedVersions(dir, "leaf")).toStrictEqual(["1.5.0"]);
+  expect(exitCode).toBe(0);
+});
+
+// The root's `^1.0.0` row sits on leaf@1.5.0; its lookup (1.5.0) is below leaf@2.0.0 but the row
+// never resolved there, so it must not hold parent's `^2.0.0` want from moving to 2.5.0.
+test.concurrent("a direct row on a lower instance does not hold wants on a higher instance", async () => {
+  const manifests: Manifests = {
+    parent: { "1.0.0": { dependencies: { leaf: "^2.0.0" } } },
+    leaf: { "1.5.0": {}, "2.0.0": {}, "2.5.0": {} },
+  };
+  using server = await serveRegistry(manifests);
+  // Tarballs are built eagerly, versions are read per request: hide 2.5.0 from the install only.
+  const hidden = manifests.leaf["2.5.0"];
+  delete manifests.leaf["2.5.0"];
+  const dir = await installServed(server, "update-two-instances-", pkgJson({ parent: "1.0.0", leaf: "^1.0.0" }));
+  expect(await lockedVersions(dir, "leaf")).toStrictEqual(["1.5.0", "2.0.0"]);
+  manifests.leaf["2.5.0"] = hidden;
+
+  const { stderr, exitCode } = await run(dir, "update");
+  expect(stderr).not.toContain("error:");
+  expect(await lockedVersions(dir, "leaf")).toStrictEqual(["1.5.0", "2.5.0"]);
+  expect(exitCode).toBe(0);
+});
+
+// The redirect is first-wins per instance: root's row lands on 3.0.0 first, so pkg1's 4.0.0 landing is
+// never offered to peer-host's edge; that edge stays on 1.0.0 and parent's `*` want must be held.
+test.concurrent("only the first moved direct row's landing carries an instance's followers", async () => {
+  const manifests: Manifests = {
+    parent: { "1.0.0": { dependencies: { leaf: "*" } } },
+    "peer-host": { "1.0.0": { peerDependencies: { leaf: "~1.0.0 || ~4.0.0" } } },
+    leaf: { "1.0.0": {}, "3.0.0": {}, "4.0.0": {}, "5.0.0": {} },
+  };
+  using server = await serveRegistry(manifests);
+  const { "1.0.0": kept, ...hidden } = manifests.leaf;
+  manifests.leaf = { "1.0.0": kept };
+  using tmp = tempDir("update-first-landing-", {
+    "package.json": stringify({
+      name: "root",
+      workspaces: ["packages/*"],
+      dependencies: { leaf: "~1.0.0 || 3.0.0", parent: "1.0.0", "peer-host": "1.0.0" },
+    }),
+    "packages/pkg1/package.json": stringify({ name: "pkg1", dependencies: { leaf: "~1.0.0 || 4.0.0" } }),
+  });
+  const dir = String(tmp);
+  await servedBunfig(server, dir);
+  await install(dir);
+  expect(await lockedVersions(dir, "leaf")).toStrictEqual(["1.0.0"]);
+  Object.assign(manifests.leaf, hidden);
+
+  const { stderr, exitCode } = await run(dir, "update", "-r");
+  expect(stderr).not.toContain("error:");
+  // parent's `*` want is held and its edge carried to 3.0.0 instead of forking off a removable 5.0.0.
+  expect(await lockedVersions(dir, "leaf")).toStrictEqual(["3.0.0", "4.0.0"]);
+  expect(exitCode).toBe(0);
+
+  const check = await run(dir, "dedupe", "--check");
+  expect(check.stderr).not.toContain("error:");
+  expect(check.exitCode).toBe(0);
+});
+
+// pkg1's `1.0.0 || 2.0.0` row binds to the workspace member leaf@2.0.0, never the npm leaf@1.0.0 it
+// name-matches, so it must not hold parent-b's `~1.0.0` want from vacating that instance to 1.0.5.
+test.concurrent("a row a workspace member captures does not hold its package's npm instances", async () => {
+  const manifests: Manifests = {
+    "parent-b": { "1.0.0": { dependencies: { leaf: "~1.0.0" } } },
+    leaf: { "1.0.0": {}, "1.0.5": {} },
+  };
+  using server = await serveRegistry(manifests);
+  const revealed = manifests.leaf["1.0.5"];
+  delete manifests.leaf["1.0.5"];
+  using tmp = tempDir("update-workspace-capture-", {
+    "package.json": stringify({
+      name: "root",
+      workspaces: ["packages/*"],
+      dependencies: { "parent-b": "1.0.0" },
+    }),
+    "packages/leaf/package.json": stringify({ name: "leaf", version: "2.0.0" }),
+    "packages/pkg1/package.json": stringify({ name: "pkg1", dependencies: { leaf: "1.0.0 || 2.0.0" } }),
+  });
+  const dir = String(tmp);
+  await servedBunfig(server, dir);
+  await install(dir);
+  expect(await lockedVersions(dir, "leaf")).toStrictEqual(["1.0.0", "workspace:packages/leaf"]);
+  manifests.leaf["1.0.5"] = revealed;
+
+  const { stderr, exitCode } = await run(dir, "update", "-r");
+  expect(stderr).not.toContain("error:");
+  expect(await lockedVersions(dir, "leaf")).toStrictEqual(["1.0.5", "workspace:packages/leaf"]);
   expect(exitCode).toBe(0);
 });
 
@@ -1358,7 +1837,10 @@ test.concurrent("in a workspace, `bun update` from one member also re-points a s
   expect(exitCode).toBe(0);
 });
 
-type Manifests = Record<string, Record<string, { dependencies?: Record<string, string> }>>;
+type Manifests = Record<
+  string,
+  Record<string, { dependencies?: Record<string, string>; peerDependencies?: Record<string, string> }>
+>;
 type Tags = Record<string, Record<string, string>>;
 
 // Serves one manifest per name from memory; verdaccio has no parent whose newer version keeps a range on the same child, and its dist-tags cannot move mid-test. `tags` is read per request, so a test can move a tag after installing.

From e7e9d15d37ec2fcfb3f5d7104ff746f829c1370d Mon Sep 17 00:00:00 2001
From: robobun <117481402+robobun@users.noreply.github.com>
Date: Mon, 17 Aug 2026 01:38:04 +0000
Subject: [PATCH 115/258] install: stop hoisting a dependency cycle forever
 (#38976)

---
 src/install/lockfile/Tree.rs                  |  30 ++-
 src/install/lockfile/bun.lock.rs              |  23 +++
 test/cli/install/hoist.test.ts                | 188 +++++++++++++++++-
 .../packages/create-hoist-cycle-packages.ts   | 129 ++++++++++++
 .../hoist-bundled-cycle-host-1.0.0.tgz        | Bin 0 -> 265 bytes
 .../hoist-bundled-cycle-host/package.json     |  25 +++
 .../hoist-bundled-cycle-plugin-1.0.0.tgz      | Bin 0 -> 208 bytes
 .../hoist-bundled-cycle-plugin/package.json   |  22 ++
 .../hoist-cycle-x/hoist-cycle-x-1.0.0.tgz     | Bin 0 -> 188 bytes
 .../hoist-cycle-x/hoist-cycle-x-2.0.0.tgz     | Bin 0 -> 188 bytes
 .../packages/hoist-cycle-x/package.json       |  35 ++++
 .../hoist-cycle-y/hoist-cycle-y-1.0.0.tgz     | Bin 0 -> 192 bytes
 .../hoist-cycle-y/hoist-cycle-y-2.0.0.tgz     | Bin 0 -> 192 bytes
 .../packages/hoist-cycle-y/package.json       |  35 ++++
 .../hoist-optional-peer-cycle-entry-1.0.0.tgz | Bin 0 -> 205 bytes
 .../package.json                              |  22 ++
 .../hoist-optional-peer-cycle-x-1.0.0.tgz     | Bin 0 -> 209 bytes
 .../hoist-optional-peer-cycle-x-2.0.0.tgz     | Bin 0 -> 209 bytes
 .../hoist-optional-peer-cycle-x/package.json  |  37 ++++
 .../hoist-optional-peer-cycle-y-1.0.0.tgz     | Bin 0 -> 209 bytes
 .../hoist-optional-peer-cycle-y-2.0.0.tgz     | Bin 0 -> 232 bytes
 .../hoist-optional-peer-cycle-y/package.json  |  40 ++++
 .../hoist-optional-peer-cycle-z-1.0.0.tgz     | Bin 0 -> 205 bytes
 .../hoist-optional-peer-cycle-z-2.0.0.tgz     | Bin 0 -> 173 bytes
 .../hoist-optional-peer-cycle-z/package.json  |  32 +++
 25 files changed, 616 insertions(+), 2 deletions(-)
 create mode 100644 test/cli/install/registry/packages/create-hoist-cycle-packages.ts
 create mode 100644 test/cli/install/registry/packages/hoist-bundled-cycle-host/hoist-bundled-cycle-host-1.0.0.tgz
 create mode 100644 test/cli/install/registry/packages/hoist-bundled-cycle-host/package.json
 create mode 100644 test/cli/install/registry/packages/hoist-bundled-cycle-plugin/hoist-bundled-cycle-plugin-1.0.0.tgz
 create mode 100644 test/cli/install/registry/packages/hoist-bundled-cycle-plugin/package.json
 create mode 100644 test/cli/install/registry/packages/hoist-cycle-x/hoist-cycle-x-1.0.0.tgz
 create mode 100644 test/cli/install/registry/packages/hoist-cycle-x/hoist-cycle-x-2.0.0.tgz
 create mode 100644 test/cli/install/registry/packages/hoist-cycle-x/package.json
 create mode 100644 test/cli/install/registry/packages/hoist-cycle-y/hoist-cycle-y-1.0.0.tgz
 create mode 100644 test/cli/install/registry/packages/hoist-cycle-y/hoist-cycle-y-2.0.0.tgz
 create mode 100644 test/cli/install/registry/packages/hoist-cycle-y/package.json
 create mode 100644 test/cli/install/registry/packages/hoist-optional-peer-cycle-entry/hoist-optional-peer-cycle-entry-1.0.0.tgz
 create mode 100644 test/cli/install/registry/packages/hoist-optional-peer-cycle-entry/package.json
 create mode 100644 test/cli/install/registry/packages/hoist-optional-peer-cycle-x/hoist-optional-peer-cycle-x-1.0.0.tgz
 create mode 100644 test/cli/install/registry/packages/hoist-optional-peer-cycle-x/hoist-optional-peer-cycle-x-2.0.0.tgz
 create mode 100644 test/cli/install/registry/packages/hoist-optional-peer-cycle-x/package.json
 create mode 100644 test/cli/install/registry/packages/hoist-optional-peer-cycle-y/hoist-optional-peer-cycle-y-1.0.0.tgz
 create mode 100644 test/cli/install/registry/packages/hoist-optional-peer-cycle-y/hoist-optional-peer-cycle-y-2.0.0.tgz
 create mode 100644 test/cli/install/registry/packages/hoist-optional-peer-cycle-y/package.json
 create mode 100644 test/cli/install/registry/packages/hoist-optional-peer-cycle-z/hoist-optional-peer-cycle-z-1.0.0.tgz
 create mode 100644 test/cli/install/registry/packages/hoist-optional-peer-cycle-z/hoist-optional-peer-cycle-z-2.0.0.tgz
 create mode 100644 test/cli/install/registry/packages/hoist-optional-peer-cycle-z/package.json

diff --git a/src/install/lockfile/Tree.rs b/src/install/lockfile/Tree.rs
index 589c389e6cde..6acd33bd9f16 100644
--- a/src/install/lockfile/Tree.rs
+++ b/src/install/lockfile/Tree.rs
@@ -666,6 +666,24 @@ impl Tree {
             return Ok(());
         }
 
+        // Below another copy of itself, a package's dependencies are already placed; laying
+        // them out again only re-nests what the levels in between shadow, which for a cycle
+        // through two versions (a@1 -> b@1 -> a@2 -> b@2 -> a@1 ...) never ends. npm stops
+        // here as well (linking to the copy above); bun.lock.rs skips these copies to match.
+        {
+            let trees = builder.list.items_tree();
+            let mut ancestor_id = self.id;
+            while ancestor_id != INVALID_ID {
+                let ancestor = &trees[ancestor_id as usize];
+                if (ancestor.dependency_id as usize) < builder.resolutions.len()
+                    && builder.resolutions[ancestor.dependency_id as usize] == parent_pkg_id
+                {
+                    return Ok(());
+                }
+                ancestor_id = ancestor.parent;
+            }
+        }
+
         builder.list.append(BuilderEntry {
             tree: Tree {
                 parent: self.id,
@@ -1090,7 +1108,17 @@ impl Tree {
                 builder,
             )
         {
-            return Ok(HoistDependencyResult::DependencyLoop); // 3
+            return HoistDependencyResult::DependencyLoop; // 3
+        }
+
+        // A bundled root's walk ends below the folder holding the bundling package, which is
+        // resolvable from inside it; a bundled dependency depending back on it would otherwise
+        // copy it into itself, and the copy's bundled dependencies bring it back, forever.
+        if (this.dependency_id as usize) < deps.len()
+            && builder.resolutions[this.dependency_id as usize] == package_id
+            && deps[this.dependency_id as usize].name_hash == target_name_hash
+        {
+            return HoistDependencyResult::Hoisted; // 1
         }
 
         // place the dependency in the current tree
diff --git a/src/install/lockfile/bun.lock.rs b/src/install/lockfile/bun.lock.rs
index 7c5e868f498b..0cb524779cd6 100644
--- a/src/install/lockfile/bun.lock.rs
+++ b/src/install/lockfile/bun.lock.rs
@@ -1871,6 +1871,22 @@ impl<T> PkgMap<T> {
     }
 }
 
+impl PkgMap<PackageID> {
+    /// Whether a folder on the way down to `pkg_path` holds `pkg_id` too. Each of those
+    /// folders is a key of its own; a prefix ending inside a scoped name matches nothing.
+    fn is_below_copy_of(&self, pkg_path: &[u8], pkg_id: PackageID) -> bool {
+        let mut end: usize = 0;
+        while let Some(i) = strings::index_of_char_usize(&pkg_path[end..], b'/') {
+            end += i;
+            if self.get(&pkg_path[..end]) == Some(&pkg_id) {
+                return true;
+            }
+            end += 1;
+        }
+        false
+    }
+}
+
 // const PkgMap = struct {};
 
 fn object_rows(expr: &Expr) -> &[JSON::E::PropertyJSON] {
@@ -3286,6 +3302,13 @@ pub(crate) fn parse_into_binary_lockfile(
                 continue;
             }
 
+            // A copy below another copy of its package has no node_modules of its own
+            // (`Tree::process_subtree`), so walking up from it finds the versions it sits
+            // under rather than the package's resolutions; the copy above binds those.
+            if pkg_map.is_below_copy_of(pkg_path, pkg_id) {
+                continue;
+            }
+
             // find resolutions. iterate up to root through the pkg path.
             let deps = pkg_deps[pkg_id as usize];
             'deps: for _dep_id in deps.begin()..deps.end() {
diff --git a/test/cli/install/hoist.test.ts b/test/cli/install/hoist.test.ts
index 471acd7dde14..8fc6230cdc2d 100644
--- a/test/cli/install/hoist.test.ts
+++ b/test/cli/install/hoist.test.ts
@@ -1,7 +1,7 @@
 import { file, write } from "bun";
 import { afterAll, beforeAll, expect, test } from "bun:test";
 import { exists, rm } from "fs/promises";
-import { VerdaccioRegistry, bunEnv, runBunInstall } from "harness";
+import { VerdaccioRegistry, bunEnv, bunExe, runBunInstall } from "harness";
 import { join } from "path";
 
 const registry = new VerdaccioRegistry();
@@ -94,3 +94,189 @@ test("tree written after a ranged peer gains a higher candidate is the tree the
   expect(await layout()).toEqual(written);
   expect(await file(join(packageDir, "bun.lock")).text()).toBe(lockfile);
 });
+
+// The hoist-*-cycle-* fixtures are described in registry/packages/create-hoist-cycle-packages.ts.
+//
+// These graphs can only be laid out by nesting: every package in the cycle conflicts with the
+// version of its name one level up, so each copy used to get another copy nested below it and
+// `bun install` never finished. The tree now ends at the first copy of a package that is nested
+// below another copy of itself; that copy gets no node_modules of its own, so its dependency in
+// the cycle resolves to the conflicting version next to it (no finite layout of these graphs avoids
+// that). The trees below are what that produces, keyed the way bun.lock keys `packages`.
+//
+// bun.lock has to load back into the same tree. That copy's row resolves its dependencies to the
+// wrong versions by path, so the loader has to bind the package from the copy above it instead; the
+// reload half of each test fails if it does not, without --frozen-lockfile noticing.
+
+type Linker = "hoisted" | "isolated";
+
+async function install(cwd: string, ...args: string[]) {
+  await using proc = Bun.spawn({
+    cmd: [bunExe(), "install", ...args],
+    cwd,
+    env: bunEnv,
+    stdout: "pipe",
+    stderr: "pipe",
+  });
+  const [stdout, stderr, exitCode] = await Promise.all([proc.stdout.text(), proc.stderr.text(), proc.exited]);
+  expect({ args, stdout, stderr, exitCode }).toMatchObject({
+    stderr: expect.not.stringContaining("error:"),
+    exitCode: 0,
+  });
+}
+
+async function lockfileTree(dir: string) {
+  const { packages } = Bun.JSONC.parse(await Bun.file(join(dir, "bun.lock")).text()) as {
+    packages: Record<string, [string, ...unknown[]]>;
+  };
+  return Object.fromEntries(Object.entries(packages).map(([path, [resolution]]) => [path, resolution]));
+}
+
+async function installedPackageJsons(dir: string) {
+  const nodeModules = join(dir, "node_modules");
+  const paths = await Array.fromAsync(new Bun.Glob("**/package.json").scan({ cwd: nodeModules, dot: true }));
+  return paths.map(path => path.replaceAll("\\", "/")).sort();
+}
+
+// Installs `files` from scratch, then again in a new directory from the bun.lock that produced,
+// and returns the first install's directory.
+async function installFreshAndFromLockfile(
+  files: Record<string, string>,
+  linker: Linker,
+  expectedTree: Record<string, string>,
+) {
+  const { packageDir } = await registry.createTestDir({ bunfigOpts: { linker }, files });
+  await install(packageDir);
+  const lockfile = await Bun.file(join(packageDir, "bun.lock")).text();
+  expect(await lockfileTree(packageDir)).toEqual(expectedTree);
+
+  const { packageDir: reloadDir } = await registry.createTestDir({
+    bunfigOpts: { linker },
+    files: { ...files, "bun.lock": lockfile },
+  });
+  await install(reloadDir, "--frozen-lockfile");
+  expect(await installedPackageJsons(reloadDir)).toEqual(await installedPackageJsons(packageDir));
+
+  // --lockfile-only always writes, so this is the tree a reload builds, printed back.
+  await install(reloadDir, "--lockfile-only");
+  expect(await Bun.file(join(reloadDir, "bun.lock")).text()).toBe(lockfile);
+
+  return packageDir;
+}
+
+test.each(["hoisted", "isolated"] as const)(
+  "a dependency cycle through two versions of the same packages is installed (%s linker)",
+  async linker => {
+    const packageDir = await installFreshAndFromLockfile(
+      { "package.json": JSON.stringify({ name: "pkg", dependencies: { "hoist-cycle-x": "1.0.0" } }) },
+      linker,
+      {
+        "hoist-cycle-x": "hoist-cycle-x@1.0.0",
+        "hoist-cycle-y": "hoist-cycle-y@1.0.0",
+        "hoist-cycle-y/hoist-cycle-x": "hoist-cycle-x@2.0.0",
+        "hoist-cycle-y/hoist-cycle-x/hoist-cycle-y": "hoist-cycle-y@2.0.0",
+        "hoist-cycle-y/hoist-cycle-x/hoist-cycle-y/hoist-cycle-x": "hoist-cycle-x@1.0.0",
+        // This y@1.0.0 is below the y@1.0.0 at the root, so it gets no node_modules of its own.
+        "hoist-cycle-y/hoist-cycle-x/hoist-cycle-y/hoist-cycle-x/hoist-cycle-y": "hoist-cycle-y@1.0.0",
+      },
+    );
+
+    if (linker === "hoisted") {
+      expect(await installedPackageJsons(packageDir)).toEqual([
+        "hoist-cycle-x/package.json",
+        "hoist-cycle-y/node_modules/hoist-cycle-x/node_modules/hoist-cycle-y/node_modules/hoist-cycle-x/node_modules/hoist-cycle-y/package.json",
+        "hoist-cycle-y/node_modules/hoist-cycle-x/node_modules/hoist-cycle-y/node_modules/hoist-cycle-x/package.json",
+        "hoist-cycle-y/node_modules/hoist-cycle-x/node_modules/hoist-cycle-y/package.json",
+        "hoist-cycle-y/node_modules/hoist-cycle-x/package.json",
+        "hoist-cycle-y/package.json",
+      ]);
+    }
+  },
+);
+
+test("a cycle entered at both of its versions, from the root and from a workspace, is installed", async () => {
+  await installFreshAndFromLockfile(
+    {
+      "package.json": JSON.stringify({
+        name: "pkg",
+        workspaces: ["packages/*"],
+        dependencies: { "hoist-cycle-x": "1.0.0" },
+      }),
+      "packages/app/package.json": JSON.stringify({
+        name: "app",
+        version: "1.0.0",
+        dependencies: { "hoist-cycle-x": "2.0.0" },
+      }),
+    },
+    "hoisted",
+    {
+      "app": "app@workspace:packages/app",
+      "hoist-cycle-x": "hoist-cycle-x@1.0.0",
+      "hoist-cycle-y": "hoist-cycle-y@1.0.0",
+      "hoist-cycle-y/hoist-cycle-x": "hoist-cycle-x@2.0.0",
+      "hoist-cycle-y/hoist-cycle-x/hoist-cycle-y": "hoist-cycle-y@2.0.0",
+      "hoist-cycle-y/hoist-cycle-x/hoist-cycle-y/hoist-cycle-x": "hoist-cycle-x@1.0.0",
+      "hoist-cycle-y/hoist-cycle-x/hoist-cycle-y/hoist-cycle-x/hoist-cycle-y": "hoist-cycle-y@1.0.0",
+      // The workspace's branch enters the cycle at x@2.0.0, so it is x@2.0.0's copy that ends it.
+      "app/hoist-cycle-x": "hoist-cycle-x@2.0.0",
+      "app/hoist-cycle-x/hoist-cycle-y": "hoist-cycle-y@2.0.0",
+      "app/hoist-cycle-x/hoist-cycle-y/hoist-cycle-x": "hoist-cycle-x@1.0.0",
+      "app/hoist-cycle-x/hoist-cycle-y/hoist-cycle-x/hoist-cycle-y": "hoist-cycle-y@1.0.0",
+      "app/hoist-cycle-x/hoist-cycle-y/hoist-cycle-x/hoist-cycle-y/hoist-cycle-x": "hoist-cycle-x@2.0.0",
+    },
+  );
+});
+
+test.each(["hoisted", "isolated"] as const)(
+  "a bundled dependency with a peer on the package bundling it is installed (%s linker)",
+  async linker => {
+    // The plugin's peer is satisfied by the host it is bundled in. The host used to be copied into
+    // its own node_modules instead, and the copy bundled the plugin again below it, and so on.
+    await installFreshAndFromLockfile(
+      { "package.json": JSON.stringify({ name: "pkg", dependencies: { "hoist-bundled-cycle-host": "1.0.0" } }) },
+      linker,
+      {
+        "hoist-bundled-cycle-host": "hoist-bundled-cycle-host@1.0.0",
+        "hoist-bundled-cycle-host/hoist-bundled-cycle-plugin": "hoist-bundled-cycle-plugin@1.0.0",
+      },
+    );
+  },
+);
+
+test("a cycle closed through an optional peer is installed", async () => {
+  await installFreshAndFromLockfile(
+    {
+      "package.json": JSON.stringify({
+        name: "pkg",
+        dependencies: { "hoist-optional-peer-cycle-x": "2.0.0" },
+        devDependencies: { "hoist-optional-peer-cycle-entry": "1.0.0" },
+      }),
+    },
+    "hoisted",
+    {
+      "hoist-optional-peer-cycle-entry": "hoist-optional-peer-cycle-entry@1.0.0",
+      "hoist-optional-peer-cycle-x": "hoist-optional-peer-cycle-x@2.0.0",
+      "hoist-optional-peer-cycle-y": "hoist-optional-peer-cycle-y@2.0.0",
+      "hoist-optional-peer-cycle-z": "hoist-optional-peer-cycle-z@2.0.0",
+      "hoist-optional-peer-cycle-entry/hoist-optional-peer-cycle-x": "hoist-optional-peer-cycle-x@1.0.0",
+      "hoist-optional-peer-cycle-entry/hoist-optional-peer-cycle-x/hoist-optional-peer-cycle-y":
+        "hoist-optional-peer-cycle-y@1.0.0",
+      "hoist-optional-peer-cycle-entry/hoist-optional-peer-cycle-x/hoist-optional-peer-cycle-z":
+        "hoist-optional-peer-cycle-z@1.0.0",
+      // y@1.0.0's peer on x@2.0.0, nested because x@1.0.0 is above it.
+      "hoist-optional-peer-cycle-entry/hoist-optional-peer-cycle-x/hoist-optional-peer-cycle-y/hoist-optional-peer-cycle-x":
+        "hoist-optional-peer-cycle-x@2.0.0",
+      // z@1.0.0's y@2.0.0, whose optional peer binds to the x@1.0.0 above it here.
+      "hoist-optional-peer-cycle-entry/hoist-optional-peer-cycle-x/hoist-optional-peer-cycle-z/hoist-optional-peer-cycle-y":
+        "hoist-optional-peer-cycle-y@2.0.0",
+      "hoist-optional-peer-cycle-entry/hoist-optional-peer-cycle-x/hoist-optional-peer-cycle-y/hoist-optional-peer-cycle-x/hoist-optional-peer-cycle-y":
+        "hoist-optional-peer-cycle-y@2.0.0",
+      "hoist-optional-peer-cycle-entry/hoist-optional-peer-cycle-x/hoist-optional-peer-cycle-y/hoist-optional-peer-cycle-x/hoist-optional-peer-cycle-z":
+        "hoist-optional-peer-cycle-z@2.0.0",
+      // That y@2.0.0 sits below x@2.0.0, so the bound x@1.0.0 is nested under it; this x@1.0.0 is
+      // below the x@1.0.0 under `entry` and is where the tree ends.
+      "hoist-optional-peer-cycle-entry/hoist-optional-peer-cycle-x/hoist-optional-peer-cycle-y/hoist-optional-peer-cycle-x/hoist-optional-peer-cycle-y/hoist-optional-peer-cycle-x":
+        "hoist-optional-peer-cycle-x@1.0.0",
+    },
+  );
+});
diff --git a/test/cli/install/registry/packages/create-hoist-cycle-packages.ts b/test/cli/install/registry/packages/create-hoist-cycle-packages.ts
new file mode 100644
index 000000000000..2ab5f295b71c
--- /dev/null
+++ b/test/cli/install/registry/packages/create-hoist-cycle-packages.ts
@@ -0,0 +1,129 @@
+#!/usr/bin/env bun
+/**
+ * Generates the `hoist-*-cycle-*` fixtures used by hoist.test.ts.
+ *
+ * Each shape is a dependency cycle the hoister can only lay out by nesting:
+ * every package in the cycle conflicts with the version of its name one level
+ * up, so without a cutoff the tree builder nests copies forever.
+ *
+ * hoist-cycle (plain dependencies, two versions of each name):
+ *
+ * - hoist-cycle-x@1.0.0 -> hoist-cycle-y@1.0.0
+ * - hoist-cycle-y@1.0.0 -> hoist-cycle-x@2.0.0
+ * - hoist-cycle-x@2.0.0 -> hoist-cycle-y@2.0.0
+ * - hoist-cycle-y@2.0.0 -> hoist-cycle-x@1.0.0
+ *
+ * hoist-bundled-cycle: a package bundling a plugin that has a peer dependency
+ * back on the package bundling it.
+ *
+ * - hoist-bundled-cycle-host@1.0.0    -> plugin@1.0.0 (bundled)
+ * - hoist-bundled-cycle-plugin@1.0.0  peer on host@1.0.0
+ *
+ * hoist-optional-peer-cycle: the cycle is closed through an optional peer.
+ * An optional peer is bound while the tree is built, to whichever version of
+ * its name is closest to the copy being processed, and that one binding is
+ * shared by every copy of the package. With x@2.0.0 at the root and x@1.0.0
+ * nested under `entry`, y@2.0.0 is reached both next to x@1.0.0 (through z,
+ * which binds the peer to it) and below a nested x@2.0.0, where that binding
+ * conflicts and x@1.0.0 is nested again, which starts the cycle over.
+ *
+ * - hoist-optional-peer-cycle-entry@1.0.0 -> x@1.0.0
+ * - hoist-optional-peer-cycle-x@1.0.0     -> y@1.0.0, z@1.0.0
+ * - hoist-optional-peer-cycle-x@2.0.0     -> y@2.0.0, z@2.0.0
+ * - hoist-optional-peer-cycle-y@1.0.0     peer on x@2.0.0
+ * - hoist-optional-peer-cycle-y@2.0.0     optional peer on x@1.0.0
+ * - hoist-optional-peer-cycle-z@1.0.0     -> y@2.0.0
+ * - hoist-optional-peer-cycle-z@2.0.0     no dependencies
+ */
+
+import { mkdir, writeFile } from "fs/promises";
+import { join } from "path";
+
+const packagesDir = import.meta.dir;
+
+type Manifest = {
+  version: string;
+  dependencies?: Record<string, string>;
+  peerDependencies?: Record<string, string>;
+  peerDependenciesMeta?: Record<string, { optional: true }>;
+  bundleDependencies?: string[];
+};
+
+const cycle = "hoist-cycle-";
+const bundled = "hoist-bundled-cycle-";
+const optional = "hoist-optional-peer-cycle-";
+
+const packages: Record<string, Manifest[]> = {
+  [`${cycle}x`]: [
+    { version: "1.0.0", dependencies: { [`${cycle}y`]: "1.0.0" } },
+    { version: "2.0.0", dependencies: { [`${cycle}y`]: "2.0.0" } },
+  ],
+  [`${cycle}y`]: [
+    { version: "1.0.0", dependencies: { [`${cycle}x`]: "2.0.0" } },
+    { version: "2.0.0", dependencies: { [`${cycle}x`]: "1.0.0" } },
+  ],
+
+  [`${bundled}host`]: [
+    {
+      version: "1.0.0",
+      dependencies: { [`${bundled}plugin`]: "1.0.0" },
+      bundleDependencies: [`${bundled}plugin`],
+    },
+  ],
+  [`${bundled}plugin`]: [{ version: "1.0.0", peerDependencies: { [`${bundled}host`]: "1.0.0" } }],
+
+  [`${optional}entry`]: [{ version: "1.0.0", dependencies: { [`${optional}x`]: "1.0.0" } }],
+  [`${optional}x`]: [
+    { version: "1.0.0", dependencies: { [`${optional}y`]: "1.0.0", [`${optional}z`]: "1.0.0" } },
+    { version: "2.0.0", dependencies: { [`${optional}y`]: "2.0.0", [`${optional}z`]: "2.0.0" } },
+  ],
+  [`${optional}y`]: [
+    { version: "1.0.0", peerDependencies: { [`${optional}x`]: "2.0.0" } },
+    {
+      version: "2.0.0",
+      peerDependencies: { [`${optional}x`]: "1.0.0" },
+      peerDependenciesMeta: { [`${optional}x`]: { optional: true } },
+    },
+  ],
+  [`${optional}z`]: [{ version: "1.0.0", dependencies: { [`${optional}y`]: "2.0.0" } }, { version: "2.0.0" }],
+};
+
+for (const [name, manifests] of Object.entries(packages)) {
+  const dir = join(packagesDir, name);
+  await mkdir(dir, { recursive: true });
+
+  const versions: Record<string, object> = {};
+  let latest = "";
+  for (const manifest of manifests) {
+    const pkgJson = { name, ...manifest };
+    const files: Record<string, string> = { "package/package.json": JSON.stringify(pkgJson, null, 2) };
+    for (const dep of manifest.bundleDependencies ?? []) {
+      files[`package/node_modules/${dep}/package.json`] = JSON.stringify(
+        { name: dep, version: manifest.dependencies![dep] },
+        null,
+        2,
+      );
+    }
+    const tarball = join(dir, `${name}-${manifest.version}.tgz`);
+    await Bun.Archive.write(tarball, files, { compress: "gzip" });
+
+    const bytes = await Bun.file(tarball).bytes();
+    versions[manifest.version] = {
+      ...pkgJson,
+      _id: `${name}@${manifest.version}`,
+      dist: {
+        integrity: `sha512-${Buffer.from(new Bun.CryptoHasher("sha512").update(bytes).digest()).toString("base64")}`,
+        shasum: new Bun.CryptoHasher("sha1").update(bytes).digest("hex"),
+        tarball: `http://localhost:4873/${name}/-/${name}-${manifest.version}.tgz`,
+      },
+    };
+    latest = manifest.version;
+  }
+
+  await writeFile(
+    join(dir, "package.json"),
+    JSON.stringify({ _id: name, name, "dist-tags": { latest }, versions }, null, 2),
+  );
+}
+
+console.log("Created hoist cycle test packages");
diff --git a/test/cli/install/registry/packages/hoist-bundled-cycle-host/hoist-bundled-cycle-host-1.0.0.tgz b/test/cli/install/registry/packages/hoist-bundled-cycle-host/hoist-bundled-cycle-host-1.0.0.tgz
new file mode 100644
index 0000000000000000000000000000000000000000..37507eb9689eda5df9cf21eada4c17429988e27e
GIT binary patch
literal 265
zcmb2|=3oGW|8KAOW*s&VU`<$C+U5BAmfZg>Z0oDLgSxVLJEPr=CdO(gmg^shG*LWy
zp{3=(Z!=~mDaC`c_vP8WZdLgk^0@!O++7A~by{3Odx~Rb7W-+|p5b~n=kp#FzhXUZ
z*EQ=Bc%1i!)qIOR-oIN|+BYR;uTb#B$X{kW7k|IVQ8&xlH`{N~QvT-33og&RuPyv~
zE+pmBjO2M?Yri~Nvt!xR1g%>cN>+DQzCY&r`}GdBTkoQLZqMVF-h0OElFRz4)emHT
z-%&poT^U_zT_!YXzy06%;v~KQnx7N@ZC;b&_HTWn+5g`g=FVg2kcW5`P99kMm!V66
K(}_WYfdK$Oqj+2Z

literal 0
HcmV?d00001

diff --git a/test/cli/install/registry/packages/hoist-bundled-cycle-host/package.json b/test/cli/install/registry/packages/hoist-bundled-cycle-host/package.json
new file mode 100644
index 000000000000..3ab9a86e8308
--- /dev/null
+++ b/test/cli/install/registry/packages/hoist-bundled-cycle-host/package.json
@@ -0,0 +1,25 @@
+{
+  "_id": "hoist-bundled-cycle-host",
+  "name": "hoist-bundled-cycle-host",
+  "dist-tags": {
+    "latest": "1.0.0"
+  },
+  "versions": {
+    "1.0.0": {
+      "name": "hoist-bundled-cycle-host",
+      "version": "1.0.0",
+      "dependencies": {
+        "hoist-bundled-cycle-plugin": "1.0.0"
+      },
+      "bundleDependencies": [
+        "hoist-bundled-cycle-plugin"
+      ],
+      "_id": "hoist-bundled-cycle-host@1.0.0",
+      "dist": {
+        "integrity": "sha512-SFFfaFA5g9jnrCbqHjFhQ2jfd+GFqWQWrwJw3RboD8z/Pn091rfOCiVfyoYwCoByZuCUyCiHojzoXIXYFlSYXA==",
+        "shasum": "51b0aeed7e396f12316b46e763fa6cb1972ecb63",
+        "tarball": "http://localhost:4873/hoist-bundled-cycle-host/-/hoist-bundled-cycle-host-1.0.0.tgz"
+      }
+    }
+  }
+}
\ No newline at end of file
diff --git a/test/cli/install/registry/packages/hoist-bundled-cycle-plugin/hoist-bundled-cycle-plugin-1.0.0.tgz b/test/cli/install/registry/packages/hoist-bundled-cycle-plugin/hoist-bundled-cycle-plugin-1.0.0.tgz
new file mode 100644
index 0000000000000000000000000000000000000000..722a07a00cc6ccaa5ec3359a4fa569f5b2c5881e
GIT binary patch
literal 208
zcmb2|=3oGW|8LJ9^g8Sy()uv+xu)J`vyaO>c~jnYA9-@g?QzNpm8L2Cb|;8C6)JZH
z{MdiCaks^E;obk1THmPMlk#!Svj_iXtg^eZ)#7i-+*Q_hy?5Tfx@u}zsB%=;Efc>h
zf17pJ-hK4t`u=st?{);MJ#zk@wNJEu&hahJ{G%n*q(A-JJ71^&a+yT){?jghX6t6o
zY0f`7y;ZDgr`zVI7Z<f2bh3~7w04e>;Lm;UEtY>>tsrcfp3V+&G?e_YlK-Y`QU-$t
G0|Nji{$=?9

literal 0
HcmV?d00001

diff --git a/test/cli/install/registry/packages/hoist-bundled-cycle-plugin/package.json b/test/cli/install/registry/packages/hoist-bundled-cycle-plugin/package.json
new file mode 100644
index 000000000000..d7ee81ad39b1
--- /dev/null
+++ b/test/cli/install/registry/packages/hoist-bundled-cycle-plugin/package.json
@@ -0,0 +1,22 @@
+{
+  "_id": "hoist-bundled-cycle-plugin",
+  "name": "hoist-bundled-cycle-plugin",
+  "dist-tags": {
+    "latest": "1.0.0"
+  },
+  "versions": {
+    "1.0.0": {
+      "name": "hoist-bundled-cycle-plugin",
+      "version": "1.0.0",
+      "peerDependencies": {
+        "hoist-bundled-cycle-host": "1.0.0"
+      },
+      "_id": "hoist-bundled-cycle-plugin@1.0.0",
+      "dist": {
+        "integrity": "sha512-Ln5B/R9XfmUnYRRzx4BXwV8ncQ+xWCWkga1eiuX+HwgYsiCYZlsZfFmz0i+R86eYv/oKuQo5Cy8qxGr1vqp8BQ==",
+        "shasum": "5de566ac4690ed53cf7d3e5a6590c5bef47c6ef0",
+        "tarball": "http://localhost:4873/hoist-bundled-cycle-plugin/-/hoist-bundled-cycle-plugin-1.0.0.tgz"
+      }
+    }
+  }
+}
\ No newline at end of file
diff --git a/test/cli/install/registry/packages/hoist-cycle-x/hoist-cycle-x-1.0.0.tgz b/test/cli/install/registry/packages/hoist-cycle-x/hoist-cycle-x-1.0.0.tgz
new file mode 100644
index 0000000000000000000000000000000000000000..4fbb67e76b27d285dbe56eb4c64cad25ac73496d
GIT binary patch
literal 188
zcmb2|=3oGW|8LKq<~n2`(E4!AXA$RXQR>^GUfiA{wI%LSQi#aMyR5MtdAdy>>Sr@E
zw?F(+x_RaF#7p+Z(aZH_HLiTMN8`wg!|AJj%@ntvEw*asvr5fZ#k$_gS#=L)@O{1a
z;`)BO<9|C>ixzIY#~R)lU7BmvGuwMJ@8iwVk%Hx1zps>C41H9yY^L4%?hEZZI5uWF
k7fp>>+p*`m{`xl2oi}GQLL3Msd0z50Yu3JD&|qKy09wvfZU6uP

literal 0
HcmV?d00001

diff --git a/test/cli/install/registry/packages/hoist-cycle-x/hoist-cycle-x-2.0.0.tgz b/test/cli/install/registry/packages/hoist-cycle-x/hoist-cycle-x-2.0.0.tgz
new file mode 100644
index 0000000000000000000000000000000000000000..72032921d3a88b0df3037bc89f2d84a944f543f2
GIT binary patch
literal 188
zcmb2|=3oGW|8LKq<!W*eIr=g3d~i%!Y?-h3hukA=oB9K1btzSSR}i0gTZQA_{<DqT
z?WbR^stRBGcg<_#o5##%OkDZO=={+arwu|cyK22mnzuS_R%&a;tjs`(z|YLjD^~Tn
z?f+*g^IiR2*pb#(4`Ma*E}MNcS)2d$p8xv1B-cAf<&!V7g?G(XpOsM``}17;RQ}S(
ji?yHTxjxxkS8cxL#9=!ghy$Tyf{%Y_)#t|y8Vn2o4a--f

literal 0
HcmV?d00001

diff --git a/test/cli/install/registry/packages/hoist-cycle-x/package.json b/test/cli/install/registry/packages/hoist-cycle-x/package.json
new file mode 100644
index 000000000000..a710c107d8cf
--- /dev/null
+++ b/test/cli/install/registry/packages/hoist-cycle-x/package.json
@@ -0,0 +1,35 @@
+{
+  "_id": "hoist-cycle-x",
+  "name": "hoist-cycle-x",
+  "dist-tags": {
+    "latest": "2.0.0"
+  },
+  "versions": {
+    "1.0.0": {
+      "name": "hoist-cycle-x",
+      "version": "1.0.0",
+      "dependencies": {
+        "hoist-cycle-y": "1.0.0"
+      },
+      "_id": "hoist-cycle-x@1.0.0",
+      "dist": {
+        "integrity": "sha512-XxY8WzFQ5Bl1KRxuXCjsm+fI5ByOVVRT0c3oTzC8OFZ/ya+bXJwAgbx8ZNmLmfMJVZYPdJbKgLmtmQ7YumXOqw==",
+        "shasum": "8c8c12769463f25bb4bbeacd0d257aa78c23e7fd",
+        "tarball": "http://localhost:4873/hoist-cycle-x/-/hoist-cycle-x-1.0.0.tgz"
+      }
+    },
+    "2.0.0": {
+      "name": "hoist-cycle-x",
+      "version": "2.0.0",
+      "dependencies": {
+        "hoist-cycle-y": "2.0.0"
+      },
+      "_id": "hoist-cycle-x@2.0.0",
+      "dist": {
+        "integrity": "sha512-ekGNL6MZSdsQ84pld6v1kcvZNSlR29owcDnPIamnrkuKAIj//DOnvKllLSKpW3ICKtXdvRac65hCt/v7hjQ2Iw==",
+        "shasum": "5fb9f771e881c4f89abc18f0dd75732b44b37380",
+        "tarball": "http://localhost:4873/hoist-cycle-x/-/hoist-cycle-x-2.0.0.tgz"
+      }
+    }
+  }
+}
\ No newline at end of file
diff --git a/test/cli/install/registry/packages/hoist-cycle-y/hoist-cycle-y-1.0.0.tgz b/test/cli/install/registry/packages/hoist-cycle-y/hoist-cycle-y-1.0.0.tgz
new file mode 100644
index 0000000000000000000000000000000000000000..0c7b414d7b4eea257a546a0af2590f9582994036
GIT binary patch
literal 192
zcmb2|=3oGW|8LKq?mFZk(E2d$d$7n>IpeEpehT@*Nyf*#)o*BZ{dm{3u4FaGq5rvj
zA~IdZ+wQLV+rR&@ZFj2Nq-ta1->bC>%RbLZOB7Q%vutW)W@==2>!nw>I(PElcpkgE
z^xLQP&kN%py>T_!I(tR$i=-Ey^DfQZRXS(Rm*d?p6!VJhRdQXN6I<`D|7>y0q<`h>
n<ZEu{;#}ljyXU$r-`*y^^G7!`#F0>P&t=hS-oF|Q8Vn2o(lS{{

literal 0
HcmV?d00001

diff --git a/test/cli/install/registry/packages/hoist-cycle-y/hoist-cycle-y-2.0.0.tgz b/test/cli/install/registry/packages/hoist-cycle-y/hoist-cycle-y-2.0.0.tgz
new file mode 100644
index 0000000000000000000000000000000000000000..752a17fcfc9e65b60ee01df0bb01abede34b5aaa
GIT binary patch
literal 192
zcmb2|=3oGW|8LKq?mFZk(E2d$d$7n>IpeEpehT@*Nyf*#)o*BZ{dm{3u4FaGq5rvj
zA~IdZ+wQLV+rR&@ZFj2Nq-ta1->bC>%RbLZOB7Q%vutW)W@==2>!nw>I(PElcpkgE
z^xLQP&kN%py>T_!I(tR$i=-Ey^DfQZRXS(Rm*d?p6!VJhRdQXHw~ChSKlfPTvdyw}
n{gKj^)q<64<hKg)Zf_Ic`J<Z|;z%gD=d$S9xMFn%4F(1PgC$oj

literal 0
HcmV?d00001

diff --git a/test/cli/install/registry/packages/hoist-cycle-y/package.json b/test/cli/install/registry/packages/hoist-cycle-y/package.json
new file mode 100644
index 000000000000..108a59aaffc5
--- /dev/null
+++ b/test/cli/install/registry/packages/hoist-cycle-y/package.json
@@ -0,0 +1,35 @@
+{
+  "_id": "hoist-cycle-y",
+  "name": "hoist-cycle-y",
+  "dist-tags": {
+    "latest": "2.0.0"
+  },
+  "versions": {
+    "1.0.0": {
+      "name": "hoist-cycle-y",
+      "version": "1.0.0",
+      "dependencies": {
+        "hoist-cycle-x": "2.0.0"
+      },
+      "_id": "hoist-cycle-y@1.0.0",
+      "dist": {
+        "integrity": "sha512-6wncHD+Md00Ib56bEGFfUOu92s/KY8359DUdCF+P2c3QJvmQ1tKf8P/vR+SRvM0Vk759pKe2EHlhUOgWPOFVWg==",
+        "shasum": "08a70c02642754a082346211eca18ed5b1041729",
+        "tarball": "http://localhost:4873/hoist-cycle-y/-/hoist-cycle-y-1.0.0.tgz"
+      }
+    },
+    "2.0.0": {
+      "name": "hoist-cycle-y",
+      "version": "2.0.0",
+      "dependencies": {
+        "hoist-cycle-x": "1.0.0"
+      },
+      "_id": "hoist-cycle-y@2.0.0",
+      "dist": {
+        "integrity": "sha512-Q8oaz58QXz8CB6hh0kGLkTBsNvkooYaZN4cTVSweoefw1VcymRVMBoDmi/ku+4BZDYDKI5idwdQ6+oDqK09Wjw==",
+        "shasum": "8b01a417c5f2156e68fa9342966bcd50ee319b91",
+        "tarball": "http://localhost:4873/hoist-cycle-y/-/hoist-cycle-y-2.0.0.tgz"
+      }
+    }
+  }
+}
\ No newline at end of file
diff --git a/test/cli/install/registry/packages/hoist-optional-peer-cycle-entry/hoist-optional-peer-cycle-entry-1.0.0.tgz b/test/cli/install/registry/packages/hoist-optional-peer-cycle-entry/hoist-optional-peer-cycle-entry-1.0.0.tgz
new file mode 100644
index 0000000000000000000000000000000000000000..d9593a54544cc262a2aadb57316371f5cb1eb654
GIT binary patch
literal 205
zcmb2|=3oGW|8LJ9^g8SyaO|V)bImr}*%r55xGQI?%9=!#PtOtYez}|bo5B}`4keL)
z`%kko8y^mT^hHMg&9*t4t5;d>v|qOB`(Xt?``Bf#)L1ynXFG1azVCilTio_$;nM#P
zwyrBI{PjA1`qOnsHVS^!+&4r1sQt5@>vHv8&k4S>{b)|+^21xUU%RwR=8v!Pqx(54
zi~Z_E<gMO*vAG+$am!|tvtfTVj=Q<+v;OgK>-~;7vnDe`Tnr`u9AVdOUvI#m!N33j
DiS1y@

literal 0
HcmV?d00001

diff --git a/test/cli/install/registry/packages/hoist-optional-peer-cycle-entry/package.json b/test/cli/install/registry/packages/hoist-optional-peer-cycle-entry/package.json
new file mode 100644
index 000000000000..604e9a659ecc
--- /dev/null
+++ b/test/cli/install/registry/packages/hoist-optional-peer-cycle-entry/package.json
@@ -0,0 +1,22 @@
+{
+  "_id": "hoist-optional-peer-cycle-entry",
+  "name": "hoist-optional-peer-cycle-entry",
+  "dist-tags": {
+    "latest": "1.0.0"
+  },
+  "versions": {
+    "1.0.0": {
+      "name": "hoist-optional-peer-cycle-entry",
+      "version": "1.0.0",
+      "dependencies": {
+        "hoist-optional-peer-cycle-x": "1.0.0"
+      },
+      "_id": "hoist-optional-peer-cycle-entry@1.0.0",
+      "dist": {
+        "integrity": "sha512-FDfiSd8eCpyJ3n324Hk8KdEoNLkB/go8tQvT9txL1qt/ULRhuzYfCjT0StP5a3pYykhvjQFYA17VzF1ZMPsEqw==",
+        "shasum": "be52741a45e564b667febacfdcfcd2433ba474ef",
+        "tarball": "http://localhost:4873/hoist-optional-peer-cycle-entry/-/hoist-optional-peer-cycle-entry-1.0.0.tgz"
+      }
+    }
+  }
+}
\ No newline at end of file
diff --git a/test/cli/install/registry/packages/hoist-optional-peer-cycle-x/hoist-optional-peer-cycle-x-1.0.0.tgz b/test/cli/install/registry/packages/hoist-optional-peer-cycle-x/hoist-optional-peer-cycle-x-1.0.0.tgz
new file mode 100644
index 0000000000000000000000000000000000000000..9c948777879fc7d44a810128b56b461184144b4b
GIT binary patch
literal 209
zcmb2|=3oGW|8LJ9^kOy?IQDVQXA$Rf@2p;~6aAKZ$m~Uy@1Zo&?3cT_zbSmX(7iO^
z$A3NM!{)|5oR70By1qY+xIKN=<edhgvETPf{4I<M4bRs9mw0t`*{#z4Mf*O#>Rqw3
z>HDshn=kg~&$TO8{uXv*=?Ag93hylaOEZfim(4k}P1Eq)*&Wi`H~uUs4?9wOWT&6y
zPRBX<TdyXU3w!&_o^ebw%>2Z?t`j>`ckln4zBzt>q;}B;c4mm9p`^jF8TrkIZXX#m
G7#IMwI%MGh

literal 0
HcmV?d00001

diff --git a/test/cli/install/registry/packages/hoist-optional-peer-cycle-x/hoist-optional-peer-cycle-x-2.0.0.tgz b/test/cli/install/registry/packages/hoist-optional-peer-cycle-x/hoist-optional-peer-cycle-x-2.0.0.tgz
new file mode 100644
index 0000000000000000000000000000000000000000..e194805325bc7779e59fd2d9c3b7a2f109ddb6c9
GIT binary patch
literal 209
zcmb2|=3oGW|8LJ9^g8SyaO|V)`(U1GvqG~@(NAXHyE3-C)4Qp0?NYh;8^<>b#a%W2
z)K71GI9qaA%S%g}Be#oIy$wEl@{eKYU7lu%zeRDOyL-j!uk)_j`|a=E74P>}DQEpV
zm>qjK>C5%)=jQJgV%L5YRMD9y@_okhU1mGi6#FG!pCU0m?Uw)U8+&$3Yd^a8DCqf|
zI~wb<w_Xh{m-hC#J!6?=nE9!LT_={N{+|C?e6#%hNbRC6?#vKJLrH^UGyD_wfAV0^
HU|;|M{3K*~

literal 0
HcmV?d00001

diff --git a/test/cli/install/registry/packages/hoist-optional-peer-cycle-x/package.json b/test/cli/install/registry/packages/hoist-optional-peer-cycle-x/package.json
new file mode 100644
index 000000000000..d0860938ccb0
--- /dev/null
+++ b/test/cli/install/registry/packages/hoist-optional-peer-cycle-x/package.json
@@ -0,0 +1,37 @@
+{
+  "_id": "hoist-optional-peer-cycle-x",
+  "name": "hoist-optional-peer-cycle-x",
+  "dist-tags": {
+    "latest": "2.0.0"
+  },
+  "versions": {
+    "1.0.0": {
+      "name": "hoist-optional-peer-cycle-x",
+      "version": "1.0.0",
+      "dependencies": {
+        "hoist-optional-peer-cycle-y": "1.0.0",
+        "hoist-optional-peer-cycle-z": "1.0.0"
+      },
+      "_id": "hoist-optional-peer-cycle-x@1.0.0",
+      "dist": {
+        "integrity": "sha512-KlprcCPzErpXf5tACt0XAxTEYf7fk+72MSCcBs7j6xnIKikqIK1h3LxEHkcNqT4dB4fAIhsfJK88T9OWhvCgPA==",
+        "shasum": "3f31db5e7f100aa1061349e8e4926067cb71b54f",
+        "tarball": "http://localhost:4873/hoist-optional-peer-cycle-x/-/hoist-optional-peer-cycle-x-1.0.0.tgz"
+      }
+    },
+    "2.0.0": {
+      "name": "hoist-optional-peer-cycle-x",
+      "version": "2.0.0",
+      "dependencies": {
+        "hoist-optional-peer-cycle-y": "2.0.0",
+        "hoist-optional-peer-cycle-z": "2.0.0"
+      },
+      "_id": "hoist-optional-peer-cycle-x@2.0.0",
+      "dist": {
+        "integrity": "sha512-inK8dVXwSw1OCxE7iULIpMNMnpPYt3duWJtY2TnizQ1nBopIeDbYOESvN7iWZ63qzH3x8xkpBz7Aw0Lnyerqag==",
+        "shasum": "174af505b598ac64b79d11045e01ba1bf8ef5dd8",
+        "tarball": "http://localhost:4873/hoist-optional-peer-cycle-x/-/hoist-optional-peer-cycle-x-2.0.0.tgz"
+      }
+    }
+  }
+}
\ No newline at end of file
diff --git a/test/cli/install/registry/packages/hoist-optional-peer-cycle-y/hoist-optional-peer-cycle-y-1.0.0.tgz b/test/cli/install/registry/packages/hoist-optional-peer-cycle-y/hoist-optional-peer-cycle-y-1.0.0.tgz
new file mode 100644
index 0000000000000000000000000000000000000000..7f46eef5682390db7a1e17b2dcae7decd936f6cf
GIT binary patch
literal 209
zcmb2|=3oGW|8LJbdLMQWV0~cwetpH6n@4V{M4h;4zv+nM;?nYyZX2ikD_^+xt3t=p
zfQtK156ay8;5Fyo<L<lDgSX|Is+T9O`engWP*pN-RV)Vw|J?<*vhU|FSa|*Hg9Y!n
z>|RTWFaQ6q)b5?z8(Rg<x*0tauG?JSdNOrxao6o-Gjz{xnZ51Wn<wX(Kc#xlEuJJO
z6qWn6L^tj9WKr+))0W*_)pMhoVZUhIX^xkDvT_zbnw6E%!J_>?81t@r%w*7DU;qHm
Con-w0

literal 0
HcmV?d00001

diff --git a/test/cli/install/registry/packages/hoist-optional-peer-cycle-y/hoist-optional-peer-cycle-y-2.0.0.tgz b/test/cli/install/registry/packages/hoist-optional-peer-cycle-y/hoist-optional-peer-cycle-y-2.0.0.tgz
new file mode 100644
index 0000000000000000000000000000000000000000..d489f89c7b6e7fae80dffd13c65b9fd8927fe452
GIT binary patch
literal 232
zcmb2|=3oGW|8LJbdLMQWV0~cwetpH6n@2n+Ydv{$Res|U$Hk?aRiZae`BScV&|6SY
zWZ~1=>5UIRws|hB=Ik$<do9w=-?^mTCp3Q+o1ggd;H~$}R&1N?w)NVseXU`oOM9Dl
z)o++zBr*5juWK)h(;vNH?0k52NvjR--znXSPwP4o!&NqKe8G43Tvu~UrNh0PIlmOW
zxNlC0dbP_p?eSdIZho=d_tY{AzcB36u9+?tq$?{oWB;3-+hyu*ZEa)t$>Y&&^DZ~?
XyxfexZ#po5-U)W2SqhyD8Vn2o<}Y#b

literal 0
HcmV?d00001

diff --git a/test/cli/install/registry/packages/hoist-optional-peer-cycle-y/package.json b/test/cli/install/registry/packages/hoist-optional-peer-cycle-y/package.json
new file mode 100644
index 000000000000..86abf8665e9c
--- /dev/null
+++ b/test/cli/install/registry/packages/hoist-optional-peer-cycle-y/package.json
@@ -0,0 +1,40 @@
+{
+  "_id": "hoist-optional-peer-cycle-y",
+  "name": "hoist-optional-peer-cycle-y",
+  "dist-tags": {
+    "latest": "2.0.0"
+  },
+  "versions": {
+    "1.0.0": {
+      "name": "hoist-optional-peer-cycle-y",
+      "version": "1.0.0",
+      "peerDependencies": {
+        "hoist-optional-peer-cycle-x": "2.0.0"
+      },
+      "_id": "hoist-optional-peer-cycle-y@1.0.0",
+      "dist": {
+        "integrity": "sha512-K6r6RYiWvhsjN0UMpVoBXWRvE7tUUXGIiS1ZxMf+HW4dsgMNXB+hfWMoQ8DlwNHZuM1kTdSIkc5u4rDIrf1x0A==",
+        "shasum": "c450c4030181e5c778268eab31bffa98d595cfbf",
+        "tarball": "http://localhost:4873/hoist-optional-peer-cycle-y/-/hoist-optional-peer-cycle-y-1.0.0.tgz"
+      }
+    },
+    "2.0.0": {
+      "name": "hoist-optional-peer-cycle-y",
+      "version": "2.0.0",
+      "peerDependencies": {
+        "hoist-optional-peer-cycle-x": "1.0.0"
+      },
+      "peerDependenciesMeta": {
+        "hoist-optional-peer-cycle-x": {
+          "optional": true
+        }
+      },
+      "_id": "hoist-optional-peer-cycle-y@2.0.0",
+      "dist": {
+        "integrity": "sha512-ycp0N508WdyGz/ECodwmYUWevdQrSeCSKvjjUFL+oEkJyz0l8lKn7cHcD7Png+oQ5heJbJUkje91bIZKhyeLaA==",
+        "shasum": "d2befacfc7eb260db2369e59d2d3ce0755af5d23",
+        "tarball": "http://localhost:4873/hoist-optional-peer-cycle-y/-/hoist-optional-peer-cycle-y-2.0.0.tgz"
+      }
+    }
+  }
+}
\ No newline at end of file
diff --git a/test/cli/install/registry/packages/hoist-optional-peer-cycle-z/hoist-optional-peer-cycle-z-1.0.0.tgz b/test/cli/install/registry/packages/hoist-optional-peer-cycle-z/hoist-optional-peer-cycle-z-1.0.0.tgz
new file mode 100644
index 0000000000000000000000000000000000000000..292f583dca19939707963464904e487e2e1e3c83
GIT binary patch
literal 205
zcmb2|=3oGW|8LLV^*Zbz(Du;wTqsX<&Z8&G*^11)tunT})4Qp0<x;iyt<7>Ai#QJb
zo>OCBU|eH)M*rc(cb`pXKcBSdcj~HN20V|xJTeQlzU#UBHQUv=-*qCn)w1sDul^l~
zzIo`?m*e~MPX85N?seq&hpalG|5K)Ix~iG)-Ssdaee>3N{htrM;;#?y{81i#deWl#
zN4EExRn2{;8+|8wj<|N+q+nI0cv<UTo;Bq+*Snm%dXo|2Vko)qwXjH;f-r*y0|Nj+
CreOL2

literal 0
HcmV?d00001

diff --git a/test/cli/install/registry/packages/hoist-optional-peer-cycle-z/hoist-optional-peer-cycle-z-2.0.0.tgz b/test/cli/install/registry/packages/hoist-optional-peer-cycle-z/hoist-optional-peer-cycle-z-2.0.0.tgz
new file mode 100644
index 0000000000000000000000000000000000000000..147d280f19573f5c32eabc5ed4a7e70403170357
GIT binary patch
literal 173
zcmb2|=3oGW|8LLRavgFIaecUQbJy`JYWx1Im~fXT@j}L#79Ww2JG&ReM!5=}yFTYr
z5&LzSJJ<Bv!#CIR?EPsF8XG=UqIOoe>GhaTp@A!>MNN~wxaW#*qRUzFIgg&WEzZwB
zd;V`{v{F)a`Il{CySa1cTr%*<eGxmI?_Pgqai-P$xVK7z8`JHNnE|DvQ)aF7ea8lI
S5tRJE&Hw9Zr#yoO0|Nkyic8@D

literal 0
HcmV?d00001

diff --git a/test/cli/install/registry/packages/hoist-optional-peer-cycle-z/package.json b/test/cli/install/registry/packages/hoist-optional-peer-cycle-z/package.json
new file mode 100644
index 000000000000..afec4abf2a8a
--- /dev/null
+++ b/test/cli/install/registry/packages/hoist-optional-peer-cycle-z/package.json
@@ -0,0 +1,32 @@
+{
+  "_id": "hoist-optional-peer-cycle-z",
+  "name": "hoist-optional-peer-cycle-z",
+  "dist-tags": {
+    "latest": "2.0.0"
+  },
+  "versions": {
+    "1.0.0": {
+      "name": "hoist-optional-peer-cycle-z",
+      "version": "1.0.0",
+      "dependencies": {
+        "hoist-optional-peer-cycle-y": "2.0.0"
+      },
+      "_id": "hoist-optional-peer-cycle-z@1.0.0",
+      "dist": {
+        "integrity": "sha512-CVxdzowZDlVIXkbYwdTBboHzoZj37q6BMsbliVhhb1jUc9oD5ekzEW/X7x697DVKQbVGekQ5Sbq005ATD1kcRQ==",
+        "shasum": "cf47fc0ae10f5d732cc60124a6475e92c65eba35",
+        "tarball": "http://localhost:4873/hoist-optional-peer-cycle-z/-/hoist-optional-peer-cycle-z-1.0.0.tgz"
+      }
+    },
+    "2.0.0": {
+      "name": "hoist-optional-peer-cycle-z",
+      "version": "2.0.0",
+      "_id": "hoist-optional-peer-cycle-z@2.0.0",
+      "dist": {
+        "integrity": "sha512-uHhXNwS4Q2LxIJp2KcJ1LLs/5QOyggw6QQvoXqp5GM6JS1yO1tG4d7n+t4gZM+GyQT6mtP8Vtz0YZe9aaEwZHw==",
+        "shasum": "a875d069566a9b97a2cffa171dba2826934bfb2c",
+        "tarball": "http://localhost:4873/hoist-optional-peer-cycle-z/-/hoist-optional-peer-cycle-z-2.0.0.tgz"
+      }
+    }
+  }
+}
\ No newline at end of file

From 806c0ccfbb8ec30556c424373987a5049df41aa4 Mon Sep 17 00:00:00 2001
From: robobun <117481402+robobun@users.noreply.github.com>
Date: Mon, 17 Aug 2026 01:38:25 +0000
Subject: [PATCH 116/258] install: warn when the hoisted tree serves a peer
 from a root copy outside its range (#39053)

---
 src/install/lockfile.rs             |  13 +++
 src/install/lockfile/OverrideMap.rs |  14 +--
 src/install/lockfile/Tree.rs        |  58 +++++++++-
 test/cli/install/hoist.test.ts      | 168 ++++++++++++++++++++++++++++
 4 files changed, 241 insertions(+), 12 deletions(-)

diff --git a/src/install/lockfile.rs b/src/install/lockfile.rs
index c64ea9d912a2..763f65f98838 100644
--- a/src/install/lockfile.rs
+++ b/src/install/lockfile.rs
@@ -847,6 +847,19 @@ impl Lockfile {
         self.packages.items_dependencies()[0].contains(id)
     }
 
+    /// `None` for git, tarball and unversioned workspace packages (no version to compare).
+    pub(crate) fn package_version(&self, id: PackageID) -> Option<Semver::Version> {
+        let resolution = &self.packages.items_resolution()[id as usize];
+        match resolution.tag {
+            ResolutionTag::Npm => Some(resolution.npm().version),
+            ResolutionTag::Workspace => self
+                .workspace_versions
+                .get(&self.packages.items_name_hash()[id as usize])
+                .copied(),
+            _ => None,
+        }
+    }
+
     /// Is this a direct dependency of the workspace the install is taking place in?
     pub(crate) fn is_root_dependency(
         &self,
diff --git a/src/install/lockfile/OverrideMap.rs b/src/install/lockfile/OverrideMap.rs
index 58188dbece3b..40e527a26bbf 100644
--- a/src/install/lockfile/OverrideMap.rs
+++ b/src/install/lockfile/OverrideMap.rs
@@ -4,7 +4,6 @@ use core::cmp::Ordering;
 use crate::DependencyID;
 use crate::Error;
 use crate::package_manager::workspace_package_json_cache::{GetJSONOptions, GetResult};
-use crate::resolution::Tag as ResolutionTag;
 use crate::{PackageID, invalid_package_id};
 use bun_collections::{ArrayHashMap, index_sort};
 use bun_install::dependency::{
@@ -257,15 +256,10 @@ impl OverrideMap {
         if owner_id == invalid_package_id {
             return None;
         }
-        let owner_id = owner_id as usize;
-        let owner_name_hash = lockfile.packages.items_name_hash()[owner_id];
-        let resolution = &lockfile.packages.items_resolution()[owner_id];
-        let owner_version = match resolution.tag {
-            ResolutionTag::Npm => Some(resolution.npm().version),
-            ResolutionTag::Workspace => lockfile.workspace_versions.get(&owner_name_hash).copied(),
-            _ => None,
-        };
-        Some((owner_name_hash, owner_version))
+        Some((
+            lockfile.packages.items_name_hash()[owner_id as usize],
+            lockfile.package_version(owner_id),
+        ))
     }
 
     fn owner_package_id(&self, lockfile: &Lockfile, dependency_id: DependencyID) -> PackageID {
diff --git a/src/install/lockfile/Tree.rs b/src/install/lockfile/Tree.rs
index 6acd33bd9f16..04f3ebdd2ec4 100644
--- a/src/install/lockfile/Tree.rs
+++ b/src/install/lockfile/Tree.rs
@@ -4,6 +4,7 @@ use bun_alloc::AllocError;
 use bun_collections::{ArrayHashMap, DynamicBitSet, MultiArrayList};
 use bun_core::Output;
 use bun_core::ZStr;
+use bun_core::fmt::PathSep;
 use bun_paths::{MAX_PATH_BYTES, PathBuffer, SEP};
 
 use crate::lockfile::package::PackageColumns as _;
@@ -137,6 +138,8 @@ enum HoistDependencyResult {
     ResolveLater,
     /// `Hoisted`, plus the optional peer's slot now points at the version it deduplicated onto.
     Rebind(PackageID),
+    /// `Hoisted` onto the root package.json's copy of a peer, whose version the peer's range rejects.
+    HoistedOutOfRange(PackageID),
     Placement(Placement),
 }
 
@@ -488,6 +491,35 @@ impl<'a, const METHOD: BuilderMethod> Builder<'a, METHOD> {
         let _ = self.log.add_error_fmt(None, bun_ast::Loc::EMPTY, args);
     }
 
+    /// The resolver's "incorrect peer dependency" message, with the dependent and range added.
+    #[cold]
+    fn warn_peer_out_of_range(
+        &mut self,
+        dependent_id: PackageID,
+        peer: &Dependency,
+        copy_id: PackageID,
+    ) {
+        let lockfile_ref = self.lockfile;
+        let lockfile: &Lockfile = lockfile_ref.get();
+        let buf = lockfile.buffers.string_bytes.as_slice();
+        let pkg_names = lockfile.packages.items_name();
+        let pkg_resolutions = lockfile.packages.items_resolution();
+        let range = lockfile.catalogs.resolve_range(buf, peer);
+        self.log.add_warning_fmt(
+            None,
+            bun_ast::Loc::EMPTY,
+            format_args!(
+                "incorrect peer dependency \"{}@{}\": \"{}@{}\" requires \"{}@{}\"",
+                pkg_names[copy_id as usize].fmt(buf),
+                pkg_resolutions[copy_id as usize].fmt(buf, PathSep::Posix),
+                pkg_names[dependent_id as usize].fmt(buf),
+                pkg_resolutions[dependent_id as usize].fmt(buf, PathSep::Posix),
+                peer.name.fmt(buf),
+                range.literal.fmt(buf),
+            ),
+        );
+    }
+
     fn buf(&self) -> &[u8] {
         self.lockfile().buffers.string_bytes.as_slice()
     }
@@ -925,6 +957,12 @@ impl Tree {
                     debug_assert!(dependency.behavior.is_optional_peer());
                     builder.resolutions[dep_id as usize] = res_id;
                 }
+                HoistDependencyResult::HoistedOutOfRange(res_id) => {
+                    // Resolvable builds also run on load and clean; only the installed tree warns.
+                    if METHOD == BuilderMethod::Filter {
+                        builder.warn_peer_out_of_range(parent_pkg_id, dependency, res_id);
+                    }
+                }
                 HoistDependencyResult::ResolveLater => {
                     // `dep_id` is an unresolved peer. while hoisting it deduplicated
                     // with another unresolved peer. save it so we remember resolve it
@@ -1075,8 +1113,24 @@ impl Tree {
                 // Root dependencies are manually chosen by the user. Allow them
                 // to hoist other peers even if they don't satisfy the version
                 if builder.lockfile().is_workspace_root_dependency(dep_id) {
-                    // TODO: warning about peer dependency version mismatch
-                    return dedupe(); // 1
+                    // Optional peers take whatever the tree offers, as they do in the resolver.
+                    let rejected = !dependency.behavior.is_optional_peer()
+                        && peer_range.tag == crate::dependency::VersionTag::Npm
+                        && builder
+                            .lockfile()
+                            .package_version(res_id)
+                            .is_some_and(|copy| {
+                                !peer_range.npm().version.satisfies(
+                                    copy,
+                                    builder.buf(),
+                                    builder.buf(),
+                                )
+                            });
+                    return if rejected {
+                        HoistDependencyResult::HoistedOutOfRange(res_id) // 1
+                    } else {
+                        dedupe() // 1
+                    };
                 }
             }
 
diff --git a/test/cli/install/hoist.test.ts b/test/cli/install/hoist.test.ts
index 8fc6230cdc2d..3cffc2986e96 100644
--- a/test/cli/install/hoist.test.ts
+++ b/test/cli/install/hoist.test.ts
@@ -1,5 +1,6 @@
 import { file, write } from "bun";
 import { afterAll, beforeAll, expect, test } from "bun:test";
+import { readFileSync } from "fs";
 import { exists, rm } from "fs/promises";
 import { VerdaccioRegistry, bunEnv, bunExe, runBunInstall } from "harness";
 import { join } from "path";
@@ -280,3 +281,170 @@ test("a cycle closed through an optional peer is installed", async () => {
     },
   );
 });
+
+// A peer whose own resolution conflicts with the copy the root package.json put
+// at the top of node_modules is served by the root's copy whatever its range
+// says (Tree.hoist_dependency). The install doing that has to say so; the
+// resolver's own `incorrect peer dependency` warning only covers peers it bound
+// out of range itself.
+const peerWarnings = (stderr: string) => stderr.match(/^warn: incorrect peer dependency [^\r\n]*/gm) ?? [];
+// CI exports BUN_INSTALL_CACHE_DIR, which overrides the harness bunfig's per-test `cache`; concurrent cases sharing one cache race on Windows.
+const installEnv = (dir: string) => ({ ...bunEnv, BUN_INSTALL_CACHE_DIR: join(dir, ".bun-cache") });
+const installedVersion = async (packageDir: string, ...path: string[]) =>
+  (await file(join(packageDir, "node_modules", ...path, "package.json")).json()).version;
+const hasOwnNodeModules = (packageDir: string, name: string) =>
+  exists(join(packageDir, "node_modules", name, "node_modules"));
+
+test.concurrent("warns when a workspace member's peer is served by a root dependency outside its range", async () => {
+  const rootPackageJson = (noDeps: string) =>
+    JSON.stringify({ name: "root", workspaces: ["packages/*"], dependencies: { "no-deps": noDeps } });
+  const { packageDir, packageJson } = await registry.createTestDir({
+    bunfigOpts: { linker: "hoisted" },
+    files: {
+      "package.json": rootPackageJson("^1.0.0"),
+      "packages/pkg1/package.json": JSON.stringify({
+        name: "pkg1",
+        version: "1.0.0",
+        peerDependencies: { "no-deps": "^1.0.0" },
+      }),
+    },
+  });
+
+  // The member's peer binds to the root's no-deps@1.1.0: nothing to report.
+  await runBunInstall(installEnv(packageDir), packageDir);
+  expect(await installedVersion(packageDir, "no-deps")).toBe("1.1.0");
+
+  // The peer stays bound to 1.1.0, but the tree only has room for the root's
+  // new copy, so pkg1 gets no-deps@2.0.0. Reported once: the tree is also built
+  // while loading and cleaning the lockfile, and those builds stay quiet.
+  await write(packageJson, rootPackageJson("^2.0.0"));
+  const { err } = await runBunInstall(installEnv(packageDir), packageDir, { allowWarnings: true });
+  expect(peerWarnings(err)).toEqual([
+    'warn: incorrect peer dependency "no-deps@2.0.0": "pkg1@workspace:packages/pkg1" requires "no-deps@^1.0.0"',
+  ]);
+  expect(await installedVersion(packageDir, "no-deps")).toBe("2.0.0");
+  expect(await hasOwnNodeModules(packageDir, "pkg1")).toBe(false);
+});
+
+test.concurrent(
+  "warns on every install while a dependency's peer is served by a root dependency outside its range",
+  async () => {
+    const { packageDir } = await registry.createTestDir({
+      bunfigOpts: { linker: "hoisted" },
+      files: {
+        "package.json": JSON.stringify({
+          name: "root",
+          dependencies: {
+            // peer-deps-fixed@1.0.0 has a peer on no-deps@^1.0.0.
+            // provides-peer-deps-1-0-0 depends on no-deps@1.0.0, which the
+            // resolver binds that peer to, so the resolver itself has nothing
+            // to warn about.
+            "peer-deps-fixed": "1.0.0",
+            "no-deps": "2.0.0",
+            "provides-peer-deps-1-0-0": "1.0.0",
+          },
+        }),
+      },
+    });
+    const expected =
+      'warn: incorrect peer dependency "no-deps@2.0.0": "peer-deps-fixed@1.0.0" requires "no-deps@^1.0.0"';
+
+    const fresh = await runBunInstall(installEnv(packageDir), packageDir, { allowWarnings: true });
+    expect(peerWarnings(fresh.err)).toEqual([expected]);
+    expect(await installedVersion(packageDir, "no-deps")).toBe("2.0.0");
+    expect(await installedVersion(packageDir, "provides-peer-deps-1-0-0", "node_modules", "no-deps")).toBe("1.0.0");
+    expect(await hasOwnNodeModules(packageDir, "peer-deps-fixed")).toBe(false);
+
+    // Nothing changed, so the same tree gets installed again.
+    const again = await runBunInstall(installEnv(packageDir), packageDir, {
+      allowWarnings: true,
+      savesLockfile: false,
+    });
+    expect(peerWarnings(again.err)).toEqual([expected]);
+  },
+);
+
+// The root provides no-deps as something other than a registry package. A
+// workspace is checked through its own version; a copy with no version in the
+// lockfile (a tarball here, git would be the same) cannot be checked and is
+// never reported.
+const workspaceNoDeps = (version?: string) => ({
+  "packages/no-deps/package.json": JSON.stringify({ name: "no-deps", version }),
+});
+const tarballNoDeps = {
+  "no-deps-2.0.0.tgz": readFileSync(join(registry.packagesPath, "no-deps", "no-deps-2.0.0.tgz")),
+};
+test.concurrent.each([
+  [
+    "a workspace at 2.0.0",
+    "warns",
+    workspaceNoDeps("2.0.0"),
+    {},
+    [
+      'warn: incorrect peer dependency "no-deps@workspace:packages/no-deps": "peer-deps-fixed@1.0.0" requires "no-deps@^1.0.0"',
+    ],
+    "2.0.0",
+  ],
+  ["a workspace at 1.5.0", "is quiet", workspaceNoDeps("1.5.0"), {}, [], "1.5.0"],
+  ["a workspace without a version", "is quiet", workspaceNoDeps(), {}, [], undefined],
+  ["a file: tarball of 2.0.0", "is quiet", tarballNoDeps, { "no-deps": "file:./no-deps-2.0.0.tgz" }, [], "2.0.0"],
+])(
+  "root-provided no-deps (%s) serving a dependency's no-deps@^1.0.0 peer %s",
+  async (_, __, files, noDepsDependency, warnings, installed) => {
+    const { packageDir } = await registry.createTestDir({
+      bunfigOpts: { linker: "hoisted" },
+      files: {
+        ...files,
+        "package.json": JSON.stringify({
+          name: "root",
+          workspaces: ["packages/*"],
+          dependencies: { "peer-deps-fixed": "1.0.0", "provides-peer-deps-1-0-0": "1.0.0", ...noDepsDependency },
+        }),
+      },
+    });
+
+    const { err } = await runBunInstall(installEnv(packageDir), packageDir, { allowWarnings: warnings.length > 0 });
+    expect(peerWarnings(err)).toEqual(warnings);
+    expect(await installedVersion(packageDir, "no-deps")).toBe(installed);
+    expect(await installedVersion(packageDir, "provides-peer-deps-1-0-0", "node_modules", "no-deps")).toBe("1.0.0");
+    expect(await hasOwnNodeModules(packageDir, "peer-deps-fixed")).toBe(false);
+  },
+);
+
+// one-optional-peer-dep has a peer on no-deps@^1.0.0: required in 1.0.1, optional in 1.0.2.
+test.concurrent.each([
+  [
+    "1.0.1",
+    "is reported",
+    ['warn: incorrect peer dependency "no-deps@2.0.0": "one-optional-peer-dep@1.0.1" requires "no-deps@^1.0.0"'],
+  ],
+  ["1.0.2", "is rebound quietly", []],
+])(
+  "a peer of one-optional-peer-dep@%s left on no-deps@1.0.0 when the root moves to 2.0.0 %s",
+  async (version, _, warnings) => {
+    const rootPackageJson = (noDeps: string) =>
+      JSON.stringify({
+        name: "root",
+        dependencies: {
+          "one-optional-peer-dep": version,
+          "no-deps": noDeps,
+          // Keeps no-deps@1.0.0, and with it the peer's binding to it, in the lockfile after the root moves on.
+          "provides-peer-deps-1-0-0": "1.0.0",
+        },
+      });
+    const { packageDir, packageJson } = await registry.createTestDir({
+      bunfigOpts: { linker: "hoisted" },
+      files: { "package.json": rootPackageJson("1.0.0") },
+    });
+
+    await runBunInstall(installEnv(packageDir), packageDir);
+    expect(await installedVersion(packageDir, "no-deps")).toBe("1.0.0");
+
+    await write(packageJson, rootPackageJson("2.0.0"));
+    const { err } = await runBunInstall(installEnv(packageDir), packageDir, { allowWarnings: warnings.length > 0 });
+    expect(peerWarnings(err)).toEqual(warnings);
+    expect(await installedVersion(packageDir, "no-deps")).toBe("2.0.0");
+    expect(await installedVersion(packageDir, "provides-peer-deps-1-0-0", "node_modules", "no-deps")).toBe("1.0.0");
+    expect(await hasOwnNodeModules(packageDir, "one-optional-peer-dep")).toBe(false);
+  },
+);

From 9e16aa9ea8e81af1d20be783ae037e37576aa996 Mon Sep 17 00:00:00 2001
From: robobun <117481402+robobun@users.noreply.github.com>
Date: Mon, 17 Aug 2026 01:39:17 +0000
Subject: [PATCH 117/258] install: stamp lockfileVersion 1 on new bun.lock
 files (#38741)

---
 docs/pm/catalogs.mdx                          |  2 +-
 docs/pm/lockfile.mdx                          |  4 +
 src/install/lockfile/bun.lock.rs              | 82 +++++------------
 .../bun-install-registry.test.ts.snap         | 12 +--
 .../__snapshots__/bun-lock.test.ts.snap       | 20 ++--
 .../__snapshots__/catalogs.test.ts.snap       |  6 +-
 test/cli/install/bun-install.test.ts          |  4 +-
 test/cli/install/bun-workspaces.test.ts       |  2 +-
 test/cli/install/config-version.test.ts       |  4 +-
 test/cli/install/lockfile-version-2.test.ts   | 63 +++++++++++--
 .../__snapshots__/migrate.test.ts.snap        | 92 +++++++++----------
 .../pnpm-comprehensive.test.ts.snap           |  6 +-
 .../pnpm-lock-migration.test.ts.snap          |  6 +-
 .../__snapshots__/pnpm-lock-v9.test.ts.snap   |  2 +-
 .../pnpm-migration-complete.test.ts.snap      | 26 +++---
 .../__snapshots__/pnpm-migration.test.ts.snap |  2 +-
 .../yarn-lock-migration.test.ts.snap          | 24 ++---
 test/cli/install/nested-overrides.test.ts     |  8 +-
 18 files changed, 190 insertions(+), 175 deletions(-)

diff --git a/docs/pm/catalogs.mdx b/docs/pm/catalogs.mdx
index e7893ce0eaf9..8b709a0c3856 100644
--- a/docs/pm/catalogs.mdx
+++ b/docs/pm/catalogs.mdx
@@ -257,7 +257,7 @@ Bun's lockfile tracks catalog versions, so installs are consistent across enviro
 
 ```json bun.lock(excerpt) icon="file-json"
 {
-  "lockfileVersion": 2,
+  "lockfileVersion": 1,
   "workspaces": {
     "": {
       "name": "react-monorepo",
diff --git a/docs/pm/lockfile.mdx b/docs/pm/lockfile.mdx
index 5bec794a3ad5..32be45828d79 100644
--- a/docs/pm/lockfile.mdx
+++ b/docs/pm/lockfile.mdx
@@ -54,6 +54,10 @@ Bun v1.2 changed the default lockfile format to the text-based `bun.lock`. To mi
 
 For more on the format, see [the blog post](https://bun.com/blog/bun-lock-text-lockfile).
 
+#### `lockfileVersion`
+
+The `lockfileVersion` field at the top of `bun.lock` records its format version. A new `bun.lock` is written as `lockfileVersion` 1, which every Bun release since v1.2 can read, and re-saving a `lockfileVersion` 1 or 2 lockfile keeps its version. The exception is [nested or version-scoped overrides](/pm/overrides#limitations): while a lockfile contains those it is written as `lockfileVersion` 3, which requires Bun v1.4 or later, and it goes back to 1 once they are removed.
+
 #### Automatic lockfile migration
 
 When you run `bun install` in a project without a `bun.lock`, Bun automatically migrates existing lockfiles:
diff --git a/src/install/lockfile/bun.lock.rs b/src/install/lockfile/bun.lock.rs
index 0cb524779cd6..fb63557d3aea 100644
--- a/src/install/lockfile/bun.lock.rs
+++ b/src/install/lockfile/bun.lock.rs
@@ -114,6 +114,8 @@ pub enum Version {
     /// - a git `.bun-tag` must be a safe path/checkout component (the same
     ///   check on a `github` tag is enforced at every version, since its
     ///   download path has no checkout-time re-validation)
+    ///
+    /// Same content as v1; only ever preserved, never stamped on a new lockfile.
     V2 = 2,
 
     /// `overrides` values may be objects holding scoped rules (parent-scoped or `name@range` targets); stamped while such rules exist and the package walk in `Stringifier::version_to_write` is v2-clean (object rows themselves parse at every version)
@@ -185,49 +187,25 @@ pub(crate) struct Stringifier;
 impl Stringifier {
     const INDENT_SCALAR: usize = 2;
 
-    /// Pick the `lockfileVersion` to stamp. A lockfile loaded from disk keeps
-    /// the version it already carried — re-saving never silently upgrades an
-    /// existing `bun.lock` to a newer format. `text_lockfile_version` holds the
-    /// parsed version when the lockfile was loaded from text, and defaults to
-    /// `Version::CURRENT` otherwise (a fresh install, or a migration from
-    /// another lockfile format), the "no version previously" case whose stamp
-    /// is decided by the walk below.
-    ///
-    /// The one version that is *not* preserved is v0: v0→v1 was a content-format
-    /// change (v1 stopped listing a workspace package's dependencies as a
-    /// trailing object), and the writer only ever emits the v1+ single-element
-    /// `["name@workspace:path"]` form. Stamping v0 on that output would make the
-    /// next parse fail ("Missing dependencies object"), so a v0 lockfile is
-    /// floored to v1 — the lowest version whose content matches what we write.
-    /// v1→v2, by contrast, only added parse-time strictness on identical
-    /// content, so v1 is preserved as-is.
-    ///
-    /// Scoped overrides (parent-scoped or `name@range` rules) are stamped v3, but
-    /// only after the same walk: a lockfile the walk holds at v1 stays v1 with the
-    /// override objects written as-is, since the parser reads those at every
-    /// version while its v2+ integrity check is evaluated against the *reader's*
-    /// registries — stamping 3 there would make the file config-dependent again.
-    /// A walk-clean lockfile with scoped rules is stamped v3 whatever version was
-    /// loaded. Without scoped rules a lockfile keeps its loaded v1/v2, and a fresh
-    /// or v3-loaded one is walked down to v2, or to v1 on a v2-invariant violation
-    /// (off-registry npm tarball without a supported integrity, unsafe git
-    /// `.bun-tag`); that decision must not depend on the writer's `~/.npmrc`.
-    ///
-    /// Walks the package tree the same way the writer does — only packages that
-    /// are actually serialized are considered, not every entry in the in-memory
-    /// `pkg_resolutions` buffer (migration can leave pruned/unreferenced entries
-    /// there that never reach the written `packages` object).
+    /// The lowest `lockfileVersion` whose readers understand the content being
+    /// written: v1 and v2 are the same content and pre-v2 readers reject the v2
+    /// stamp, so a new lockfile is v1; v3 is stamped only while scoped overrides
+    /// (which older readers would silently drop) exist.
     fn version_to_write(lockfile: &BinaryLockfile) -> Version {
-        let loaded = lockfile.text_lockfile_version;
-        let has_scoped = lockfile.overrides.has_scoped();
-        if !has_scoped && !loaded.at_least(Version::V3) {
-            return if loaded.at_least(Version::V1) {
-                loaded
-            } else {
-                Version::V1
+        if !lockfile.overrides.has_scoped() {
+            return match lockfile.text_lockfile_version {
+                loaded @ (Version::V1 | Version::V2) => loaded,
+                // v0: the writer only emits the v1+ workspace entry shape. v3: a
+                // lockfile that was never loaded sits at `Version::CURRENT`.
+                Version::V0 | Version::V3 => Version::V1,
             };
         }
 
+        // v3 implies the v2 parse checks, which a reader evaluates against its
+        // own registry config. Any serialized row that some reader could reject
+        // holds the file at v1 instead; the override objects parse at every
+        // version. Walk the tree rather than `pkg_resolutions`, which migration
+        // can leave holding entries the writer never emits.
         let buf = lockfile.buffers.string_bytes.as_slice();
         let deps_buf = lockfile.buffers.dependencies.as_slice();
         let resolution_buf = lockfile.buffers.resolutions.as_slice();
@@ -255,29 +233,19 @@ impl Stringifier {
                         if pkg_metas[i].integrity.tag.is_supported() {
                             continue;
                         }
-                        // No supported integrity: only v2-clean if the tarball
-                        // URL is under the *default* registry, the one case the
-                        // writer normalizes to `""` (see the npm URL
-                        // serialization in `save_from_binary`). An empty
-                        // URL never sets the parser's `npm_url_needs_integrity`,
-                        // so that round-trips for any reader. A URL under a
-                        // configured-but-not-default scope is written verbatim,
-                        // and the parser's integrity check is evaluated against
-                        // the *reader's* scope config, so it is not
-                        // config-independent: a writer with a private `@scope`
-                        // registry could stamp v2 on a lockfile a teammate
-                        // without that scope then fails to parse. Stay at v1 for
-                        // those so the file keeps loading everywhere.
+                        // Only a default-registry URL is config-independent: the
+                        // writer serializes it as `""`, which never trips the
+                        // parser's `npm_url_needs_integrity`. A URL under one of
+                        // the writer's own scopes is written verbatim and a reader
+                        // without that scope would reject it.
                         let url = res.npm().url.slice(buf);
                         if !url_is_under_registry(url, Npm::Registry::DEFAULT_URL.as_bytes()) {
                             return Version::V1;
                         }
                     }
                     ResolutionTag::Git => {
-                        // An unsafe git `.bun-tag` is only rejected at v2, so
-                        // staying at v1 keeps it loading. (A `github` tag is
-                        // rejected at every version, so no lockfile version can
-                        // round-trip an unsafe one — nothing to gate here.)
+                        // A `github` tag is rejected at every version, so there is
+                        // nothing to gate for it.
                         if !crate::repository::is_safe_resolved_tag(
                             res.repository().resolved.slice(buf),
                         ) {
@@ -288,7 +256,7 @@ impl Stringifier {
                 }
             }
         }
-        if has_scoped { Version::V3 } else { Version::V2 }
+        Version::V3
     }
 
     pub(crate) fn save_from_binary(
diff --git a/test/cli/install/__snapshots__/bun-install-registry.test.ts.snap b/test/cli/install/__snapshots__/bun-install-registry.test.ts.snap
index 38dc82f3392d..9d30c8a6e83f 100644
--- a/test/cli/install/__snapshots__/bun-install-registry.test.ts.snap
+++ b/test/cli/install/__snapshots__/bun-install-registry.test.ts.snap
@@ -10,7 +10,7 @@ exports[`auto-install symlinks (and junctions) are created correctly in the inst
 
 exports[`text lockfile workspace sorting 1`] = `
 "{
-  "lockfileVersion": 2,
+  "lockfileVersion": 1,
   "configVersion": 1,
   "workspaces": {
     "": {
@@ -45,7 +45,7 @@ exports[`text lockfile workspace sorting 1`] = `
 
 exports[`text lockfile workspace sorting 2`] = `
 "{
-  "lockfileVersion": 2,
+  "lockfileVersion": 1,
   "configVersion": 1,
   "workspaces": {
     "": {
@@ -88,7 +88,7 @@ exports[`text lockfile workspace sorting 2`] = `
 
 exports[`text lockfile --frozen-lockfile 1`] = `
 "{
-  "lockfileVersion": 2,
+  "lockfileVersion": 1,
   "configVersion": 1,
   "workspaces": {
     "": {
@@ -120,7 +120,7 @@ exports[`text lockfile --frozen-lockfile 1`] = `
 
 exports[`binaries each type of binary serializes correctly to text lockfile 1`] = `
 "{
-  "lockfileVersion": 2,
+  "lockfileVersion": 1,
   "configVersion": 1,
   "workspaces": {
     "": {
@@ -170,7 +170,7 @@ exports[`binaries root resolution bins 1`] = `
 
 exports[`hoisting text lockfile is hoisted 1`] = `
 "{
-  "lockfileVersion": 2,
+  "lockfileVersion": 1,
   "configVersion": 1,
   "workspaces": {
     "": {
@@ -280,7 +280,7 @@ exports[`outdated NO_COLOR works 1`] = `
 
 exports[`it should ignore peerDependencies within workspaces 1`] = `
 "{
-  "lockfileVersion": 2,
+  "lockfileVersion": 1,
   "configVersion": 1,
   "workspaces": {
     "": {
diff --git a/test/cli/install/__snapshots__/bun-lock.test.ts.snap b/test/cli/install/__snapshots__/bun-lock.test.ts.snap
index 3ea0a20c70d1..77f5c4a45c56 100644
--- a/test/cli/install/__snapshots__/bun-lock.test.ts.snap
+++ b/test/cli/install/__snapshots__/bun-lock.test.ts.snap
@@ -2,7 +2,7 @@
 
 exports[`should write plaintext lockfiles 1`] = `
 "{
-  "lockfileVersion": 2,
+  "lockfileVersion": 1,
   "configVersion": 1,
   "workspaces": {
     "": {
@@ -21,7 +21,7 @@ exports[`should write plaintext lockfiles 1`] = `
 
 exports[`should escape names 1`] = `
 "{
-  "lockfileVersion": 2,
+  "lockfileVersion": 1,
   "configVersion": 1,
   "workspaces": {
     "": {
@@ -48,7 +48,7 @@ exports[`should escape names 1`] = `
 
 exports[`should be the default save format 1`] = `
 "{
-  "lockfileVersion": 2,
+  "lockfileVersion": 1,
   "configVersion": 1,
   "workspaces": {
     "": {
@@ -67,7 +67,7 @@ exports[`should be the default save format 1`] = `
 
 exports[`should be the default save format 2`] = `
 "{
-  "lockfileVersion": 2,
+  "lockfileVersion": 1,
   "configVersion": 1,
   "workspaces": {
     "": {
@@ -89,7 +89,7 @@ exports[`should be the default save format 2`] = `
 
 exports[`should save the lockfile if --save-text-lockfile and --frozen-lockfile are used 1`] = `
 "{
-  "lockfileVersion": 2,
+  "lockfileVersion": 1,
   "configVersion": 1,
   "workspaces": {
     "": {
@@ -108,7 +108,7 @@ exports[`should save the lockfile if --save-text-lockfile and --frozen-lockfile
 
 exports[`should save the lockfile if --save-text-lockfile and --frozen-lockfile are used 2`] = `
 "{
-  "lockfileVersion": 2,
+  "lockfileVersion": 1,
   "configVersion": 1,
   "workspaces": {
     "": {
@@ -130,7 +130,7 @@ exports[`should save the lockfile if --save-text-lockfile and --frozen-lockfile
 
 exports[`should convert a binary lockfile with invalid optional peers 1`] = `
 "{
-  "lockfileVersion": 2,
+  "lockfileVersion": 1,
   "configVersion": 0,
   "workspaces": {
     "": {
@@ -300,7 +300,7 @@ exports[`should not deduplicate bundled packages with un-bundled packages 2`] =
 
 exports[`should not change formatting unexpectedly 2`] = `
 "{
-  "lockfileVersion": 2,
+  "lockfileVersion": 1,
   "configVersion": 1,
   "workspaces": {
     "": {
@@ -400,7 +400,7 @@ exports[`should not change formatting unexpectedly 2`] = `
 
 exports[`should sort overrides before comparing 1`] = `
 "{
-  "lockfileVersion": 2,
+  "lockfileVersion": 1,
   "configVersion": 1,
   "workspaces": {
     "": {
@@ -438,7 +438,7 @@ exports[`should sort overrides before comparing 1`] = `
 
 exports[`should include unused resolutions in the lockfile 1`] = `
 "{
-  "lockfileVersion": 2,
+  "lockfileVersion": 1,
   "configVersion": 1,
   "workspaces": {
     "": {
diff --git a/test/cli/install/__snapshots__/catalogs.test.ts.snap b/test/cli/install/__snapshots__/catalogs.test.ts.snap
index af53eedc5ccc..ced4c76bb008 100644
--- a/test/cli/install/__snapshots__/catalogs.test.ts.snap
+++ b/test/cli/install/__snapshots__/catalogs.test.ts.snap
@@ -2,7 +2,7 @@
 
 exports[`basic detect changes (bun.lock) 1`] = `
 "{
-  "lockfileVersion": 2,
+  "lockfileVersion": 1,
   "configVersion": 1,
   "workspaces": {
     "": {
@@ -37,7 +37,7 @@ exports[`basic detect changes (bun.lock) 1`] = `
 
 exports[`basic detect changes (bun.lock) 2`] = `
 "{
-  "lockfileVersion": 2,
+  "lockfileVersion": 1,
   "configVersion": 1,
   "workspaces": {
     "": {
@@ -72,7 +72,7 @@ exports[`basic detect changes (bun.lock) 2`] = `
 
 exports[`basic detect changes (bun.lock) 3`] = `
 "{
-  "lockfileVersion": 2,
+  "lockfileVersion": 1,
   "configVersion": 1,
   "workspaces": {
     "": {
diff --git a/test/cli/install/bun-install.test.ts b/test/cli/install/bun-install.test.ts
index e4312eb01a6b..de5e2be65221 100644
--- a/test/cli/install/bun-install.test.ts
+++ b/test/cli/install/bun-install.test.ts
@@ -10503,7 +10503,7 @@ describe.concurrent("bun-install", () => {
       expect(await exists(join(ctx.package_dir, "bun.lockb"))).toBeFalse();
       expect(await file(join(ctx.package_dir, "bun.lock")).text()).toMatchInlineSnapshot(`
       "{
-        "lockfileVersion": 2,
+        "lockfileVersion": 1,
         "configVersion": 1,
         "workspaces": {
           "": {
@@ -12565,7 +12565,7 @@ it("installs file: dependencies that depend on each other", async () => {
   using dir = tempDir("file-dep-cycle", fileDepCycleFixture);
   expect(await installFileDepCycle(String(dir))).toMatchInlineSnapshot(`
     "{
-      "lockfileVersion": 2,
+      "lockfileVersion": 1,
       "configVersion": 1,
       "workspaces": {
         "": {
diff --git a/test/cli/install/bun-workspaces.test.ts b/test/cli/install/bun-workspaces.test.ts
index 4a18038f9231..d4bd1b10ff06 100644
--- a/test/cli/install/bun-workspaces.test.ts
+++ b/test/cli/install/bun-workspaces.test.ts
@@ -2507,7 +2507,7 @@ test("matching workspace devDependency and npm peerDependency", async () => {
   expect((await file(join(packageDir, "bun.lock")).text()).replaceAll(/localhost:\d+/g, "localhost:1234"))
     .toMatchInlineSnapshot(`
     "{
-      "lockfileVersion": 2,
+      "lockfileVersion": 1,
       "configVersion": 1,
       "workspaces": {
         "": {
diff --git a/test/cli/install/config-version.test.ts b/test/cli/install/config-version.test.ts
index b15e7855e1eb..57639b6ce732 100644
--- a/test/cli/install/config-version.test.ts
+++ b/test/cli/install/config-version.test.ts
@@ -55,7 +55,7 @@ describe.concurrent("configVersion", () => {
 
     expect(await file(join(packageDir, "bun.lock")).text()).toMatchInlineSnapshot(`
       "{
-        "lockfileVersion": 2,
+        "lockfileVersion": 1,
         "configVersion": 1,
         "workspaces": {
           "": {
@@ -108,7 +108,7 @@ describe.concurrent("configVersion", () => {
 
     expect(await file(join(packageDir, "bun.lock")).text()).toMatchInlineSnapshot(`
       "{
-        "lockfileVersion": 2,
+        "lockfileVersion": 1,
         "configVersion": 1,
         "workspaces": {
           "": {
diff --git a/test/cli/install/lockfile-version-2.test.ts b/test/cli/install/lockfile-version-2.test.ts
index c1104f4f1284..0a541b9502d8 100644
--- a/test/cli/install/lockfile-version-2.test.ts
+++ b/test/cli/install/lockfile-version-2.test.ts
@@ -4,13 +4,18 @@ import { exists } from "fs/promises";
 import { bunExe, bunEnv as env, tempDir } from "harness";
 import { join } from "path";
 
-// These tests cover the text lockfile bump to version 2 and the parse-time
-// checks gated behind it. They run fully offline — using `file:` deps or
-// loopback/unreachable endpoints — so no external network or registry is
-// required.
-
-it("a freshly written text lockfile defaults to version 2", async () => {
-  using dir = tempDir("lockfile-v2-default", {
+// These tests cover text lockfile version 2 (parse-time checks on v1's
+// content) and which version the writer stamps. They run fully offline — using
+// `file:` deps or loopback/unreachable endpoints — so no external network or
+// registry is required.
+
+// v1 and v2 have identical content, and Bun releases before v2 existed reject
+// `lockfileVersion: 2` outright ("Unknown lockfile version"), so a lockfile
+// written from scratch is stamped v1: the first `bun install` of a project
+// must produce a file that a teammate or CI image on an older Bun can still
+// install from with `--frozen-lockfile`.
+it("a freshly written text lockfile is stamped version 1", async () => {
+  using dir = tempDir("lockfile-fresh-v1", {
     "package.json": JSON.stringify({ name: "root", dependencies: { dep: "file:./dep" } }),
     "dep/package.json": JSON.stringify({ name: "dep", version: "1.0.0" }),
   });
@@ -26,15 +31,53 @@ it("a freshly written text lockfile defaults to version 2", async () => {
 
   const lockfile = await file(join(String(dir), "bun.lock")).text();
   expect(err).not.toContain("error:");
-  expect(lockfile).toContain(`"lockfileVersion": 2,`);
+  expect(lockfile).toContain(`"lockfileVersion": 1,`);
+  expect(exitCode).toBe(0);
+});
+
+// An existing v2 lockfile is left alone: the writer neither upgrades nor
+// downgrades a version it loaded, it only avoids introducing v2 on new files.
+it("re-saving a v2 lockfile keeps it at version 2", async () => {
+  const v2Lockfile =
+    JSON.stringify(
+      {
+        lockfileVersion: 2,
+        configVersion: 1,
+        workspaces: { "": { name: "root", dependencies: { a: "file:./a" } } },
+        packages: { a: ["a@file:a", {}] },
+      },
+      null,
+      2,
+    ) + "\n";
+
+  using dir = tempDir("lockfile-v2-preserved", {
+    // package.json asks for a second `file:` dep the lockfile doesn't have yet,
+    // forcing a real re-save (not a no-op skip).
+    "package.json": JSON.stringify({ name: "root", dependencies: { a: "file:./a", b: "file:./b" } }),
+    "a/package.json": JSON.stringify({ name: "a", version: "1.0.0" }),
+    "b/package.json": JSON.stringify({ name: "b", version: "1.0.0" }),
+    "bun.lock": v2Lockfile,
+  });
+
+  await using proc = spawn({
+    cmd: [bunExe(), "install"],
+    cwd: String(dir),
+    env,
+    stdout: "pipe",
+    stderr: "pipe",
+  });
+  const [, err, exitCode] = await Promise.all([proc.stdout.text(), proc.stderr.text(), proc.exited]);
+
+  const after = await file(join(String(dir), "bun.lock")).text();
+  expect(err).not.toContain("error:");
+  expect(after).toContain(`"b": ["b@file:b"`);
+  expect(after).toContain(`"lockfileVersion": 2,`);
   expect(exitCode).toBe(0);
 });
 
 // Re-saving an existing lockfile must never bump its version. A v1 `bun.lock`
 // that is rewritten — here because a new dependency is added — keeps
 // `lockfileVersion: 1`, even though every entry would satisfy the v2 invariants.
-// Only a lockfile with no prior version (fresh install / migration) is written
-// at the current version.
 it("re-saving a v1 lockfile keeps it at version 1 even after adding a dependency", async () => {
   const v1Lockfile =
     JSON.stringify(
diff --git a/test/cli/install/migration/__snapshots__/migrate.test.ts.snap b/test/cli/install/migration/__snapshots__/migrate.test.ts.snap
index ba6aeab1da8c..f9fcf6b9b15f 100644
--- a/test/cli/install/migration/__snapshots__/migrate.test.ts.snap
+++ b/test/cli/install/migration/__snapshots__/migrate.test.ts.snap
@@ -6,7 +6,7 @@ bun pm migrate exit code: 0
 bun install --frozen-lockfile exit code: 0
 
 {
-  "lockfileVersion": 2,
+  "lockfileVersion": 1,
   "configVersion": 1,
   "workspaces": {
     "": {
@@ -1169,7 +1169,7 @@ bun pm migrate exit code: 0
 bun install --frozen-lockfile exit code: 0
 
 {
-  "lockfileVersion": 2,
+  "lockfileVersion": 1,
   "configVersion": 1,
   "workspaces": {
     "": {
@@ -1192,7 +1192,7 @@ bun pm migrate exit code: 0
 bun install --frozen-lockfile exit code: 0
 
 {
-  "lockfileVersion": 2,
+  "lockfileVersion": 1,
   "configVersion": 1,
   "workspaces": {
     "": {
@@ -2703,7 +2703,7 @@ bun pm migrate exit code: 0
 bun install --frozen-lockfile exit code: 1
 
 {
-  "lockfileVersion": 2,
+  "lockfileVersion": 1,
   "configVersion": 1,
   "workspaces": {
     "": {
@@ -2730,7 +2730,7 @@ bun pm migrate exit code: 0
 bun install --frozen-lockfile exit code: 0
 
 {
-  "lockfileVersion": 2,
+  "lockfileVersion": 1,
   "configVersion": 1,
   "workspaces": {
     "": {
@@ -2998,7 +2998,7 @@ bun pm migrate exit code: 0
 bun install --frozen-lockfile exit code: 0
 
 {
-  "lockfileVersion": 2,
+  "lockfileVersion": 1,
   "configVersion": 1,
   "workspaces": {
     "": {
@@ -3023,7 +3023,7 @@ bun pm migrate exit code: 0
 bun install --frozen-lockfile exit code: 0
 
 {
-  "lockfileVersion": 2,
+  "lockfileVersion": 1,
   "configVersion": 1,
   "workspaces": {
     "": {
@@ -3051,7 +3051,7 @@ bun pm migrate exit code: 0
 bun install --frozen-lockfile exit code: 0
 
 {
-  "lockfileVersion": 2,
+  "lockfileVersion": 1,
   "configVersion": 1,
   "workspaces": {
     "": {
@@ -3078,7 +3078,7 @@ bun pm migrate exit code: 0
 bun install --frozen-lockfile exit code: 0
 
 {
-  "lockfileVersion": 2,
+  "lockfileVersion": 1,
   "configVersion": 1,
   "workspaces": {
     "": {
@@ -3574,7 +3574,7 @@ bun pm migrate exit code: 0
 bun install --frozen-lockfile exit code: 0
 
 {
-  "lockfileVersion": 2,
+  "lockfileVersion": 1,
   "configVersion": 1,
   "workspaces": {
     "": {
@@ -3621,7 +3621,7 @@ bun pm migrate exit code: 0
 bun install --frozen-lockfile exit code: 0
 
 {
-  "lockfileVersion": 2,
+  "lockfileVersion": 1,
   "configVersion": 1,
   "workspaces": {
     "": {
@@ -3669,7 +3669,7 @@ bun pm migrate exit code: 0
 bun install --frozen-lockfile exit code: 1
 
 {
-  "lockfileVersion": 2,
+  "lockfileVersion": 1,
   "configVersion": 1,
   "workspaces": {
     "": {
@@ -3710,7 +3710,7 @@ bun pm migrate exit code: 0
 bun install --frozen-lockfile exit code: 1
 
 {
-  "lockfileVersion": 2,
+  "lockfileVersion": 1,
   "configVersion": 1,
   "workspaces": {
     "": {
@@ -3743,7 +3743,7 @@ bun pm migrate exit code: 0
 bun install --frozen-lockfile exit code: 1
 
 {
-  "lockfileVersion": 2,
+  "lockfileVersion": 1,
   "configVersion": 1,
   "workspaces": {
     "": {
@@ -3768,7 +3768,7 @@ bun pm migrate exit code: 0
 bun install --frozen-lockfile exit code: 0
 
 {
-  "lockfileVersion": 2,
+  "lockfileVersion": 1,
   "configVersion": 1,
   "workspaces": {
     "": {
@@ -3835,7 +3835,7 @@ bun pm migrate exit code: 0
 bun install --frozen-lockfile exit code: 0
 
 {
-  "lockfileVersion": 2,
+  "lockfileVersion": 1,
   "configVersion": 1,
   "workspaces": {
     "": {
@@ -3867,7 +3867,7 @@ bun pm migrate exit code: 0
 bun install --frozen-lockfile exit code: 0
 
 {
-  "lockfileVersion": 2,
+  "lockfileVersion": 1,
   "configVersion": 1,
   "workspaces": {
     "": {
@@ -3889,7 +3889,7 @@ bun pm migrate exit code: 0
 bun install --frozen-lockfile exit code: 0
 
 {
-  "lockfileVersion": 2,
+  "lockfileVersion": 1,
   "configVersion": 1,
   "workspaces": {
     "": {
@@ -3913,7 +3913,7 @@ bun pm migrate exit code: 0
 bun install --frozen-lockfile exit code: 0
 
 {
-  "lockfileVersion": 2,
+  "lockfileVersion": 1,
   "configVersion": 1,
   "workspaces": {
     "": {
@@ -3944,7 +3944,7 @@ bun pm migrate exit code: 0
 bun install --frozen-lockfile exit code: 1
 
 {
-  "lockfileVersion": 2,
+  "lockfileVersion": 1,
   "configVersion": 1,
   "workspaces": {
     "": {
@@ -3967,7 +3967,7 @@ bun pm migrate exit code: 0
 bun install --frozen-lockfile exit code: 1
 
 {
-  "lockfileVersion": 2,
+  "lockfileVersion": 1,
   "configVersion": 1,
   "workspaces": {
     "": {
@@ -3990,7 +3990,7 @@ bun pm migrate exit code: 0
 bun install --frozen-lockfile exit code: 0
 
 {
-  "lockfileVersion": 2,
+  "lockfileVersion": 1,
   "configVersion": 1,
   "workspaces": {
     "": {
@@ -4013,7 +4013,7 @@ bun pm migrate exit code: 0
 bun install --frozen-lockfile exit code: 1
 
 {
-  "lockfileVersion": 2,
+  "lockfileVersion": 1,
   "configVersion": 1,
   "workspaces": {
     "": {
@@ -4036,7 +4036,7 @@ bun pm migrate exit code: 0
 bun install --frozen-lockfile exit code: 1
 
 {
-  "lockfileVersion": 2,
+  "lockfileVersion": 1,
   "configVersion": 1,
   "workspaces": {
     "": {
@@ -4061,7 +4061,7 @@ bun pm migrate exit code: 0
 bun install --frozen-lockfile exit code: 0
 
 {
-  "lockfileVersion": 2,
+  "lockfileVersion": 1,
   "configVersion": 1,
   "workspaces": {
     "": {
@@ -4090,7 +4090,7 @@ bun pm migrate exit code: 0
 bun install --frozen-lockfile exit code: 0
 
 {
-  "lockfileVersion": 2,
+  "lockfileVersion": 1,
   "configVersion": 1,
   "workspaces": {
     "": {
@@ -4118,7 +4118,7 @@ bun pm migrate exit code: 0
 bun install --frozen-lockfile exit code: 0
 
 {
-  "lockfileVersion": 2,
+  "lockfileVersion": 1,
   "configVersion": 1,
   "workspaces": {
     "": {
@@ -4218,7 +4218,7 @@ bun pm migrate exit code: 0
 bun install --frozen-lockfile exit code: 1
 
 {
-  "lockfileVersion": 2,
+  "lockfileVersion": 1,
   "configVersion": 1,
   "workspaces": {
     "": {},
@@ -4259,7 +4259,7 @@ bun pm migrate exit code: 0
 bun install --frozen-lockfile exit code: 0
 
 {
-  "lockfileVersion": 2,
+  "lockfileVersion": 1,
   "configVersion": 1,
   "workspaces": {
     "": {
@@ -4282,7 +4282,7 @@ bun pm migrate exit code: 0
 bun install --frozen-lockfile exit code: 0
 
 {
-  "lockfileVersion": 2,
+  "lockfileVersion": 1,
   "configVersion": 1,
   "workspaces": {
     "": {
@@ -4313,7 +4313,7 @@ bun pm migrate exit code: 0
 bun install --frozen-lockfile exit code: 0
 
 {
-  "lockfileVersion": 2,
+  "lockfileVersion": 1,
   "configVersion": 1,
   "workspaces": {
     "": {
@@ -4345,7 +4345,7 @@ bun pm migrate exit code: 0
 bun install --frozen-lockfile exit code: 0
 
 {
-  "lockfileVersion": 2,
+  "lockfileVersion": 1,
   "configVersion": 1,
   "workspaces": {
     "": {
@@ -4409,7 +4409,7 @@ bun pm migrate exit code: 0
 bun install --frozen-lockfile exit code: 0
 
 {
-  "lockfileVersion": 2,
+  "lockfileVersion": 1,
   "configVersion": 1,
   "workspaces": {
     "": {
@@ -4552,7 +4552,7 @@ bun pm migrate exit code: 0
 bun install --frozen-lockfile exit code: 0
 
 {
-  "lockfileVersion": 2,
+  "lockfileVersion": 1,
   "configVersion": 1,
   "workspaces": {
     "": {
@@ -4574,7 +4574,7 @@ bun pm migrate exit code: 0
 bun install --frozen-lockfile exit code: 1
 
 {
-  "lockfileVersion": 2,
+  "lockfileVersion": 1,
   "configVersion": 1,
   "workspaces": {
     "": {},
@@ -4596,7 +4596,7 @@ bun pm migrate exit code: 0
 bun install --frozen-lockfile exit code: 0
 
 {
-  "lockfileVersion": 2,
+  "lockfileVersion": 1,
   "configVersion": 1,
   "workspaces": {
     "": {
@@ -4641,7 +4641,7 @@ bun pm migrate exit code: 0
 bun install --frozen-lockfile exit code: 0
 
 {
-  "lockfileVersion": 2,
+  "lockfileVersion": 1,
   "configVersion": 1,
   "workspaces": {
     "": {
@@ -4670,7 +4670,7 @@ bun pm migrate exit code: 0
 bun install --frozen-lockfile exit code: 0
 
 {
-  "lockfileVersion": 2,
+  "lockfileVersion": 1,
   "configVersion": 1,
   "workspaces": {
     "": {
@@ -4704,7 +4704,7 @@ bun pm migrate exit code: 0
 bun install --frozen-lockfile exit code: 0
 
 {
-  "lockfileVersion": 2,
+  "lockfileVersion": 1,
   "configVersion": 1,
   "workspaces": {
     "": {
@@ -4753,7 +4753,7 @@ bun pm migrate exit code: 0
 bun install --frozen-lockfile exit code: 0
 
 {
-  "lockfileVersion": 2,
+  "lockfileVersion": 1,
   "configVersion": 1,
   "workspaces": {
     "": {
@@ -4786,7 +4786,7 @@ bun pm migrate exit code: 0
 bun install --frozen-lockfile exit code: 0
 
 {
-  "lockfileVersion": 2,
+  "lockfileVersion": 1,
   "configVersion": 1,
   "workspaces": {
     "": {
@@ -4842,7 +4842,7 @@ bun pm migrate exit code: 0
 bun install --frozen-lockfile exit code: 0
 
 {
-  "lockfileVersion": 2,
+  "lockfileVersion": 1,
   "configVersion": 1,
   "workspaces": {
     "": {
@@ -4875,7 +4875,7 @@ bun pm migrate exit code: 0
 bun install --frozen-lockfile exit code: 0
 
 {
-  "lockfileVersion": 2,
+  "lockfileVersion": 1,
   "configVersion": 1,
   "workspaces": {
     "": {
@@ -4902,7 +4902,7 @@ bun pm migrate exit code: 0
 bun install --frozen-lockfile exit code: 0
 
 {
-  "lockfileVersion": 2,
+  "lockfileVersion": 1,
   "configVersion": 1,
   "workspaces": {
     "": {
@@ -4933,7 +4933,7 @@ bun pm migrate exit code: 0
 bun install --frozen-lockfile exit code: 0
 
 {
-  "lockfileVersion": 2,
+  "lockfileVersion": 1,
   "configVersion": 1,
   "workspaces": {
     "": {
@@ -4968,7 +4968,7 @@ bun pm migrate exit code: 0
 bun install --frozen-lockfile exit code: 0
 
 {
-  "lockfileVersion": 2,
+  "lockfileVersion": 1,
   "configVersion": 1,
   "workspaces": {
     "": {
diff --git a/test/cli/install/migration/__snapshots__/pnpm-comprehensive.test.ts.snap b/test/cli/install/migration/__snapshots__/pnpm-comprehensive.test.ts.snap
index af8a1be1963e..797b3bbf999c 100644
--- a/test/cli/install/migration/__snapshots__/pnpm-comprehensive.test.ts.snap
+++ b/test/cli/install/migration/__snapshots__/pnpm-comprehensive.test.ts.snap
@@ -2,7 +2,7 @@
 
 exports[`pnpm comprehensive migration tests large single package with many dependencies: large-single-package 1`] = `
 "{
-  "lockfileVersion": 2,
+  "lockfileVersion": 1,
   "configVersion": 1,
   "workspaces": {
     "": {
@@ -100,7 +100,7 @@ exports[`pnpm comprehensive migration tests large single package with many depen
 
 exports[`pnpm comprehensive migration tests complex monorepo with cross-dependencies: complex-monorepo 1`] = `
 "{
-  "lockfileVersion": 2,
+  "lockfileVersion": 1,
   "configVersion": 1,
   "workspaces": {
     "": {
@@ -295,7 +295,7 @@ exports[`pnpm comprehensive migration tests pnpm with patches and overrides: pat
 
 exports[`pnpm comprehensive migration tests pnpm with peer dependencies and auto-install-peers: peer-deps-auto-install 1`] = `
 "{
-  "lockfileVersion": 2,
+  "lockfileVersion": 1,
   "configVersion": 1,
   "workspaces": {
     "": {
diff --git a/test/cli/install/migration/__snapshots__/pnpm-lock-migration.test.ts.snap b/test/cli/install/migration/__snapshots__/pnpm-lock-migration.test.ts.snap
index b57fba25cfe3..2154f3eaae71 100644
--- a/test/cli/install/migration/__snapshots__/pnpm-lock-migration.test.ts.snap
+++ b/test/cli/install/migration/__snapshots__/pnpm-lock-migration.test.ts.snap
@@ -2,7 +2,7 @@
 
 exports[`pnpm-lock.yaml migration simple pnpm lockfile migration produces correct bun.lock: simple-pnpm-migration 1`] = `
 "{
-  "lockfileVersion": 2,
+  "lockfileVersion": 1,
   "configVersion": 1,
   "workspaces": {
     "": {
@@ -24,7 +24,7 @@ exports[`pnpm-lock.yaml migration simple pnpm lockfile migration produces correc
 
 exports[`pnpm-lock.yaml migration pnpm workspace lockfile migration: workspace-pnpm-migration 1`] = `
 "{
-  "lockfileVersion": 2,
+  "lockfileVersion": 1,
   "configVersion": 1,
   "workspaces": {
     "": {
@@ -86,7 +86,7 @@ exports[`pnpm-lock.yaml migration pnpm workspace lockfile migration: workspace-p
 
 exports[`pnpm-lock.yaml migration pnpm with npm protocol aliases: npm-aliases-pnpm-migration 1`] = `
 "{
-  "lockfileVersion": 2,
+  "lockfileVersion": 1,
   "configVersion": 1,
   "workspaces": {
     "": {
diff --git a/test/cli/install/migration/__snapshots__/pnpm-lock-v9.test.ts.snap b/test/cli/install/migration/__snapshots__/pnpm-lock-v9.test.ts.snap
index 8f622d8afc82..af5cfc98db37 100644
--- a/test/cli/install/migration/__snapshots__/pnpm-lock-v9.test.ts.snap
+++ b/test/cli/install/migration/__snapshots__/pnpm-lock-v9.test.ts.snap
@@ -29,7 +29,7 @@ exports[`pnpm-lock.yaml v9 v9 git and userinfo-tarball references migrate: bun.l
 
 exports[`pnpm-lock.yaml v9 snapshot alias whose dep-path version is a file: directory or tarball: bun.lock 1`] = `
 "{
-  "lockfileVersion": 2,
+  "lockfileVersion": 1,
   "configVersion": 1,
   "workspaces": {
     "": {
diff --git a/test/cli/install/migration/__snapshots__/pnpm-migration-complete.test.ts.snap b/test/cli/install/migration/__snapshots__/pnpm-migration-complete.test.ts.snap
index 51f7da457372..3b5814f568c5 100644
--- a/test/cli/install/migration/__snapshots__/pnpm-migration-complete.test.ts.snap
+++ b/test/cli/install/migration/__snapshots__/pnpm-migration-complete.test.ts.snap
@@ -2,7 +2,7 @@
 
 exports[`PNPM Migration Complete Test Suite comprehensive PNPM migration with all edge cases: basic-dependencies 1`] = `
 "{
-  "lockfileVersion": 2,
+  "lockfileVersion": 1,
   "configVersion": 1,
   "workspaces": {
     "": {
@@ -33,7 +33,7 @@ exports[`PNPM Migration Complete Test Suite comprehensive PNPM migration with al
 
 exports[`PNPM Migration Complete Test Suite comprehensive PNPM migration with all edge cases: canary-versions 1`] = `
 "{
-  "lockfileVersion": 2,
+  "lockfileVersion": 1,
   "configVersion": 1,
   "workspaces": {
     "": {
@@ -58,7 +58,7 @@ exports[`PNPM Migration Complete Test Suite comprehensive PNPM migration with al
 
 exports[`PNPM Migration Complete Test Suite comprehensive PNPM migration with all edge cases: monorepo-workspaces 1`] = `
 "{
-  "lockfileVersion": 2,
+  "lockfileVersion": 1,
   "configVersion": 1,
   "workspaces": {
     "": {
@@ -112,7 +112,7 @@ exports[`PNPM Migration Complete Test Suite comprehensive PNPM migration with al
 
 exports[`PNPM Migration Complete Test Suite comprehensive PNPM migration with all edge cases: patches-overrides 1`] = `
 "{
-  "lockfileVersion": 2,
+  "lockfileVersion": 1,
   "configVersion": 1,
   "workspaces": {
     "": {
@@ -137,7 +137,7 @@ exports[`PNPM Migration Complete Test Suite comprehensive PNPM migration with al
 
 exports[`PNPM Migration Complete Test Suite comprehensive PNPM migration with all edge cases: file-link-deps 1`] = `
 "{
-  "lockfileVersion": 2,
+  "lockfileVersion": 1,
   "configVersion": 1,
   "workspaces": {
     "": {
@@ -159,7 +159,7 @@ exports[`PNPM Migration Complete Test Suite comprehensive PNPM migration with al
 
 exports[`PNPM Migration Complete Test Suite comprehensive PNPM migration with all edge cases: custom-registries 1`] = `
 "{
-  "lockfileVersion": 2,
+  "lockfileVersion": 1,
   "configVersion": 1,
   "workspaces": {
     "": {
@@ -181,7 +181,7 @@ exports[`PNPM Migration Complete Test Suite comprehensive PNPM migration with al
 
 exports[`PNPM Migration Complete Test Suite comprehensive PNPM migration with all edge cases: peer-dependencies 1`] = `
 "{
-  "lockfileVersion": 2,
+  "lockfileVersion": 1,
   "configVersion": 1,
   "workspaces": {
     "": {
@@ -210,7 +210,7 @@ exports[`PNPM Migration Complete Test Suite comprehensive PNPM migration with al
 
 exports[`PNPM Migration Complete Test Suite comprehensive PNPM migration with all edge cases: duplicate-packages 1`] = `
 "{
-  "lockfileVersion": 2,
+  "lockfileVersion": 1,
   "configVersion": 1,
   "workspaces": {
     "": {
@@ -242,7 +242,7 @@ exports[`PNPM Migration Complete Test Suite comprehensive PNPM migration with al
 
 exports[`PNPM Migration Complete Test Suite comprehensive PNPM migration with all edge cases: catalogs 1`] = `
 "{
-  "lockfileVersion": 2,
+  "lockfileVersion": 1,
   "configVersion": 1,
   "workspaces": {
     "": {
@@ -278,7 +278,7 @@ exports[`PNPM Migration Complete Test Suite comprehensive PNPM migration with al
 
 exports[`PNPM Migration Complete Test Suite comprehensive PNPM migration with all edge cases: integrity-hashes 1`] = `
 "{
-  "lockfileVersion": 2,
+  "lockfileVersion": 1,
   "configVersion": 1,
   "workspaces": {
     "": {
@@ -300,7 +300,7 @@ exports[`PNPM Migration Complete Test Suite comprehensive PNPM migration with al
 
 exports[`PNPM Migration Complete Test Suite comprehensive PNPM migration with all edge cases: version-zero 1`] = `
 "{
-  "lockfileVersion": 2,
+  "lockfileVersion": 1,
   "configVersion": 1,
   "workspaces": {
     "": {
@@ -319,7 +319,7 @@ exports[`PNPM Migration Complete Test Suite comprehensive PNPM migration with al
 
 exports[`PNPM Migration Complete Test Suite comprehensive PNPM migration with all edge cases: mixed-dependency-types 1`] = `
 "{
-  "lockfileVersion": 2,
+  "lockfileVersion": 1,
   "configVersion": 1,
   "workspaces": {
     "": {
@@ -354,7 +354,7 @@ exports[`PNPM Migration Complete Test Suite comprehensive PNPM migration with al
 
 exports[`PNPM Migration Complete Test Suite comprehensive PNPM migration with all edge cases: circular-workspaces 1`] = `
 "{
-  "lockfileVersion": 2,
+  "lockfileVersion": 1,
   "configVersion": 1,
   "workspaces": {
     "": {
diff --git a/test/cli/install/migration/__snapshots__/pnpm-migration.test.ts.snap b/test/cli/install/migration/__snapshots__/pnpm-migration.test.ts.snap
index 2cde151b715f..d89564fc7440 100644
--- a/test/cli/install/migration/__snapshots__/pnpm-migration.test.ts.snap
+++ b/test/cli/install/migration/__snapshots__/pnpm-migration.test.ts.snap
@@ -2,7 +2,7 @@
 
 exports[`basic: bun.lock 1`] = `
 "{
-  "lockfileVersion": 2,
+  "lockfileVersion": 1,
   "configVersion": 1,
   "workspaces": {
     "": {
diff --git a/test/cli/install/migration/__snapshots__/yarn-lock-migration.test.ts.snap b/test/cli/install/migration/__snapshots__/yarn-lock-migration.test.ts.snap
index c0e389462c75..ca391e28e224 100644
--- a/test/cli/install/migration/__snapshots__/yarn-lock-migration.test.ts.snap
+++ b/test/cli/install/migration/__snapshots__/yarn-lock-migration.test.ts.snap
@@ -2,7 +2,7 @@
 
 exports[`yarn.lock migration basic simple yarn.lock migration produces correct bun.lock: simple-yarn-migration 1`] = `
 "{
-  "lockfileVersion": 2,
+  "lockfileVersion": 1,
   "configVersion": 1,
   "workspaces": {
     "": {
@@ -21,7 +21,7 @@ exports[`yarn.lock migration basic simple yarn.lock migration produces correct b
 
 exports[`yarn.lock migration basic complex yarn.lock with multiple dependencies and versions: complex-yarn-migration 1`] = `
 "{
-  "lockfileVersion": 2,
+  "lockfileVersion": 1,
   "configVersion": 1,
   "workspaces": {
     "": {
@@ -169,7 +169,7 @@ exports[`yarn.lock migration basic complex yarn.lock with multiple dependencies
 
 exports[`yarn.lock migration basic yarn.lock with npm aliases: aliases-yarn-migration 1`] = `
 "{
-  "lockfileVersion": 2,
+  "lockfileVersion": 1,
   "configVersion": 1,
   "workspaces": {
     "": {
@@ -222,7 +222,7 @@ exports[`yarn.lock migration basic yarn.lock with resolutions: resolutions-yarn-
 
 exports[`yarn.lock migration basic yarn.lock with workspace dependencies: workspace-yarn-migration 1`] = `
 "{
-  "lockfileVersion": 2,
+  "lockfileVersion": 1,
   "configVersion": 1,
   "workspaces": {
     "": {
@@ -241,7 +241,7 @@ exports[`yarn.lock migration basic yarn.lock with workspace dependencies: worksp
 
 exports[`yarn.lock migration basic yarn.lock with scoped packages and parent/child relationships: scoped-yarn-migration 1`] = `
 "{
-  "lockfileVersion": 2,
+  "lockfileVersion": 1,
   "configVersion": 1,
   "workspaces": {
     "": {
@@ -269,7 +269,7 @@ exports[`yarn.lock migration basic yarn.lock with scoped packages and parent/chi
 
 exports[`yarn.lock migration basic migration with realistic complex yarn.lock: complex-realistic-yarn-migration 1`] = `
 "{
-  "lockfileVersion": 2,
+  "lockfileVersion": 1,
   "configVersion": 1,
   "workspaces": {
     "": {
@@ -324,7 +324,7 @@ exports[`yarn.lock migration basic migration with realistic complex yarn.lock: c
 
 exports[`bun pm migrate for existing yarn.lock yarn-cli-repo: yarn-cli-repo 1`] = `
 "{
-  "lockfileVersion": 2,
+  "lockfileVersion": 1,
   "configVersion": 1,
   "workspaces": {
     "": {
@@ -3069,7 +3069,7 @@ exports[`bun pm migrate for existing yarn.lock yarn-cli-repo: yarn-cli-repo 1`]
 
 exports[`bun pm migrate for existing yarn.lock yarn-lock-mkdirp: yarn-lock-mkdirp 1`] = `
 "{
-  "lockfileVersion": 2,
+  "lockfileVersion": 1,
   "configVersion": 1,
   "workspaces": {
     "": {
@@ -3087,7 +3087,7 @@ exports[`bun pm migrate for existing yarn.lock yarn-lock-mkdirp: yarn-lock-mkdir
 
 exports[`bun pm migrate for existing yarn.lock yarn-lock-mkdirp-file-dep: yarn-lock-mkdirp-file-dep 1`] = `
 "{
-  "lockfileVersion": 2,
+  "lockfileVersion": 1,
   "configVersion": 1,
   "workspaces": {
     "": {
@@ -3105,7 +3105,7 @@ exports[`bun pm migrate for existing yarn.lock yarn-lock-mkdirp-file-dep: yarn-l
 
 exports[`bun pm migrate for existing yarn.lock yarn-lock-mkdirp-no-resolved: yarn-lock-mkdirp-no-resolved 1`] = `
 "{
-  "lockfileVersion": 2,
+  "lockfileVersion": 1,
   "configVersion": 1,
   "workspaces": {
     "": {
@@ -3166,7 +3166,7 @@ exports[`bun pm migrate for existing yarn.lock yarn-stuff: yarn-stuff 1`] = `
 
 exports[`bun pm migrate for existing yarn.lock yarn-stuff/abbrev-link-target: yarn-stuff/abbrev-link-target 1`] = `
 "{
-  "lockfileVersion": 2,
+  "lockfileVersion": 1,
   "configVersion": 1,
   "workspaces": {
     "": {
@@ -3180,7 +3180,7 @@ exports[`bun pm migrate for existing yarn.lock yarn-stuff/abbrev-link-target: ya
 
 exports[`bun pm migrate for existing yarn.lock yarn.lock with packages that have os/cpu requirements: os-cpu-yarn-migration 1`] = `
 "{
-  "lockfileVersion": 2,
+  "lockfileVersion": 1,
   "configVersion": 1,
   "workspaces": {
     "": {
diff --git a/test/cli/install/nested-overrides.test.ts b/test/cli/install/nested-overrides.test.ts
index 4a94485c15e5..b2599476ad3f 100644
--- a/test/cli/install/nested-overrides.test.ts
+++ b/test/cli/install/nested-overrides.test.ts
@@ -1248,7 +1248,7 @@ describe.concurrent("lockfile", () => {
     ]);
     await Promise.all([installOk(x), installOk(y), installOk(z)]);
     const xLock = await lock(x);
-    expect(xLock).toContain('"lockfileVersion": 2');
+    expect(xLock).toContain('"lockfileVersion": 1');
     expect(xLock).toContain('\n    "no-deps": "1.0.0",\n');
     expect(await lock(y)).toContain('"lockfileVersion": 3');
     expect(await lock(z)).toContain('"lockfileVersion": 3');
@@ -1266,10 +1266,10 @@ describe.concurrent("lockfile", () => {
     const dir = await project({ dependencies: walkFallbackDeps });
     await installOk(dir);
     const text = await lock(dir);
-    expect(text).toContain('"lockfileVersion": 2');
+    expect(text).toContain('"lockfileVersion": 1');
     expect(text).toContain('one-dep-1.0.0.tgz", ');
     const stripped = text
-      .replace('"lockfileVersion": 2', `"lockfileVersion": ${stampVersion}`)
+      .replace('"lockfileVersion": 1', `"lockfileVersion": ${stampVersion}`)
       .replace(/, "sha512-[^"]*"\]/g, ', ""]');
     expect(stripped).not.toContain("sha512-");
     await write(join(dir, "bun.lock"), stripped);
@@ -1408,7 +1408,7 @@ describe.concurrent("lockfile", () => {
     const after = await lock(dir);
     expect(after).not.toContain('"overrides"');
     expect(after).not.toContain("no-deps@2.0.0");
-    expect(after).toContain('"lockfileVersion": 2');
+    expect(after).toContain('"lockfileVersion": 1');
     await installOk(dir, "--frozen-lockfile");
   });
 

From 4513393ae5325769ffe3e89f75722dd408e388d5 Mon Sep 17 00:00:00 2001
From: robobun <117481402+robobun@users.noreply.github.com>
Date: Mon, 17 Aug 2026 01:40:28 +0000
Subject: [PATCH 118/258] test(install): establish the warm manifest cache
 before the unmet peer test re-resolves (#39190)

---
 test/cli/install/bun-lock.test.ts | 23 +++++++++++++++++++++++
 1 file changed, 23 insertions(+)

diff --git a/test/cli/install/bun-lock.test.ts b/test/cli/install/bun-lock.test.ts
index 5b62298ba891..0c1156924b87 100644
--- a/test/cli/install/bun-lock.test.ts
+++ b/test/cli/install/bun-lock.test.ts
@@ -2055,6 +2055,19 @@ describe.each(["hoisted", "isolated"] as const)("peer no published version satis
     });
   }
 
+  function cacheDir(cwd: string) {
+    return join(cwd, ".bun-cache");
+  }
+
+  // How many manifests the project's installs have written to its cache. The
+  // entries are written by a thread pool task that bun install does not wait
+  // for before exiting (`save_async` in src/install/npm.rs), so the last
+  // manifest an install fetches is occasionally missing. An install that has
+  // to fetch it again writes it again.
+  function cachedManifests(cwd: string) {
+    return Array.from(new Bun.Glob("*.npm").scanSync(cacheDir(cwd))).length;
+  }
+
   it.concurrent("declared by a registry package", async () => {
     using registry = await serveRegistry(manifests);
     using dir = createProject(registry.url, {
@@ -2091,6 +2104,16 @@ describe.each(["hoisted", "isolated"] as const)("peer no published version satis
     expect(err).not.toContain("Ignoring lockfile");
     expect(await file(lockfilePath).text()).toBe(lockfile);
 
+    // The resolve below needs both manifests cached. peer-target's was the last
+    // thing the first install fetched, and nothing was left to do after it, so
+    // its entry is the one that is occasionally missing (see cachedManifests);
+    // resolving without the lockfile fetches and writes it again.
+    for (let retries = 5; retries > 0 && cachedManifests(String(dir)) < 2; retries--) {
+      await rm(lockfilePath);
+      await installWithOwnCache(String(dir));
+    }
+    expect(cachedManifests(String(dir))).toBe(2);
+
     // Resolve from scratch again. Both manifests are cached now, so the peer
     // is looked up synchronously instead of through a network task.
     await rm(lockfilePath);

From 3123ac32dec2e53452adff41c3d7d691a75aca92 Mon Sep 17 00:00:00 2001
From: robobun <117481402+robobun@users.noreply.github.com>
Date: Mon, 17 Aug 2026 01:41:16 +0000
Subject: [PATCH 119/258] install: keep the workspace: spelling given to bun
 add <member>@workspace:<range> (#38866)

---
 .../PackageManager/PackageJSONEditor.rs       | 18 ++++-
 .../install/bun-update-lockfile-sync.test.ts  | 73 +++++++++++++++++++
 2 files changed, 88 insertions(+), 3 deletions(-)

diff --git a/src/install/PackageManager/PackageJSONEditor.rs b/src/install/PackageManager/PackageJSONEditor.rs
index 4c3250ccfafe..8669062d6216 100644
--- a/src/install/PackageManager/PackageJSONEditor.rs
+++ b/src/install/PackageManager/PackageJSONEditor.rs
@@ -1246,10 +1246,18 @@ pub(crate) fn edit(
                     bun_ast::Loc::EMPTY,
                 ));
 
+                // Read by the `workspace:` arm of the write-back below; every other arm overwrites it.
+                let declared: &[u8] = match new_dependencies[k]
+                    .value
+                    .as_ref()
+                    .and_then(Expr::as_utf8_string_literal)
+                {
+                    Some(literal) => arena_dup(arena, literal),
+                    None => b"",
+                };
                 new_dependencies[k].value = Some(Expr::allocate(
                     arena,
-                    // we set it later
-                    E::EString::init(b""),
+                    E::EString::init(declared),
                     bun_ast::Loc::EMPTY,
                 ));
 
@@ -1501,7 +1509,11 @@ pub(crate) fn edit(
 
                 // A range that linked a workspace member has nothing to move to; `workspace:*` is what `bun add` writes.
                 resolution::Tag::Workspace if manager.subcommand == Subcommand::Update => continue,
-                resolution::Tag::Workspace => b"workspace:*",
+                // Not the bound row: an unchanged resolution keeps the old lockfile row and its previous literal.
+                resolution::Tag::Workspace => match dependency::Tag::infer(e_string.data.slice()) {
+                    dependency::Tag::Workspace => e_string.data.slice(),
+                    _ => b"workspace:*",
+                },
                 _ => arena_dup(arena, request.version.literal.slice(request.version_buf())),
             };
             if e_string.data.slice() != new_literal {
diff --git a/test/cli/install/bun-update-lockfile-sync.test.ts b/test/cli/install/bun-update-lockfile-sync.test.ts
index 1064a9671139..9f9e78f2f9c8 100644
--- a/test/cli/install/bun-update-lockfile-sync.test.ts
+++ b/test/cli/install/bun-update-lockfile-sync.test.ts
@@ -667,6 +667,79 @@ describe.concurrent("bun add", () => {
     await expectInSync(dir, ["", PKG1]);
   });
 
+  // The spelling decides what `bun pm pack` / `bun publish` replace the range with (`^1.0.0`, `~1.0.0`, `1.0.0`); it used to be saved as `workspace:*`.
+  test.each(["workspace:^", "workspace:~", "workspace:1.0.0", "workspace:^1.0.0"])(
+    "bun add <workspace>@%s keeps the spelling",
+    async literal => {
+      const dir = await setup(MONOREPO());
+      await run(dir, "add", `pkg1@${literal}`);
+      expect((await pkg(dir)).dependencies).toStrictEqual({ pkg1: literal });
+      expect((await lock(dir)).workspaces[""].dependencies).toStrictEqual({ pkg1: literal });
+      await expectInSync(dir, ["", PKG1]);
+    },
+  );
+
+  test("bun add <workspace>@workspace:^ -d without a lockfile", async () => {
+    const dir = await setup(MONOREPO(), { install: false });
+    await run(dir, "add", "pkg1@workspace:^", "-d");
+    const manifest = await pkg(dir);
+    expect(manifest.dependencies).toBeUndefined();
+    expect(manifest.devDependencies).toStrictEqual({ pkg1: "workspace:^" });
+    expect((await lock(dir)).workspaces[""].devDependencies).toStrictEqual({ pkg1: "workspace:^" });
+    await expectInSync(dir, ["", PKG1]);
+  });
+
+  test("bun add <workspace>@workspace:~ from another member", async () => {
+    const dir = await setup(WORKSPACES({}, { pkg1: {}, pkg2: {} }));
+    await runIn(dir, PKG2, "add", "pkg1@workspace:~");
+    expect((await pkg(dir, PKG2)).dependencies).toStrictEqual({ pkg1: "workspace:~" });
+    expect((await lock(dir)).workspaces[PKG2].dependencies).toStrictEqual({ pkg1: "workspace:~" });
+    expect((await pkg(dir)).dependencies).toBeUndefined();
+    await expectInSync(dir, ["", PKG1, PKG2]);
+  });
+
+  // The member resolves the same as before, so the install keeps bun.lock's old row; the entry must still take the new spelling.
+  test.each(["workspace:*", "1.0.0"])(
+    "bun add <workspace>@workspace:~ replaces an existing %s entry",
+    async existing => {
+      const dir = await setup(MONOREPO({}, { dependencies: { pkg1: existing } }));
+      await run(dir, "add", "pkg1@workspace:~");
+      expect((await pkg(dir)).dependencies).toStrictEqual({ pkg1: "workspace:~" });
+      expect((await lock(dir)).workspaces[""].dependencies).toStrictEqual({ pkg1: "workspace:~" });
+      await expectInSync(dir, ["", PKG1]);
+    },
+  );
+
+  test("bun add <workspace>@workspace:^ rewrites an entry listed in devDependencies in place", async () => {
+    const dir = await setup(MONOREPO({}, { devDependencies: { pkg1: "workspace:*" } }));
+    await run(dir, "add", "pkg1@workspace:^");
+    const manifest = await pkg(dir);
+    expect(manifest.dependencies).toBeUndefined();
+    expect(manifest.devDependencies).toStrictEqual({ pkg1: "workspace:^" });
+    expect((await lock(dir)).workspaces[""].devDependencies).toStrictEqual({ pkg1: "workspace:^" });
+    await expectInSync(dir, ["", PKG1]);
+  });
+
+  test("bun add <workspace>@workspace:^ --filter keeps the spelling in every target", async () => {
+    const dir = await setup(WORKSPACES({}, { pkg1: {}, pkg2: {} }));
+    await run(dir, "add", "pkg1@workspace:^", "--filter", "pkg2", "--filter", "root");
+    expect((await pkg(dir)).dependencies).toStrictEqual({ pkg1: "workspace:^" });
+    expect((await pkg(dir, PKG2)).dependencies).toStrictEqual({ pkg1: "workspace:^" });
+    const { workspaces } = await lock(dir);
+    expect(workspaces[""].dependencies).toStrictEqual({ pkg1: "workspace:^" });
+    expect(workspaces[PKG2].dependencies).toStrictEqual({ pkg1: "workspace:^" });
+    await expectInSync(dir, ["", PKG1, PKG2]);
+  });
+
+  // A member linked through a plain range is still saved as `workspace:*`.
+  test.each(["1.0.0", "^1.0.0"])("bun add <workspace>@%s saves workspace:*", async range => {
+    const dir = await setup(MONOREPO());
+    await run(dir, "add", `pkg1@${range}`);
+    expect((await pkg(dir)).dependencies).toStrictEqual({ pkg1: "workspace:*" });
+    expect((await lock(dir)).workspaces[""].dependencies).toStrictEqual({ pkg1: "workspace:*" });
+    await expectInSync(dir, ["", PKG1]);
+  });
+
   test("bun add --filter", async () => {
     const dir = await setup(MONOREPO());
     await run(dir, "add", "x@npm:no-deps@latest", "--filter", "pkg1");

From a61a054a3984d67baa16dcae49b28909a0291000 Mon Sep 17 00:00:00 2001
From: robobun <117481402+robobun@users.noreply.github.com>
Date: Mon, 17 Aug 2026 01:44:11 +0000
Subject: [PATCH 120/258] install: ignore leading whitespace wherever a
 dependency literal is classified or re-parsed (#38309)

---
 .../PackageManager/PackageJSONEditor.rs       |  19 +--
 src/install/dependency.rs                     |   4 +-
 src/install/lockfile/Package.rs               |  11 +-
 src/runtime/cli/pack_command.rs               |   1 +
 src/runtime/cli/update_interactive_command.rs |   1 +
 test/cli/install/bun-install-registry.test.ts | 121 ++++++++++++++++
 test/cli/install/bun-install.test.ts          |  52 +++++++
 test/cli/install/bun-pack.test.ts             |   2 +
 test/cli/install/bun-workspaces.test.ts       |  10 +-
 test/cli/install/catalogs.test.ts             | 132 ++++++++++++++++++
 10 files changed, 338 insertions(+), 15 deletions(-)

diff --git a/src/install/PackageManager/PackageJSONEditor.rs b/src/install/PackageManager/PackageJSONEditor.rs
index 8669062d6216..124f81b71ec9 100644
--- a/src/install/PackageManager/PackageJSONEditor.rs
+++ b/src/install/PackageManager/PackageJSONEditor.rs
@@ -480,7 +480,7 @@ fn edit_update_entries(
                         let version_literal = value
                             .as_utf8_string_literal()
                             .unwrap_or_else(|| bun_core::out_of_memory());
-                        let tag = dependency::Tag::infer(version_literal);
+                        let tag = dependency::Tag::infer(dependency::trim_literal(version_literal));
 
                         // npm ranges only (and dist-tags with --latest); `catalog:` is handled by edit_catalogs_*.
                         if tag != dependency::Tag::Npm
@@ -558,7 +558,9 @@ fn edit_update_entries(
                         let value_literal = value
                             .as_utf8_string_literal()
                             .unwrap_or_else(|| bun_core::out_of_memory());
-                        if dependency::Tag::infer(value_literal) == dependency::Tag::Catalog {
+                        if dependency::Tag::infer(dependency::trim_literal(value_literal))
+                            == dependency::Tag::Catalog
+                        {
                             continue;
                         }
 
@@ -715,7 +717,7 @@ pub(crate) fn edit_catalogs_before_update(
             let version_literal = value
                 .as_utf8_string_literal()
                 .unwrap_or_else(|| bun_core::out_of_memory());
-            let tag = dependency::Tag::infer(version_literal);
+            let tag = dependency::Tag::infer(dependency::trim_literal(version_literal));
 
             // same tag rule as direct dependencies
             if tag != dependency::Tag::Npm && (tag != dependency::Tag::DistTag || !update_to_latest)
@@ -1050,8 +1052,9 @@ pub(crate) fn edit(
                                         == Subcommand::Update
                                         && value.expr.as_utf8_string_literal().is_some_and(
                                             |version_literal| {
-                                                dependency::Tag::infer(version_literal)
-                                                    == dependency::Tag::Catalog
+                                                dependency::Tag::infer(dependency::trim_literal(
+                                                    version_literal,
+                                                )) == dependency::Tag::Catalog
                                             },
                                         );
 
@@ -1072,7 +1075,7 @@ pub(crate) fn edit(
                                                 else {
                                                     break 'add_packages_to_update;
                                                 };
-                                                let tag = dependency::Tag::infer(version_literal);
+                                                let tag = dependency::Tag::infer(dependency::trim_literal(version_literal));
 
                                                 if tag != dependency::Tag::Npm
                                                     && tag != dependency::Tag::DistTag
@@ -1394,7 +1397,7 @@ pub(crate) fn edit(
             let e_string = unsafe { &mut *e_string };
             // `bun update <pkg>` only moves registry entries, like `edit_update_entries`; `bun add` still replaces any entry.
             if manager.subcommand == Subcommand::Update
-                && !dependency::Tag::infer(e_string.data.slice()).is_npm()
+                && !dependency::Tag::infer(dependency::trim_literal(e_string.data.slice())).is_npm()
             {
                 continue;
             }
@@ -1510,7 +1513,7 @@ pub(crate) fn edit(
                 // A range that linked a workspace member has nothing to move to; `workspace:*` is what `bun add` writes.
                 resolution::Tag::Workspace if manager.subcommand == Subcommand::Update => continue,
                 // Not the bound row: an unchanged resolution keeps the old lockfile row and its previous literal.
-                resolution::Tag::Workspace => match dependency::Tag::infer(e_string.data.slice()) {
+                resolution::Tag::Workspace => match dependency::Tag::infer(dependency::trim_literal(e_string.data.slice())) {
                     dependency::Tag::Workspace => e_string.data.slice(),
                     _ => b"workspace:*",
                 },
diff --git a/src/install/dependency.rs b/src/install/dependency.rs
index 53fe20bb3636..2230bc6850fb 100644
--- a/src/install/dependency.rs
+++ b/src/install/dependency.rs
@@ -233,7 +233,7 @@ impl DependencyExt for Dependency {
                 Some(Semver::string::Builder::string_hash(
                     new_name.slice(out_slice),
                 )),
-                new_literal.slice(out_slice),
+                trim_literal(new_literal.slice(out_slice)),
                 self.version.tag,
                 &sliced,
                 None,
@@ -694,7 +694,7 @@ impl VersionExt for Version {
         parse_with_tag(
             alias,
             Some(alias_hash),
-            sliced.slice,
+            trim_literal(sliced.slice),
             tag,
             &sliced,
             Some(ctx.log),
diff --git a/src/install/lockfile/Package.rs b/src/install/lockfile/Package.rs
index 7b5da1ac25b1..20de29c14307 100644
--- a/src/install/lockfile/Package.rs
+++ b/src/install/lockfile/Package.rs
@@ -1805,7 +1805,9 @@ impl Package<u64> {
     ) -> crate::Result<Option<Dependency>> {
         #[cfg(windows)]
         let external_version = 'brk: {
-            match tag.unwrap_or_else(|| dependency::version::Tag::infer(version)) {
+            match tag.unwrap_or_else(|| {
+                dependency::version::Tag::infer(dependency::trim_literal(version))
+            }) {
                 dependency::version::Tag::Workspace
                 | dependency::version::Tag::Folder
                 | dependency::version::Tag::Symlink
@@ -1857,9 +1859,10 @@ impl Package<u64> {
                 semver::string::Builder::string_hash(npm_name.slice(buf))
             }
             dependency::version::Tag::Workspace => {
-                if strings::has_prefix(sliced.slice, b"workspace:") {
+                let literal = dependency::trim_literal(sliced.slice);
+                if strings::has_prefix(literal, b"workspace:") {
                     'brk: {
-                        let input = &sliced.slice[b"workspace:".len()..];
+                        let input = &literal[b"workspace:".len()..];
                         let trimmed = strings::trim(input, &strings::WHITESPACE_CHARS);
                         if trimmed.len() != 1
                             || (trimmed[0] != b'*' && trimmed[0] != b'^' && trimmed[0] != b'~')
@@ -2492,7 +2495,7 @@ impl Package<u64> {
                             string_builder.count(value);
 
                             // If it's a folder or workspace, pessimistically assume we will need a maximum path
-                            match dependency::version::Tag::infer(value) {
+                            match dependency::version::Tag::infer(dependency::trim_literal(value)) {
                                 dependency::version::Tag::Folder
                                 | dependency::version::Tag::Workspace => {
                                     string_builder.cap += MAX_PATH_BYTES;
diff --git a/src/runtime/cli/pack_command.rs b/src/runtime/cli/pack_command.rs
index 5eeb7a32bde0..22595fc72011 100644
--- a/src/runtime/cli/pack_command.rs
+++ b/src/runtime/cli/pack_command.rs
@@ -3265,6 +3265,7 @@ fn edit_root_package_json(
                     else {
                         continue;
                     };
+                    let package_spec = bun_install::dependency::trim_literal(package_spec);
                     if let Some(without_workspace_protocol) =
                         strings::without_prefix_if_possible_comptime(package_spec, b"workspace:")
                     {
diff --git a/src/runtime/cli/update_interactive_command.rs b/src/runtime/cli/update_interactive_command.rs
index cbae1c6acf25..5f08811bca64 100644
--- a/src/runtime/cli/update_interactive_command.rs
+++ b/src/runtime/cli/update_interactive_command.rs
@@ -2478,6 +2478,7 @@ fn preserve_version_prefix(
     original_version: &[u8],
     new_version: &[u8],
 ) -> crate::Result<Box<[u8]>> {
+    let original_version = dependency::trim_literal(original_version);
     if original_version.len() > 1 {
         let mut orig_version: &[u8] = original_version;
         let mut alias: Option<&[u8]> = None;
diff --git a/test/cli/install/bun-install-registry.test.ts b/test/cli/install/bun-install-registry.test.ts
index 8b670fba6490..d2adf907efd8 100644
--- a/test/cli/install/bun-install-registry.test.ts
+++ b/test/cli/install/bun-install-registry.test.ts
@@ -6599,6 +6599,127 @@ describe("update", () => {
       });
     });
   });
+  describe("leading whitespace in the version literal", () => {
+    // The installer ignores leading whitespace in a package.json version, so each of these must
+    // end up exactly where the same command takes the value without the whitespace.
+    const cases: [dependency: string, version: string, args: string[], updated: string, installed: string][] = [
+      ["aliased-dep", " npm:no-deps@^1.0.0", ["aliased-dep"], "npm:no-deps@^1.1.0", "1.1.0"],
+      ["aliased-dep", " npm:no-deps@^1.0.0", [], "npm:no-deps@^1.1.0", "1.1.0"],
+      ["aliased-dep", " npm:no-deps@^1.0.0", ["--latest"], "npm:no-deps@^2.0.0", "2.0.0"],
+      ["aliased-dep", "\tnpm:no-deps@~1.0.0", [], "npm:no-deps@~1.0.1", "1.0.1"],
+      ["aliased-dep", "\tnpm:no-deps@~1.0.0", ["--latest"], "npm:no-deps@~2.0.0", "2.0.0"],
+      ["no-deps", " ^1.0.0", [], "^1.1.0", "1.1.0"],
+      ["no-deps", " ^1.0.0", ["no-deps"], "^1.1.0", "1.1.0"],
+      ["no-deps", " ^1.0.0", ["--latest"], "^2.0.0", "2.0.0"],
+      ["no-deps", "\n~1.0.0", [], "~1.0.1", "1.0.1"],
+    ];
+
+    for (const [dependency, version, args, updated, installed] of cases) {
+      test(`${JSON.stringify(version)} with \`bun update${args.map(arg => ` ${arg}`).join("")}\``, async () => {
+        await write(
+          packageJson,
+          JSON.stringify({
+            name: "foo",
+            dependencies: {
+              [dependency]: version,
+            },
+          }),
+        );
+
+        await runBunUpdate(env, packageDir, args);
+        assertManifestsPopulated(join(packageDir, ".bun-cache"), registryUrl());
+
+        expect(await file(packageJson).json()).toEqual({
+          name: "foo",
+          dependencies: {
+            [dependency]: updated,
+          },
+        });
+        expect(await file(join(packageDir, "node_modules", dependency, "package.json")).json()).toMatchObject({
+          name: "no-deps",
+          version: installed,
+        });
+      });
+    }
+
+    test("bun update --interactive keeps the alias and the range prefix", async () => {
+      await write(
+        packageJson,
+        JSON.stringify({
+          name: "foo",
+          dependencies: {
+            "aliased-dep": " npm:no-deps@^1.0.0",
+            "no-deps": "\t~1.0.0",
+          },
+        }),
+      );
+      await runBunInstall(env, packageDir);
+
+      // `a` selects every package, enter confirms. bunEnv lets the prompt read keys from a pipe.
+      await using proc = spawn({
+        cmd: [bunExe(), "update", "--interactive", "--latest"],
+        cwd: packageDir,
+        env,
+        stdin: new Blob(["a\r"]),
+        stdout: "pipe",
+        stderr: "pipe",
+      });
+      const [out, err, exitCode] = await Promise.all([proc.stdout.text(), proc.stderr.text(), proc.exited]);
+      expect({ out, err, exitCode }).toMatchObject({ exitCode: 0 });
+
+      expect(await file(packageJson).json()).toEqual({
+        name: "foo",
+        dependencies: {
+          "aliased-dep": "npm:no-deps@^2.0.0",
+          "no-deps": "~2.0.0",
+        },
+      });
+      expect(await file(join(packageDir, "node_modules", "aliased-dep", "package.json")).json()).toMatchObject({
+        name: "no-deps",
+        version: "2.0.0",
+      });
+    });
+
+    test("a catalog reference in an earlier dependency group is left alone", async () => {
+      // devDependencies are visited before dependencies. The entry recorded for `dependencies`
+      // must not be spent rewriting the `catalog:` reference.
+      await write(
+        packageJson,
+        JSON.stringify({
+          name: "foo",
+          workspaces: {
+            catalog: {
+              "no-deps": "^1.0.0",
+            },
+          },
+          devDependencies: {
+            "no-deps": " catalog:",
+          },
+          dependencies: {
+            "no-deps": " ^1.0.0",
+          },
+        }),
+      );
+
+      await runBunUpdate(env, packageDir);
+      assertManifestsPopulated(join(packageDir, ".bun-cache"), registryUrl());
+
+      expect(await file(packageJson).json()).toEqual({
+        name: "foo",
+        workspaces: {
+          catalog: {
+            "no-deps": "^1.1.0",
+          },
+        },
+        devDependencies: {
+          "no-deps": " catalog:",
+        },
+        dependencies: {
+          "no-deps": "^1.1.0",
+        },
+      });
+    });
+  });
   test("--no-save will update packages in node_modules and not save to package.json", async () => {
     await write(
       packageJson,
diff --git a/test/cli/install/bun-install.test.ts b/test/cli/install/bun-install.test.ts
index de5e2be65221..11d18651b6f8 100644
--- a/test/cli/install/bun-install.test.ts
+++ b/test/cli/install/bun-install.test.ts
@@ -12330,6 +12330,58 @@ describe.concurrent("link: paths with .. or an absolute path declared by a depen
     await packDeclarer(root, { dependencies: declaredLinks(root) });
 
     await expectRefused(root, "tb@./tb-1.0.0.tgz");
+for (const lockfile of ["bun.lock", "bun.lockb"]) {
+  it(`installs a file: dependency whose version literal has leading whitespace (${lockfile})`, async () => {
+    // The folder path is longer than an inline string so that it has to be appended to the
+    // lockfile's string buffer, which only has room for it if the literal was classified as a folder.
+    const literal = " file:./vendor/some-long-directory-name/lib";
+    using dir = tempDir("whitespace-file-dep", {
+      "package.json": JSON.stringify({
+        name: "my-app",
+        version: "1.0.0",
+        dependencies: {
+          lib: literal,
+        },
+      }),
+      "vendor/some-long-directory-name/lib/package.json": JSON.stringify({
+        name: "lib",
+        version: "1.0.0",
+      }),
+      "bunfig.toml": `install.saveTextLockfile = ${lockfile === "bun.lock"}`,
+    });
+
+    // The first pass resolves from package.json; the second installs from the lockfile the first
+    // pass wrote, which stores the literal as written and has to parse it as a folder again.
+    for (const args of [["install"], ["install", "--frozen-lockfile"]]) {
+      await rm(join(String(dir), "node_modules"), { recursive: true, force: true });
+
+      const { stdout, stderr, exited } = spawn({
+        cmd: [bunExe(), ...args],
+        cwd: String(dir),
+        stdout: "pipe",
+        stderr: "pipe",
+        env,
+      });
+      const [err, out, exitCode] = await Promise.all([stderr.text(), stdout.text(), exited]);
+
+      expect(err).not.toContain("error:");
+      expect(out).toContain("1 package installed");
+      expect(exitCode).toBe(0);
+
+      expect(await file(join(String(dir), "node_modules", "lib", "package.json")).json()).toEqual({
+        name: "lib",
+        version: "1.0.0",
+      });
+      if (lockfile === "bun.lock") {
+        expect(await file(join(String(dir), "bun.lock")).text()).toContain(`"lib": ${JSON.stringify(literal)}`);
+      } else {
+        expect(await exists(join(String(dir), "bun.lockb"))).toBe(true);
+      }
+    }
+  });
+}
+
+
   });
 
   it("are refused when a git dependency declares them", async () => {
diff --git a/test/cli/install/bun-pack.test.ts b/test/cli/install/bun-pack.test.ts
index f16f5cd85d32..02f7131cbce8 100644
--- a/test/cli/install/bun-pack.test.ts
+++ b/test/cli/install/bun-pack.test.ts
@@ -852,6 +852,8 @@ describe("workspaces", () => {
     { input: "workspace:1.1.x", expected: "1.1.x" },
     { input: "workspace:*", expected: "1.1.1" },
     { input: "workspace:-", expected: "-" },
+    // leading whitespace is not part of the specifier
+    { input: " workspace:^", expected: "^1.1.1" },
   ];
 
   for (const { input, expected } of withLockfileWorkspaceProtocolTests) {
diff --git a/test/cli/install/bun-workspaces.test.ts b/test/cli/install/bun-workspaces.test.ts
index d4bd1b10ff06..12eb3842199f 100644
--- a/test/cli/install/bun-workspaces.test.ts
+++ b/test/cli/install/bun-workspaces.test.ts
@@ -511,6 +511,8 @@ describe("workspace aliases", async () => {
     "workspace:@org/b@*",
     // missing version after `@`
     "workspace:@org/b@",
+    // leading whitespace is not part of the specifier
+    " workspace:@org/b@*",
   ];
   for (const version of shouldPass) {
     test.concurrent(`version range ${version} and workspace with no version`, async () => {
@@ -551,7 +553,13 @@ describe("workspace aliases", async () => {
       expect(files).toMatchObject([{ name: "@org/a" }, { name: "@org/b" }, { name: "@org/b" }]);
     });
   }
-  let shouldFail: string[] = ["workspace:@org/b@1.0.0", "workspace:@org/b@1", "workspace:@org/b"];
+  let shouldFail: string[] = [
+    "workspace:@org/b@1.0.0",
+    "workspace:@org/b@1",
+    "workspace:@org/b",
+    // leading whitespace is not part of the specifier
+    " workspace:@org/b@1.0.0",
+  ];
   for (const version of shouldFail) {
     test.concurrent(`version range ${version} and workspace with no version (should fail)`, async () => {
       using ctx = await setupTest();
diff --git a/test/cli/install/catalogs.test.ts b/test/cli/install/catalogs.test.ts
index c06304ed2474..f548c2a57f39 100644
--- a/test/cli/install/catalogs.test.ts
+++ b/test/cli/install/catalogs.test.ts
@@ -750,6 +750,138 @@ describe("update", () => {
     });
     expect(exitCode).toBe(0);
   });
+
+  // Leading whitespace in a version literal is ignored by the installer, so `bun update` has to
+  // treat these entries exactly like their trimmed counterparts above.
+  for (const [flags, expected] of [
+    [[], { "no-deps": "^1.1.0", "aliased-dep": "npm:no-deps@~1.0.1" }],
+    [["--latest"], { "no-deps": "^2.0.0", "aliased-dep": "npm:no-deps@~2.0.0" }],
+  ] as const) {
+    test(`update ${flags.join(" ") || "(no args)"} updates catalog entries with leading whitespace`, async () => {
+      const { packageDir } = await registry.createTestDir();
+      await Promise.all([
+        write(
+          join(packageDir, "package.json"),
+          JSON.stringify({
+            name: "catalog-update-whitespace",
+            workspaces: {
+              packages: ["packages/*"],
+              catalog: {
+                "no-deps": " ^1.0.0",
+                "aliased-dep": "\tnpm:no-deps@~1.0.0",
+              },
+            },
+          }),
+        ),
+        write(
+          join(packageDir, "packages", "pkg1", "package.json"),
+          JSON.stringify({
+            name: "pkg1",
+            dependencies: {
+              "no-deps": "catalog:",
+              "aliased-dep": "catalog:",
+            },
+          }),
+        ),
+      ]);
+      await runBunInstall(bunEnv, packageDir);
+
+      const { err, exitCode } = await runUpdate(packageDir, ...flags);
+      expect(err).not.toContain("error:");
+
+      expect((await file(join(packageDir, "package.json")).json()).workspaces.catalog).toEqual(expected);
+      expect((await file(join(packageDir, "packages", "pkg1", "package.json")).json()).dependencies).toEqual({
+        "no-deps": "catalog:",
+        "aliased-dep": "catalog:",
+      });
+      expect(exitCode).toBe(0);
+    });
+  }
+
+  for (const flags of [[], ["--latest"]] as const) {
+    test(`update <pkg>${flags.length ? ` ${flags.join(" ")}` : ""} keeps a catalog reference with leading whitespace`, async () => {
+      const { packageDir } = await registry.createTestDir();
+      await Promise.all([
+        write(
+          join(packageDir, "package.json"),
+          JSON.stringify({
+            name: "catalog-reference-whitespace",
+            workspaces: {
+              packages: ["packages/*"],
+              catalog: {
+                "no-deps": "^1.0.0",
+              },
+            },
+          }),
+        ),
+        write(
+          join(packageDir, "packages", "pkg1", "package.json"),
+          JSON.stringify({
+            name: "pkg1",
+            dependencies: {
+              "no-deps": " catalog:",
+            },
+          }),
+        ),
+      ]);
+      await runBunInstall(bunEnv, packageDir);
+
+      const { err, exitCode } = await runUpdate(join(packageDir, "packages", "pkg1"), "no-deps", ...flags);
+      expect(err).not.toContain("error:");
+
+      expect((await file(join(packageDir, "packages", "pkg1", "package.json")).json()).dependencies).toEqual({
+        "no-deps": " catalog:",
+      });
+      expect((await file(join(packageDir, "package.json")).json()).workspaces.catalog).toEqual({
+        "no-deps": "^1.0.0",
+      });
+      expect(exitCode).toBe(0);
+    });
+  }
+});
+
+describe("pack", () => {
+  test("replaces a catalog: reference with leading whitespace", async () => {
+    const { packageDir } = await registry.createTestDir();
+    const pkg1Dir = join(packageDir, "packages", "pkg1");
+    await Promise.all([
+      write(
+        join(packageDir, "package.json"),
+        JSON.stringify({
+          name: "catalog-pack-whitespace",
+          workspaces: {
+            packages: ["packages/*"],
+            catalog: {
+              "no-deps": "^1.0.0",
+            },
+          },
+        }),
+      ),
+      write(
+        join(pkg1Dir, "package.json"),
+        JSON.stringify({
+          name: "pkg1",
+          version: "1.0.0",
+          dependencies: {
+            "no-deps": " catalog:",
+          },
+        }),
+      ),
+    ]);
+    await runBunInstall(bunEnv, packageDir);
+
+    await pack(pkg1Dir, bunEnv);
+
+    const tarball = readTarball(join(pkg1Dir, "pkg1-1.0.0.tgz"));
+    expect(tarball.entries).toMatchObject([{ pathname: "package/package.json" }]);
+    expect(JSON.parse(tarball.entries[0].contents)).toEqual({
+      name: "pkg1",
+      version: "1.0.0",
+      dependencies: {
+        "no-deps": "^1.0.0",
+      },
+    });
+  });
 });
 
 describe("errors", () => {

From 3069d7a36b02e7fdb956a992c5488bf272d92fd5 Mon Sep 17 00:00:00 2001
From: robobun <117481402+robobun@users.noreply.github.com>
Date: Mon, 17 Aug 2026 01:44:35 +0000
Subject: [PATCH 121/258] install: migrate pnpm onlyBuiltDependencies and
 report blocked scripts under the isolated linker (#38780)

---
 docs/pm/cli/install.mdx                       |   1 +
 src/install/isolated_install.rs               |   1 +
 src/install/isolated_install/Installer.rs     | 110 ++++++++---
 src/install/lockfile.rs                       |  11 +-
 src/install/pnpm.rs                           | 114 ++++++++++++
 test/cli/install/isolated-install.test.ts     |  80 ++++++++
 .../install/migration/pnpm-lock-v9.test.ts    | 174 ++++++++++++++++++
 7 files changed, 464 insertions(+), 27 deletions(-)

diff --git a/docs/pm/cli/install.mdx b/docs/pm/cli/install.mdx
index 20643063fce8..a36b630ea09c 100644
--- a/docs/pm/cli/install.mdx
+++ b/docs/pm/cli/install.mdx
@@ -602,6 +602,7 @@ Bun copies the following pnpm configuration into the root `package.json`:
 - **Workspace Overrides**: Copied from `overrides` and `patchedDependencies` in `pnpm-workspace.yaml` to the same root-level fields
 
 Bun leaves the `pnpm` field of `package.json` as it is. pnpm reads its configuration from that field and ignores the root-level fields, so `pnpm install --frozen-lockfile` keeps working for teammates who still use pnpm. Bun reads the root-level fields and ignores the `pnpm` field.
+- **Allowed build scripts**: `onlyBuiltDependencies` (from `pnpm-workspace.yaml` or `pnpm.onlyBuiltDependencies` in `package.json`) is added to [`trustedDependencies`](/pm/lifecycle) in `package.json`, so the same packages keep running their lifecycle scripts
 
 ### Requirements and limitations
 
diff --git a/src/install/isolated_install.rs b/src/install/isolated_install.rs
index 28b2c58f265d..1b644a3a4746 100644
--- a/src/install/isolated_install.rs
+++ b/src/install/isolated_install.rs
@@ -2143,6 +2143,7 @@ pub(crate) fn install_isolated_packages(
                     installer: bun_ptr::BackRef::from(core::ptr::NonNull::dangling()),
                     result: installer::Result::None,
                     relink: installer::Relink::Off,
+                    blocked_scripts: 0,
                     task: bun_threading::thread_pool::Task {
                         callback: installer::Task::callback,
                         node: Default::default(),
diff --git a/src/install/isolated_install/Installer.rs b/src/install/isolated_install/Installer.rs
index 4f98208fff2c..c25a6f8118c7 100644
--- a/src/install/isolated_install/Installer.rs
+++ b/src/install/isolated_install/Installer.rs
@@ -600,6 +600,18 @@ impl<'a> Installer<'a> {
         let is_duplicate = self.installed.is_set(pkg_id as usize);
         self.summary.success += (!is_duplicate) as u32;
         self.installed.set(pkg_id as usize);
+
+        // Once per package, like `success`: a package has one store entry per peer set.
+        let blocked_scripts = self.tasks[entry_id.get() as usize].blocked_scripts;
+        if blocked_scripts > 0 && !is_duplicate {
+            let dep_id = nodes.items_dep_id()[node_id.get() as usize];
+            let dep_name_hash = self.lockfile().buffers.dependencies[dep_id as usize].name_hash;
+            *self
+                .summary
+                .packages_with_blocked_scripts
+                .entry(dep_name_hash as TruncatedPackageNameHash)
+                .or_default() += usize::from(blocked_scripts);
+        }
     }
 
     /// Called from main thread once the package is deleted; dependents finish without it.
@@ -699,6 +711,8 @@ pub struct Task {
 
     pub(crate) result: Result,
     pub(crate) relink: Relink,
+    /// Set by `Step::RunPreinstall` on the task thread, read by `on_task_complete` like `relink`.
+    pub(crate) blocked_scripts: u8,
 }
 
 // SAFETY: `next` is the sole intrusive link for `UnboundedQueue<Task>`.
@@ -1642,22 +1656,7 @@ impl Task {
 
                 Step::RunPreinstall => {
                     let current_step = Step::RunPreinstall;
-                    if !manager_ref.options.do_.contains(Do::RUN_SCRIPTS)
-                        || self.entry_id == StoreEntryId::ROOT
-                    {
-                        step = self.next_step(current_step);
-                        continue;
-                    }
-
-                    // The eligibility check excludes any package whose
-                    // lifecycle scripts are trusted to run, so a global-store
-                    // entry should never reach script enqueueing. Guard it
-                    // anyway: `meta.hasInstallScript` can be a false negative
-                    // (yarn-migrated lockfiles force it to `.false`), and a
-                    // script running with cwd inside a shared content-
-                    // addressed directory would mutate every other project's
-                    // copy.
-                    if installer.entry_uses_global_store(self.entry_id) {
+                    if self.entry_id == StoreEntryId::ROOT {
                         step = self.next_step(current_step);
                         continue;
                     }
@@ -1685,15 +1684,41 @@ impl Task {
                         break 'brk (false, false);
                     };
 
+                    if !(pkg_res.tag != ResolutionTag::Root
+                        && (pkg_res.tag == ResolutionTag::Workspace || is_trusted))
+                    {
+                        // Before the early returns below, like the hoisted installer.
+                        if pkg_res.tag != ResolutionTag::Root
+                            && pkg_metas[pkg_id as usize].has_install_script()
+                        {
+                            self.blocked_scripts = self.count_blocked_scripts(
+                                installer,
+                                manager_ref.get(),
+                                lockfile,
+                                pkg_script_lists[pkg_id as usize],
+                                dep.name.slice(string_buf),
+                                &pkg_res,
+                            );
+                        }
+                        step = self.next_step(current_step);
+                        continue;
+                    }
+
+                    if !manager_ref.options.do_.contains(Do::RUN_SCRIPTS) {
+                        step = self.next_step(current_step);
+                        continue;
+                    }
+
+                    // Trusted entries are never global-store eligible; never run in the shared dir.
+                    if installer.entry_uses_global_store(self.entry_id) {
+                        step = self.next_step(current_step);
+                        continue;
+                    }
+
                     let mut pkg_cwd = AutoAbsPath::init_top_level_dir();
                     installer.append_store_path(&mut pkg_cwd, self.entry_id);
 
                     'enqueue_lifecycle_scripts: {
-                        if !(pkg_res.tag != ResolutionTag::Root
-                            && (pkg_res.tag == ResolutionTag::Workspace || is_trusted))
-                        {
-                            break 'enqueue_lifecycle_scripts;
-                        }
                         let mut pkg_scripts: package::scripts::Scripts =
                             pkg_script_lists[pkg_id as usize];
                         let manager = manager_ref.get();
@@ -1992,6 +2017,49 @@ impl Task {
         }
     }
 
+    /// Task thread. Counts the installed scripts; `hasInstallScript` alone can be a false positive.
+    fn count_blocked_scripts(
+        &self,
+        installer: &Installer<'_>,
+        manager: &PackageManager,
+        lockfile: &Lockfile,
+        mut pkg_scripts: package::scripts::Scripts,
+        dep_name: &[u8],
+        pkg_res: &Resolution,
+    ) -> u8 {
+        // A global-store entry stays in its staging dir until `Step::Binaries` renames it.
+        let mut pkg_dir = AutoAbsPath::init_top_level_dir();
+        installer.append_real_store_path(&mut pkg_dir, self.entry_id, Which::Staging);
+
+        let mut log = Log::init();
+        match pkg_scripts.get_list(&mut log, lockfile, &mut pkg_dir, dep_name, pkg_res) {
+            Ok(Some(list)) => {
+                if manager.options.log_level.is_verbose() {
+                    bun_core::pretty_error!(
+                        "Blocked {} scripts for: {}@{}\n",
+                        list.total,
+                        bstr::BStr::new(dep_name),
+                        pkg_res.fmt(
+                            lockfile.buffers.string_bytes.as_slice(),
+                            bun_core::fmt::PathSep::Posix
+                        ),
+                    );
+                }
+                list.total
+            }
+            Ok(None) => 0,
+            Err(err) => {
+                if !manager.options.log_level.is_silent() {
+                    Output::err_generic(
+                        "failed to fill lifecycle scripts for <b>{}<r>: {}",
+                        (bstr::BStr::new(dep_name), err.name()),
+                    );
+                }
+                0
+            }
+        }
+    }
+
     /// Called from task thread
     pub(crate) unsafe fn callback(task: *mut thread_pool::Task) {
         // SAFETY: task points to Task.task field
diff --git a/src/install/lockfile.rs b/src/install/lockfile.rs
index 763f65f98838..6a0605bcbef5 100644
--- a/src/install/lockfile.rs
+++ b/src/install/lockfile.rs
@@ -1576,13 +1576,9 @@ impl Lockfile {
             name_hash: pkg_name_hashes,
             resolution: pkg_resolutions,
             bin: pkg_bins,
-            meta,
+            meta: pkg_metas,
             ..
         } = pkgs.split_mut();
-        // One loop serves both modes: bind `pkg_metas` as an empty slice
-        // when the const generic is false.
-        let pkg_metas: &mut [self::package::meta::Meta] =
-            if UPDATE_OS_CPU { meta } else { &mut [] };
 
         for i in 0..len {
             let pkg_name = pkg_names[i];
@@ -1661,8 +1657,11 @@ impl Lockfile {
 
                     builder.clamp();
 
+                    let pkg_meta = &mut pkg_metas[i];
+                    // Neither yarn.lock nor pnpm-lock.yaml records this.
+                    pkg_meta.set_has_install_script(pkg.package.has_install_script);
+
                     if UPDATE_OS_CPU {
-                        let pkg_meta = &mut pkg_metas[i];
                         // Update os/cpu metadata if not already set
                         if pkg_meta.os == Npm::OperatingSystem::ALL {
                             pkg_meta.os = pkg.package.os;
diff --git a/src/install/pnpm.rs b/src/install/pnpm.rs
index 410a1476b81e..192adee41929 100644
--- a/src/install/pnpm.rs
+++ b/src/install/pnpm.rs
@@ -2376,6 +2376,94 @@ fn rewrite_bare_patch_keys(
     Ok(())
 }
 
+/// pnpm's allow-list of packages that may run lifecycle scripts, i.e. bun's `trustedDependencies`.
+fn collect_only_built_dependencies(list: &Expr, out: &mut Vec<&'static [u8]>) -> bool {
+    let Some(mut items) = list.as_array() else {
+        return false;
+    };
+    let mut found_any = false;
+    while let Some(item) = items.next() {
+        let Some(name) = as_string(&item) else {
+            continue;
+        };
+        if name.is_empty() {
+            continue;
+        }
+        found_any = true;
+        if !out.contains(&name) {
+            out.push(js_ast::data_store_dupe_str(name));
+        }
+    }
+    found_any
+}
+
+/// The migrated root skips `Package::parse`, so the lockfile's list is filled in here as well.
+fn add_trusted_dependencies(
+    json: &mut Expr,
+    lockfile: &mut Lockfile,
+    bump: &bun_alloc::Arena,
+    names: &[&'static [u8]],
+) -> Result<bool, AllocError> {
+    let existing = e_object(json).get(b"trustedDependencies");
+    if existing.is_some_and(|existing| !matches!(existing.data, ExprData::EArray(_))) {
+        return Ok(false);
+    }
+
+    let mut items = js_ast::ExprNodeList::init_capacity(names.len());
+    if let Some(mut existing_items) = existing.as_ref().and_then(Expr::as_array) {
+        while let Some(item) = existing_items.next() {
+            VecExt::append(&mut items, item);
+        }
+    }
+
+    let mut added_any = false;
+    for &name in names {
+        if items
+            .slice()
+            .iter()
+            .any(|item| as_string(item) == Some(name))
+        {
+            continue;
+        }
+        VecExt::append(
+            &mut items,
+            Expr::init(E::EString::init(name), bun_ast::Loc::EMPTY),
+        );
+        added_any = true;
+    }
+
+    let trusted = lockfile
+        .trusted_dependencies
+        .get_or_insert_with(Default::default);
+    for item in items.slice() {
+        if let Some(name) = as_string(item) {
+            trusted.put(
+                semver::string::Builder::string_hash(name) as crate::TruncatedPackageNameHash,
+                Box::from(name),
+            )?;
+        }
+    }
+
+    if !added_any {
+        return Ok(false);
+    }
+
+    let is_single_line = items.len_u32() == 1;
+    e_object_mut(json).put(
+        bump,
+        b"trustedDependencies",
+        Expr::init(
+            E::Array {
+                items,
+                is_single_line,
+                ..Default::default()
+            },
+            bun_ast::Loc::EMPTY,
+        ),
+    )?;
+    Ok(true)
+}
+
 /// Updates package.json with workspace and catalog information after migration
 fn update_package_json_after_migration(
     lockfile: &mut Lockfile,
@@ -2413,6 +2501,11 @@ fn update_package_json_after_migration(
 
     let mut copied: Vec<&'static str> = Vec::new();
 
+    // Copied rather than moved out of the `pnpm` block: pnpm itself still reads it there.
+    let mut trusted_names: Vec<&'static [u8]> = Vec::new();
+    let mut pnpm_only_built_deps = false;
+    let mut workspace_only_built_deps = false;
+
     // Copied, not moved: pnpm keeps reading this block, bun only reads the root-level fields.
     if let Some(pnpm_prop) = json.as_property(b"pnpm") {
         if pnpm_prop.expr.is_object() {
@@ -2434,6 +2527,11 @@ fn update_package_json_after_migration(
                     copied.push("pnpm.patchedDependencies to patchedDependencies");
                 }
             }
+
+            if let Some(only_built) = pnpm_obj.get(b"onlyBuiltDependencies") {
+                pnpm_only_built_deps =
+                    collect_only_built_dependencies(&only_built, &mut trusted_names);
+            }
         }
     }
 
@@ -2498,6 +2596,10 @@ fn update_package_json_after_migration(
             workspace_patched_deps_obj = ws_root
                 .get_object(b"patchedDependencies")
                 .filter(is_non_empty_object);
+            if let Some(only_built) = ws_root.get(b"onlyBuiltDependencies") {
+                workspace_only_built_deps =
+                    collect_only_built_dependencies(&only_built, &mut trusted_names);
+            }
         }
         Err(_) => {}
     }
@@ -2613,6 +2715,18 @@ fn update_package_json_after_migration(
         }
     }
 
+    if !trusted_names.is_empty()
+        && add_trusted_dependencies(&mut json, lockfile, &bump, &trusted_names)?
+    {
+        needs_update = true;
+        if pnpm_only_built_deps {
+            moved.push("pnpm.onlyBuiltDependencies to trustedDependencies");
+        }
+        if workspace_only_built_deps {
+            moved.push("pnpm-workspace.yaml onlyBuiltDependencies to trustedDependencies");
+        }
+    }
+
     if !copied.is_empty() {
         print_package_json_into_cache_entry(root_pkg_json, json);
         // The printed tree borrows from the replaced contents; `bun update` edits this entry next.
diff --git a/test/cli/install/isolated-install.test.ts b/test/cli/install/isolated-install.test.ts
index addfa5ba4f5b..4ac887367191 100644
--- a/test/cli/install/isolated-install.test.ts
+++ b/test/cli/install/isolated-install.test.ts
@@ -2522,6 +2522,86 @@ test("direct optional dependency with a failing postinstall script is removed al
   ).toEqual([[".bun", "no-deps"], [], ["no-deps"]]);
 });
 
+describe("blocked lifecycle scripts", () => {
+  const blockedLine = "Blocked 4 postinstalls. Run `bun pm untrusted` for details.";
+
+  async function createUntrustedScriptsDir(bunfigOpts: { linker: "isolated"; globalStore?: boolean }) {
+    const { packageJson, packageDir } = await registry.createTestDir({ bunfigOpts });
+    await write(
+      packageJson,
+      JSON.stringify({
+        name: "test-pkg-blocked-scripts",
+        dependencies: {
+          // one postinstall
+          "lifecycle-postinstall": "1.0.0",
+          // preinstall, install and postinstall
+          "all-lifecycle-scripts": "1.0.0",
+          // no scripts
+          "no-deps": "1.0.0",
+        },
+      }),
+    );
+    return packageDir;
+  }
+
+  test.concurrent("are reported in the install summary like the hoisted linker does", async () => {
+    const packageDir = await createUntrustedScriptsDir({ linker: "isolated" });
+
+    const { out } = await runBunInstall(bunEnv, packageDir);
+
+    expect(out).toContain(blockedLine);
+    expect(existsSync(join(packageDir, "node_modules", "lifecycle-postinstall", "postinstall.txt"))).toBeFalse();
+    expect(existsSync(join(packageDir, "node_modules", "all-lifecycle-scripts", "postinstall.txt"))).toBeFalse();
+  });
+
+  test.concurrent("are not reported for trusted packages", async () => {
+    const { packageJson, packageDir } = await registry.createTestDir({ bunfigOpts: { linker: "isolated" } });
+    await write(
+      packageJson,
+      JSON.stringify({
+        name: "test-pkg-blocked-scripts-trusted",
+        dependencies: { "lifecycle-postinstall": "1.0.0" },
+        trustedDependencies: ["lifecycle-postinstall"],
+      }),
+    );
+
+    const { out } = await runBunInstall(bunEnv, packageDir);
+
+    expect(out).not.toContain("Blocked");
+    expect(existsSync(join(packageDir, "node_modules", "lifecycle-postinstall", "postinstall.txt"))).toBeTrue();
+  });
+
+  test.concurrent("are still reported with --ignore-scripts", async () => {
+    const packageDir = await createUntrustedScriptsDir({ linker: "isolated" });
+
+    await using proc = spawn({
+      cmd: [bunExe(), "install", "--ignore-scripts"],
+      cwd: packageDir,
+      env: bunEnv,
+      stdout: "pipe",
+      stderr: "pipe",
+    });
+    const [out, err, exitCode] = await Promise.all([proc.stdout.text(), proc.stderr.text(), proc.exited]);
+
+    expect(out).toContain(blockedLine);
+    expect(err).not.toContain("error:");
+    expect(exitCode).toBe(0);
+  });
+
+  test.concurrent("are reported for packages installed into the global store", async () => {
+    const packageDir = await createUntrustedScriptsDir({ linker: "isolated", globalStore: true });
+
+    const { out } = await runBunInstall(bunEnv, packageDir);
+
+    expect(out).toContain(blockedLine);
+    // Untrusted packages are eligible for the global store, so this is the
+    // path that bypasses script enqueueing entirely.
+    expect(lstatSync(join(packageDir, "node_modules", ".bun", "lifecycle-postinstall@1.0.0")).isSymbolicLink()).toBe(
+      true,
+    );
+  });
+});
+
 // When an auto-installed peer dependency has its OWN peer deps, those
 // transitive peers get re-queued during peer processing. If all manifest
 // loads are synchronous (cached with valid max-age) AND the transitive peer's
diff --git a/test/cli/install/migration/pnpm-lock-v9.test.ts b/test/cli/install/migration/pnpm-lock-v9.test.ts
index a79133b5a07c..17995bdac7cf 100644
--- a/test/cli/install/migration/pnpm-lock-v9.test.ts
+++ b/test/cli/install/migration/pnpm-lock-v9.test.ts
@@ -3796,4 +3796,178 @@ snapshots:
       expect(existsSync(join(String(dir), "bun.lock"))).toBe(false);
     });
   });
+
+  // pnpm's `onlyBuiltDependencies` is the allow-list of packages whose lifecycle
+  // scripts may run, which is `trustedDependencies` in bun.
+  describe("onlyBuiltDependencies", () => {
+    const LIFECYCLE_POSTINSTALL_1_0_0_INTEGRITY =
+      "sha512-+frsFSxvy+pkm5fjAsAHptt2NiMMMnU07dan43rZO1yCqxy8vU0X8wNTOYlgkViD7HCHT/bIpPhoki935Nc2pg==";
+
+    // `lifecycle-postinstall`'s postinstall writes postinstall.txt next to itself.
+    const lifecyclePostinstallLockfile = `lockfileVersion: '9.0'
+
+importers:
+
+  .:
+    dependencies:
+      lifecycle-postinstall:
+        specifier: 1.0.0
+        version: 1.0.0
+
+packages:
+
+  lifecycle-postinstall@1.0.0:
+    resolution: {integrity: ${LIFECYCLE_POSTINSTALL_1_0_0_INTEGRITY}}
+
+snapshots:
+
+  lifecycle-postinstall@1.0.0: {}
+`;
+
+    function postinstallRan(dir: string) {
+      return existsSync(join(dir, "node_modules", "lifecycle-postinstall", "postinstall.txt"));
+    }
+
+    for (const linker of ["hoisted", "isolated"] as const) {
+      test.concurrent(`pnpm-workspace.yaml list becomes trustedDependencies (${linker})`, async () => {
+        const { packageDir } = await verdaccio.createTestDir({
+          bunfigOpts: { linker },
+          files: {
+            "package.json": JSON.stringify({
+              name: "only-built-workspace-yaml",
+              dependencies: { "lifecycle-postinstall": "1.0.0" },
+            }),
+            "pnpm-workspace.yaml": "onlyBuiltDependencies:\n  - lifecycle-postinstall\n",
+            "pnpm-lock.yaml": lifecyclePostinstallLockfile,
+          },
+        });
+
+        const { stderr, exitCode } = await migrate(packageDir);
+
+        expect(stderr).toContain("pnpm-workspace.yaml onlyBuiltDependencies to trustedDependencies in package.json");
+        expect(stderr).toContain("migrated lockfile from pnpm-lock.yaml");
+        expect(exitCode).toBe(0);
+
+        expect(await Bun.file(join(packageDir, "package.json")).json()).toStrictEqual({
+          name: "only-built-workspace-yaml",
+          dependencies: { "lifecycle-postinstall": "1.0.0" },
+          trustedDependencies: ["lifecycle-postinstall"],
+        });
+        expect(await bunLockOf(packageDir)).toContain(`"trustedDependencies": [\n    "lifecycle-postinstall",\n  ]`);
+
+        const install = await run(packageDir, "install");
+
+        expect(install.stderr).not.toContain("error:");
+        expect(install.stdout).not.toContain("Blocked");
+        expect(postinstallRan(packageDir)).toBe(true);
+        expect(install.exitCode).toBe(0);
+      });
+
+      // Without an allow-list the scripts stay blocked, and the install has to say so.
+      test.concurrent(`blocked scripts are reported after migrating (${linker})`, async () => {
+        const { packageDir } = await verdaccio.createTestDir({
+          bunfigOpts: { linker },
+          files: {
+            "package.json": JSON.stringify({
+              name: "only-built-missing",
+              dependencies: { "lifecycle-postinstall": "1.0.0" },
+            }),
+            "pnpm-lock.yaml": lifecyclePostinstallLockfile,
+          },
+        });
+
+        const { stdout, stderr, exitCode } = await run(packageDir, "install");
+
+        expect(stderr).toContain("migrated lockfile from pnpm-lock.yaml");
+        expect(stderr).not.toContain("trustedDependencies");
+        expect(stdout).toContain("Blocked 1 postinstall. Run `bun pm untrusted` for details.");
+        expect(postinstallRan(packageDir)).toBe(false);
+        expect(exitCode).toBe(0);
+      });
+    }
+
+    test.concurrent("bun install migrates the list and runs the scripts in the same run", async () => {
+      const { packageDir } = await verdaccio.createTestDir({
+        bunfigOpts: { linker: "isolated" },
+        files: {
+          "package.json": JSON.stringify({
+            name: "only-built-install",
+            dependencies: { "lifecycle-postinstall": "1.0.0" },
+          }),
+          "pnpm-workspace.yaml": "onlyBuiltDependencies:\n  - lifecycle-postinstall\n",
+          "pnpm-lock.yaml": lifecyclePostinstallLockfile,
+        },
+      });
+
+      const { stdout, stderr, exitCode } = await run(packageDir, "install");
+
+      expect(stderr).toContain("pnpm-workspace.yaml onlyBuiltDependencies to trustedDependencies in package.json");
+      expect(stderr).toContain("migrated lockfile from pnpm-lock.yaml");
+      expect(stdout).not.toContain("Blocked");
+      expect(postinstallRan(packageDir)).toBe(true);
+      expect(exitCode).toBe(0);
+      expect((await Bun.file(join(packageDir, "package.json")).json()).trustedDependencies).toEqual([
+        "lifecycle-postinstall",
+      ]);
+    });
+
+    // pnpm 9 kept the list in package.json. Both sources merge into an existing list, and
+    // the pnpm block keeps its copy for anyone still running pnpm on the project.
+    test.concurrent("package.json pnpm.onlyBuiltDependencies merges into an existing trustedDependencies", async () => {
+      const pnpm = { onlyBuiltDependencies: ["esbuild", "from-package-json"] };
+      using dir = tempDir("pnpm-v9-only-built-pnpm-field", {
+        "package.json": JSON.stringify({
+          name: "only-built-pnpm-field",
+          trustedDependencies: ["already-trusted", "esbuild"],
+          pnpm,
+        }),
+        "pnpm-workspace.yaml": "onlyBuiltDependencies:\n  - from-workspace-yaml\n  - esbuild\n",
+        "pnpm-lock.yaml": `lockfileVersion: '9.0'
+
+importers:
+
+  .: {}
+`,
+      });
+
+      const { stderr, exitCode } = await migrate(String(dir));
+
+      expect(stderr).toContain(
+        "pnpm.onlyBuiltDependencies to trustedDependencies, pnpm-workspace.yaml onlyBuiltDependencies to trustedDependencies in package.json",
+      );
+      expect(stderr).toContain("migrated lockfile from pnpm-lock.yaml");
+      expect(exitCode).toBe(0);
+
+      expect(await Bun.file(join(String(dir), "package.json")).json()).toStrictEqual({
+        name: "only-built-pnpm-field",
+        trustedDependencies: ["already-trusted", "esbuild", "from-package-json", "from-workspace-yaml"],
+        pnpm,
+      });
+    });
+
+    test.concurrent("a list that adds nothing leaves package.json alone", async () => {
+      const packageJson = {
+        name: "only-built-nothing-new",
+        trustedDependencies: ["esbuild"],
+        pnpm: { onlyBuiltDependencies: [] },
+      };
+      using dir = tempDir("pnpm-v9-only-built-nothing-new", {
+        "package.json": JSON.stringify(packageJson),
+        "pnpm-workspace.yaml": "onlyBuiltDependencies:\n  - esbuild\n",
+        "pnpm-lock.yaml": `lockfileVersion: '9.0'
+
+importers:
+
+  .: {}
+`,
+      });
+
+      const { stderr, exitCode } = await migrate(String(dir));
+
+      expect(stderr).not.toContain("onlyBuiltDependencies");
+      expect(stderr).toContain("migrated lockfile from pnpm-lock.yaml");
+      expect(exitCode).toBe(0);
+      expect(await Bun.file(join(String(dir), "package.json")).json()).toStrictEqual(packageJson);
+    });
+  });
 });

From 59746871fc687f1c65c0911506168e0c6df2a33d Mon Sep 17 00:00:00 2001
From: robobun <117481402+robobun@users.noreply.github.com>
Date: Mon, 17 Aug 2026 01:45:13 +0000
Subject: [PATCH 122/258] install: name folder, tarball and git packages
 without a package.json name after their source (#38681)

---
 .../PackageManager/processDependencyList.rs   |  58 ++----
 src/install/PackageManager/runTasks.rs        |   2 -
 src/install/dependency.rs                     |  30 +++
 src/install/lockfile/Package.rs               | 135 +++---------
 src/install/repository.rs                     |  51 +----
 src/install/resolution.rs                     |  11 -
 src/install/resolvers/folder_resolver.rs      |   9 +
 test/cli/install/bun-add.test.ts              |  45 ++++
 test/cli/install/bun-install-git-deps.test.ts |  57 +++++-
 test/cli/install/bun-install.test.ts          | 192 ++++++++++++++++++
 test/cli/install/bun-lock.test.ts             |  97 +++++++++
 test/cli/install/isolated-install.test.ts     |  47 +++++
 12 files changed, 532 insertions(+), 202 deletions(-)

diff --git a/src/install/PackageManager/processDependencyList.rs b/src/install/PackageManager/processDependencyList.rs
index 492110ad87af..92ca76b219fb 100644
--- a/src/install/PackageManager/processDependencyList.rs
+++ b/src/install/PackageManager/processDependencyList.rs
@@ -15,11 +15,11 @@ use crate::package_manager_real::options::LogLevel;
 use crate::package_manager_real::{
     PackageManager, TaskCallbackList, enqueue, resolution as pm_resolution,
 };
-use crate::repository_real::{Repository, RepositoryExt as _};
+use crate::repository_real::RepositoryExt as _;
 use crate::resolution::{ResolutionType, Tag as ResolutionTag, TaggedValue};
 use crate::{
-    DependencyID, ExtractData, Features, INVALID_PACKAGE_ID, PackageID, Resolution,
-    TaskCallbackContext, initialize_store,
+    ExtractData, Features, INVALID_PACKAGE_ID, PackageID, Resolution, TaskCallbackContext,
+    dependency, initialize_store,
 };
 
 // ──────────────────────────────────────────────────────────────────────────
@@ -29,16 +29,12 @@ use crate::{
 pub struct GitResolver<'a> {
     pub(crate) resolved: &'a [u8],
     pub(crate) resolution: &'a Resolution,
-    pub(crate) dep_id: DependencyID,
-    /// Owned scratch buffer that
-    /// `Package::parse_with_json` may assign when the package.json `name`
-    /// field is missing (see `ResolverContext::set_new_name`).
-    pub(crate) new_name: Vec<u8>,
+    /// `Repository::fallback_package_name`, copied out before parsing starts
+    /// because it is sliced from the lockfile string buffer parsing appends to.
+    pub(crate) fallback_name: &'a [u8],
 }
 
 impl<'a> ResolverContext for GitResolver<'a> {
-    const IS_GIT_RESOLVER: bool = true;
-
     fn check_bundled_dependencies() -> bool {
         true
     }
@@ -67,20 +63,8 @@ impl<'a> ResolverContext for GitResolver<'a> {
         }))
     }
 
-    fn resolution(&self) -> &Resolution {
-        self.resolution
-    }
-    fn dep_id(&self) -> DependencyID {
-        self.dep_id
-    }
-    fn new_name(&self) -> &[u8] {
-        &self.new_name
-    }
-    fn set_new_name(&mut self, name: Vec<u8>) {
-        self.new_name = name;
-    }
-    fn take_new_name(&mut self) -> Vec<u8> {
-        core::mem::take(&mut self.new_name)
+    fn fallback_name(&self) -> Option<Vec<u8>> {
+        Some(self.fallback_name.to_vec())
     }
 }
 
@@ -117,6 +101,10 @@ impl<'a> ResolverContext for TarballResolver<'a> {
             _ => unreachable!(),
         }))
     }
+
+    fn fallback_name(&self) -> Option<Vec<u8>> {
+        Some(dependency::fallback_package_name(self.url).to_vec())
+    }
 }
 
 // ──────────────────────────────────────────────────────────────────────────
@@ -128,7 +116,6 @@ impl PackageManager {
     pub(crate) fn process_extracted_tarball_package(
         &mut self,
         package_id: &mut PackageID,
-        dep_id: DependencyID,
         resolution: &Resolution,
         data: &ExtractData,
         log_level: LogLevel,
@@ -136,11 +123,14 @@ impl PackageManager {
         match resolution.tag {
             ResolutionTag::Git | ResolutionTag::Github => {
                 let mut package = 'package: {
+                    let fallback_name: Vec<u8> = resolution
+                        .repository()
+                        .fallback_package_name(self.lockfile.buffers.string_bytes.as_slice())
+                        .to_vec();
                     let mut resolver = GitResolver {
                         resolved: &data.resolved,
                         resolution,
-                        dep_id,
-                        new_name: Vec::new(),
+                        fallback_name: &fallback_name,
                     };
 
                     let mut pkg = Package::default();
@@ -184,25 +174,15 @@ impl PackageManager {
                     }
 
                     // package.json doesn't exist, no dependencies to worry about but we need to decide on a name for the dependency
-                    // tag is `.git` or `.github`; both store `Repository`.
-                    let repo = *resolution.repository();
-
-                    let new_name = Repository::create_dependency_name_from_version_literal(
-                        &repo,
-                        self.lockfile.buffers.string_bytes.as_slice(),
-                        &self.lockfile.buffers.dependencies[dep_id as usize],
-                    );
-                    // `defer manager.allocator.free(new_name)` — `new_name: Vec<u8>` drops at scope end.
-
                     {
                         let mut builder = self.lockfile.string_builder();
 
-                        builder.count(&new_name);
+                        builder.count(&fallback_name);
                         resolver.count(&mut builder, &Expr::default());
 
                         bun_core::handle_oom(builder.allocate());
 
-                        let name = builder.append::<ExternalString>(&new_name);
+                        let name = builder.append::<ExternalString>(&fallback_name);
                         pkg.name = name.value;
                         pkg.name_hash = name.hash;
 
diff --git a/src/install/PackageManager/runTasks.rs b/src/install/PackageManager/runTasks.rs
index 97b6d6b54215..2828589c97dc 100644
--- a/src/install/PackageManager/runTasks.rs
+++ b/src/install/PackageManager/runTasks.rs
@@ -1156,7 +1156,6 @@ pub fn run_tasks<C: RunTasksCallbacks>(
                     }
                 } else if let Some(pkg) = manager.process_extracted_tarball_package(
                     &mut package_id,
-                    dependency_id,
                     resolution,
                     // Tag-checked accessor (debug_asserts Extract|LocalTarball);
                     // shared `&task` here coexists with the field-disjoint
@@ -1489,7 +1488,6 @@ pub fn run_tasks<C: RunTasksCallbacks>(
                     }
                 } else if let Some(pkg) = manager.process_extracted_tarball_package(
                     &mut package_id,
-                    git_checkout.dependency_id,
                     resolution,
                     // Tag-checked accessor (debug_asserts GitCheckout); shared
                     // `&task` here coexists with the field-disjoint
diff --git a/src/install/dependency.rs b/src/install/dependency.rs
index 2230bc6850fb..bae9e1f8cc06 100644
--- a/src/install/dependency.rs
+++ b/src/install/dependency.rs
@@ -587,6 +587,36 @@ pub(crate) fn contains_control_character(name: &[u8]) -> bool {
     })
 }
 
+/// bun.lock stores a package as `"<name>@<resolution>"` and takes it apart again with
+/// `split_name_and_version`, then rejects names that fail `is_safe_install_folder_name`.
+/// A name containing any `@` other than a scope marker (`a@b`, `@s/a@b`) or failing that
+/// check would therefore be written out but could never be loaded back.
+pub(crate) fn is_safe_lockfile_package_name(name: &[u8]) -> bool {
+    is_safe_install_folder_name(name) && !strings::contains_char(&name[1..], b'@')
+}
+
+const FALLBACK_PACKAGE_NAME: &[u8] = b"unnamed-package";
+
+/// Name for a package whose own package.json has no `name`: the last component of where it
+/// came from, so `../pkgs/foo`, `https://host/foo.tgz?token=x` and `https://host/user/foo`
+/// all become `foo`. Always `is_safe_lockfile_package_name`, since it ends up in bun.lock.
+pub(crate) fn fallback_package_name(location: &[u8]) -> &[u8] {
+    let without_query = match strings::index_of_char(location, b'?') {
+        Some(query_start) => &location[..query_start as usize],
+        None => location,
+    };
+    let basename = bun_paths::basename(without_query);
+    let name = strings::without_suffix_comptime(
+        strings::without_suffix_comptime(basename, b".tgz"),
+        b".tar.gz",
+    );
+    if is_safe_lockfile_package_name(name) {
+        name
+    } else {
+        FALLBACK_PACKAGE_NAME
+    }
+}
+
 /// assumes version is valid
 pub fn without_build_tag(version: &[u8]) -> &[u8] {
     if let Some(plus) = strings::index_of_char(version, b'+') {
diff --git a/src/install/lockfile/Package.rs b/src/install/lockfile/Package.rs
index 20de29c14307..7ed38f1ac6e0 100644
--- a/src/install/lockfile/Package.rs
+++ b/src/install/lockfile/Package.rs
@@ -12,12 +12,10 @@ use bun_semver::{self as semver, ExternalString, String, Version as SemverVersio
 
 use crate::bun_json::{E, Expr, ExprData};
 use crate::dependency::{Behavior, DependencyExt as _, TagExt as _};
-use crate::repository::RepositoryExt as _;
 use crate::{
     self as install, Aligner, Bin, Dependency, ExternalStringList, ExternalStringMap, Features,
-    Npm, PackageID, PackageManager, PackageNameHash, Repository, TruncatedPackageNameHash,
-    UpdateRequest, bin, default_trusted_dependencies, dependency, initialize_store,
-    invalid_package_id,
+    Npm, PackageID, PackageManager, PackageNameHash, TruncatedPackageNameHash, UpdateRequest, bin,
+    default_trusted_dependencies, dependency, initialize_store, invalid_package_id,
 };
 // `Package.rs` is mounted as `crate::lockfile_real::package`; the parent module
 // (`super`) is the real `lockfile.rs`, distinct from the `crate::lockfile`
@@ -237,7 +235,6 @@ pub(crate) type Resolution<SemverIntType> = ResolutionType<SemverIntType>;
 // override what they need. The `()` impl is the no-op resolver.
 pub trait ResolverContext {
     const IS_VOID: bool = false;
-    const IS_GIT_RESOLVER: bool = false;
 
     fn check_bundled_dependencies() -> bool {
         false
@@ -261,34 +258,12 @@ pub trait ResolverContext {
         json: &Expr,
     ) -> crate::Result<ResolutionType<u64>>;
 
-    // ── GitResolver-only surface ────────────────────────────────────────────
-    // Trait methods so non-git
-    // resolvers don't need the fields; default impls are dead code (gated on
-    // `IS_GIT_RESOLVER`). The bodies here are never executed — calls are
-    // statically guarded by `if R::IS_GIT_RESOLVER` — so a debug assertion
-    // documents the invariant without panicking in release.
-    fn resolution(&self) -> &ResolutionType<u64> {
-        debug_assert!(
-            false,
-            "ResolverContext::resolution called on non-git resolver"
-        );
-        // SAFETY: unreachable in practice; never dereferenced when the
-        // `IS_GIT_RESOLVER` gate is false. `ZEROED` is an associated const on a
-        // trait-bounded generic impl, which Rust refuses to evaluate in `const`
-        // position; a `static` (with `Sync` POD payload) sidesteps that.
-        static EMPTY: ResolutionType<u64> = ResolutionType::<u64>::ZEROED;
-        &EMPTY
-    }
-    fn dep_id(&self) -> install::DependencyID {
-        debug_assert!(false, "ResolverContext::dep_id called on non-git resolver");
-        0
-    }
-    fn new_name(&self) -> &[u8] {
-        b""
-    }
-    fn set_new_name(&mut self, _name: Vec<u8>) {}
-    fn take_new_name(&mut self) -> Vec<u8> {
-        Vec::new()
+    /// Name to store when the package.json has no `name`. Resolvers for
+    /// packages fetched from somewhere (git, tarballs, folders) derive one from
+    /// the source; `None` (the root, workspace members, the npm cache) leaves
+    /// the package unnamed.
+    fn fallback_name(&self) -> Option<Vec<u8>> {
+        None
     }
 }
 
@@ -320,7 +295,6 @@ impl ResolverContext for () {
 // permitted on object-safe trait methods, only type generics are not.
 trait ResolverContextDyn {
     fn is_void(&self) -> bool;
-    fn is_git(&self) -> bool;
     fn check_bundled_dependencies(&self) -> bool;
 
     fn count(&mut self, builder: &mut StringBuilder<'_>, json: &Expr);
@@ -330,11 +304,7 @@ trait ResolverContextDyn {
         json: &Expr,
     ) -> crate::Result<ResolutionType<u64>>;
 
-    fn resolution(&self) -> &ResolutionType<u64>;
-    fn dep_id(&self) -> install::DependencyID;
-    fn new_name(&self) -> &[u8];
-    fn set_new_name(&mut self, name: Vec<u8>);
-    fn take_new_name(&mut self) -> Vec<u8>;
+    fn fallback_name(&self) -> Option<Vec<u8>>;
 }
 
 impl<R: ResolverContext> ResolverContextDyn for R {
@@ -343,10 +313,6 @@ impl<R: ResolverContext> ResolverContextDyn for R {
         R::IS_VOID
     }
     #[inline]
-    fn is_git(&self) -> bool {
-        R::IS_GIT_RESOLVER
-    }
-    #[inline]
     fn check_bundled_dependencies(&self) -> bool {
         R::check_bundled_dependencies()
     }
@@ -365,24 +331,8 @@ impl<R: ResolverContext> ResolverContextDyn for R {
     }
 
     #[inline]
-    fn resolution(&self) -> &ResolutionType<u64> {
-        ResolverContext::resolution(self)
-    }
-    #[inline]
-    fn dep_id(&self) -> install::DependencyID {
-        ResolverContext::dep_id(self)
-    }
-    #[inline]
-    fn new_name(&self) -> &[u8] {
-        ResolverContext::new_name(self)
-    }
-    #[inline]
-    fn set_new_name(&mut self, name: Vec<u8>) {
-        ResolverContext::set_new_name(self, name)
-    }
-    #[inline]
-    fn take_new_name(&mut self) -> Vec<u8> {
-        ResolverContext::take_new_name(self)
+    fn fallback_name(&self) -> Option<Vec<u8>> {
+        ResolverContext::fallback_name(self)
     }
 }
 
@@ -2239,7 +2189,7 @@ impl Package<u64> {
         self.name_hash = 0;
 
         // -- Count the sizes
-        'name: {
+        let name: &[u8] = 'name: {
             if let Some(name_q) = json.as_property(b"name") {
                 if let Some(name) = name_q.expr.as_utf8(&bump) {
                     if !name.is_empty() {
@@ -2253,29 +2203,28 @@ impl Package<u64> {
                             );
                             return Err(crate::Error::InvalidPackageJSON);
                         }
-                        string_builder.count(name);
-                        break 'name;
+                        // Non-root names become bun.lock `packages` entries, which can
+                        // only be read back if `is_safe_lockfile_package_name` holds.
+                        if !FEATURES.is_main && !dependency::is_safe_lockfile_package_name(name) {
+                            log.add_error_fmt(
+                                source,
+                                value_loc_of(source, name_q.loc),
+                                format_args!("Invalid package name {}", bun_core::fmt::quote(name)),
+                            );
+                            return Err(crate::Error::InvalidPackageJSON);
+                        }
+                        break 'name name;
                     }
                 }
             }
 
-            // name is not validated by npm, so fallback to creating a new from the version literal
-            if resolver.is_git() {
-                let resolution: &Resolution<u64> = resolver.resolution();
-                let repo = match resolution.tag {
-                    ResolutionTag::Git => *resolution.git(),
-                    ResolutionTag::Github => *resolution.github(),
-                    _ => break 'name,
-                };
-
-                resolver.set_new_name(Repository::create_dependency_name_from_version_literal(
-                    &repo,
-                    string_builder.string_bytes.as_slice(),
-                    &lockfile.buffers.dependencies[resolver.dep_id() as usize],
-                ));
-
-                string_builder.count(resolver.new_name());
+            match resolver.fallback_name() {
+                Some(fallback_name) => bump.alloc_slice_copy(&fallback_name),
+                None => b"",
             }
+        };
+        if !name.is_empty() {
+            string_builder.count(name);
         }
 
         if let Some(patched_deps) = json.as_property(b"patchedDependencies") {
@@ -2593,28 +2542,10 @@ impl Package<u64> {
         // was reserved above so it does not realloc.
         let mut package_dependencies: Vec<Dependency> = Vec::with_capacity(total_len - off);
 
-        'name: {
-            if resolver.is_git() {
-                if !resolver.new_name().is_empty() {
-                    let new_name = resolver.take_new_name();
-                    let external_string = string_builder.append::<ExternalString>(&new_name);
-                    self.name = external_string.value;
-                    self.name_hash = external_string.hash;
-                    break 'name;
-                }
-            }
-
-            if let Some(name_q) = json.as_property(b"name") {
-                if let Some(name) = name_q.expr.as_utf8(&bump) {
-                    if !name.is_empty() {
-                        let external_string = string_builder.append::<ExternalString>(name);
-
-                        self.name = external_string.value;
-                        self.name_hash = external_string.hash;
-                        break 'name;
-                    }
-                }
-            }
+        if !name.is_empty() {
+            let external_string = string_builder.append::<ExternalString>(name);
+            self.name = external_string.value;
+            self.name_hash = external_string.hash;
         }
 
         if !FEATURES.is_main {
diff --git a/src/install/repository.rs b/src/install/repository.rs
index 58978edbb073..0d461277d890 100644
--- a/src/install/repository.rs
+++ b/src/install/repository.rs
@@ -322,11 +322,9 @@ pub trait RepositoryExt: Sized {
     fn parse_append_git(input: &[u8], buf: &mut StringBuf<'_>) -> Result<Repository, AllocError>;
     fn parse_append_github(input: &[u8], buf: &mut StringBuf<'_>)
     -> Result<Repository, AllocError>;
-    fn create_dependency_name_from_version_literal(
-        repository: &Repository,
-        string_buf: &[u8],
-        dep: &Install::Dependency,
-    ) -> Vec<u8>;
+    /// `dependency::fallback_package_name` of the repository, for a checkout
+    /// whose package.json has no `name` (or no package.json at all).
+    fn fallback_package_name<'a>(&'a self, string_buf: &'a [u8]) -> &'a [u8];
     fn format_as(&self, label: &str, buf: &[u8], writer: &mut impl fmt::Write) -> fmt::Result;
     fn fmt_store_path<'a>(&'a self, label: &'a str, string_buf: &'a [u8])
     -> StorePathFormatter<'a>;
@@ -542,45 +540,12 @@ impl RepositoryExt for Repository {
         Ok(result)
     }
 
-    fn create_dependency_name_from_version_literal(
-        repository: &Repository,
-        string_buf: &[u8],
-        dep: &Install::Dependency,
-    ) -> Vec<u8> {
-        // Callers (`parse_with_json`) hold a split `StringBuilder`
-        // borrow on `string_bytes`, so accept the two pieces directly.
-        let buf = string_buf;
-        let repo_name = repository.repo;
-        let repo_name_str = repo_name.slice(buf);
-
-        let name = 'brk: {
-            let mut remain = repo_name_str;
-
-            if let Some(hash_index) = strings::index_of_char(remain, b'#') {
-                remain = &remain[..hash_index as usize];
-            }
-
-            if remain.is_empty() {
-                break 'brk remain;
-            }
-
-            if let Some(slash_index) = strings::last_index_of_char(remain, b'/') {
-                remain = &remain[slash_index + 1..];
-            }
-
-            remain
-        };
-
-        if name.is_empty() {
-            let version_literal = dep.version.literal.slice(buf);
-            let mut name_buf = [0u8; bun_sha::SHA1::DIGEST];
-            let mut sha1 = bun_sha::SHA1::init();
-            sha1.update(version_literal);
-            sha1.r#final(&mut name_buf);
-            return name_buf.to_vec();
+    fn fallback_package_name<'a>(&'a self, string_buf: &'a [u8]) -> &'a [u8] {
+        let mut repo = self.repo.slice(string_buf);
+        if let Some(hash_index) = strings::index_of_char(repo, b'#') {
+            repo = &repo[..hash_index as usize];
         }
-
-        name.to_vec()
+        Dependency::fallback_package_name(repo)
     }
 
     fn format_as(&self, label: &str, buf: &[u8], writer: &mut impl fmt::Write) -> fmt::Result {
diff --git a/src/install/resolution.rs b/src/install/resolution.rs
index bd665fdd674c..f09297efb23d 100644
--- a/src/install/resolution.rs
+++ b/src/install/resolution.rs
@@ -96,17 +96,6 @@ pub enum TaggedValue<SemverInt: VersionInt> {
 }
 
 impl<SemverInt: VersionInt> ResolutionType<SemverInt> {
-    /// Const-evaluable zeroed sentinel. Mirrors `Default::default()` but usable
-    /// in `const` / `static` position (e.g. dummy `&'static Resolution` returns).
-    /// Only the tag/padding are guaranteed zero — the union payload is the
-    /// `uninitialized` variant, which is the only field a `Tag::Uninitialized`
-    /// reader may legally access.
-    pub(crate) const ZEROED: Self = Self {
-        tag: Tag::Uninitialized,
-        _padding: [0; 7],
-        value: Value { uninitialized: () },
-    };
-
     /// Construct from a tagged value, e.g. `Resolution::init(TaggedValue::Npm(...))`.
     #[inline]
     pub(crate) fn init(value: TaggedValue<SemverInt>) -> Self {
diff --git a/src/install/resolvers/folder_resolver.rs b/src/install/resolvers/folder_resolver.rs
index e81504332ad2..fd178f8e5780 100644
--- a/src/install/resolvers/folder_resolver.rs
+++ b/src/install/resolvers/folder_resolver.rs
@@ -127,6 +127,15 @@ impl<'a, const TAG: ResolutionTag> ResolverContext for NewResolver<'a, TAG> {
             _ => unreachable!(),
         }))
     }
+
+    fn fallback_name(&self) -> Option<Vec<u8>> {
+        // Workspace members were already registered under their package.json
+        // name by `WorkspaceMap` and are found by that name again later.
+        if matches!(TAG, ResolutionTag::Workspace) {
+            return None;
+        }
+        Some(dependency::fallback_package_name(self.folder_path).to_vec())
+    }
 }
 
 type Resolver<'a> = NewResolver<'a, { ResolutionTag::Folder }>;
diff --git a/test/cli/install/bun-add.test.ts b/test/cli/install/bun-add.test.ts
index a399f6b8f6d5..7e851a02f90d 100644
--- a/test/cli/install/bun-add.test.ts
+++ b/test/cli/install/bun-add.test.ts
@@ -97,6 +97,51 @@ it("should add existing package", async () => {
   );
 });
 
+it("should add a folder whose package.json has no name under the folder's name", async () => {
+  // Used to be added as `"": "file:..."` and then fail to install anywhere.
+  const pkg_dir = join(add_dir, "pkg-without-name");
+  await mkdir(pkg_dir);
+  await writeFile(join(pkg_dir, "package.json"), JSON.stringify({ version: "0.0.1" }));
+  await writeFile(
+    join(package_dir, "package.json"),
+    JSON.stringify({
+      name: "bar",
+      version: "0.0.2",
+    }),
+  );
+  const add_path = relative(package_dir, pkg_dir).replace(/\\/g, "/");
+  const { stdout, stderr, exited } = spawn({
+    cmd: [bunExe(), "add", `file:${add_path}`],
+    cwd: package_dir,
+    stdout: "pipe",
+    stdin: "pipe",
+    stderr: "pipe",
+    env,
+  });
+  const [err, out, exitCode] = await Promise.all([stderr.text(), stdout.text(), exited]);
+  expect(err).not.toContain("error:");
+  expect(err).not.toContain("warn:");
+  expect(err).toContain("Saved lockfile");
+  expect(out.replace(/\s*\[[0-9\.]+m?s\]\s*$/, "").split(/\r?\n/)).toEqual([
+    expect.stringContaining("bun add v1."),
+    "",
+    `installed pkg-without-name@${add_path}`,
+    "",
+    "1 package installed",
+  ]);
+  expect(exitCode).toBe(0);
+  expect(await file(join(package_dir, "package.json")).json()).toEqual({
+    name: "bar",
+    version: "0.0.2",
+    dependencies: {
+      "pkg-without-name": `file:${add_path}`,
+    },
+  });
+  expect(await file(join(package_dir, "node_modules", "pkg-without-name", "package.json")).json()).toEqual({
+    version: "0.0.1",
+  });
+});
+
 it("should reject missing package", async () => {
   await writeFile(
     join(package_dir, "package.json"),
diff --git a/test/cli/install/bun-install-git-deps.test.ts b/test/cli/install/bun-install-git-deps.test.ts
index e68d82e08421..cb28a6fd1389 100644
--- a/test/cli/install/bun-install-git-deps.test.ts
+++ b/test/cli/install/bun-install-git-deps.test.ts
@@ -34,19 +34,23 @@ function git(cwd: string, ...args: string[]) {
 }
 
 interface BranchPackage {
-  name: string;
+  name?: string;
   branch: string;
   dependencies?: Record<string, string>;
   /** Files committed next to package.json; an `index.js` entry replaces the default one. */
   files?: Record<string, string>;
 }
 
-// Creates `<root>/shared-repo.git`, a bare repo with one orphan branch per
+// Creates `<root>/<repoName>`, a bare repo with one orphan branch per
 // package, and prepares it for serving over dumb HTTP.
-async function makeSharedRepo(root: string, packages: BranchPackage[]): Promise<string> {
-  const bare = join(root, "shared-repo.git");
+async function makeSharedRepo(
+  root: string,
+  packages: BranchPackage[],
+  repoName: string = "shared-repo.git",
+): Promise<string> {
+  const bare = join(root, repoName);
   const work = join(root, "work");
-  await git(root, "init", "-q", "--bare", "shared-repo.git");
+  await git(root, "init", "-q", "--bare", repoName);
   mkdirSync(work);
   await git(work, "init", "-q");
   for (const pkg of packages) {
@@ -578,3 +582,46 @@ test.concurrent("rejects a file: folder dependency of a tarball package that poi
   ).toBe(false);
   expect(exitCode).toBe(1);
 });
+
+// A git package whose package.json has no name is named after its repository. bun.lock stores a
+// package as "<name>@<resolution>", so when that repository name itself contains an "@" (or is
+// otherwise unusable as a package name) the generic name is used instead; the repository name
+// used to be taken as-is, producing an entry the next install could not parse ("Ignoring
+// lockfile"). Folders and tarballs without a name are covered in bun-lock.test.ts.
+test.concurrent("names a git dependency without a package.json name after its repository", async () => {
+  using dir = tempDir("git-dep-no-name", {});
+  using oddDir = tempDir("git-dep-no-name-odd-repo", {});
+  const root = String(dir);
+  const repo = `git+${pathToFileURL(await makeSharedRepo(root, [{ branch: "no-name" }]))}`;
+  const oddRepo = `git+${pathToFileURL(await makeSharedRepo(String(oddDir), [{ branch: "odd-repo" }], "odd@repo.git"))}`;
+
+  const project = join(root, "project");
+  mkdirSync(project);
+  writeFileSync(
+    join(project, "package.json"),
+    JSON.stringify({
+      name: "project",
+      version: "1.0.0",
+      dependencies: {
+        "no-name-dep": `${repo}#no-name`,
+        "odd-repo-dep": `${oddRepo}#odd-repo`,
+      },
+    }),
+  );
+
+  let { stderr, exitCode } = await runInstall(project, join(root, "cache"), {});
+  expect(stderr).not.toContain("error:");
+  expect(await installedVersionOf(project, "no-name-dep")).toBe("no-name");
+  expect(await installedVersionOf(project, "odd-repo-dep")).toBe("odd-repo");
+  expect(exitCode).toBe(0);
+
+  const lockfile = await Bun.file(join(project, "bun.lock")).text();
+  expect(lockfile).toContain(`"no-name-dep": ["shared-repo.git@${repo}#`);
+  expect(lockfile).toContain(`"odd-repo-dep": ["unnamed-package@${oddRepo}#`);
+
+  ({ stderr, exitCode } = await runInstall(project, join(root, "cache"), {}, "--frozen-lockfile"));
+  expect(stderr).not.toContain("Ignoring lockfile");
+  expect(stderr).not.toContain("error:");
+  expect(await Bun.file(join(project, "bun.lock")).text()).toBe(lockfile);
+  expect(exitCode).toBe(0);
+});
diff --git a/test/cli/install/bun-install.test.ts b/test/cli/install/bun-install.test.ts
index 11d18651b6f8..fa2357409e4d 100644
--- a/test/cli/install/bun-install.test.ts
+++ b/test/cli/install/bun-install.test.ts
@@ -11165,6 +11165,198 @@ describe.concurrent("a dependency whose own package.json has an invalid name", (
   });
 });
 
+describe.concurrent("a dependency whose own package.json has an invalid name", () => {
+  // The name inside a tarball, folder or git dependency's package.json is written
+  // to bun.lock as `name@resolution`, and the bun.lock parser rejects names that
+  // are not safe install folder names. Saving such a name used to succeed and
+  // leave behind a lockfile that every later `bun install` ignored, so the
+  // install has to fail before the lockfile is saved.
+  async function install(root: string, ...args: string[]) {
+    await using proc = spawn({
+      cmd: [bunExe(), "install", ...args],
+      cwd: join(root, "project"),
+      env: { ...env, BUN_INSTALL_CACHE_DIR: join(root, "cache") },
+      stdout: "pipe",
+      stderr: "pipe",
+    });
+    const [out, err, exitCode] = await Promise.all([proc.stdout.text(), proc.stderr.text(), proc.exited]);
+    return { out, err, exitCode };
+  }
+
+  async function expectRejected(root: string, quotedName: string) {
+    const { out, err, exitCode } = await install(root);
+    expect(err).toContain(`error: Invalid package name ${quotedName}`);
+    expect(out).not.toContain("1 package installed");
+    expect(await exists(join(root, "project", "bun.lock"))).toBe(false);
+    expect(await exists(join(root, "project", "node_modules", "dep"))).toBe(false);
+    expect(exitCode).toBe(1);
+    return err;
+  }
+
+  it("fails to install a local tarball", async () => {
+    using dir = tempDir("invalid-name-tarball", {
+      "project/package.json": JSON.stringify({
+        name: "foo",
+        version: "0.0.1",
+        dependencies: { dep: "file:../dep.tgz" },
+      }),
+    });
+    await Bun.Archive.write(
+      join(String(dir), "dep.tgz"),
+      { "package/package.json": JSON.stringify({ name: "a:b", version: "1.0.0" }) },
+      { compress: "gzip" },
+    );
+
+    await expectRejected(String(dir), '"a:b"');
+  });
+
+  it("fails to install a file: folder and points at the offending package.json", async () => {
+    using dir = tempDir("invalid-name-folder", {
+      "project/package.json": JSON.stringify({
+        name: "foo",
+        version: "0.0.1",
+        dependencies: { dep: "file:../lib" },
+      }),
+      "lib/package.json": JSON.stringify({ name: "lib/..", version: "1.0.0" }),
+    });
+
+    const err = await expectRejected(String(dir), '"lib/.."');
+    expect(err).toMatch(/ at .*lib[\\/]package\.json:1:9\s/);
+  });
+
+  it("escapes the rejected name in the error message", async () => {
+    using dir = tempDir("invalid-name-escaped", {
+      "project/package.json": JSON.stringify({
+        name: "foo",
+        version: "0.0.1",
+        dependencies: { dep: "file:../lib" },
+      }),
+      "lib/package.json": JSON.stringify({ name: "a\0b", version: "1.0.0" }),
+    });
+
+    await expectRejected(String(dir), '"a\\u0000b"');
+  });
+
+  it("fails to install a git dependency", async () => {
+    using dir = tempDir("invalid-name-git", {
+      "work/package.json": JSON.stringify({ name: "a\\b", version: "1.0.0" }),
+    });
+    await createDumbHttpGitRepo(String(dir), {});
+    using server = serveDirectory(String(dir));
+    await write(
+      join(String(dir), "project", "package.json"),
+      JSON.stringify({
+        name: "foo",
+        version: "0.0.1",
+        dependencies: { dep: `git+http://localhost:${server.port}/repo.git` },
+      }),
+    );
+
+    await expectRejected(String(dir), '"a\\b"');
+  });
+
+  // The bun.lock parser splits `name@resolution` at the first "@" after an optional scope, so a
+  // name with any other "@" in it cannot be stored either, even though it is a safe folder name.
+  it("fails to install a file: folder whose name contains an @", async () => {
+    using dir = tempDir("invalid-name-at-folder", {
+      "project/package.json": JSON.stringify({
+        name: "foo",
+        version: "0.0.1",
+        dependencies: { dep: "file:../lib" },
+      }),
+      "lib/package.json": JSON.stringify({ name: "a@b", version: "1.0.0" }),
+    });
+
+    await expectRejected(String(dir), '"a@b"');
+  });
+
+  it("fails to install a local tarball whose scoped name contains a second @", async () => {
+    using dir = tempDir("invalid-name-at-tarball", {
+      "project/package.json": JSON.stringify({
+        name: "foo",
+        version: "0.0.1",
+        dependencies: { dep: "file:../dep.tgz" },
+      }),
+    });
+    await Bun.Archive.write(
+      join(String(dir), "dep.tgz"),
+      { "package/package.json": JSON.stringify({ name: "@scope/a@b", version: "1.0.0" }) },
+      { compress: "gzip" },
+    );
+
+    await expectRejected(String(dir), '"@scope/a@b"');
+  });
+
+  it("fails to install a workspace whose member's name contains an @", async () => {
+    using dir = tempDir("invalid-name-at-workspace", {
+      "project/package.json": JSON.stringify({
+        name: "foo",
+        version: "0.0.1",
+        workspaces: ["packages/*"],
+      }),
+      "project/packages/member/package.json": JSON.stringify({ name: "a@b", version: "1.0.0" }),
+    });
+
+    const { err, exitCode } = await install(String(dir));
+    expect(err).toContain('error: Invalid package name "a@b"');
+    expect(err).toMatch(/ at .*member[\\/]package\.json:1:9\s/);
+    expect(await exists(join(String(dir), "project", "bun.lock"))).toBe(false);
+    expect(exitCode).toBe(1);
+  });
+
+  it("still installs scoped names and writes a lockfile the next install loads", async () => {
+    using dir = tempDir("valid-scoped-name-tarball", {
+      "project/package.json": JSON.stringify({
+        name: "foo",
+        version: "0.0.1",
+        dependencies: { dep: "file:../dep.tgz" },
+      }),
+    });
+    await Bun.Archive.write(
+      join(String(dir), "dep.tgz"),
+      { "package/package.json": JSON.stringify({ name: "@scope/dep", version: "1.0.0" }) },
+      { compress: "gzip" },
+    );
+
+    const first = await install(String(dir));
+    expect(first.err).not.toContain("error:");
+    expect(first.out).toContain("1 package installed");
+    expect(first.exitCode).toBe(0);
+    expect(await file(join(String(dir), "project", "bun.lock")).text()).toContain('"dep": ["@scope/dep@../dep.tgz"');
+
+    const second = await install(String(dir), "--frozen-lockfile");
+    expect(second.err).not.toContain("Ignoring lockfile");
+    expect(second.err).not.toContain("error:");
+    expect(second.exitCode).toBe(0);
+  });
+
+  it("does not apply to the root package's own name", async () => {
+    // The root is not a bun.lock `packages` entry; its name only appears in the
+    // `workspaces` section, which accepts it as-is.
+    using dir = tempDir("invalid-name-root", {
+      "project/package.json": JSON.stringify({
+        name: "a:b",
+        version: "0.0.1",
+        dependencies: { dep: "file:../lib" },
+      }),
+      "lib/package.json": JSON.stringify({ name: "lib", version: "1.0.0" }),
+    });
+
+    const first = await install(String(dir));
+    expect(first.err).not.toContain("error:");
+    expect(first.out).toContain("1 package installed");
+    expect(first.exitCode).toBe(0);
+    const lockfile = await file(join(String(dir), "project", "bun.lock")).text();
+    expect(lockfile).toContain('"name": "a:b"');
+    expect(lockfile).toContain('"dep": ["lib@file:../lib", {}]');
+
+    const second = await install(String(dir), "--frozen-lockfile");
+    expect(second.err).not.toContain("Ignoring lockfile");
+    expect(second.err).not.toContain("error:");
+    expect(second.exitCode).toBe(0);
+  });
+});
+
 it("does not install transitive file: dependencies with overlong folder targets", async () => {
   const overlongTarget = "file:./" + Buffer.alloc(120000, "a").toString();
   using dir = tempDir("transitive-file-dep-overlong", {
diff --git a/test/cli/install/bun-lock.test.ts b/test/cli/install/bun-lock.test.ts
index 0c1156924b87..cee3f4065d46 100644
--- a/test/cli/install/bun-lock.test.ts
+++ b/test/cli/install/bun-lock.test.ts
@@ -974,6 +974,103 @@ it("--frozen-lockfile accepts a bun.lock with an entry nothing depends on, where
   }
 });
 
+// bun.lock stores every package as "<name>@<resolution>" and splits the name back off at the
+// first "@" after an optional scope, so a package without a name cannot be stored. A folder or
+// tarball package whose package.json had no name used to be written as e.g. "@file:../dir", which
+// the next install could not parse: it printed "Ignoring lockfile", and --frozen-lockfile always
+// failed. Such packages are now named after their folder or tarball. The git variant lives in
+// bun-install-git-deps.test.ts, the isolated store layout in isolated-install.test.ts.
+it("names folder and tarball packages without a package.json name after their folder or tarball", async () => {
+  const noName = JSON.stringify({ version: "1.0.0" });
+  const { packageDir, packageJson } = await registry.createTestDir({
+    bunfigOpts: { linker: "hoisted" },
+    files: {
+      "pkgs/folder-pkg/package.json": noName,
+      "pkgs/empty-name-pkg/package.json": JSON.stringify({ name: "", version: "1.0.0" }),
+      // "odd@folder" cannot be stored as a name either, so this one gets the generic name.
+      "pkgs/odd@folder/package.json": noName,
+    },
+  });
+  await Bun.Archive.write(
+    join(packageDir, "tarball-pkg.tgz"),
+    { "package/package.json": noName },
+    { compress: "gzip" },
+  );
+  // Serves that tarball under other file names: remote packages are named after the URL.
+  await using server = Bun.serve({
+    port: 0,
+    fetch: () => new Response(file(join(packageDir, "tarball-pkg.tgz"))),
+  });
+  const dependencies: Record<string, string> = {
+    "folder-dep": "file:./pkgs/folder-pkg",
+    "empty-name-dep": "file:./pkgs/empty-name-pkg",
+    "odd-folder-dep": "file:./pkgs/odd@folder",
+    "tarball-dep": "file:./tarball-pkg.tgz",
+    "remote-dep": `http://localhost:${server.port}/remote-pkg.tgz`,
+    "signed-url-dep": `http://localhost:${server.port}/signed-pkg.tgz?token=abc/def`,
+  };
+  await write(packageJson, JSON.stringify({ name: "deps-without-names", dependencies }));
+
+  await runBunInstall(env, packageDir);
+  const lockfile = await file(join(packageDir, "bun.lock")).text();
+  expect(lockfile.replaceAll(/localhost:\d+/g, "localhost:1234").replaceAll(/"sha512-[^"]*"/g, '"<integrity>"'))
+    .toMatchInlineSnapshot(`
+    "{
+      "lockfileVersion": 2,
+      "configVersion": 1,
+      "workspaces": {
+        "": {
+          "name": "deps-without-names",
+          "dependencies": {
+            "empty-name-dep": "file:./pkgs/empty-name-pkg",
+            "folder-dep": "file:./pkgs/folder-pkg",
+            "odd-folder-dep": "file:./pkgs/odd@folder",
+            "remote-dep": "http://localhost:1234/remote-pkg.tgz",
+            "signed-url-dep": "http://localhost:1234/signed-pkg.tgz?token=abc/def",
+            "tarball-dep": "file:./tarball-pkg.tgz",
+          },
+        },
+      },
+      "packages": {
+        "empty-name-dep": ["empty-name-pkg@file:pkgs/empty-name-pkg", {}],
+
+        "folder-dep": ["folder-pkg@file:pkgs/folder-pkg", {}],
+
+        "odd-folder-dep": ["unnamed-package@file:pkgs/odd@folder", {}],
+
+        "remote-dep": ["remote-pkg@http://localhost:1234/remote-pkg.tgz", {}, "<integrity>"],
+
+        "signed-url-dep": ["signed-pkg@http://localhost:1234/signed-pkg.tgz?token=abc/def", {}, "<integrity>"],
+
+        "tarball-dep": ["tarball-pkg@./tarball-pkg.tgz", {}, "<integrity>"],
+      }
+    }
+    "
+  `);
+  expect(await readdirSorted(join(packageDir, "node_modules"))).toEqual([
+    "empty-name-dep",
+    "folder-dep",
+    "odd-folder-dep",
+    "remote-dep",
+    "signed-url-dep",
+    "tarball-dep",
+  ]);
+
+  // runBunInstall rejects any warning, which includes "warn: Ignoring lockfile".
+  await runBunInstall(env, packageDir, { savesLockfile: false });
+  expect(await file(join(packageDir, "bun.lock")).text()).toBe(lockfile);
+  await runBunInstall(env, packageDir, { frozenLockfile: true });
+
+  // The name comes from the folder, not from the alias, so a second alias for the same folder
+  // resolves to the package already in the lockfile.
+  dependencies["folder-dep-again"] = "file:./pkgs/folder-pkg";
+  await write(packageJson, JSON.stringify({ name: "deps-without-names", dependencies }));
+  await runBunInstall(env, packageDir);
+  expect(await file(join(packageDir, "bun.lock")).text()).toContain(
+    '"folder-dep-again": ["folder-pkg@file:pkgs/folder-pkg", {}]',
+  );
+});
+
 it("escapes quotes and newlines in requested version literals when writing yarn.lock", async () => {
   const { packageDir, packageJson } = await registry.createTestDir();
 
diff --git a/test/cli/install/isolated-install.test.ts b/test/cli/install/isolated-install.test.ts
index 4ac887367191..01b61565bf07 100644
--- a/test/cli/install/isolated-install.test.ts
+++ b/test/cli/install/isolated-install.test.ts
@@ -357,6 +357,53 @@ test("can install folder dependencies", async () => {
   ).toBe("module.exports = 'hello from pkg-1';");
 });
 
+test("a folder dependency without a package.json name is stored under its folder name", async () => {
+  const { packageJson, packageDir } = await registry.createTestDir({ bunfigOpts: { linker: "isolated" } });
+
+  await Promise.all([
+    write(
+      packageJson,
+      JSON.stringify({
+        name: "test-pkg-nameless-folder-dep",
+        dependencies: {
+          "folder-dep": "file:./pkg-1",
+        },
+      }),
+    ),
+    write(join(packageDir, "pkg-1", "package.json"), JSON.stringify({ version: "1.0.0" })),
+    write(join(packageDir, "pkg-1", "index.js"), "module.exports = 'hello from pkg-1';"),
+  ]);
+
+  await runBunInstall(bunEnv, packageDir);
+
+  // Without a name the store entry used to be ".bun/@file+pkg-1/node_modules" with the package's
+  // files spilled directly into that node_modules directory.
+  expect(readlinkSync(join(packageDir, "node_modules", "folder-dep"))).toBe(
+    join(".bun", "pkg-1@file+pkg-1", "node_modules", "pkg-1"),
+  );
+  expect(
+    await file(
+      join(packageDir, "node_modules", ".bun", "pkg-1@file+pkg-1", "node_modules", "pkg-1", "package.json"),
+    ).json(),
+  ).toEqual({ version: "1.0.0" });
+
+  await using proc = spawn({
+    cmd: [bunExe(), "-e", "console.log(require('folder-dep'))"],
+    cwd: packageDir,
+    env: bunEnv,
+    stdout: "pipe",
+    stderr: "pipe",
+  });
+  const [stdout, stderr, exitCode] = await Promise.all([proc.stdout.text(), proc.stderr.text(), proc.exited]);
+  expect(stdout).toBe("hello from pkg-1\n");
+  expect(stderr).toBe("");
+  expect(exitCode).toBe(0);
+
+  // The entry bun wrote loads again (runBunInstall fails on "warn: Ignoring lockfile").
+  expect(await file(join(packageDir, "bun.lock")).text()).toContain('"folder-dep": ["pkg-1@file:pkg-1", {}]');
+  await runBunInstall(bunEnv, packageDir, { savesLockfile: false });
+});
+
 test("can install folder dependencies on root package", async () => {
   const { packageDir, packageJson } = await registry.createTestDir({ bunfigOpts: { linker: "isolated" } });
 

From 1a2abf954a0e6ee1c72cdf953f16b187674d1d11 Mon Sep 17 00:00:00 2001
From: robobun <117481402+robobun@users.noreply.github.com>
Date: Mon, 17 Aug 2026 01:46:53 +0000
Subject: [PATCH 123/258] install: reinstall node_modules when switching
 between the isolated and hoisted linkers (#38779)

---
 docs/pm/isolated-installs.mdx             |   2 +
 src/install/hoisted_install.rs            |  11 +-
 src/install/isolated_install.rs           | 297 ++++++----------------
 test/cli/install/isolated-install.test.ts | 233 +++++++++++++++++
 4 files changed, 317 insertions(+), 226 deletions(-)

diff --git a/docs/pm/isolated-installs.mdx b/docs/pm/isolated-installs.mdx
index 0f322aa295ba..69fbec8302e8 100644
--- a/docs/pm/isolated-installs.mdx
+++ b/docs/pm/isolated-installs.mdx
@@ -184,6 +184,8 @@ If you encounter issues, you can:
    bun install --linker hoisted
    ```
 
+   Switching linkers in either direction reinstalls the existing `node_modules` from scratch. The previous tree is moved to `node_modules/.old_modules-<random>`, which is safe to delete.
+
 2. **Report compatibility issues** to help improve isolated install support
 
 ### Performance considerations
diff --git a/src/install/hoisted_install.rs b/src/install/hoisted_install.rs
index 1be524ca6350..2b9c15432a7c 100644
--- a/src/install/hoisted_install.rs
+++ b/src/install/hoisted_install.rs
@@ -169,6 +169,14 @@ pub(crate) fn install_hoisted_packages(
         this.downloads_node = None;
     });
 
+    // A partial install (security scanner) runs ahead of the real one and must not touch the layout.
+    let replacing_isolated_node_modules = packages_to_install.is_none()
+        && sys::directory_exists_at(Fd::cwd(), bun_paths::path_literal!("node_modules/.bun"))
+            .unwrap_or(false);
+    if replacing_isolated_node_modules {
+        crate::isolated_install::move_node_modules_aside(&this.lockfile);
+    }
+
     // If there was already a valid lockfile and so we did not resolve, i.e. there was zero network activity
     // the packages could still not be in the cache dir
     // this would be a common scenario in a CI environment
@@ -218,7 +226,8 @@ pub(crate) fn install_hoisted_packages(
     let mut skip_delete = new_node_modules;
     let mut skip_verify_installed_version_number = new_node_modules;
 
-    if this.options.enable.force_install() {
+    // Whatever `move_node_modules_aside` could not move is still deleted before it is reinstalled.
+    if this.options.enable.force_install() || replacing_isolated_node_modules {
         skip_verify_installed_version_number = true;
         skip_delete = false;
     }
diff --git a/src/install/isolated_install.rs b/src/install/isolated_install.rs
index 1b644a3a4746..b7ccc8cfc446 100644
--- a/src/install/isolated_install.rs
+++ b/src/install/isolated_install.rs
@@ -1258,6 +1258,73 @@ pub(crate) fn build_store(
     })
 }
 
+/// Entry by entry rather than renaming `node_modules` itself, which may be a mount point or a symlink.
+pub(crate) fn move_node_modules_aside(lockfile: &Lockfile) {
+    use bun_sys::FdExt as _;
+
+    let mut old_modules = AutoRelPath::from(b"node_modules").assume_ok();
+    let rand = fast_random();
+    old_modules
+        .append_fmt(format_args!(
+            ".old_modules-{}",
+            bun_fmt::hex_lower(bun_core::bytes_of(&rand))
+        ))
+        .assume_ok();
+    if sys::mkdirat(Fd::cwd(), old_modules.slice_z(), 0o755).is_err() {
+        return;
+    }
+    let old_modules_name = old_modules.basename().to_vec();
+
+    let Ok(node_modules) = sys::open_dir_for_iteration(Fd::cwd(), b"node_modules") else {
+        return;
+    };
+    let mut entry_path = AutoRelPath::from(b"node_modules").assume_ok();
+    let mut iter = sys::iterate_dir(node_modules);
+    while let Ok(Some(entry)) = iter.next() {
+        let name = entry.name.slice_u8();
+        if name == b".cache" || name == old_modules_name.as_slice() {
+            continue;
+        }
+
+        let entry_path_len = entry_path.len();
+        entry_path.append(name).assume_ok();
+        let old_modules_len = old_modules.len();
+        old_modules.append(name).assume_ok();
+
+        let _ = sys::renameat(
+            Fd::cwd(),
+            entry_path.slice_z(),
+            Fd::cwd(),
+            old_modules.slice_z(),
+        );
+
+        entry_path.set_length(entry_path_len);
+        old_modules.set_length(old_modules_len);
+    }
+    node_modules.close();
+
+    for workspace_path in lockfile.workspace_paths.values() {
+        let mut workspace_node_modules =
+            AutoRelPath::from(workspace_path.slice(&lockfile.buffers.string_bytes)).assume_ok();
+        let basename = workspace_node_modules.basename().to_vec();
+        workspace_node_modules.append(b"node_modules").assume_ok();
+
+        let old_modules_len = old_modules.len();
+        old_modules
+            .append_fmt(format_args!(".old_{}_modules", BStr::new(&basename)))
+            .assume_ok();
+
+        let _ = sys::renameat(
+            Fd::cwd(),
+            workspace_node_modules.slice_z(),
+            Fd::cwd(),
+            old_modules.slice_z(),
+        );
+
+        old_modules.set_length(old_modules_len);
+    }
+}
+
 /// Runs on main thread
 pub(crate) fn install_isolated_packages(
     manager: &mut PackageManager,
@@ -1806,233 +1873,13 @@ pub(crate) fn install_isolated_packages(
         // matches `Installer::NODE_MODULES_BUN`.
         let bun_modules_path = paths::path_literal!("node_modules/.bun");
 
-        match sys::mkdirat(Fd::cwd(), node_modules_path, 0o755) {
-            Ok(()) => {
-                // fallthrough to creating bun_modules below
+        if sys::mkdirat(Fd::cwd(), node_modules_path, 0o755).is_err() {
+            if sys::directory_exists_at(Fd::cwd(), bun_modules_path).unwrap_or(false) {
+                break 'is_new_bun_modules false;
             }
-            Err(_) => {
-                match sys::mkdirat(Fd::cwd(), bun_modules_path, 0o755) {
-                    Err(_) => break 'is_new_bun_modules false,
-                    Ok(()) => {}
-                }
-
-                // 'node_modules' exists and 'node_modules/.bun' doesn't
-
-                #[cfg(windows)]
-                {
-                    // Windows:
-                    // 1. create 'node_modules/.old_modules-{hex}'
-                    // 2. for each entry in 'node_modules' rename into 'node_modules/.old_modules-{hex}'
-                    // 3. for each workspace 'node_modules' rename into 'node_modules/.old_modules-{hex}/old_{basename}_modules'
-
-                    // `sys::mkdirat`/`renameat` take `&ZStr` (u8) and widen
-                    // internally, so a single u8 `AutoRelPath` covers both the
-                    // mkdir and rename targets.
-                    let mut rename_path = AutoRelPath::from(b"node_modules").assume_ok();
-                    let rand = fast_random();
-                    rename_path
-                        .append_fmt(format_args!(
-                            ".old_modules-{}",
-                            bun_fmt::hex_lower(bun_core::bytes_of(&rand))
-                        ))
-                        .assume_ok();
-
-                    // 1
-                    if sys::mkdirat(Fd::cwd(), rename_path.slice_z(), 0o755).is_err() {
-                        break 'is_new_bun_modules true;
-                    }
 
-                    let Ok(node_modules) = sys::open_dir_for_iteration(Fd::cwd(), b"node_modules")
-                    else {
-                        break 'is_new_bun_modules true;
-                    };
-                    // Windows HANDLE-leak audit: `Fd` is `Copy` (no Drop) and the
-                    // `WrappedIterator` from `sys::iterate_dir` does not own/close it,
-                    // so close explicitly. The guard fires on
-                    // normal fall-through to step 3 and on every
-                    // `break 'is_new_bun_modules true` early exit.
-                    let _close_node_modules = scopeguard::guard(node_modules, |fd| {
-                        use bun_sys::FdExt as _;
-                        fd.close();
-                    });
-
-                    let mut entry_path = AutoRelPath::from(b"node_modules").assume_ok();
-
-                    // 2
-                    let mut node_modules_iter = sys::iterate_dir(node_modules);
-                    loop {
-                        let Some(entry) = (match node_modules_iter.next() {
-                            Ok(v) => v,
-                            Err(_) => break 'is_new_bun_modules true,
-                        }) else {
-                            break;
-                        };
-                        if bun_core::starts_with_char(entry.name.slice_u8(), b'.') {
-                            continue;
-                        }
-
-                        // Capture lengths and truncate manually so
-                        // the paths stay unborrowed across the loop body.
-                        let entry_path_save = entry_path.len();
-                        entry_path.append(entry.name.slice()).assume_ok();
-
-                        let rename_path_save = rename_path.len();
-                        rename_path.append(entry.name.slice()).assume_ok();
-
-                        let _ = sys::renameat(
-                            Fd::cwd(),
-                            entry_path.slice_z(),
-                            Fd::cwd(),
-                            rename_path.slice_z(),
-                        );
-
-                        rename_path.set_length(rename_path_save);
-                        entry_path.set_length(entry_path_save);
-                    }
-
-                    // 3
-                    for workspace_path in lockfile.workspace_paths.values() {
-                        let mut workspace_node_modules =
-                            AutoRelPath::from(workspace_path.slice(&lockfile.buffers.string_bytes))
-                                .assume_ok();
-
-                        // Clone basename before mutating
-                        // `workspace_node_modules`.
-                        let basename = workspace_node_modules.basename().to_vec();
-
-                        workspace_node_modules.append(b"node_modules").assume_ok();
-
-                        // Reshaped for borrowck — capture length instead
-                        // of `save()` so `rename_path` stays unborrowed.
-                        let rename_path_save = rename_path.len();
-                        rename_path
-                            .append_fmt(format_args!(".old_{}_modules", BStr::new(&basename)))
-                            .assume_ok();
-
-                        let _ = sys::renameat(
-                            Fd::cwd(),
-                            workspace_node_modules.slice_z(),
-                            Fd::cwd(),
-                            rename_path.slice_z(),
-                        );
-
-                        rename_path.set_length(rename_path_save);
-                    }
-                }
-                #[cfg(not(windows))]
-                {
-                    // Posix:
-                    // 1. rename existing 'node_modules' to temp location
-                    // 2. create new 'node_modules' directory
-                    // 3. rename temp into 'node_modules/.old_modules-{hex}'
-                    // 4. attempt renaming 'node_modules/.old_modules-{hex}/.cache' to 'node_modules/.cache'
-                    // 5. rename each workspace 'node_modules' into 'node_modules/.old_modules-{hex}/old_{basename}_modules'
-                    let mut temp_node_modules_buf = PathBuffer::uninit();
-                    let temp_node_modules = paths::fs::FileSystem::tmpname(
-                        b"tmp_modules",
-                        &mut temp_node_modules_buf.0,
-                        fast_random(),
-                    )
-                    .expect("unreachable");
-
-                    // 1
-                    if sys::renameat(
-                        Fd::cwd(),
-                        bun_core::zstr!("node_modules"),
-                        Fd::cwd(),
-                        temp_node_modules,
-                    )
-                    .is_err()
-                    {
-                        break 'is_new_bun_modules true;
-                    }
-
-                    // 2
-                    if let Err(err) = sys::mkdirat(Fd::cwd(), node_modules_path, 0o755) {
-                        Output::err(err, "failed to create './node_modules'", format_args!(""));
-                        Global::exit(1);
-                    }
-
-                    if let Err(err) = sys::mkdirat(Fd::cwd(), bun_modules_path, 0o755) {
-                        Output::err(
-                            err,
-                            "failed to create './node_modules/.bun'",
-                            format_args!(""),
-                        );
-                        Global::exit(1);
-                    }
-
-                    let mut rename_path = AutoRelPath::from(b"node_modules").assume_ok();
-
-                    let rand = fast_random();
-                    rename_path
-                        .append_fmt(format_args!(
-                            ".old_modules-{}",
-                            bun_fmt::hex_lower(bun_core::bytes_of(&rand))
-                        ))
-                        .assume_ok();
-
-                    // 3
-                    if sys::renameat(
-                        Fd::cwd(),
-                        temp_node_modules,
-                        Fd::cwd(),
-                        rename_path.slice_z(),
-                    )
-                    .is_err()
-                    {
-                        break 'is_new_bun_modules true;
-                    }
-
-                    rename_path.append(b".cache").assume_ok();
-
-                    let mut cache_path = AutoRelPath::from(b"node_modules").assume_ok();
-                    cache_path.append(b".cache").assume_ok();
-
-                    // 4
-                    let _ = sys::renameat(
-                        Fd::cwd(),
-                        rename_path.slice_z(),
-                        Fd::cwd(),
-                        cache_path.slice_z(),
-                    );
-
-                    // remove .cache so we can append destination for each workspace
-                    rename_path.undo(1);
-
-                    // 5
-                    for workspace_path in lockfile.workspace_paths.values() {
-                        let mut workspace_node_modules =
-                            AutoRelPath::from(workspace_path.slice(&lockfile.buffers.string_bytes))
-                                .assume_ok();
-
-                        // Clone basename before mutating
-                        // `workspace_node_modules`.
-                        let basename = workspace_node_modules.basename().to_vec();
-
-                        workspace_node_modules.append(b"node_modules").assume_ok();
-
-                        // Capture the length and truncate manually
-                        // so `rename_path` stays unborrowed between save/restore.
-                        let rename_path_save = rename_path.len();
-
-                        rename_path
-                            .append_fmt(format_args!(".old_{}_modules", BStr::new(&basename)))
-                            .assume_ok();
-
-                        let _ = sys::renameat(
-                            Fd::cwd(),
-                            workspace_node_modules.slice_z(),
-                            Fd::cwd(),
-                            rename_path.slice_z(),
-                        );
-
-                        rename_path.set_length(rename_path_save);
-                    }
-                }
-
-                break 'is_new_bun_modules true;
-            }
+            // 'node_modules' exists and 'node_modules/.bun' doesn't
+            move_node_modules_aside(lockfile);
         }
 
         if let Err(err) = sys::mkdirat(Fd::cwd(), bun_modules_path, 0o755) {
diff --git a/test/cli/install/isolated-install.test.ts b/test/cli/install/isolated-install.test.ts
index 01b61565bf07..96434eb9cc7f 100644
--- a/test/cli/install/isolated-install.test.ts
+++ b/test/cli/install/isolated-install.test.ts
@@ -6,6 +6,7 @@ import { VerdaccioRegistry, bunEnv, bunExe, githubTarball, readdirSorted, runBun
 import { createRequire } from "module";
 import { basename, dirname, join } from "path";
 import { pathToFileURL } from "url";
+import { SimpleRegistry } from "./simple-dummy-registry";
 
 const registry = new VerdaccioRegistry();
 
@@ -2213,6 +2214,238 @@ describe("--linker flag", () => {
 
     expect(lstatSync(join(packageDir, "node_modules", "no-deps")).isSymbolicLink()).toBeTrue();
   });
+
+  async function installWithLinker(packageDir: string, linker: "isolated" | "hoisted") {
+    await using proc = spawn({
+      cmd: [bunExe(), "install", "--linker", linker],
+      cwd: packageDir,
+      env: bunEnv,
+      stdout: "pipe",
+      stderr: "pipe",
+    });
+    const [stdout, stderr, exitCode] = await Promise.all([proc.stdout.text(), proc.stderr.text(), proc.exited]);
+    expect(stderr).not.toContain("error:");
+    expect(exitCode).toBe(0);
+    return stdout;
+  }
+
+  // `peer-deps` has a peer dependency on `no-deps`, so it shows which copy of
+  // `no-deps` a dependency resolves to. Both must resolve to the same copy the
+  // root resolves to, whichever linker laid out the tree.
+  async function resolvedNoDeps(packageDir: string) {
+    await using proc = spawn({
+      cmd: [
+        bunExe(),
+        "-e",
+        `const root = require("no-deps");
+         const viaPeer = require("peer-deps").peerDependencies["no-deps"];
+         console.log(JSON.stringify({ root: root.version, viaPeer: viaPeer.version, sameCopy: root === viaPeer }));`,
+      ],
+      cwd: packageDir,
+      env: bunEnv,
+      stdout: "pipe",
+      stderr: "pipe",
+    });
+    const [stdout, stderr, exitCode] = await Promise.all([proc.stdout.text(), proc.stderr.text(), proc.exited]);
+    expect(stderr).toBe("");
+    expect(exitCode).toBe(0);
+    return JSON.parse(stdout);
+  }
+
+  function rootEntryKinds(packageDir: string, names: string[]) {
+    return Object.fromEntries(
+      names.map(name => {
+        const stat = lstatSync(join(packageDir, "node_modules", name), { throwIfNoEntry: false });
+        return [name, stat === undefined ? "missing" : stat.isSymbolicLink() ? "symlink" : "directory"];
+      }),
+    );
+  }
+
+  test("switching linkers on an existing node_modules replaces the whole tree", async () => {
+    const { packageJson, packageDir } = await registry.createTestDir();
+    const writeRootPackageJson = (noDepsVersion: string) =>
+      write(
+        packageJson,
+        JSON.stringify({
+          name: "linker-switch",
+          dependencies: {
+            "no-deps": noDepsVersion,
+            "peer-deps": "1.0.0",
+          },
+        }),
+      );
+
+    await writeRootPackageJson("1.0.0");
+    await installWithLinker(packageDir, "isolated");
+    expect(rootEntryKinds(packageDir, [".bun", "no-deps", "peer-deps"])).toEqual({
+      ".bun": "directory",
+      "no-deps": "symlink",
+      "peer-deps": "symlink",
+    });
+    expect(await resolvedNoDeps(packageDir)).toEqual({ root: "1.0.0", viaPeer: "1.0.0", sameCopy: true });
+
+    // The store symlink for `peer-deps` still points at a package.json with the
+    // right version, so a hoisted install that only compared versions would keep
+    // it linked into the store next to the old `no-deps`.
+    await writeRootPackageJson("2.0.0");
+    expect(await installWithLinker(packageDir, "hoisted")).toContain("2 packages installed");
+    expect(rootEntryKinds(packageDir, [".bun", "no-deps", "peer-deps"])).toEqual({
+      ".bun": "missing",
+      "no-deps": "directory",
+      "peer-deps": "directory",
+    });
+    expect(await readdirSorted(join(packageDir, "node_modules"))).toEqual([
+      expect.stringContaining(".old_modules-"),
+      "no-deps",
+      "peer-deps",
+    ]);
+    expect(await resolvedNoDeps(packageDir)).toEqual({ root: "2.0.0", viaPeer: "2.0.0", sameCopy: true });
+
+    // Only a tree built by the other linker gets replaced.
+    expect(await installWithLinker(packageDir, "hoisted")).toContain("(no changes)");
+    expect(await readdirSorted(join(packageDir, "node_modules"))).toEqual([
+      expect.stringContaining(".old_modules-"),
+      "no-deps",
+      "peer-deps",
+    ]);
+
+    // Back to isolated: the real directory left behind by the hoisted install
+    // must not shadow the store entry for the version the lockfile now has.
+    await writeRootPackageJson("1.0.0");
+    expect(await installWithLinker(packageDir, "isolated")).toContain("2 packages installed");
+    expect(rootEntryKinds(packageDir, [".bun", "no-deps", "peer-deps"])).toEqual({
+      ".bun": "directory",
+      "no-deps": "symlink",
+      "peer-deps": "symlink",
+    });
+    expect(readlinkSync(join(packageDir, "node_modules", "no-deps"))).toBe(
+      join(".bun", "no-deps@1.0.0", "node_modules", "no-deps"),
+    );
+    expect(await readdirSorted(join(packageDir, "node_modules"))).toEqual([
+      ".bun",
+      expect.stringContaining(".old_modules-"),
+      "no-deps",
+      "peer-deps",
+    ]);
+    expect(await resolvedNoDeps(packageDir)).toEqual({ root: "1.0.0", viaPeer: "1.0.0", sameCopy: true });
+
+    expect(await installWithLinker(packageDir, "isolated")).toContain("(no changes)");
+    expect(await readdirSorted(join(packageDir, "node_modules"))).toEqual([
+      ".bun",
+      expect.stringContaining(".old_modules-"),
+      "no-deps",
+      "peer-deps",
+    ]);
+  });
+
+  test("switching from isolated to hoisted also replaces workspace node_modules", async () => {
+    const { packageDir } = await registry.createTestDir({
+      files: {
+        "package.json": JSON.stringify({
+          name: "linker-switch-workspaces",
+          workspaces: ["packages/*"],
+        }),
+        "packages/pkg1/package.json": JSON.stringify({
+          name: "pkg1",
+          dependencies: {
+            "no-deps": "1.0.0",
+          },
+        }),
+        "packages/pkg1/index.js": `console.log(require.resolve("no-deps/package.json"));`,
+      },
+    });
+
+    await installWithLinker(packageDir, "isolated");
+    expect(lstatSync(join(packageDir, "packages", "pkg1", "node_modules", "no-deps")).isSymbolicLink()).toBeTrue();
+
+    await installWithLinker(packageDir, "hoisted");
+    // The workspace's store link would otherwise keep shadowing the hoisted copy.
+    expect(existsSync(join(packageDir, "packages", "pkg1", "node_modules"))).toBeFalse();
+    expect(rootEntryKinds(packageDir, [".bun", "no-deps", "pkg1"])).toEqual({
+      ".bun": "missing",
+      "no-deps": "directory",
+      "pkg1": "symlink",
+    });
+
+    await using proc = spawn({
+      cmd: [bunExe(), "packages/pkg1/index.js"],
+      cwd: packageDir,
+      env: bunEnv,
+      stdout: "pipe",
+      stderr: "pipe",
+    });
+    const [stdout, stderr, exitCode] = await Promise.all([proc.stdout.text(), proc.stderr.text(), proc.exited]);
+    expect(stderr).toBe("");
+    expect(stdout.trim()).toBe(join(packageDir, "node_modules", "no-deps", "package.json"));
+    expect(exitCode).toBe(0);
+  });
+
+  // A security scanner that is not installed yet is installed on its own, with
+  // the hoisted linker, before the real install runs. Finding the store in that
+  // step is not a linker switch.
+  test("installing a missing security scanner into an isolated node_modules keeps the tree", async () => {
+    using scannerRegistry = new SimpleRegistry(false);
+    await scannerRegistry.start();
+
+    const { packageDir } = await registry.createTestDir({
+      files: {
+        "package.json": JSON.stringify({
+          name: "scanner-into-isolated",
+          workspaces: ["packages/*"],
+          devDependencies: {
+            "test-security-scanner": "1.0.0",
+          },
+        }),
+        "packages/app/package.json": JSON.stringify({
+          name: "app",
+          dependencies: {
+            "left-pad": "1.3.0",
+          },
+        }),
+      },
+    });
+    await write(
+      join(packageDir, "bunfig.toml"),
+      Bun.TOML.stringify({
+        install: {
+          cache: join(packageDir, ".bun-cache"),
+          registry: `${scannerRegistry.getUrl()}/`,
+          security: { scanner: "test-security-scanner" },
+        },
+      }),
+    );
+
+    async function installWithScanner() {
+      await using proc = spawn({
+        cmd: [bunExe(), "install"],
+        cwd: packageDir,
+        env: bunEnv,
+        stdout: "pipe",
+        stderr: "pipe",
+      });
+      const [stdout, stderr, exitCode] = await Promise.all([proc.stdout.text(), proc.stderr.text(), proc.exited]);
+      const output = stdout + stderr;
+      expect(output).toContain("Attempting to install security scanner from npm");
+      expect(output).toContain("SCANNER_RAN:");
+      expect(exitCode).toBe(0);
+    }
+
+    await installWithScanner();
+    const nodeModules = join(packageDir, "node_modules");
+    const entriesAfterFirstInstall = await readdirSorted(nodeModules);
+    expect(entriesAfterFirstInstall).toEqual([
+      ".bun",
+      expect.stringContaining(".old_modules-"),
+      "test-security-scanner",
+    ]);
+
+    // Make the scanner need its own install step again, this time into a tree
+    // that already has a store.
+    await rm(join(nodeModules, "test-security-scanner"), { recursive: true, force: true });
+    await installWithScanner();
+    expect(await readdirSorted(nodeModules)).toEqual(entriesAfterFirstInstall);
+    expect(await readdirSorted(join(packageDir, "packages", "app", "node_modules"))).toEqual(["left-pad"]);
+  });
 });
 test("many transitive dependencies", async () => {
   const { packageJson, packageDir } = await registry.createTestDir({ bunfigOpts: { linker: "isolated" } });

From 4dfe3d0abc61ebbed4fbabf330517255dd123765 Mon Sep 17 00:00:00 2001
From: robobun <117481402+robobun@users.noreply.github.com>
Date: Mon, 17 Aug 2026 01:47:14 +0000
Subject: [PATCH 124/258] resolver: make auto-install use the version range
 from the project's package.json (#38198)

---
 src/install/auto_installer.rs        |  28 ++++-
 src/install/lockfile.rs              |   7 +-
 src/install_types/resolver_hooks.rs  |  10 +-
 src/jsc/VirtualMachine.rs            |   8 ++
 src/resolver/package_json.rs         |  51 ++++----
 src/resolver/resolver.rs             |  43 ++++++-
 src/runtime/cli/repl_command.rs      |   1 +
 src/runtime/cli/run_command.rs       |   8 ++
 src/runtime/jsc_hooks.rs             |   2 +
 test/cli/run/run-autoinstall.test.ts | 178 +++++++++++++++++++++++++++
 10 files changed, 307 insertions(+), 29 deletions(-)

diff --git a/src/install/auto_installer.rs b/src/install/auto_installer.rs
index 774a05069b6f..47d347cdd3fe 100644
--- a/src/install/auto_installer.rs
+++ b/src/install/auto_installer.rs
@@ -170,9 +170,10 @@ impl hooks::AutoInstaller for PackageManager {
         &self,
         name: &[u8],
         version: &hooks::DependencyVersion,
+        version_buf: &[u8],
     ) -> Option<PackageID> {
         self.lockfile
-            .resolve_package_from_name_and_version(name, version)
+            .resolve_package_from_name_and_version(name, version, version_buf)
     }
 
     fn lockfile_legacy_package_to_dependency_id(
@@ -434,6 +435,31 @@ impl hooks::AutoInstaller for PackageManager {
     }
 }
 
+// ─── Dependency parsing without a manager (resolver → install link-time hook) ──
+//
+// `bun_resolver::PackageJSON::parse` reads the project's package.json before the
+// first bare import creates the `PackageManager` (see `Resolver::parse_dependency`).
+// `parse` only uses the manager to record `npm:` aliases, and
+// `lockfile_append_from_package_json` records them when these dependencies are
+// cloned into the lockfile, so nothing is lost by parsing without one.
+#[unsafe(no_mangle)]
+fn __bun_resolver_parse_dependency(
+    name: SemverString,
+    name_hash: hooks::PackageNameHash,
+    version: &[u8],
+    sliced: &SlicedString,
+    log: Option<&mut bun_ast::Log>,
+) -> Option<hooks::DependencyVersion> {
+    dependency::parse(
+        name,
+        name_hash,
+        version,
+        sliced,
+        log,
+        None::<&mut PackageManager>,
+    )
+}
+
 // ─── Lazy factory (resolver → install link-time hook) ─────────────────────
 //
 // `bun_resolver` cannot name `PackageManager` (it would create a dep cycle),
diff --git a/src/install/lockfile.rs b/src/install/lockfile.rs
index 6a0605bcbef5..ad1da68c3f48 100644
--- a/src/install/lockfile.rs
+++ b/src/install/lockfile.rs
@@ -3173,10 +3173,15 @@ impl Lockfile {
         Ok(digest)
     }
 
+    /// `version_buf` is the buffer `version`'s strings (prerelease/build tags)
+    /// were parsed against. The auto-install resolver passes versions parsed
+    /// from a project's package.json here, so it is not always this lockfile's
+    /// string buffer.
     pub(crate) fn resolve_package_from_name_and_version(
         &self,
         package_name: &[u8],
         version: &DependencyVersion,
+        version_buf: &[u8],
     ) -> Option<PackageID> {
         let name_hash = SemverStringBuilder::string_hash(package_name);
         let entry = self.package_index.get(&name_hash)?;
@@ -3192,7 +3197,7 @@ impl Lockfile {
                 // folder/symlink deps share the name index with other variants.
                 let satisfies = |resolution: &Resolution| -> bool {
                     resolution.tag == ResolutionTag::Npm
-                        && npm_group.satisfies(resolution.npm().version, buf, buf)
+                        && npm_group.satisfies(resolution.npm().version, version_buf, buf)
                 };
                 match entry {
                     PackageIndexEntry::Id(id) => {
diff --git a/src/install_types/resolver_hooks.rs b/src/install_types/resolver_hooks.rs
index 2878b87bd28c..7ab83e481d40 100644
--- a/src/install_types/resolver_hooks.rs
+++ b/src/install_types/resolver_hooks.rs
@@ -1450,7 +1450,15 @@ pub trait AutoInstaller {
     fn lockfile_dependencies_buf(&self) -> &[Dependency];
     fn lockfile_resolutions_buf(&self) -> &[PackageID];
     fn lockfile_string_bytes(&self) -> &[u8];
-    fn lockfile_resolve(&self, name: &[u8], version: &DependencyVersion) -> Option<PackageID>;
+    /// `version_buf` holds the strings `version` was parsed against (a
+    /// package.json's bytes, the lockfile's string buffer, or the import
+    /// specifier itself).
+    fn lockfile_resolve(
+        &self,
+        name: &[u8],
+        version: &DependencyVersion,
+        version_buf: &[u8],
+    ) -> Option<PackageID>;
     fn lockfile_legacy_package_to_dependency_id(
         &self,
         package_id: PackageID,
diff --git a/src/jsc/VirtualMachine.rs b/src/jsc/VirtualMachine.rs
index fc224cc8f479..0fc97494243f 100644
--- a/src/jsc/VirtualMachine.rs
+++ b/src/jsc/VirtualMachine.rs
@@ -98,6 +98,13 @@ pub struct InitOptions {
     /// `transpiler.resolver.store_fd` BEFORE `configure_linker()` reads
     /// `top_level_dir`, so it threads through `init_runtime_state`.
     pub store_fd: bool,
+    /// Auto-install mode (`--install=...`). Like `store_fd`, it must be on the
+    /// resolver BEFORE `configure_linker()` reads `top_level_dir`: that read
+    /// caches the project's package.json, and its dependency ranges are only
+    /// recorded (for auto-install to resolve against) when the resolver has
+    /// auto-install enabled at the time it is cached. Defaults to `disable`,
+    /// matching `BundleOptions::from_api`.
+    pub global_cache: bun_options_types::global_cache::GlobalCache,
     pub smol: bool,
     pub eval_mode: bool,
     pub is_main_thread: bool,
@@ -123,6 +130,7 @@ impl Default for InitOptions {
             env_loader: None,
             graph: None,
             store_fd: false,
+            global_cache: bun_options_types::global_cache::GlobalCache::disable,
             smol: false,
             eval_mode: false,
             is_main_thread: false,
diff --git a/src/resolver/package_json.rs b/src/resolver/package_json.rs
index 12dd6aa32601..a048f3869189 100644
--- a/src/resolver/package_json.rs
+++ b/src/resolver/package_json.rs
@@ -811,9 +811,11 @@ impl PackageJSON {
                                 Some(&mut *r_log),
                             ) {
                                 if dependency_version.is_exact_npm() {
-                                    if let Some(resolved) =
-                                        pm.lockfile_resolve(&package_json.name, &dependency_version)
-                                    {
+                                    if let Some(resolved) = pm.lockfile_resolve(
+                                        &package_json.name,
+                                        &dependency_version,
+                                        &package_json.version,
+                                    ) {
                                         package_json.package_manager_package_id = resolved;
                                         if resolved > 0 {
                                             break 'update_dependencies;
@@ -904,25 +906,30 @@ impl PackageJSON {
                                     let Some(version_str) = prop.value.as_str() else {
                                         continue;
                                     };
-                                    let sliced_str =
-                                        Semver::SlicedString::init(version_str, version_str);
-
-                                    // The parser body lives in install-tier so route through
-                                    // the AutoInstaller vtable when one is wired. When it
-                                    // isn't, still record the dependency name (with an
-                                    // uninitialized-tag version) — `bun run --filter` reads
-                                    // only the map keys to compute workspace ordering.
-                                    let dependency_version = match r.auto_installer() {
-                                        Some(pm) => pm.parse_dependency(
-                                            name,
-                                            Some(name_hash),
-                                            version_str,
-                                            &sliced_str,
-                                            Some(&mut *r_log),
-                                        ),
-                                        None => Some(DependencyVersion::default()),
-                                    };
-                                    if let Some(dependency_version) = dependency_version {
+                                    // Like the key above: a value with JSON escapes is
+                                    // decoded outside the source buffer and cannot be
+                                    // stored as an offset into it.
+                                    if !bun_alloc::is_slice_in_buffer(
+                                        version_str,
+                                        package_json.dependencies.source_buf,
+                                    ) {
+                                        continue;
+                                    }
+                                    // The strings inside the parsed version are offsets
+                                    // into this buffer; every reader of the map slices
+                                    // them with `dependencies.source_buf`.
+                                    let sliced_str = Semver::SlicedString::init(
+                                        package_json.dependencies.source_buf,
+                                        version_str,
+                                    );
+
+                                    if let Some(dependency_version) = r.parse_dependency(
+                                        name,
+                                        name_hash,
+                                        version_str,
+                                        &sliced_str,
+                                        Some(&mut *r_log),
+                                    ) {
                                         let dependency = Dependency {
                                             name,
                                             version: dependency_version,
diff --git a/src/resolver/resolver.rs b/src/resolver/resolver.rs
index a933414bb77b..9d7ec2c0c1f6 100644
--- a/src/resolver/resolver.rs
+++ b/src/resolver/resolver.rs
@@ -20,8 +20,8 @@ use ::bun_install_types::resolver_hooks as Install;
 use ::bun_install_types::resolver_hooks::{AutoInstaller, Resolution};
 use ::bun_semver as Semver;
 
-// LAYERING: `PackageManager.initWithRuntime` lives in
-// `bun_install`, which depends on this crate. The lazy-init body is defined
+// LAYERING: `PackageManager.initWithRuntime` and `Dependency.parse` live in
+// `bun_install`, which depends on this crate. Both bodies are defined
 // `#[no_mangle]` in `bun_install::auto_installer` and resolved at link time
 // (same pattern as `__bun_regex_*` / `__BUN_RUNTIME_HOOKS`). `install` is the
 // `?*Api.BunInstall` (`self.opts.install`); `env` is the `*DotEnv.Loader`.
@@ -37,6 +37,16 @@ unsafe extern "Rust" {
         install: Option<NonNull<bun_options_types::schema::api::BunInstall>>,
         env: NonNull<bun_dotenv::Loader>,
     ) -> core::result::Result<NonNull<dyn AutoInstaller>, bun_errno::SystemErrno>;
+
+    /// `Dependency.parse` with no `PackageManager` (it only uses one to record
+    /// `npm:` aliases). See [`Resolver::parse_dependency`].
+    safe fn __bun_resolver_parse_dependency(
+        name: Semver::String,
+        name_hash: Install::PackageNameHash,
+        version: &[u8],
+        sliced: &Semver::SlicedString,
+        log: Option<&mut bun_ast::Log>,
+    ) -> Option<Dependency::Version>;
 }
 use crate::cache::Set as CacheSet;
 use ::bun_resolve_builtins::{Alias as HardcodedAlias, Cfg as HardcodedAliasCfg};
@@ -862,6 +872,26 @@ impl<'a> Resolver<'a> {
         self.package_manager.map(|mut pm| unsafe { pm.as_mut() })
     }
 
+    /// Parses one package.json dependency value (`"^1.0.0"`, `"npm:foo@1"`,
+    /// `"file:../foo"`, ...). Goes through the package manager when it already
+    /// exists so `npm:` aliases get recorded; otherwise parses standalone. The
+    /// package manager is created lazily by the first bare import, so the
+    /// project's own package.json normally takes the second path, and the
+    /// versions recorded there are what auto-install resolves against.
+    pub(crate) fn parse_dependency(
+        &mut self,
+        name: Semver::String,
+        name_hash: Install::PackageNameHash,
+        version: &[u8],
+        sliced: &Semver::SlicedString,
+        log: Option<&mut bun_ast::Log>,
+    ) -> Option<Dependency::Version> {
+        match self.auto_installer() {
+            Some(pm) => pm.parse_dependency(name, Some(name_hash), version, sliced, log),
+            None => __bun_resolver_parse_dependency(name, name_hash, version, sliced, log),
+        }
+    }
+
     /// Safe read-only accessor for the optional `DotEnv::Loader` back-reference.
     ///
     /// Single `unsafe` deref site for the `env_loader: Option<NonNull<_>>`
@@ -3014,7 +3044,8 @@ impl<'a> Resolver<'a> {
                             };
                         }
 
-                        if let Some(id) = manager!().lockfile_resolve(esm.name, &dependency_version)
+                        if let Some(id) =
+                            manager!().lockfile_resolve(esm.name, &dependency_version, string_buf)
                         {
                             resolved_package_id = id;
                         }
@@ -3540,7 +3571,11 @@ impl<'a> Resolver<'a> {
             };
         }
         // we should never be trying to resolve a dependency that is already resolved
-        debug_assert!(pm!().lockfile_resolve(esm.name, &version).is_none());
+        debug_assert!(
+            pm!()
+                .lockfile_resolve(esm.name, &version, version_buf)
+                .is_none()
+        );
 
         // Add the containing package to the lockfile
 
diff --git a/src/runtime/cli/repl_command.rs b/src/runtime/cli/repl_command.rs
index 061ac4de2b1a..aa4c7b2b0fac 100644
--- a/src/runtime/cli/repl_command.rs
+++ b/src/runtime/cli/repl_command.rs
@@ -78,6 +78,7 @@ impl ReplCommand {
             transform_options: core::mem::take(&mut ctx.args),
             debugger: core::mem::take(&mut ctx.runtime_options.debugger),
             log: core::ptr::NonNull::new(ctx.log),
+            global_cache: ctx.debug.global_cache,
             smol: ctx.runtime_options.smol,
             eval_mode: true,
             is_main_thread: true,
diff --git a/src/runtime/cli/run_command.rs b/src/runtime/cli/run_command.rs
index 83fba6b67574..efd05d5cf0fe 100644
--- a/src/runtime/cli/run_command.rs
+++ b/src/runtime/cli/run_command.rs
@@ -614,6 +614,13 @@ Full documentation is available at <magenta>https://bun.com/docs/cli/run<r>
         this_transpiler.resolver.care_about_bin_folder = true;
         this_transpiler.resolver.care_about_scripts = true;
         this_transpiler.resolver.store_fd = opts.store_root_fd;
+        // The directories read below are cached process-wide and reused by the
+        // VM that `bun run file.js` boots afterwards, and a package.json's
+        // dependency ranges (what auto-install resolves against) are only
+        // recorded when the resolver caching it has auto-install enabled. So
+        // this resolver needs the VM's setting (see `InitOptions::global_cache`).
+        this_transpiler.options.global_cache = ctx.debug.global_cache;
+        this_transpiler.resolver.opts.global_cache = ctx.debug.global_cache;
 
         // Bundler-linker + JSX-runtime config: only callers that actually
         // transpile through this `Transpiler` need it. `configure_linker`'s
@@ -956,6 +963,7 @@ Full documentation is available at <magenta>https://bun.com/docs/cli/run<r>
             transform_options: ctx.args.clone(),
             log: ::core::ptr::NonNull::new(ctx.log),
             debugger: ::core::mem::take(&mut ctx.runtime_options.debugger),
+            global_cache: ctx.debug.global_cache,
             smol: ctx.runtime_options.smol,
             mini_mode: ctx.runtime_options.smol,
             eval_mode: ctx.runtime_options.eval.eval_and_print,
diff --git a/src/runtime/jsc_hooks.rs b/src/runtime/jsc_hooks.rs
index edb355d3b465..840585ff825a 100644
--- a/src/runtime/jsc_hooks.rs
+++ b/src/runtime/jsc_hooks.rs
@@ -465,6 +465,8 @@ unsafe fn init_runtime_state(
                     let t = &mut (*vm).transpiler;
                     t.options.emit_dce_annotations = false;
                     t.resolver.store_fd = opts.store_fd;
+                    t.options.global_cache = opts.global_cache;
+                    t.resolver.opts.global_cache = opts.global_cache;
                     t.resolver.prefer_module_field = false;
                     // Propagate `--preserve-symlinks`
                     // from CLI args to the resolver so symlinked node_modules
diff --git a/test/cli/run/run-autoinstall.test.ts b/test/cli/run/run-autoinstall.test.ts
index bdf63a8690f8..8f1e67ab40c6 100644
--- a/test/cli/run/run-autoinstall.test.ts
+++ b/test/cli/run/run-autoinstall.test.ts
@@ -85,6 +85,184 @@ test("auto-install in a project whose package.json has a name and version", asyn
   expect(exitCode).toBe(1);
 });
 
+// Serves the `no-deps` fixture (versions 1.0.0, 1.0.1, 1.1.0 and 2.0.0, with
+// `latest` pointing at 2.0.0) and records every request path, so a test can
+// tell which version auto-install decided to download.
+function noDepsRegistry() {
+  const fixtures = join(import.meta.dir, "..", "install", "registry", "packages", "no-deps");
+  const requests: string[] = [];
+  const server = Bun.serve({
+    port: 0,
+    async fetch(req) {
+      const pathname = new URL(req.url).pathname;
+      requests.push(pathname);
+      if (pathname === "/no-deps") {
+        const manifest = await Bun.file(join(fixtures, "package.json")).text();
+        return Response.json(
+          JSON.parse(manifest.replaceAll("http://localhost:4873", `http://127.0.0.1:${server.port}`)),
+        );
+      }
+      const tgz = pathname.match(/^\/no-deps\/-\/(no-deps-[\d.]+\.tgz)$/);
+      if (tgz) return new Response(Bun.file(join(fixtures, tgz[1])));
+      return new Response("not found", { status: 404 });
+    },
+  });
+  return {
+    requests,
+    bunfig: `[install]\nregistry = "http://127.0.0.1:${server.port}/"\n`,
+    tarballs: () => requests.filter(p => p.endsWith(".tgz")),
+    [Symbol.dispose]() {
+      server.stop(true);
+    },
+  };
+}
+
+async function runAutoInstall(cwd: string, ...args: string[]) {
+  await using proc = Bun.spawn({
+    cmd: [bunExe(), ...args],
+    cwd,
+    env: { ...bunEnv, BUN_INSTALL_CACHE_DIR: join(cwd, ".bun-cache") },
+    stdout: "pipe",
+    stderr: "pipe",
+  });
+  const [stdout, stderr, exitCode] = await Promise.all([proc.stdout.text(), proc.stderr.text(), proc.exited]);
+  return { stdout, stderr, exitCode };
+}
+
+const printNoDepsVersion = `console.log(require("no-deps").version);\n`;
+
+// docs/runtime/auto-install.mdx: a bare import resolves to the version range the
+// nearest package.json declares for it, and only falls back to `latest` when no
+// package.json lists the package.
+describe.concurrent("auto-install uses the version range from package.json", () => {
+  test("bun <file> run from the project directory", async () => {
+    using registry = noDepsRegistry();
+    using dir = tempDir("autoinstall-range", {
+      "package.json": JSON.stringify({ name: "app", dependencies: { "no-deps": "^1.0.0" } }),
+      "index.js": printNoDepsVersion,
+      "bunfig.toml": registry.bunfig,
+    });
+
+    const { stdout, stderr, exitCode } = await runAutoInstall(String(dir), "index.js");
+    expect(stdout).toBe("1.1.0\n");
+    expect(stderr).not.toContain("error");
+    expect(exitCode).toBe(0);
+    expect(registry.tarballs()).toEqual(["/no-deps/-/no-deps-1.1.0.tgz"]);
+  });
+
+  // `bun run <file>` reads the project directory while looking for a
+  // package.json script before it boots the runtime; the cached result must
+  // still carry the dependency ranges.
+  test("bun run <file> run from the project directory", async () => {
+    using registry = noDepsRegistry();
+    using dir = tempDir("autoinstall-range-run", {
+      "package.json": JSON.stringify({ name: "app", dependencies: { "no-deps": "^1.0.0" } }),
+      "index.js": printNoDepsVersion,
+      "bunfig.toml": registry.bunfig,
+    });
+
+    const { stdout, stderr, exitCode } = await runAutoInstall(String(dir), "run", "index.js");
+    expect(stdout).toBe("1.1.0\n");
+    expect(stderr).not.toContain("error");
+    expect(exitCode).toBe(0);
+    expect(registry.tarballs()).toEqual(["/no-deps/-/no-deps-1.1.0.tgz"]);
+  });
+
+  test("project package.json in a directory below the cwd", async () => {
+    using registry = noDepsRegistry();
+    using dir = tempDir("autoinstall-range-nested", {
+      "bunfig.toml": registry.bunfig,
+      "app/package.json": JSON.stringify({ name: "app", dependencies: { "no-deps": "^1.0.0" } }),
+      "app/index.js": printNoDepsVersion,
+    });
+
+    const { stdout, stderr, exitCode } = await runAutoInstall(String(dir), "app/index.js");
+    expect(stdout).toBe("1.1.0\n");
+    expect(stderr).not.toContain("error");
+    expect(exitCode).toBe(0);
+    expect(registry.tarballs()).toEqual(["/no-deps/-/no-deps-1.1.0.tgz"]);
+  });
+
+  test("package.json without a name field", async () => {
+    using registry = noDepsRegistry();
+    using dir = tempDir("autoinstall-range-nameless", {
+      "package.json": JSON.stringify({ dependencies: { "no-deps": "~1.0.0" } }),
+      "index.js": printNoDepsVersion,
+      "bunfig.toml": registry.bunfig,
+    });
+
+    const { stdout, stderr, exitCode } = await runAutoInstall(String(dir), "index.js");
+    expect(stdout).toBe("1.0.1\n");
+    expect(stderr).not.toContain("error");
+    expect(exitCode).toBe(0);
+    expect(registry.tarballs()).toEqual(["/no-deps/-/no-deps-1.0.1.tgz"]);
+  });
+
+  // Ranges longer than 8 bytes are stored as offsets into the package.json
+  // source rather than inline, so this also checks they are read back from the
+  // right buffer.
+  test("range longer than an inline semver string", async () => {
+    using registry = noDepsRegistry();
+    using dir = tempDir("autoinstall-range-long", {
+      "package.json": JSON.stringify({ name: "app", dependencies: { "no-deps": ">=1.0.0 <1.1.0" } }),
+      "index.js": printNoDepsVersion,
+      "bunfig.toml": registry.bunfig,
+    });
+
+    const { stdout, stderr, exitCode } = await runAutoInstall(String(dir), "index.js");
+    expect(stdout).toBe("1.0.1\n");
+    expect(stderr).not.toContain("error");
+    expect(exitCode).toBe(0);
+    expect(registry.tarballs()).toEqual(["/no-deps/-/no-deps-1.0.1.tgz"]);
+  });
+
+  test("a range nothing in the registry satisfies is an error, not latest", async () => {
+    using registry = noDepsRegistry();
+    using dir = tempDir("autoinstall-range-unsatisfiable", {
+      "package.json": JSON.stringify({ name: "app", dependencies: { "no-deps": "^3.0.0" } }),
+      "index.js": printNoDepsVersion,
+      "bunfig.toml": registry.bunfig,
+    });
+
+    const { stdout, stderr, exitCode } = await runAutoInstall(String(dir), "index.js");
+    expect(stdout).toBe("");
+    expect(stderr).toContain("Cannot find package 'no-deps'");
+    expect(exitCode).toBe(1);
+    expect(registry.requests).toContain("/no-deps");
+    expect(registry.tarballs()).toEqual([]);
+  });
+
+  test("npm: alias installs the aliased package", async () => {
+    using registry = noDepsRegistry();
+    using dir = tempDir("autoinstall-range-alias", {
+      "package.json": JSON.stringify({ name: "app", dependencies: { "my-alias": "npm:no-deps@^1.0.0" } }),
+      "index.js": `console.log(require("my-alias").version);\n`,
+      "bunfig.toml": registry.bunfig,
+    });
+
+    const { stdout, stderr, exitCode } = await runAutoInstall(String(dir), "index.js");
+    expect(stdout).toBe("1.1.0\n");
+    expect(stderr).not.toContain("error");
+    expect(exitCode).toBe(0);
+    expect(registry.requests).toEqual(["/no-deps", "/no-deps/-/no-deps-1.1.0.tgz"]);
+  });
+
+  test("a package the package.json does not list still resolves to latest", async () => {
+    using registry = noDepsRegistry();
+    using dir = tempDir("autoinstall-range-unlisted", {
+      "package.json": JSON.stringify({ name: "app", dependencies: { "something-else": "^1.0.0" } }),
+      "index.js": printNoDepsVersion,
+      "bunfig.toml": registry.bunfig,
+    });
+
+    const { stdout, stderr, exitCode } = await runAutoInstall(String(dir), "index.js");
+    expect(stdout).toBe("2.0.0\n");
+    expect(stderr).not.toContain("error");
+    expect(exitCode).toBe(0);
+    expect(registry.tarballs()).toEqual(["/no-deps/-/no-deps-2.0.0.tgz"]);
+  });
+});
+
 test("--install=fallback to install missing packages", async () => {
   const dir = tmpdirSync();
   mkdirSync(dir, { recursive: true });

From e6abb9bd98a5e715a1e61c183ad63322df993570 Mon Sep 17 00:00:00 2001
From: robobun <117481402+robobun@users.noreply.github.com>
Date: Mon, 17 Aug 2026 01:50:42 +0000
Subject: [PATCH 125/258] install: import pnpm-workspace.yaml even without a
 migratable pnpm-lock.yaml (#38754)

---
 docs/pm/cli/install.mdx                       |   4 +-
 docs/pm/isolated-installs.mdx                 |   6 +-
 .../PackageManager/install_with_manager.rs    |   5 +
 .../updatePackageJSONAndInstall.rs            | 116 ++++----
 src/install/pnpm.rs                           | 143 ++++-----
 .../migration/pnpm-lock-migration.test.ts     | 278 +++++++++++++++++-
 .../install/migration/pnpm-lock-v9.test.ts    |  59 +++-
 7 files changed, 474 insertions(+), 137 deletions(-)

diff --git a/docs/pm/cli/install.mdx b/docs/pm/cli/install.mdx
index a36b630ea09c..3bec9f4b0a31 100644
--- a/docs/pm/cli/install.mdx
+++ b/docs/pm/cli/install.mdx
@@ -543,7 +543,7 @@ The migration process handles:
 
 ### Workspace Configuration
 
-When a `pnpm-workspace.yaml` file exists, Bun migrates workspace settings to your root `package.json`:
+When a `pnpm-workspace.yaml` file exists, Bun migrates workspace settings to your root `package.json`. This happens together with the lockfile migration, and also when there is no `pnpm-lock.yaml` to migrate (it was never committed, or it is too old to convert), as long as `bun.lock` does not exist yet and the root `package.json` has no `workspaces` field of its own:
 
 ```yaml pnpm-workspace.yaml icon="file-code"
 packages:
@@ -611,7 +611,7 @@ Bun leaves the `pnpm` field of `package.json` as it is. pnpm reads its configura
 - All catalog entries referenced by dependencies must exist in the catalogs definition
 - Every workspace in `pnpm-lock.yaml` must have its `package.json` on disk (in Docker, copy them in before `bun install`)
 - Relative `link:` dependencies and git dependencies with a sub-directory (`resolution.path`) are not supported
-- If migration fails for any of these reasons, Bun prints why and resolves from scratch instead
+- If migration fails for any of these reasons, Bun prints why and resolves from scratch instead. The `pnpm-workspace.yaml` settings above are still migrated, so workspaces, catalogs and overrides are not lost
 
 Once nobody on the repository uses pnpm anymore, you can remove `pnpm-lock.yaml`, `pnpm-workspace.yaml`, and the `pnpm` field of `package.json`.
 
diff --git a/docs/pm/isolated-installs.mdx b/docs/pm/isolated-installs.mdx
index 69fbec8302e8..669a0b5dd25c 100644
--- a/docs/pm/isolated-installs.mdx
+++ b/docs/pm/isolated-installs.mdx
@@ -211,13 +211,15 @@ bun install --linker isolated
 Isolated installs are conceptually similar to pnpm, so migration is direct:
 
 ```bash terminal icon="terminal"
-# Remove pnpm files
-rm -rf node_modules pnpm-lock.yaml
+# Remove pnpm's node_modules
+rm -rf node_modules
 
 # Install with Bun's isolated linker
 bun install --linker isolated
 ```
 
+Keep `pnpm-lock.yaml` around for this first install: Bun converts it to `bun.lock`, so you keep the versions pnpm had resolved. The same first install (no `bun.lock` yet, no `workspaces` field in the root `package.json`) also moves the workspace list, catalogs and overrides from `pnpm-workspace.yaml` into the root `package.json`, with or without a `pnpm-lock.yaml`. See [pnpm migration](/pm/cli/install#pnpm-migration) for what is converted.
+
 The layouts are close: Bun hardlinks (clones on macOS) packages from its [global cache](/pm/global-cache) into a per-project store, `node_modules/.bun/`, and symlinks top-level `node_modules` entries into it. With [`install.globalStore`](#global-virtual-store) enabled, those store entries become symlinks into a global virtual store instead.
 
 ## When to use isolated installs
diff --git a/src/install/PackageManager/install_with_manager.rs b/src/install/PackageManager/install_with_manager.rs
index 2090a2839c56..e8f6b699b800 100644
--- a/src/install/PackageManager/install_with_manager.rs
+++ b/src/install/PackageManager/install_with_manager.rs
@@ -1936,6 +1936,11 @@ fn create_new_lockfile_and_enqueue(
         Global::crash();
     }
 
+    // A loaded lockfile already describes the project; a migrated pnpm-lock.yaml imports the yaml itself.
+    if !matches!(load_result, lockfile::LoadResult::Ok { .. }) {
+        crate::pnpm::migrate_pnpm_workspace_config(manager)?;
+    }
+
     let source_copy = root_package_json_source(manager, root_package_json_path)?;
 
     let mut resolver: () = ();
diff --git a/src/install/PackageManager/updatePackageJSONAndInstall.rs b/src/install/PackageManager/updatePackageJSONAndInstall.rs
index cb75ce464347..323c2b6a181d 100644
--- a/src/install/PackageManager/updatePackageJSONAndInstall.rs
+++ b/src/install/PackageManager/updatePackageJSONAndInstall.rs
@@ -284,9 +284,18 @@ fn update_package_json_and_install_with_manager_with_updates(
 
     add_catalog::prepare(manager, &updates);
 
+    // Loads the lockfile, and migrating one rewrites the cached root package.json: do it before reading the entry.
+    let patch_commit: Option<PatchCommitResult> =
+        if matches!(manager.options.patch_features, PatchFeatures::Commit { .. }) {
+            let mut pathbuf = PathBuffer::uninit();
+            patch_package::do_patch_commit(manager, &mut pathbuf, log_level)?
+        } else {
+            None
+        };
+
     // reshaped for borrowck — `get_with_path` returns `&mut MapEntry`
     // borrowed from `manager.workspace_package_json_cache`, but we then need
-    // `&mut *manager` for `PackageJSONEditor::edit` / `do_patch_commit` while still
+    // `&mut *manager` for `PackageJSONEditor::edit` while still
     // holding the entry. Demote to `*mut MapEntry` and re-
     // borrow at point of use. The cache map is not mutated again until the
     // next `get_with_path` call below, so the pointer remains valid.
@@ -326,8 +335,7 @@ fn update_package_json_and_install_with_manager_with_updates(
         };
     // SAFETY: see note above — pointer into `manager.workspace_package_json_cache`,
     // valid until the next `get_with_path`. No `&mut manager.workspace_package_json_cache`
-    // is taken across this borrow; `PackageJSONEditor` and `do_patch_commit` touch only
-    // disjoint manager fields.
+    // is taken across this borrow; `PackageJSONEditor` touches only disjoint manager fields.
     let current_package_json: &mut MapEntry = unsafe { &mut *current_package_json_ptr };
     let mut current_package_json_root: bun_ast::Expr = current_package_json.root;
     let current_package_json_indent = current_package_json.indentation;
@@ -425,23 +433,17 @@ fn update_package_json_and_install_with_manager_with_updates(
             }
         }
         _ => {
-            if matches!(manager.options.patch_features, PatchFeatures::Commit { .. }) {
-                let mut pathbuf = PathBuffer::uninit();
-                if let Some(stuff) =
-                    patch_package::do_patch_commit(manager, &mut pathbuf, log_level)?
-                {
-                    // we're inside a workspace package, we need to edit the
-                    // root json, not the `current_package_json`
-                    if stuff.not_in_workspace_root {
-                        not_in_workspace_root = Some(stuff);
-                    } else {
-                        PackageJSONEditor::edit_patched_dependencies(
-                            manager,
-                            &mut current_package_json_root,
-                            &stuff.patch_key,
-                            &stuff.patchfile_path,
-                        )?;
-                    }
+            if let Some(stuff) = patch_commit {
+                // Inside a workspace package the root package.json is edited below, not `current_package_json`.
+                if stuff.not_in_workspace_root {
+                    not_in_workspace_root = Some(stuff);
+                } else {
+                    PackageJSONEditor::edit_patched_dependencies(
+                        manager,
+                        &mut current_package_json_root,
+                        &stuff.patch_key,
+                        &stuff.patchfile_path,
+                    )?;
                 }
             }
         }
@@ -483,12 +485,12 @@ fn update_package_json_and_install_with_manager_with_updates(
     // The Smarter™ approach is you resolve ahead of time and write to disk once!
     // But, turns out that's slower in any case where more than one package has to be resolved (most of the time!)
     // Concurrent network requests are faster than doing one and then waiting until the next batch
-    let new_package_json_source: Vec<u8> = package_json_writer
-        .ctx
-        .written_without_trailing_zero()
-        .to_vec();
-    // The cache entry (`Cow<'static, [u8]>`) outlives this stack frame, so it needs its own copy.
-    current_package_json.source.contents = Cow::Owned(new_package_json_source.clone());
+    current_package_json.source.contents = Cow::Owned(
+        package_json_writer
+            .ctx
+            .written_without_trailing_zero()
+            .to_vec(),
+    );
     // The edits above went into a promoted copy
     // (`current_package_json_root`), so re-parse the
     // printed source so the cached AST (consumed by `FolderResolver` for workspace
@@ -661,40 +663,34 @@ fn update_package_json_and_install_with_manager_with_updates(
     }
 
     if manager.options.do_.contains(Do::WRITE_PACKAGE_JSON) {
-        let (source, path): (&[u8], &ZStr) =
-            if matches!(manager.options.patch_features, PatchFeatures::Commit { .. }) {
-                'source_and_path: {
-                    let root_package_json_entry = match manager
-                        .workspace_package_json_cache
-                        .get_with_path(
-                            manager.log_mut(),
-                            root_package_json_path.as_bytes(),
-                            GetJSONOptions::default(),
-                        )
-                        .unwrap()
-                    {
-                        Ok(e) => e,
-                        Err(err) => {
-                            Output::err(
-                                err,
-                                "failed to read/parse package.json at '{s}'",
-                                (BStr::new(root_package_json_path.as_bytes()),),
-                            );
-                            Global::exit(1);
-                        }
-                    };
-
-                    break 'source_and_path (
-                        &root_package_json_entry.source.contents,
-                        root_package_json_path,
-                    );
-                }
-            } else {
-                (
-                    &new_package_json_source,
-                    manager.original_package_json_path.as_zstr(),
-                )
-            };
+        // `bun patch --commit` records the patch in the root package.json, even when run from a workspace.
+        let path: &ZStr = if matches!(manager.options.patch_features, PatchFeatures::Commit { .. })
+        {
+            root_package_json_path
+        } else {
+            manager.original_package_json_path.as_zstr()
+        };
+        // Written from the cache entry: a pnpm migration inside `install_with_manager` may have edited it since.
+        let entry = match manager
+            .workspace_package_json_cache
+            .get_with_path(
+                manager.log_mut(),
+                path.as_bytes(),
+                GetJSONOptions::default(),
+            )
+            .unwrap()
+        {
+            Ok(entry) => entry,
+            Err(err) => {
+                Output::err(
+                    err,
+                    "failed to read/parse package.json at '{s}'",
+                    (BStr::new(path.as_bytes()),),
+                );
+                Global::exit(1);
+            }
+        };
+        let source: &[u8] = &entry.source.contents;
 
         // Now that we've run the install step
         // We can save our in-memory package.json to disk
diff --git a/src/install/pnpm.rs b/src/install/pnpm.rs
index 192adee41929..d07e53751b00 100644
--- a/src/install/pnpm.rs
+++ b/src/install/pnpm.rs
@@ -6,7 +6,7 @@ use bun_alloc::AllocError;
 use bun_collections::StringArrayHashMap;
 
 use bun_ast::{self, self as js_ast, E, Expr, ExprData, G};
-use bun_core::strings;
+use bun_core::{Global, Output, strings};
 use bun_semver as semver;
 use bun_semver::{ExternalString, String};
 use bun_sys::{self as sys, Fd};
@@ -176,6 +176,25 @@ fn collect_patch_paths(
     Ok(())
 }
 
+fn root_package_json<'a>(
+    manager: &'a mut PackageManager,
+    log: &mut bun_ast::Log,
+) -> Option<&'a mut crate::WorkspacePackageJsonCacheEntry> {
+    let mut pkg_json_path = bun_paths::AutoAbsPath::init_top_level_dir();
+    let _ = pkg_json_path.append(b"package.json"); // OOM/capacity error is non-actionable here
+    match manager.workspace_package_json_cache.get_with_path(
+        log,
+        pkg_json_path.slice(),
+        crate::GetJsonOptions {
+            guess_indentation: true,
+            ..Default::default()
+        },
+    ) {
+        crate::GetJsonResult::Entry(entry) => Some(entry),
+        crate::GetJsonResult::ReadErr(_) | crate::GetJsonResult::ParseErr(_) => None,
+    }
+}
+
 /// Current pnpm records only the patch hash in the lockfile; the patch file path lives in the config.
 fn read_config_patch_paths(
     manager: &mut PackageManager,
@@ -183,12 +202,7 @@ fn read_config_patch_paths(
 ) -> Result<StringArrayHashMap<Box<[u8]>>, AllocError> {
     let mut paths: StringArrayHashMap<Box<[u8]>> = StringArrayHashMap::new();
 
-    let mut pkg_json_path = bun_paths::AutoAbsPath::init_top_level_dir();
-    let _ = pkg_json_path.append(b"package.json");
-    if let crate::GetJsonResult::Entry(pkg_json) = manager
-        .workspace_package_json_cache
-        .get_with_path(log, pkg_json_path.slice(), Default::default())
-    {
+    if let Some(pkg_json) = root_package_json(manager, log) {
         if let Some(patched) = pkg_json
             .root
             .get(b"pnpm")
@@ -2369,7 +2383,7 @@ fn rewrite_bare_patch_keys(
             bstr::BStr::new(&**res_str)
         )
         .map_err(|_| AllocError)?;
-        // Interned into the DATA_STORE backing the cached package.json Expr tree, which outlives this fn.
+        // Lives in the AST store like the key node below; nothing resets it before the caller prints the tree.
         let interned: &[u8] = js_ast::data_store_dupe_str(join_buf.as_slice());
         prop.key = Some(Expr::init(E::EString::init(interned), bun_ast::Loc::EMPTY));
     }
@@ -2464,7 +2478,24 @@ fn add_trusted_dependencies(
     Ok(true)
 }
 
-/// Updates package.json with workspace and catalog information after migration
+/// Imports pnpm-workspace.yaml when no pnpm-lock.yaml was migrated; a root `workspaces` field means it already was.
+pub(crate) fn migrate_pnpm_workspace_config(
+    manager: &mut PackageManager,
+) -> Result<(), AllocError> {
+    if !sys::exists_z(bun_core::zstr!("pnpm-workspace.yaml")) {
+        return Ok(());
+    }
+    let log = manager.log_mut();
+    let Some(root_pkg_json) = root_package_json(manager, log) else {
+        return Ok(());
+    };
+    if root_pkg_json.root.get(b"workspaces").is_some() {
+        return Ok(());
+    }
+    update_package_json_after_migration(manager, log, Fd::cwd(), &StringArrayHashMap::new())
+}
+
+/// Moves the settings pnpm reads from package.json `pnpm.*` and pnpm-workspace.yaml into the fields bun reads.
 fn update_package_json_after_migration(
     lockfile: &mut Lockfile,
     manager: &mut PackageManager,
@@ -2472,26 +2503,11 @@ fn update_package_json_after_migration(
     dir: Fd,
     patches: &StringArrayHashMap<Box<[u8]>>,
 ) -> Result<(), AllocError> {
-    let mut pkg_json_path = bun_paths::AutoAbsPath::init_top_level_dir();
-    let _ = pkg_json_path.append(b"package.json"); // OOM/capacity error is non-actionable here
-
     let bump = bun_alloc::Arena::new();
     let silent = manager.options.log_level.is_silent();
 
-    let root_pkg_json = match manager
-        .workspace_package_json_cache
-        .get_with_path(
-            log,
-            pkg_json_path.slice(),
-            crate::GetJsonOptions {
-                guess_indentation: true,
-                ..Default::default()
-            },
-        )
-        .unwrap()
-    {
-        Ok(j) => j,
-        Err(_) => return Ok(()),
+    let Some(root_pkg_json) = root_package_json(manager, log) else {
+        return Ok(());
     };
 
     let mut json = root_pkg_json.root;
@@ -2535,10 +2551,7 @@ fn update_package_json_after_migration(
         }
     }
 
-    // Each `&'static [u8]` here is interned into the thread-local `DATA_STORE`
-    // (see `data_store_dupe_str` below) so it shares the lifetime of the
-    // `Expr` nodes it ends up backing inside the cached `root_pkg_json.root`.
-    let mut workspace_paths: Option<Vec<&'static [u8]>> = None;
+    let mut workspace_paths: Option<Vec<&[u8]>> = None;
     let mut catalog_obj: Option<Expr> = None;
     let mut catalogs_obj: Option<Expr> = None;
     let mut workspace_overrides_obj: Option<Expr> = None;
@@ -2546,16 +2559,9 @@ fn update_package_json_after_migration(
 
     match sys::File::read_from(Fd::cwd(), b"pnpm-workspace.yaml") {
         Ok(contents) => 'read_pnpm_workspace_yaml: {
-            // The `Vec<u8>` would drop at the end of this arm while the
-            // `Expr`s it backs (catalog/catalogs/overrides/patchedDependencies
-            // below) escape into `json` and the
-            // `workspace_package_json_cache`. Intern the bytes into the same
-            // thread-local `DATA_STORE` that owns the surrounding `Expr`
-            // nodes — arena ownership, not a leak (bulk-freed on
-            // `Expr::data_store_reset`).
-            let contents: &'static [u8] = js_ast::data_store_dupe_str(&contents);
+            // Quoted and block scalars are copied into the parse arena, so it has to outlive the print below.
+            let contents: &[u8] = bump.alloc_slice_copy(&contents);
             let yaml_source = bun_ast::Source::init_path_string(b"pnpm-workspace.yaml", contents);
-            // Quoted scalars are copied into the arena; `bump` lives until the print below.
             let Ok(ws_root) = bun_parsers::yaml::YAML::parse(
                 &yaml_source,
                 log,
@@ -2567,16 +2573,10 @@ fn update_package_json_after_migration(
 
             if let Some(packages_expr) = ws_root.get(b"packages") {
                 if let Some(mut packages) = packages_expr.as_array() {
-                    let mut paths: Vec<&'static [u8]> = Vec::new();
+                    let mut paths: Vec<&[u8]> = Vec::new();
                     while let Some(package_path) = packages.next() {
                         if let Some(package_path_str) = as_string(&package_path) {
-                            // Intern (vs. the prior `Box<[u8]>`) so the
-                            // `EString` nodes built from these paths below do
-                            // not dangle once this function returns and the
-                            // boxes drop — they are stored into
-                            // `root_pkg_json.root` which is cached in
-                            // `manager.workspace_package_json_cache`.
-                            paths.push(js_ast::data_store_dupe_str(package_path_str));
+                            paths.push(package_path_str);
                         }
                     }
                     workspace_paths = Some(paths);
@@ -2718,36 +2718,37 @@ fn update_package_json_after_migration(
     if !trusted_names.is_empty()
         && add_trusted_dependencies(&mut json, lockfile, &bump, &trusted_names)?
     {
-        needs_update = true;
         if pnpm_only_built_deps {
-            moved.push("pnpm.onlyBuiltDependencies to trustedDependencies");
+            copied.push("pnpm.onlyBuiltDependencies to trustedDependencies");
         }
         if workspace_only_built_deps {
-            moved.push("pnpm-workspace.yaml onlyBuiltDependencies to trustedDependencies");
+            copied.push("pnpm-workspace.yaml onlyBuiltDependencies to trustedDependencies");
         }
     }
 
-    if !copied.is_empty() {
-        print_package_json_into_cache_entry(root_pkg_json, json);
-        // The printed tree borrows from the replaced contents; `bun update` edits this entry next.
-        if let Err(err) = root_pkg_json.reparse_root(log) {
-            bun_core::pretty_errorln!("package.json failed to parse due to error {}", err.name());
-            bun_core::Global::crash();
-        }
+    if copied.is_empty() {
+        return Ok(());
+    }
 
-        if sys::File::write_file(
-            dir,
-            bun_core::zstr!("package.json"),
-            root_pkg_json.source.contents(),
-        )
-        .is_ok()
-            && !silent
-        {
-            bun_core::pretty_errorln!(
-                "<d>copied {} in <r><green>package.json<r>",
-                copied.join(", ")
-            );
-        }
+    // The spliced-in nodes live in `bump` and the AST store; re-parse so the cache entry owns its tree.
+    print_package_json_into_cache_entry(root_pkg_json, json);
+    if let Err(err) = root_pkg_json.reparse_root(log) {
+        bun_core::pretty_errorln!("package.json failed to parse due to error {}", err.name());
+        Global::crash();
+    }
+
+    let copied = copied.join(", ");
+    // Continuing would save a bun.lock that does not match the package.json left on disk.
+    if let Err(err) = sys::File::write_file(
+        dir,
+        bun_core::zstr!("package.json"),
+        root_pkg_json.source.contents(),
+    ) {
+        Output::err(err, "failed to copy {} in package.json", (&copied,));
+        Global::crash();
+    }
+    if !silent {
+        bun_core::pretty_errorln!("<d>copied {} in <r><green>package.json<r>", copied);
     }
 
     Ok(())
@@ -2797,7 +2798,7 @@ fn copy_into_root(
     Ok(true)
 }
 
-fn paths_array(paths: &[&'static [u8]]) -> Expr {
+fn paths_array(paths: &[&[u8]]) -> Expr {
     let mut items = js_ast::ExprNodeList::init_capacity(paths.len());
     for path in paths {
         VecExt::append(
diff --git a/test/cli/install/migration/pnpm-lock-migration.test.ts b/test/cli/install/migration/pnpm-lock-migration.test.ts
index 039e8727b2fc..6074bff549c8 100644
--- a/test/cli/install/migration/pnpm-lock-migration.test.ts
+++ b/test/cli/install/migration/pnpm-lock-migration.test.ts
@@ -1,6 +1,6 @@
 import { describe, expect, test } from "bun:test";
 import fs from "fs";
-import { bunEnv, bunExe, tempDir } from "harness";
+import { bunEnv, bunExe, isWindows, tempDir } from "harness";
 import { join } from "path";
 
 describe("pnpm-lock.yaml migration", () => {
@@ -402,3 +402,279 @@ snapshots:
     expect(stderr).not.toContain("migrated lockfile from pnpm-lock.yaml");
   });
 });
+
+// Everything below resolves only workspace packages, so it never touches a registry.
+describe.concurrent("pnpm-workspace.yaml is imported into package.json", () => {
+  const rootPackageJson = { name: "root", private: true };
+  const workspaceYaml = `packages:\n  - "packages/*"\n`;
+  const workspacePackages = {
+    "packages/a/package.json": JSON.stringify({ name: "@w/a", version: "1.2.3" }),
+    "packages/b/package.json": JSON.stringify({
+      name: "@w/b",
+      version: "0.0.1",
+      dependencies: { "@w/a": "workspace:*" },
+    }),
+  };
+  const movedWorkspaces = "copied pnpm-workspace.yaml to workspaces in package.json";
+
+  async function runBun(cwd: string, ...args: string[]) {
+    await using proc = Bun.spawn({
+      cmd: [bunExe(), ...args],
+      cwd,
+      env: bunEnv,
+      stdout: "pipe",
+      stderr: "pipe",
+    });
+    const [stdout, stderr, exitCode] = await Promise.all([proc.stdout.text(), proc.stderr.text(), proc.exited]);
+    return { stdout, stderr, exitCode };
+  }
+
+  function readPackageJson(dir: string) {
+    return JSON.parse(fs.readFileSync(join(dir, "package.json"), "utf8"));
+  }
+
+  // `@w/b` can only see `@w/a` if the install knew `packages/*` were workspaces.
+  async function versionOfAResolvedFromB(dir: string) {
+    const { stdout, stderr, exitCode } = await runBun(
+      join(dir, "packages/b"),
+      "-e",
+      `console.log(require("@w/a/package.json").version)`,
+    );
+    expect({ stdout, stderr, exitCode }).toEqual({ stdout: "1.2.3\n", stderr: "", exitCode: 0 });
+  }
+
+  // Quoted yaml scalars are stored differently from plain ones by the parser; cover both.
+  const catalogFixture = {
+    "package.json": JSON.stringify({ ...rootPackageJson, pnpm: { overrides: { "from-package-json": "1.0.0" } } }),
+    "pnpm-workspace.yaml": `packages:
+  - 'packages/*'
+catalog:
+  "@w/a": "workspace:*"
+  left-pad: ^1.3.0
+catalogs:
+  build:
+    '@scope/quoted': '~2.0.0'
+overrides:
+  "@scope/quoted": "2.0.1"
+  plain: 3.0.0
+`,
+    ...workspacePackages,
+    "packages/b/package.json": JSON.stringify({
+      name: "@w/b",
+      version: "0.0.1",
+      dependencies: { "@w/a": "catalog:" },
+    }),
+  };
+  const catalogFixtureMoved =
+    "copied pnpm.overrides to overrides, pnpm-workspace.yaml to workspaces, pnpm-workspace.yaml overrides to overrides in package.json";
+  const catalogFixtureImported = {
+    ...rootPackageJson,
+    workspaces: {
+      packages: ["packages/*"],
+      catalog: { "@w/a": "workspace:*", "left-pad": "^1.3.0" },
+      catalogs: { build: { "@scope/quoted": "~2.0.0" } },
+    },
+    overrides: { "from-package-json": "1.0.0", "@scope/quoted": "2.0.1", plain: "3.0.0" },
+  };
+
+  test("by bun install when there is no lockfile at all", async () => {
+    await using dir = tempDir("pnpm-workspace-yaml-no-lockfile", {
+      "package.json": JSON.stringify(rootPackageJson, null, 2) + "\n",
+      "pnpm-workspace.yaml": workspaceYaml,
+      ...workspacePackages,
+    });
+
+    const first = await runBun(dir, "install");
+    expect(first.stderr).toContain(movedWorkspaces);
+    expect(first.exitCode).toBe(0);
+
+    expect(readPackageJson(dir)).toEqual({ ...rootPackageJson, workspaces: ["packages/*"] });
+    const lockfile = fs.readFileSync(join(dir, "bun.lock"), "utf8");
+    expect(lockfile).toContain(`"@w/a": ["@w/a@workspace:packages/a"]`);
+    expect(lockfile).toContain(`"@w/b": ["@w/b@workspace:packages/b"]`);
+    await versionOfAResolvedFromB(dir);
+
+    // package.json now declares the workspaces and bun.lock exists: nothing left to import.
+    const second = await runBun(dir, "install");
+    expect(second.stderr).not.toContain("copied pnpm");
+    expect(second.exitCode).toBe(0);
+    expect(readPackageJson(dir)).toEqual({ ...rootPackageJson, workspaces: ["packages/*"] });
+  });
+
+  test("with its catalogs and overrides when there is no lockfile", async () => {
+    await using dir = tempDir("pnpm-workspace-yaml-catalog", catalogFixture);
+
+    const { stderr, exitCode } = await runBun(dir, "install");
+    expect(stderr).toContain(catalogFixtureMoved);
+    expect(exitCode).toBe(0);
+
+    expect(readPackageJson(dir)).toEqual(catalogFixtureImported);
+    expect(fs.readFileSync(join(dir, "bun.lock"), "utf8")).toContain(`"@w/b": ["@w/b@workspace:packages/b"]`);
+    await versionOfAResolvedFromB(dir);
+  });
+
+  test("with its catalogs and overrides while migrating pnpm-lock.yaml", async () => {
+    await using dir = tempDir("pnpm-workspace-yaml-catalog-lockfile", {
+      ...catalogFixture,
+      "pnpm-lock.yaml": `lockfileVersion: '9.0'
+
+catalogs:
+  default:
+    '@w/a':
+      specifier: workspace:*
+      version: link:packages/a
+
+importers:
+
+  .: {}
+
+  packages/a: {}
+
+  packages/b:
+    dependencies:
+      '@w/a':
+        specifier: 'catalog:'
+        version: link:../a
+`,
+    });
+
+    const { stderr, exitCode } = await runBun(dir, "install");
+    expect(stderr).toContain(catalogFixtureMoved);
+    expect(stderr).toContain("migrated lockfile from pnpm-lock.yaml");
+    expect(exitCode).toBe(0);
+
+    expect(readPackageJson(dir)).toEqual(catalogFixtureImported);
+    await versionOfAResolvedFromB(dir);
+  });
+
+  test("when pnpm-lock.yaml is too old to migrate", async () => {
+    await using dir = tempDir("pnpm-workspace-yaml-old-lockfile", {
+      "package.json": JSON.stringify(rootPackageJson),
+      "pnpm-workspace.yaml": workspaceYaml,
+      "pnpm-lock.yaml": `lockfileVersion: '6.0'\n\nimporters:\n\n  .: {}\n`,
+      ...workspacePackages,
+    });
+
+    const { stderr, exitCode } = await runBun(dir, "install");
+    expect(stderr).toContain("pnpm-lock.yaml is lockfileVersion 6.0, which bun cannot migrate");
+    expect(stderr).toContain(movedWorkspaces);
+    expect(exitCode).toBe(0);
+
+    expect(readPackageJson(dir)).toEqual({ ...rootPackageJson, workspaces: ["packages/*"] });
+    await versionOfAResolvedFromB(dir);
+  });
+
+  test("by bun add, alongside the added dependency", async () => {
+    await using dir = tempDir("pnpm-workspace-yaml-add", {
+      "package.json": JSON.stringify(rootPackageJson),
+      "pnpm-workspace.yaml": workspaceYaml,
+      "lib/c/package.json": JSON.stringify({ name: "c", version: "0.0.1" }),
+      ...workspacePackages,
+    });
+
+    const { stderr, exitCode } = await runBun(dir, "add", "file:lib/c");
+    expect(stderr).toContain(movedWorkspaces);
+    expect(exitCode).toBe(0);
+
+    expect(readPackageJson(dir)).toEqual({
+      ...rootPackageJson,
+      dependencies: { c: "file:lib/c" },
+      workspaces: ["packages/*"],
+    });
+    await versionOfAResolvedFromB(dir);
+  });
+
+  test("by bun remove, surviving its package.json write-back", async () => {
+    await using dir = tempDir("pnpm-workspace-yaml-remove", {
+      "package.json": JSON.stringify({ ...rootPackageJson, dependencies: { c: "file:lib/c" } }),
+      "pnpm-workspace.yaml": workspaceYaml,
+      "lib/c/package.json": JSON.stringify({ name: "c", version: "0.0.1" }),
+      ...workspacePackages,
+    });
+
+    const { stderr, exitCode } = await runBun(dir, "remove", "c");
+    expect(stderr).toContain(movedWorkspaces);
+    expect(exitCode).toBe(0);
+
+    expect(readPackageJson(dir)).toEqual({ ...rootPackageJson, workspaces: ["packages/*"] });
+    await versionOfAResolvedFromB(dir);
+  });
+
+  test("not when package.json already declares workspaces", async () => {
+    const declared = { ...rootPackageJson, workspaces: ["packages/a"] };
+    await using dir = tempDir("pnpm-workspace-yaml-declared", {
+      "package.json": JSON.stringify(declared),
+      "pnpm-workspace.yaml": workspaceYaml,
+      ...workspacePackages,
+    });
+
+    const { stderr, exitCode } = await runBun(dir, "install");
+    expect(stderr).not.toContain("copied pnpm");
+    expect(exitCode).toBe(0);
+
+    expect(readPackageJson(dir)).toEqual(declared);
+    const lockfile = fs.readFileSync(join(dir, "bun.lock"), "utf8");
+    expect(lockfile).toContain(`"@w/a": ["@w/a@workspace:packages/a"]`);
+    expect(lockfile).not.toContain("@w/b");
+  });
+
+  test("not when a bun.lock exists", async () => {
+    const single = { ...rootPackageJson, dependencies: { c: "file:lib/c" } };
+    await using dir = tempDir("pnpm-workspace-yaml-has-bun-lock", {
+      "package.json": JSON.stringify(single),
+      "lib/c/package.json": JSON.stringify({ name: "c", version: "0.0.1" }),
+      ...workspacePackages,
+    });
+    expect((await runBun(dir, "install")).exitCode).toBe(0);
+    expect(fs.existsSync(join(dir, "bun.lock"))).toBe(true);
+
+    fs.writeFileSync(join(dir, "pnpm-workspace.yaml"), workspaceYaml);
+    const { stderr, exitCode } = await runBun(dir, "install");
+    expect(stderr).not.toContain("copied pnpm");
+    expect(exitCode).toBe(0);
+
+    expect(readPackageJson(dir)).toEqual(single);
+    expect(fs.readFileSync(join(dir, "bun.lock"), "utf8")).not.toContain("@w/a");
+  });
+
+  // A 0444 package.json does not stop root from writing it, and the mode bits mean something else on Windows.
+  test.skipIf(isWindows || process.getuid?.() === 0).each([
+    ["without a lockfile", {}],
+    [
+      "while migrating pnpm-lock.yaml",
+      {
+        "pnpm-lock.yaml": `lockfileVersion: '9.0'
+
+importers:
+
+  .: {}
+
+  packages/a: {}
+
+  packages/b:
+    dependencies:
+      '@w/a':
+        specifier: workspace:*
+        version: link:../a
+`,
+      },
+    ],
+  ])("and the install fails when package.json cannot be written back, %s", async (_, lockfile) => {
+    const original = JSON.stringify(rootPackageJson);
+    await using dir = tempDir("pnpm-workspace-yaml-readonly", {
+      "package.json": original,
+      "pnpm-workspace.yaml": workspaceYaml,
+      ...workspacePackages,
+      ...lockfile,
+    });
+    fs.chmodSync(join(dir, "package.json"), 0o444);
+
+    const { stderr, exitCode } = await runBun(dir, "install");
+    expect(stderr).toContain("failed to move pnpm-workspace.yaml to workspaces in package.json");
+    expect(stderr).not.toContain("copied pnpm");
+    expect(exitCode).toBe(1);
+
+    expect(fs.readFileSync(join(dir, "package.json"), "utf8")).toBe(original);
+    expect(fs.existsSync(join(dir, "bun.lock"))).toBe(false);
+  });
+});
diff --git a/test/cli/install/migration/pnpm-lock-v9.test.ts b/test/cli/install/migration/pnpm-lock-v9.test.ts
index 17995bdac7cf..f7a607a631d8 100644
--- a/test/cli/install/migration/pnpm-lock-v9.test.ts
+++ b/test/cli/install/migration/pnpm-lock-v9.test.ts
@@ -1,5 +1,5 @@
 import { afterAll, beforeAll, describe, expect, test } from "bun:test";
-import { existsSync, readdirSync, realpathSync, rmSync } from "fs";
+import { appendFileSync, existsSync, readdirSync, realpathSync, rmSync, writeFileSync } from "fs";
 import { bunEnv, bunExe, nodeModulesPackages, tempDir, VerdaccioRegistry } from "harness";
 import { dirname, join } from "path";
 
@@ -1086,6 +1086,63 @@ snapshots:
         );
       },
     );
+
+    // `bun patch --commit` loads the lockfile before it edits package.json, so the migration's rewrite of
+    // package.json (and of its cache entry) happens underneath the command.
+    test("bun patch --commit that has to migrate the lockfile keeps the migration's package.json edits", async () => {
+      const packageJson = { name: "patch-commit-migrates", dependencies: { "no-deps": "^1.0.0" } };
+      const { packageDir } = await verdaccio.createTestDir({
+        bunfigOpts: { linker: "hoisted" },
+        files: {
+          "package.json": JSON.stringify(packageJson),
+          "pnpm-workspace.yaml": "packages:\n  - 'packages/*'\n",
+          "packages/a/package.json": JSON.stringify({ name: "a", version: "1.0.0" }),
+          "pnpm-lock.yaml": `lockfileVersion: '9.0'
+
+importers:
+
+  .:
+    dependencies:
+      no-deps:
+        specifier: ^1.0.0
+        version: 1.0.1
+
+  packages/a: {}
+
+packages:
+
+  no-deps@1.0.1:
+    resolution: {integrity: ${NO_DEPS_1_0_1_INTEGRITY}}
+
+snapshots:
+
+  no-deps@1.0.1: {}
+`,
+        },
+      });
+
+      // `bun patch` installs and unlinks node_modules/no-deps from the cache copy that `--commit` diffs against;
+      // the repo is then put back to how it was checked out, so `--commit` is the command that migrates.
+      expect((await run(packageDir, "patch", "no-deps")).exitCode).toBe(0);
+      rmSync(join(packageDir, "bun.lock"));
+      writeFileSync(join(packageDir, "package.json"), JSON.stringify(packageJson));
+      appendFileSync(join(packageDir, "node_modules/no-deps/index.js"), "globalThis.patchedAtCommit = true;\n");
+
+      const { stderr, exitCode } = await run(packageDir, "patch", "--commit", "node_modules/no-deps");
+      expect(stderr).toContain("copied pnpm-workspace.yaml to workspaces in package.json");
+      expect(stderr).toContain("migrated lockfile from pnpm-lock.yaml");
+      expect(exitCode).toBe(0);
+
+      expect(await Bun.file(join(packageDir, "package.json")).json()).toEqual({
+        ...packageJson,
+        workspaces: ["packages/*"],
+        patchedDependencies: { "no-deps@1.0.1": "patches/no-deps@1.0.1.patch" },
+      });
+      expect(await Bun.file(join(packageDir, "patches/no-deps@1.0.1.patch")).text()).toContain(
+        "+globalThis.patchedAtCommit = true;",
+      );
+      expect(await bunLockOf(packageDir)).toContain(`"no-deps@1.0.1": "patches/no-deps@1.0.1.patch"`);
+    });
   });
 
   test("catalog:default is the default catalog", async () => {

From 234864f878c735161002913b0a96677ee9c11c89 Mon Sep 17 00:00:00 2001
From: robobun <117481402+robobun@users.noreply.github.com>
Date: Mon, 17 Aug 2026 01:51:15 +0000
Subject: [PATCH 126/258] install: skip workspace members whose package.json
 has no name (#38781)

---
 docs/pm/workspaces.mdx                        |   2 +
 src/install/error.rs                          |   3 -
 src/install/lockfile/Package.rs               |   2 +
 src/install/lockfile/Package/WorkspaceMap.rs  | 151 +++++++++++-------
 src/install/migration.rs                      |   5 -
 src/install/pnpm.rs                           |  10 +-
 test/cli/install/bun-workspaces.test.ts       |  90 +++++++++++
 .../__snapshots__/migrate.test.ts.snap        |  22 ++-
 .../install/migration/npm-arborist/README.md  |   2 +-
 .../migration/npm-arborist/fixtures.json      |   2 +-
 .../install/migration/pnpm-lock-v9.test.ts    | 105 ++++++++++++
 11 files changed, 322 insertions(+), 72 deletions(-)

diff --git a/docs/pm/workspaces.mdx b/docs/pm/workspaces.mdx
index 7673b6111780..e60a963e1bee 100644
--- a/docs/pm/workspaces.mdx
+++ b/docs/pm/workspaces.mdx
@@ -66,6 +66,8 @@ Each workspace has its own `package.json`. To reference another package in the m
 }
 ```
 
+A workspace needs a `"name"`. Bun skips a matched `package.json` that has no `"name"`, such as a test fixture containing only `{ "type": "module" }`. Bun does not link the skipped directory into `node_modules` and does not install its dependencies. If the skipped `package.json` declares dependencies, `bun install` prints a warning that names the directory.
+
 `bun install` installs dependencies for all workspaces in the monorepo, de-duplicating packages if possible. To install dependencies for specific workspaces only, use the `--filter` flag.
 
 ```bash
diff --git a/src/install/error.rs b/src/install/error.rs
index ebe01be29377..bf5bd11e7e38 100644
--- a/src/install/error.rs
+++ b/src/install/error.rs
@@ -178,8 +178,6 @@ pub enum Error {
     CorruptLockfile,
     #[error("Lockfile is missing resolution data")]
     LockfileIsMissingResolutionData,
-    #[error("MissingPackageName")]
-    MissingPackageName,
     #[error("GlobError")]
     GlobError,
     #[error("Invalid")]
@@ -344,7 +342,6 @@ impl Error {
             }
             Self::CorruptLockfile => "CorruptLockfile",
             Self::LockfileIsMissingResolutionData => "Lockfile is missing resolution data",
-            Self::MissingPackageName => "MissingPackageName",
             Self::GlobError => "GlobError",
             Self::Invalid => "Invalid",
             Self::LockfileValidationFailedListIsImpossiblyLong => {
diff --git a/src/install/lockfile/Package.rs b/src/install/lockfile/Package.rs
index 7ed38f1ac6e0..693755d72cf1 100644
--- a/src/install/lockfile/Package.rs
+++ b/src/install/lockfile/Package.rs
@@ -2477,6 +2477,8 @@ impl Package<u64> {
             }
         }
 
+        workspace_names.warn_skipped(log);
+
         if FEATURES.trusted_dependencies {
             parse_append_trusted_dependencies(
                 &mut lockfile.trusted_dependencies,
diff --git a/src/install/lockfile/Package/WorkspaceMap.rs b/src/install/lockfile/Package/WorkspaceMap.rs
index 2f2d415ccd4d..0e4b11077cb2 100644
--- a/src/install/lockfile/Package/WorkspaceMap.rs
+++ b/src/install/lockfile/Package/WorkspaceMap.rs
@@ -8,6 +8,7 @@ use bun_paths as path;
 use bun_paths::resolve_path;
 use bun_paths::{MAX_PATH_BYTES, PathBuffer, SEP_STR};
 
+use super::DependencyGroup;
 use crate::lockfile_real::{Lockfile, StringBuilder, pruned_workspaces};
 use crate::package_manager::workspace_package_json_cache::{
     GetJSONOptions, WorkspacePackageJSONCache,
@@ -17,6 +18,8 @@ bun_output::declare_scope!(Lockfile, hidden);
 
 pub(crate) struct WorkspaceMap {
     map: Map,
+    /// Relative dirs of nameless members that declare dependencies, for `warn_skipped`.
+    skipped_with_dependencies: Vec<Box<[u8]>>,
 }
 
 type Map = StringArrayHashMap<Entry>;
@@ -28,10 +31,52 @@ pub struct Entry {
     pub(crate) name_loc: bun_ast::Loc,
 }
 
+enum Scanned {
+    Workspace(Entry),
+    /// No usable `"name"`, so nothing to link or resolve it by; skipped, as pnpm and npm do.
+    Nameless {
+        declares_dependencies: bool,
+    },
+}
+
 impl WorkspaceMap {
     pub(crate) fn init() -> WorkspaceMap {
         WorkspaceMap {
             map: Map::default(),
+            skipped_with_dependencies: Vec::new(),
+        }
+    }
+
+    fn workspace_entry(&mut self, scanned: Scanned, relative_dir: &[u8]) -> Option<Entry> {
+        match scanned {
+            Scanned::Workspace(entry) => Some(entry),
+            Scanned::Nameless {
+                declares_dependencies,
+            } => {
+                // Overlapping patterns match the same directory more than once.
+                if declares_dependencies
+                    && !self
+                        .skipped_with_dependencies
+                        .iter()
+                        .any(|dir| **dir == *relative_dir)
+                {
+                    self.skipped_with_dependencies.push(relative_dir.into());
+                }
+                None
+            }
+        }
+    }
+
+    pub(crate) fn warn_skipped(&self, log: &mut bun_ast::Log) {
+        for dir in &self.skipped_with_dependencies {
+            log.add_warning_fmt(
+                None,
+                bun_ast::Loc::EMPTY,
+                format_args!(
+                    "Skipping workspace \"{}\": its package.json has no \"name\", so its dependencies will not be installed",
+                    BStr::new(dir)
+                ),
+            );
         }
     }
 
@@ -127,7 +172,7 @@ fn process_workspace_name(
     json_cache: &mut WorkspacePackageJSONCache,
     abs_package_json_path: &[u8],
     log: &mut bun_ast::Log,
-) -> crate::Result<Entry> {
+) -> crate::Result<Scanned> {
     let workspace_json = json_cache
         .get_with_path(
             log,
@@ -144,17 +189,32 @@ fn process_workspace_name(
     // results are immediately boxed so the bump can drop at scope exit.
     let scratch = Arena::new();
 
-    let name_expr = workspace_json
-        .root
-        .get(b"name")
-        .ok_or(crate::Error::MissingPackageName)?;
-    let name = name_expr
-        .as_string_cloned(&scratch)?
-        .ok_or(crate::Error::MissingPackageName)?;
+    let name = match workspace_json.root.get(b"name") {
+        Some(name_expr) => name_expr
+            .as_string_cloned(&scratch)?
+            .filter(|name| !name.is_empty())
+            .map(|name| (name, name_expr.loc)),
+        None => None,
+    };
+    let Some((name, name_loc)) = name else {
+        bun_output::scoped_log!(
+            Lockfile,
+            "processWorkspaceName({}) has no name, skipping",
+            BStr::new(abs_package_json_path)
+        );
+        return Ok(Scanned::Nameless {
+            declares_dependencies: DependencyGroup::FOUR.iter().any(|group| {
+                workspace_json
+                    .root
+                    .get(group.prop)
+                    .is_some_and(|deps| deps.property_count() > 0)
+            }),
+        });
+    };
 
     let entry = Entry {
         name: Box::<[u8]>::from(name),
-        name_loc: name_expr.loc,
+        name_loc,
         version: 'brk: {
             if let Some(version_expr) = workspace_json.root.get(b"version") {
                 if let Some(version) = version_expr.as_string_cloned(&scratch)? {
@@ -171,7 +231,7 @@ fn process_workspace_name(
         BStr::new(&entry.name)
     );
 
-    Ok(entry)
+    Ok(Scanned::Workspace(entry))
 }
 
 fn workspace_dir_of(abs_package_json_path: &[u8]) -> &[u8] {
@@ -265,12 +325,12 @@ impl WorkspaceMap {
                     }
 
                     process_workspace_name(json_cache, abs_package_json_path, log)
-                        .map(|entry| (abs_package_json_path, entry))
+                        .map(|scanned| (abs_package_json_path, scanned))
                 }
                 None => Err(crate::Error::Sys(bun_errno::SystemErrno::ENAMETOOLONG)),
             };
 
-            let (abs_package_json_path, workspace_entry) = match processed {
+            let (abs_package_json_path, scanned) = match processed {
                 Ok(processed) => processed,
                 Err(err) => {
                     if err == crate::Error::Sys(bun_errno::SystemErrno::ENOENT) {
@@ -302,15 +362,6 @@ impl WorkspaceMap {
                             arr.item_loc(source, i),
                             format_args!("Workspace not found \"{}\"", BStr::new(input_path)),
                         );
-                    } else if err == crate::Error::MissingPackageName {
-                        let _ = log.add_error_fmt(
-                            Some(source),
-                            loc,
-                            format_args!(
-                                "Missing \"name\" from package.json in {}",
-                                BStr::new(input_path)
-                            ),
-                        );
                     } else {
                         let mut cwd_buf = vec![0u8; MAX_PATH_BYTES];
                         let cwd_len = bun_sys::getcwd(&mut cwd_buf).expect("unreachable");
@@ -329,16 +380,17 @@ impl WorkspaceMap {
                 }
             };
 
-            if workspace_entry.name.len() == 0 {
-                continue;
-            }
-
             let rel_input_path = relative_workspace_path(
                 &mut rel_path_buf.0,
                 root_dir,
                 workspace_dir_of(abs_package_json_path),
             );
 
+            let Some(workspace_entry) = workspace_names.workspace_entry(scanned, rel_input_path)
+            else {
+                continue;
+            };
+
             if let Some(builder) = string_builder.as_deref_mut() {
                 builder.count(&workspace_entry.name);
                 builder.count(rel_input_path);
@@ -484,55 +536,44 @@ impl WorkspaceMap {
                     ) {
                         Some(abs_package_json_path) => {
                             process_workspace_name(json_cache, abs_package_json_path, log)
-                                .map(|entry| (abs_package_json_path, entry))
+                                .map(|scanned| (abs_package_json_path, scanned))
                         }
                         None => Err(crate::Error::Sys(bun_errno::SystemErrno::ENAMETOOLONG)),
                     };
 
-                    let (abs_package_json_path, workspace_entry) = match processed {
+                    let (abs_package_json_path, scanned) = match processed {
                         Ok(processed) => processed,
                         Err(err) => {
-                            let entry_base: &[u8] = path::basename(matched_path);
                             if err == crate::Error::Sys(bun_errno::SystemErrno::ENOENT) {
                                 continue;
-                            } else if err == crate::Error::MissingPackageName {
-                                let _ = log.add_error_fmt(
-                                    Some(source),
-                                    bun_ast::Loc::EMPTY,
-                                    format_args!(
-                                        "Missing \"name\" from package.json in {}{}{}",
-                                        BStr::new(entry_dir),
-                                        SEP_STR,
-                                        BStr::new(entry_base),
-                                    ),
-                                );
-                            } else {
-                                let _ = log.add_error_fmt(
-                                    Some(source),
-                                    bun_ast::Loc::EMPTY,
-                                    format_args!(
-                                        "{} reading package.json for workspace package \"{}\" from \"{}\"",
-                                        err.name(),
-                                        BStr::new(entry_dir),
-                                        BStr::new(entry_base),
-                                    ),
-                                );
                             }
-
+                            let entry_base: &[u8] = path::basename(matched_path);
+                            let _ = log.add_error_fmt(
+                                Some(source),
+                                bun_ast::Loc::EMPTY,
+                                format_args!(
+                                    "{} reading package.json for workspace package \"{}\" from \"{}\"",
+                                    err.name(),
+                                    BStr::new(entry_dir),
+                                    BStr::new(entry_base),
+                                ),
+                            );
                             continue;
                         }
                     };
 
-                    if workspace_entry.name.len() == 0 {
-                        continue;
-                    }
-
                     let workspace_path: &[u8] = relative_workspace_path(
                         &mut rel_path_buf.0,
                         root_dir,
                         workspace_dir_of(abs_package_json_path),
                     );
 
+                    let Some(workspace_entry) =
+                        workspace_names.workspace_entry(scanned, workspace_path)
+                    else {
+                        continue;
+                    };
+
                     if let Some(builder) = string_builder.as_deref_mut() {
                         builder.count(&workspace_entry.name);
                         builder.count(workspace_path);
diff --git a/src/install/migration.rs b/src/install/migration.rs
index 172b5661560d..777b2da8d0eb 100644
--- a/src/install/migration.rs
+++ b/src/install/migration.rs
@@ -131,11 +131,6 @@ pub fn detect_and_load_other_lockfile<'a>(
                                 "Relative link dependencies aren't supported yet. Please follow along at <magenta>https://github.com/oven-sh/bun/issues/23026<r>",
                             );
                         }
-                        MigratePnpmLockfileError::WorkspaceNameMissing => {
-                            bun_core::warn!(
-                                "pnpm-lock.yaml migration failed due to missing workspace name.",
-                            );
-                        }
                         MigratePnpmLockfileError::YamlParseError => {
                             bun_core::warn!("Failed to parse pnpm-lock.yaml.");
                         }
diff --git a/src/install/pnpm.rs b/src/install/pnpm.rs
index d07e53751b00..b24b6c025a04 100644
--- a/src/install/pnpm.rs
+++ b/src/install/pnpm.rs
@@ -381,8 +381,6 @@ pub enum MigratePnpmLockfileError {
     NonExistentWorkspaceDependency,
     #[error("RelativeLinkDependency")]
     RelativeLinkDependency,
-    #[error("WorkspaceNameMissing")]
-    WorkspaceNameMissing,
     #[error("PnpmLockfileNotObject")]
     PnpmLockfileNotObject,
     #[error("PnpmLockfileMissingVersion")]
@@ -783,9 +781,11 @@ pub(crate) fn migrate_pnpm_lockfile<'a>(
 
             let workspace_root = &importer_pkg_json.root;
 
-            let Some((name, _)) = get_string(workspace_root, b"name") else {
-                // we require workspace names.
-                return Err(MigratePnpmLockfileError::WorkspaceNameMissing);
+            // Nameless importers are skipped like `WorkspaceMap::process_workspace_name` skips them.
+            let Some((name, _)) =
+                get_string(workspace_root, b"name").filter(|(name, _)| !name.is_empty())
+            else {
+                continue;
             };
 
             let name_hash = semver::string::Builder::string_hash(name);
diff --git a/test/cli/install/bun-workspaces.test.ts b/test/cli/install/bun-workspaces.test.ts
index 12eb3842199f..f3472c2105d5 100644
--- a/test/cli/install/bun-workspaces.test.ts
+++ b/test/cli/install/bun-workspaces.test.ts
@@ -234,6 +234,96 @@ test.concurrent("allowing negative workspace patterns", async () => {
   });
 });
 
+// pnpm and npm accept workspace members whose package.json has no "name" (vite's
+// pnpm-workspace.yaml matches dozens of test fixtures shaped like `{"type":"module"}`).
+describe("workspace member package.json without a name", () => {
+  const skippedWarning =
+    'warn: Skipping workspace "packages/fixture": its package.json has no "name", so its dependencies will not be installed\n';
+
+  async function setupMonorepo(packageDir: string, workspaces: string[], fixturePackageJson: object) {
+    await Promise.all([
+      write(
+        join(packageDir, "package.json"),
+        JSON.stringify({
+          name: "root",
+          workspaces,
+          dependencies: {
+            pkg1: "workspace:*",
+          },
+        }),
+      ),
+      write(join(packageDir, "packages", "pkg1", "package.json"), JSON.stringify({ name: "pkg1", version: "1.0.0" })),
+      write(join(packageDir, "packages", "fixture", "package.json"), JSON.stringify(fixturePackageJson)),
+    ]);
+  }
+
+  async function expectFixtureSkipped(packageDir: string) {
+    expect(await file(join(packageDir, "node_modules", "pkg1", "package.json")).json()).toEqual({
+      name: "pkg1",
+      version: "1.0.0",
+    });
+    expect(await exists(join(packageDir, "node_modules", "fixture"))).toBeFalse();
+    const lockfile = await file(join(packageDir, "bun.lock")).text();
+    expect(lockfile).toContain('"packages/pkg1"');
+    expect(lockfile).not.toContain("packages/fixture");
+  }
+
+  const patterns = {
+    glob: ["packages/*"],
+    listed: ["packages/pkg1", "packages/fixture"],
+    // The fixture matches three times; it must still be warned about once.
+    overlapping: ["packages/fixture", "packages/*", "packages/**"],
+  };
+
+  for (const [kind, workspaces] of Object.entries(patterns)) {
+    test.concurrent(`is skipped (${kind})`, async () => {
+      using ctx = await setupTest();
+      const { packageDir, env } = ctx;
+      await setupMonorepo(packageDir, workspaces, { type: "module" });
+
+      // runBunInstall asserts nothing was warned about.
+      await runBunInstall(env, packageDir);
+      await expectFixtureSkipped(packageDir);
+    });
+
+    test.concurrent(`is skipped with a warning when it declares dependencies (${kind})`, async () => {
+      using ctx = await setupTest();
+      const { packageDir, env } = ctx;
+      // Resolving this dependency would fail the install, so a successful install
+      // proves the fixture's dependencies were never looked at.
+      await setupMonorepo(packageDir, workspaces, { devDependencies: { "doesnt-exist-oops": "1.2.3" } });
+
+      const { err } = await runBunInstall(env, packageDir, { allowWarnings: true });
+      expect(err).toContain(skippedWarning);
+      expect(err.split(skippedWarning)).toHaveLength(2);
+      await expectFixtureSkipped(packageDir);
+    });
+  }
+
+  test.concurrent("an empty name counts as no name", async () => {
+    using ctx = await setupTest();
+    const { packageDir, env } = ctx;
+    await setupMonorepo(packageDir, patterns.glob, { name: "", dependencies: { "doesnt-exist-oops": "1.2.3" } });
+
+    const { err } = await runBunInstall(env, packageDir, { allowWarnings: true });
+    expect(err).toContain(skippedWarning);
+    await expectFixtureSkipped(packageDir);
+  });
+
+  test.concurrent("does not stop a member from finding the workspace root", async () => {
+    using ctx = await setupTest();
+    const { packageDir, env } = ctx;
+    await setupMonorepo(packageDir, patterns.glob, { dependencies: { "doesnt-exist-oops": "1.2.3" } });
+
+    const { err } = await runBunInstall(env, join(packageDir, "packages", "pkg1"), { allowWarnings: true });
+
+    expect(await exists(join(packageDir, "packages", "pkg1", "bun.lock"))).toBeFalse();
+    // Both the root lookup and the root package.json parse scan the workspaces; only the latter warns.
+    expect(err.split(skippedWarning)).toHaveLength(2);
+    await expectFixtureSkipped(packageDir);
+  });
+});
+
 test("dependency on same name as workspace and dist-tag", async () => {
   using ctx = await setupTest();
   const { packageDir, env } = ctx;
diff --git a/test/cli/install/migration/__snapshots__/migrate.test.ts.snap b/test/cli/install/migration/__snapshots__/migrate.test.ts.snap
index f9fcf6b9b15f..480bd63020ba 100644
--- a/test/cli/install/migration/__snapshots__/migrate.test.ts.snap
+++ b/test/cli/install/migration/__snapshots__/migrate.test.ts.snap
@@ -4660,8 +4660,26 @@ bun install --frozen-lockfile exit code: 0
 `;
 
 exports[`package-lock.json migration fixes arborist fixtures workspaces-need-update 1`] = `
-"error: failed to migrate lockfile: InstallFailed
-bun pm migrate exit code: 1"
+"warn: skipped 4 package-lock.json entries not depended on by any package: "a", "b", "node_modules/once", "node_modules/wrappy"
+migrated lockfile from package-lock.json
+bun pm migrate exit code: 0
+bun install --frozen-lockfile exit code: 0
+
+{
+  "lockfileVersion": 2,
+  "configVersion": 1,
+  "workspaces": {
+    "": {
+      "dependencies": {
+        "abbrev": "^1.0.4",
+      },
+    },
+  },
+  "packages": {
+    "abbrev": ["abbrev@1.0.4", "", {}, "sha1-vVWuXkE7oXIu5Mq6H26hBBSlns0="],
+  }
+}
+"
 `;
 
 exports[`package-lock.json migration fixes arborist fixtures workspaces-non-simplistic 1`] = `
diff --git a/test/cli/install/migration/npm-arborist/README.md b/test/cli/install/migration/npm-arborist/README.md
index 8e3f17dc5c94..a05d240dcc0d 100644
--- a/test/cli/install/migration/npm-arborist/README.md
+++ b/test/cli/install/migration/npm-arborist/README.md
@@ -53,7 +53,7 @@ Each directory holds only what a `package-lock.json -> bun.lock` migration reads
 - `workspaces-add-new-dep` (v2, workspaces) - single workspace `a` at the fixture root, no registry deps
 - `workspaces-conflicting-versions-virtual` (v2, workspaces) - two workspaces pinning different versions of the root's dep, nested under each workspace
 - `workspaces-ignore-nm-virtual` (v2, workspaces) - workspaces glob `packages/**`
-- `workspaces-need-update` (v2, workspaces) - workspaces a/b whose package.json files have no `name` (Bun rejects nameless workspaces)
+- `workspaces-need-update` (v2, workspaces) - workspaces a/b whose package.json files have no `name` (Bun skips nameless workspaces, so only the root's deps migrate)
 - `workspaces-non-simplistic` (v2, workspaces) - workspace with a scoped transitive dep chain, minified lockfile, root devDependencies
 - `workspaces-not-root` (v2, workspaces) - three workspaces sharing hoisted registry deps, `""` specs, root package.json without a name
 - `workspaces-prefer-linking-virtual` (v2, workspaces) - workspace named `abbrev` satisfying another workspace's `abbrev` dep
diff --git a/test/cli/install/migration/npm-arborist/fixtures.json b/test/cli/install/migration/npm-arborist/fixtures.json
index 7f9dd08de44c..47f1a43ef1de 100644
--- a/test/cli/install/migration/npm-arborist/fixtures.json
+++ b/test/cli/install/migration/npm-arborist/fixtures.json
@@ -335,7 +335,7 @@
     "lockfile": "package-lock.json",
     "lockfileVersion": 2,
     "workspaces": true,
-    "notes": "workspaces a/b whose package.json files have no `name` (Bun rejects nameless workspaces)"
+    "notes": "workspaces a/b whose package.json files have no `name` (Bun skips nameless workspaces, so only the root's deps migrate)"
   },
   {
     "name": "workspaces-non-simplistic",
diff --git a/test/cli/install/migration/pnpm-lock-v9.test.ts b/test/cli/install/migration/pnpm-lock-v9.test.ts
index f7a607a631d8..c2ecac6f9aba 100644
--- a/test/cli/install/migration/pnpm-lock-v9.test.ts
+++ b/test/cli/install/migration/pnpm-lock-v9.test.ts
@@ -261,6 +261,111 @@ describe("pnpm-lock.yaml v9", () => {
     expect(existsSync(join(String(dir), "bun.lock"))).toBe(false);
   });
 
+  // pnpm lists every directory matched by pnpm-workspace.yaml as an importer, including
+  // test fixtures whose package.json has no "name" (vite has dozens). Those are not
+  // workspace packages to bun; the migration and the later workspace scan both skip them.
+  describe("importer whose package.json has no name", () => {
+    const fixtureDir = "packages/a/__tests__/fixtures/esm";
+    const files = {
+      "package.json": JSON.stringify({
+        name: "nameless-importer-root",
+        private: true,
+        dependencies: { a: "workspace:*" },
+      }),
+      "pnpm-workspace.yaml": "packages:\n  - 'packages/*'\n  - 'packages/**/__tests__/**'\n",
+      "packages/a/package.json": JSON.stringify({ name: "a" }),
+    };
+    const rootImporter = `lockfileVersion: '9.0'
+
+importers:
+
+  .:
+    dependencies:
+      a:
+        specifier: workspace:*
+        version: link:packages/a
+
+  packages/a: {}
+`;
+
+    async function migrateThenFrozenInstall(dir: string) {
+      const { stderr, exitCode } = await migrate(dir);
+      expect(stderr).toContain("moved pnpm-workspace.yaml to workspaces in package.json");
+      expect(stderr).toContain("migrated lockfile from pnpm-lock.yaml");
+      expect(stderr).not.toContain("warn:");
+      expect(exitCode).toBe(0);
+
+      const migrated = await bunLockOf(dir);
+      expect(workspacesSection(migrated)).toBe(`  "workspaces": {
+    "": {
+      "name": "nameless-importer-root",
+      "dependencies": {
+        "a": "workspace:*",
+      },
+    },
+    "packages/a": {
+      "name": "a",
+    },
+  },
+`);
+      expect((await Bun.file(join(dir, "package.json")).json()).workspaces).toStrictEqual([
+        "packages/*",
+        "packages/**/__tests__/**",
+      ]);
+
+      // The migrated package.json now matches the fixture through the glob; the
+      // workspace scan has to agree with the migration for a frozen install to pass.
+      const install = await run(dir, "install", "--frozen-lockfile", "--linker", "hoisted");
+      expect(install.stderr).not.toContain("error:");
+      expect(install.exitCode).toBe(0);
+      expect(await bunLockOf(dir)).toBe(migrated);
+      expect(await installedPackageJson(dir, "", "a")).toStrictEqual({ name: "a" });
+      return { migrated, install };
+    }
+
+    test.concurrent("is skipped", async () => {
+      using dir = tempDir("pnpm-v9-nameless-importer", {
+        ...files,
+        [`${fixtureDir}/package.json`]: JSON.stringify({ type: "module" }),
+        "pnpm-lock.yaml": `${rootImporter}
+  ${fixtureDir}: {}
+`,
+      });
+
+      const { install } = await migrateThenFrozenInstall(String(dir));
+      expect(install.stderr).not.toContain("warn:");
+    });
+
+    test.concurrent("its dependencies are not migrated, and bun install warns about them", async () => {
+      using dir = tempDir("pnpm-v9-nameless-importer-with-deps", {
+        ...files,
+        [`${fixtureDir}/package.json`]: JSON.stringify({ type: "module", dependencies: { "no-deps": "^1.0.0" } }),
+        "pnpm-lock.yaml": `${rootImporter}
+  ${fixtureDir}:
+    dependencies:
+      no-deps:
+        specifier: ^1.0.0
+        version: 1.0.1
+
+packages:
+
+  no-deps@1.0.1:
+    resolution: {integrity: ${NO_DEPS_1_0_1_INTEGRITY}}
+
+snapshots:
+
+  no-deps@1.0.1: {}
+`,
+      });
+
+      const { migrated, install } = await migrateThenFrozenInstall(String(dir));
+      expect(migrated).not.toContain("no-deps");
+      expect(install.stderr).toContain(
+        `warn: Skipping workspace "${fixtureDir}": its package.json has no "name", so its dependencies will not be installed\n`,
+      );
+    });
+  });
+
   test("registry-qualified dep path resolves from the configured registry with a warning", async () => {
     // shape from pnpm11/deps/path/test/index.ts parse() `foo@work:1.0.0`
     const { packageDir } = await verdaccio.createTestDir({

From 14d05929c138091c892a624cb31298f65067e3bf Mon Sep 17 00:00:00 2001
From: robobun <117481402+robobun@users.noreply.github.com>
Date: Mon, 17 Aug 2026 01:52:04 +0000
Subject: [PATCH 127/258] install: migrate pnpm importer rows in the shape
 package.json parsing produces (#38791)

---
 docs/pm/cli/install.mdx                       |   1 +
 src/install/lockfile/bun.lock.rs              |  19 +-
 src/install/pnpm.rs                           |  83 ++---
 .../pnpm-lock-migration.test.ts.snap          |   3 +
 .../pnpm-migration-complete.test.ts.snap      |   7 +-
 .../install/migration/pnpm-lock-v9.test.ts    | 288 ++++++++++++++++++
 .../migration/pnpm-migration-complete.test.ts |   6 +-
 7 files changed, 356 insertions(+), 51 deletions(-)

diff --git a/docs/pm/cli/install.mdx b/docs/pm/cli/install.mdx
index 3bec9f4b0a31..d5128bf6b837 100644
--- a/docs/pm/cli/install.mdx
+++ b/docs/pm/cli/install.mdx
@@ -535,6 +535,7 @@ The migration process handles:
 - Preserves resolved versions and integrity hashes
 - Preserves peer dependency ranges and `peerDependenciesMeta`, so the next `bun install` leaves the migrated lockfile unchanged
 - Writes every catalog entry declared in `pnpm-workspace.yaml` to `bun.lock`, including entries no workspace uses yet (`pnpm-lock.yaml` lists only the entries in use), so the next `bun install` leaves the catalog unchanged
+- Keeps `catalog:` and `workspace:` specifiers as written and records each workspace package's version, so `bun install --frozen-lockfile` accepts the migrated lockfile and the versions pnpm locked for each workspace are the ones installed
 - Migrates git, GitHub, tarball URL, `file:`, and `npm:` alias dependencies, including transitive ones
 - Resolves pnpm named registries (`name@registry:version`) via `namedRegistries` in `pnpm-workspace.yaml`
 - Converts injected workspace packages (`dependenciesMeta.*.injected`) to ordinary workspace dependencies
diff --git a/src/install/lockfile/bun.lock.rs b/src/install/lockfile/bun.lock.rs
index fb63557d3aea..d7134a241693 100644
--- a/src/install/lockfile/bun.lock.rs
+++ b/src/install/lockfile/bun.lock.rs
@@ -3567,10 +3567,7 @@ fn map_dep_to_pkg(
     resolutions[dep_id as usize] = pkg_id;
 
     if text_lockfile_version != Version::V0 {
-        let res = &pkg_resolutions[pkg_id as usize];
-        if res.tag == ResolutionTag::Workspace {
-            link_dep_to_workspace(dep, res);
-        }
+        adopt_workspace_resolution(dep, &pkg_resolutions[pkg_id as usize]);
     }
 }
 
@@ -3596,7 +3593,7 @@ fn map_manifest_dep_to_pkg(
 
     let res = &pkg_resolutions[pkg_id as usize];
     if res.tag == ResolutionTag::Workspace && workspace_links.links(dep, pkg_id) {
-        link_dep_to_workspace(dep, res);
+        adopt_workspace_resolution(dep, res);
     }
 }
 
@@ -3664,8 +3661,16 @@ impl WorkspaceLinks<'_> {
     }
 }
 
-fn link_dep_to_workspace(dep: &mut Dependency, res: &Resolution) {
-    // Whole-struct assign so `DependencyVersion::Drop` frees any prior npm chain.
+/// An edge bound to a workspace member takes the shape `Package::parse_dependency`
+/// gives it (`workspace` tag carrying the member's path, literal kept), so the
+/// differ compares equal against a fresh package.json parse. Other targets leave
+/// the edge as parsed.
+pub(crate) fn adopt_workspace_resolution(dep: &mut Dependency, res: &Resolution) {
+    if res.tag != ResolutionTag::Workspace {
+        return;
+    }
+    // Whole-struct assign so `DependencyVersion::Drop` frees any prior
+    // npm chain. SAFETY: `res.tag == Workspace` checked above.
     let literal = dep.version.literal;
     dep.version = DependencyVersion {
         tag: DependencyVersionTag::Workspace,
diff --git a/src/install/pnpm.rs b/src/install/pnpm.rs
index b24b6c025a04..53d88d441ff8 100644
--- a/src/install/pnpm.rs
+++ b/src/install/pnpm.rs
@@ -8,6 +8,7 @@ use bun_collections::StringArrayHashMap;
 use bun_ast::{self, self as js_ast, E, Expr, ExprData, G};
 use bun_core::{Global, Output, strings};
 use bun_semver as semver;
+use bun_semver::query::token::Wildcard;
 use bun_semver::{ExternalString, String};
 use bun_sys::{self as sys, Fd};
 
@@ -46,6 +47,21 @@ macro_rules! string_bytes {
     };
 }
 
+// Binds a root or workspace edge the way bun.lock's reader does. `workspace:*` rows and ranges
+// pnpm linked to a member arrive here parsed from their literal, while the package.json rows the
+// differ compares them against carry the member's path. A macro so callers can keep slices of
+// `string_bytes` alive across the call.
+macro_rules! bind_importer_dependency {
+    ($lockfile:expr, $dep_id:expr, $pkg_id:expr) => {{
+        let pkg_id: PackageID = $pkg_id;
+        $lockfile.buffers.resolutions[$dep_id as usize] = pkg_id;
+        lockfile::bun_lock::adopt_workspace_resolution(
+            &mut $lockfile.buffers.dependencies[$dep_id as usize],
+            &$lockfile.packages.items_resolution()[pkg_id as usize],
+        );
+    }};
+}
+
 /// returns (peers_index, patch_hash_index)
 /// https://github.com/pnpm/pnpm/blob/102d5a01ddabda1184b88119adccfbe956d30579/packages/dependency-path/src/index.ts#L9-L31
 fn index_of_dep_path_suffix(path: &[u8]) -> (Option<usize>, Option<usize>) {
@@ -793,20 +809,16 @@ pub(crate) fn migrate_pnpm_lockfile<'a>(
             let path_str = sbuf!(lockfile).append(importer_path)?;
             lockfile.workspace_paths.put(name_hash, path_str)?;
 
-            if let Some(version_expr) = value.get(b"version") {
-                let Some(version_raw) = as_string(&version_expr) else {
-                    return Err(invalid_pnpm_lockfile());
-                };
+            // Same rule as the `workspaces` array parser: a version that does not parse, or has a
+            // wildcard, leaves the member unversioned.
+            if let Some((version_raw, _)) = get_string(workspace_root, b"version") {
                 let version_str = sbuf!(lockfile).append(version_raw)?;
-
                 let parsed = semver::Version::parse(version_str.sliced(string_bytes!(lockfile)));
-                if !parsed.valid {
-                    return Err(invalid_pnpm_lockfile());
+                if parsed.valid && parsed.wildcard == Wildcard::None {
+                    lockfile
+                        .workspace_versions
+                        .put(name_hash, parsed.version.min())?;
                 }
-
-                lockfile
-                    .workspace_versions
-                    .put(name_hash, parsed.version.min())?;
             }
         }
 
@@ -1453,14 +1465,14 @@ pub(crate) fn migrate_pnpm_lockfile<'a>(
                 let mut path_buf = bun_paths::AutoAbsPath::init_top_level_dir();
                 let _ = path_buf.join(&[workspace_path]); // path-buffer overflow unreachable for bounded inputs
                 if let Some(workspace_pkg_id) = pkg_map.get(path_buf.slice()) {
-                    lockfile.buffers.resolutions[dep_id as usize] = *workspace_pkg_id;
+                    bind_importer_dependency!(lockfile, dep_id, *workspace_pkg_id);
                     continue;
                 }
             }
 
             let dep_name = dep.name.slice(string_buf);
             if let Some(peer_pkg_id) = resolve_peer_like_bun_lock(lockfile, &dep) {
-                lockfile.buffers.resolutions[dep_id as usize] = peer_pkg_id;
+                bind_importer_dependency!(lockfile, dep_id, peer_pkg_id);
                 continue;
             }
             let Some(mut version_maybe_alias) = importer_versions.get(dep_name).map(|v| &**v)
@@ -1489,7 +1501,7 @@ pub(crate) fn migrate_pnpm_lockfile<'a>(
                 let mut path_buf = bun_paths::AutoAbsPath::init_top_level_dir();
                 let _ = path_buf.join(&[maybe_symlink_or_folder_or_workspace_path]); // path-buffer overflow unreachable for bounded inputs
                 if let Some(pkg_id) = pkg_map.get(path_buf.slice()) {
-                    lockfile.buffers.resolutions[dep_id as usize] = *pkg_id;
+                    bind_importer_dependency!(lockfile, dep_id, *pkg_id);
                     continue;
                 }
             }
@@ -1505,7 +1517,7 @@ pub(crate) fn migrate_pnpm_lockfile<'a>(
                 ));
             };
 
-            lockfile.buffers.resolutions[dep_id as usize] = *pkg_id;
+            bind_importer_dependency!(lockfile, dep_id, *pkg_id);
         }
     }
 
@@ -1527,7 +1539,7 @@ pub(crate) fn migrate_pnpm_lockfile<'a>(
             let string_buf = string_bytes!(lockfile);
             let dep_name = dep.name.slice(string_buf);
             if let Some(peer_pkg_id) = resolve_peer_like_bun_lock(lockfile, &dep) {
-                lockfile.buffers.resolutions[dep_id as usize] = peer_pkg_id;
+                bind_importer_dependency!(lockfile, dep_id, peer_pkg_id);
                 continue;
             }
             let Some(mut version_maybe_alias) = importer_versions.get(dep_name).map(|v| &**v)
@@ -1557,7 +1569,7 @@ pub(crate) fn migrate_pnpm_lockfile<'a>(
                 let mut path_buf = bun_paths::AutoAbsPath::init_top_level_dir();
                 let _ = path_buf.join(&[workspace_path, maybe_symlink_or_folder_or_workspace_path]); // path-buffer overflow unreachable for bounded inputs
                 if let Some(link_pkg_id) = pkg_map.get(path_buf.slice()) {
-                    lockfile.buffers.resolutions[dep_id as usize] = *link_pkg_id;
+                    bind_importer_dependency!(lockfile, dep_id, *link_pkg_id);
                     continue;
                 }
             }
@@ -1573,7 +1585,7 @@ pub(crate) fn migrate_pnpm_lockfile<'a>(
                 ));
             };
 
-            lockfile.buffers.resolutions[dep_id as usize] = *res_pkg_id;
+            bind_importer_dependency!(lockfile, dep_id, *res_pkg_id);
         }
     }
 
@@ -2039,36 +2051,29 @@ fn append_importer_dependency(
     specifier_str: &[u8],
     behavior: dependency::Behavior,
 ) -> Result<(), ParseAppendDependenciesError> {
-    if strings::has_prefix(specifier_str, b"catalog:") {
-        let name_hash = semver::string::Builder::string_hash(name_str);
-        let name = sbuf!(lockfile).append_external_with_hash(name_str, name_hash)?;
-        let mut catalog_group_name_str = specifier_str[b"catalog:".len()..].trim_ascii();
-        if catalog_group_name_str == b"default" {
-            catalog_group_name_str = b"";
-        }
-        let catalog_group_name = sbuf!(lockfile).append(catalog_group_name_str)?;
-        // `CatalogMap::get` borrows `&self` and the whole lockfile, so move catalogs out for the call.
-        let catalogs = core::mem::take(&mut lockfile.catalogs);
-        let dep_result = catalogs.get(lockfile, catalog_group_name, name.value);
-        lockfile.catalogs = catalogs;
-        let Some(mut dep) = dep_result else {
-            // catalog is missing an entry in the "catalogs" object in the lockfile
+    // The row keeps its `catalog:` reference, as the package.json parser and the bun.lock reader
+    // keep theirs; the importer's own `version:` field binds it below. Only the entry's existence
+    // is checked here.
+    if let Some(catalog_name) =
+        strings::without_prefix_if_possible_comptime(specifier_str, b"catalog:")
+    {
+        let catalog_name = catalog_name.trim_ascii();
+        if lockfile
+            .catalogs
+            .find(string_bytes!(lockfile), catalog_name, name_str)
+            .is_none()
+        {
             log.add_error_fmt(
                 None,
                 bun_ast::Loc::EMPTY,
                 format_args!(
                     "pnpm-lock.yaml catalog '{}' missing entry for dependency '{}'",
-                    bstr::BStr::new(specifier_str[b"catalog:".len()..].trim_ascii()),
+                    bstr::BStr::new(catalog_name),
                     bstr::BStr::new(name_str)
                 ),
             );
             return Err(ParseAppendDependenciesError::PnpmLockfileMissingCatalogEntry);
-        };
-
-        dep.behavior = behavior;
-
-        lockfile.buffers.dependencies.push(dep);
-        return Ok(());
+        }
     }
 
     append_manifest_dependency(lockfile, log, name_str, specifier_str, behavior)
diff --git a/test/cli/install/migration/__snapshots__/pnpm-lock-migration.test.ts.snap b/test/cli/install/migration/__snapshots__/pnpm-lock-migration.test.ts.snap
index 2154f3eaae71..7cc771fec2b1 100644
--- a/test/cli/install/migration/__snapshots__/pnpm-lock-migration.test.ts.snap
+++ b/test/cli/install/migration/__snapshots__/pnpm-lock-migration.test.ts.snap
@@ -32,6 +32,7 @@ exports[`pnpm-lock.yaml migration pnpm workspace lockfile migration: workspace-p
     },
     "apps/web": {
       "name": "@repo/web",
+      "version": "1.0.0",
       "dependencies": {
         "@repo/ui": "workspace:*",
         "@repo/utils": "workspace:*",
@@ -40,12 +41,14 @@ exports[`pnpm-lock.yaml migration pnpm workspace lockfile migration: workspace-p
     },
     "packages/ui": {
       "name": "@repo/ui",
+      "version": "1.0.0",
       "dependencies": {
         "react": "^18.2.0",
       },
     },
     "packages/utils": {
       "name": "@repo/utils",
+      "version": "1.0.0",
       "dependencies": {
         "lodash": "^4.17.21",
       },
diff --git a/test/cli/install/migration/__snapshots__/pnpm-migration-complete.test.ts.snap b/test/cli/install/migration/__snapshots__/pnpm-migration-complete.test.ts.snap
index 3b5814f568c5..6d33b2910485 100644
--- a/test/cli/install/migration/__snapshots__/pnpm-migration-complete.test.ts.snap
+++ b/test/cli/install/migration/__snapshots__/pnpm-migration-complete.test.ts.snap
@@ -248,8 +248,8 @@ exports[`PNPM Migration Complete Test Suite comprehensive PNPM migration with al
     "": {
       "name": "catalogs-test",
       "dependencies": {
-        "lodash": "4.17.21",
-        "react": "18.2.0",
+        "lodash": "catalog:tools",
+        "react": "catalog:",
       },
     },
   },
@@ -365,6 +365,7 @@ exports[`PNPM Migration Complete Test Suite comprehensive PNPM migration with al
     },
     "packages/pkg1": {
       "name": "@workspace/pkg1",
+      "version": "1.0.0",
       "dependencies": {
         "@workspace/pkg2": "workspace:*",
         "lodash": "^4.17.21",
@@ -372,12 +373,14 @@ exports[`PNPM Migration Complete Test Suite comprehensive PNPM migration with al
     },
     "packages/pkg2": {
       "name": "@workspace/pkg2",
+      "version": "1.0.0",
       "dependencies": {
         "@workspace/pkg3": "workspace:*",
       },
     },
     "packages/pkg3": {
       "name": "@workspace/pkg3",
+      "version": "1.0.0",
       "dependencies": {
         "@workspace/pkg1": "workspace:*",
       },
diff --git a/test/cli/install/migration/pnpm-lock-v9.test.ts b/test/cli/install/migration/pnpm-lock-v9.test.ts
index c2ecac6f9aba..22e7b40fc17b 100644
--- a/test/cli/install/migration/pnpm-lock-v9.test.ts
+++ b/test/cli/install/migration/pnpm-lock-v9.test.ts
@@ -3640,6 +3640,294 @@ catalog:
     expect(await bunLockOf(String(formatted))).toBe(await bunLockOf(String(plain)));
   });
 
+  // The install after a migration diffs each importer's rows against a fresh package.json parse. A row
+  // in a different shape re-resolves the whole importer, and a range with two versions in the lockfile
+  // then moves: below, the members lock `no-deps` at 1.0.0 while `one-dep` brings in 1.0.1.
+  describe("importer rows match a package.json parse", () => {
+    const catalogFiles = {
+      "pnpm-workspace.yaml": `packages:
+  - packages/*
+
+catalog:
+  a-dep: ^1.0.1
+
+catalogs:
+  tooling:
+    one-dep: ^1.0.0
+`,
+      "package.json": JSON.stringify({
+        name: "catalog-rows",
+        private: true,
+        devDependencies: { "one-dep": "catalog:tooling" },
+      }),
+      "packages/app/package.json": JSON.stringify({
+        name: "app",
+        version: "1.0.0",
+        dependencies: { "a-dep": "catalog:", "no-deps": "^1.0.0" },
+      }),
+      "pnpm-lock.yaml": `lockfileVersion: '9.0'
+
+catalogs:
+  default:
+    a-dep:
+      specifier: ^1.0.1
+      version: 1.0.1
+  tooling:
+    one-dep:
+      specifier: ^1.0.0
+      version: 1.0.0
+
+importers:
+
+  .:
+    devDependencies:
+      one-dep:
+        specifier: catalog:tooling
+        version: 1.0.0
+
+  packages/app:
+    dependencies:
+      a-dep:
+        specifier: 'catalog:'
+        version: 1.0.1
+      no-deps:
+        specifier: ^1.0.0
+        version: 1.0.0
+
+packages:
+
+  a-dep@1.0.1:
+    resolution: {integrity: ${A_DEP_1_0_1_INTEGRITY}}
+
+  no-deps@1.0.0:
+    resolution: {integrity: ${NO_DEPS_1_0_0_INTEGRITY}}
+
+  no-deps@1.0.1:
+    resolution: {integrity: ${NO_DEPS_1_0_1_INTEGRITY}}
+
+  one-dep@1.0.0:
+    resolution: {integrity: ${ONE_DEP_1_0_0_INTEGRITY}}
+
+snapshots:
+
+  a-dep@1.0.1: {}
+
+  no-deps@1.0.0: {}
+
+  no-deps@1.0.1: {}
+
+  one-dep@1.0.0:
+    dependencies:
+      no-deps: 1.0.1
+`,
+    };
+
+    const workspaceRowFiles = {
+      "pnpm-workspace.yaml": `packages:
+  - packages/*
+`,
+      "package.json": JSON.stringify({
+        name: "workspace-rows",
+        private: true,
+        devDependencies: { "one-dep": "^1.0.0" },
+      }),
+      "packages/lib/package.json": JSON.stringify({ name: "lib", version: "1.2.3" }),
+      "packages/app/package.json": JSON.stringify({
+        name: "app",
+        version: "1.0.0",
+        dependencies: { lib: "workspace:*", "no-deps": "^1.0.0" },
+      }),
+      // link-workspace-packages shape: a plain range pnpm linked to the member; the version is not semver
+      "packages/cli/package.json": JSON.stringify({
+        name: "cli",
+        version: "unversioned",
+        dependencies: { lib: "^1.0.0", "no-deps": "^1.0.0" },
+      }),
+      "pnpm-lock.yaml": `lockfileVersion: '9.0'
+
+importers:
+
+  .:
+    devDependencies:
+      one-dep:
+        specifier: ^1.0.0
+        version: 1.0.0
+
+  packages/app:
+    dependencies:
+      lib:
+        specifier: workspace:*
+        version: link:../lib
+      no-deps:
+        specifier: ^1.0.0
+        version: 1.0.0
+
+  packages/cli:
+    dependencies:
+      lib:
+        specifier: ^1.0.0
+        version: link:../lib
+      no-deps:
+        specifier: ^1.0.0
+        version: 1.0.0
+
+  packages/lib: {}
+
+packages:
+
+  no-deps@1.0.0:
+    resolution: {integrity: ${NO_DEPS_1_0_0_INTEGRITY}}
+
+  no-deps@1.0.1:
+    resolution: {integrity: ${NO_DEPS_1_0_1_INTEGRITY}}
+
+  one-dep@1.0.0:
+    resolution: {integrity: ${ONE_DEP_1_0_0_INTEGRITY}}
+
+snapshots:
+
+  no-deps@1.0.0: {}
+
+  no-deps@1.0.1: {}
+
+  one-dep@1.0.0:
+    dependencies:
+      no-deps: 1.0.1
+`,
+    };
+
+    const noDeps100 = { name: "no-deps", version: "1.0.0" };
+
+    // `bun install` on a pnpm checkout migrates in-process and installs from the migrated rows directly.
+    async function installStraightFromPnpmLock(files: Record<string, string>) {
+      const { packageDir: viaMigrate } = await verdaccio.createTestDir({ bunfigOpts: { linker: "hoisted" }, files });
+      const { packageDir: viaInstall } = await verdaccio.createTestDir({ bunfigOpts: { linker: "hoisted" }, files });
+
+      const [migrated, install] = await Promise.all([migrate(viaMigrate), run(viaInstall, "install")]);
+
+      expect(migrated.stderr).toContain("migrated lockfile from pnpm-lock.yaml");
+      expect(migrated.exitCode).toBe(0);
+      expect(install.stderr).toContain("migrated lockfile from pnpm-lock.yaml");
+      expect(install.stderr).not.toContain("error:");
+      expect(install.exitCode).toBe(0);
+      expect(await bunLockOf(viaInstall)).toBe(await bunLockOf(viaMigrate));
+
+      return viaInstall;
+    }
+
+    test("catalog: rows keep the reference and a frozen install accepts bun pm migrate's lockfile", async () => {
+      const { packageDir } = await verdaccio.createTestDir({ bunfigOpts: { linker: "hoisted" }, files: catalogFiles });
+
+      const { stderr, exitCode } = await migrate(packageDir);
+
+      expect(stderr).toContain("migrated lockfile from pnpm-lock.yaml");
+      expect(exitCode).toBe(0);
+
+      const migrated = await bunLockOf(packageDir);
+      expect(workspacesSection(migrated)).toMatchInlineSnapshot(`
+        "  "workspaces": {
+            "": {
+              "name": "catalog-rows",
+              "devDependencies": {
+                "one-dep": "catalog:tooling",
+              },
+            },
+            "packages/app": {
+              "name": "app",
+              "version": "1.0.0",
+              "dependencies": {
+                "a-dep": "catalog:",
+                "no-deps": "^1.0.0",
+              },
+            },
+          },
+          "catalog": {
+            "a-dep": "^1.0.1",
+          },
+          "catalogs": {
+            "tooling": {
+              "one-dep": "^1.0.0",
+            },
+          },
+        "
+      `);
+
+      const install = await run(packageDir, "install", "--frozen-lockfile");
+
+      expect(install.stderr).not.toContain("error:");
+      expect(install.exitCode).toBe(0);
+      expect(await bunLockOf(packageDir)).toBe(migrated);
+      expect(await installedPackageJson(packageDir, "packages/app", "no-deps")).toStrictEqual(noDeps100);
+    });
+
+    test("bun install straight from pnpm-lock.yaml keeps the versions locked for a catalog: user", async () => {
+      const dir = await installStraightFromPnpmLock(catalogFiles);
+
+      expect(await installedPackageJson(dir, "packages/app", "no-deps")).toStrictEqual(noDeps100);
+      expect(await installedPackageJson(dir, "packages/app", "a-dep")).toStrictEqual({
+        name: "a-dep",
+        version: "1.0.1",
+      });
+    });
+
+    test("workspace: and linked rows keep their specifiers; members get their package.json version", async () => {
+      const { packageDir } = await verdaccio.createTestDir({
+        bunfigOpts: { linker: "hoisted" },
+        files: workspaceRowFiles,
+      });
+
+      const { stderr, exitCode } = await migrate(packageDir);
+
+      expect(stderr).toContain("migrated lockfile from pnpm-lock.yaml");
+      expect(exitCode).toBe(0);
+
+      const bunLock = await bunLockOf(packageDir);
+      expect(workspacesSection(bunLock)).toMatchInlineSnapshot(`
+        "  "workspaces": {
+            "": {
+              "name": "workspace-rows",
+              "devDependencies": {
+                "one-dep": "^1.0.0",
+              },
+            },
+            "packages/app": {
+              "name": "app",
+              "version": "1.0.0",
+              "dependencies": {
+                "lib": "workspace:*",
+                "no-deps": "^1.0.0",
+              },
+            },
+            "packages/cli": {
+              "name": "cli",
+              "dependencies": {
+                "lib": "^1.0.0",
+                "no-deps": "^1.0.0",
+              },
+            },
+            "packages/lib": {
+              "name": "lib",
+              "version": "1.2.3",
+            },
+          },
+        "
+      `);
+      expect(bunLock).toContain(`"lib": ["lib@workspace:packages/lib"]`);
+      expect(bunLock).toContain(`"no-deps@1.0.0"`);
+      expect(bunLock).toContain(`"no-deps@1.0.1"`);
+      expect(bunLock).not.toContain("link:");
+    });
+
+    test("bun install straight from pnpm-lock.yaml keeps the versions locked for workspace: and linked users", async () => {
+      const dir = await installStraightFromPnpmLock(workspaceRowFiles);
+
+      for (const member of ["packages/app", "packages/cli"]) {
+        expect(await installedPackageJson(dir, member, "no-deps")).toStrictEqual(noDeps100);
+        expect(await installedPackageJson(dir, member, "lib")).toStrictEqual({ name: "lib", version: "1.2.3" });
+      }
+    });
+  });
+
   describe("catalogs", () => {
     // pnpm/pnpm#10551: pruned Docker contexts ship the lockfile without pnpm-workspace.yaml
     test("lockfile catalogs: section is enough without pnpm-workspace.yaml", async () => {
diff --git a/test/cli/install/migration/pnpm-migration-complete.test.ts b/test/cli/install/migration/pnpm-migration-complete.test.ts
index 117b7465751b..33a056385e99 100644
--- a/test/cli/install/migration/pnpm-migration-complete.test.ts
+++ b/test/cli/install/migration/pnpm-migration-complete.test.ts
@@ -714,9 +714,9 @@ snapshots:
     expect(catalogsExitCode).toBe(0);
     const catalogsLockfile = fs.readFileSync(join(catalogsTest, "bun.lock"), "utf8");
 
-    // Catalogs are resolved to actual versions during migration
-    expect(catalogsLockfile).toContain('"react": "18.2.0"');
-    expect(catalogsLockfile).toContain('"lodash": "4.17.21"');
+    // Importer rows keep their catalog references, as package.json spells them
+    expect(catalogsLockfile).toContain('"react": "catalog:"');
+    expect(catalogsLockfile).toContain('"lodash": "catalog:tools"');
     // The actual packages should be in the lockfile
     expect(catalogsLockfile).toContain('"react@18.2.0"');
     expect(catalogsLockfile).toContain('"lodash@4.17.21"');

From e381220642fe1800893dad0647841372c819fcf6 Mon Sep 17 00:00:00 2001
From: robobun <bot@oven.sh>
Date: Mon, 17 Aug 2026 01:53:36 +0000
Subject: [PATCH 128/258] install: migrate workspace packages from yarn.lock
 (#38878)

---
 src/install/lockfile/bun.lock.rs              |  53 +-
 src/install/migration.rs                      |   2 +-
 src/install/yarn.rs                           | 877 ++++--------------
 .../yarn-lock-migration.test.ts.snap          |  31 +-
 .../migration/yarn-lock-migration.test.ts     | 365 +++++++-
 5 files changed, 569 insertions(+), 759 deletions(-)

diff --git a/src/install/lockfile/bun.lock.rs b/src/install/lockfile/bun.lock.rs
index d7134a241693..bf824b0db939 100644
--- a/src/install/lockfile/bun.lock.rs
+++ b/src/install/lockfile/bun.lock.rs
@@ -3440,23 +3440,7 @@ pub(crate) fn resolve_peer_dep_version_based_among(
     is_candidate: impl Fn(PackageID) -> bool,
 ) -> Option<PackageID> {
     let range = deferred_peer_range(dep, catalogs, string_buf)?;
-    // `package_index` is keyed by real package names; `range` (not `dep.name`) carries them for aliases.
-    let name_hash = match range.tag {
-        DependencyVersionTag::Npm => StringBuilder::string_hash(range.npm().name.slice(string_buf)),
-        DependencyVersionTag::DistTag => {
-            StringBuilder::string_hash(range.dist_tag().name.slice(string_buf))
-        }
-        DependencyVersionTag::Git => {
-            StringBuilder::string_hash(range.git().package_name.slice(string_buf))
-        }
-        DependencyVersionTag::Github => {
-            StringBuilder::string_hash(range.github().package_name.slice(string_buf))
-        }
-        DependencyVersionTag::Tarball => {
-            StringBuilder::string_hash(range.tarball().package_name.slice(string_buf))
-        }
-        _ => dep.name_hash,
-    };
+    let name_hash = peer_candidate_name_hash(dep, range, string_buf);
 
     // The fresh resolver rewrites the name and range through
     // `lockfile.overrides` (and any catalog entry an override points at)
@@ -3478,6 +3462,41 @@ pub(crate) fn resolve_peer_dep_version_based_among(
         return None;
     }
 
+    resolve_peer_dep_by_range(range, name_hash, package_index, pkg_resolutions, string_buf)
+}
+
+/// `package_index` is keyed by real package names; `range` (not `dep.name`) carries them for aliases.
+pub(crate) fn peer_candidate_name_hash(
+    dep: &Dependency,
+    range: &DependencyVersion,
+    string_buf: &[u8],
+) -> PackageNameHash {
+    match range.tag {
+        DependencyVersionTag::Npm => StringBuilder::string_hash(range.npm().name.slice(string_buf)),
+        DependencyVersionTag::DistTag => {
+            StringBuilder::string_hash(range.dist_tag().name.slice(string_buf))
+        }
+        DependencyVersionTag::Git => {
+            StringBuilder::string_hash(range.git().package_name.slice(string_buf))
+        }
+        DependencyVersionTag::Github => {
+            StringBuilder::string_hash(range.github().package_name.slice(string_buf))
+        }
+        DependencyVersionTag::Tarball => {
+            StringBuilder::string_hash(range.tarball().package_name.slice(string_buf))
+        }
+        _ => dep.name_hash,
+    }
+}
+
+/// The scan itself; the yarn.lock migration also binds `*` and overridden peers with it.
+pub(crate) fn resolve_peer_dep_by_range(
+    range: &DependencyVersion,
+    name_hash: PackageNameHash,
+    package_index: &PackageIndexMap,
+    pkg_resolutions: &[Resolution],
+    string_buf: &[u8],
+) -> Option<PackageID> {
     let candidates = package_index.get(&name_hash)?.as_slice();
     candidates.iter().copied().find(|&id| {
         is_candidate(id)
diff --git a/src/install/migration.rs b/src/install/migration.rs
index 777b2da8d0eb..50a8bf4edcb3 100644
--- a/src/install/migration.rs
+++ b/src/install/migration.rs
@@ -78,7 +78,7 @@ pub fn detect_and_load_other_lockfile<'a>(
         let Ok(data) = File::read_from(dir, b"yarn.lock") else {
             break 'yarn;
         };
-        let migrate_result = match yarn::migrate_yarn_lockfile(this, manager, log, &data, dir) {
+        let migrate_result = match yarn::migrate_yarn_lockfile(this, manager, log, &data) {
             Ok(r) => r,
             Err(e) => {
                 return LoadResult::Err(LoadResultErr {
diff --git a/src/install/yarn.rs b/src/install/yarn.rs
index da1e1c5dab41..a610ce05ebc6 100644
--- a/src/install/yarn.rs
+++ b/src/install/yarn.rs
@@ -1,12 +1,11 @@
-use bun_collections::VecExt;
 use std::borrow::Cow;
 use std::io::Write as _;
 
-use crate::Error;
+use crate::{Error, Features, GetJsonResult};
 use bun_collections::StringHashMap;
 use bun_install::bin::Bin;
 use bun_install::dependency::{self, Dependency, DependencyExt as _};
-use bun_install::install::{self, DependencyID, PackageID, PackageManager};
+use bun_install::install::{self, PackageID, PackageManager};
 use bun_install::integrity::Integrity;
 // `bun_install::lockfile` is the column-accessor stub used by the
 // audit/why CLI walkers; the yarn migrator needs the real Lockfile/Tree/
@@ -15,23 +14,20 @@ use bun_install::integrity::Integrity;
 // resolve against the ported types.
 use crate::Origin;
 use crate::lockfile_real::package::meta::HasInstallScript;
-use crate::lockfile_real::package::workspace_map::{MissingWorkspace, NamesArray, WorkspaceMap};
 use crate::lockfile_real::package::{
-    Meta as PackageMeta, Package as LockfilePackage, PackageColumns as _, value_loc_of,
+    Meta as PackageMeta, Package as LockfilePackage, PackageColumns as _,
 };
-use crate::lockfile_real::{self as lockfile, LoadResult, Lockfile, tree, tree::Tree};
+use crate::lockfile_real::{self as lockfile, LoadResult, Lockfile};
 use bun_install::npm;
 // `Package.resolution` is the file-backed `resolution_real::ResolutionType<u64>`
 // (tag + zero-padded `Value` union), constructed via `init(TaggedValue::*)`; the
 // `bun_install::resolution` stub keeps `Value` as a struct-of-fields and has no `init`.
-use crate::bun_json;
 use crate::repository::Repository;
 use crate::resolution_real::{Resolution, TaggedValue as ResolutionValue};
 use crate::versioned_url::VersionedURL;
 use bun_core::strings;
-use bun_paths::PathBuffer;
+use bun_paths::AutoAbsPath;
 use bun_semver::{self as Semver, SlicedString, String as SemverString};
-use bun_sys::Fd;
 
 // Entry/YarnLock borrow from the input `data: &[u8]` passed to `migrate_yarn_lockfile`;
 // `resolved` may instead own a rewritten URL (see `Cow` below) and `git_repo_name` is
@@ -462,20 +458,6 @@ impl<'a> YarnLock<'a> {
         Ok(())
     }
 
-    fn find_entry_by_spec(&self, spec: &[u8]) -> Option<&Entry<'a>> {
-        // Every caller only reads `.workspace` / `.specs`, so `&self`
-        // suffices and avoids the borrowck conflict with the outer
-        // `entries.iter()` loops.
-        for entry in self.entries.iter() {
-            for entry_spec in entry.specs.iter() {
-                if *entry_spec == spec {
-                    return Some(entry);
-                }
-            }
-        }
-        None
-    }
-
     fn consolidate_and_append_entry(&mut self, new_entry: Entry<'a>) -> Result<(), Error> {
         if new_entry.specs.is_empty() {
             return Ok(());
@@ -514,92 +496,124 @@ enum DependencyType {
     Peer,
 }
 
-fn process_deps(
-    deps: &StringHashMap<&[u8]>,
-    dep_type: DependencyType,
-    yarn_lock_: &YarnLock<'_>,
-    string_buf_: &mut Semver::string::Buf,
-    deps_buf: &mut [Dependency],
-    res_buf: &mut [PackageID],
-    log: &mut bun_ast::Log,
+fn read_package_json(
     manager: &mut PackageManager,
-    yarn_entry_to_package_id: &[PackageID],
-) -> Result<usize, Error> {
-    // Returns count instead of slice to avoid borrowck conflict with caller's bufs.
-    let mut count: usize = 0;
-
-    for (dep_name_key, dep_version_ref) in deps.iter() {
-        let dep_name: &[u8] = dep_name_key.as_ref();
-        let dep_version: &[u8] = *dep_version_ref;
-        let mut dep_spec = Vec::new();
-        write!(
-            &mut dep_spec,
-            "{}@{}",
-            bstr::BStr::new(dep_name),
-            bstr::BStr::new(dep_version)
-        )
-        .expect("unreachable");
-
-        if let Some(dep_entry) = yarn_lock_.find_entry_by_spec(&dep_spec) {
-            let dep_entry_workspace = dep_entry.workspace;
-            let dep_name_hash = string_hash(dep_name);
-            let dep_name_str = string_buf_.append_with_hash(dep_name, dep_name_hash)?;
-
-            let parsed_version = if Entry::is_npm_alias(dep_version) {
-                let alias_info = Entry::parse_npm_alias(dep_version);
-                alias_info.version
-            } else {
-                dep_version
-            };
+    log: &mut bun_ast::Log,
+    abs_package_json_path: &[u8],
+) -> Result<(bun_ast::Source, bun_ast::Expr), Error> {
+    match manager.workspace_package_json_cache.get_with_path(
+        log,
+        abs_package_json_path,
+        Default::default(),
+    ) {
+        // Cloned because parsing the root's `workspaces` grows the cache holding this entry.
+        GetJsonResult::Entry(entry) => Ok((entry.source.clone(), entry.root)),
+        GetJsonResult::ReadErr(err) => {
+            log.add_error_fmt(
+                None,
+                bun_ast::Loc::EMPTY,
+                format_args!(
+                    "{} reading \"{}\"",
+                    err.name(),
+                    bstr::BStr::new(abs_package_json_path)
+                ),
+            );
+            Err(err)
+        }
+        // The parse diagnostics are already in `log`.
+        GetJsonResult::ParseErr(_) => Err(crate::Error::InvalidPackageJSON),
+    }
+}
 
-            let dep = Dependency {
-                name: dep_name_str,
-                name_hash: dep_name_hash,
-                version: Dependency::parse(
-                    dep_name_str,
-                    Some(dep_name_hash),
-                    parsed_version,
-                    &SlicedString::init(parsed_version, parsed_version),
-                    Some(&mut *log),
-                    Some(&mut *manager),
-                )
-                .unwrap_or_default(),
-                behavior: behavior_for(dep_type, dep_entry_workspace),
-            };
-            let mut found_package_id: Option<PackageID> = None;
-            'outer: for (yarn_idx, entry_) in yarn_lock_.entries.iter().enumerate() {
-                for entry_spec in entry_.specs.iter() {
-                    if *entry_spec == dep_spec.as_slice() {
-                        found_package_id = Some(yarn_entry_to_package_id[yarn_idx]);
-                        break 'outer;
-                    }
-                }
-            }
+struct Binder<'a> {
+    spec_to_package_id: &'a StringHashMap<PackageID>,
+    workspace_id_by_path: &'a StringHashMap<PackageID>,
+    spec: Vec<u8>,
+}
 
-            if let Some(pkg_id) = found_package_id {
-                // SAFETY: `deps_buf` is uninitialized spare capacity; `ptr::write` skips Drop.
-                unsafe { core::ptr::write(deps_buf.as_mut_ptr().add(count), dep) };
-                res_buf[count] = pkg_id;
-                count += 1;
+impl Binder<'_> {
+    /// Only the exact `name@range` key binds; an entry that merely satisfies it is another resolution.
+    fn bind(&mut self, this: &Lockfile, dep: &Dependency) -> Option<PackageID> {
+        let string_bytes = this.buffers.string_bytes.as_slice();
+        if dep.version.tag == dependency::Tag::Workspace {
+            return self
+                .workspace_id_by_path
+                .get(dep.version.workspace().slice(string_bytes))
+                .copied();
+        }
+        // yarn never locked these peers; bind them the way loading a bun.lock does.
+        if dep.behavior.is_peer() {
+            if dep.behavior.is_optional_peer() {
+                // Bound by the hoister, as after a fresh resolve.
+                return Some(install::INVALID_PACKAGE_ID);
             }
+            // Overrides are not consulted: yarn applied them to the entries the candidates come from.
+            let range = this.catalogs.resolve_range(string_bytes, dep);
+            return lockfile::bun_lock::resolve_peer_dep_by_range(
+                range,
+                lockfile::bun_lock::peer_candidate_name_hash(dep, range, string_bytes),
+                &this.package_index,
+                this.packages.items_resolution(),
+                string_bytes,
+            );
         }
+        self.spec.clear();
+        self.spec.extend_from_slice(dep.name.slice(string_bytes));
+        self.spec.push(b'@');
+        self.spec
+            .extend_from_slice(dep.version.literal.slice(string_bytes));
+        self.spec_to_package_id.get(self.spec.as_slice()).copied()
     }
-    Ok(count)
 }
 
-struct RootDep {
-    name: Vec<u8>,
-    version: Vec<u8>,
-    dep_type: DependencyType,
+/// Packages `0..importer_count` (root, then workspaces) own every row in the buffers so far.
+fn bind_importer_dependencies(
+    this: &mut Lockfile,
+    importer_count: usize,
+    spec_to_package_id: &StringHashMap<PackageID>,
+    workspace_id_by_path: &StringHashMap<PackageID>,
+) {
+    debug_assert_eq!(
+        this.buffers.dependencies.len(),
+        this.buffers.resolutions.len()
+    );
+    let mut declared = core::mem::take(&mut this.buffers.dependencies).into_iter();
+    this.buffers.resolutions.clear();
+
+    let mut binder = Binder {
+        spec_to_package_id,
+        workspace_id_by_path,
+        spec: Vec::new(),
+    };
+    let mut consumed: u32 = 0;
+    for package_id in 0..importer_count {
+        let declared_slice = this.packages.items_dependencies()[package_id];
+        debug_assert_eq!(declared_slice.off, consumed);
+        consumed += declared_slice.len;
+
+        let off = u32::try_from(this.buffers.dependencies.len()).expect("int cast");
+        for dep in declared.by_ref().take(declared_slice.len as usize) {
+            let Some(resolution) = binder.bind(this, &dep) else {
+                // `bun install` resolves it, like a dependency added after yarn.lock was written.
+                continue;
+            };
+            this.buffers.dependencies.push(dep);
+            this.buffers.resolutions.push(resolution);
+        }
+        let len = u32::try_from(this.buffers.dependencies.len()).expect("int cast") - off;
+        this.packages.items_dependencies_mut()[package_id] =
+            lockfile::DependencySlice::new(off, len);
+        this.packages.items_resolutions_mut()[package_id] = lockfile::PackageIDSlice::new(off, len);
+    }
+    debug_assert!(declared.next().is_none());
 }
 
 #[derive(Clone)]
 struct VersionInfo {
-    version: Vec<u8>,
     // Owned Vec<u8> (rather than a borrow from the input) avoids a second
     // lifetime on the local map.
+    version: Vec<u8>,
     package_id: PackageID,
-    yarn_idx: usize,
 }
 
 pub(crate) fn migrate_yarn_lockfile<'a>(
@@ -607,7 +621,6 @@ pub(crate) fn migrate_yarn_lockfile<'a>(
     manager: &mut PackageManager,
     log: &mut bun_ast::Log,
     data: &[u8],
-    dir: Fd,
 ) -> Result<LoadResult<'a>, Error> {
     // yarn v2+ (berry) lockfiles are not supported; only the v1 format migrates.
     if !strings::index_of(data, b"# yarn lockfile v1").is_some() {
@@ -635,183 +648,58 @@ pub(crate) fn migrate_yarn_lockfile<'a>(
         };
     }
 
-    let mut num_deps: u32 = 0;
-    let root_dep_count: u32;
-    let mut root_dep_count_from_package_json: u32 = 0;
-
-    let mut root_dependencies: Vec<RootDep> = Vec::new();
-
-    // read package.json to get specified dependencies
-    let Ok(package_json_fd) = bun_sys::File::openat(dir, b"package.json", bun_sys::O::RDONLY, 0)
-    else {
-        return Err(crate::Error::InvalidPackageJSON);
-    };
-    let Ok(package_json_contents) = package_json_fd.read_to_end() else {
-        return Err(crate::Error::InvalidPackageJSON);
-    };
-
-    // `package_json_source.path` borrows this buffer (lifetime-erased); keep it alive until the overrides are parsed below.
-    let mut package_json_path_buf = PathBuffer::uninit();
-    let package_json_source = {
-        let Ok(package_json_path) =
-            bun_sys::get_fd_path(package_json_fd.handle(), &mut package_json_path_buf)
-        else {
-            return Err(crate::Error::InvalidPackageJSON);
-        };
-        bun_ast::Source::init_path_string(&*package_json_path, package_json_contents.as_slice())
-    };
-    drop(package_json_fd);
-
-    let json_bump = bun_alloc::Arena::new();
-    let Ok(package_json_expr) = bun_json::parse_package_json_utf8_with_opts(
-        bun_json::JSONOptions {
-            json_warn_duplicate_keys: false,
-            guess_indentation: true,
-            ..bun_json::PACKAGE_JSON_OPTS
-        },
-        &package_json_source,
-        log,
-        &json_bump,
-    ) else {
-        return Err(crate::Error::InvalidPackageJSON);
+    let root = {
+        let mut package_json_path = AutoAbsPath::init_top_level_dir();
+        let _ = package_json_path.append(b"package.json");
+        let (source, json) = read_package_json(manager, log, package_json_path.slice())?;
+        let mut root = LockfilePackage::default();
+        let mut resolver: () = ();
+        root.parse_with_json(
+            this,
+            manager,
+            log,
+            &source,
+            json,
+            &mut resolver,
+            Features::main(),
+        )?;
+        this.append_package(&root)?
     };
+    debug_assert_eq!(root.meta.id, 0);
 
-    let package_json = package_json_expr.root;
-
-    {
-        let package_name: Option<Vec<u8>> = 'blk: {
-            if let Some(name_prop) = package_json.as_property(b"name") {
-                if let bun_ast::ExprData::EString(e_string) = &name_prop.expr.data {
-                    let name_slice = e_string.string(&json_bump).unwrap_or(b"");
-                    if !name_slice.is_empty() {
-                        break 'blk Some(name_slice.to_vec());
-                    }
-                }
-            }
-            break 'blk None;
-        };
-        let package_name_hash = if let Some(name) = &package_name {
-            Semver::string::Builder::string_hash(name)
-        } else {
-            0
-        };
-
-        use bun_install_types::DependencyGroup;
-        // prop literals come from canonical; DependencyType retained as yarn-lexer-local discriminant
-        for (group, dep_type) in [
-            (DependencyGroup::DEPENDENCIES, DependencyType::Production),
-            (DependencyGroup::DEV, DependencyType::Development),
-            (DependencyGroup::OPTIONAL, DependencyType::Optional),
-            (DependencyGroup::PEER, DependencyType::Peer),
-        ] {
-            let Some(prop) = package_json.as_property(group.prop) else {
-                continue;
-            };
-            let bun_ast::ExprData::EObject(e_object) = &prop.expr.data else {
-                continue;
-            };
-
-            for p in e_object.properties.slice() {
-                let Some(key) = &p.key else { continue };
-                let bun_ast::ExprData::EString(key_str) = &key.data else {
-                    continue;
-                };
-
-                let Ok(name_slice) = key_str.string(&json_bump) else {
-                    continue;
-                };
-                let Some(value) = &p.value else { continue };
-                let bun_ast::ExprData::EString(value_str) = &value.data else {
-                    continue;
-                };
-
-                let Ok(version_slice) = value_str.string(&json_bump) else {
-                    continue;
-                };
-                if version_slice.is_empty() {
-                    continue;
-                }
-
-                let name = name_slice.to_vec();
-                let version = version_slice.to_vec();
-                root_dependencies.push(RootDep {
-                    name,
-                    version,
-                    dep_type,
-                });
-                root_dep_count_from_package_json += 1;
-            }
-        }
-
-        root_dep_count = root_dep_count_from_package_json.max(10);
-        num_deps += root_dep_count;
-
-        for entry in yarn_lock.entries.iter() {
-            if let Some(deps) = &entry.dependencies {
-                num_deps += u32::try_from(deps.count()).expect("int cast");
-            }
-            if let Some(deps) = &entry.optional_dependencies {
-                num_deps += u32::try_from(deps.count()).expect("int cast");
-            }
-            if let Some(deps) = &entry.peer_dependencies {
-                num_deps += u32::try_from(deps.count()).expect("int cast");
-            }
-            if let Some(deps) = &entry.dev_dependencies {
-                num_deps += u32::try_from(deps.count()).expect("int cast");
-            }
+    let mut workspace_id_by_path: StringHashMap<PackageID> = StringHashMap::new();
+    for dep_id in root.dependencies.begin()..root.dependencies.end() {
+        let dep = &this.buffers.dependencies[dep_id as usize];
+        if !dep.behavior.is_workspace() {
+            continue;
         }
-
-        let num_packages = u32::try_from(yarn_lock.entries.len() + 1).expect("int cast");
-
-        this.buffers
-            .dependencies
-            .reserve((num_deps as usize).saturating_sub(this.buffers.dependencies.len()));
-        this.buffers
-            .resolutions
-            .reserve((num_deps as usize).saturating_sub(this.buffers.resolutions.len()));
-        this.packages.ensure_total_capacity(num_packages as usize)?;
-        this.package_index
-            .ensure_total_capacity(num_packages as usize)?;
-
-        let root_name = if let Some(name) = &package_name {
-            sbuf!().append_with_hash(name, package_name_hash)?
-        } else {
-            sbuf!().append(b"")?
-        };
-
-        this.packages.append(LockfilePackage {
-            name: root_name,
-            name_hash: package_name_hash,
-            resolution: Resolution::init(ResolutionValue::Root),
-            dependencies: Default::default(),
-            resolutions: Default::default(),
-            meta: PackageMeta {
-                id: 0,
-                origin: Origin::Local,
-                arch: npm::Architecture::ALL,
-                os: npm::OperatingSystem::ALL,
-                man_dir: SemverString::default(),
-                has_install_script: HasInstallScript::False,
-                integrity: Integrity::default(),
-                ..Default::default()
-            },
-            bin: Bin::init(),
-            scripts: Default::default(),
-        })?;
+        let workspace_path = *dep.version.workspace();
+
+        let mut package_json_path = AutoAbsPath::init_top_level_dir();
+        let _ =
+            package_json_path.append(workspace_path.slice(this.buffers.string_bytes.as_slice()));
+        let _ = package_json_path.append(b"package.json");
+        let (source, json) = read_package_json(manager, log, package_json_path.slice())?;
+
+        let mut workspace = LockfilePackage::default();
+        let mut resolver: () = ();
+        workspace.parse_with_json(
+            this,
+            manager,
+            log,
+            &source,
+            json,
+            &mut resolver,
+            Features::WORKSPACE,
+        )?;
+        workspace.resolution = Resolution::init(ResolutionValue::Workspace(workspace_path));
+        let workspace = this.append_package(&workspace)?;
+        workspace_id_by_path.put(
+            workspace_path.slice(this.buffers.string_bytes.as_slice()),
+            workspace.meta.id,
+        )?;
     }
-
-    // SAFETY: capacity reserved above to num_deps; we write past `len` through
-    // raw pointers into the reserved capacity and set `len` at the end.
-    let dependencies_base_ptr = this.buffers.dependencies.as_mut_ptr();
-    let resolutions_base_ptr = this.buffers.resolutions.as_mut_ptr();
-    let mut dependencies_buf: &mut [Dependency] = unsafe {
-        // SAFETY: capacity >= num_deps reserved above
-        bun_core::ffi::slice_mut(dependencies_base_ptr, num_deps as usize)
-    };
-    let mut resolutions_buf: &mut [PackageID] = unsafe {
-        // SAFETY: capacity >= num_deps reserved above
-        bun_core::ffi::slice_mut(resolutions_base_ptr, num_deps as usize)
-    };
+    let importer_count = this.packages.len();
 
     let mut yarn_entry_to_package_id: Vec<PackageID> = vec![0; yarn_lock.entries.len()];
 
@@ -819,7 +707,7 @@ pub(crate) fn migrate_yarn_lockfile<'a>(
 
     let mut scoped_packages: StringHashMap<Vec<VersionInfo>> = StringHashMap::new();
 
-    let mut next_package_id: PackageID = 1; // 0 is root
+    let mut next_package_id: PackageID = PackageID::try_from(importer_count).expect("int cast");
 
     for (yarn_idx, entry) in yarn_lock.entries.iter().enumerate() {
         let mut is_npm_alias = false;
@@ -865,18 +753,13 @@ pub(crate) fn migrate_yarn_lockfile<'a>(
                 }
 
                 if !found_existing {
-                    list.push(VersionInfo {
-                        yarn_idx: existing.yarn_idx,
-                        version: existing.version.clone(),
-                        package_id: existing.package_id,
-                    });
+                    list.push(existing);
                 }
 
                 if !found_new {
                     let package_id = next_package_id;
                     next_package_id += 1;
                     list.push(VersionInfo {
-                        yarn_idx,
                         version: version.to_vec(),
                         package_id,
                     });
@@ -903,7 +786,6 @@ pub(crate) fn migrate_yarn_lockfile<'a>(
                 VersionInfo {
                     version: version.to_vec(),
                     package_id,
-                    yarn_idx,
                 },
             )?;
         }
@@ -911,9 +793,6 @@ pub(crate) fn migrate_yarn_lockfile<'a>(
 
     let mut package_id_to_yarn_idx: Vec<usize> = vec![usize::MAX; next_package_id as usize];
 
-    let created_packages: StringHashMap<bool> = StringHashMap::new();
-    let _ = &created_packages; // never populated
-
     for (yarn_idx, entry) in yarn_lock.entries.iter().enumerate() {
         let mut is_npm_alias = false;
         for spec in entry.specs.iter() {
@@ -1082,6 +961,7 @@ pub(crate) fn migrate_yarn_lockfile<'a>(
             }
         };
 
+        debug_assert_eq!(this.packages.len(), package_id as usize);
         this.packages.append(LockfilePackage {
             name: pkg_name,
             name_hash,
@@ -1121,357 +1001,23 @@ pub(crate) fn migrate_yarn_lockfile<'a>(
             bin: Bin::init(),
             scripts: Default::default(),
         })?;
+        this.get_or_put_id(package_id, name_hash)?;
     }
 
-    // The derive's `&mut self` accessors can't alias, so we re-borrow per write
-    // below via `this.packages.items_*_mut()[idx] = …` instead of caching
-    // two field slices simultaneously.
-
-    let mut actual_root_dep_count: u32 = 0;
-
-    if !root_dependencies.is_empty() {
-        for dep in root_dependencies.iter() {
-            let mut dep_spec = Vec::new();
-            write!(
-                &mut dep_spec,
-                "{}@{}",
-                bstr::BStr::new(&dep.name),
-                bstr::BStr::new(&dep.version)
-            )
-            .expect("unreachable");
-
-            let mut found_idx: Option<usize> = None;
-            for (idx, entry) in yarn_lock.entries.iter().enumerate() {
-                for spec in entry.specs.iter() {
-                    if *spec == dep_spec.as_slice() {
-                        found_idx = Some(idx);
-                        break;
-                    }
-                }
-                if found_idx.is_some() {
-                    break;
-                }
-            }
-
-            if let Some(idx) = found_idx {
-                let name_hash = string_hash(&dep.name);
-                let dep_name_string = sbuf!().append_with_hash(&dep.name, name_hash)?;
-                let version_string = sbuf!().append(&dep.version)?;
-
-                // SAFETY: `dependencies_buf` is uninitialized spare capacity; `ptr::write` skips Drop.
-                unsafe {
-                    core::ptr::write(
-                        dependencies_buf
-                            .as_mut_ptr()
-                            .add(actual_root_dep_count as usize),
-                        Dependency {
-                            name: dep_name_string,
-                            name_hash,
-                            version: Dependency::parse(
-                                dep_name_string,
-                                Some(name_hash),
-                                version_string.slice(this.buffers.string_bytes.as_slice()),
-                                &version_string.sliced(this.buffers.string_bytes.as_slice()),
-                                Some(&mut *log),
-                                Some(&mut *manager),
-                            )
-                            .unwrap_or_default(),
-                            behavior: behavior_for(dep.dep_type, false),
-                        },
-                    );
-                }
-
-                resolutions_buf[actual_root_dep_count as usize] = yarn_entry_to_package_id[idx];
-                actual_root_dep_count += 1;
-            }
-        }
-    }
-
-    this.packages.items_dependencies_mut()[0] =
-        lockfile::DependencySlice::new(0, actual_root_dep_count);
-    this.packages.items_resolutions_mut()[0] =
-        lockfile::DependencyIDSlice::new(0, actual_root_dep_count);
-
-    dependencies_buf = &mut dependencies_buf[actual_root_dep_count as usize..];
-    resolutions_buf = &mut resolutions_buf[actual_root_dep_count as usize..];
-
-    for yarn_idx in 0..yarn_lock.entries.len() {
-        let package_id = yarn_entry_to_package_id[yarn_idx];
-        if package_id == install::INVALID_PACKAGE_ID {
-            continue;
-        }
-
-        let dependencies_start = dependencies_buf.as_mut_ptr();
-        let resolutions_start = resolutions_buf.as_mut_ptr();
-
-        // reshaped for borrowck — iterate by index and re-borrow
-        // `yarn_lock.entries[yarn_idx]` for each map so the shared borrow of
-        // `yarn_lock` passed into `process_deps` doesn't overlap an iterator.
-        if let Some(deps) = yarn_lock.entries[yarn_idx].dependencies.as_ref() {
-            let processed = process_deps(
-                deps,
-                DependencyType::Production,
-                &yarn_lock,
-                &mut sbuf!(),
-                dependencies_buf,
-                resolutions_buf,
-                &mut *log,
-                &mut *manager,
-                &yarn_entry_to_package_id,
-            )?;
-            dependencies_buf = &mut dependencies_buf[processed..];
-            resolutions_buf = &mut resolutions_buf[processed..];
-        }
-
-        if let Some(deps) = yarn_lock.entries[yarn_idx].optional_dependencies.as_ref() {
-            let processed = process_deps(
-                deps,
-                DependencyType::Optional,
-                &yarn_lock,
-                &mut sbuf!(),
-                dependencies_buf,
-                resolutions_buf,
-                &mut *log,
-                &mut *manager,
-                &yarn_entry_to_package_id,
-            )?;
-            dependencies_buf = &mut dependencies_buf[processed..];
-            resolutions_buf = &mut resolutions_buf[processed..];
-        }
-
-        if let Some(deps) = yarn_lock.entries[yarn_idx].peer_dependencies.as_ref() {
-            let processed = process_deps(
-                deps,
-                DependencyType::Peer,
-                &yarn_lock,
-                &mut sbuf!(),
-                dependencies_buf,
-                resolutions_buf,
-                &mut *log,
-                &mut *manager,
-                &yarn_entry_to_package_id,
-            )?;
-            dependencies_buf = &mut dependencies_buf[processed..];
-            resolutions_buf = &mut resolutions_buf[processed..];
-        }
-
-        if let Some(deps) = yarn_lock.entries[yarn_idx].dev_dependencies.as_ref() {
-            let processed = process_deps(
-                deps,
-                DependencyType::Development,
-                &yarn_lock,
-                &mut sbuf!(),
-                dependencies_buf,
-                resolutions_buf,
-                &mut *log,
-                &mut *manager,
-                &yarn_entry_to_package_id,
-            )?;
-            dependencies_buf = &mut dependencies_buf[processed..];
-            resolutions_buf = &mut resolutions_buf[processed..];
-        }
-
-        // dependencies_start/dependencies_buf.as_ptr() are within the same allocation
-        let deps_len = (dependencies_buf.as_mut_ptr() as usize) - (dependencies_start as usize);
-        let deps_off = (dependencies_start as usize) - (dependencies_base_ptr as usize);
-        this.packages.items_dependencies_mut()[package_id as usize] =
-            lockfile::DependencySlice::new(
-                u32::try_from(deps_off / core::mem::size_of::<Dependency>()).expect("int cast"),
-                u32::try_from(deps_len / core::mem::size_of::<Dependency>()).expect("int cast"),
-            );
-        let res_off = (resolutions_start as usize) - (resolutions_base_ptr as usize);
-        let res_len = (resolutions_buf.as_mut_ptr() as usize) - (resolutions_start as usize);
-        this.packages.items_resolutions_mut()[package_id as usize] =
-            lockfile::DependencyIDSlice::new(
-                u32::try_from(res_off / core::mem::size_of::<PackageID>()).expect("int cast"),
-                u32::try_from(res_len / core::mem::size_of::<PackageID>()).expect("int cast"),
-            );
-    }
-
-    let final_deps_len = ((dependencies_buf.as_mut_ptr() as usize)
-        - (dependencies_base_ptr as usize))
-        / core::mem::size_of::<Dependency>();
-    unsafe {
-        // SAFETY: all elements in 0..final_deps_len initialized above; capacity >= num_deps
-        this.buffers.dependencies.set_len(final_deps_len);
-        this.buffers.resolutions.set_len(final_deps_len);
-    }
-
-    this.buffers.hoisted_dependencies.reserve(
-        (this.buffers.dependencies.len() * 2)
-            .saturating_sub(this.buffers.hoisted_dependencies.len()),
-    );
-
-    this.buffers.trees.push(Tree {
-        id: 0,
-        parent: tree::INVALID_ID,
-        dependency_id: tree::ROOT_DEP_ID,
-        dependencies: lockfile::DependencyIDSlice::new(0, 0),
-    });
-
-    let mut package_dependents: Vec<Vec<PackageID>> =
-        (0..next_package_id).map(|_| Vec::new()).collect();
-
-    for (yarn_idx, entry) in yarn_lock.entries.iter().enumerate() {
-        let parent_package_id = yarn_entry_to_package_id[yarn_idx];
-
-        let dep_maps: [Option<&StringHashMap<&[u8]>>; 4] = [
-            entry.dependencies.as_ref(),
-            entry.optional_dependencies.as_ref(),
-            entry.peer_dependencies.as_ref(),
-            entry.dev_dependencies.as_ref(),
-        ];
-
-        for deps in dep_maps.iter().flatten() {
-            for (dep_name_key, dep_version_ref) in deps.iter() {
-                let dep_name: &[u8] = dep_name_key.as_ref();
-                let dep_version: &[u8] = *dep_version_ref;
-                let mut dep_spec = Vec::new();
-                write!(
-                    &mut dep_spec,
-                    "{}@{}",
-                    bstr::BStr::new(dep_name),
-                    bstr::BStr::new(dep_version)
-                )
-                .expect("unreachable");
-
-                let found_entry_idx: Option<usize> = yarn_lock
-                    .entries
-                    .iter()
-                    .position(|e| e.specs.contains(&dep_spec.as_slice()));
-
-                if let Some(found_entry_idx) = found_entry_idx {
-                    let dep_entry_specs = &yarn_lock.entries[found_entry_idx].specs;
-                    for (idx, e) in yarn_lock.entries.iter().enumerate() {
-                        let mut found = false;
-                        for spec in e.specs.iter() {
-                            for dep_spec_item in dep_entry_specs.iter() {
-                                if *spec == *dep_spec_item {
-                                    found = true;
-                                    break;
-                                }
-                            }
-                            if found {
-                                break;
-                            }
-                        }
-
-                        if found {
-                            let dep_package_id = yarn_entry_to_package_id[idx];
-                            package_dependents[dep_package_id as usize].push(parent_package_id);
-                            break;
-                        }
-                    }
-                }
-            }
-        }
-    }
-
-    for dep in root_dependencies.iter() {
-        let mut dep_spec = Vec::new();
-        write!(
-            &mut dep_spec,
-            "{}@{}",
-            bstr::BStr::new(&dep.name),
-            bstr::BStr::new(&dep.version)
-        )
-        .expect("unreachable");
-
-        for (idx, entry) in yarn_lock.entries.iter().enumerate() {
-            for spec in entry.specs.iter() {
-                if *spec == dep_spec.as_slice() {
-                    let dep_package_id = yarn_entry_to_package_id[idx];
-                    package_dependents[dep_package_id as usize].push(0); // 0 is root package
-                    break;
-                }
-            }
-        }
-    }
-
-    for id in 0..this.packages.len() {
-        let name_hash = this.packages.items_name_hash()[id];
-        this.get_or_put_id(id as PackageID, name_hash)?;
-    }
-
-    this.buffers.trees[0].dependencies = lockfile::DependencyIDSlice::new(0, 0);
-
     let mut spec_to_package_id: StringHashMap<PackageID> = StringHashMap::new();
-
     for (yarn_idx, entry) in yarn_lock.entries.iter().enumerate() {
-        let package_id = yarn_entry_to_package_id[yarn_idx];
-        if package_id == install::INVALID_PACKAGE_ID {
-            continue;
-        }
-
         for spec in entry.specs.iter() {
-            spec_to_package_id.put(*spec, package_id)?;
-        }
-    }
-
-    let root_deps_off = u32::try_from(this.buffers.dependencies.len()).expect("int cast");
-    let root_resolutions_off = u32::try_from(this.buffers.resolutions.len()).expect("int cast");
-
-    if !root_dependencies.is_empty() {
-        for root_dep in root_dependencies.iter() {
-            let _ = DependencyID::try_from(this.buffers.dependencies.len()).expect("int cast");
-
-            let name_hash = string_hash(&root_dep.name);
-            let dep_name_string = sbuf!().append_with_hash(&root_dep.name, name_hash)?;
-            let dep_version_string = sbuf!().append(&root_dep.version)?;
-            let sliced_string = SlicedString::init(
-                dep_version_string.slice(this.buffers.string_bytes.as_slice()),
-                dep_version_string.slice(this.buffers.string_bytes.as_slice()),
-            );
-
-            let mut parsed_version = Dependency::parse(
-                dep_name_string,
-                Some(name_hash),
-                dep_version_string.slice(this.buffers.string_bytes.as_slice()),
-                &sliced_string,
-                Some(&mut *log),
-                Some(&mut *manager),
-            )
-            .unwrap_or_default();
-
-            parsed_version.literal = dep_version_string;
-
-            let dep = Dependency {
-                name_hash,
-                name: dep_name_string,
-                version: parsed_version,
-                behavior: behavior_for(root_dep.dep_type, false),
-            };
-
-            this.buffers.dependencies.push(dep);
-
-            let mut dep_spec = Vec::new();
-            write!(
-                &mut dep_spec,
-                "{}@{}",
-                bstr::BStr::new(&root_dep.name),
-                bstr::BStr::new(&root_dep.version)
-            )
-            .expect("unreachable");
-
-            if let Some(pkg_id) = spec_to_package_id.get(dep_spec.as_slice()).copied() {
-                this.buffers.resolutions.push(pkg_id);
-            } else {
-                this.buffers.resolutions.push(install::INVALID_PACKAGE_ID);
-            }
+            spec_to_package_id.put(spec, yarn_entry_to_package_id[yarn_idx])?;
         }
     }
 
-    this.packages.items_dependencies_mut()[0] = lockfile::DependencySlice::new(
-        root_deps_off,
-        u32::try_from(root_dependencies.len()).expect("int cast"),
-    );
-    this.packages.items_resolutions_mut()[0] = lockfile::DependencyIDSlice::new(
-        root_resolutions_off,
-        u32::try_from(root_dependencies.len()).expect("int cast"),
+    bind_importer_dependencies(
+        this,
+        importer_count,
+        &spec_to_package_id,
+        &workspace_id_by_path,
     );
 
-    parse_root_overrides(this, manager, log, &package_json_source, package_json)?;
-
     for (yarn_idx, entry) in yarn_lock.entries.iter().enumerate() {
         let package_id = yarn_entry_to_package_id[yarn_idx];
         if package_id == install::INVALID_PACKAGE_ID {
@@ -1720,98 +1266,7 @@ pub(crate) fn migrate_yarn_lockfile<'a>(
     Ok(result)
 }
 
-/// Must run after the root package's dependencies are laid out: `$ref` values resolve through them, then through the workspaces.
-fn parse_root_overrides(
-    this: &mut Lockfile,
-    manager: &mut PackageManager,
-    log: &mut bun_ast::Log,
-    source: &bun_ast::Source,
-    package_json: bun_ast::Expr,
-) -> Result<(), Error> {
-    if package_json.as_property(b"overrides").is_none()
-        && package_json.as_property(b"resolutions").is_none()
-    {
-        return Ok(());
-    }
-
-    let mut workspace_names = WorkspaceMap::init();
-    let workspaces = package_json.as_property(b"workspaces");
-    let packages = workspaces
-        .as_ref()
-        .filter(|q| !q.expr.is_array())
-        .and_then(|q| q.expr.as_property(b"packages"));
-    let names: Option<(NamesArray<'_>, bun_ast::Loc)> = match (&workspaces, &packages) {
-        (Some(q), _) if q.expr.is_array() => Some((
-            NamesArray::from_expr(&q.expr, value_loc_of(source, q.loc))
-                .expect("is_array was checked above"),
-            q.loc,
-        )),
-        (Some(_), Some(p)) if p.expr.is_array() => Some((
-            NamesArray::from_expr(&p.expr, value_loc_of(source, p.loc))
-                .expect("is_array was checked above"),
-            p.loc,
-        )),
-        _ => None,
-    };
-    if let Some((arr, loc)) = names {
-        workspace_names.process_names_array(
-            &mut manager.workspace_package_json_cache,
-            log,
-            arr,
-            source,
-            loc,
-            None,
-            MissingWorkspace::Skip,
-        )?;
-    }
-
-    let root_package = *this.packages.get(0);
-    let (mut string_builder, lf) = this.string_builder_split();
-    lf.overrides.parse_count(
-        manager,
-        log,
-        source,
-        &workspace_names,
-        package_json,
-        &mut string_builder,
-    );
-    string_builder.allocate()?;
-    lf.overrides.parse_append(
-        manager,
-        lf.dependencies.as_slice(),
-        &root_package,
-        log,
-        source,
-        &workspace_names,
-        package_json,
-        &mut string_builder,
-    )?;
-    string_builder.clamp();
-    Ok(())
-}
-
 #[inline]
 fn string_hash(s: &[u8]) -> u64 {
     Semver::string::Builder::string_hash(s)
 }
-
-/// The bitflags-backed `Behavior` has no named fields, so build via
-/// `with(FLAG, cond)` chaining.
-#[inline]
-fn behavior_for(dep_type: DependencyType, workspace: bool) -> dependency::Behavior {
-    dependency::Behavior::default()
-        .with(
-            dependency::Behavior::PROD,
-            dep_type == DependencyType::Production,
-        )
-        .with(
-            dependency::Behavior::OPTIONAL,
-            dep_type == DependencyType::Optional,
-        )
-        .with(
-            dependency::Behavior::DEV,
-            dep_type == DependencyType::Development,
-        )
-        .with(dependency::Behavior::PEER, dep_type == DependencyType::Peer)
-        .with(dependency::Behavior::WORKSPACE, workspace)
-}
diff --git a/test/cli/install/migration/__snapshots__/yarn-lock-migration.test.ts.snap b/test/cli/install/migration/__snapshots__/yarn-lock-migration.test.ts.snap
index ca391e28e224..2911ece4e8a7 100644
--- a/test/cli/install/migration/__snapshots__/yarn-lock-migration.test.ts.snap
+++ b/test/cli/install/migration/__snapshots__/yarn-lock-migration.test.ts.snap
@@ -231,9 +231,34 @@ exports[`yarn.lock migration basic yarn.lock with workspace dependencies: worksp
         "lodash": "^4.17.21",
       },
     },
+    "packages/a": {
+      "name": "@workspace/a",
+      "version": "1.0.0",
+      "dependencies": {
+        "@workspace/b": "workspace:*",
+        "is-number": "^7.0.0",
+      },
+    },
+    "packages/b": {
+      "name": "@workspace/b",
+      "version": "1.0.0",
+      "dependencies": {
+        "is-odd": "^3.0.1",
+      },
+    },
   },
   "packages": {
+    "@workspace/a": ["@workspace/a@workspace:packages/a"],
+
+    "@workspace/b": ["@workspace/b@workspace:packages/b"],
+
+    "is-number": ["is-number@7.0.0", "", {}, "sha512-41Cifkg6e8TylSpdtTpeLVMqvSBEVzTttHvERD741+pnZ8ANv0004MRL43QKPDlK9cGvNp6NZWZUBlbGXYxxng=="],
+
+    "is-odd": ["is-odd@3.0.1", "", { "dependencies": { "is-number": "^6.0.0" } }, "sha512-CQpnWPrDwmP1+SMHXZhtLtJv90yiyVfluGsX5iNCVkrhQtU3TQHsUWPG9wkdk9Lgd5yNpAg9jQEo90CBaXgWMA=="],
+
     "lodash": ["lodash@4.17.21", "", {}, "sha512-v2kDEe57lecTulaDIuNTPy3Ry4gLGJ6Z1O3vE1krgXZNrsQ+LFTGHVxVjcXPs17LhbZVGedAJv8XZ1tvj5FvSg=="],
+
+    "is-odd/is-number": ["is-number@6.0.0", "", {}, "sha512-Wu1VHeILBK8KAWJUAiSZQX94GmOE45Rg6/538fKwiloUu21KncEkYGPqob2oSZ5mUT73vLGrHQjKw3KMPwfDzg=="],
   }
 }
 "
@@ -275,15 +300,15 @@ exports[`yarn.lock migration basic migration with realistic complex yarn.lock: c
     "": {
       "name": "complex-app",
       "dependencies": {
+        "@babel/core": "^7.20.0",
         "react": "^18.2.0",
         "react-dom": "^18.2.0",
-        "@babel/core": "^7.20.0",
         "webpack": "^5.75.0",
       },
       "devDependencies": {
         "@types/react": "^18.0.0",
-        "typescript": "^4.9.0",
         "eslint": "^8.0.0",
+        "typescript": "^4.9.0",
       },
       "optionalDependencies": {
         "fsevents": "^2.3.2",
@@ -3186,8 +3211,8 @@ exports[`bun pm migrate for existing yarn.lock yarn.lock with packages that have
     "": {
       "name": "os-cpu-test",
       "dependencies": {
-        "fsevents": "^2.3.2",
         "esbuild": "^0.17.0",
+        "fsevents": "^2.3.2",
       },
     },
   },
diff --git a/test/cli/install/migration/yarn-lock-migration.test.ts b/test/cli/install/migration/yarn-lock-migration.test.ts
index 83fe9cd28754..3df71b451933 100644
--- a/test/cli/install/migration/yarn-lock-migration.test.ts
+++ b/test/cli/install/migration/yarn-lock-migration.test.ts
@@ -1,6 +1,6 @@
 import { afterAll, beforeAll, describe, expect, test } from "bun:test";
 import fs from "fs";
-import { bunEnv, bunExe, tempDir, VerdaccioRegistry } from "harness";
+import { bunEnv, bunExe, isDebug, nodeModulesPackages, tempDir, VerdaccioRegistry } from "harness";
 import { join } from "path";
 
 describe("yarn.lock migration basic", () => {
@@ -1153,8 +1153,19 @@ lodash@^4.17.21:
     const bunLockContent = fs.readFileSync(join(tmpDir, "bun.lock"), "utf8");
     expect(bunLockContent).toMatchSnapshot("workspace-yarn-migration");
 
-    // TODO: Workspace dependencies are not yet supported in yarn migration
-    // expect(bunLockContent).toContain("workspace:");
+    const lock = Bun.JSONC.parse(bunLockContent) as {
+      workspaces: Record<string, unknown>;
+      packages: Record<string, unknown[]>;
+    };
+    expect(Object.keys(lock.workspaces)).toEqual(["", "packages/a", "packages/b"]);
+    expect(Object.fromEntries(Object.entries(lock.packages).map(([key, info]) => [key, info[0]]))).toEqual({
+      "@workspace/a": "@workspace/a@workspace:packages/a",
+      "@workspace/b": "@workspace/b@workspace:packages/b",
+      "is-number": "is-number@7.0.0",
+      "is-odd": "is-odd@3.0.1",
+      "is-odd/is-number": "is-number@6.0.0",
+      "lodash": "lodash@4.17.21",
+    });
   });
 
   test("yarn.lock with scoped packages and parent/child relationships", async () => {
@@ -1508,30 +1519,41 @@ describe("bun pm migrate for existing yarn.lock", () => {
     "yarn-stuff",
     "yarn-stuff/abbrev-link-target",
   ];
-  test.each(folders)("%s", async folder => {
-    const packageJsonContent = await Bun.file(join(import.meta.dir, "yarn", folder, "package.json")).text();
-    const yarnLockContent = await Bun.file(join(import.meta.dir, "yarn", folder, "yarn.lock")).text();
-
-    await using tmpDir = tempDir("yarn-lock-migration-", {
-      "package.json": packageJsonContent,
-      "yarn.lock": yarnLockContent,
-    });
-
-    const migrateResult = Bun.spawn({
-      cmd: [bunExe(), "pm", "migrate", "-f"],
-      cwd: tmpDir,
-      env: bunEnv,
-      stdout: "pipe",
-      stderr: "pipe",
-      stdin: "ignore",
-    });
-
-    expect(migrateResult.exited).resolves.toBe(0);
-    expect(Bun.file(join(tmpDir, "bun.lock")).exists()).resolves.toBe(true);
-
-    const bunLockContent = await Bun.file(join(tmpDir, "bun.lock")).text();
-    expect(bunLockContent).toMatchSnapshot(folder);
-  });
+  test.each(folders)(
+    "%s",
+    async folder => {
+      const packageJsonContent = await Bun.file(join(import.meta.dir, "yarn", folder, "package.json")).text();
+      const yarnLockContent = await Bun.file(join(import.meta.dir, "yarn", folder, "yarn.lock")).text();
+
+      await using tmpDir = tempDir("yarn-lock-migration-", {
+        "package.json": packageJsonContent,
+        "yarn.lock": yarnLockContent,
+      });
+
+      await using migrateResult = Bun.spawn({
+        cmd: [bunExe(), "pm", "migrate", "-f"],
+        cwd: tmpDir,
+        env: bunEnv,
+        stdout: "pipe",
+        stderr: "pipe",
+        stdin: "ignore",
+      });
+
+      const [stdout, stderr, exitCode] = await Promise.all([
+        migrateResult.stdout.text(),
+        migrateResult.stderr.text(),
+        migrateResult.exited,
+      ]);
+      expect(stdout).toBe("");
+      expect(stderr).toContain("migrated lockfile from yarn.lock");
+      expect(exitCode).toBe(0);
+
+      const bunLockContent = await Bun.file(join(tmpDir, "bun.lock")).text();
+      expect(bunLockContent).toMatchSnapshot(folder);
+    },
+    // yarn-cli-repo is yarn's own 8k-line lockfile; a debug build takes several seconds to migrate it.
+    isDebug ? 60_000 : undefined,
+  );
 
   test("yarn.lock with packages that have os/cpu requirements", async () => {
     await using tmpDir = tempDir("yarn-migration-os-cpu", {
@@ -1929,3 +1951,292 @@ ${yarnLockEntries}`,
     expect(bunLock).toContain(`"abbrev": ["abbrev-js@github:isaacs/abbrev-js#3f9802e", {}, ""]`);
   });
 });
+
+// yarn.lock has no entries for the root or the workspaces themselves: each dependency they declare is
+// looked up by the exact `name@range` key, the same way yarn resolves it.
+const yarnLockEntries = {
+  "is-number-6": (specs: string) => `${specs}:
+  version "6.0.0"
+  resolved "https://registry.yarnpkg.com/is-number/-/is-number-6.0.0.tgz#e6d15ad31fc262887d1846d1c6c84c9b3b0b5982"
+  integrity sha512-Wu1VHeILBK8KAWJUAiSZQX94GmOE45Rg6/538fKwiloUu21KncEkYGPqob2oSZ5mUT73vLGrHQjKw3KMPwfDzg==
+`,
+  "is-number-7": (specs: string) => `${specs}:
+  version "7.0.0"
+  resolved "https://registry.yarnpkg.com/is-number/-/is-number-7.0.0.tgz#7535345b896734d5f80c4d06c50955527a14f12b"
+  integrity sha512-41Cifkg6e8TylSpdtTpeLVMqvSBEVzTttHvERD741+pnZ8ANv0004MRL43QKPDlK9cGvNp6NZWZUBlbGXYxxng==
+`,
+  "lodash": (specs: string) => `${specs}:
+  version "4.17.21"
+  resolved "https://registry.yarnpkg.com/lodash/-/lodash-4.17.21.tgz#679591c564c3bffaae8454cf0b3df370c3d6911c"
+  integrity sha512-v2kDEe57lecTulaDIuNTPy3Ry4gLGJ6Z1O3vE1krgXZNrsQ+LFTGHVxVjcXPs17LhbZVGedAJv8XZ1tvj5FvSg==
+`,
+};
+
+function yarnLock(...entries: string[]) {
+  return `# yarn lockfile v1\n\n\n${entries.join("\n")}`;
+}
+
+type MigratedLock = {
+  workspaces: Record<string, Record<string, unknown>>;
+  packages: Record<string, unknown[]>;
+};
+
+async function migrate(dir: string): Promise<MigratedLock & { stderr: string }> {
+  await using proc = Bun.spawn({
+    cmd: [bunExe(), "pm", "migrate", "-f"],
+    cwd: dir,
+    env: bunEnv,
+    stdout: "pipe",
+    stderr: "pipe",
+    stdin: "ignore",
+  });
+  const [stdout, stderr, exitCode] = await Promise.all([proc.stdout.text(), proc.stderr.text(), proc.exited]);
+  expect(stdout).toBe("");
+  expect(stderr).toContain("migrated lockfile from yarn.lock");
+  expect(exitCode).toBe(0);
+  const lock = Bun.JSONC.parse(await Bun.file(join(dir, "bun.lock")).text()) as MigratedLock;
+  return { ...lock, stderr };
+}
+
+function resolvedPackages(lock: MigratedLock) {
+  return Object.fromEntries(Object.entries(lock.packages).map(([key, info]) => [key, info[0]]));
+}
+
+describe.concurrent("yarn.lock migration of workspace dependencies", () => {
+  test("workspace dependencies are taken from yarn.lock when the root has no dependencies of its own", async () => {
+    using dir = tempDir("yarn-migration-workspaces-root-without-deps", {
+      "package.json": JSON.stringify({ name: "mono", private: true, workspaces: ["packages/*"] }),
+      "packages/a/package.json": JSON.stringify({ name: "a", version: "1.0.0", dependencies: { "is-number": ">=6" } }),
+      "packages/b/package.json": JSON.stringify({ name: "b", version: "1.0.0" }),
+      // One entry keyed by several ranges, as yarn writes it when the ranges resolve to the same version.
+      "yarn.lock": yarnLock(yarnLockEntries["is-number-7"]("is-number@>=6, is-number@^7.0.0")),
+    });
+
+    const lock = await migrate(String(dir));
+
+    expect(lock.workspaces).toEqual({
+      "": { name: "mono" },
+      "packages/a": { name: "a", version: "1.0.0", dependencies: { "is-number": ">=6" } },
+      "packages/b": { name: "b", version: "1.0.0" },
+    });
+    expect(resolvedPackages(lock)).toEqual({
+      "a": "a@workspace:packages/a",
+      "b": "b@workspace:packages/b",
+      "is-number": "is-number@7.0.0",
+    });
+  });
+
+  test("a range binds to its own yarn.lock entry, not to another entry of the same name that satisfies it", async () => {
+    using dir = tempDir("yarn-migration-workspaces-same-name", {
+      "package.json": JSON.stringify({
+        name: "mono",
+        private: true,
+        workspaces: ["packages/*"],
+        devDependencies: { lodash: "^4.17.21" },
+      }),
+      "packages/a/package.json": JSON.stringify({ name: "a", version: "1.0.0", dependencies: { "is-number": ">=6" } }),
+      "packages/b/package.json": JSON.stringify({
+        name: "b",
+        version: "1.0.0",
+        dependencies: { "is-number": "6.0.0" },
+      }),
+      "yarn.lock": yarnLock(
+        yarnLockEntries["is-number-6"]("is-number@6.0.0"),
+        yarnLockEntries["is-number-7"]("is-number@>=6"),
+        yarnLockEntries["lodash"]("lodash@^4.17.21"),
+      ),
+    });
+
+    const lock = await migrate(String(dir));
+
+    expect(lock.workspaces).toEqual({
+      "": { name: "mono", devDependencies: { lodash: "^4.17.21" } },
+      "packages/a": { name: "a", version: "1.0.0", dependencies: { "is-number": ">=6" } },
+      "packages/b": { name: "b", version: "1.0.0", dependencies: { "is-number": "6.0.0" } },
+    });
+    expect(resolvedPackages(lock)).toEqual({
+      "a": "a@workspace:packages/a",
+      "b": "b@workspace:packages/b",
+      "b/is-number": "is-number@6.0.0",
+      "is-number": "is-number@7.0.0",
+      "lodash": "lodash@4.17.21",
+    });
+  });
+
+  test("workspace links, peers, and dependencies missing from yarn.lock", async () => {
+    using dir = tempDir("yarn-migration-workspaces-links", {
+      "package.json": JSON.stringify({
+        name: "mono",
+        private: true,
+        workspaces: ["packages/*"],
+        // Not in yarn.lock (added to package.json after the last `yarn install`).
+        dependencies: { "is-odd": "^3.0.1" },
+        devDependencies: { lodash: "^4.17.21" },
+        // yarn applied this when it wrote yarn.lock; the workspaces' lodash peers bind all the same.
+        resolutions: { lodash: "^4.17.21" },
+      }),
+      "packages/a/package.json": JSON.stringify({
+        name: "@mono/a",
+        version: "1.0.0",
+        dependencies: {
+          // Satisfied by the workspace's version, so yarn links it and yarn.lock has no entry for it.
+          "@mono/b": "^1.0.0",
+          "@mono/c": "workspace:*",
+          "is-number": "^7.0.0",
+          "left-pad": "^1.3.0",
+        },
+        peerDependencies: {
+          "is-number": ">=6",
+          "lodash": "*",
+          "react": ">=16",
+          "typescript": ">=4",
+        },
+        peerDependenciesMeta: { typescript: { optional: true } },
+      }),
+      "packages/b/package.json": JSON.stringify({
+        name: "@mono/b",
+        version: "1.2.0",
+        dependencies: { "is-number": "6.0.0" },
+      }),
+      "packages/c/package.json": JSON.stringify({
+        name: "@mono/c",
+        version: "0.0.1",
+        // Neither peer is satisfied by the first `is-number` / `lodash` yarn.lock has.
+        peerDependencies: { "is-number": "6.0.0", lodash: "^3.0.0" },
+      }),
+      "yarn.lock": yarnLock(
+        yarnLockEntries["is-number-6"]("is-number@6.0.0"),
+        yarnLockEntries["is-number-7"]("is-number@^7.0.0"),
+        yarnLockEntries["lodash"]("lodash@^4.17.21"),
+      ),
+    });
+
+    const lock = await migrate(String(dir));
+
+    expect(lock.workspaces).toEqual({
+      // `is-odd` has no yarn.lock entry, so it is left for `bun install` to resolve.
+      "": { name: "mono", devDependencies: { lodash: "^4.17.21" } },
+      "packages/a": {
+        name: "@mono/a",
+        version: "1.0.0",
+        // `left-pad` has no yarn.lock entry either.
+        dependencies: { "@mono/b": "^1.0.0", "@mono/c": "workspace:*", "is-number": "^7.0.0" },
+        // Peers bind to the packages yarn.lock has for their names; `react` has none.
+        peerDependencies: { "is-number": ">=6", lodash: "*", typescript: ">=4" },
+        optionalPeers: ["typescript"],
+      },
+      "packages/b": { name: "@mono/b", version: "1.2.0", dependencies: { "is-number": "6.0.0" } },
+      "packages/c": {
+        name: "@mono/c",
+        version: "0.0.1",
+        // `is-number` binds to the 6.0.0 entry; `lodash` falls back to the only lodash there is, as a
+        // fresh install would ("incorrect peer dependency").
+        peerDependencies: { "is-number": "6.0.0", lodash: "^3.0.0" },
+      },
+    });
+    expect(resolvedPackages(lock)).toEqual({
+      "@mono/a": "@mono/a@workspace:packages/a",
+      "@mono/b": "@mono/b@workspace:packages/b",
+      "@mono/b/is-number": "is-number@6.0.0",
+      "@mono/c": "@mono/c@workspace:packages/c",
+      "@mono/c/is-number": "is-number@6.0.0",
+      "is-number": "is-number@7.0.0",
+      "lodash": "lodash@4.17.21",
+    });
+  });
+});
+
+describe("bun install migrating a yarn.lock with workspaces", () => {
+  const verdaccio = new VerdaccioRegistry();
+
+  beforeAll(async () => {
+    await verdaccio.start();
+  });
+
+  afterAll(() => {
+    verdaccio.stop();
+  });
+
+  function registryEntry(name: string, specs: string, version: string) {
+    const manifest = JSON.parse(fs.readFileSync(join(verdaccio.packagesPath, name, "package.json"), "utf8"));
+    const { integrity, shasum } = manifest.versions[version].dist;
+    return `${specs}:
+  version "${version}"
+  resolved "${verdaccio.registryUrl()}${name}/-/${name}-${version}.tgz#${shasum}"
+  integrity ${integrity}
+`;
+  }
+
+  async function install(cwd: string) {
+    await using proc = Bun.spawn({
+      cmd: [bunExe(), "install"],
+      cwd,
+      env: bunEnv,
+      stdout: "pipe",
+      stderr: "pipe",
+      stdin: "ignore",
+    });
+    const [stdout, stderr, exitCode] = await Promise.all([proc.stdout.text(), proc.stderr.text(), proc.exited]);
+    expect(stderr).not.toContain("error:");
+    expect(exitCode).toBe(0);
+    return { stdout, stderr };
+  }
+
+  test("installs the versions yarn.lock resolved each workspace's dependencies to", async () => {
+    const { packageDir } = await verdaccio.createTestDir({
+      files: {
+        "package.json": JSON.stringify({
+          name: "mono",
+          private: true,
+          workspaces: ["packages/*"],
+          // Not in yarn.lock: resolved from the registry, without disturbing the locked versions.
+          dependencies: { "a-dep": "1.0.1" },
+        }),
+        "packages/a/package.json": JSON.stringify({
+          name: "a",
+          version: "1.0.0",
+          dependencies: { "no-deps": "^1.0.0" },
+        }),
+        "packages/b/package.json": JSON.stringify({
+          name: "b",
+          version: "1.0.0",
+          dependencies: { "no-deps": "1.0.1" },
+        }),
+        // The registry has no-deps 1.0.0, 1.0.1, 1.1.0 and 2.0.0; yarn resolved `^1.0.0` to 1.0.0.
+        // The `1.0.1` entry comes first, like yarn sorts it, and also satisfies `^1.0.0`.
+        "yarn.lock": yarnLock(
+          registryEntry("no-deps", "no-deps@1.0.1", "1.0.1"),
+          registryEntry("no-deps", "no-deps@^1.0.0", "1.0.0"),
+        ),
+      },
+    });
+
+    const first = await install(packageDir);
+    expect(first.stderr).toContain("migrated lockfile from yarn.lock");
+    expect(first.stderr).toContain("Saved lockfile");
+
+    const installed = nodeModulesPackages(packageDir);
+    expect(installed).toMatchInlineSnapshot(`
+      "node_modules/a-dep/a-dep@1.0.1
+      node_modules/no-deps/no-deps@1.0.0
+      packages/a/a@1.0.0
+      packages/b/b@1.0.0
+      packages/b/node_modules/no-deps/no-deps@1.0.1"
+    `);
+
+    const lockText = await Bun.file(join(packageDir, "bun.lock")).text();
+    expect(resolvedPackages(Bun.JSONC.parse(lockText) as MigratedLock)).toEqual({
+      "a": "a@workspace:packages/a",
+      "a-dep": "a-dep@1.0.1",
+      "b": "b@workspace:packages/b",
+      "b/no-deps": "no-deps@1.0.1",
+      "no-deps": "no-deps@1.0.0",
+    });
+
+    // The migrated lockfile describes the package.json files exactly, so the next install has nothing to change.
+    const second = await install(packageDir);
+    expect(second.stderr).not.toContain("Saved lockfile");
+    expect(await Bun.file(join(packageDir, "bun.lock")).text()).toBe(lockText);
+    expect(nodeModulesPackages(packageDir)).toBe(installed);
+  });
+});

From f02dbde4778573c0aceb298d2bbfce845e62782d Mon Sep 17 00:00:00 2001
From: robobun <117481402+robobun@users.noreply.github.com>
Date: Mon, 17 Aug 2026 01:54:43 +0000
Subject: [PATCH 129/258] install: fix yarn.lock migration panic on tarball
 URLs with "/-/" right after the host (#38803)

---
 src/install/yarn.rs                           | 28 ++++----
 .../migration/yarn-lock-migration.test.ts     | 68 +++++++++++++++++++
 2 files changed, 82 insertions(+), 14 deletions(-)

diff --git a/src/install/yarn.rs b/src/install/yarn.rs
index a610ce05ebc6..3914e7c0697a 100644
--- a/src/install/yarn.rs
+++ b/src/install/yarn.rs
@@ -166,6 +166,18 @@ impl<'a> Entry<'a> {
         strings::without_trailing_slash(path)
     }
 
+    /// `https://registry.npmjs.org/@scope/name/-/name-1.0.0.tgz` -> `@scope/name`
+    pub(crate) fn get_package_name_from_default_registry_url(url: &[u8]) -> Option<&[u8]> {
+        let host_and_path = url
+            .strip_prefix(b"https://")
+            .or_else(|| url.strip_prefix(b"http://"))?;
+        let path = host_and_path
+            .strip_prefix(b"registry.npmjs.org/")
+            .or_else(|| host_and_path.strip_prefix(b"registry.yarnpkg.com/"))?;
+        let name = &path[..strings::index_of(path, b"/-/")?];
+        (!name.is_empty()).then_some(name)
+    }
+
     pub(crate) fn parse_git_url(
         _yarn_lock: &YarnLock<'a>,
         version: &'a [u8],
@@ -835,20 +847,8 @@ pub(crate) fn migrate_yarn_lockfile<'a>(
             if entry.commit.is_some() && entry.git_repo_name.is_some() {
                 break 'blk entry.git_repo_name.as_deref().unwrap();
             } else if let (true, Some(resolved)) = (is_direct_url_dep, resolved_url) {
-                // https://registry.npmjs.org/package/-/package-version.tgz
-                if strings::index_of(resolved, b"registry.npmjs.org/").is_some()
-                    || strings::index_of(resolved, b"registry.yarnpkg.com/").is_some()
-                {
-                    if let Some(separator_idx) = strings::index_of(resolved, b"/-/") {
-                        if let Some(registry_idx) = strings::index_of(resolved, b"registry.") {
-                            let after_registry = &resolved[registry_idx..];
-                            if let Some(domain_slash) = strings::index_of(after_registry, b"/") {
-                                let package_start = registry_idx + domain_slash + 1;
-                                let extracted_name = &resolved[package_start..separator_idx];
-                                break 'blk extracted_name;
-                            }
-                        }
-                    }
+                if let Some(name) = Entry::get_package_name_from_default_registry_url(resolved) {
+                    break 'blk name;
                 }
             }
             break 'blk base_name;
diff --git a/test/cli/install/migration/yarn-lock-migration.test.ts b/test/cli/install/migration/yarn-lock-migration.test.ts
index 3df71b451933..9fb9dc00e9c6 100644
--- a/test/cli/install/migration/yarn-lock-migration.test.ts
+++ b/test/cli/install/migration/yarn-lock-migration.test.ts
@@ -903,6 +903,74 @@ needs-node-types@1.0.0:
     expect([...requestedManifests].sort()).toStrictEqual(["@types/node", "needs-node-types"]);
   });
 
+  test("package names are only read from the path of default registry tarball URLs", async () => {
+    // Dependencies declared as tarball URLs. A tarball on registry.npmjs.org / registry.yarnpkg.com
+    // is named after the path segment(s) before "/-/"; every other URL keeps the dependency's name.
+    const tarballs = {
+      "host-after-separator": "https://evil.example/-/registry.npmjs.org/x.tgz",
+      "nothing-before-separator": "https://registry.npmjs.org/-/y.tgz",
+      "empty-segment-before-separator": "https://registry.npmjs.org//-/z.tgz",
+      "mirror-with-registry-in-path": "https://registry.mirror.example/registry.npmjs.org/other/-/other-1.0.0.tgz",
+      "dash-package": "https://registry.npmjs.org/-/-/--0.0.1.tgz",
+      "scoped-npmjs-https": "https://registry.npmjs.org/@scope/real/-/real-1.0.0.tgz",
+      "npmjs-http": "http://registry.npmjs.org/real-a/-/real-a-1.0.0.tgz",
+      "yarnpkg-https": "https://registry.yarnpkg.com/real-b/-/real-b-1.0.0.tgz",
+      "yarnpkg-http": "http://registry.yarnpkg.com/real-c/-/real-c-1.0.0.tgz",
+    };
+
+    await using tmpDir = tempDir("yarn-migration-tarball-names", {
+      "package.json": JSON.stringify({ name: "tarball-names-test", version: "1.0.0", dependencies: tarballs }, null, 2),
+      "yarn.lock":
+        "# yarn lockfile v1\n\n\n" +
+        Object.entries(tarballs)
+          .map(([name, url]) => `"${name}@${url}":\n  version "1.0.0"\n  resolved "${url}"\n`)
+          .join("\n"),
+    });
+
+    // Every entry is a tarball package, so the migration has no registry manifests to fetch.
+    const registryRequests: string[] = [];
+    await using registry = Bun.serve({
+      port: 0,
+      fetch(req) {
+        registryRequests.push(new URL(req.url).pathname);
+        return new Response("not found", { status: 404 });
+      },
+    });
+
+    await using proc = Bun.spawn({
+      cmd: [bunExe(), "pm", "migrate", "-f"],
+      cwd: tmpDir,
+      env: {
+        ...bunEnv,
+        BUN_CONFIG_REGISTRY: registry.url.href,
+        BUN_INSTALL_CACHE_DIR: join(tmpDir, ".bun-cache"),
+      },
+      stdout: "pipe",
+      stderr: "pipe",
+      stdin: "ignore",
+    });
+
+    const [stdout, stderr, exitCode] = await Promise.all([proc.stdout.text(), proc.stderr.text(), proc.exited]);
+    expect(exitCode, stdout + stderr).toBe(0);
+
+    const lock = Bun.JSONC.parse(await Bun.file(join(tmpDir, "bun.lock")).text()) as { packages: unknown };
+    expect(lock.packages).toStrictEqual({
+      "host-after-separator": [`host-after-separator@${tarballs["host-after-separator"]}`, {}],
+      "nothing-before-separator": [`nothing-before-separator@${tarballs["nothing-before-separator"]}`, {}],
+      "empty-segment-before-separator": [
+        `empty-segment-before-separator@${tarballs["empty-segment-before-separator"]}`,
+        {},
+      ],
+      "mirror-with-registry-in-path": [`mirror-with-registry-in-path@${tarballs["mirror-with-registry-in-path"]}`, {}],
+      "dash-package": [`-@${tarballs["dash-package"]}`, {}],
+      "scoped-npmjs-https": [`@scope/real@${tarballs["scoped-npmjs-https"]}`, {}],
+      "npmjs-http": [`real-a@${tarballs["npmjs-http"]}`, {}],
+      "yarnpkg-https": [`real-b@${tarballs["yarnpkg-https"]}`, {}],
+      "yarnpkg-http": [`real-c@${tarballs["yarnpkg-http"]}`, {}],
+    });
+    expect(registryRequests).toStrictEqual([]);
+  });
+
   test("yarn.lock with resolutions", async () => {
     await using tmpDir = tempDir("yarn-migration-resolutions", {
       "package.json": JSON.stringify(

From 814929343e3801315f5bae424da486d485759ae8 Mon Sep 17 00:00:00 2001
From: robobun <117481402+robobun@users.noreply.github.com>
Date: Mon, 17 Aug 2026 01:55:37 +0000
Subject: [PATCH 130/258] install: name yarn.lock npm: alias packages after the
 alias spec, not the tarball URL (#38948)

---
 src/install/yarn.rs                           | 142 +++++------
 .../migration/yarn-lock-migration.test.ts     | 239 +++++++++++++++---
 2 files changed, 264 insertions(+), 117 deletions(-)

diff --git a/src/install/yarn.rs b/src/install/yarn.rs
index 3914e7c0697a..b9d6a85fc910 100644
--- a/src/install/yarn.rs
+++ b/src/install/yarn.rs
@@ -39,6 +39,8 @@ pub(crate) struct YarnLock<'a> {
 
 pub struct Entry<'a> {
     pub(crate) specs: Vec<&'a [u8]>,
+    /// Name of the package the entry resolves to; see `package_name_of`.
+    pub(crate) name: &'a [u8],
     pub(crate) version: &'a [u8],
     // Usually borrows from the input; owned when `parse_git_url` rewrites a
     // `github:` spec to a `https://github.com/...` URL.
@@ -61,6 +63,7 @@ impl<'a> Default for Entry<'a> {
     fn default() -> Self {
         Self {
             specs: Vec::new(),
+            name: b"",
             version: b"",
             resolved: None,
             integrity: None,
@@ -89,10 +92,45 @@ pub(crate) struct ParsedGitUrl<'a> {
 }
 
 pub(crate) struct ParsedNpmAlias<'a> {
+    pub(crate) name: &'a [u8],
     pub(crate) version: &'a [u8],
 }
 
 impl<'a> Entry<'a> {
+    /// The alias spec may follow plain specs of the same package on yarn's shared key line.
+    pub(crate) fn package_name_of(specs: &[&'a [u8]]) -> &'a [u8] {
+        if let Some(name) = specs.iter().find_map(|spec| Self::npm_alias_target(spec)) {
+            return name;
+        }
+        match specs.first() {
+            Some(spec) => Self::get_name_from_spec(spec),
+            None => b"",
+        }
+    }
+
+    /// `alias@npm:<name>@<range>` -> `<name>`; `None` for every other kind of spec.
+    pub(crate) fn npm_alias_target(spec: &[u8]) -> Option<&[u8]> {
+        let alias_end = strings::index_of(spec, b"@npm:")?;
+        let name = Self::parse_npm_alias(&spec[alias_end + 1..]).name;
+        (!name.is_empty()).then_some(name)
+    }
+
+    /// Whether the dependency was declared as a tarball URL (`name@https://...`).
+    pub(crate) fn has_direct_url_spec(&self) -> bool {
+        self.specs.iter().any(|spec| {
+            strings::index_of(spec, b"@https://").is_some()
+                || strings::index_of(spec, b"@http://").is_some()
+        })
+    }
+
+    /// Identity shared by consolidation and the package-id pass; git entries go by repository.
+    pub(crate) fn dedupe_name(&self) -> &[u8] {
+        match &self.git_repo_name {
+            Some(repo_name) if !self.has_direct_url_spec() => repo_name,
+            _ => self.name,
+        }
+    }
+
     pub(crate) fn get_name_from_spec(spec: &[u8]) -> &[u8] {
         let unquoted = if spec[0] == b'"' && spec[spec.len() - 1] == b'"' {
             &spec[1..spec.len() - 1]
@@ -237,37 +275,22 @@ impl<'a> Entry<'a> {
         })
     }
 
+    /// Splits `npm:<name>@<range>`; the `@` of a scoped `<name>` is not the separator.
     pub(crate) fn parse_npm_alias(version: &[u8]) -> ParsedNpmAlias<'_> {
-        if version.len() <= 4 {
-            return ParsedNpmAlias { version: b"*" };
-        }
-
-        let npm_part = &version[4..];
-        if let Some(at_idx) = strings::index_of(npm_part, b"@") {
+        let target = version.strip_prefix(b"npm:").unwrap_or(version);
+        let scope_len = usize::from(target.starts_with(b"@"));
+        let Some(at_idx) = strings::index_of_char_usize(&target[scope_len..], b'@') else {
             return ParsedNpmAlias {
-                version: if at_idx + 1 < npm_part.len() {
-                    &npm_part[at_idx + 1..]
-                } else {
-                    b"*"
-                },
+                name: target,
+                version: b"*",
             };
+        };
+        let (name, range) = target.split_at(scope_len + at_idx);
+        let range = &range[b"@".len()..];
+        ParsedNpmAlias {
+            name,
+            version: if range.is_empty() { b"*" } else { range },
         }
-        ParsedNpmAlias { version: b"*" }
-    }
-
-    /// Registry tarball URLs look like `<registry>/<name>/-/<basename>-<version>.tgz`,
-    /// where `<name>` spans two path segments (`@scope/name`) for scoped packages.
-    pub(crate) fn get_package_name_from_resolved_url(url: &[u8]) -> Option<&[u8]> {
-        let path = &url[..strings::index_of(url, b"/-/")?];
-        let (prefix, name) = strings::rsplit_once_char(path, b'/')?;
-        if name.is_empty() {
-            return None;
-        }
-        let scope_start = strings::last_index_of_char(prefix, b'/').map_or(0, |slash| slash + 1);
-        if prefix[scope_start..].starts_with(b"@") {
-            return Some(&path[scope_start..]);
-        }
-        Some(name)
     }
 }
 
@@ -327,6 +350,7 @@ impl<'a> YarnLock<'a> {
 
                 let mut new_entry = Entry::<'a> {
                     specs: current_specs.clone(),
+                    name: Entry::package_name_of(&current_specs),
                     version: b"", // assigned below when "version" key is parsed
                     ..Default::default()
                 };
@@ -474,15 +498,12 @@ impl<'a> YarnLock<'a> {
         if new_entry.specs.is_empty() {
             return Ok(());
         }
-        let package_name = Entry::get_name_from_spec(new_entry.specs[0]);
+        let dedupe_name = new_entry.dedupe_name();
 
         for existing_entry in self.entries.iter_mut() {
-            if existing_entry.specs.is_empty() {
-                continue;
-            }
-            let existing_name = Entry::get_name_from_spec(existing_entry.specs[0]);
-
-            if package_name == existing_name && new_entry.version == existing_entry.version {
+            if dedupe_name == existing_entry.dedupe_name()
+                && new_entry.version == existing_entry.version
+            {
                 let old_len = existing_entry.specs.len();
                 let mut combined_specs: Vec<&'a [u8]> =
                     Vec::with_capacity(old_len + new_entry.specs.len());
@@ -722,31 +743,7 @@ pub(crate) fn migrate_yarn_lockfile<'a>(
     let mut next_package_id: PackageID = PackageID::try_from(importer_count).expect("int cast");
 
     for (yarn_idx, entry) in yarn_lock.entries.iter().enumerate() {
-        let mut is_npm_alias = false;
-        let mut is_direct_url = false;
-        for spec in entry.specs.iter() {
-            if strings::index_of(spec, b"@npm:").is_some() {
-                is_npm_alias = true;
-                break;
-            }
-            if strings::index_of(spec, b"@https://").is_some()
-                || strings::index_of(spec, b"@http://").is_some()
-            {
-                is_direct_url = true;
-            }
-        }
-
-        let name: &[u8] = if let (true, Some(resolved)) = (is_npm_alias, entry.resolved.as_deref())
-        {
-            Entry::get_package_name_from_resolved_url(resolved)
-                .unwrap_or_else(|| Entry::get_name_from_spec(entry.specs[0]))
-        } else if is_direct_url {
-            Entry::get_name_from_spec(entry.specs[0])
-        } else if let Some(repo_name) = &entry.git_repo_name {
-            repo_name
-        } else {
-            Entry::get_name_from_spec(entry.specs[0])
-        };
+        let name: &[u8] = entry.dedupe_name();
         let version = entry.version;
 
         if let Some(existing) = package_versions.get(name).cloned() {
@@ -806,31 +803,8 @@ pub(crate) fn migrate_yarn_lockfile<'a>(
     let mut package_id_to_yarn_idx: Vec<usize> = vec![usize::MAX; next_package_id as usize];
 
     for (yarn_idx, entry) in yarn_lock.entries.iter().enumerate() {
-        let mut is_npm_alias = false;
-        for spec in entry.specs.iter() {
-            if strings::index_of(spec, b"@npm:").is_some() {
-                is_npm_alias = true;
-                break;
-            }
-        }
-
-        let mut is_direct_url_dep = false;
-        for spec in entry.specs.iter() {
-            if strings::index_of(spec, b"@https://").is_some()
-                || strings::index_of(spec, b"@http://").is_some()
-            {
-                is_direct_url_dep = true;
-                break;
-            }
-        }
-
-        let base_name: &[u8] =
-            if let (true, Some(resolved)) = (is_npm_alias, entry.resolved.as_deref()) {
-                Entry::get_package_name_from_resolved_url(resolved)
-                    .unwrap_or_else(|| Entry::get_name_from_spec(entry.specs[0]))
-            } else {
-                Entry::get_name_from_spec(entry.specs[0])
-            };
+        let is_direct_url_dep = entry.has_direct_url_spec();
+        let base_name: &[u8] = entry.name;
         let package_id = yarn_entry_to_package_id[yarn_idx];
 
         if (package_id as usize) < package_id_to_yarn_idx.len()
diff --git a/test/cli/install/migration/yarn-lock-migration.test.ts b/test/cli/install/migration/yarn-lock-migration.test.ts
index 9fb9dc00e9c6..c2435574fab6 100644
--- a/test/cli/install/migration/yarn-lock-migration.test.ts
+++ b/test/cli/install/migration/yarn-lock-migration.test.ts
@@ -3,6 +3,41 @@ import fs from "fs";
 import { bunEnv, bunExe, isDebug, nodeModulesPackages, tempDir, VerdaccioRegistry } from "harness";
 import { join } from "path";
 
+// After migrating, bun fetches the manifest of every migrated package by the name it recorded,
+// so the registry sees which package each alias was resolved to.
+async function migrateYarnLock(dir: string) {
+  const requestedManifests = new Set<string>();
+  await using registry = Bun.serve({
+    port: 0,
+    fetch(req) {
+      requestedManifests.add(decodeURIComponent(new URL(req.url).pathname.slice(1)));
+      return new Response("not found", { status: 404 });
+    },
+  });
+
+  await using proc = Bun.spawn({
+    cmd: [bunExe(), "pm", "migrate", "-f"],
+    cwd: dir,
+    env: {
+      ...bunEnv,
+      BUN_CONFIG_REGISTRY: registry.url.href,
+      BUN_INSTALL_CACHE_DIR: join(dir, ".bun-cache"),
+    },
+    stdout: "pipe",
+    stderr: "pipe",
+    stdin: "ignore",
+  });
+
+  const [stdout, stderr, exitCode] = await Promise.all([proc.stdout.text(), proc.stderr.text(), proc.exited]);
+
+  expect(stdout).toBe("");
+  expect(stderr).toContain("migrated lockfile from yarn.lock");
+  expect(exitCode).toBe(0);
+
+  const lock = Bun.JSONC.parse(await Bun.file(join(dir, "bun.lock")).text()) as { packages: unknown };
+  return { packages: lock.packages, requestedManifests: [...requestedManifests].sort() };
+}
+
 describe("yarn.lock migration basic", () => {
   test("simple yarn.lock migration produces correct bun.lock", async () => {
     await using tmpDir = tempDir("yarn-migration-simple", {
@@ -856,38 +891,8 @@ needs-node-types@1.0.0:
 `,
     });
 
-    // After migrating, bun fetches the manifest of every migrated package by the name it
-    // recorded, so the registry sees which package each alias was resolved to.
-    const requestedManifests = new Set<string>();
-    await using registry = Bun.serve({
-      port: 0,
-      fetch(req) {
-        requestedManifests.add(decodeURIComponent(new URL(req.url).pathname.slice(1)));
-        return new Response("not found", { status: 404 });
-      },
-    });
-
-    await using proc = Bun.spawn({
-      cmd: [bunExe(), "pm", "migrate", "-f"],
-      cwd: tmpDir,
-      env: {
-        ...bunEnv,
-        BUN_CONFIG_REGISTRY: registry.url.href,
-        BUN_INSTALL_CACHE_DIR: join(tmpDir, ".bun-cache"),
-      },
-      stdout: "pipe",
-      stderr: "pipe",
-      stdin: "ignore",
-    });
-
-    const [stdout, stderr, exitCode] = await Promise.all([proc.stdout.text(), proc.stderr.text(), proc.exited]);
-
-    expect(stdout).toBe("");
-    expect(stderr).toContain("migrated lockfile from yarn.lock");
-    expect(exitCode).toBe(0);
-
-    const lock = Bun.JSONC.parse(await Bun.file(join(tmpDir, "bun.lock")).text()) as { packages: unknown };
-    expect(lock.packages).toStrictEqual({
+    const { packages, requestedManifests } = await migrateYarnLock(tmpDir);
+    expect(packages).toStrictEqual({
       "@aliased/node-types": ["@types/node@20.11.5", "", {}, typesNode20Integrity],
       "@types/node": ["@types/node@18.19.0", "", {}, typesNode18Integrity],
       "my-node-types": ["@types/node@20.11.5", "", {}, typesNode20Integrity],
@@ -900,7 +905,175 @@ needs-node-types@1.0.0:
       "types-alias": ["@types/node@20.11.5", "", {}, typesNode20Integrity],
     });
 
-    expect([...requestedManifests].sort()).toStrictEqual(["@types/node", "needs-node-types"]);
+    expect(requestedManifests).toStrictEqual(["@types/node", "needs-node-types"]);
+  });
+
+  test.concurrent("yarn.lock npm aliases are named after the alias spec, not the tarball URL", async () => {
+    const corpBareIntegrity = "sha512-" + Buffer.alloc(64, 2).toString("base64");
+    const corpFooIntegrity = "sha512-" + Buffer.alloc(64, 3).toString("base64");
+    const barIntegrity = "sha512-" + Buffer.alloc(64, 4).toString("base64");
+    const stringWidthIntegrity = "sha512-" + Buffer.alloc(64, 5).toString("base64");
+    // GitHub Packages does not use the registry's `<name>/-/<file>.tgz` tarball layout.
+    const corpFooTarball =
+      "https://npm.pkg.github.com/download/@corp/foo/1.0.0/0123456789abcdef0123456789abcdef01234567";
+
+    // Four alias shapes: an alias without a range, a tarball URL with no package name in it, a
+    // tarball URL whose "/-/" directly follows the host, and yarn's usual key line on which the
+    // alias spec sorts before the plain specs of the package it points at.
+    await using tmpDir = tempDir("yarn-migration-alias-spec-names", {
+      "package.json": JSON.stringify(
+        {
+          name: "alias-spec-names",
+          version: "1.0.0",
+          dependencies: {
+            "bare-alias": "npm:@corp/bare",
+            "gh-alias": "npm:@corp/foo@1.0.0",
+            "host-alias": "npm:bar@1.0.0",
+            "string-width": "^4.1.0",
+            "string-width-cjs": "npm:string-width@^4.2.0",
+          },
+        },
+        null,
+        2,
+      ),
+      "yarn.lock": `# THIS IS AN AUTOGENERATED FILE. DO NOT EDIT THIS FILE DIRECTLY.
+# yarn lockfile v1
+
+
+"bare-alias@npm:@corp/bare":
+  version "2.0.0"
+  resolved "https://registry.yarnpkg.com/@corp/bare/-/bare-2.0.0.tgz#2222222222222222222222222222222222222222"
+  integrity ${corpBareIntegrity}
+
+"gh-alias@npm:@corp/foo@1.0.0":
+  version "1.0.0"
+  resolved "${corpFooTarball}"
+  integrity ${corpFooIntegrity}
+
+"host-alias@npm:bar@1.0.0":
+  version "1.0.0"
+  resolved "https://registry.npmjs.org/-/bar-1.0.0.tgz#4444444444444444444444444444444444444444"
+  integrity ${barIntegrity}
+
+"string-width-cjs@npm:string-width@^4.2.0", string-width@^4.1.0:
+  version "4.2.3"
+  resolved "https://registry.yarnpkg.com/string-width/-/string-width-4.2.3.tgz#5555555555555555555555555555555555555555"
+  integrity ${stringWidthIntegrity}
+`,
+    });
+
+    const { packages, requestedManifests } = await migrateYarnLock(tmpDir);
+    expect(packages).toStrictEqual({
+      "bare-alias": ["@corp/bare@2.0.0", "", {}, corpBareIntegrity],
+      "gh-alias": ["@corp/foo@1.0.0", corpFooTarball, {}, corpFooIntegrity],
+      "host-alias": ["bar@1.0.0", "", {}, barIntegrity],
+      "string-width": ["string-width@4.2.3", "", {}, stringWidthIntegrity],
+      "string-width-cjs": ["string-width@4.2.3", "", {}, stringWidthIntegrity],
+    });
+
+    expect(requestedManifests).toStrictEqual(["@corp/bare", "@corp/foo", "bar", "string-width"]);
+  });
+
+  test.concurrent("yarn.lock aliases of one name and version to different packages stay separate", async () => {
+    const xIntegrity = "sha512-" + Buffer.alloc(64, 6).toString("base64");
+    const yIntegrity = "sha512-" + Buffer.alloc(64, 7).toString("base64");
+    const fooIntegrity = "sha512-" + Buffer.alloc(64, 8).toString("base64");
+    const bazIntegrity = "sha512-" + Buffer.alloc(64, 9).toString("base64");
+
+    await using tmpDir = tempDir("yarn-migration-alias-same-name", {
+      "package.json": JSON.stringify(
+        {
+          name: "alias-same-name",
+          version: "1.0.0",
+          dependencies: {
+            x: "1.0.0",
+            y: "1.0.0",
+          },
+        },
+        null,
+        2,
+      ),
+      "yarn.lock": `# THIS IS AN AUTOGENERATED FILE. DO NOT EDIT THIS FILE DIRECTLY.
+# yarn lockfile v1
+
+
+"same@npm:baz@1.0.0":
+  version "1.0.0"
+  resolved "https://registry.yarnpkg.com/baz/-/baz-1.0.0.tgz#9999999999999999999999999999999999999999"
+  integrity ${bazIntegrity}
+
+"same@npm:foo@1.0.0":
+  version "1.0.0"
+  resolved "https://registry.yarnpkg.com/foo/-/foo-1.0.0.tgz#8888888888888888888888888888888888888888"
+  integrity ${fooIntegrity}
+
+x@1.0.0:
+  version "1.0.0"
+  resolved "https://registry.yarnpkg.com/x/-/x-1.0.0.tgz#6666666666666666666666666666666666666666"
+  integrity ${xIntegrity}
+  dependencies:
+    same "npm:foo@1.0.0"
+
+y@1.0.0:
+  version "1.0.0"
+  resolved "https://registry.yarnpkg.com/y/-/y-1.0.0.tgz#7777777777777777777777777777777777777777"
+  integrity ${yIntegrity}
+  dependencies:
+    same "npm:baz@1.0.0"
+`,
+    });
+
+    const { packages, requestedManifests } = await migrateYarnLock(tmpDir);
+    expect(packages).toStrictEqual({
+      "same": ["foo@1.0.0", "", {}, fooIntegrity],
+      "x": ["x@1.0.0", "", { dependencies: { same: "npm:foo@1.0.0" } }, xIntegrity],
+      "y": ["y@1.0.0", "", { dependencies: { same: "npm:baz@1.0.0" } }, yIntegrity],
+      "y/same": ["baz@1.0.0", "", {}, bazIntegrity],
+    });
+
+    expect(requestedManifests).toStrictEqual(["baz", "foo", "x", "y"]);
+  });
+
+  test.concurrent("yarn.lock git dependency keyed by a package name stays separate from an alias of it", async () => {
+    const lodashIntegrity = "sha512-" + Buffer.alloc(64, 10).toString("base64");
+    const forkCommit = "0123456789abcdef0123456789abcdef01234567";
+
+    // The fork keeps upstream's name and version, so the two entries share a name and a version.
+    await using tmpDir = tempDir("yarn-migration-git-vs-alias", {
+      "package.json": JSON.stringify(
+        {
+          name: "git-vs-alias",
+          version: "1.0.0",
+          dependencies: {
+            "lodash": "git+https://github.com/me/lodash-fork.git",
+            "my-lodash": "npm:lodash@4.17.21",
+          },
+        },
+        null,
+        2,
+      ),
+      "yarn.lock": `# THIS IS AN AUTOGENERATED FILE. DO NOT EDIT THIS FILE DIRECTLY.
+# yarn lockfile v1
+
+
+"lodash@git+https://github.com/me/lodash-fork.git":
+  version "4.17.21"
+  resolved "git+https://github.com/me/lodash-fork.git#${forkCommit}"
+
+"my-lodash@npm:lodash@4.17.21":
+  version "4.17.21"
+  resolved "https://registry.yarnpkg.com/lodash/-/lodash-4.17.21.tgz#aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa"
+  integrity ${lodashIntegrity}
+`,
+    });
+
+    const { packages, requestedManifests } = await migrateYarnLock(tmpDir);
+    expect(packages).toStrictEqual({
+      "lodash": [`lodash-fork@github:me/lodash-fork#${forkCommit.slice(0, 7)}`, {}, ""],
+      "my-lodash": ["lodash@4.17.21", "", {}, lodashIntegrity],
+    });
+
+    expect(requestedManifests).toStrictEqual(["lodash"]);
   });
 
   test("package names are only read from the path of default registry tarball URLs", async () => {

From c9769ceebfcb47d89e9dcba24fae6e09eada3f25 Mon Sep 17 00:00:00 2001
From: robobun <117481402+robobun@users.noreply.github.com>
Date: Mon, 17 Aug 2026 01:58:16 +0000
Subject: [PATCH 131/258] install: migrate yarn.lock registry entries that have
 no resolved field (#38985)

---
 src/install/yarn.rs                           |  51 +++--
 .../migration/yarn-lock-migration.test.ts     | 215 ++++++++++++++++++
 .../yarn-lock-mkdirp-no-resolved/yarn.lock    |   1 -
 3 files changed, 250 insertions(+), 17 deletions(-)

diff --git a/src/install/yarn.rs b/src/install/yarn.rs
index b9d6a85fc910..b37ca9b014dc 100644
--- a/src/install/yarn.rs
+++ b/src/install/yarn.rs
@@ -4,7 +4,7 @@ use std::io::Write as _;
 use crate::{Error, Features, GetJsonResult};
 use bun_collections::StringHashMap;
 use bun_install::bin::Bin;
-use bun_install::dependency::{self, Dependency, DependencyExt as _};
+use bun_install::dependency::{self, Dependency, DependencyExt as _, Tag as DepTag, TagExt as _};
 use bun_install::install::{self, PackageID, PackageManager};
 use bun_install::integrity::Integrity;
 // `bun_install::lockfile` is the column-accessor stub used by the
@@ -176,6 +176,20 @@ impl<'a> Entry<'a> {
         version.starts_with(b"npm:")
     }
 
+    /// A spec asked a registry for this entry (a semver range, a dist-tag, or an `npm:` alias of one).
+    pub(crate) fn is_registry_entry(&self) -> bool {
+        self.specs.iter().any(|spec| {
+            let name = Entry::get_name_from_spec(spec);
+            let range = spec.get(name.len() + 1..).unwrap_or(b"");
+            let range = if Entry::is_npm_alias(range) {
+                Entry::parse_npm_alias(range).version
+            } else {
+                range
+            };
+            DepTag::infer(range).is_npm()
+        })
+    }
+
     pub(crate) fn is_remote_tarball(version: &[u8]) -> bool {
         version.starts_with(b"https://") && version.ends_with(b".tgz")
     }
@@ -892,11 +906,15 @@ pub(crate) fn migrate_yarn_lockfile<'a>(
                     }
                 }
                 break 'blk Resolution::default();
-            } else if let Some(resolved) = resolved_url {
-                if is_direct_url_dep {
-                    break 'blk Resolution::init(ResolutionValue::RemoteTarball(
-                        sbuf!().append(resolved)?,
-                    ));
+            } else {
+                if let Some(resolved) = resolved_url {
+                    if is_direct_url_dep {
+                        break 'blk Resolution::init(ResolutionValue::RemoteTarball(
+                            sbuf!().append(resolved)?,
+                        ));
+                    }
+                } else if !entry.is_registry_entry() {
+                    break 'blk Resolution::default();
                 }
 
                 let version = sbuf!().append(entry.version)?;
@@ -906,7 +924,9 @@ pub(crate) fn migrate_yarn_lockfile<'a>(
                     // Yarn v1 lockfiles legitimately contain entries without an integrity field
                     // (workspace deps, file:, codeload tarballs), so migration intentionally
                     // accepts off-registry tarball URLs without integrity instead of failing.
-                    if Entry::is_remote_tarball(resolved) || resolved.ends_with(b".tgz") {
+                    if let Some(resolved) = resolved_url
+                        && (Entry::is_remote_tarball(resolved) || resolved.ends_with(b".tgz"))
+                    {
                         break 'blk Resolution::init(ResolutionValue::RemoteTarball(
                             sbuf!().append(resolved)?,
                         ));
@@ -917,21 +937,20 @@ pub(crate) fn migrate_yarn_lockfile<'a>(
                 // `has_trusted_dependency` compares this URL with the canonical registry
                 // tarball URL, so it must be the bare URL a fresh install records: no
                 // `#sha1`, and no RemoteTarball just because the URL ends in `.tgz`.
-                let is_default_registry = resolved.starts_with(b"https://registry.yarnpkg.com/")
-                    || resolved.starts_with(b"https://registry.npmjs.org/");
-
-                let url = if is_default_registry {
-                    SemverString::default()
-                } else {
-                    sbuf!().append(resolved)?
+                // An empty url is fetched by name@version from the configured registry.
+                let is_default_registry = |resolved: &[u8]| {
+                    resolved.starts_with(b"https://registry.yarnpkg.com/")
+                        || resolved.starts_with(b"https://registry.npmjs.org/")
+                };
+                let url = match resolved_url {
+                    Some(resolved) if !is_default_registry(resolved) => sbuf!().append(resolved)?,
+                    _ => SemverString::default(),
                 };
 
                 break 'blk Resolution::init(ResolutionValue::Npm(VersionedURL {
                     url,
                     version: result.version.min(),
                 }));
-            } else {
-                break 'blk Resolution::default();
             }
         };
 
diff --git a/test/cli/install/migration/yarn-lock-migration.test.ts b/test/cli/install/migration/yarn-lock-migration.test.ts
index c2435574fab6..d53917499301 100644
--- a/test/cli/install/migration/yarn-lock-migration.test.ts
+++ b/test/cli/install/migration/yarn-lock-migration.test.ts
@@ -2481,3 +2481,218 @@ describe("bun install migrating a yarn.lock with workspaces", () => {
     expect(nodeModulesPackages(packageDir)).toBe(installed);
   });
 });
+
+// A registry entry can carry `version` (and `integrity`) but no `resolved` line. That is
+// everything bun keeps of a registry entry anyway (a default-registry URL is discarded), so it
+// migrates like any other registry entry instead of being dropped; package-lock.json migration
+// treats a missing `resolved` the same way. Whether an entry is a registry entry is decided by
+// its specs: yarn also writes `link:` and path entries with a `version` line and no `resolved`.
+describe.concurrent("yarn.lock entries without a resolved field", () => {
+  const REGISTRY_PACKAGES = join(import.meta.dir, "..", "registry", "packages");
+
+  // Serves the verdaccio fixture packages from disk (404 for anything else) and records every path requested.
+  function localRegistry() {
+    const requests: string[] = [];
+    let url = "";
+    const server = Bun.serve({
+      port: 0,
+      async fetch(req) {
+        const { pathname } = new URL(req.url);
+        requests.push(pathname);
+        const tarball = pathname.match(/^\/([^/]+)\/-\/([^/]+\.tgz)$/);
+        const file = tarball
+          ? Bun.file(join(REGISTRY_PACKAGES, tarball[1], tarball[2]))
+          : Bun.file(join(REGISTRY_PACKAGES, pathname.slice(1), "package.json"));
+        if (!(await file.exists())) return new Response("not found", { status: 404 });
+        if (tarball) return new Response(file);
+        return Response.json(
+          JSON.parse((await file.text()).replaceAll(/http:\/\/(?:http:\/\/)?localhost:4873\//g, url)),
+        );
+      },
+    });
+    url = `http://localhost:${server.port}/`;
+    return {
+      url,
+      requests,
+      integrity: (name: string, version: string): string =>
+        JSON.parse(fs.readFileSync(join(REGISTRY_PACKAGES, name, "package.json"), "utf8")).versions[version].dist
+          .integrity,
+      [Symbol.dispose]() {
+        server.stop(true);
+      },
+    };
+  }
+
+  async function runBun(dir: string, registryUrl: string, ...args: string[]) {
+    await using proc = Bun.spawn({
+      cmd: [bunExe(), ...args],
+      cwd: dir,
+      env: { ...bunEnv, BUN_CONFIG_REGISTRY: registryUrl, BUN_INSTALL_CACHE_DIR: join(dir, ".bun-cache") },
+      stdout: "pipe",
+      stderr: "pipe",
+      stdin: "ignore",
+    });
+    const [stdout, stderr, exitCode] = await Promise.all([proc.stdout.text(), proc.stderr.text(), proc.exited]);
+    return { stdout, stderr, exitCode };
+  }
+
+  const lockPackages = async (dir: string) =>
+    (Bun.JSONC.parse(await Bun.file(join(dir, "bun.lock")).text()) as { packages: unknown }).packages;
+
+  test("bun pm migrate keeps them as registry packages", async () => {
+    using registry = localRegistry();
+    const parentIntegrity = "sha512-" + Buffer.alloc(64, 1).toString("base64");
+    const leafIntegrity = "sha512-" + Buffer.alloc(64, 2).toString("base64");
+    const scopedIntegrity = "sha512-" + Buffer.alloc(64, 3).toString("base64");
+    const taggedIntegrity = "sha512-" + Buffer.alloc(64, 4).toString("base64");
+
+    await using dir = tempDir("yarn-migration-no-resolved", {
+      "package.json": JSON.stringify({
+        name: "no-resolved",
+        version: "1.0.0",
+        dependencies: {
+          "@scope/pinned": "2.0.0",
+          "no-integrity": "^3.0.0",
+          "parent": "^1.0.0",
+          "tagged": "next",
+        },
+      }),
+      "yarn.lock": `# THIS IS AN AUTOGENERATED FILE. DO NOT EDIT THIS FILE DIRECTLY.
+# yarn lockfile v1
+
+
+"@scope/pinned@2.0.0":
+  version "2.0.0"
+  integrity ${scopedIntegrity}
+
+leaf@^1.0.0:
+  version "1.2.3"
+  integrity ${leafIntegrity}
+
+no-integrity@^3.0.0:
+  version "3.0.1"
+
+parent@^1.0.0:
+  version "1.0.0"
+  resolved "https://registry.yarnpkg.com/parent/-/parent-1.0.0.tgz#0000000000000000000000000000000000000000"
+  integrity ${parentIntegrity}
+  dependencies:
+    leaf "^1.0.0"
+
+tagged@next:
+  version "5.0.0-beta.1"
+  integrity ${taggedIntegrity}
+`,
+    });
+
+    const { stderr, exitCode } = await runBun(String(dir), registry.url, "pm", "migrate", "-f");
+    expect(stderr).toContain("migrated lockfile from yarn.lock");
+    expect(exitCode).toBe(0);
+
+    expect(await lockPackages(String(dir))).toStrictEqual({
+      "@scope/pinned": ["@scope/pinned@2.0.0", "", {}, scopedIntegrity],
+      "leaf": ["leaf@1.2.3", "", {}, leafIntegrity],
+      "no-integrity": ["no-integrity@3.0.1", "", {}, ""],
+      "parent": ["parent@1.0.0", "", { dependencies: { leaf: "^1.0.0" } }, parentIntegrity],
+      "tagged": ["tagged@5.0.0-beta.1", "", {}, taggedIntegrity],
+    });
+  });
+
+  test("bun pm migrate does not turn link:, path, tarball URL or alias entries into registry packages", async () => {
+    using registry = localRegistry();
+    const keptIntegrity = "sha512-" + Buffer.alloc(64, 5).toString("base64");
+    const aliasIntegrity = "sha512-" + Buffer.alloc(64, 6).toString("base64");
+
+    // The `bare` and `linked` entries are what yarn 1.22 writes for a path and a `link:`
+    // dependency: a `version` line (the target's, or 0.0.0) and no `resolved`. Nothing in these
+    // entries is a registry package, and which package `lodash-alias` is only follows from its
+    // tarball URL, so none of them may be migrated as `<name>@<version>` from the registry.
+    // (They are still not migrated at all; `kept` shows the registry entries next to them are.)
+    await using dir = tempDir("yarn-migration-no-resolved-non-registry", {
+      "package.json": JSON.stringify({
+        name: "no-resolved-non-registry",
+        version: "1.0.0",
+        dependencies: {
+          "bare": "../linked",
+          "from-url": "https://example.com/from-url-1.0.0.tgz",
+          "kept": "^1.0.0",
+          "linked": "link:../linked",
+          "lodash-alias": "npm:lodash@4.17.21",
+        },
+      }),
+      "yarn.lock": `# THIS IS AN AUTOGENERATED FILE. DO NOT EDIT THIS FILE DIRECTLY.
+# yarn lockfile v1
+
+
+bare@../linked:
+  version "3.2.1"
+
+"from-url@https://example.com/from-url-1.0.0.tgz":
+  version "1.0.0"
+
+kept@^1.0.0:
+  version "1.0.0"
+  integrity ${keptIntegrity}
+
+"linked@link:../linked":
+  version "0.0.0"
+  uid ""
+
+lodash-alias@npm:lodash@4.17.21:
+  version "4.17.21"
+  integrity ${aliasIntegrity}
+`,
+    });
+
+    const { stderr, exitCode } = await runBun(String(dir), registry.url, "pm", "migrate", "-f");
+    expect(stderr).toContain("migrated lockfile from yarn.lock");
+    expect(exitCode).toBe(0);
+
+    expect(await lockPackages(String(dir))).toStrictEqual({
+      kept: ["kept@1.0.0", "", {}, keptIntegrity],
+    });
+  });
+
+  test("bun install installs the pinned version from the configured registry", async () => {
+    using registry = localRegistry();
+    const integrity = registry.integrity("no-deps", "1.0.0");
+
+    // The registry also has no-deps 1.0.1 and 1.1.0, so resolving ^1.0.0 afresh would not pick 1.0.0.
+    await using dir = tempDir("yarn-migration-no-resolved-install", {
+      "package.json": JSON.stringify({
+        name: "no-resolved-install",
+        version: "1.0.0",
+        dependencies: { "no-deps": "^1.0.0" },
+      }),
+      "yarn.lock": `# THIS IS AN AUTOGENERATED FILE. DO NOT EDIT THIS FILE DIRECTLY.
+# yarn lockfile v1
+
+
+no-deps@^1.0.0:
+  version "1.0.0"
+  integrity ${integrity}
+`,
+    });
+
+    const install = await runBun(String(dir), registry.url, "install");
+    expect(install.stderr).toContain("migrated lockfile from yarn.lock");
+    expect(install.stdout).toContain("+ no-deps@1.0.0");
+    expect(install.exitCode).toBe(0);
+
+    expect(await Bun.file(join(String(dir), "node_modules", "no-deps", "package.json")).json()).toStrictEqual({
+      name: "no-deps",
+      version: "1.0.0",
+    });
+    expect(await lockPackages(String(dir))).toStrictEqual({ "no-deps": ["no-deps@1.0.0", "", {}, integrity] });
+    // Migration reads the manifest for bin/os/cpu metadata; the install itself goes straight to the pinned tarball.
+    expect(registry.requests).toStrictEqual(["/no-deps", "/no-deps/-/no-deps-1.0.0.tgz"]);
+
+    // The written bun.lock is complete: a frozen install accepts it as is, without going back to the registry.
+    const lockText = await Bun.file(join(String(dir), "bun.lock")).text();
+    const frozen = await runBun(String(dir), registry.url, "install", "--frozen-lockfile");
+    expect(frozen.stdout).toContain("(no changes)");
+    expect(frozen.exitCode).toBe(0);
+    expect(await Bun.file(join(String(dir), "bun.lock")).text()).toBe(lockText);
+    expect(registry.requests).toStrictEqual(["/no-deps", "/no-deps/-/no-deps-1.0.0.tgz"]);
+  });
+});
diff --git a/test/cli/install/migration/yarn/yarn-lock-mkdirp-no-resolved/yarn.lock b/test/cli/install/migration/yarn/yarn-lock-mkdirp-no-resolved/yarn.lock
index 539babc61f9a..4be59c5367f9 100644
--- a/test/cli/install/migration/yarn/yarn-lock-mkdirp-no-resolved/yarn.lock
+++ b/test/cli/install/migration/yarn/yarn-lock-mkdirp-no-resolved/yarn.lock
@@ -4,5 +4,4 @@
 
 mkdirp@^1.0.2:
   version "1.0.4"
-  resolved "https://registry.yarnpkg.com/mkdirp/-/mkdirp-1.0.4.tgz#3eb5ed62622756d79a5f0e2a221dfebad75c2f7e"
   integrity sha512-vVqVZQyf3WLx2Shd0qJ9xuvqgAyKPLAiqITEtqW0oIUjzo3PePDd6fW9iFz30ef7Ysp/oiWqbhszeGWW2T6Gzw==

From 3eddf99da1b5757f81144939e8cc53defdaec2ff Mon Sep 17 00:00:00 2001
From: robobun <117481402+robobun@users.noreply.github.com>
Date: Mon, 17 Aug 2026 02:01:35 +0000
Subject: [PATCH 132/258] install: skip yarn.lock entries the migration cannot
 build a resolution for (#39001)

---
 src/install/yarn.rs                           |  47 +++++-
 .../migration/yarn-lock-migration.test.ts     | 152 ++++++++++++++++++
 2 files changed, 196 insertions(+), 3 deletions(-)

diff --git a/src/install/yarn.rs b/src/install/yarn.rs
index b37ca9b014dc..b50d72f727f3 100644
--- a/src/install/yarn.rs
+++ b/src/install/yarn.rs
@@ -816,6 +816,16 @@ pub(crate) fn migrate_yarn_lockfile<'a>(
 
     let mut package_id_to_yarn_idx: Vec<usize> = vec![usize::MAX; next_package_id as usize];
 
+    // The ids handed out above count every distinct name@version, but an entry
+    // whose resolution cannot be built is not appended below, and a package's id
+    // has to be its index in `this.packages`. Maps the ids above to the appended
+    // ones; a skipped entry stays `INVALID_PACKAGE_ID`, which gives its dependents
+    // the same unresolved edge as a spec with no yarn.lock entry at all.
+    let mut appended_package_ids: Vec<PackageID> =
+        vec![install::INVALID_PACKAGE_ID; next_package_id as usize];
+    let silent = manager.options.log_level.is_silent();
+
+
     for (yarn_idx, entry) in yarn_lock.entries.iter().enumerate() {
         let is_direct_url_dep = entry.has_direct_url_spec();
         let base_name: &[u8] = entry.name;
@@ -954,7 +964,34 @@ pub(crate) fn migrate_yarn_lockfile<'a>(
             }
         };
 
-        debug_assert_eq!(this.packages.len(), package_id as usize);
+        if resolution.tag == ResolutionTag::Uninitialized {
+            if !silent {
+                let specs = bstr::join(", ", &entry.specs);
+                let specs = bstr::BStr::new(&specs);
+                if entry.version.is_empty() {
+                    bun_core::warn!(
+                        "skipped \"{}\" from yarn.lock: missing \"version\" field",
+                        specs
+                    );
+                } else if !Semver::Version::parse_utf8(entry.version).valid {
+                    bun_core::warn!(
+                        "skipped \"{}\" from yarn.lock: invalid version \"{}\"",
+                        specs,
+                        bstr::BStr::new(entry.version)
+                    );
+                } else {
+                    bun_core::warn!(
+                        "skipped \"{}\" from yarn.lock: missing \"resolved\" field",
+                        specs
+                    );
+                }
+            }
+            continue;
+        }
+
+        let appended_id = PackageID::try_from(this.packages.len()).expect("int cast");
+        appended_package_ids[package_id as usize] = appended_id;
+
         this.packages.append(LockfilePackage {
             name: pkg_name,
             name_hash,
@@ -962,7 +999,7 @@ pub(crate) fn migrate_yarn_lockfile<'a>(
             dependencies: Default::default(),
             resolutions: Default::default(),
             meta: PackageMeta {
-                id: package_id,
+                id: appended_id,
                 origin: Origin::Npm,
                 arch: if let Some(cpu_list) = &entry.cpu {
                     let mut arch = npm::Architecture::NONE.negatable();
@@ -994,7 +1031,11 @@ pub(crate) fn migrate_yarn_lockfile<'a>(
             bin: Bin::init(),
             scripts: Default::default(),
         })?;
-        this.get_or_put_id(package_id, name_hash)?;
+        this.get_or_put_id(appended_id, name_hash)?;
+    }
+
+    for package_id in yarn_entry_to_package_id.iter_mut() {
+        *package_id = appended_package_ids[*package_id as usize];
     }
 
     let mut spec_to_package_id: StringHashMap<PackageID> = StringHashMap::new();
diff --git a/test/cli/install/migration/yarn-lock-migration.test.ts b/test/cli/install/migration/yarn-lock-migration.test.ts
index d53917499301..2337497f69a0 100644
--- a/test/cli/install/migration/yarn-lock-migration.test.ts
+++ b/test/cli/install/migration/yarn-lock-migration.test.ts
@@ -2696,3 +2696,155 @@ no-deps@^1.0.0:
     expect(registry.requests).toStrictEqual(["/no-deps", "/no-deps/-/no-deps-1.0.0.tgz"]);
   });
 });
+
+describe.concurrent("yarn.lock entries the migration cannot build a resolution for", () => {
+  // After migrating, bun fetches the manifest of every migrated registry package (for bin
+  // metadata), so the registry has to answer for "pinned". Nothing below downloads a tarball.
+  function manifestOnlyRegistry() {
+    return Bun.serve({
+      port: 0,
+      fetch(req, server) {
+        const name = new URL(req.url).pathname.slice(1);
+        if (name !== "pinned") return new Response("not found", { status: 404 });
+        return Response.json({
+          name,
+          "dist-tags": { latest: "2.0.0" },
+          versions: { "2.0.0": { name, version: "2.0.0", dist: { tarball: `${server.url}pinned-2.0.0.tgz` } } },
+        });
+      },
+    });
+  }
+
+  const registryTarball = (name: string, version: string) =>
+    `https://registry.yarnpkg.com/${name}/-/${name}-${version}.tgz#0000000000000000000000000000000000000000`;
+
+  const header = "# yarn lockfile v1\n\n\n";
+  const pinnedEntry = (dependencies = "") =>
+    `pinned@^2.0.0:\n  version "2.0.0"\n  resolved "${registryTarball("pinned", "2.0.0")}"\n${dependencies}`;
+  const brokenEntry = `broken@^1.0.0:\n  version "not-a-version"\n  resolved "${registryTarball("broken", "1.0.0")}"\n`;
+  const brokenWarning = 'warn: skipped "broken@^1.0.0" from yarn.lock: invalid version "not-a-version"';
+
+  async function run(cwd: string, registry: string, ...args: string[]) {
+    await using proc = Bun.spawn({
+      cmd: [bunExe(), ...args],
+      cwd,
+      env: { ...bunEnv, BUN_CONFIG_REGISTRY: registry, BUN_INSTALL_CACHE_DIR: join(cwd, ".bun-cache") },
+      stdout: "pipe",
+      stderr: "pipe",
+      stdin: "ignore",
+    });
+    const [stdout, stderr, exitCode] = await Promise.all([proc.stdout.text(), proc.stderr.text(), proc.exited]);
+    return { stdout, stderr, exitCode };
+  }
+
+  // A skipped entry leaves its dependents with the same unresolved edge as a spec that has no
+  // yarn.lock entry at all, which `bun install` reports instead of resolving. Before the entry was
+  // skipped, install crashed on the package's missing resolution (debug builds) or wrote a bun.lock
+  // that listed the dependency without a package for it.
+  test("bun install: a root dependency on a skipped entry is reported as unresolved", async () => {
+    using registry = manifestOnlyRegistry();
+    using dir = tempDir("yarn-migration-skipped-root-dep", {
+      "package.json": JSON.stringify({ name: "app", dependencies: { broken: "^1.0.0", pinned: "^2.0.0" } }),
+      "yarn.lock": header + brokenEntry + "\n" + pinnedEntry(),
+    });
+
+    const { stderr, exitCode } = await run(String(dir), registry.url.href, "install", "--lockfile-only");
+
+    expect(stderr).toContain(brokenWarning);
+    expect(stderr).toContain("error: broken@^1.0.0 failed to resolve");
+    expect(exitCode).toBe(1);
+  });
+
+  test("bun install: a transitive dependency on a skipped entry is reported as unresolved", async () => {
+    using registry = manifestOnlyRegistry();
+    using dir = tempDir("yarn-migration-skipped-transitive-dep", {
+      "package.json": JSON.stringify({ name: "app", dependencies: { pinned: "^2.0.0" } }),
+      "yarn.lock": header + brokenEntry + "\n" + pinnedEntry('  dependencies:\n    broken "^1.0.0"\n'),
+    });
+
+    const { stderr, exitCode } = await run(String(dir), registry.url.href, "install", "--lockfile-only");
+
+    expect(stderr).toContain(brokenWarning);
+    expect(stderr).toContain("error: broken@^1.0.0 failed to resolve");
+    expect(exitCode).toBe(1);
+  });
+
+  const skippedEntries: [label: string, brokenRange: string, entry: string, warning: string][] = [
+    [
+      "version is not semver",
+      "^1.0.0",
+      brokenEntry,
+      'skipped "broken@^1.0.0" from yarn.lock: invalid version "not-a-version"',
+    ],
+    [
+      "version is not semver and there is no resolved field",
+      "^1.0.0",
+      'broken@^1.0.0:\n  version "not-a-version"\n',
+      'skipped "broken@^1.0.0" from yarn.lock: invalid version "not-a-version"',
+    ],
+    [
+      "there is no version field",
+      "^1.0.0",
+      `broken@^1.0.0:\n  resolved "${registryTarball("broken", "1.0.0")}"\n`,
+      'skipped "broken@^1.0.0" from yarn.lock: missing "version" field',
+    ],
+    [
+      "npm: alias without a resolved field",
+      "npm:actual@^1.0.0",
+      '"broken@npm:actual@^1.0.0":\n  version "1.0.0"\n',
+      'skipped "broken@npm:actual@^1.0.0" from yarn.lock: missing "resolved" field',
+    ],
+    [
+      "tarball URL spec without a resolved field",
+      "https://example.com/broken-1.0.0.tgz",
+      '"broken@https://example.com/broken-1.0.0.tgz":\n  version "1.0.0"\n',
+      'skipped "broken@https://example.com/broken-1.0.0.tgz" from yarn.lock: missing "resolved" field',
+    ],
+    [
+      "entry shared by several specs",
+      "^1.0.0",
+      `broken@^1.0.0, broken@^1.2.0:\n  version "not-a-version"\n  resolved "${registryTarball("broken", "1.0.0")}"\n`,
+      'skipped "broken@^1.0.0, broken@^1.2.0" from yarn.lock: invalid version "not-a-version"',
+    ],
+  ];
+
+  test.each(skippedEntries)(
+    "bun pm migrate warns and keeps the other entries when %s",
+    async (_, range, entry, warning) => {
+      using registry = manifestOnlyRegistry();
+      using dir = tempDir("yarn-migration-skipped-entry", {
+        "package.json": JSON.stringify({ name: "app", dependencies: { broken: range, pinned: "^2.0.0" } }),
+        "yarn.lock": header + entry + "\n" + pinnedEntry(),
+      });
+
+      const { stderr, exitCode } = await run(String(dir), registry.url.href, "pm", "migrate", "-f");
+
+      expect(stderr).toContain(`warn: ${warning}`);
+      expect(stderr).toContain("migrated lockfile from yarn.lock");
+      expect(exitCode).toBe(0);
+
+      const bunLock = await Bun.file(join(String(dir), "bun.lock")).text();
+      expect(bunLock).toContain('"pinned": ["pinned@2.0.0", "", {}, ""]');
+      expect(bunLock).not.toContain('"broken": [');
+    },
+  );
+
+  test("bun pm migrate keeps a version of a package whose other version is skipped", async () => {
+    using registry = manifestOnlyRegistry();
+    using dir = tempDir("yarn-migration-skipped-sibling-version", {
+      "package.json": JSON.stringify({ name: "app", dependencies: { pinned: "^2.0.0" } }),
+      "yarn.lock":
+        header +
+        `pinned@^1.0.0:\n  version "not-a-version"\n  resolved "${registryTarball("pinned", "1.0.0")}"\n\n` +
+        pinnedEntry(),
+    });
+
+    const { stderr, exitCode } = await run(String(dir), registry.url.href, "pm", "migrate", "-f");
+
+    expect(stderr).toContain('warn: skipped "pinned@^1.0.0" from yarn.lock: invalid version "not-a-version"');
+    expect(exitCode).toBe(0);
+
+    const bunLock = await Bun.file(join(String(dir), "bun.lock")).text();
+    expect(bunLock).toContain('"pinned": ["pinned@2.0.0", "", {}, ""]');
+  });
+});

From 9c8d7f347fba72cbd9cae2256cc571979cd23953 Mon Sep 17 00:00:00 2001
From: robobun <117481402+robobun@users.noreply.github.com>
Date: Mon, 17 Aug 2026 02:03:04 +0000
Subject: [PATCH 133/258] install: migrate npm-shrinkwrap.json like
 package-lock.json (#38861)

---
 docs/pm/lockfile.mdx                       |   6 +-
 src/install/migration.rs                   |  57 +++++-----
 src/install/migration/npm_lock.rs          |  19 +++-
 test/cli/install/migration/migrate.test.ts | 121 ++++++++++++++++++++-
 4 files changed, 170 insertions(+), 33 deletions(-)

diff --git a/docs/pm/lockfile.mdx b/docs/pm/lockfile.mdx
index 32be45828d79..4963fcb0d102 100644
--- a/docs/pm/lockfile.mdx
+++ b/docs/pm/lockfile.mdx
@@ -63,9 +63,11 @@ The `lockfileVersion` field at the top of `bun.lock` records its format version.
 When you run `bun install` in a project without a `bun.lock`, Bun automatically migrates existing lockfiles:
 
 - `yarn.lock` (v1)
-- `package-lock.json` (npm, `lockfileVersion` 2, 3 or 4)
+- `npm-shrinkwrap.json` and `package-lock.json` (npm, `lockfileVersion` 2, 3 or 4)
 - `pnpm-lock.yaml` (pnpm)
 
-Bun does not migrate a `package-lock.json` from npm 6 or older (`lockfileVersion` 1); it prints a warning and resolves from `package.json` instead.
+When a project has both npm lockfiles, Bun reads `npm-shrinkwrap.json` and ignores `package-lock.json`, as npm does.
+
+Bun does not migrate an npm lockfile from npm 6 or older (`lockfileVersion` 1); it prints a warning and resolves from `package.json` instead.
 
 Bun preserves the original lockfile. You can remove it manually after verification.
diff --git a/src/install/migration.rs b/src/install/migration.rs
index 50a8bf4edcb3..065ccf45447f 100644
--- a/src/install/migration.rs
+++ b/src/install/migration.rs
@@ -33,44 +33,49 @@ pub fn detect_and_load_other_lockfile<'a>(
     manager: &mut PackageManager,
     log: &mut bun_ast::Log,
 ) -> LoadResult<'a> {
-    // check for package-lock.json, yarn.lock, etc...
+    // check for npm-shrinkwrap.json, package-lock.json, yarn.lock, etc...
     // if it exists, do an in-memory migration
 
-    'npm: {
+    // npm itself reads npm-shrinkwrap.json over package-lock.json; the two share a format.
+    for (lockfile_name, lockfile_name_z) in [
+        ("npm-shrinkwrap.json", zstr!("npm-shrinkwrap.json")),
+        ("package-lock.json", zstr!("package-lock.json")),
+    ] {
         let timer = std::time::Instant::now();
-        let Ok(lockfile) = File::openat(dir, b"package-lock.json", O::RDONLY, 0) else {
-            break 'npm;
+        let Ok(lockfile) = File::openat(dir, lockfile_name_z, O::RDONLY, 0) else {
+            continue;
         };
         // file closes on Drop
         let mut lockfile_path_buf = PathBuffer::uninit();
         let Ok(lockfile_path) = bun_sys::get_fd_path(lockfile.handle(), &mut lockfile_path_buf)
         else {
-            break 'npm;
+            continue;
         };
         let lockfile_path: &[u8] = &*lockfile_path;
         let Ok(data) = lockfile.read_to_end() else {
-            break 'npm;
+            continue;
         };
-        let migrate_result =
-            match migrate_npm_lockfile(this, manager, log, &data, lockfile_path, dir) {
-                Ok(r) => r,
-                Err(e) => {
-                    return LoadResult::Err(LoadResultErr {
-                        step: LoadStep::Migrating,
-                        value: e,
-                        lockfile_path: zstr!("package-lock.json"),
-                        format: LockfileFormat::Text,
-                    });
-                }
-            };
-
-        return finish_migration(
-            migrate_result,
+        let migrate_result = match migrate_npm_lockfile(
+            this,
             manager,
             log,
-            &timer,
-            zstr!("package-lock.json"),
-        );
+            &data,
+            lockfile_path,
+            dir,
+            lockfile_name,
+        ) {
+            Ok(r) => r,
+            Err(e) => {
+                return LoadResult::Err(LoadResultErr {
+                    step: LoadStep::Migrating,
+                    value: e,
+                    lockfile_path: lockfile_name_z,
+                    format: LockfileFormat::Text,
+                });
+            }
+        };
+
+        return finish_migration(migrate_result, manager, log, &timer, lockfile_name_z);
     }
 
     'yarn: {
@@ -312,6 +317,7 @@ fn migrate_npm_lockfile<'a>(
     data: &[u8],
     abs_path: &[u8],
     dir: Fd,
+    lockfile_name: &'static str,
 ) -> Result<LoadResult<'a>, Error> {
     debug!("begin lockfile migration");
 
@@ -332,7 +338,7 @@ fn migrate_npm_lockfile<'a>(
         Some(E::JsonValue::Number(n)) => {
             report_unsupported_lockfile_version(
                 manager,
-                "package-lock.json",
+                lockfile_name,
                 &(n.value() as i64),
                 "npm install --package-lock-only --lockfile-version=3",
             );
@@ -459,6 +465,7 @@ fn migrate_npm_lockfile<'a>(
         log,
         packages_properties,
         workspace_map.as_ref(),
+        lockfile_name,
     )?;
     clear_non_registry_platform_constraints(this);
     npm_lock::apply_root_overrides(this, manager, log, dir, workspace_map.as_ref(), abs_path)?;
diff --git a/src/install/migration/npm_lock.rs b/src/install/migration/npm_lock.rs
index 82836eaa6d02..cafa4d077de0 100644
--- a/src/install/migration/npm_lock.rs
+++ b/src/install/migration/npm_lock.rs
@@ -129,6 +129,8 @@ struct Migrator<'a> {
     url: Vec<u8>,
     patched: String,
     silent: bool,
+    /// `npm-shrinkwrap.json` or `package-lock.json`, for warnings.
+    lockfile_name: &'static str,
 }
 
 pub(super) fn migrate_packages(
@@ -137,6 +139,7 @@ pub(super) fn migrate_packages(
     _log: &mut bun_ast::Log,
     packages_properties: &[E::PropertyJSON],
     workspace_map: Option<&WorkspaceMap>,
+    lockfile_name: &'static str,
 ) -> Result<(), Error> {
     debug_assert!(!packages_properties.is_empty() && packages_properties[0].key.slice().is_empty());
 
@@ -163,6 +166,7 @@ pub(super) fn migrate_packages(
         url: Vec::new(),
         patched: String::new(),
         silent,
+        lockfile_name,
     };
 
     migrator.build_index()?;
@@ -185,8 +189,9 @@ pub(super) fn migrate_packages(
 
     if !migrator.patched.is_empty() {
         bun_core::warn!(
-            "skipped npm patches for {} from package-lock.json",
+            "skipped npm patches for {} from {}",
             migrator.patched,
+            lockfile_name,
         );
         bun_core::note!("bun patch \\<pkg\\>");
     }
@@ -767,9 +772,10 @@ impl<'a> Migrator<'a> {
                 else {
                     if !self.silent {
                         bun_core::warn!(
-                            "skipped \"{}@{}\" from package-lock.json: unsupported version specifier",
+                            "skipped \"{}@{}\" from {}: unsupported version specifier",
                             bstr::BStr::new(name),
                             bstr::BStr::new(spec),
+                            self.lockfile_name,
                         );
                     }
                     continue;
@@ -886,9 +892,10 @@ impl<'a> Migrator<'a> {
             let Some(t) = target else {
                 if !self.silent {
                     bun_core::warn!(
-                        "workspace \"{}\" ({}) is not in package-lock.json; resolving it from package.json",
+                        "workspace \"{}\" ({}) is not in {}; resolving it from package.json",
                         bstr::BStr::new(&ws.name),
                         bstr::BStr::new(path),
+                        self.lockfile_name,
                     );
                 }
                 continue;
@@ -986,8 +993,9 @@ impl<'a> Migrator<'a> {
         self.skipped_external.set(t as usize);
         if !self.silent {
             bun_core::warn!(
-                "skipped \"{}\" from package-lock.json: transitive folder dependency \"{}\" is outside the project",
+                "skipped \"{}\" from {}: transitive folder dependency \"{}\" is outside the project",
                 bstr::BStr::new(name),
+                self.lockfile_name,
                 bstr::BStr::new(self.entries[t as usize].key.slice()),
             );
         }
@@ -1050,8 +1058,9 @@ impl<'a> Migrator<'a> {
             let _ = write!(list, " and {} more", count - 5);
         }
         bun_core::warn!(
-            "skipped {} package-lock.json {} not depended on by any package: {}",
+            "skipped {} {} {} not depended on by any package: {}",
             count,
+            self.lockfile_name,
             if count == 1 { "entry" } else { "entries" },
             list,
         );
diff --git a/test/cli/install/migration/migrate.test.ts b/test/cli/install/migration/migrate.test.ts
index a351d82f8bc4..957147105b7a 100644
--- a/test/cli/install/migration/migrate.test.ts
+++ b/test/cli/install/migration/migrate.test.ts
@@ -188,7 +188,7 @@ test("npm lockfile with relative workspaces", async () => {
   expect(exitCode).toBe(0);
 });
 
-const lockfiles = ["package-lock.json", "yarn.lock", "pnpm-lock.yaml"];
+const lockfiles = ["npm-shrinkwrap.json", "package-lock.json", "yarn.lock", "pnpm-lock.yaml"];
 
 for (const lockfile of lockfiles) {
   test(`should create bun.lock if ${lockfile} migration fails`, async () => {
@@ -2112,6 +2112,125 @@ describe("package-lock.json migration fixes", () => {
     expect(lock.packages).toStrictEqual({});
   });
 
+  // npm-shrinkwrap.json is package-lock.json under another name, and npm reads it in preference to package-lock.json.
+  describe("npm-shrinkwrap.json", () => {
+    test.concurrent("bun install keeps the versions it pins instead of resolving afresh", async () => {
+      using registry = localRegistry();
+      // The registry also has no-deps 1.0.1 and 1.1.0, which a fresh resolve of this range would pick.
+      const dependencies = { "no-deps": "^1.0.0" };
+      using dir = synthetic(
+        "npm-migrate-shrinkwrap-install",
+        {
+          "package.json": JSON.stringify({ name: "shrinkwrapped", dependencies }),
+          "npm-shrinkwrap.json": npmLock("shrinkwrapped", {
+            "": { name: "shrinkwrapped", dependencies },
+            "node_modules/no-deps": {
+              version: "1.0.0",
+              resolved: registry.tarball("no-deps", "1.0.0"),
+              integrity: registry.integrity("no-deps", "1.0.0"),
+            },
+          }),
+        },
+        registry.url,
+      );
+
+      const { stderr, exitCode } = await run(dir, "install");
+      expect(stderr).toContain("migrated lockfile from npm-shrinkwrap.json");
+      expect(exitCode).toBe(0);
+      expect(await Bun.file(join(String(dir), "node_modules", "no-deps", "package.json")).json()).toStrictEqual({
+        name: "no-deps",
+        version: "1.0.0",
+      });
+      const { lock } = await readLock(dir);
+      expect(lock.packages["no-deps"]).toStrictEqual([
+        "no-deps@1.0.0",
+        registry.tarball("no-deps", "1.0.0"),
+        {},
+        registry.integrity("no-deps", "1.0.0"),
+      ]);
+      expect(registry.requests).toStrictEqual(["/no-deps/-/no-deps-1.0.0.tgz"]);
+      await frozen(dir);
+    });
+
+    test.concurrent("bun pm migrate reads it", async () => {
+      const dependencies = { x: "^1.0.0" };
+      using dir = synthetic("npm-migrate-shrinkwrap-pm-migrate", {
+        "package.json": JSON.stringify({ name: "shrinkwrapped", dependencies }),
+        "npm-shrinkwrap.json": npmLock("shrinkwrapped", {
+          "": { name: "shrinkwrapped", dependencies },
+          "node_modules/x": { version: "1.0.0" },
+        }),
+      });
+      const { stderr, lock } = await migrate(dir);
+      expect(stderr).toContain("migrated lockfile from npm-shrinkwrap.json");
+      expect(lock.packages.x).toStrictEqual(["x@1.0.0", `${OFFLINE_REGISTRY}x/-/x-1.0.0.tgz`, {}, ""]);
+      await frozen(dir);
+    });
+
+    test.concurrent("takes precedence over a package-lock.json next to it, as in npm", async () => {
+      const dependencies = { x: "^1.0.0" };
+      using dir = synthetic("npm-migrate-shrinkwrap-precedence", {
+        "package.json": JSON.stringify({ name: "both", dependencies }),
+        "npm-shrinkwrap.json": npmLock("both", {
+          "": { name: "both", dependencies },
+          "node_modules/x": { version: "1.0.0" },
+        }),
+        "package-lock.json": npmLock("both", {
+          "": { name: "both", dependencies },
+          "node_modules/x": { version: "1.0.1" },
+        }),
+      });
+      const { stderr, lock } = await migrate(dir);
+      expect(stderr).toContain("migrated lockfile from npm-shrinkwrap.json");
+      expect(stderr).not.toContain("package-lock.json");
+      expect(firstsOf(lock.packages)).toStrictEqual(["x@1.0.0"]);
+      await frozen(dir);
+    });
+
+    test.concurrent("migration warnings name it", async () => {
+      const dependencies = { x: "1.0.0" };
+      using dir = synthetic("npm-migrate-shrinkwrap-warnings", {
+        "package.json": JSON.stringify({ name: "warned", dependencies }),
+        "npm-shrinkwrap.json": npmLock("warned", {
+          "": { name: "warned", dependencies },
+          "node_modules/x": { version: "1.0.0", patched: { "patches/x.patch": "sha512-x" } },
+          "node_modules/y": { version: "1.0.0" },
+        }),
+      });
+      const { stderr, lock } = await migrate(dir);
+      expect(stderr).toContain(
+        'warn: skipped 1 npm-shrinkwrap.json entry not depended on by any package: "node_modules/y"\n',
+      );
+      expect(stderr).toContain('warn: skipped npm patches for "x" from npm-shrinkwrap.json\nnote: bun patch <pkg>\n');
+      expect(stderr).not.toContain("package-lock.json");
+      expect(firstsOf(lock.packages)).toStrictEqual(["x@1.0.0"]);
+    });
+
+    test.concurrent("an unsupported lockfileVersion is reported under its own name", async () => {
+      using dir = synthetic("npm-migrate-shrinkwrap-v1", {
+        "package.json": JSON.stringify({ name: "v1", dependencies: { "dep-1": "file:dep-1" } }),
+        "dep-1/package.json": JSON.stringify({ name: "dep-1" }),
+        "npm-shrinkwrap.json": JSON.stringify({ name: "v1", lockfileVersion: 1, requires: true, dependencies: {} }),
+      });
+      const { stderr, exitCode } = await run(dir, "pm", "migrate");
+      expect(stderr).toBe(
+        "error: npm-shrinkwrap.json is lockfileVersion 1, which bun cannot migrate\nnote: npm install --package-lock-only --lockfile-version=3\n",
+      );
+      expect(exitCode).toBe(1);
+      expect(fs.existsSync(join(String(dir), "bun.lock"))).toBeFalse();
+
+      const install = await run(dir, "install");
+      expect(install.stderr).toContain(
+        "warn: npm-shrinkwrap.json is lockfileVersion 1, which bun cannot migrate; resolving from package.json instead\nnote: npm install --package-lock-only --lockfile-version=3\n",
+      );
+      expect(install.stderr).not.toContain("migrated lockfile");
+      expect(install.stderr).not.toContain("failed to migrate");
+      expect(install.exitCode).toBe(0);
+      expect((await readLock(dir)).lock.packages["dep-1"]).toStrictEqual(["dep-1@file:dep-1", {}]);
+      expect(fs.existsSync(join(String(dir), "node_modules", "dep-1", "package.json"))).toBeTrue();
+    });
+  });
+
   describe("arborist fixtures", () => {
     // Snapshot matchers are unsupported inside a concurrent group, so these stay sequential.
     test.each(arboristFixtures.map(f => f.name))("%s", async name => {

From e2cf8c4305321abb8e1c2b037da8916eb4ea9dc7 Mon Sep 17 00:00:00 2001
From: robobun <117481402+robobun@users.noreply.github.com>
Date: Mon, 17 Aug 2026 02:08:10 +0000
Subject: [PATCH 134/258] install: write a migrated lockfile and its
 package.json edits only when the command saves a lockfile (#38804)

---
 docs/pm/cli/install.mdx                       |   4 +
 docs/pm/lockfile.mdx                          |   4 +-
 src/install/PackageManager.rs                 |   6 +
 .../PackageManager/install_with_manager.rs    |  48 +++-
 .../PackageManager/package_json_write_back.rs |  31 +++
 src/install/lockfile.rs                       |  18 ++
 src/install/migration.rs                      |   2 +-
 src/install/pnpm.rs                           |  59 +++--
 src/install/update_scope.rs                   |  11 +-
 src/runtime/cli/package_manager_command.rs    |   3 +-
 src/runtime/cli/pm_trusted_command.rs         |   9 +-
 test/cli/install/lockfile-only.test.ts        |  76 +++++-
 test/cli/install/migration/migrate.test.ts    |   2 +-
 .../install/migration/pnpm-lock-v9.test.ts    | 237 +++++++++++++++++-
 14 files changed, 447 insertions(+), 63 deletions(-)

diff --git a/docs/pm/cli/install.mdx b/docs/pm/cli/install.mdx
index d5128bf6b837..6f362d7debce 100644
--- a/docs/pm/cli/install.mdx
+++ b/docs/pm/cli/install.mdx
@@ -174,6 +174,8 @@ bun install --frozen-lockfile
 
 Bun does not enable `--frozen-lockfile` automatically in CI; pass the flag or use `bun ci`. If there is no lockfile at all, `--frozen-lockfile` installs from `package.json` without writing one.
 
+If the project has a `package-lock.json`, `yarn.lock`, or `pnpm-lock.yaml` but no `bun.lock`, `--frozen-lockfile` migrates that lockfile in memory and installs from it. The install fails if the migrated lockfile does not match `package.json`. Bun writes nothing in this case: no `bun.lock`, and none of the `package.json` edits a [pnpm migration](#pnpm-migration) makes. It prints a `note:` instead. To finish the migration, run `bun install` without the flag and commit the files it writes. The `bun.lockb` to `bun.lock` conversion described in [lockfile](/pm/lockfile) is the one write `--frozen-lockfile` still performs.
+
 `--frozen-lockfile` works on a pruned monorepo checkout (e.g. `turbo prune` output, or a Docker context with only some workspace folders copied in). If a workspace listed in `bun.lock` is missing its `package.json` on disk, Bun skips it with a `note:` and does not install its exclusive dependencies. If a remaining workspace depends on a skipped one, the install fails.
 
 To validate the lockfile without installing, use `bun install --frozen-lockfile --dry-run`.
@@ -527,6 +529,8 @@ bun install
 
 Migration only runs when `bun.lock` is absent. There is currently no opt-out flag for pnpm migration.
 
+Bun writes the migrated `bun.lock` and the `package.json` edits described below together, and only when the command saves a lockfile. `bun install`, `bun add`, `bun remove`, `bun update`, `bun pm migrate`, and `bun pm trust` write both files. `bun install --frozen-lockfile` (and `bun ci`), `bun install --dry-run`, `bun install --no-save`, and commands that only read the lockfile, such as `bun outdated` and `bun pm why`, migrate in memory and leave both files untouched.
+
 The migration process handles:
 
 ### Lockfile Migration
diff --git a/docs/pm/lockfile.mdx b/docs/pm/lockfile.mdx
index 4963fcb0d102..e8e6beb40883 100644
--- a/docs/pm/lockfile.mdx
+++ b/docs/pm/lockfile.mdx
@@ -11,7 +11,7 @@ Yes
 
 #### Generate a lockfile without installing?
 
-To generate a lockfile without installing to `node_modules`, use the `--lockfile-only` flag. Bun always saves the lockfile to disk, even if it is already up to date with your project's `package.json`(s). The exception is when `--frozen-lockfile` (or `--production`) is set.
+To generate a lockfile without installing to `node_modules`, use the `--lockfile-only` flag. Bun always saves the lockfile to disk, even if it is already up to date with your project's `package.json`(s). The exceptions are `--frozen-lockfile` (or `--production`), `--dry-run`, and `--no-save`, which save nothing.
 
 ```bash terminal icon="terminal"
 bun install --lockfile-only
@@ -71,3 +71,5 @@ When a project has both npm lockfiles, Bun reads `npm-shrinkwrap.json` and ignor
 Bun does not migrate an npm lockfile from npm 6 or older (`lockfileVersion` 1); it prints a warning and resolves from `package.json` instead.
 
 Bun preserves the original lockfile. You can remove it manually after verification.
+
+Bun writes the migrated `bun.lock` only when the command saves a lockfile. `bun install --frozen-lockfile` (and `bun ci`), `--dry-run`, `--no-save`, and read-only commands such as `bun outdated` use the migrated lockfile in memory and write nothing. Under `--frozen-lockfile`, Bun prints a `note:` asking you to run `bun install` and commit the result. To migrate without installing, run `bun pm migrate` or `bun install --lockfile-only`.
diff --git a/src/install/PackageManager.rs b/src/install/PackageManager.rs
index 8fd07d1aee4d..ea2d4d68d174 100644
--- a/src/install/PackageManager.rs
+++ b/src/install/PackageManager.rs
@@ -453,6 +453,10 @@ pub struct PackageManager {
     // Set by package_json_write_back::flush when it rewrites a file; read by the install summary.
     pub(crate) wrote_package_json: bool,
 
+    // pnpm migration: what it moved into the cached root package.json. The file is only written along with the
+    // migrated lockfile (package_json_write_back::record_migrated_root); loads that are never saved leave it alone.
+    pub(crate) migrated_package_json_moves: Vec<&'static str>,
+
     // bun add: catalog references decided per target and the root entries they need; see add_catalog.rs
     pub(crate) catalog_add: add_catalog::State,
 
@@ -2164,6 +2168,7 @@ pub fn init(
         wr!(pending_filtered_write, None);
         wr!(edited_package_jsons, Vec::new());
         wr!(wrote_package_json, false);
+        wr!(migrated_package_json_moves, Vec::new());
         wr!(catalog_add, add_catalog::State::default());
         wr!(patched_dependencies_to_remove, ArrayHashMap::default());
         wr!(last_reported_slow_lifecycle_script_at, 0);
@@ -2613,6 +2618,7 @@ fn init_with_runtime_once(
         wr!(pending_filtered_write, None);
         wr!(edited_package_jsons, Vec::new());
         wr!(wrote_package_json, false);
+        wr!(migrated_package_json_moves, Vec::new());
         wr!(catalog_add, add_catalog::State::default());
         wr!(patched_dependencies_to_remove, ArrayHashMap::default());
         wr!(last_reported_slow_lifecycle_script_at, 0);
diff --git a/src/install/PackageManager/install_with_manager.rs b/src/install/PackageManager/install_with_manager.rs
index e8f6b699b800..fd15e795d581 100644
--- a/src/install/PackageManager/install_with_manager.rs
+++ b/src/install/PackageManager/install_with_manager.rs
@@ -788,6 +788,12 @@ pub fn install_with_manager(
         }
     }
 
+    if manager.options.enable.frozen_lockfile() && !manager.options.do_.save_lockfile() {
+        if let Some(source) = load_result.migrated().source_lockfile_name() {
+            note_migrated_lockfile_not_saved(manager, source);
+        }
+    }
+
     // BACKREF: `manager.lockfile` is a `Box<Lockfile>` whose allocation is
     // never replaced for the remainder of this function (only its fields
     // mutate). Wrap once as `ParentRef` so the two `save_lockfile` read sites
@@ -904,7 +910,7 @@ pub fn install_with_manager(
     // It's unnecessary work to re-save the lockfile if there are no changes.
     // A loaded text lockfile is never re-saved just to bump its version: an
     // existing `bun.lock` keeps the version it was written with.
-    let should_save_lockfile = saves_migrated_lockfile(&load_result, save_format)
+    let should_save_lockfile = converts_binary_lockfile_to_text(&load_result, save_format)
         // check `save_lockfile` after checking if loaded from binary and save format is text
         // because `save_lockfile` is set to false for `--frozen-lockfile`
         || (manager.options.do_.save_lockfile()
@@ -918,6 +924,7 @@ pub fn install_with_manager(
                 || manager.options.enable.force_save_lockfile()));
 
     if should_save_lockfile {
+        super::package_json_write_back::record_migrated_root(manager);
         save_lockfile(
             manager,
             &load_result,
@@ -1421,7 +1428,9 @@ fn overrides_field_name(
 }
 
 pub(crate) fn loaded_lockfile_name(load_result: &lockfile::LoadResult) -> &'static str {
-    if load_result.loaded_from_binary_lockfile() {
+    if let Some(source) = load_result.migrated().source_lockfile_name() {
+        source
+    } else if load_result.loaded_from_binary_lockfile() {
         "bun.lockb"
     } else {
         "bun.lock"
@@ -2182,8 +2191,11 @@ fn run_security_scanner(
     }
 }
 
-// bun.lockb / package-lock.json / yarn.lock / pnpm-lock.yaml -> bun.lock is written even under --frozen-lockfile.
-fn saves_migrated_lockfile(
+// The documented bun.lockb -> bun.lock recipe (`--save-text-lockfile --frozen-lockfile --lockfile-only`) is the one
+// write that happens while `Do::SAVE_LOCKFILE` is off (--frozen-lockfile, --dry-run, --no-save). A migrated
+// package-lock.json / yarn.lock / pnpm-lock.yaml is saved through `FORCE_SAVE_LOCKFILE` like any other change, so
+// those flags keep it in memory. (A migrated load can report `Format::Binary` too, hence the `migrated` check.)
+fn converts_binary_lockfile_to_text(
     load_result: &lockfile::LoadResult,
     save_format: lockfile::Format,
 ) -> bool {
@@ -2191,10 +2203,30 @@ fn saves_migrated_lockfile(
         && matches!(
             load_result,
             lockfile::LoadResult::Ok(ok)
-                if ok.format == lockfile::Format::Binary || ok.migrated != lockfile::Migrated::None
+                if ok.format == lockfile::Format::Binary && ok.migrated == lockfile::Migrated::None
         )
 }
 
+#[cold]
+#[inline(never)]
+fn note_migrated_lockfile_not_saved(manager: &PackageManager, source: &str) {
+    if manager.options.log_level.is_silent() {
+        return;
+    }
+    Output::flush();
+    let files = if manager.migrated_package_json_moves.is_empty() {
+        "bun.lock"
+    } else {
+        "bun.lock and package.json"
+    };
+    bun_core::note!(
+        "the lockfile is frozen, so the migration from {} was not written to {}; run 'bun install' and commit the result",
+        source,
+        files,
+    );
+    Output::flush();
+}
+
 #[cold]
 #[inline(never)]
 #[allow(clippy::too_many_arguments)]
@@ -2208,8 +2240,8 @@ fn save_lockfile_only(
     packages_len_before_install: usize,
     log_level: Options::LogLevel,
 ) -> crate::Result<()> {
-    if (manager.options.enable.frozen_lockfile()
-        && !saves_migrated_lockfile(load_result, save_format))
+    if (!manager.options.do_.save_lockfile()
+        && !converts_binary_lockfile_to_text(load_result, save_format))
         || (manager.subcommand == Subcommand::Dedupe && manager.dedupe_report.is_none())
     {
         Output::flush();
@@ -2222,6 +2254,7 @@ fn save_lockfile_only(
         packages_len_before_install,
     )?;
 
+    super::package_json_write_back::record_migrated_root(manager);
     let saved = save_lockfile(
         manager,
         load_result,
@@ -2231,6 +2264,7 @@ fn save_lockfile_only(
         packages_len_before_install,
         log_level,
     )?;
+    super::package_json_write_back::flush(manager)?;
 
     if manager.subcommand == Subcommand::Dedupe {
         if manager.options.do_.summary() {
diff --git a/src/install/PackageManager/package_json_write_back.rs b/src/install/PackageManager/package_json_write_back.rs
index 7b24882fea36..d1c93f801592 100644
--- a/src/install/PackageManager/package_json_write_back.rs
+++ b/src/install/PackageManager/package_json_write_back.rs
@@ -58,6 +58,37 @@ fn root_target() -> WorkspaceTarget {
     }
 }
 
+/// The root package.json a pnpm migration edited in memory (`pnpm::update_package_json_after_migration`), announced
+/// once; `None` when the load did not touch it. Only the places that save the migrated lockfile ask for it, so a load
+/// that is never saved (`--frozen-lockfile`, `--dry-run`, `bun outdated`, ...) leaves the file alone.
+fn take_migrated_root(manager: &mut PackageManager) -> Option<WorkspaceTarget> {
+    if manager.migrated_package_json_moves.is_empty() {
+        return None;
+    }
+    let moved = core::mem::take(&mut manager.migrated_package_json_moves);
+    if !manager.options.log_level.is_silent() {
+        bun_core::pretty_errorln!("<d>copied {} in <r><green>package.json<r>", moved.join(", "));
+    }
+    Some(root_target())
+}
+
+/// `install_with_manager`: written by `flush` along with the command's other package.json edits.
+pub(crate) fn record_migrated_root(manager: &mut PackageManager) {
+    if let Some(root) = take_migrated_root(manager) {
+        record(manager, root, false);
+    }
+}
+
+/// `bun pm migrate` and `bun pm trust` save the lockfile without consulting `--dry-run` / `--no-save`, so the
+/// package.json that belongs with it is written the same way instead of through `flush`, which those flags disable.
+pub fn write_migrated_root(manager: &mut PackageManager) {
+    if let Some(root) = take_migrated_root(manager) {
+        if !write_target(manager, &root) {
+            Global::exit(1);
+        }
+    }
+}
+
 /// Phase 1 (before bun.lock is saved): write the resolved versions into the edited package.json entries and re-derive bun.lock's declared columns from them.
 #[inline]
 pub(crate) fn edit_after_resolve(manager: &mut PackageManager) -> crate::Result<()> {
diff --git a/src/install/lockfile.rs b/src/install/lockfile.rs
index ad1da68c3f48..35929a6216ac 100644
--- a/src/install/lockfile.rs
+++ b/src/install/lockfile.rs
@@ -360,6 +360,17 @@ pub enum Migrated {
     Pnpm,
 }
 
+impl Migrated {
+    pub(crate) fn source_lockfile_name(self) -> Option<&'static str> {
+        match self {
+            Migrated::None => None,
+            Migrated::Npm => Some("package-lock.json"),
+            Migrated::Yarn => Some("yarn.lock"),
+            Migrated::Pnpm => Some("pnpm-lock.yaml"),
+        }
+    }
+}
+
 pub struct LoadResultErr {
     pub step: LoadStep,
     pub value: BunError,
@@ -411,6 +422,13 @@ impl<'a> LoadResult<'a> {
         }
     }
 
+    pub(crate) fn migrated(&self) -> Migrated {
+        match self {
+            LoadResult::Ok(ok) => ok.migrated,
+            _ => Migrated::None,
+        }
+    }
+
     pub(crate) fn save_format(&self, options: &PackageManagerOptions) -> LockfileFormat {
         match self {
             LoadResult::NotFound => {
diff --git a/src/install/migration.rs b/src/install/migration.rs
index 065ccf45447f..9c4c2ce01b55 100644
--- a/src/install/migration.rs
+++ b/src/install/migration.rs
@@ -103,7 +103,7 @@ pub fn detect_and_load_other_lockfile<'a>(
         let Ok(data) = File::read_from(dir, b"pnpm-lock.yaml") else {
             break 'pnpm;
         };
-        let migrate_result = match pnpm::migrate_pnpm_lockfile(this, manager, log, &data, dir) {
+        let migrate_result = match pnpm::migrate_pnpm_lockfile(this, manager, log, &data) {
             Ok(r) => r,
             Err(MigratePnpmLockfileError::PnpmLockfileTooOld) => {
                 report_unsupported_lockfile_version(
diff --git a/src/install/pnpm.rs b/src/install/pnpm.rs
index 53d88d441ff8..a9ded026e91c 100644
--- a/src/install/pnpm.rs
+++ b/src/install/pnpm.rs
@@ -19,6 +19,8 @@ use crate::integrity::Integrity;
 use crate::lockfile::{self, LoadResult, LoadResultOk, Lockfile};
 use crate::npm::{self};
 use crate::package_manager_real::update_package_json_and_install::print_package_json_into_cache_entry;
+use crate::package_manager_real::add_remove_with_filter::root_package_json_path;
+use crate::package_manager_real::update_package_json_and_install::print_package_json_into_cache_entry;
 use crate::repository::Repository;
 use crate::resolution::{self, Resolution, TaggedValue};
 use crate::{DependencyID, INVALID_PACKAGE_ID, PackageID, PackageManager};
@@ -508,7 +510,6 @@ pub(crate) fn migrate_pnpm_lockfile<'a>(
     manager: &mut PackageManager,
     log: &mut bun_ast::Log,
     data: &[u8],
-    dir: Fd,
 ) -> Result<LoadResult<'a>, MigratePnpmLockfileError> {
     lockfile.init_empty();
     crate::initialize_store();
@@ -1655,7 +1656,7 @@ pub(crate) fn migrate_pnpm_lockfile<'a>(
 
     lockfile.fetch_necessary_package_metadata_after_yarn_or_pnpm_migration::<false>(manager)?;
 
-    update_package_json_after_migration(lockfile, manager, log, dir, &found_patches)?;
+    update_package_json_after_migration(Some(&mut *lockfile), manager, log, &found_patches)?;
 
     Ok(LoadResult::Ok(LoadResultOk {
         lockfile,
@@ -2388,7 +2389,7 @@ fn rewrite_bare_patch_keys(
             bstr::BStr::new(&**res_str)
         )
         .map_err(|_| AllocError)?;
-        // Lives in the AST store like the key node below; nothing resets it before the caller prints the tree.
+        // `join_buf` is reused by the next key; the tree is printed after this fn returns.
         let interned: &[u8] = js_ast::data_store_dupe_str(join_buf.as_slice());
         prop.key = Some(Expr::init(E::EString::init(interned), bun_ast::Loc::EMPTY));
     }
@@ -2419,7 +2420,7 @@ fn collect_only_built_dependencies(list: &Expr, out: &mut Vec<&'static [u8]>) ->
 /// The migrated root skips `Package::parse`, so the lockfile's list is filled in here as well.
 fn add_trusted_dependencies(
     json: &mut Expr,
-    lockfile: &mut Lockfile,
+    lockfile: Option<&mut Lockfile>,
     bump: &bun_alloc::Arena,
     names: &[&'static [u8]],
 ) -> Result<bool, AllocError> {
@@ -2451,15 +2452,18 @@ fn add_trusted_dependencies(
         added_any = true;
     }
 
-    let trusted = lockfile
-        .trusted_dependencies
-        .get_or_insert_with(Default::default);
-    for item in items.slice() {
-        if let Some(name) = as_string(item) {
-            trusted.put(
-                semver::string::Builder::string_hash(name) as crate::TruncatedPackageNameHash,
-                Box::from(name),
-            )?;
+    // A root parsed by `Package::parse` fills this from the file; the migrated root skips that.
+    if let Some(lockfile) = lockfile {
+        let trusted = lockfile
+            .trusted_dependencies
+            .get_or_insert_with(Default::default);
+        for item in items.slice() {
+            if let Some(name) = as_string(item) {
+                trusted.put(
+                    semver::string::Builder::string_hash(name) as crate::TruncatedPackageNameHash,
+                    Box::from(name),
+                )?;
+            }
         }
     }
 
@@ -2497,19 +2501,20 @@ pub(crate) fn migrate_pnpm_workspace_config(
     if root_pkg_json.root.get(b"workspaces").is_some() {
         return Ok(());
     }
-    update_package_json_after_migration(manager, log, Fd::cwd(), &StringArrayHashMap::new())
+    update_package_json_after_migration(None, manager, log, &StringArrayHashMap::new())
 }
 
-/// Moves the settings pnpm reads from package.json `pnpm.*` and pnpm-workspace.yaml into the fields bun reads.
+/// Copies the workspace, catalog, override, patch and onlyBuiltDependencies settings pnpm keeps in
+/// `pnpm-workspace.yaml` and the `pnpm` key into the fields bun reads, in the cached root package.json. Only the
+/// cache entry changes here: the rest of the load (frozen check, differ) reads it from there, and
+/// `package_json_write_back::record_migrated_root` writes it when the migrated lockfile is saved.
 fn update_package_json_after_migration(
-    lockfile: &mut Lockfile,
+    lockfile: Option<&mut Lockfile>,
     manager: &mut PackageManager,
     log: &mut bun_ast::Log,
-    dir: Fd,
     patches: &StringArrayHashMap<Box<[u8]>>,
 ) -> Result<(), AllocError> {
     let bump = bun_alloc::Arena::new();
-    let silent = manager.options.log_level.is_silent();
 
     let Some(root_pkg_json) = root_package_json(manager, log) else {
         return Ok(());
@@ -2742,18 +2747,12 @@ fn update_package_json_after_migration(
         Global::crash();
     }
 
-    let copied = copied.join(", ");
-    // Continuing would save a bun.lock that does not match the package.json left on disk.
-    if let Err(err) = sys::File::write_file(
-        dir,
-        bun_core::zstr!("package.json"),
-        root_pkg_json.source.contents(),
-    ) {
-        Output::err(err, "failed to copy {} in package.json", (&copied,));
-        Global::crash();
-    }
-    if !silent {
-        bun_core::pretty_errorln!("<d>copied {} in <r><green>package.json<r>", copied);
+    // Commands that load the lockfile twice (`bun update -r`, `bun audit fix`) migrate the already
+    // edited entry the second time, so only the pnpm-workspace.yaml copies repeat.
+    for what in copied {
+        if !manager.migrated_package_json_moves.contains(&what) {
+            manager.migrated_package_json_moves.push(what);
+        }
     }
 
     Ok(())
diff --git a/src/install/update_scope.rs b/src/install/update_scope.rs
index 52a986ec0e9a..7806ec645e7f 100644
--- a/src/install/update_scope.rs
+++ b/src/install/update_scope.rs
@@ -15,6 +15,7 @@ use crate::package_manager::Options::LogLevel;
 use crate::package_manager::UpdateTargetWorkspace;
 use crate::package_manager::workspace_selection::{self, RootSelection};
 use crate::package_manager_real::command_line_arguments::UpdateGroups;
+use crate::package_manager_real::install_with_manager::loaded_lockfile_name;
 use crate::resolution::Tag as ResolutionTag;
 use crate::{DependencyID, PackageID, PackageManager, PackageNameHash, invalid_package_id};
 
@@ -295,15 +296,9 @@ fn exit_on_lockfile_load_failure(manager: &mut PackageManager, subject: &[u8]) -
         missing(silent, subject);
     }
     let load_result = manager.load_lockfile_from_cwd::<true>();
-    let from_binary = load_result.loaded_from_binary_lockfile();
+    let lockfile_name = loaded_lockfile_name(&load_result);
     match load_result {
-        crate::lockfile::LoadResult::Ok(_) => {
-            if from_binary {
-                "bun.lockb"
-            } else {
-                "bun.lock"
-            }
-        }
+        crate::lockfile::LoadResult::Ok(_) => lockfile_name,
         crate::lockfile::LoadResult::NotFound => missing(silent, subject),
         crate::lockfile::LoadResult::Err(cause) => {
             if !silent && !crate::migration::reported_unsupported_lockfile_version(&cause) {
diff --git a/src/runtime/cli/package_manager_command.rs b/src/runtime/cli/package_manager_command.rs
index 3cd4c0af057e..c40cb14b4c12 100644
--- a/src/runtime/cli/package_manager_command.rs
+++ b/src/runtime/cli/package_manager_command.rs
@@ -10,7 +10,7 @@ use bun_install::lockfile::{LoadResult, LoadStep, Lockfile, package::PackageColu
 use bun_install::npm as Npm;
 use bun_install::package_manager_real::{
     CommandLineArguments, Subcommand, fetch_cache_directory_path, get_cache_directory,
-    package_manager_options::LogLevel, setup_global_dir,
+    package_json_write_back, package_manager_options::LogLevel, setup_global_dir,
 };
 use bun_install::{DependencyID, PackageID, PackageManager, migration};
 use bun_paths::{self as Path, PathBuffer};
@@ -740,6 +740,7 @@ Learn more about these at <magenta>https://bun.com/docs/cli/pm<r>.\n";
             unsafe {
                 (*lf).save_to_disk(&load_lockfile, &(*pm_raw).options);
             }
+            package_json_write_back::write_migrated_root(pm);
             Global::exit(0);
         } else if strings::eql_comptime(subcommand, b"version") {
             let positionals: &[&[u8]] = pm.options.positionals;
diff --git a/src/runtime/cli/pm_trusted_command.rs b/src/runtime/cli/pm_trusted_command.rs
index d03bd50c0d34..4898792f5c8a 100644
--- a/src/runtime/cli/pm_trusted_command.rs
+++ b/src/runtime/cli/pm_trusted_command.rs
@@ -12,7 +12,8 @@ use bun_install::lockfile::{
     tree,
 };
 use bun_install::package_manager_real::{
-    PackageJSONEditor, ProgressStrings, ROOT_PACKAGE_JSON_PATH, update_lockfile_if_needed,
+    PackageJSONEditor, ProgressStrings, ROOT_PACKAGE_JSON_PATH, package_json_write_back,
+    update_lockfile_if_needed,
 };
 use bun_install::{
     self as install, DEFAULT_TRUSTED_DEPENDENCIES_LIST, DependencyID, LifecycleScriptSubprocess,
@@ -533,6 +534,12 @@ impl TrustCommand {
             }
         }
 
+        // The `trustedDependencies` edit below re-reads package.json from disk, so the edits a pnpm
+        // migration made to it have to be written first (the migrated lockfile is saved below).
+        // SAFETY: `pm_raw` singleton; `load_lockfile` only borrows the boxed lockfile, which this
+        // does not touch.
+        unsafe { package_json_write_back::write_migrated_root(&mut *pm_raw) };
+
         // SAFETY: `pm_raw` singleton; this scope takes over the descriptor
         // (the original `pm.root_package_json_file` is replaced with INVALID so
         // its eventual drop is a no-op).
diff --git a/test/cli/install/lockfile-only.test.ts b/test/cli/install/lockfile-only.test.ts
index cd9a0e8586d3..2c16db65c677 100644
--- a/test/cli/install/lockfile-only.test.ts
+++ b/test/cli/install/lockfile-only.test.ts
@@ -89,7 +89,7 @@ it.each(["bun.lockb", "bun.lock"])("should not download tarballs with --lockfile
   await access(join(package_dir, lockfile));
 });
 
-describe("--lockfile-only under --frozen-lockfile", () => {
+describe("--lockfile-only and lockfile migration under --frozen-lockfile, --dry-run, and --no-save", () => {
   const project = {
     "foo/package.json": JSON.stringify({ name: "foo", version: "1.0.0" }),
     "package.json": JSON.stringify({ name: "mig", dependencies: { foo: "file:./foo" } }),
@@ -138,7 +138,7 @@ describe("--lockfile-only under --frozen-lockfile", () => {
   }
   const lock = (dir: string) => join(dir, "bun.lock");
 
-  it.concurrent.each(["--frozen-lockfile", "--production"])(
+  it.concurrent.each(["--frozen-lockfile", "--production", "--dry-run", "--no-save"])(
     "%s --lockfile-only leaves an up-to-date bun.lock byte-identical",
     async flag => {
       using tmp = tempDir("lockfile-only-frozen", project);
@@ -157,7 +157,7 @@ describe("--lockfile-only under --frozen-lockfile", () => {
     },
   );
 
-  it.concurrent.each(["--frozen-lockfile", "--production"])(
+  it.concurrent.each(["--frozen-lockfile", "--production", "--dry-run", "--no-save"])(
     "%s --lockfile-only does not create a missing bun.lock",
     async flag => {
       using tmp = tempDir("lockfile-only-frozen-missing", project);
@@ -199,32 +199,84 @@ describe("--lockfile-only under --frozen-lockfile", () => {
     expect(exitCode).toBe(0);
   });
 
+  const frozenNote = (name: string) =>
+    `note: the lockfile is frozen, so the migration from ${name} was not written to bun.lock; run 'bun install' and commit the result`;
+
   it.concurrent.each(migrations)(
-    "--frozen-lockfile --lockfile-only still writes bun.lock when migrating from %s",
+    "--frozen-lockfile --lockfile-only migrates %s in memory and does not write bun.lock",
     async (name, contents) => {
       using tmp = tempDir("lockfile-only-frozen-migrate", { ...project, [name]: contents });
       const dir = String(tmp);
 
       const { stdout, stderr, exitCode } = await run(dir, "--frozen-lockfile", "--lockfile-only");
       expect(stderr).toContain(`migrated lockfile from ${name}`);
-      expect(stdout).toContain("Saved bun.lock (2 packages)");
-      expect(readFileSync(lock(dir), "utf8")).toContain('"foo": ["foo@file:foo", {}]');
+      expect(stderr).toContain(frozenNote(name));
+      expect(stdout + stderr).not.toContain("Saved");
+      expect(existsSync(lock(dir))).toBe(false);
       expect(existsSync(join(dir, "node_modules"))).toBe(false);
       expect(exitCode).toBe(0);
     },
   );
 
-  it.concurrent.each(migrations)("--frozen-lockfile writes bun.lock when migrating from %s", async (name, contents) => {
-    using tmp = tempDir("frozen-migrate", { ...project, [name]: contents });
+  it.concurrent.each(migrations)(
+    "--frozen-lockfile installs from a migrated %s and does not write bun.lock",
+    async (name, contents) => {
+      using tmp = tempDir("frozen-migrate", { ...project, [name]: contents });
+      const dir = String(tmp);
+
+      const { stdout, stderr, exitCode } = await run(dir, "--frozen-lockfile");
+      expect(stderr).toContain(`migrated lockfile from ${name}`);
+      expect(stderr).toContain(frozenNote(name));
+      expect(stdout + stderr).not.toContain("Saved");
+      expect(existsSync(lock(dir))).toBe(false);
+      expect(existsSync(join(dir, "node_modules", "foo", "package.json"))).toBe(true);
+      expect(exitCode).toBe(0);
+    },
+  );
+
+  it.concurrent.each(migrations)("--dry-run does not write bun.lock when migrating from %s", async (name, contents) => {
+    using tmp = tempDir("dry-run-migrate", { ...project, [name]: contents });
     const dir = String(tmp);
 
-    const { stderr, exitCode } = await run(dir, "--frozen-lockfile");
+    const { stdout, stderr, exitCode } = await run(dir, "--dry-run");
     expect(stderr).toContain(`migrated lockfile from ${name}`);
-    expect(existsSync(lock(dir))).toBe(true);
-    expect(readFileSync(lock(dir), "utf8")).toContain('"foo": ["foo@file:foo", {}]');
-    expect(existsSync(join(dir, "node_modules", "foo", "package.json"))).toBe(true);
+    expect(stderr).not.toContain("note:");
+    expect(stdout + stderr).not.toContain("Saved");
+    expect(existsSync(lock(dir))).toBe(false);
+    expect(existsSync(join(dir, "node_modules"))).toBe(false);
     expect(exitCode).toBe(0);
   });
+
+  it.concurrent.each(migrations)(
+    "--no-save installs from a migrated %s and does not write bun.lock",
+    async (name, contents) => {
+      using tmp = tempDir("no-save-migrate", { ...project, [name]: contents });
+      const dir = String(tmp);
+
+      const { stdout, stderr, exitCode } = await run(dir, "--no-save");
+      expect(stderr).toContain(`migrated lockfile from ${name}`);
+      expect(stderr).not.toContain("note:");
+      expect(stdout + stderr).not.toContain("Saved");
+      expect(existsSync(lock(dir))).toBe(false);
+      expect(existsSync(join(dir, "node_modules", "foo", "package.json"))).toBe(true);
+      expect(exitCode).toBe(0);
+    },
+  );
+
+  it.concurrent.each(migrations)(
+    "a plain install still writes bun.lock when migrating from %s",
+    async (name, contents) => {
+      using tmp = tempDir("install-migrate", { ...project, [name]: contents });
+      const dir = String(tmp);
+
+      const { stderr, exitCode } = await run(dir);
+      expect(stderr).toContain(`migrated lockfile from ${name}`);
+      expect(stderr).toContain("Saved lockfile");
+      expect(readFileSync(lock(dir), "utf8")).toContain('"foo": ["foo@file:foo", {}]');
+      expect(existsSync(join(dir, "node_modules", "foo", "package.json"))).toBe(true);
+      expect(exitCode).toBe(0);
+    },
+  );
 });
 
 describe("--lockfile-only with remove and update", () => {
diff --git a/test/cli/install/migration/migrate.test.ts b/test/cli/install/migration/migrate.test.ts
index 957147105b7a..85cd8b69f4b3 100644
--- a/test/cli/install/migration/migrate.test.ts
+++ b/test/cli/install/migration/migrate.test.ts
@@ -1276,7 +1276,7 @@ describe("package-lock.json migration fixes", () => {
     await frozen(dir);
 
     using fresh = fixture("carbonium");
-    const result = await run(fresh, "install", "--frozen-lockfile", "--lockfile-only");
+    const result = await run(fresh, "install", "--lockfile-only");
     expect(result.stderr).not.toContain("Ignoring lockfile");
     expect(result.exitCode).toBe(0);
     expect((await readLock(fresh)).lock.packages).toStrictEqual(lock.packages);
diff --git a/test/cli/install/migration/pnpm-lock-v9.test.ts b/test/cli/install/migration/pnpm-lock-v9.test.ts
index 22e7b40fc17b..432f2456cf92 100644
--- a/test/cli/install/migration/pnpm-lock-v9.test.ts
+++ b/test/cli/install/migration/pnpm-lock-v9.test.ts
@@ -290,7 +290,7 @@ importers:
 
     async function migrateThenFrozenInstall(dir: string) {
       const { stderr, exitCode } = await migrate(dir);
-      expect(stderr).toContain("moved pnpm-workspace.yaml to workspaces in package.json");
+      expect(stderr).toContain("copied pnpm-workspace.yaml to workspaces in package.json");
       expect(stderr).toContain("migrated lockfile from pnpm-lock.yaml");
       expect(stderr).not.toContain("warn:");
       expect(exitCode).toBe(0);
@@ -3588,6 +3588,241 @@ catalog:
     });
   });
 
+  // The settings moved out of `pnpm` / pnpm-workspace.yaml are edited into package.json in memory while the
+  // lockfile loads; the file is only written together with bun.lock.
+  describe("package.json edits", () => {
+    const packageJson = `{
+  "name": "root",
+  "private": true,
+  "dependencies": {
+    "a": "workspace:*",
+    "foo": "file:vendor/foo"
+  },
+  "pnpm": {
+    "overrides": {
+      "left-pad": "1.3.0"
+    }
+  }
+}
+`;
+    const migratedPackageJson = {
+      name: "root",
+      private: true,
+      dependencies: { a: "workspace:*", foo: "file:vendor/foo" },
+      overrides: { "left-pad": "1.3.0" },
+      workspaces: ["packages/*"],
+    };
+    const files = {
+      "package.json": packageJson,
+      "pnpm-workspace.yaml": "packages:\n  - 'packages/*'\n",
+      "packages/a/package.json": JSON.stringify({ name: "a", version: "1.0.0" }),
+      "vendor/foo/package.json": JSON.stringify({
+        name: "foo",
+        version: "1.0.0",
+        scripts: { postinstall: "echo foo-postinstall" },
+      }),
+      "pnpm-lock.yaml": `lockfileVersion: '9.0'
+
+overrides:
+  left-pad: 1.3.0
+
+importers:
+
+  .:
+    dependencies:
+      a:
+        specifier: workspace:*
+        version: link:packages/a
+      foo:
+        specifier: file:vendor/foo
+        version: file:vendor/foo
+
+  packages/a: {}
+
+packages:
+
+  foo@file:vendor/foo:
+    resolution: {directory: vendor/foo, type: directory}
+    version: 1.0.0
+
+snapshots:
+
+  foo@file:vendor/foo: {}
+`,
+    };
+    const movedLine = "copied pnpm.overrides to overrides, pnpm-workspace.yaml to workspaces in package.json";
+    const frozenNote =
+      "note: the lockfile is frozen, so the migration from pnpm-lock.yaml was not written to bun.lock and package.json; run 'bun install' and commit the result";
+
+    async function expectUntouched(dir: string) {
+      expect(await Bun.file(join(dir, "package.json")).text()).toBe(packageJson);
+      expect(existsSync(join(dir, "bun.lock"))).toBe(false);
+    }
+
+    test.concurrent.each([
+      ["install --frozen-lockfile", ["install", "--frozen-lockfile"]],
+      ["ci", ["ci"]],
+      ["install --production", ["install", "--production"]],
+    ])("bun %s installs the migrated lockfile without writing package.json or bun.lock", async (_, args) => {
+      using dir = tempDir("pnpm-v9-package-json-frozen", files);
+
+      const { stdout, stderr, exitCode } = await run(String(dir), ...args);
+
+      expect(stderr).not.toContain("error:");
+      expect(stderr).toContain("migrated lockfile from pnpm-lock.yaml");
+      expect(stderr).toContain(frozenNote);
+      expect(stderr).not.toContain(movedLine);
+      expect(stdout + stderr).not.toContain("Saved");
+      await expectUntouched(String(dir));
+      expect(await installedPackageJson(String(dir), "", "foo")).toMatchObject({ name: "foo", version: "1.0.0" });
+      expect(await installedPackageJson(String(dir), "", "a")).toStrictEqual({ name: "a", version: "1.0.0" });
+      expect(exitCode).toBe(0);
+    });
+
+    test.concurrent("install --frozen-lockfile fails once the lockfile and package.json disagree", async () => {
+      using dir = tempDir("pnpm-v9-package-json-frozen-stale", {
+        ...files,
+        "pnpm-lock.yaml": files["pnpm-lock.yaml"].replace("left-pad: 1.3.0", "left-pad: 1.2.0"),
+      });
+
+      const { stderr, exitCode } = await run(String(dir), "install", "--frozen-lockfile");
+
+      expect(stderr).toContain("error: lockfile had changes, but lockfile is frozen");
+      expect(stderr).toContain("note: overrides in package.json changed since pnpm-lock.yaml was saved");
+      expect(exitCode).toBe(1);
+      expect(await Bun.file(join(String(dir), "package.json")).text()).toBe(packageJson);
+      expect(existsSync(join(String(dir), "bun.lock"))).toBe(false);
+    });
+
+    test.concurrent.each([
+      ["install --dry-run", ["install", "--dry-run"]],
+      ["install --no-save", ["install", "--no-save"]],
+      ["outdated", ["outdated"]],
+      ["pm why a", ["pm", "why", "a"]],
+      ["pm untrusted", ["pm", "untrusted"]],
+    ])("bun %s leaves package.json and bun.lock alone", async (_, args) => {
+      using dir = tempDir("pnpm-v9-package-json-read-only", files);
+
+      const { stdout, stderr, exitCode } = await run(String(dir), ...args);
+
+      expect(stderr).not.toContain("error:");
+      expect(stderr).toContain("migrated lockfile from pnpm-lock.yaml");
+      expect(stderr).not.toContain("note:");
+      expect(stdout + stderr).not.toContain("copied ");
+      expect(stdout + stderr).not.toContain("Saved");
+      await expectUntouched(String(dir));
+      expect(exitCode).toBe(0);
+    });
+
+    test.concurrent.each([
+      ["install", ["install"]],
+      ["install --lockfile-only", ["install", "--lockfile-only"]],
+      ["pm migrate", ["pm", "migrate"]],
+      // pm migrate saves bun.lock whatever install flags are passed, so package.json has to follow it.
+      ["pm migrate --dry-run", ["pm", "migrate", "--dry-run"]],
+    ])("bun %s writes the edited package.json together with bun.lock", async (_, args) => {
+      using dir = tempDir("pnpm-v9-package-json-written", files);
+
+      const { stderr, exitCode } = await run(String(dir), ...args);
+
+      expect(stderr).not.toContain("error:");
+      expect(stderr).toContain("migrated lockfile from pnpm-lock.yaml");
+      expect(stderr.split(movedLine).length - 1).toBe(1);
+      expect(await Bun.file(join(String(dir), "package.json")).json()).toStrictEqual(migratedPackageJson);
+      expect(await bunLockOf(String(dir))).toContain(`"packages/a": {`);
+      expect(exitCode).toBe(0);
+
+      const written = await Bun.file(join(String(dir), "package.json")).text();
+      const frozen = await run(String(dir), "install", "--frozen-lockfile");
+
+      expect(frozen.stderr).not.toContain("error:");
+      expect(frozen.stderr).not.toContain("migrated lockfile");
+      expect(frozen.exitCode).toBe(0);
+      expect(await Bun.file(join(String(dir), "package.json")).text()).toBe(written);
+    });
+
+    test.concurrent("remove keeps the edits the migration made to package.json", async () => {
+      using dir = tempDir("pnpm-v9-package-json-remove", files);
+
+      const { stderr, exitCode } = await run(String(dir), "remove", "foo");
+
+      expect(stderr).not.toContain("error:");
+      expect(stderr.split(movedLine).length - 1).toBe(1);
+      expect(await Bun.file(join(String(dir), "package.json")).json()).toStrictEqual({
+        ...migratedPackageJson,
+        dependencies: { a: "workspace:*" },
+      });
+      expect(await bunLockOf(String(dir))).not.toContain("foo");
+      expect(exitCode).toBe(0);
+
+      const frozen = await run(String(dir), "install", "--frozen-lockfile");
+
+      expect(frozen.stderr).not.toContain("error:");
+      expect(frozen.exitCode).toBe(0);
+    });
+
+    test.concurrent("add writes its own edit and the migration's edits in one package.json", async () => {
+      using dir = tempDir("pnpm-v9-package-json-add", {
+        ...files,
+        "vendor/bar/package.json": JSON.stringify({ name: "bar", version: "1.0.0" }),
+      });
+
+      const { stderr, exitCode } = await run(String(dir), "add", "./vendor/bar");
+
+      expect(stderr).not.toContain("error:");
+      expect(stderr.split(movedLine).length - 1).toBe(1);
+      const written = await Bun.file(join(String(dir), "package.json")).json();
+      expect(written).toMatchObject({
+        overrides: migratedPackageJson.overrides,
+        workspaces: migratedPackageJson.workspaces,
+      });
+      expect(written).not.toHaveProperty("pnpm");
+      expect(Object.keys(written.dependencies).sort()).toStrictEqual(["a", "bar", "foo"]);
+      expect(await bunLockOf(String(dir))).toContain(`"bar":`);
+      expect(exitCode).toBe(0);
+
+      const frozen = await run(String(dir), "install", "--frozen-lockfile");
+
+      expect(frozen.stderr).not.toContain("error:");
+      expect(frozen.exitCode).toBe(0);
+    });
+
+    test.concurrent("install --silent writes both files without printing", async () => {
+      using dir = tempDir("pnpm-v9-package-json-silent", files);
+
+      const { stdout, stderr, exitCode } = await run(String(dir), "install", "--silent");
+
+      expect(stdout).toBe("");
+      expect(stderr).toBe("");
+      expect(await Bun.file(join(String(dir), "package.json")).json()).toStrictEqual(migratedPackageJson);
+      expect(existsSync(join(String(dir), "bun.lock"))).toBe(true);
+      expect(exitCode).toBe(0);
+    });
+
+    test.concurrent("pm trust writes the edited package.json along with the lockfile it saves", async () => {
+      using dir = tempDir("pnpm-v9-package-json-pm-trust", files);
+
+      const install = await run(String(dir), "install", "--frozen-lockfile");
+      expect(install.stderr).not.toContain("error:");
+      expect(install.exitCode).toBe(0);
+      await expectUntouched(String(dir));
+
+      const { stdout, stderr, exitCode } = await run(String(dir), "pm", "trust", "foo");
+
+      expect(stderr).not.toContain("error:");
+      expect(stderr).toContain(movedLine);
+      expect(stdout).toContain("1 script ran across 1 package");
+      expect(await Bun.file(join(String(dir), "package.json")).json()).toStrictEqual({
+        ...migratedPackageJson,
+        trustedDependencies: ["foo"],
+      });
+      const bunLock = await bunLockOf(String(dir));
+      expect(bunLock).toContain(`"packages/a": {`);
+      expect(bunLock).toContain(`"trustedDependencies": [`);
+      expect(exitCode).toBe(0);
+    });
+  });
+
   test.concurrent("link: version with a semver specifier resolves to the workspace (pnpm/pnpm#7712)", async () => {
     // save-workspace-protocol=false / link-workspace-packages shape
     using dir = fixture("v9-link-semver-specifier");

From 3448f0ada6e3ed1ac70c86746ed988658a1c3800 Mon Sep 17 00:00:00 2001
From: robobun <117481402+robobun@users.noreply.github.com>
Date: Mon, 17 Aug 2026 02:09:25 +0000
Subject: [PATCH 135/258] install: resolve file: and link: dependencies on the
 same directory as separate packages (#38114)

---
 src/install/PackageManager.rs            | 14 ++---
 src/install/resolvers/folder_resolver.rs | 68 ++++++++++++++++++++----
 test/cli/install/bun-install.test.ts     | 46 ++++++++++++++++
 3 files changed, 112 insertions(+), 16 deletions(-)

diff --git a/src/install/PackageManager.rs b/src/install/PackageManager.rs
index ea2d4d68d174..2f27cbdba9e1 100644
--- a/src/install/PackageManager.rs
+++ b/src/install/PackageManager.rs
@@ -178,7 +178,10 @@ Learn more about these at <magenta>https://bun.com/docs/cli/pm<r>.
 
 use crate::lockfile_real::package as Package;
 use crate::package_manager_task as Task;
-use crate::resolvers::folder_resolver::{Entry as FolderResolutionEntry, FolderResolution};
+use crate::resolvers::folder_resolver::{
+    Entry as FolderResolutionEntry, FolderResolution, Key as FolderResolutionKey,
+    Kind as FolderResolutionKind,
+};
 use bun_install::lockfile::{self, Lockfile};
 use bun_install::{
     Dependency, DependencyID, NetworkTask, PackageID, PackageManifestMap,
@@ -270,8 +273,7 @@ type RepositoryMap = HashMap<Task::Id, Fd /* , IdentityContext<Task::Id>, 80 */>
 /// process.
 type AppendedTaskPackageMap =
     HashMap<Task::Id, PackageID /* , IdentityContext<Task::Id>, 80 */>;
-pub(crate) type FolderResolutionMap =
-    HashMap<u64, FolderResolutionEntry /* , IdentityContext<u64>, 80 */>;
+pub(crate) type FolderResolutionMap = HashMap<FolderResolutionKey, FolderResolutionEntry>;
 pub(crate) type NpmAliasMap =
     HashMap<PackageNameHash, crate::dependency::Version /* , IdentityContext<u64>, 80 */>;
 
@@ -2201,8 +2203,8 @@ pub fn init(
     {
         // make sure folder packages can find the root package without creating a new one
         // Posix-normalize the
-        // separators before hashing; `FolderResolution.hash` is always fed `/`-separated
-        // bytes by every resolver-side caller. On Windows this path contains `\`, so
+        // separators before hashing; the folder resolver always builds its `Key` from
+        // `/`-separated bytes. On Windows this path contains `\`, so
         // hashing the raw bytes would seed a key the resolver never looks up — copy into
         // a stack buffer and convert separators in place.
         // SAFETY: ROOT_PACKAGE_JSON_PATH set above on the main thread.
@@ -2213,7 +2215,7 @@ pub fn init(
         resolve_path::dangerously_convert_path_to_posix_in_place::<u8>(normalized);
         // SAFETY: singleton fully initialized; main thread, no workers yet.
         unsafe { &mut *manager_ptr }.folders.put(
-            crate::resolvers::folder_resolver::hash(normalized),
+            FolderResolutionKey::new(FolderResolutionKind::Folder, normalized),
             FolderResolutionEntry {
                 abs_path: Box::<[u8]>::from(&*normalized),
                 resolution: FolderResolution::PackageId(0),
diff --git a/src/install/resolvers/folder_resolver.rs b/src/install/resolvers/folder_resolver.rs
index fd178f8e5780..ef198b1fde43 100644
--- a/src/install/resolvers/folder_resolver.rs
+++ b/src/install/resolvers/folder_resolver.rs
@@ -83,8 +83,46 @@ impl<'a> fmt::Display for PackageWorkspaceSearchPathFormatter<'a> {
     }
 }
 
+/// What a directory's `package.json` is read as. Each kind parses it with
+/// different `Features` and produces a different `Resolution`, so one
+/// directory is cached separately per kind: a `link:` and a `file:` pointing
+/// at the same directory are two packages, and whichever resolves first must
+/// not be handed out for the other.
+#[derive(Copy, Clone, PartialEq, Eq, Hash)]
+pub(crate) enum Kind {
+    /// A `file:` dependency or a workspace member (`Features::FOLDER` /
+    /// `Features::WORKSPACE`, dependencies installed). These share an entry
+    /// so a `file:` pointing at a workspace member, or at the root package
+    /// seeded by `PackageManager::init`, resolves to that existing package.
+    Folder,
+    /// A `link:` target (`Features::LINK`: its dependencies are not
+    /// installed, `Resolution::Symlink`).
+    Link,
+    /// An npm package already extracted into the cache (`Features::NPM`,
+    /// `Resolution::Npm`).
+    CacheFolder,
+}
+
+/// Key of the folder-resolution map.
+#[derive(Copy, Clone, PartialEq, Eq, Hash)]
+pub(crate) struct Key {
+    kind: Kind,
+    /// Hash of the normalized absolute `package.json` path; `Entry::abs_path`
+    /// holds the bytes it was computed from.
+    abs_hash: u64,
+}
+
+impl Key {
+    pub(crate) fn new(kind: Kind, normalized_abs_path: &[u8]) -> Key {
+        Key {
+            kind,
+            abs_hash: bun_wyhash::hash(normalized_abs_path),
+        }
+    }
+}
+
 /// Value stored in the folder-resolution map: the resolution plus the
-/// normalized absolute `package.json` path the key hash was computed from.
+/// normalized absolute `package.json` path `Key::abs_hash` was computed from.
 /// Lookups compare the path, since a different path whose hash collides must
 /// not reuse this resolution.
 pub struct Entry {
@@ -95,10 +133,6 @@ pub struct Entry {
 // bun_collections::HashMap currently ignores the context/load-factor
 // type params (backed by std HashMap); identity hashing is a TODO(perf).
 
-pub(crate) fn hash(normalized_path: &[u8]) -> u64 {
-    bun_wyhash::hash(normalized_path)
-}
-
 // ── NewResolver ───────────────────────────────────────────────────────────
 // The const-generic tag requires `#[derive(ConstParamTy)]` (already on `Tag`).
 struct NewResolver<'a, const TAG: ResolutionTag> {
@@ -381,6 +415,20 @@ pub enum GlobalOrRelative<'a> {
     CacheFolder(&'a [u8]),
 }
 
+impl GlobalOrRelative<'_> {
+    /// Must agree with the resolver `get_or_put` picks for each variant.
+    fn kind(self) -> Kind {
+        match self {
+            GlobalOrRelative::Global(_) => Kind::Link,
+            GlobalOrRelative::Relative(
+                dependency::version::Tag::Folder | dependency::version::Tag::Workspace,
+            ) => Kind::Folder,
+            GlobalOrRelative::Relative(_) => unreachable!(),
+            GlobalOrRelative::CacheFolder(_) => Kind::CacheFolder,
+        }
+    }
+}
+
 pub(crate) fn get_or_put(
     global_or_relative: GlobalOrRelative<'_>,
     version: &dependency::Version,
@@ -408,7 +456,7 @@ pub(crate) fn get_or_put(
         // `(&[u8]).as_ptr().cast_mut()` would be UB under Stacked/Tree
         // Borrows: those pointers carry read-only provenance, and the
         // optimizer may assume `abs`'s bytes are unchanged when computing
-        // `hash(abs.as_bytes())` below.
+        // the `Key` below.
         //
         // Instead: capture lengths, let the shared borrows of `joined` die,
         // then take a fresh `&mut joined[..abs_len]` (write provenance) and
@@ -429,13 +477,13 @@ pub(crate) fn get_or_put(
             &rel_buf[..rel_len],
         )
     };
-    let abs_hash = hash(abs.as_bytes());
+    let key = Key::new(global_or_relative.kind(), abs.as_bytes());
 
     // Check first, compute, then insert, because read_package_json_from_disk
     // needs &mut manager. Compare the stored path, not just its hash: a
     // different path whose hash collides must not reuse this resolution. On a
     // collision, resolve fresh without caching so the first path's entry stays.
-    let hash_collision = match manager.folders.get(&abs_hash) {
+    let hash_collision = match manager.folders.get(&key) {
         Some(existing) if *existing.abs_path == *abs.as_bytes() => return existing.resolution,
         Some(_) => true,
         None => false,
@@ -506,7 +554,7 @@ pub(crate) fn get_or_put(
             };
             if !hash_collision {
                 manager.folders.insert(
-                    abs_hash,
+                    key,
                     Entry {
                         abs_path: abs.as_bytes().into(),
                         resolution: stored,
@@ -519,7 +567,7 @@ pub(crate) fn get_or_put(
 
     if !hash_collision {
         manager.folders.insert(
-            abs_hash,
+            key,
             Entry {
                 abs_path: abs.as_bytes().into(),
                 resolution: FolderResolution::PackageId(package.meta.id),
diff --git a/test/cli/install/bun-install.test.ts b/test/cli/install/bun-install.test.ts
index fa2357409e4d..20a408d14bde 100644
--- a/test/cli/install/bun-install.test.ts
+++ b/test/cli/install/bun-install.test.ts
@@ -13053,6 +13053,52 @@ describe.concurrent("file: tarball declared by a file: folder dependency", () =>
   });
 });
 
+// A `file:` dependency is a folder package whose dependencies get installed; a
+// `link:` dependency on the same directory is a bare symlink with none. The
+// folder resolver caches resolutions per directory, so whichever of the two
+// resolved first used to be handed out for the other one as well. Dependencies
+// resolve in alias order, so "a" is resolved before "z".
+for (const [first, second] of [
+  ["link", "file"],
+  ["file", "link"],
+] as const) {
+  it(`resolves file: and link: to the same directory as separate packages (${first}: resolves first)`, async () => {
+    using dir = tempDir("file-and-link-to-same-dir", {
+      "shared/package.json": JSON.stringify({
+        name: "shared",
+        version: "1.0.0",
+        dependencies: { extra: "file:../app/extra" },
+      }),
+      "app/extra/package.json": JSON.stringify({ name: "extra", version: "1.0.0" }),
+      "app/package.json": JSON.stringify({
+        name: "app",
+        dependencies: { a: `${first}:../shared`, z: `${second}:../shared` },
+      }),
+    });
+    const projectDir = join(String(dir), "app");
+    const fileAlias = first === "file" ? "a" : "z";
+    const linkAlias = first === "link" ? "a" : "z";
+
+    await using proc = spawn({
+      cmd: [bunExe(), "install", "--lockfile-only"],
+      cwd: projectDir,
+      stdout: "pipe",
+      stderr: "pipe",
+      env,
+    });
+    const [err, , exitCode] = await Promise.all([proc.stderr.text(), proc.stdout.text(), proc.exited]);
+
+    expect(err).not.toContain("error:");
+    expect(exitCode).toBe(0);
+    const lockfile = Bun.JSONC.parse(await file(join(projectDir, "bun.lock")).text()) as any;
+    expect(lockfile.packages).toEqual({
+      [fileAlias]: ["shared@file:../shared", { dependencies: { extra: "file:../app/extra" } }],
+      [`${fileAlias}/extra`]: ["extra@file:extra", {}],
+      [linkAlias]: ["shared@link:../shared", {}],
+    });
+  });
+}
+
 it("does not extract a local file: tarball outside the temp dir for a dependency alias containing '..' path segments", async () => {
   // For `file:` tarball dependencies, the dependency alias (the key in
   // `dependencies`) is used to derive the temporary extraction folder name.

From 1a5d1cfb3bea6b51cd5de23340bfdfb6028e04ad Mon Sep 17 00:00:00 2001
From: robobun <117481402+robobun@users.noreply.github.com>
Date: Mon, 17 Aug 2026 02:10:01 +0000
Subject: [PATCH 136/258] install: stop leaking the displaced cache folder when
 a tarball is re-extracted (#38702)

---
 src/install/PackageManager/patchPackage.rs    |   7 +-
 src/install/TarballStream.rs                  |   6 +
 src/install/extract_tarball.rs                | 116 +++++++----
 src/install/repository.rs                     |   4 +-
 src/install/resolution.rs                     |   6 +
 src/sys/lib.rs                                |  82 +++++++-
 .../bun-install-tarball-integrity.test.ts     | 182 ++++++++++++------
 7 files changed, 303 insertions(+), 100 deletions(-)

diff --git a/src/install/PackageManager/patchPackage.rs b/src/install/PackageManager/patchPackage.rs
index 8709f93b8596..ec2cfeda70a0 100644
--- a/src/install/PackageManager/patchPackage.rs
+++ b/src/install/PackageManager/patchPackage.rs
@@ -350,6 +350,7 @@ pub fn do_patch_commit(
                 random_tempdir.as_bytes(),
                 sys::RenameOptions {
                     move_fallback: true,
+                    ..Default::default()
                 },
             )
             .is_err()
@@ -405,6 +406,7 @@ pub fn do_patch_commit(
                 patch_tag_tmpname.as_bytes(),
                 sys::RenameOptions {
                     move_fallback: true,
+                    ..Default::default()
                 },
             ) {
                 bun_core::warn!(
@@ -437,7 +439,7 @@ pub fn do_patch_commit(
                         random_tempdir.as_bytes(),
                         new_folder_handle.fd,
                         b"node_modules",
-                        sys::RenameOptions { move_fallback: true },
+                        sys::RenameOptions { move_fallback: true, ..Default::default() },
                     ) {
                         bun_core::warn!("failed renaming nested node_modules folder, this may cause issues: {}", e);
                     }
@@ -449,7 +451,7 @@ pub fn do_patch_commit(
                         patch_tag_tmpname.as_bytes(),
                         new_folder_handle.fd,
                         patch_tag,
-                        sys::RenameOptions { move_fallback: true },
+                        sys::RenameOptions { move_fallback: true, ..Default::default() },
                     ) {
                         bun_core::warn!("failed renaming the bun patch tag, this may cause issues: {}", e);
                     }
@@ -594,6 +596,7 @@ pub fn do_patch_commit(
         path_in_patches_dir,
         sys::RenameOptions {
             move_fallback: true,
+            ..Default::default()
         },
     ) {
         Output::err(e, "failed renaming patch file to patches dir", ());
diff --git a/src/install/TarballStream.rs b/src/install/TarballStream.rs
index 4b88143a651f..aa1caa042fd6 100644
--- a/src/install/TarballStream.rs
+++ b/src/install/TarballStream.rs
@@ -133,6 +133,8 @@ pub struct TarballStream {
     /// Owned copy of the temp-directory name.
     // `ZBox` is the owned NUL-terminated counterpart of `&ZStr`.
     tmpname: ZBox,
+    /// Captured in `init`, before the first byte is extracted.
+    cache_publish: CachePublish,
 
     /// Incremental SHA over the *compressed* bytes, matching
     /// `Integrity.verify` / `Integrity.forBytes` in the buffered path.
@@ -230,6 +232,7 @@ impl TarballStream {
             },
             compute_if_missing,
         );
+        let cache_publish = tarball.cache_publish();
 
         // bun.TrivialNew(@This()) → heap::alloc(Box::new(...)). Pointer is
         // recovered via `container_of` from the thread-pool callback and
@@ -254,6 +257,7 @@ impl TarballStream {
             entry_final_offset: 0,
             dest: None,
             tmpname: ZBox::from_bytes(b""),
+            cache_publish,
             hasher,
             resolved_github_dirname: b"",
             want_first_dirname,
@@ -1161,6 +1165,7 @@ impl TarballStream {
                 basename,
                 self.resolved_github_dirname,
                 &integrity,
+                self.cache_publish,
             ) {
                 Ok(r) => r,
                 Err(err) => {
@@ -1442,5 +1447,6 @@ fn tokenize_rest_after_first(s: &[OSPathChar]) -> &[OSPathChar] {
 
 // Resolved Phase-B paths: Resolution::Tag is the real npm/git/tarball
 // discriminant; Data/Status live on PackageManagerTask.
+use crate::extract_tarball::CachePublish;
 use crate::package_manager_task::{Data as TaskData, Status as TaskStatus};
 use crate::resolution::Tag as ResolutionTag;
diff --git a/src/install/extract_tarball.rs b/src/install/extract_tarball.rs
index 01f15fae27a2..7d87d2fac489 100644
--- a/src/install/extract_tarball.rs
+++ b/src/install/extract_tarball.rs
@@ -183,7 +183,42 @@ pub(crate) fn uses_streaming_extraction() -> bool {
         .unwrap_or(false)
 }
 
+/// How `move_to_cache_directory` treats a cache folder that already has the
+/// name being published. Decided before extracting: afterwards a pre-existing
+/// folder and one a concurrent install published meanwhile look the same.
+#[derive(Clone, Copy, PartialEq, Eq)]
+pub(crate) enum CachePublish {
+    /// npm and GitHub: swap the fresh copy in. The swapped-out folder is left
+    /// in the temp dir, as a concurrent install may still be reading it.
+    Replace,
+    /// Tarball re-extracted over its own folder: swap the fresh copy in and
+    /// delete the swapped-out folder.
+    Supersede,
+    /// Tarball whose folder did not exist yet: if one exists by now, a
+    /// concurrent install extracted the same tarball, so keep it and drop ours.
+    KeepExisting,
+}
+
 impl ExtractTarball {
+    pub(crate) fn cache_publish(&self) -> CachePublish {
+        if !self.resolution.tag.is_tarball() {
+            return CachePublish::Replace;
+        }
+        let name_taken = TL_BUFS.with_borrow_mut(|bufs| {
+            let folder_name = directories::cached_tarball_folder_name_print(
+                &mut bufs.folder_name_buf,
+                self.url.slice(),
+                None,
+            );
+            sys::exists_at_type(self.cache_dir, folder_name).is_ok()
+        });
+        if name_taken {
+            CachePublish::Supersede
+        } else {
+            CachePublish::KeepExisting
+        }
+    }
+
     /// Derive the display name and a filesystem-safe basename for this
     /// package. Shared by the buffered `extract()` path below and the
     /// streaming extractor in `TarballStream.rs` so both pick identical
@@ -274,6 +309,7 @@ impl ExtractTarball {
         let mut resolved: &'static [u8] = b"";
         let tmpname =
             FileSystem::tmpname(tmpname_suffix, &mut tmpname_buf.0, bun_core::fast_random())?;
+        let publish = self.cache_publish();
         {
             let extract_destination = match bun_sys::make_path::make_open_path(
                 tmpdir,
@@ -457,7 +493,7 @@ impl ExtractTarball {
             }
         }
 
-        self.move_to_cache_directory(log, tmpname, name, basename, resolved, integrity)
+        self.move_to_cache_directory(log, tmpname, name, basename, resolved, integrity, publish)
     }
 
     /// Rename the freshly-extracted temp directory into the cache, read
@@ -475,6 +511,7 @@ impl ExtractTarball {
         basename: &[u8],
         resolved: &[u8],
         integrity: &Integrity,
+        publish: CachePublish,
     ) -> Result<ExtractData, Error> {
         let package_manager = self.package_manager.get();
 
@@ -548,7 +585,7 @@ impl ExtractTarball {
 
             // Now that we've extracted the archive, we rename.
             #[cfg(windows)]
-            {
+            let moved: Result<(), Error> = 'moved: {
                 // Windows EBUSY/SHARING_VIOLATION on `NtSetInformationFile` is
                 // transient when a concurrent process (another `bun install`
                 // sharing the cache, AV, the Search Indexer) is closing its
@@ -564,6 +601,10 @@ impl ExtractTarball {
                 }
 
                 let path_to_use = path2;
+                let mut folder_name_z_buf = PathBuffer::uninit();
+                folder_name_z_buf[0..folder_name.len()].copy_from_slice(folder_name);
+                folder_name_z_buf[folder_name.len()] = 0;
+                let folder_name_z = ZStr::from_buf(&folder_name_z_buf, folder_name.len());
 
                 loop {
                     let dir_to_move = match sys::open_dir_at_windows_a(
@@ -589,7 +630,7 @@ impl ExtractTarball {
                                     bun_fmt::s(folder_name),
                                 ),
                             );
-                            return Err(crate::Error::InstallFailed);
+                            break 'moved Err(crate::Error::InstallFailed);
                         }
                     };
 
@@ -609,6 +650,16 @@ impl ExtractTarball {
                                         // before we attempt to delete the destination, let's close the source dir.
                                         let _ = sys::close(dir_to_move);
 
+                                        if publish == CachePublish::KeepExisting
+                                            && sys::directory_exists_at(
+                                                cache_dir.fd(),
+                                                folder_name_z,
+                                            )
+                                            .unwrap_or(false)
+                                        {
+                                            break;
+                                        }
+
                                         // We tried to move the folder over
                                         // but it didn't work!
                                         // so instead of just simply deleting the folder
@@ -622,12 +673,6 @@ impl ExtractTarball {
                                             .copy_from_slice(&[b't', b'm', b'p', 0]);
                                         let tempdest =
                                             ZStr::from_buf(&tempdest_buf, tmpname.len() + 3);
-                                        let mut folder_name_z_buf = PathBuffer::uninit();
-                                        folder_name_z_buf[0..folder_name.len()]
-                                            .copy_from_slice(folder_name);
-                                        folder_name_z_buf[folder_name.len()] = 0;
-                                        let folder_name_z =
-                                            ZStr::from_buf(&folder_name_z_buf, folder_name.len());
                                         match sys::renameat(
                                             Fd::from_std_dir(cache_dir),
                                             folder_name_z,
@@ -664,7 +709,7 @@ impl ExtractTarball {
                                     bun_fmt::s(folder_name),
                                 ),
                             );
-                            return Err(crate::Error::InstallFailed);
+                            break 'moved Err(crate::Error::InstallFailed);
                         }
                         bun_sys::Result::Ok(_) => {
                             let _ = sys::close(dir_to_move);
@@ -673,47 +718,50 @@ impl ExtractTarball {
 
                     break;
                 }
-            }
+                Ok(())
+            };
             #[cfg(not(windows))]
-            {
-                // Attempt to gracefully handle duplicate concurrent `bun install` calls
-                //
-                // By:
-                // 1. Rename from temporary directory to cache directory and fail if it already exists
-                // 2a. If the rename fails, swap the cache directory with the temporary directory version
-                // 2b. Delete the temporary directory version ONLY if we're not using a provided temporary directory
-                // 3. If rename still fails, fallback to racily deleting the cache directory version and then renaming the temporary directory version again.
-                //
-
+            let moved: Result<(), Error> = {
                 if create_subdir {
                     if let Some(folder) = bun_paths::Dirname::dirname(folder_name) {
                         let _ = bun_sys::make_path::make_path(cache_dir, folder);
                     }
                 }
 
-                if let Err(err) = sys::renameat_concurrently_a(
+                match sys::renameat_concurrently_a(
                     tmpdir.fd(),
                     tmpname.as_bytes(),
                     cache_dir.fd(),
                     folder_name,
                     sys::RenameatConcurrentlyOptions {
                         move_fallback: true,
+                        keep_existing_destination: publish == CachePublish::KeepExisting,
                     },
                 ) {
-                    log.add_error_fmt(
-                        None,
-                        bun_ast::Loc::EMPTY,
-                        format_args!(
-                            "moving \"{}\" to cache dir failed: {}\n  From: {}\n    To: {}",
-                            bun_fmt::s(name),
-                            err,
-                            bun_fmt::s(tmpname.as_bytes()),
-                            bun_fmt::s(folder_name),
-                        ),
-                    );
-                    return Err(crate::Error::InstallFailed);
+                    Ok(()) => Ok(()),
+                    Err(err) => {
+                        log.add_error_fmt(
+                            None,
+                            bun_ast::Loc::EMPTY,
+                            format_args!(
+                                "moving \"{}\" to cache dir failed: {}\n  From: {}\n    To: {}",
+                                bun_fmt::s(name),
+                                err,
+                                bun_fmt::s(tmpname.as_bytes()),
+                                bun_fmt::s(folder_name),
+                            ),
+                        );
+                        Err(crate::Error::InstallFailed)
+                    }
                 }
+            };
+
+            // The temp name now holds our own copy (failed or lost), the
+            // superseded folder, or a `Replace` swap-out (see `CachePublish`).
+            if moved.is_err() || publish != CachePublish::Replace {
+                let _ = tmpdir.delete_tree(tmpname.as_bytes());
             }
+            moved?;
 
             // We return a resolved absolute absolute file path to the cache dir.
             // To get that directory, we open the directory again.
diff --git a/src/install/repository.rs b/src/install/repository.rs
index 0d461277d890..d95bfbbf0fa5 100644
--- a/src/install/repository.rs
+++ b/src/install/repository.rs
@@ -467,9 +467,7 @@ impl CacheStaging {
             self.tmp_name(),
             self.cache_dir,
             folder_name,
-            bun_sys::RenameatConcurrentlyOptions {
-                move_fallback: false,
-            },
+            bun_sys::RenameatConcurrentlyOptions::default(),
         );
         // After an exchange the temporary name holds the folder that was replaced.
         self.discard();
diff --git a/src/install/resolution.rs b/src/install/resolution.rs
index f09297efb23d..d2b771cb8857 100644
--- a/src/install/resolution.rs
+++ b/src/install/resolution.rs
@@ -1010,6 +1010,12 @@ impl Tag {
         self == Tag::Root || self == Tag::Workspace || self == Tag::Folder
     }
 
+    /// Cached under a hash of the path or URL, so the folder's contents can
+    /// change from one extraction to the next.
+    pub(crate) fn is_tarball(self) -> bool {
+        self == Tag::LocalTarball || self == Tag::RemoteTarball
+    }
+
     pub(crate) fn can_enqueue_install_task(self) -> bool {
         self == Tag::Npm
             || self == Tag::LocalTarball
diff --git a/src/sys/lib.rs b/src/sys/lib.rs
index 1d93453639ec..ef2d99434b20 100644
--- a/src/sys/lib.rs
+++ b/src/sys/lib.rs
@@ -9139,7 +9139,13 @@ pub fn exists(path: &[u8]) -> bool {
 /// retries; on EXDEV falls back to the slow open+copy path. Only opens the
 /// source inside the EXDEV branch.
 pub fn move_file_z(from_dir: Fd, filename: &ZStr, to_dir: Fd, destination: &ZStr) -> Maybe<()> {
-    match renameat_concurrently_without_fallback(from_dir, filename, to_dir, destination) {
+    match renameat_concurrently_without_fallback(
+        from_dir,
+        filename,
+        to_dir,
+        destination,
+        RenameatConcurrentlyOptions::default(),
+    ) {
         Ok(()) => Ok(()),
         // allow over-writing an empty directory
         Err(e) if e.get_errno() == E::EISDIR => {
@@ -9220,6 +9226,9 @@ pub fn renameat_z(from_dir: impl AsFd, from: &ZStr, to_dir: impl AsFd, to: &ZStr
 #[derive(Default, Clone, Copy)]
 pub struct RenameatConcurrentlyOptions {
     pub move_fallback: bool,
+    /// If `to` already exists (another process published it first and may be
+    /// reading it), keep it and delete `from` instead of replacing it.
+    pub keep_existing_destination: bool,
 }
 /// Alias: `bun_install` call sites spell this `RenameOptions`.
 pub type RenameOptions = RenameatConcurrentlyOptions;
@@ -9238,7 +9247,9 @@ pub(crate) fn move_file_z_slow_maybe(
 
 /// `renameatConcurrently`. Tries an atomic NOREPLACE rename,
 /// then EXCHANGE, then a racy delete-tree + rename. With `move_fallback` set,
-/// an EXDEV result falls through to a slow open/copy.
+/// an EXDEV result falls through to a slow open/copy; see
+/// [`RenameatConcurrentlyOptions`] for `keep_existing_destination`.
+/// After an EXCHANGE, `from` holds the tree that was at `to`.
 pub fn renameat_concurrently(
     from_dir_fd: Fd,
     from: &ZStr,
@@ -9246,7 +9257,7 @@ pub fn renameat_concurrently(
     to: &ZStr,
     opts: RenameatConcurrentlyOptions,
 ) -> Maybe<()> {
-    match renameat_concurrently_without_fallback(from_dir_fd, from, to_dir_fd, to) {
+    match renameat_concurrently_without_fallback(from_dir_fd, from, to_dir_fd, to, opts) {
         Ok(()) => Ok(()),
         Err(e) => {
             if opts.move_fallback && e.get_errno() == E::EXDEV {
@@ -9266,6 +9277,7 @@ pub(crate) fn renameat_concurrently_without_fallback(
     from: &ZStr,
     to_dir_fd: Fd,
     to: &ZStr,
+    opts: RenameatConcurrentlyOptions,
 ) -> Maybe<()> {
     'attempt: {
         {
@@ -9291,6 +9303,27 @@ pub(crate) fn renameat_concurrently_without_fallback(
                 Ok(()) => break 'attempt,
             };
 
+            // Not keyed on the errno: Windows and filesystems without
+            // RENAME_NOREPLACE report an existing `to` differently.
+            if opts.keep_existing_destination
+                && exists_at_type(
+                    if to_dir_fd.is_valid() {
+                        to_dir_fd
+                    } else {
+                        Fd::cwd()
+                    },
+                    to,
+                )
+                .is_ok()
+            {
+                if from_dir_fd.is_valid() {
+                    let _ = Dir::borrow(&from_dir_fd).delete_tree(from.as_bytes());
+                } else {
+                    let _ = delete_tree_absolute(from.as_bytes());
+                }
+                break 'attempt;
+            }
+
             // Windows doesn't have any equivalent of renameat with swap
             #[cfg(not(windows))]
             {
@@ -9653,6 +9686,7 @@ mod owned_handle_tests {
             b"sub",
             RenameatConcurrentlyOptions {
                 move_fallback: true,
+                ..Default::default()
             },
         )
         .expect("rename");
@@ -9668,6 +9702,48 @@ mod owned_handle_tests {
         let _ = close(root);
         let _ = Dir::open(&tmp).map(|d| d.delete_tree(b"."));
     }
+
+    #[test]
+    fn renameat_concurrently_keep_existing_destination() {
+        let _g = crate::file::tests::FD_TEST_LOCK.lock();
+        let mut tmp = std::env::temp_dir().as_os_str().as_encoded_bytes().to_vec();
+        tmp.extend_from_slice(b"/bun_sys_renameat_keep_existing_test");
+        let _ = Dir::open(&tmp).map(|d| d.delete_tree(b"."));
+        let _ = mkdir_recursive_at(Fd::cwd(), &tmp);
+        let root = open_dir_at(Fd::cwd(), &tmp).expect("open root");
+        let _ = mkdir_recursive_at(root, b"from/sub");
+        let _ = mkdir_recursive_at(root, b"to/sub");
+        File::write_file(root, ZStr::from_static(b"from/sub/loser\0"), b"").expect("loser");
+        File::write_file(root, ZStr::from_static(b"to/sub/winner\0"), b"").expect("winner");
+        let to_dir = open_dir_at(root, b"to").expect("open to");
+
+        let opts = RenameatConcurrentlyOptions {
+            keep_existing_destination: true,
+            ..Default::default()
+        };
+
+        // Destination taken: it is kept as-is and the source goes away.
+        renameat_concurrently_a(root, b"from/sub", to_dir, b"sub", opts).expect("rename");
+        assert!(matches!(
+            exists_at_type(root, ZStr::from_static(b"to/sub/winner\0")),
+            Ok(ExistsAtType::File)
+        ));
+        assert!(exists_at_type(root, ZStr::from_static(b"to/sub/loser\0")).is_err());
+        assert!(exists_at_type(root, ZStr::from_static(b"from/sub\0")).is_err());
+
+        // Destination free: a plain rename.
+        let _ = mkdir_recursive_at(root, b"from/other");
+        renameat_concurrently_a(root, b"from/other", to_dir, b"other", opts).expect("rename");
+        assert!(matches!(
+            exists_at_type(root, ZStr::from_static(b"to/other\0")),
+            Ok(ExistsAtType::Directory)
+        ));
+        assert!(exists_at_type(root, ZStr::from_static(b"from/other\0")).is_err());
+
+        let _ = close(to_dir);
+        let _ = close(root);
+        let _ = Dir::open(&tmp).map(|d| d.delete_tree(b"."));
+    }
 }
 
 #[cfg(all(test, windows))]
diff --git a/test/cli/install/bun-install-tarball-integrity.test.ts b/test/cli/install/bun-install-tarball-integrity.test.ts
index 765f13314ccb..ed7bb622b99c 100644
--- a/test/cli/install/bun-install-tarball-integrity.test.ts
+++ b/test/cli/install/bun-install-tarball-integrity.test.ts
@@ -2,7 +2,7 @@ import { file, spawn } from "bun";
 import { afterAll, beforeAll, describe, expect, it, setDefaultTimeout } from "bun:test";
 import { rm, writeFile } from "fs/promises";
 import { bunExe, bunEnv as env, readdirSorted, tempDir } from "harness";
-import { createHash } from "node:crypto";
+import { createHash, randomBytes } from "node:crypto";
 import { gzipSync } from "node:zlib";
 import { join } from "path";
 import {
@@ -39,6 +39,33 @@ async function withContext(
 // Default context options for most tests
 const defaultOpts = { linker: "hoisted" as const };
 
+/** A .tgz with the given files under the usual `package/` root. */
+function tarball(files: Record<string, Buffer>): Buffer {
+  function octal(n: number, width: number) {
+    return n.toString(8).padStart(width - 1, "0") + "\0";
+  }
+  const blocks: Buffer[] = [];
+  for (const [name, body] of Object.entries(files)) {
+    const header = Buffer.alloc(512, 0);
+    header.write(`package/${name}`, 0, 100, "utf8");
+    header.write(octal(0o644, 8), 100);
+    header.write(octal(0, 8), 108);
+    header.write(octal(0, 8), 116);
+    header.write(octal(body.length, 12), 124);
+    header.write(octal(0, 12), 136);
+    header.fill(" ", 148, 156);
+    header.write("0", 156);
+    header.write("ustar\0", 257);
+    header.write("00", 263);
+    let sum = 0;
+    for (let i = 0; i < 512; i++) sum += header[i];
+    header.write(octal(sum, 8), 148);
+    blocks.push(header, body, Buffer.alloc((512 - (body.length % 512)) % 512, 0));
+  }
+  blocks.push(Buffer.alloc(1024, 0));
+  return gzipSync(Buffer.concat(blocks));
+}
+
 describe.concurrent("tarball integrity", () => {
   it("should store integrity hash for tarball URL in text lockfile", async () => {
     await withContext(defaultOpts, async ctx => {
@@ -632,37 +659,8 @@ describe.concurrent.each(["hoisted", "isolated"] as const)("tarball integrity mi
   // callback is the void `onPackageDownloadError = {}` — i.e. the branch the
   // fix in runTasks.zig now cleans up.
   it("should fail (not hang) when tarball bytes don't match manifest SHA-512", { timeout: 60_000 }, async () => {
-    function octal(n: number, width: number) {
-      return n.toString(8).padStart(width - 1, "0") + "\0";
-    }
-    function tarHeader(name: string, size: number) {
-      const buf = Buffer.alloc(512, 0);
-      buf.write(name, 0, 100, "utf8");
-      buf.write(octal(0o644, 8), 100);
-      buf.write(octal(0, 8), 108);
-      buf.write(octal(0, 8), 116);
-      buf.write(octal(size, 12), 124);
-      buf.write(octal(0, 12), 136);
-      buf.fill(" ", 148, 156);
-      buf.write("0", 156);
-      buf.write("ustar\0", 257);
-      buf.write("00", 263);
-      let sum = 0;
-      for (let i = 0; i < 512; i++) sum += buf[i];
-      buf.write(octal(sum, 8), 148);
-      return buf;
-    }
-    function pad512(len: number) {
-      return Buffer.alloc((512 - (len % 512)) % 512, 0);
-    }
     function buildTarball(body: Buffer) {
-      const tar = Buffer.concat([
-        tarHeader("package/package.json", body.length),
-        body,
-        pad512(body.length),
-        Buffer.alloc(1024, 0),
-      ]);
-      const tgz = gzipSync(tar);
+      const tgz = tarball({ "package.json": body });
       return { tgz, integrity: "sha512-" + createHash("sha512").update(tgz).digest("base64") };
     }
 
@@ -743,34 +741,8 @@ describe.concurrent.each(["hoisted", "isolated"] as const)("tarball integrity mi
 });
 
 describe.concurrent("tarball integrity metadata forms", () => {
-  function octal(n: number, width: number) {
-    return n.toString(8).padStart(width - 1, "0") + "\0";
-  }
-  function tarHeader(name: string, size: number) {
-    const buf = Buffer.alloc(512, 0);
-    buf.write(name, 0, 100, "utf8");
-    buf.write(octal(0o644, 8), 100);
-    buf.write(octal(0, 8), 108);
-    buf.write(octal(0, 8), 116);
-    buf.write(octal(size, 12), 124);
-    buf.write(octal(0, 12), 136);
-    buf.fill(" ", 148, 156);
-    buf.write("0", 156);
-    buf.write("ustar\0", 257);
-    buf.write("00", 263);
-    let sum = 0;
-    for (let i = 0; i < 512; i++) sum += buf[i];
-    buf.write(octal(sum, 8), 148);
-    return buf;
-  }
   function buildTarball(body: Buffer) {
-    const tar = Buffer.concat([
-      tarHeader("package/package.json", body.length),
-      body,
-      Buffer.alloc((512 - (body.length % 512)) % 512, 0),
-      Buffer.alloc(1024, 0),
-    ]);
-    const tgz = gzipSync(tar);
+    const tgz = tarball({ "package.json": body });
     return {
       tgz,
       sha512: "sha512-" + createHash("sha512").update(tgz).digest("base64"),
@@ -1048,3 +1020,97 @@ describe.concurrent.each(["hoisted", "isolated"] as const)("tarball download fai
     });
   });
 });
+
+// A `file:` or URL tarball is cached under a folder named after its path or
+// URL, so installing without a lockfile extracts it again over the folder from
+// the previous install. The fresh copy must win (the tarball may have been
+// repacked) and the copy it displaces must not be left behind in the temp dir,
+// which used to grow by one extracted tarball per install.
+describe.concurrent("tarball re-extraction over an existing cache folder", () => {
+  function tarballOfVersion(version: string, padding: Record<string, Buffer> = {}) {
+    return tarball({ "package.json": Buffer.from(JSON.stringify({ name: "pkg", version }) + "\n"), ...padding });
+  }
+
+  function project(name: string, spec: string) {
+    return tempDir(name, {
+      "app/package.json": JSON.stringify({ name: "app", dependencies: { pkg: spec } }),
+      // The install extracts into tmp/ and renames into cache/; both are inside
+      // the test directory, so anything left in tmp/ after an install is a leak.
+      cache: {},
+      tmp: {},
+    });
+  }
+
+  /** `bun install` from scratch (no node_modules, no lockfile); returns the installed version of `pkg`. */
+  async function installFresh(dir: string) {
+    const app = join(dir, "app");
+    await Promise.all([
+      rm(join(app, "node_modules"), { recursive: true, force: true }),
+      rm(join(app, "bun.lock"), { force: true }),
+    ]);
+    await using proc = spawn({
+      cmd: [bunExe(), "install"],
+      cwd: app,
+      env: { ...env, BUN_INSTALL_CACHE_DIR: join(dir, "cache"), BUN_TMPDIR: join(dir, "tmp") },
+      stdout: "pipe",
+      stderr: "pipe",
+    });
+    const [stdout, stderr, exitCode] = await Promise.all([proc.stdout.text(), proc.stderr.text(), proc.exited]);
+    expect({ stdout, stderr, exitCode }).toMatchObject({ exitCode: 0 });
+    const { version } = await file(join(app, "node_modules", "pkg", "package.json")).json();
+    return version as string;
+  }
+
+  async function cacheState(dir: string) {
+    const [tmp, cache] = await Promise.all([readdirSorted(join(dir, "tmp")), readdirSorted(join(dir, "cache"))]);
+    return { tmp, tarballFolders: cache.filter(name => name.startsWith("@T@")).length };
+  }
+
+  it("file: tarball", async () => {
+    using dir = project("tarball-reextract-file", "file:../pkg.tgz");
+    await writeFile(join(String(dir), "pkg.tgz"), tarballOfVersion("1.0.0"));
+
+    expect(await installFresh(String(dir))).toBe("1.0.0");
+    expect(await installFresh(String(dir))).toBe("1.0.0");
+    expect(await installFresh(String(dir))).toBe("1.0.0");
+    expect(await cacheState(String(dir))).toEqual({ tmp: [], tarballFolders: 1 });
+
+    await writeFile(join(String(dir), "pkg.tgz"), tarballOfVersion("2.0.0"));
+    expect(await installFresh(String(dir))).toBe("2.0.0");
+    expect(await cacheState(String(dir))).toEqual({ tmp: [], tarballFolders: 1 });
+  });
+
+  it("tarball URL", async () => {
+    // Incompressible padding, served without a Content-Length in several
+    // chunks, makes the download take the streaming extractor rather than
+    // being buffered and extracted in one go.
+    const padding = { "blob.bin": randomBytes(256 * 1024) };
+    let tgz = tarballOfVersion("1.0.0", padding);
+    await using server = Bun.serve({
+      port: 0,
+      hostname: "127.0.0.1",
+      fetch() {
+        let offset = 0;
+        return new Response(
+          new ReadableStream({
+            pull(controller) {
+              if (offset >= tgz.length) return controller.close();
+              controller.enqueue(tgz.subarray(offset, offset + 64 * 1024));
+              offset += 64 * 1024;
+            },
+          }),
+        );
+      },
+    });
+    using dir = project("tarball-reextract-url", `${server.url}pkg.tgz`);
+
+    expect(await installFresh(String(dir))).toBe("1.0.0");
+    expect(await installFresh(String(dir))).toBe("1.0.0");
+    expect(await installFresh(String(dir))).toBe("1.0.0");
+    expect(await cacheState(String(dir))).toEqual({ tmp: [], tarballFolders: 1 });
+
+    tgz = tarballOfVersion("2.0.0", padding);
+    expect(await installFresh(String(dir))).toBe("2.0.0");
+    expect(await cacheState(String(dir))).toEqual({ tmp: [], tarballFolders: 1 });
+  });
+});

From 6c3cec6c0fcba43ca955de4c9eb9fb51901d2940 Mon Sep 17 00:00:00 2001
From: robobun <117481402+robobun@users.noreply.github.com>
Date: Mon, 17 Aug 2026 02:13:05 +0000
Subject: [PATCH 137/258] install: fail the isolated install with ENAMETOOLONG
 when a link: target does not fit the path buffer (#38369)

---
 src/install/isolated_install.rs           |   2 +-
 src/install/isolated_install/Installer.rs | 102 ++++++++++----
 test/cli/install/isolated-install.test.ts | 156 +++++++++++++++++++++-
 3 files changed, 230 insertions(+), 30 deletions(-)

diff --git a/src/install/isolated_install.rs b/src/install/isolated_install.rs
index b7ccc8cfc446..87e12035a1da 100644
--- a/src/install/isolated_install.rs
+++ b/src/install/isolated_install.rs
@@ -2061,7 +2061,7 @@ pub(crate) fn install_isolated_packages(
             task.installer = installer_backref;
         }
 
-        // `append_store_path` runs on worker threads via `&Installer` and
+        // `append_dependency_path` runs on worker threads via `&Installer` and
         // can't take `&mut PackageManager` there, so ensure the
         // global link dir once on the main thread before any `.symlink`
         // resolution can be reached by a task. Guarded so installs without
diff --git a/src/install/isolated_install/Installer.rs b/src/install/isolated_install/Installer.rs
index c25a6f8118c7..591c06bbf916 100644
--- a/src/install/isolated_install/Installer.rs
+++ b/src/install/isolated_install/Installer.rs
@@ -407,6 +407,15 @@ impl<'a> Installer<'a> {
                     ),
                 );
             }
+            TaskError::LinkPathTooLong(link_pkg_id) => {
+                Output::err(
+                    "ENAMETOOLONG",
+                    "link path for package <b>{}<r> is too long",
+                    (bstr::BStr::new(
+                        pkg_names[*link_pkg_id as usize].slice(string_buf),
+                    ),),
+                );
+            }
             TaskError::Patching(patch_log) => {
                 Output::err_generic(
                     "failed to patch package: {}@{}",
@@ -744,6 +753,9 @@ pub struct DownloadError {
 pub enum TaskError {
     LinkPackage(sys::Error),
     SymlinkDependencies(sys::Error),
+    /// `<global link dir>/<link: target>` of this `link:` dependency does not
+    /// fit in a path buffer. See `Installer::append_dependency_path`.
+    LinkPathTooLong(PackageID),
     RunScripts(crate::Error),
     Binaries(crate::Error),
     Patching(Log),
@@ -755,6 +767,7 @@ impl TaskError {
         match self {
             TaskError::LinkPackage(err) => TaskError::LinkPackage(err.clone()),
             TaskError::SymlinkDependencies(err) => TaskError::SymlinkDependencies(err.clone()),
+            TaskError::LinkPathTooLong(pkg_id) => TaskError::LinkPathTooLong(*pkg_id),
             TaskError::Binaries(err) => TaskError::Binaries(*err),
             TaskError::RunScripts(err) => TaskError::RunScripts(*err),
             TaskError::Patching(_log) => {
@@ -1576,10 +1589,8 @@ impl Task {
                     };
 
                     let changed = match installer.symlink_dependencies(self.entry_id, strategy) {
-                        sys::Result::Ok(changed) => changed,
-                        sys::Result::Err(err) => {
-                            return Ok(Yield::failure(TaskError::SymlinkDependencies(err)));
-                        }
+                        Ok(changed) => changed,
+                        Err(err) => return Ok(Yield::failure(err)),
                     };
 
                     if relinking {
@@ -2381,7 +2392,7 @@ impl<'a> Installer<'a> {
         &self,
         entry_id: StoreEntryId,
         strategy: symlinker::Strategy,
-    ) -> sys::Result<bool> {
+    ) -> core::result::Result<bool, TaskError> {
         let lockfile = self.lockfile();
         let string_buf = lockfile.buffers.string_bytes.as_slice();
         let dependencies = lockfile.buffers.dependencies.as_slice();
@@ -2423,12 +2434,15 @@ impl<'a> Installer<'a> {
                 let Some(package_dir_name) = entry_node_modules_name else {
                     continue;
                 };
-                if !self.append_nested_folder_path(
-                    &mut dep_store_path,
-                    entry_id,
-                    package_dir_name,
-                    dep_res.folder().slice(string_buf),
-                )? {
+                if !self
+                    .append_nested_folder_path(
+                        &mut dep_store_path,
+                        entry_id,
+                        package_dir_name,
+                        dep_res.folder().slice(string_buf),
+                    )
+                    .map_err(TaskError::SymlinkDependencies)?
+                {
                     continue;
                 }
             } else if dep_is_nested_folder {
@@ -2437,7 +2451,7 @@ impl<'a> Installer<'a> {
                 debug_assert!(self.entry_uses_global_store(dep.entry_id));
                 self.append_real_store_path(&mut dep_store_path, dep.entry_id, Which::Final);
             } else {
-                self.append_store_path(&mut dep_store_path, dep.entry_id);
+                self.append_dependency_path(&mut dep_store_path, dep.entry_id)?;
             }
 
             let dest_len = dest.len();
@@ -2453,7 +2467,7 @@ impl<'a> Installer<'a> {
             };
             let result = symlinker.ensure_symlink(strategy);
             dest = symlinker.dest.into_sep::<{ PathSeparators::AUTO }>();
-            changed |= result?;
+            changed |= result.map_err(TaskError::SymlinkDependencies)?;
         }
 
         Ok(changed)
@@ -2973,6 +2987,52 @@ impl<'a> Installer<'a> {
         }
     }
 
+    /// `append_store_path` for the entry a dependency symlink points at. This
+    /// is the one place a `link:` package's path is needed: it is never
+    /// installed (`install_isolated_packages` marks its entry done up front),
+    /// its dependents link straight to `<global link dir>/<link: target>`.
+    ///
+    /// The `link:` target is stored as written in package.json or bun.lock, so
+    /// unlike every other input of these path builders it is not bounded by a
+    /// path buffer. A target that does not fit fails the dependent instead.
+    pub(crate) fn append_dependency_path(
+        &self,
+        buf: &mut AutoAbsPath,
+        entry_id: StoreEntryId,
+    ) -> core::result::Result<(), TaskError> {
+        let node_id = self.store.entries.items_node_id()[entry_id.get() as usize];
+        let pkg_id = self.store.nodes.items_pkg_id()[node_id.get() as usize];
+        let pkg_res = self.lockfile().packages.items_resolution()[pkg_id as usize];
+
+        if pkg_res.tag != ResolutionTag::Symlink {
+            self.append_store_path(buf, entry_id);
+            return Ok(());
+        }
+
+        // Lazily ensuring the global link dir would mutate `*PackageManager`,
+        // but this runs on worker threads, so the lazy init is hoisted to the
+        // main thread (`install_isolated_packages`, before any `start_task`).
+        // Reading the cached field here is then equivalent.
+        let link_dir_path: &[u8] = &self.manager().global_link_dir_path;
+        debug_assert!(
+            !link_dir_path.is_empty(),
+            "global_link_dir_path must be ensured before tasks start",
+        );
+        let string_buf = self.lockfile().buffers.string_bytes.as_slice();
+        let link_target = pkg_res.symlink().slice(string_buf);
+
+        let mut target = paths::AutoAbsPathChecked::init();
+        if target.append(link_dir_path).is_err() || target.append(link_target).is_err() {
+            return Err(TaskError::LinkPathTooLong(pkg_id));
+        }
+
+        paths::PathLike::clear(buf);
+        // Same unit width and `target` passed the length check, so this fits.
+        buf.append(target.slice()).assume_ok();
+        Ok(())
+    }
+
+    /// `entry_id` must not be a `link:` package; see `append_dependency_path`.
     pub(crate) fn append_store_path(&self, buf: &mut impl paths::PathLike, entry_id: StoreEntryId) {
         let string_buf = self.lockfile().buffers.string_bytes.as_slice();
 
@@ -3019,21 +3079,7 @@ impl<'a> Installer<'a> {
                 buf.append(pkg_res.workspace().slice(string_buf));
             }
             ResolutionTag::Symlink => {
-                // Lazily ensuring the global link dir would mutate
-                // `*PackageManager`, but `append_store_path` is
-                // `&self` and may run on worker
-                // threads, so the lazy init is hoisted to the main-thread caller
-                // (`isolated_install::install_packages`, before any `start_task`).
-                // Reading the cached field here is then equivalent.
-                let symlink_dir_path: &[u8] = &self.manager().global_link_dir_path;
-                debug_assert!(
-                    !symlink_dir_path.is_empty(),
-                    "global_link_dir_path must be ensured before tasks start",
-                );
-
-                buf.clear();
-                buf.append(symlink_dir_path);
-                buf.append(pkg_res.symlink().slice(string_buf));
+                unreachable!("link: packages have no store path; see append_dependency_path")
             }
             _ => self.append_store_package_path(buf, entry_id, Which::Final),
         }
diff --git a/test/cli/install/isolated-install.test.ts b/test/cli/install/isolated-install.test.ts
index 96434eb9cc7f..9c95b8db0e83 100644
--- a/test/cli/install/isolated-install.test.ts
+++ b/test/cli/install/isolated-install.test.ts
@@ -2,7 +2,7 @@ import { file, spawn, write } from "bun";
 import { afterAll, beforeAll, describe, expect, test } from "bun:test";
 import { existsSync, lstatSync, readFileSync, readlinkSync, statSync } from "fs";
 import { mkdir, readlink, rm, symlink } from "fs/promises";
-import { VerdaccioRegistry, bunEnv, bunExe, githubTarball, readdirSorted, runBunInstall, tempDir } from "harness";
+import { VerdaccioRegistry, bunEnv, bunExe, githubTarball, isLinux, isWindows, readdirSorted, runBunInstall, tempDir } from "harness";
 import { createRequire } from "module";
 import { basename, dirname, join } from "path";
 import { pathToFileURL } from "url";
@@ -4405,6 +4405,160 @@ test("store build timings are printed by --verbose only", async () => {
   expect(quiet).not.toContain("Created store");
 });
 
+describe("link: dependencies", () => {
+  // Size of the buffer install paths are built in (`MAX_PATH_BYTES`): PATH_MAX
+  // on Linux and macOS, the UTF-8 worst case of a 32767 character path on Windows.
+  const MAX_PATH_BYTES = isWindows ? 32767 * 3 + 1 : isLinux ? 4096 : 1024;
+
+  // A `link:` target that resolves to the registered `linked` package but is
+  // about `length` bytes as written. The target is stored and joined onto the
+  // global link dir as written, so the `x/..` segments count against the buffer.
+  function linkTarget(length: number): string {
+    const segments = Math.floor((length - "linked".length) / "x/../".length);
+    return Buffer.alloc(segments * "x/../".length, "x/../").toString() + "linked";
+  }
+
+  const linkedPackageJson = JSON.stringify({ name: "linked", version: "1.0.0" });
+
+  // Registers `<dir>/linked` in a global link dir private to the test, so the
+  // dir every `link:` target is joined onto is `<dir>/global/node_modules`.
+  async function registerLinked(dir: string) {
+    const env = {
+      ...bunEnv,
+      BUN_INSTALL_GLOBAL_DIR: join(dir, "global"),
+      BUN_INSTALL_CACHE_DIR: join(dir, "cache"),
+    };
+    await using proc = spawn({
+      cmd: [bunExe(), "link"],
+      cwd: join(dir, "linked"),
+      env,
+      stdout: "pipe",
+      stderr: "pipe",
+    });
+    const [stdout, stderr, exitCode] = await Promise.all([proc.stdout.text(), proc.stderr.text(), proc.exited]);
+    expect(stderr).toBe("");
+    expect(stdout).toContain('Registered "linked"');
+    expect(exitCode).toBe(0);
+
+    return { env, projectDir: join(dir, "project"), linkDir: join(dir, "global", "node_modules") };
+  }
+
+  async function installIsolated(env: NodeJS.Dict<string>, cwd: string) {
+    await using proc = spawn({
+      cmd: [bunExe(), "install", "--linker=isolated"],
+      cwd,
+      env,
+      stdout: "pipe",
+      stderr: "pipe",
+    });
+    const [stdout, stderr, exitCode] = await Promise.all([proc.stdout.text(), proc.stderr.text(), proc.exited]);
+    return { stdout, stderr, exitCode };
+  }
+
+  test.concurrent("links the package when the target fits", async () => {
+    using dir = tempDir("isolated-link-fits", {
+      "linked/package.json": linkedPackageJson,
+      "project/package.json": JSON.stringify({
+        name: "link-fits",
+        dependencies: { linked: "link:" + linkTarget(256) },
+      }),
+    });
+    const { env, projectDir } = await registerLinked(String(dir));
+
+    const { stderr, exitCode } = await installIsolated(env, projectDir);
+
+    expect(stderr).not.toContain("error:");
+    expect(exitCode).toBe(0);
+    expect(lstatSync(join(projectDir, "node_modules", "linked")).isSymbolicLink()).toBeTrue();
+    expect(await file(join(projectDir, "node_modules", "linked", "package.json")).json()).toEqual({
+      name: "linked",
+      version: "1.0.0",
+    });
+  });
+
+  test.concurrent("fails with ENAMETOOLONG when the target in bun.lock does not fit", async () => {
+    // A lockfile resolution is used as-is, so this never passes through the
+    // resolver: the linker is the first thing that builds a path from it.
+    const target = linkTarget(MAX_PATH_BYTES + 64);
+    using dir = tempDir("isolated-link-lockfile-too-long", {
+      "linked/package.json": linkedPackageJson,
+      "project/package.json": JSON.stringify({
+        name: "link-from-lockfile",
+        dependencies: { linked: "link:linked" },
+      }),
+      "project/bun.lock": `{
+  "lockfileVersion": 2,
+  "configVersion": 1,
+  "workspaces": {
+    "": {
+      "name": "link-from-lockfile",
+      "dependencies": {
+        "linked": "link:linked",
+      },
+    },
+  },
+  "packages": {
+    "linked": ["linked@link:${target}", {}],
+  }
+}
+`,
+    });
+    const { env, projectDir } = await registerLinked(String(dir));
+
+    const { stdout, stderr, exitCode } = await installIsolated(env, projectDir);
+
+    expect(stderr).toContain("ENAMETOOLONG: link path for package linked is too long");
+    expect(stdout).toContain("Failed to install 1 package");
+    expect(exitCode).toBe(1);
+    expect(() => lstatSync(join(projectDir, "node_modules", "linked"))).toThrow();
+  });
+
+  test.concurrent("fails with ENAMETOOLONG when the target in package.json does not fit", async () => {
+    // Fits on its own, so it resolves; does not fit once joined onto the link dir.
+    const target = linkTarget(MAX_PATH_BYTES - 16);
+    using dir = tempDir("isolated-link-package-json-too-long", {
+      "linked/package.json": linkedPackageJson,
+      "project/package.json": JSON.stringify({
+        name: "link-from-package-json",
+        dependencies: { linked: "link:" + target },
+      }),
+    });
+    const { env, projectDir, linkDir } = await registerLinked(String(dir));
+    expect(linkDir.length + "/".length + target.length).toBeGreaterThanOrEqual(MAX_PATH_BYTES);
+
+    const { stdout, stderr, exitCode } = await installIsolated(env, projectDir);
+
+    expect(stderr).toContain("ENAMETOOLONG: link path for package linked is too long");
+    expect(stdout).toContain("Failed to install 1 package");
+    expect(exitCode).toBe(1);
+    expect(() => lstatSync(join(projectDir, "node_modules", "linked"))).toThrow();
+  });
+
+  test.concurrent("fails the workspace package that depends on a target that does not fit", async () => {
+    const target = linkTarget(MAX_PATH_BYTES - 16);
+    using dir = tempDir("isolated-link-workspace-too-long", {
+      "linked/package.json": linkedPackageJson,
+      "project/package.json": JSON.stringify({
+        name: "link-from-workspace",
+        workspaces: ["packages/*"],
+      }),
+      "project/packages/app/package.json": JSON.stringify({
+        name: "app",
+        dependencies: { linked: "link:" + target },
+      }),
+    });
+    const { env, projectDir, linkDir } = await registerLinked(String(dir));
+    expect(linkDir.length + "/".length + target.length).toBeGreaterThanOrEqual(MAX_PATH_BYTES);
+
+    const { stdout, stderr, exitCode } = await installIsolated(env, projectDir);
+
+    expect(stderr).toContain("ENAMETOOLONG: link path for package linked is too long");
+    expect(stdout).toContain("Failed to install 1 package");
+    expect(exitCode).toBe(1);
+    expect(() => lstatSync(join(projectDir, "packages", "app", "node_modules", "linked"))).toThrow();
+  });
+});
+
 describe("hoist", () => {
   // `node_modules/.bun/node_modules` holds a symlink to every installed
   // package and sits on the upward resolution path of every store entry, so

From c07f07cf217215fb5351ee34f295577986ce4234 Mon Sep 17 00:00:00 2001
From: robobun <117481402+robobun@users.noreply.github.com>
Date: Mon, 17 Aug 2026 02:15:00 +0000
Subject: [PATCH 138/258] install: do not abort when $XDG_CONFIG_HOME or $HOME
 is too long for the .npmrc path buffer (#38372)

---
 src/install/PackageManager.rs  | 53 ++++++++++++++++++++--------------
 test/cli/install/npmrc.test.ts | 50 +++++++++++++++++++++++++++++++-
 2 files changed, 81 insertions(+), 22 deletions(-)

diff --git a/src/install/PackageManager.rs b/src/install/PackageManager.rs
index 2f27cbdba9e1..27526ac07499 100644
--- a/src/install/PackageManager.rs
+++ b/src/install/PackageManager.rs
@@ -20,7 +20,7 @@ use bun_event_loop::{self, AnyEventLoop, EventLoopHandle};
 use bun_http as http;
 use bun_ini as ini;
 use bun_paths::resolve_path::{self, PosixToWinNormalizer, platform};
-use bun_paths::{DELIMITER, PathBuffer, SEP, SEP_STR};
+use bun_paths::{DELIMITER, MAX_PATH_BYTES, PathBuffer, SEP, SEP_STR};
 use bun_semver as Semver;
 use bun_sys::{self, Fd};
 use bun_threading::{ThreadPool, UnboundedQueue, thread_pool};
@@ -1488,6 +1488,27 @@ fn overlay_bunfig_install(install: &mut Api::BunInstall, bunfig: Api::BunInstall
     );
 }
 
+/// `<dir>/.npmrc` for the user-level `.npmrc` candidates in [`init`]. `dir` is
+/// `$XDG_CONFIG_HOME` or `$HOME`, so it can be longer than `buf`; a path that
+/// does not fit could not be opened either, and `None` makes the caller treat
+/// it like a missing file.
+fn user_npmrc_path<'a>(dir: &[u8], buf: &'a mut PathBuffer) -> Option<&'a ZStr> {
+    join_path_z(dir, &[b".npmrc"], buf)
+}
+
+/// `None` when the joined path does not fit the buffer.
+fn join_path_z<'a>(base: &[u8], parts: &[&[u8]], buf: &'a mut PathBuffer) -> Option<&'a ZStr> {
+    // The last byte is reserved for the NUL terminator.
+    let len = resolve_path::join_abs_string_buf_checked::<platform::Auto>(
+        base,
+        &mut buf[..MAX_PATH_BYTES - 1],
+        parts,
+    )?
+    .len();
+    buf[len] = 0;
+    Some(ZStr::from_buf(&buf[..], len))
+}
+
 /// Returns `&'static mut PackageManager` — the process-singleton (held in
 /// `holder::RAW_PTR`) is leaked for the process lifetime and `init()` is called
 /// exactly once on the single CLI dispatch thread. Every
@@ -1943,38 +1964,28 @@ pub fn init(
         let npmrc_local = ZBox::from_bytes(b".npmrc");
 
         let mut buf = PathBuffer::uninit();
-        let parts = [b"./.npmrc" as &[u8]];
 
         let mut global_len: usize = 0;
         // npm's `userconfig`: when set, this file is the per-user .npmrc and
         // neither $XDG_CONFIG_HOME/.npmrc nor ~/.npmrc is looked at.
         // actions/setup-node writes one to $RUNNER_TEMP and exports
         // NPM_CONFIG_USERCONFIG pointing at it.
-        if let Some(userconfig) = [b"NPM_CONFIG_USERCONFIG" as &[u8], b"npm_config_userconfig"]
+        let userconfig = [b"NPM_CONFIG_USERCONFIG" as &[u8], b"npm_config_userconfig"]
             .into_iter()
-            .find_map(|key| env.get(key).filter(|path| !path.is_empty()))
-        {
-            global_len = resolve_path::join_abs_string_buf_z::<platform::Auto>(
-                &original_cwd_clone,
-                &mut buf,
-                &[userconfig],
-            )
-            .len();
+            .find_map(|key| env.get(key).filter(|path| !path.is_empty()));
+        if let Some(userconfig) = userconfig {
+            global_len =
+                join_path_z(&original_cwd_clone, &[userconfig], &mut buf).map_or(0, ZStr::len);
         } else if let Some(xdg_dir) = bun_core::env_var::XDG_CONFIG_HOME.get_not_empty() {
             // npm reads `$HOME/.npmrc` and ignores XDG_CONFIG_HOME; keep
             // `$XDG_CONFIG_HOME/.npmrc` only when that file actually exists.
-            let p =
-                resolve_path::join_abs_string_buf_z::<platform::Auto>(xdg_dir, &mut buf, &parts);
-            if bun_sys::exists_z(p) {
-                global_len = p.len();
-            }
+            global_len = user_npmrc_path(xdg_dir, &mut buf)
+                .filter(|p| bun_sys::exists_z(p))
+                .map_or(0, ZStr::len);
         }
-        if global_len == 0 {
+        if global_len == 0 && userconfig.is_none() {
             if let Some(home_dir) = bun_core::env_var::HOME.get_not_empty() {
-                global_len = resolve_path::join_abs_string_buf_z::<platform::Auto>(
-                    home_dir, &mut buf, &parts,
-                )
-                .len();
+                global_len = user_npmrc_path(home_dir, &mut buf).map_or(0, ZStr::len);
             }
         }
 
diff --git a/test/cli/install/npmrc.test.ts b/test/cli/install/npmrc.test.ts
index e43a83aac091..e499b67a7069 100644
--- a/test/cli/install/npmrc.test.ts
+++ b/test/cli/install/npmrc.test.ts
@@ -1,7 +1,8 @@
 import { write } from "bun";
 import { afterAll, beforeAll, describe, expect, it, test } from "bun:test";
+import { mkdirSync, writeFileSync } from "fs";
 import { rm } from "fs/promises";
-import { VerdaccioRegistry, bunExe, bunEnv as env, isIPv6, tempDir } from "harness";
+import { VerdaccioRegistry, bunExe, bunEnv as env, isIPv6, isLinux, isWindows, tempDir } from "harness";
 import { join } from "path";
 const { iniInternals } = require("bun:internal-for-testing");
 const { loadNpmrc } = iniInternals;
@@ -302,6 +303,53 @@ registry = http://localhost:${registry.port}/
       });
       expect(await authorization).toBe("Bearer npm_token-from-the-workflow-env");
     });
+
+    // The candidate paths are built in a buffer of MAX_PATH_BYTES (4096 on Linux, 1024 on the
+    // other POSIX platforms; on Windows it is larger than any environment variable can be), so
+    // the longest directory whose "/.npmrc" and NUL terminator still fit is MAX_PATH_BYTES - 8
+    // bytes. A longer directory cannot contain an openable .npmrc and counts as having none.
+    describe.skipIf(isWindows)("$HOME longer than the path buffer", () => {
+      const MAX_PATH_BYTES = isLinux ? 4096 : 1024;
+      const LONGEST_HOME = MAX_PATH_BYTES - 8;
+
+      // xdg/ has no .npmrc, so the lookup falls through to $HOME. The global bunfig.toml lookup
+      // starts at $XDG_CONFIG_HOME too; the bunfig there keeps it away from the oversized $HOME,
+      // which is not what is under test here.
+      const xdg = { "xdg/.bunfig.toml": "" };
+      const envWith = (dir: string, home: string) => ({ XDG_CONFIG_HOME: join(dir, "xdg"), HOME: home });
+
+      // An absolute path of exactly `length` bytes. Nothing exists there.
+      const missingHome = (length: number) => "/" + Buffer.alloc(length - 1, "a").toString();
+
+      it.concurrent("reads $HOME/.npmrc from the longest $HOME that fits", async () => {
+        using dir = tempDir("npmrc-home-longest", { ...pkg, ...xdg });
+        // Pad `<dir>/home/` out to exactly LONGEST_HOME bytes with nested directories of 200
+        // bytes each (NAME_MAX is 255); the last byte is never a separator.
+        const prefix = join(String(dir), "home") + "/";
+        const padding = Buffer.alloc(LONGEST_HOME - Buffer.byteLength(prefix), "a");
+        for (let i = 200; i < padding.length - 1; i += 201) padding[i] = "/".charCodeAt(0);
+        const home = prefix + padding.toString();
+        expect(Buffer.byteLength(home)).toBe(LONGEST_HOME);
+        mkdirSync(home, { recursive: true });
+        writeFileSync(join(home, ".npmrc"), npmrc(1));
+
+        const result = await publishDryRun(String(dir), envWith(String(dir), home));
+        expect(result).toEqual(usesRegistry(1));
+      });
+
+      // The project .npmrc is the only one left, and shows the command still ran normally.
+      it.concurrent("skips a $HOME one byte longer than fits", async () => {
+        using dir = tempDir("npmrc-home-one-too-long", { ...pkg, ...xdg, "pkg/.npmrc": npmrc(3) });
+        const result = await publishDryRun(String(dir), envWith(String(dir), missingHome(LONGEST_HOME + 1)));
+        expect(result).toEqual(usesRegistry(3));
+      });
+
+      it.concurrent("skips a $HOME longer than the whole buffer", async () => {
+        using dir = tempDir("npmrc-home-too-long", { ...pkg, ...xdg, "pkg/.npmrc": npmrc(3) });
+        const result = await publishDryRun(String(dir), envWith(String(dir), missingHome(MAX_PATH_BYTES + 1000)));
+        expect(result).toEqual(usesRegistry(3));
+      });
+    });
   });
 
   it("package config overrides home config", async () => {

From e52625ce9a6dcefc5c69a493a459bcc96b550fb8 Mon Sep 17 00:00:00 2001
From: robobun <117481402+robobun@users.noreply.github.com>
Date: Mon, 17 Aug 2026 02:15:52 +0000
Subject: [PATCH 139/258] install: stop aborting on -g when $BUN_INSTALL,
 $XDG_CACHE_HOME or $HOME does not fit the global directory path buffer
 (#38413)

---
 .../PackageManager/PackageManagerOptions.rs   |  49 ++++----
 test/cli/install/bun-pm.test.ts               | 105 +++++++++++++++++-
 2 files changed, 123 insertions(+), 31 deletions(-)

diff --git a/src/install/PackageManager/PackageManagerOptions.rs b/src/install/PackageManager/PackageManagerOptions.rs
index 0fdb5ae4979c..52c014bb0de1 100644
--- a/src/install/PackageManager/PackageManagerOptions.rs
+++ b/src/install/PackageManager/PackageManagerOptions.rs
@@ -298,9 +298,23 @@ pub use crate::config_version::ConfigVersion;
 pub use bun_install_types::DependencyGroup;
 pub use bun_install_types::NodeLinker::NodeLinker;
 
+/// mkdir -p + open `<base>/<parts...>`; `base` is an environment value of any length.
+fn make_open_dir_under(base: &[u8], parts: &[&[u8]]) -> crate::Result<bun_sys::Fd> {
+    use bun_paths::{platform, resolve_path::join_abs_string_buf_checked};
+    use bun_sys::{Dir, OpenDirOptions};
+
+    let mut buf = PathBuffer::uninit();
+    let Some(path) = join_abs_string_buf_checked::<platform::Auto>(base, &mut buf.0, parts) else {
+        return Err(crate::Error::Sys(bun_errno::SystemErrno::ENAMETOOLONG));
+    };
+    Dir::cwd()
+        .make_open_path(path, OpenDirOptions::default())
+        .map(|d| d.into_raw())
+        .map_err(Into::into)
+}
+
 // mkdir -p + open the dir. Callers store the raw `Fd` (`options.global_bin_dir: Fd`).
 pub fn open_global_dir(explicit_global_dir: &[u8]) -> crate::Result<bun_sys::Fd> {
-    use bun_paths::{platform, resolve_path::join_abs_string_buf};
     use bun_sys::{Dir, OpenDirOptions};
 
     if let Some(home_dir) = env_var::BUN_INSTALL_GLOBAL_DIR.get() {
@@ -318,33 +332,20 @@ pub fn open_global_dir(explicit_global_dir: &[u8]) -> crate::Result<bun_sys::Fd>
     }
 
     if let Some(home_dir) = env_var::BUN_INSTALL.get() {
-        let mut buf = PathBuffer::uninit();
-        let parts: [&[u8]; 2] = [b"install", b"global"];
-        let path = join_abs_string_buf::<platform::Auto>(home_dir, &mut buf.0, &parts);
-        return Dir::cwd()
-            .make_open_path(path, OpenDirOptions::default())
-            .map(|d| d.into_raw())
-            .map_err(Into::into);
+        return make_open_dir_under(home_dir, &[b"install", b"global"]);
     }
 
     if let Some(home_dir) = env_var::XDG_CACHE_HOME
         .get()
         .or_else(|| env_var::HOME.get())
     {
-        let mut buf = PathBuffer::uninit();
-        let parts: [&[u8]; 3] = [b".bun", b"install", b"global"];
-        let path = join_abs_string_buf::<platform::Auto>(home_dir, &mut buf.0, &parts);
-        return Dir::cwd()
-            .make_open_path(path, OpenDirOptions::default())
-            .map(|d| d.into_raw())
-            .map_err(Into::into);
+        return make_open_dir_under(home_dir, &[b".bun", b"install", b"global"]);
     }
 
     Err(crate::Error::NoGlobalDirectoryFound)
 }
 
 pub(crate) fn open_global_bin_dir(opts_: Option<&Api::BunInstall>) -> crate::Result<bun_sys::Fd> {
-    use bun_paths::{platform, resolve_path::join_abs_string_buf};
     use bun_sys::{Dir, OpenDirOptions};
 
     if let Some(home_dir) = env_var::BUN_INSTALL_BIN.get() {
@@ -366,26 +367,14 @@ pub(crate) fn open_global_bin_dir(opts_: Option<&Api::BunInstall>) -> crate::Res
     }
 
     if let Some(home_dir) = env_var::BUN_INSTALL.get() {
-        let mut buf = PathBuffer::uninit();
-        let parts: [&[u8]; 1] = [b"bin"];
-        let path = join_abs_string_buf::<platform::Auto>(home_dir, &mut buf.0, &parts);
-        return Dir::cwd()
-            .make_open_path(path, OpenDirOptions::default())
-            .map(|d| d.into_raw())
-            .map_err(Into::into);
+        return make_open_dir_under(home_dir, &[b"bin"]);
     }
 
     if let Some(home_dir) = env_var::XDG_CACHE_HOME
         .get()
         .or_else(|| env_var::HOME.get())
     {
-        let mut buf = PathBuffer::uninit();
-        let parts: [&[u8]; 2] = [b".bun", b"bin"];
-        let path = join_abs_string_buf::<platform::Auto>(home_dir, &mut buf.0, &parts);
-        return Dir::cwd()
-            .make_open_path(path, OpenDirOptions::default())
-            .map(|d| d.into_raw())
-            .map_err(Into::into);
+        return make_open_dir_under(home_dir, &[b".bun", b"bin"]);
     }
 
     Err(crate::Error::MissingGlobalBinDirectoryTrySettingBUNINSTALL)
diff --git a/test/cli/install/bun-pm.test.ts b/test/cli/install/bun-pm.test.ts
index 81e06a5d0a03..b571a52a9437 100644
--- a/test/cli/install/bun-pm.test.ts
+++ b/test/cli/install/bun-pm.test.ts
@@ -1,7 +1,7 @@
 import { spawn } from "bun";
 import { afterAll, afterEach, beforeAll, beforeEach, describe, expect, it, test } from "bun:test";
 import { exists, mkdir, writeFile } from "fs/promises";
-import { bunEnv, bunExe, bunEnv as env, isWindows, readdirSorted, tempDir, tmpdirSync } from "harness";
+import { bunEnv, bunEnv as env, bunExe, isLinux, isWindows, readdirSorted, tempDir, tmpdirSync } from "harness";
 import { cpSync } from "node:fs";
 import { join } from "path";
 import {
@@ -1214,3 +1214,106 @@ test.skipIf(isWindows)("bun pm untrusted escapes control characters in the packa
   expect(stdout).not.toContain("\r");
   expect(exitCode).toBe(0);
 });
+
+// The global directory (`$BUN_INSTALL/install/global`, otherwise `.bun/install/global` under
+// $XDG_CACHE_HOME or $HOME) and the global bin directory (`$BUN_INSTALL/bin`, otherwise `.bun/bin`
+// under the same two) are each joined in a path buffer of MAX_PATH_BYTES: 4096 bytes on Linux, 1024
+// on macOS. On Windows the buffer holds more than an environment variable can, so this is POSIX only.
+describe.concurrent.skipIf(isWindows)("global directories longer than the path buffer", () => {
+  const PATH_BUFFER_BYTES = isLinux ? 4096 : 1024;
+  const LONG_VALUE = "/" + Buffer.alloc(8192, "a").toString();
+
+  type GlobalDirectory = "global directory" | "global bin directory";
+  type Variable = "BUN_INSTALL" | "XDG_CACHE_HOME" | "HOME";
+
+  // A -g command opens the global directory (which has to contain a package.json) and then the
+  // global bin directory; `bun pm bin -g` prints the latter. Every variable the two lookups read is
+  // set, so that a case reaches exactly the arm it names: the directory not under test is named
+  // outright ($BUN_INSTALL_GLOBAL_DIR and $BUN_INSTALL_BIN are opened as given, not joined), and
+  // $XDG_CONFIG_HOME holds an .npmrc so that neither the bunfig nor the .npmrc lookup joins $HOME.
+  async function runGlobal(
+    args: string[],
+    directory: GlobalDirectory,
+    variable: Variable,
+    value: string | ((dir: string) => string),
+  ) {
+    using dir = tempDir("pm-global-dir-too-long", {
+      "global/package.json": JSON.stringify({ name: "global" }),
+      "xdg-config/.npmrc": "",
+    });
+    const spawnEnv: NodeJS.Dict<string> = {
+      ...env,
+      HOME: String(dir),
+      XDG_CONFIG_HOME: join(String(dir), "xdg-config"),
+    };
+    delete spawnEnv.BUN_INSTALL;
+    delete spawnEnv.BUN_INSTALL_GLOBAL_DIR;
+    delete spawnEnv.BUN_INSTALL_BIN;
+    delete spawnEnv.XDG_CACHE_HOME;
+    if (directory === "global directory") {
+      spawnEnv.BUN_INSTALL_BIN = join(String(dir), "bin");
+    } else {
+      spawnEnv.BUN_INSTALL_GLOBAL_DIR = join(String(dir), "global");
+    }
+    spawnEnv[variable] = typeof value === "string" ? value : value(String(dir));
+
+    await using proc = spawn({
+      cmd: [bunExe(), ...args],
+      cwd: String(dir),
+      env: spawnEnv,
+      stdout: "pipe",
+      stderr: "pipe",
+    });
+    const [stdout, stderr, exitCode] = await Promise.all([proc.stdout.text(), proc.stderr.text(), proc.exited]);
+    return { dir: String(dir), stdout, stderr, exitCode };
+  }
+
+  function expectNameTooLong({ stdout, stderr, exitCode }: Awaited<ReturnType<typeof runGlobal>>) {
+    expect(stderr).toContain("ENAMETOOLONG");
+    expect(stdout).toBe("");
+    expect(exitCode).toBe(1);
+  }
+
+  test.each<[GlobalDirectory, Variable]>([
+    ["global directory", "BUN_INSTALL"],
+    ["global directory", "XDG_CACHE_HOME"],
+    ["global directory", "HOME"],
+    ["global bin directory", "BUN_INSTALL"],
+    ["global bin directory", "XDG_CACHE_HOME"],
+    ["global bin directory", "HOME"],
+  ])("bun pm bin -g: %s from $%s", async (directory, variable) => {
+    expectNameTooLong(await runGlobal(["pm", "bin", "-g"], directory, variable, LONG_VALUE));
+  });
+
+  test("bun install -g: global directory from $BUN_INSTALL", async () => {
+    expectNameTooLong(await runGlobal(["install", "-g"], "global directory", "BUN_INSTALL", LONG_VALUE));
+  });
+
+  // A joined path of exactly the buffer size is already one byte longer than the OS accepts; one
+  // byte more and it does not fit the buffer either.
+  test.each([
+    ["exactly", 0],
+    ["one byte above", 1],
+  ])("global directory path %s the path buffer size", async (_, offset) => {
+    const suffix = "/install/global";
+    const value = "/" + Buffer.alloc(PATH_BUFFER_BYTES + offset - "/".length - suffix.length, "a").toString();
+    expect(Buffer.byteLength(value + suffix)).toBe(PATH_BUFFER_BYTES + offset);
+
+    expectNameTooLong(await runGlobal(["pm", "bin", "-g"], "global directory", "BUN_INSTALL", value));
+  });
+
+  // What has to fit the buffer is the normalized path, not the value as written.
+  test("a value that only fits the path buffer once normalized is used", async () => {
+    const { dir, stdout, stderr, exitCode } = await runGlobal(
+      ["pm", "bin", "-g"],
+      "global bin directory",
+      "BUN_INSTALL",
+      // `${dir}/x/../x/../...` normalizes to `${dir}` (path.join would normalize it here already).
+      dir => `${dir}/${Buffer.alloc(100_000, "x/../").toString()}`,
+    );
+
+    expect(stderr).toBe("");
+    expect(stdout).toBe(join(dir, "bin") + "\n");
+    expect(exitCode).toBe(0);
+  });
+});

From eac007b979643b6b731e39ed29c7a67954bcc47a Mon Sep 17 00:00:00 2001
From: robobun <117481402+robobun@users.noreply.github.com>
Date: Mon, 17 Aug 2026 02:17:44 +0000
Subject: [PATCH 140/258] install: keep linking the remaining bins when one bin
 or one dependency's bins fail to link (#38972)

---
 src/install/bin.rs                            | 19 ++--
 src/install/isolated_install/Installer.rs     | 47 +++++++++-
 test/cli/install/bun-install-registry.test.ts | 34 +++++++
 test/cli/install/isolated-install.test.ts     | 90 +++++++++++++++++++
 4 files changed, 179 insertions(+), 11 deletions(-)

diff --git a/src/install/bin.rs b/src/install/bin.rs
index af9c831cba23..d6ed56e13bf7 100644
--- a/src/install/bin.rs
+++ b/src/install/bin.rs
@@ -925,29 +925,34 @@ impl<'a> Linker<'a> {
 
         bun_core::analytics::Features::binlinks_inc();
 
+        // Only this bin's outcome decides whether the link just made is kept.
+        let prior_err = self.err.take();
         #[cfg(not(windows))]
         {
             self.create_symlink(abs_target, abs_dest, global);
         }
         #[cfg(windows)]
         {
-            let target = match sys::File::openat(Fd::cwd(), abs_target, sys::O::RDONLY, 0) {
-                Ok(f) => f,
+            match sys::File::openat(Fd::cwd(), abs_target, sys::O::RDONLY, 0) {
+                Ok(target) => self.create_windows_shim(&target, abs_target, abs_dest, global),
                 Err(err) => {
                     let err: crate::Error = err.into();
+                    // ignore directories, creating a shim for one won't do anything
                     if err != crate::Error::Sys(bun_errno::SystemErrno::EISDIR) {
-                        // ignore directories, creating a shim for one won't do anything
                         self.err = Some(err);
                     }
-                    return;
                 }
-            };
-            self.create_windows_shim(&target, abs_target, abs_dest, global);
+            }
         }
+        let err = self.err;
+        self.err = prior_err.or(err);
 
-        if self.err.is_some() {
+        if err.is_some() {
             // cleanup on error just in case
             Self::unlink_bin_or_shim(abs_dest);
+            if let Some(seen) = self.seen.as_deref_mut() {
+                seen.remove(abs_dest.as_bytes());
+            }
             return;
         }
 
diff --git a/src/install/isolated_install/Installer.rs b/src/install/isolated_install/Installer.rs
index 591c06bbf916..3cca07b0cafe 100644
--- a/src/install/isolated_install/Installer.rs
+++ b/src/install/isolated_install/Installer.rs
@@ -436,6 +436,23 @@ impl<'a> Installer<'a> {
                     ),
                 );
             }
+            TaskError::DependencyBinaries(dep_errs) => {
+                for dep_err in dep_errs.iter() {
+                    let dep_node_id = entry_node_ids[dep_err.dep_entry_id.get() as usize];
+                    let dep_pkg_id = node_pkg_ids[dep_node_id.get() as usize];
+                    Output::err(
+                        dep_err.err,
+                        "failed to link binaries of dependency {}@{} for package: {}@{}",
+                        (
+                            bstr::BStr::new(pkg_names[dep_pkg_id as usize].slice(string_buf)),
+                            pkg_resolutions[dep_pkg_id as usize]
+                                .fmt(string_buf, bun_core::fmt::PathSep::Auto),
+                            bstr::BStr::new(pkg_name.slice(string_buf)),
+                            pkg_res.fmt(string_buf, bun_core::fmt::PathSep::Auto),
+                        ),
+                    );
+                }
+            }
             TaskError::Download(dl) => {
                 Output::err_generic(
                     "failed to download <b>{}@{}<r>: {}\n  <d>{}<r>",
@@ -750,6 +767,12 @@ pub struct DownloadError {
     pub(crate) url: Box<[u8]>,
 }
 
+#[derive(Clone, Copy)]
+pub struct DependencyBinariesError {
+    pub(crate) dep_entry_id: StoreEntryId,
+    pub(crate) err: crate::Error,
+}
+
 pub enum TaskError {
     LinkPackage(sys::Error),
     SymlinkDependencies(sys::Error),
@@ -758,6 +781,7 @@ pub enum TaskError {
     LinkPathTooLong(PackageID),
     RunScripts(crate::Error),
     Binaries(crate::Error),
+    DependencyBinaries(Box<[DependencyBinariesError]>),
     Patching(Log),
     Download(DownloadError),
 }
@@ -769,6 +793,7 @@ impl TaskError {
             TaskError::SymlinkDependencies(err) => TaskError::SymlinkDependencies(err.clone()),
             TaskError::LinkPathTooLong(pkg_id) => TaskError::LinkPathTooLong(*pkg_id),
             TaskError::Binaries(err) => TaskError::Binaries(*err),
+            TaskError::DependencyBinaries(errs) => TaskError::DependencyBinaries(errs.clone()),
             TaskError::RunScripts(err) => TaskError::RunScripts(*err),
             TaskError::Patching(_log) => {
                 // `bun_ast::Log` is non-Clone; the only caller of
@@ -1635,7 +1660,7 @@ impl Task {
                 Step::SymlinkDependencyBinaries => {
                     let current_step = Step::SymlinkDependencyBinaries;
                     if let Err(err) = installer.link_dependency_bins(self.entry_id) {
-                        return Ok(Yield::failure(TaskError::Binaries(err)));
+                        return Ok(Yield::failure(err));
                     }
 
                     match pkg_res.tag {
@@ -1944,6 +1969,8 @@ impl Task {
                         bin_linker.target_node_modules_path = bin_linker.node_modules_path;
                         bin_linker.target_package_name =
                             strings::StringOrTinyString::init(dep_name);
+                        bin_linker.err = None;
+                        bin_linker.skipped_due_to_missing_bin = false;
 
                         if manager_ref.options.log_level.is_verbose() {
                             bun_core::pretty_errorln!(
@@ -2536,7 +2563,10 @@ impl<'a> Installer<'a> {
         }
     }
 
-    pub(crate) fn link_dependency_bins(&self, parent_entry_id: StoreEntryId) -> crate::Result<()> {
+    pub(crate) fn link_dependency_bins(
+        &self,
+        parent_entry_id: StoreEntryId,
+    ) -> core::result::Result<(), TaskError> {
         let lockfile = self.lockfile();
         let store = self.store;
 
@@ -2563,6 +2593,7 @@ impl<'a> Installer<'a> {
         let mut link_rel_buf = paths::path_buffer_pool::get();
 
         let mut seen: StringHashMap<()> = StringHashMap::default();
+        let mut failed: Vec<DependencyBinariesError> = Vec::new();
 
         let mut node_modules_path = DefaultAbsPath::init_top_level_dir();
         self.append_real_store_node_modules_path(
@@ -2646,6 +2677,8 @@ impl<'a> Installer<'a> {
             {
                 bin_linker.target_node_modules_path = bin_linker.node_modules_path;
                 bin_linker.target_package_name = package_name;
+                bin_linker.err = None;
+                bin_linker.skipped_due_to_missing_bin = false;
 
                 if self.manager().options.log_level.is_verbose() {
                     bun_core::pretty_errorln!(
@@ -2659,11 +2692,17 @@ impl<'a> Installer<'a> {
             }
 
             if let Some(err) = bin_linker.err {
-                return Err(err);
+                failed.push(DependencyBinariesError {
+                    dep_entry_id: dep.entry_id,
+                    err,
+                });
             }
         }
 
-        Ok(())
+        if failed.is_empty() {
+            return Ok(());
+        }
+        Err(TaskError::DependencyBinaries(failed.into_boxed_slice()))
     }
 
     /// True when this entry should live in the shared global virtual store
diff --git a/test/cli/install/bun-install-registry.test.ts b/test/cli/install/bun-install-registry.test.ts
index d2adf907efd8..d980506aceeb 100644
--- a/test/cli/install/bun-install-registry.test.ts
+++ b/test/cli/install/bun-install-registry.test.ts
@@ -2653,6 +2653,40 @@ test("--production without a lockfile will install and not save lockfile", async
 });
 
 describe("binaries", () => {
+  test("a bin that fails to link does not stop the remaining bins of the package from being linked", async () => {
+    // Longer than a file name may be, so creating the link itself fails. It is
+    // the first of the package's bins, both as declared and sorted.
+    const longBinName = Buffer.alloc(300, "a").toString();
+    await Promise.all([
+      write(packageJson, JSON.stringify({ name: "foo", dependencies: { "multi-bin": "file:./multi-bin" } })),
+      write(
+        join(packageDir, "multi-bin", "package.json"),
+        JSON.stringify({
+          name: "multi-bin",
+          version: "1.0.0",
+          bin: { [longBinName]: "cli.js", "multi-b": "cli.js", "multi-c": "cli.js" },
+        }),
+      ),
+      write(join(packageDir, "multi-bin", "cli.js"), "#!/usr/bin/env node\nconsole.log('multi');\n"),
+    ]);
+
+    await using proc = spawn({
+      cmd: [bunExe(), "install"],
+      cwd: packageDir,
+      env,
+      stdout: "pipe",
+      stderr: "pipe",
+    });
+    const [, stderr, exitCode] = await Promise.all([proc.stdout.text(), proc.stderr.text(), proc.exited]);
+
+    expect(await readdirSorted(join(packageDir, "node_modules", ".bin"))).toEqual(
+      isWindows ? ["multi-b.bunx", "multi-b.exe", "multi-c.bunx", "multi-c.exe"] : ["multi-b", "multi-c"],
+    );
+    expect(join(packageDir, "node_modules", ".bin", "multi-b")).toBeValidBin(join("..", "multi-bin", "cli.js"));
+    expect(stderr).toContain(`error: Failed to link multi-bin: ${isWindows ? "ENOENT" : "ENAMETOOLONG"}`);
+    expect(exitCode).toBe(1);
+  });
+
   for (const global of [false, true]) {
     describe(`existing destinations${global ? " (global)" : ""}`, () => {
       test("existing non-symlink", async () => {
diff --git a/test/cli/install/isolated-install.test.ts b/test/cli/install/isolated-install.test.ts
index 9c95b8db0e83..5f66b796aca3 100644
--- a/test/cli/install/isolated-install.test.ts
+++ b/test/cli/install/isolated-install.test.ts
@@ -821,6 +821,96 @@ describe("transitive file dependencies of registry packages", () => {
   });
 });
 
+test("a bin that fails to link does not stop the remaining bins of the package or of its siblings from being linked", async () => {
+  // `directories.bin` names a file, so opening it as a directory fails with
+  // ENOTDIR (a missing directory would be skipped silently).
+  const badBinDir = (name: string) => JSON.stringify({ name, version: "1.0.0", directories: { bin: "package.json" } });
+  // Longer than a file name may be, so creating the link itself fails. It is
+  // the first of the package's bins, both as declared and sorted.
+  const longBinName = Buffer.alloc(300, "a").toString();
+  const longBinNameError = isWindows ? "ENOENT" : "ENAMETOOLONG";
+  const { packageDir } = await registry.createTestDir({
+    bunfigOpts: { linker: "isolated" },
+    files: {
+      "package.json": JSON.stringify({
+        name: "test-pkg-bin-link-errors",
+        workspaces: ["packages/*"],
+        dependencies: {
+          "a-bin": "file:./deps/a-bin",
+          "bad-bin-dir-1": "file:./deps/bad-bin-dir-1",
+          "bad-bin-dir-2": "file:./deps/bad-bin-dir-2",
+          "multi-bin": "file:./deps/multi-bin",
+          "z-bin": "file:./deps/z-bin",
+        },
+      }),
+      "packages/ws/package.json": JSON.stringify({
+        name: "ws",
+        dependencies: {
+          "bad-bin-dir-1": "file:../../deps/bad-bin-dir-1",
+          "z-bin": "file:../../deps/z-bin",
+        },
+      }),
+      "deps/a-bin/package.json": JSON.stringify({ name: "a-bin", version: "1.0.0", bin: { "a-cli": "cli.js" } }),
+      "deps/a-bin/cli.js": "#!/usr/bin/env node\nconsole.log('a');\n",
+      "deps/z-bin/package.json": JSON.stringify({ name: "z-bin", version: "1.0.0", bin: { "z-cli": "cli.js" } }),
+      "deps/z-bin/cli.js": "#!/usr/bin/env node\nconsole.log('z');\n",
+      "deps/bad-bin-dir-1/package.json": badBinDir("bad-bin-dir-1"),
+      "deps/bad-bin-dir-2/package.json": badBinDir("bad-bin-dir-2"),
+      "deps/multi-bin/package.json": JSON.stringify({
+        name: "multi-bin",
+        version: "1.0.0",
+        bin: { [longBinName]: "cli.js", "multi-b": "cli.js", "multi-c": "cli.js" },
+      }),
+      "deps/multi-bin/cli.js": "#!/usr/bin/env node\nconsole.log('multi');\n",
+    },
+  });
+
+  await using proc = spawn({
+    cmd: [bunExe(), "install"],
+    cwd: packageDir,
+    env: bunEnv,
+    stdout: "pipe",
+    stderr: "pipe",
+  });
+  const [, stderr, exitCode] = await Promise.all([proc.stdout.text(), proc.stderr.text(), proc.exited]);
+
+  const binDir = async (dir: string) => {
+    const path = join(dir, "node_modules", ".bin");
+    return existsSync(path) ? await readdirSorted(path) : [];
+  };
+  const bins = (...names: string[]) => (isWindows ? names.flatMap(n => [`${n}.bunx`, `${n}.exe`]) : names).sort();
+  expect({
+    root: await binDir(packageDir),
+    ws: await binDir(join(packageDir, "packages", "ws")),
+    "multi-bin's own": await binDir(join(packageDir, "node_modules", ".bun", "multi-bin@file+deps+multi-bin")),
+  }).toEqual({
+    root: bins("a-cli", "multi-b", "multi-c", "z-cli"),
+    ws: bins("z-cli"),
+    "multi-bin's own": bins("multi-b", "multi-c"),
+  });
+
+  // Every failing package is reported once for its own `.bin` and once per
+  // package whose `.bin` it could not be linked into. Tasks run in parallel,
+  // so sort.
+  const binErrors = stderr
+    .split("\n")
+    .filter(line => line.includes("failed to link binaries"))
+    .map(line => line.replaceAll("\\", "/"))
+    .sort();
+  expect(binErrors).toEqual(
+    [
+      "ENOTDIR: failed to link binaries for package: bad-bin-dir-1@deps/bad-bin-dir-1",
+      "ENOTDIR: failed to link binaries for package: bad-bin-dir-2@deps/bad-bin-dir-2",
+      `${longBinNameError}: failed to link binaries for package: multi-bin@deps/multi-bin`,
+      "ENOTDIR: failed to link binaries of dependency bad-bin-dir-1@deps/bad-bin-dir-1 for package: test-pkg-bin-link-errors@",
+      "ENOTDIR: failed to link binaries of dependency bad-bin-dir-1@deps/bad-bin-dir-1 for package: ws@workspace:packages/ws",
+      "ENOTDIR: failed to link binaries of dependency bad-bin-dir-2@deps/bad-bin-dir-2 for package: test-pkg-bin-link-errors@",
+      `${longBinNameError}: failed to link binaries of dependency multi-bin@deps/multi-bin for package: test-pkg-bin-link-errors@`,
+    ].sort(),
+  );
+  expect(exitCode).toBe(1);
+});
+
 describe("isolated workspaces", () => {
   test("basic", async () => {
     const { packageJson, packageDir } = await registry.createTestDir({ bunfigOpts: { linker: "isolated" } });

From 6c1231aa7eb85f215c8a533982fb386b910e55a9 Mon Sep 17 00:00:00 2001
From: robobun <117481402+robobun@users.noreply.github.com>
Date: Mon, 17 Aug 2026 02:19:16 +0000
Subject: [PATCH 141/258] pack: report an error instead of panicking when
 --destination does not fit the path buffer (#38749)

---
 src/runtime/cli/pack_command.rs   | 17 ++++++++--
 test/cli/install/bun-pack.test.ts | 54 ++++++++++++++++++++++++++++++-
 test/harness.ts                   |  5 +++
 3 files changed, 73 insertions(+), 3 deletions(-)

diff --git a/src/runtime/cli/pack_command.rs b/src/runtime/cli/pack_command.rs
index 22595fc72011..0d922e4e72e0 100644
--- a/src/runtime/cli/pack_command.rs
+++ b/src/runtime/cli/pack_command.rs
@@ -2912,11 +2912,24 @@ fn tarball_destination<'a>(
         return (ZStr::from_buf(&dest_buf[..], tarball_name_len - 1), 0);
     } else {
         let (dir_len_trimmed, dir_len_full) = {
-            let tarball_destination_dir = resolve_path::join_abs_string_buf::<
+            let Some(tarball_destination_dir) = resolve_path::join_abs_string_buf_checked::<
                 resolve_path::platform::Auto,
             >(
                 abs_workspace_path, dest_buf, &[pack_destination]
-            );
+            ) else {
+                Output::err_generic(
+                    "archive destination name too long: \"{}/{}\"",
+                    (
+                        bstr::BStr::new(strings::without_trailing_slash(pack_destination)),
+                        fmt_tarball_filename(
+                            package_name,
+                            package_version,
+                            TarballNameStyle::Normalize,
+                        ),
+                    ),
+                );
+                Global::crash();
+            };
             (
                 strings::without_trailing_slash(tarball_destination_dir).len(),
                 tarball_destination_dir.len(),
diff --git a/test/cli/install/bun-pack.test.ts b/test/cli/install/bun-pack.test.ts
index 02f7131cbce8..169e7868e3d3 100644
--- a/test/cli/install/bun-pack.test.ts
+++ b/test/cli/install/bun-pack.test.ts
@@ -2,7 +2,7 @@ import { file, gunzipSync, spawn, write } from "bun";
 import { readTarball } from "bun:internal-for-testing";
 import { beforeEach, describe, expect, test } from "bun:test";
 import { chmod, exists, lstat, mkdir, rm, symlink } from "fs/promises";
-import { bunEnv, bunExe, isLinux, isWindows, pack, runBunInstall, tempDir, tmpdirSync } from "harness";
+import { MAX_PATH_BYTES, bunEnv, bunExe, isLinux, isWindows, pack, runBunInstall, tempDir, tmpdirSync } from "harness";
 import fs from "node:fs/promises";
 import { join } from "path";
 
@@ -443,6 +443,58 @@ describe("flags", () => {
     expect(await exists(join(packageDir, "packed"))).toBeFalse();
   });
 
+  // On Windows the path buffer is larger than any command line, so the overflow cannot be reached there.
+  describe.skipIf(isWindows)("--destination longer than the path buffer", () => {
+    const longName = Buffer.alloc(MAX_PATH_BYTES + 1, "d").toString();
+    const packageJson = JSON.stringify({ name: "pack-long-dest", version: "1.0.0" });
+    const expectedError = `error: archive destination name too long: "${longName}/pack-long-dest-1.0.0.tgz"\n`;
+
+    async function packWithDestination(dir: string, destination: string, ...args: string[]) {
+      await using proc = spawn({
+        cmd: [bunExe(), "pm", "pack", ...args, `--destination=${destination}`],
+        cwd: dir,
+        stdout: "pipe",
+        stderr: "pipe",
+        stdin: "ignore",
+        env: bunEnv,
+      });
+      return await Promise.all([proc.stdout.text(), proc.stderr.text(), proc.exited]);
+    }
+
+    test.concurrent("is reported as an error", async () => {
+      await using dir = tempDir("pack-long-destination", { "package.json": packageJson });
+
+      const [out, err, exitCode] = await packWithDestination(dir, longName);
+
+      expect(err).toContain(expectedError);
+      expect(out).not.toContain(".tgz");
+      expect(exitCode).toBe(1);
+      expect(await exists(join(dir, "pack-long-dest-1.0.0.tgz"))).toBeFalse();
+    });
+
+    test.concurrent("is reported as an error with --dry-run", async () => {
+      await using dir = tempDir("pack-long-destination-dry-run", { "package.json": packageJson });
+
+      const [out, err, exitCode] = await packWithDestination(dir, `${longName}/`, "--dry-run");
+
+      expect(err).toContain(expectedError);
+      expect(out).not.toContain(".tgz");
+      expect(exitCode).toBe(1);
+    });
+
+    test.concurrent("packs when the path normalizes to one that fits", async () => {
+      await using dir = tempDir("pack-long-destination-normalized", { "package.json": packageJson });
+
+      // `<over-long name>/..` resolves back to the package directory.
+      const { out } = await pack(dir, bunEnv, `--destination=${longName}/..`);
+
+      expect(out).toContain(join(dir, "pack-long-dest-1.0.0.tgz"));
+      expect(readTarball(join(dir, "pack-long-dest-1.0.0.tgz")).entries).toMatchObject([
+        { "pathname": "package/package.json" },
+      ]);
+    });
+  });
+
   test("--ignore-scripts", async () => {
     await Promise.all([
       write(
diff --git a/test/harness.ts b/test/harness.ts
index aafc014d44f6..8b4bc67b4e51 100644
--- a/test/harness.ts
+++ b/test/harness.ts
@@ -31,6 +31,11 @@ export const isWindows = process.platform === "win32";
  * on Windows, where `process.getuid` does not exist.
  */
 export const isRoot = process.getuid?.() === 0;
+/**
+ * Size of bun's fixed path buffers (`MAX_PATH_BYTES` in `src/bun_core/util.rs`). A path longer than this does not
+ * fit in one, which code taking a path from the user has to report rather than overflow the buffer.
+ */
+export const MAX_PATH_BYTES = isWindows ? 32767 * 3 + 1 : isLinux || isAndroid ? 4096 : 1024;
 export const isIntelMacOS = isMacOS && process.arch === "x64";
 export const isArm64 = process.arch === "arm64";
 export const isDebug = Bun.version.includes("debug");

From 9ef4c85308bbc139c8e070d980df6e9403930aa1 Mon Sep 17 00:00:00 2001
From: robobun <117481402+robobun@users.noreply.github.com>
Date: Mon, 17 Aug 2026 02:20:28 +0000
Subject: [PATCH 142/258] publish: report ENAMETOOLONG for a tarball path that
 does not fit the path buffer (#38753)

---
 src/runtime/cli/publish_command.rs   | 13 +++--
 test/cli/install/bun-publish.test.ts | 72 ++++++++++++++++++++++++++++
 2 files changed, 82 insertions(+), 3 deletions(-)

diff --git a/src/runtime/cli/publish_command.rs b/src/runtime/cli/publish_command.rs
index 146fc5e5c485..8fdede88f8fb 100644
--- a/src/runtime/cli/publish_command.rs
+++ b/src/runtime/cli/publish_command.rs
@@ -15,7 +15,7 @@ use bun_install::lockfile::{LoadResult, LoadStep};
 use bun_install::{self as install, Lockfile, Npm, PackageManager, Subcommand};
 use bun_libarchive::lib::{Archive, ArchiveIterator, IteratorResult as ArchiveIterResult};
 use bun_parsers::json as json_mod;
-use bun_paths::resolve_path::{join_abs_string_buf_z, normalize_buf_spill, normalize_buf_z_spill};
+use bun_paths::resolve_path::{join_abs_string_buf_checked, normalize_buf_spill, normalize_buf_z_spill};
 use bun_paths::{self as path, PathBuffer};
 use bun_sha_hmac as sha;
 use bun_simdutf_sys::simdutf;
@@ -140,11 +140,18 @@ impl<'a, const DIRECTORY_PUBLISH: bool> Context<'a, DIRECTORY_PUBLISH> {
         tarball_path: &[u8],
     ) -> Result<Context<'a, DIRECTORY_PUBLISH>, FromTarballError> {
         let mut abs_buf = PathBuffer::uninit();
-        let abs_tarball_path = join_abs_string_buf_z::<path::platform::Auto>(
+        let Some(abs_tarball_path) = join_abs_string_buf_checked::<path::platform::Auto>(
             original_cwd,
             &mut abs_buf,
             &[tarball_path],
-        );
+        ) else {
+            Output::err(
+                bun_sys::Error::from_code(bun_sys::E::ENAMETOOLONG, bun_sys::Tag::open),
+                "failed to read tarball: '{}'",
+                (bstr::BStr::new(tarball_path),),
+            );
+            Global::crash();
+        };
 
         let tarball_bytes = match File::read_from(Fd::cwd(), abs_tarball_path) {
             Ok(b) => b,
diff --git a/test/cli/install/bun-publish.test.ts b/test/cli/install/bun-publish.test.ts
index 65184d20714e..4c8b0a1789fa 100644
--- a/test/cli/install/bun-publish.test.ts
+++ b/test/cli/install/bun-publish.test.ts
@@ -1079,6 +1079,78 @@ describe.concurrent("credentials in the registry url", () => {
   });
 });
 
+describe.concurrent("tarball path", () => {
+  // --dry-run stops before the first request, so credentials in the registry url are enough
+  // for the auth check and the closed port guarantees nothing is contacted.
+  const dryRunEnv = { ...env, npm_config_registry: "http://someuser:hunter2@127.0.0.1:1/" };
+
+  function packageDir(dirName: string, packageName: string) {
+    return tempDir(dirName, { "package.json": JSON.stringify({ name: packageName, version: "1.0.0" }) });
+  }
+
+  // The tarball path is resolved against the package directory (`${dir}/${tarballPath}`) into a
+  // buffer of MAX_PATH_BYTES (src/bun_core/util.rs): 4096 bytes on Linux, 1024 on macOS and, on
+  // Windows, the longest possible command line (32767 UTF-16 units) at three UTF-8 bytes per unit.
+  const PATH_BUFFER_BYTES = isWindows ? 32767 * 3 + 1 : isLinux ? 4096 : 1024;
+
+  // So on Windows the resolved path only gets that long when it is made of three byte characters.
+  // That goes for the directory too: the argument shares the command line with bun.exe and the
+  // other arguments, and every byte the directory contributes is one the argument does not need.
+  // 150 characters keep the directory within MAX_PATH (260 units), the longest a process can be
+  // started in, and leave about 140 units of the command line for the path of bun.exe.
+  const FILLER = isWindows ? "\u4e00" : "d";
+  const TOO_LONG_DIR = isWindows ? Buffer.alloc(150 * 3, FILLER).toString() : "publish-tarball-path-too-long";
+
+  function nameOfBytes(bytes: number) {
+    const remainder = bytes % Buffer.byteLength(FILLER);
+    return Buffer.alloc(bytes - remainder, FILLER).toString() + Buffer.alloc(remainder, "d").toString();
+  }
+
+  function nameResolvingTo(resolvedBytes: number, dir: string) {
+    return nameOfBytes(resolvedBytes - Buffer.byteLength(dir) - 1);
+  }
+
+  async function expectTooLong(tarballPathFor: (dir: string) => string) {
+    using dir = packageDir(TOO_LONG_DIR, "publish-tarball-path-too-long");
+    const tarballPath = tarballPathFor(String(dir));
+    if (isWindows) {
+      // CreateProcess takes command lines of up to 32767 units, terminating NUL included.
+      expect(`"${bunExe()}" publish ${tarballPath} --dry-run\0`.length).toBeLessThanOrEqual(32767);
+    }
+
+    const { err, exitCode } = await publish(dryRunEnv, String(dir), tarballPath, "--dry-run");
+
+    expect(err).toContain(`ENAMETOOLONG: File name too long: failed to read tarball: '${tarballPath}'`);
+    expect(exitCode).toBe(1);
+  }
+
+  test("one byte longer than the path buffer once resolved fails with ENAMETOOLONG", () =>
+    expectTooLong(dir => nameResolvingTo(PATH_BUFFER_BYTES + 1, dir)));
+
+  // Neither of these works on Windows: an argument longer than the whole buffer does not fit in a
+  // command line, and a path that fills the buffer exactly is refused by the open rather than the
+  // join, which on Windows currently reports it as ENOSYS (it takes ENAMETOOLONG's number from the
+  // C runtime, where it is a different one than in bun's errno table).
+  test.skipIf(isWindows).each([
+    ["longer than the path buffer", () => nameOfBytes(5000)],
+    // Leaves no room for the terminating NUL.
+    ["as long as the path buffer once resolved", (dir: string) => nameResolvingTo(PATH_BUFFER_BYTES, dir)],
+  ])("%s fails with ENAMETOOLONG", (_, tarballPathFor) => expectTooLong(tarballPathFor));
+
+  // What has to fit the buffer is the resolved path, not the argument as written.
+  test("that only fits the path buffer once resolved is read", async () => {
+    using dir = packageDir("publish-tarball-path-resolved", "publish-tarball-path-resolved");
+    await pack(String(dir), env);
+    const tarballPath = Buffer.alloc(5000, "x/../").toString() + "publish-tarball-path-resolved-1.0.0.tgz";
+
+    const { out, err, exitCode } = await publish(dryRunEnv, String(dir), tarballPath, "--dry-run");
+
+    expect(err).not.toContain("error:");
+    expect(out).toContain(" + publish-tarball-path-resolved@1.0.0 (dry-run)");
+    expect(exitCode).toBe(0);
+  });
+});
+
 describe("lifecycle scripts", async () => {
   const script = `const fs = require("fs");
     fs.writeFileSync(process.argv[2] + ".txt", \`

From 1c0fcb42393136e6152e8f48413516ae7eeadb5b Mon Sep 17 00:00:00 2001
From: robobun <117481402+robobun@users.noreply.github.com>
Date: Mon, 17 Aug 2026 02:20:50 +0000
Subject: [PATCH 143/258] install: replace an existing manifest cache entry
 atomically instead of unlinking it first (#38916)

---
 src/install/npm.rs                            |  11 +-
 test/cli/install/bun-install-registry.test.ts | 167 +++++++++++++-----
 2 files changed, 129 insertions(+), 49 deletions(-)

diff --git a/src/install/npm.rs b/src/install/npm.rs
index 04320ef2965f..e86fcc837a3a 100644
--- a/src/install/npm.rs
+++ b/src/install/npm.rs
@@ -1191,14 +1191,11 @@ pub mod package_manifest {
 
             #[cfg(any(target_os = "linux", target_os = "android"))]
             if is_using_o_tmpfile {
-                // Attempt #1.
-                if bun_sys::linkat_tmpfile(file.handle, cache_dir, outpath).is_err() {
-                    // Attempt #2: the file may already exist. Let's unlink and try again.
-                    let _ = bun_sys::unlinkat(cache_dir, outpath);
-                    bun_sys::linkat_tmpfile(file.handle, cache_dir, outpath)?;
-                    // There is no attempt #3. This is a cache, so it's not essential.
+                if bun_sys::linkat_tmpfile(file.handle, cache_dir, outpath).is_ok() {
+                    return Ok(());
                 }
-                return Ok(());
+                // Keep the entry present throughout: rename over it below instead of unlinking it.
+                bun_sys::linkat_tmpfile(file.handle, tmpdir, tmp_path)?;
             }
 
             #[cfg(not(windows))]
diff --git a/test/cli/install/bun-install-registry.test.ts b/test/cli/install/bun-install-registry.test.ts
index d980506aceeb..82fb0aceb268 100644
--- a/test/cli/install/bun-install-registry.test.ts
+++ b/test/cli/install/bun-install-registry.test.ts
@@ -1,13 +1,14 @@
 import { file, spawn, write } from "bun";
 import { install_test_helpers, npm_manifest_test_helpers } from "bun:internal-for-testing";
 import { afterAll, beforeEach, describe, expect, setDefaultTimeout, test } from "bun:test";
-import { copyFileSync, mkdirSync } from "fs";
+import { copyFileSync, existsSync, mkdirSync } from "fs";
 import { cp, exists, lstat, mkdir, readlink, rename, rm, writeFile } from "fs/promises";
 import {
   assertManifestsPopulated,
   bunExe,
   bunEnv as env,
   isFlaky,
+  isLinux,
   isWindows,
   mergeWindowEnvs,
   normalizeBunSnapshot,
@@ -10855,16 +10856,20 @@ describe("manifest conditional requests", () => {
   const etag = '"no-deps-manifest-v1"';
   const lastModified = "Wed, 21 Oct 2015 07:28:00 GMT";
 
-  function startRegistry(validators: { etag?: string; lastModified?: string }) {
+  /** `served` is read on every request, so a test can change what the registry serves between installs. */
+  function startRegistry(served: { etag?: string; lastModified?: string; versions?: string[] }) {
     const requests: ManifestRequest[] = [];
-    let tarballRequests = 0;
+    const tarballRequests: string[] = [];
     const server = Bun.serve({
       port: 0,
       fetch(req) {
         const { pathname } = new URL(req.url);
-        if (pathname === "/no-deps/-/no-deps-1.0.0.tgz") {
-          tarballRequests++;
-          return new Response(file(join(import.meta.dir, "registry", "packages", "no-deps", "no-deps-1.0.0.tgz")));
+        const tarball = pathname.match(/^\/no-deps\/-\/no-deps-(.+)\.tgz$/);
+        if (tarball) {
+          tarballRequests.push(tarball[1]);
+          return new Response(
+            file(join(import.meta.dir, "registry", "packages", "no-deps", `no-deps-${tarball[1]}.tgz`)),
+          );
         }
         if (pathname !== "/no-deps") {
           return new Response("unexpected", { status: 404 });
@@ -10878,34 +10883,38 @@ describe("manifest conditional requests", () => {
         };
         requests.push(entry);
         const notModified =
-          (validators.etag !== undefined && entry.ifNoneMatch === validators.etag) ||
-          (validators.etag === undefined &&
-            validators.lastModified !== undefined &&
-            entry.ifModifiedSince === validators.lastModified);
+          (served.etag !== undefined && entry.ifNoneMatch === served.etag) ||
+          (served.etag === undefined &&
+            served.lastModified !== undefined &&
+            entry.ifModifiedSince === served.lastModified);
         if (notModified) {
           entry.status = 304;
           return new Response(null, { status: 304 });
         }
         const headers: Record<string, string> = {};
-        if (validators.etag !== undefined) headers["ETag"] = validators.etag;
-        if (validators.lastModified !== undefined) headers["Last-Modified"] = validators.lastModified;
+        if (served.etag !== undefined) headers["ETag"] = served.etag;
+        if (served.lastModified !== undefined) headers["Last-Modified"] = served.lastModified;
+        const versions = served.versions ?? ["1.0.0"];
         return Response.json(
           {
             name: "no-deps",
-            "dist-tags": { latest: "1.0.0" },
-            versions: {
-              "1.0.0": {
-                name: "no-deps",
-                version: "1.0.0",
-                dist: { tarball: `http://localhost:${server.port}/no-deps/-/no-deps-1.0.0.tgz` },
-              },
-            },
+            "dist-tags": { latest: versions.at(-1) },
+            versions: Object.fromEntries(
+              versions.map(version => [
+                version,
+                {
+                  name: "no-deps",
+                  version,
+                  dist: { tarball: `http://localhost:${server.port}/no-deps/-/no-deps-${version}.tgz` },
+                },
+              ]),
+            ),
           },
           { headers },
         );
       },
     });
-    return { server, requests, tarballRequests: () => tarballRequests };
+    return { server, requests, tarballRequests };
   }
 
   let registryPort = 0;
@@ -10925,12 +10934,18 @@ describe("manifest conditional requests", () => {
     ]);
   }
 
-  async function install(...args: string[]) {
+  /** Without a lockfile, the next install has to resolve no-deps again (from the manifest cache or the registry). */
+  async function clean() {
     await Promise.all([
       rm(join(packageDir, "node_modules"), { recursive: true, force: true }),
       rm(join(packageDir, "bun.lock"), { force: true }),
       rm(join(packageDir, "bun.lockb"), { force: true }),
     ]);
+  }
+
+  /** Runs `bun install` from scratch and checks that it installed `no-deps@${version}`. */
+  async function install(version: string, ...args: string[]) {
+    await clean();
     await using proc = spawn({
       cmd: [bunExe(), "install", ...args],
       cwd: packageDir,
@@ -10940,17 +10955,17 @@ describe("manifest conditional requests", () => {
     });
     const [out, err, exitCode] = await Promise.all([proc.stdout.text(), proc.stderr.text(), proc.exited]);
     expect(err).not.toContain("error:");
-    expect(out).toContain("+ no-deps@1.0.0");
+    expect(out).toContain(`+ no-deps@${version}`);
     expect(exitCode).toBe(0);
     expect(await file(join(packageDir, "node_modules", "no-deps", "package.json")).json()).toStrictEqual({
       name: "no-deps",
-      version: "1.0.0",
+      version,
     });
     const npmPackages = (Object.values(parseLockfile(packageDir).packages) as any[]).filter(
       pkg => pkg.resolution.tag === "npm",
     );
     expect(npmPackages.map(pkg => [pkg.name, pkg.resolution.resolved])).toStrictEqual([
-      ["no-deps", `http://localhost:${registryPort}/no-deps/-/no-deps-1.0.0.tgz`],
+      ["no-deps", `http://localhost:${registryPort}/no-deps/-/no-deps-${version}.tgz`],
     ]);
   }
 
@@ -10962,34 +10977,42 @@ describe("manifest conditional requests", () => {
     using _ = server;
     await setup(server.port);
 
-    await install();
-    await install("--force");
+    await install("1.0.0");
+    await install("1.0.0", "--force");
     expect(requests).toStrictEqual([
       { accept, authorization, ifNoneMatch: null, ifModifiedSince: null, status: 200 },
       { accept, authorization, ifNoneMatch: etag, ifModifiedSince: null, status: 304 },
     ]);
-    expect(tarballRequests()).toBe(1);
+    expect(tarballRequests).toStrictEqual(["1.0.0"]);
 
-    await install();
+    // Whether or not the --force install got to rewrite the cache entry before it
+    // exited (nothing waits for that write), a fresh manifest is on disk.
+    await install("1.0.0");
     expect(requests).toHaveLength(2);
-    expect(tarballRequests()).toBe(1);
+    expect(tarballRequests).toStrictEqual(["1.0.0"]);
   });
 
-  test("a changed etag returns 200 and the new etag is cached", async () => {
-    const validators = { etag };
-    const { server, requests } = startRegistry(validators);
+  test("a changed etag returns 200 and the new manifest and etag are cached", async () => {
+    const served = { etag, versions: ["1.0.0"] };
+    const { server, requests, tarballRequests } = startRegistry(served);
     using _ = server;
     await setup(server.port);
 
-    await install();
-    validators.etag = '"no-deps-manifest-v2"';
-    await install("--force");
-    await install("--force");
+    await install("1.0.0");
+
+    // The registry's manifest changes because a version was published. Installing it
+    // downloads a tarball after the manifest arrived, which is what gives the rewrite
+    // of the cache entry (nothing waits for it) time to land before the install exits.
+    served.versions.push("1.0.1");
+    served.etag = '"no-deps-manifest-v2"';
+    await install("1.0.1", "--force");
+    await install("1.0.1", "--force");
     expect(requests).toStrictEqual([
       { accept, authorization, ifNoneMatch: null, ifModifiedSince: null, status: 200 },
       { accept, authorization, ifNoneMatch: etag, ifModifiedSince: null, status: 200 },
       { accept, authorization, ifNoneMatch: '"no-deps-manifest-v2"', ifModifiedSince: null, status: 304 },
     ]);
+    expect(tarballRequests).toStrictEqual(["1.0.0", "1.0.1"]);
   });
 
   test("If-Modified-Since is sent when the registry only provided Last-Modified", async () => {
@@ -10997,13 +11020,13 @@ describe("manifest conditional requests", () => {
     using _ = server;
     await setup(server.port);
 
-    await install();
-    await install("--force");
+    await install("1.0.0");
+    await install("1.0.0", "--force");
     expect(requests).toStrictEqual([
       { accept, authorization, ifNoneMatch: null, ifModifiedSince: null, status: 200 },
       { accept, authorization, ifNoneMatch: null, ifModifiedSince: lastModified, status: 304 },
     ]);
-    expect(tarballRequests()).toBe(1);
+    expect(tarballRequests).toStrictEqual(["1.0.0"]);
   });
 
   test("no validators means every --force install refetches unconditionally", async () => {
@@ -11011,11 +11034,71 @@ describe("manifest conditional requests", () => {
     using _ = server;
     await setup(server.port);
 
-    await install();
-    await install("--force");
+    await install("1.0.0");
+    await install("1.0.0", "--force");
     expect(requests).toStrictEqual([
       { accept, authorization, ifNoneMatch: null, ifModifiedSince: null, status: 200 },
       { accept, authorization, ifNoneMatch: null, ifModifiedSince: null, status: 200 },
     ]);
   });
+
+  // The 304 makes the install rewrite the cache entry from a thread pool task that nothing
+  // waits for, so the install can exit at any point of the rewrite. On Linux the rewrite used
+  // to unlink the entry and link the new file in its place, so an install exiting in between
+  // deleted the entry, and another install reading the cache in between missed it. The poll
+  // below is that other reader. Linux only: the other platforms rename the new file into place.
+  test.skipIf(!isLinux)("rewriting a cached manifest never leaves the cache without the entry", async () => {
+    const { server, requests } = startRegistry({ etag });
+    using _ = server;
+    await setup(server.port);
+    await install("1.0.0");
+
+    const cacheDir = join(packageDir, ".bun-cache");
+    const manifestFiles = (await readdirSorted(cacheDir)).filter(name => name.endsWith(".npm"));
+    expect(manifestFiles).toHaveLength(1);
+    const manifestPath = join(cacheDir, manifestFiles[0]);
+
+    const forcedInstalls = 10;
+    for (let i = 0; i < forcedInstalls; i++) {
+      await clean();
+      await using proc = spawn({
+        cmd: [bunExe(), "install", "--force"],
+        cwd: packageDir,
+        stdout: "pipe",
+        stderr: "pipe",
+        env,
+      });
+      let running = true;
+      const exited = proc.exited.finally(() => {
+        running = false;
+      });
+      let timesMissing = 0;
+      while (running) {
+        for (let poll = 0; poll < 512; poll++) {
+          if (!existsSync(manifestPath)) timesMissing++;
+        }
+        // Gives the event loop a turn to notice the exit between batches of polls.
+        await new Promise(resolve => setImmediate(resolve));
+      }
+      const [out, err, exitCode] = await Promise.all([proc.stdout.text(), proc.stderr.text(), exited]);
+      expect(err).not.toContain("error:");
+      expect(out).toContain("+ no-deps@1.0.0");
+      expect(exitCode).toBe(0);
+      expect({ install: i, timesMissing, presentAfterExit: existsSync(manifestPath) }).toStrictEqual({
+        install: i,
+        timesMissing: 0,
+        presentAfterExit: true,
+      });
+    }
+    expect(requests).toStrictEqual([
+      { accept, authorization, ifNoneMatch: null, ifModifiedSince: null, status: 200 },
+      ...Array.from({ length: forcedInstalls }, () => ({
+        accept,
+        authorization,
+        ifNoneMatch: etag,
+        ifModifiedSince: null,
+        status: 304,
+      })),
+    ]);
+  });
 });

From bbb6ec00e7368945a45dd61d250d626759cf0dfc Mon Sep 17 00:00:00 2001
From: robobun <117481402+robobun@users.noreply.github.com>
Date: Mon, 17 Aug 2026 02:21:29 +0000
Subject: [PATCH 144/258] Make bun pm ls list installed packages instead of
 lockfile entries (#38923)

---
 completions/bun-cli.json                      |   2 +-
 completions/bun.zsh                           |   4 +-
 src/install/PackageManager.rs                 |   4 +-
 src/runtime/cli/mod.rs                        |   2 +-
 src/runtime/cli/package_manager_command.rs    | 117 +++++++++++++++-
 src/runtime/cli/pm_licenses_command.rs        |  10 +-
 test/cli/bun.test.ts                          |   2 +-
 test/cli/install/bun-pm.test.ts               | 130 +++++++++++++++++-
 .../install/frozen-lockfile-pruned.test.ts    |  41 +++---
 9 files changed, 275 insertions(+), 37 deletions(-)

diff --git a/completions/bun-cli.json b/completions/bun-cli.json
index 365c2ac427ec..8b0d12dc057f 100644
--- a/completions/bun-cli.json
+++ b/completions/bun-cli.json
@@ -3407,7 +3407,7 @@
         },
         "ls": {
           "name": "ls",
-          "description": "list the dependency tree according to the current lockfile",
+          "description": "list the tree of installed dependencies",
           "flags": [],
           "positionalArgs": []
         },
diff --git a/completions/bun.zsh b/completions/bun.zsh
index 790da62bd25d..3fb302df5196 100644
--- a/completions/bun.zsh
+++ b/completions/bun.zsh
@@ -259,7 +259,7 @@ _bun_pm_completion() {
     cmd2)
         sub_commands=(
             'bin\:"print the path to bin folder" '
-            'ls\:"list the dependency tree according to the current lockfile" '
+            'ls\:"list the tree of installed dependencies" '
             'licenses\:"list installed packages grouped by license" '
             'hash\:"generate & print the hash of the current lockfile" '
             'hash-string\:"print the string used to hash the lockfile" '
@@ -295,7 +295,7 @@ _bun_pm_completion() {
             ;;
         ls)
             pmargs=(
-                "--all[list the entire dependency tree according to the current lockfile]"
+                "--all[list the entire tree of installed dependencies]"
                 "--trusted[list only trusted dependencies]"
             )
 
diff --git a/src/install/PackageManager.rs b/src/install/PackageManager.rs
index 27526ac07499..50ba311f83ad 100644
--- a/src/install/PackageManager.rs
+++ b/src/install/PackageManager.rs
@@ -134,8 +134,8 @@ impl PackageManagerCommand {
   <d>└<r> <cyan>--quiet<r>                   only output the tarball filename
   <b><green>bun pm<r> <blue>bin<r>                  print the path to bin folder
   <d>└<r> <cyan>-g<r>                        print the <b>global<r> path to bin folder
-  <b><green>bun pm<r> <blue>ls<r>                   list the dependency tree according to the current lockfile
-  <d>├<r> <cyan>--all<r>                     list the entire dependency tree according to the current lockfile
+  <b><green>bun pm<r> <blue>ls<r>                   list the tree of installed dependencies
+  <d>├<r> <cyan>--all<r>                     list the entire tree of installed dependencies
   <d>└<r> <cyan>--trusted<r>                 list only trusted dependencies
   <b><green>bun pm<r> <blue>why<r> <d>\<pkg\><r>            show dependency tree explaining why a package is installed
   <b><green>bun pm<r> <blue>licenses<r>             list installed packages grouped by license
diff --git a/src/runtime/cli/mod.rs b/src/runtime/cli/mod.rs
index f609dfdd4a0b..71c4d5c48d83 100644
--- a/src/runtime/cli/mod.rs
+++ b/src/runtime/cli/mod.rs
@@ -2266,7 +2266,7 @@ Full documentation is available at <magenta>https://bun.com/docs/cli/why<r>
 
 <b>Commands:<r>
   <b><green>bun pm<r> <blue>bin<r>              print the path to bin folder
-  <b><green>bun pm<r> <blue>ls<r>               list the dependency tree according to the current lockfile
+  <b><green>bun pm<r> <blue>ls<r>               list the tree of installed dependencies
   <b><green>bun pm<r> <blue>whoami<r>           print the current npm username
   <b><green>bun pm<r> <blue>hash<r>             generate & print the hash of the current lockfile
   <b><green>bun pm<r> <blue>cache<r>            print the path to the cache folder
diff --git a/src/runtime/cli/package_manager_command.rs b/src/runtime/cli/package_manager_command.rs
index c40cb14b4c12..eb9e993dc645 100644
--- a/src/runtime/cli/package_manager_command.rs
+++ b/src/runtime/cli/package_manager_command.rs
@@ -12,13 +12,13 @@ use bun_install::package_manager_real::{
     CommandLineArguments, Subcommand, fetch_cache_directory_path, get_cache_directory,
     package_json_write_back, package_manager_options::LogLevel, setup_global_dir,
 };
-use bun_install::{DependencyID, PackageID, PackageManager, migration};
-use bun_paths::{self as Path, PathBuffer};
+use bun_install::{DependencyID, PackageID, PackageManager, ResolutionTag, migration};
+use bun_paths::{self as Path, AutoAbsPath, PathBuffer};
 use bun_resolver::fs as Fs;
 use bun_sys::{self, Dir, Fd, File};
 
 use crate::cli::Command;
-use crate::cli::pm_licenses_command::{LicensesFlags, PmLicensesCommand};
+use crate::cli::pm_licenses_command::{BunStore, LicensesFlags, PmLicensesCommand};
 use crate::cli::pm_pkg_command::PmPkgCommand;
 use crate::cli::pm_trusted_command::{DefaultTrustedCommand, TrustCommand, UntrustedCommand};
 use crate::cli::pm_version_command::PmVersionCommand;
@@ -36,6 +36,83 @@ pub(crate) struct NodeModulesFolder {
     dependencies: Box<[DependencyID]>,
 }
 
+/// Disk-existence check for `bun pm ls`: the lockfile also contains entries
+/// that were never installed (platform-mismatched optionals) or were removed
+/// after install (`bun prune --production`), and those must not be listed as
+/// the contents of `node_modules`.
+struct InstalledFilter {
+    path: AutoAbsPath,
+    top_len: usize,
+    store: BunStore,
+}
+
+impl InstalledFilter {
+    fn init() -> Self {
+        let path = AutoAbsPath::init_top_level_dir();
+        let top_len = path.len();
+        Self {
+            path,
+            top_len,
+            store: BunStore::init(),
+        }
+    }
+
+    fn node_modules_exists(&mut self) -> bool {
+        self.path.set_length(self.top_len);
+        let _ = self.path.append(b"node_modules");
+        let exists = bun_sys::exists(self.path.slice());
+        self.path.set_length(self.top_len);
+        exists
+    }
+
+    fn is_installed(
+        &mut self,
+        lockfile: &Lockfile,
+        relative_path: &[u8],
+        dep_id: DependencyID,
+    ) -> bool {
+        let package_id = lockfile.buffers.resolutions.as_slice()[dep_id as usize];
+        if package_id as usize >= lockfile.packages.len() {
+            return false;
+        }
+        let slice = lockfile.packages.slice();
+        let resolution = &slice.items_resolution()[package_id as usize];
+        // Local sources (the project itself, workspaces, `bun link`ed packages)
+        // always exist on disk outside of node_modules.
+        if matches!(
+            resolution.tag,
+            ResolutionTag::Root | ResolutionTag::Workspace | ResolutionTag::Symlink
+        ) {
+            return true;
+        }
+
+        let buf = lockfile.buffers.string_bytes.as_slice();
+        let alias = lockfile.buffers.dependencies.as_slice()[dep_id as usize]
+            .name
+            .slice(buf);
+        self.path.set_length(self.top_len);
+        let _ = self.path.append(relative_path);
+        let _ = self.path.append(alias);
+        let exists = bun_sys::exists(self.path.slice());
+        self.path.set_length(self.top_len);
+        if exists {
+            return true;
+        }
+
+        // Isolated installs (`node_modules/.bun`) only link direct dependencies
+        // into each package's node_modules; transitive packages live in the store.
+        self.store
+            .lookup(
+                &mut self.path,
+                self.top_len,
+                slice.items_name()[package_id as usize],
+                resolution,
+                buf,
+            )
+            .is_some()
+    }
+}
+
 // Transient sort-comparator context; lifetime is fn-local.
 struct ByName<'a> {
     dependencies: &'a [Dependency],
@@ -184,8 +261,8 @@ impl PackageManagerCommand {
   <d>└<r> <cyan>--quiet<r>                   only output the tarball filename\n\
   <b><green>bun pm<r> <blue>bin<r>                  print the path to bin folder\n\
   <d>└<r> <cyan>-g<r>                        print the <b>global<r> path to bin folder\n\
-  <b><green>bun pm<r> <blue>ls<r>                   list the dependency tree according to the current lockfile\n\
-  <d>├<r> <cyan>--all<r>                     list the entire dependency tree according to the current lockfile\n\
+  <b><green>bun pm<r> <blue>ls<r>                   list the tree of installed dependencies\n\
+  <d>├<r> <cyan>--all<r>                     list the entire tree of installed dependencies\n\
   <d>└<r> <cyan>--trusted<r>                 list only trusted dependencies\n\
   <b><green>bun pm<r> <blue>why<r> <d>\\<pkg\\><r>            show dependency tree explaining why a package is installed\n\
   <b><green>bun pm<r> <blue>licenses<r>             list installed packages grouped by license\n\
@@ -546,10 +623,21 @@ Learn more about these at <magenta>https://bun.com/docs/cli/pm<r>.\n";
             Output::flush();
             Output::disable_buffering();
             let lockfile: &Lockfile = &pm.lockfile;
+
+            let mut installed = InstalledFilter::init();
+            if !installed.node_modules_exists() {
+                if log_level != LogLevel::Silent {
+                    Output::err_generic("node_modules not found, nothing to list", ());
+                    bun_core::note!("run 'bun install' first");
+                }
+                Global::exit(1);
+            }
+
             let mut iterator =
                 tree::Iterator::<{ tree::IteratorPathStyle::NodeModules }>::init(lockfile);
 
             let mut max_depth: usize = 0;
+            let mut installed_count: usize = 0;
 
             let mut directories: Vec<NodeModulesFolder> = Vec::new();
             while let Some(node_modules) = iterator.next(None) {
@@ -558,7 +646,19 @@ Learn more about these at <magenta>https://bun.com/docs/cli/pm<r>.\n";
                 path.extend_from_slice(node_modules.relative_path.as_bytes());
                 path.push(0);
 
-                let dependencies: Box<[DependencyID]> = Box::from(node_modules.dependencies);
+                let dependencies: Box<[DependencyID]> = node_modules
+                    .dependencies
+                    .iter()
+                    .copied()
+                    .filter(|&dep_id| {
+                        installed.is_installed(
+                            lockfile,
+                            node_modules.relative_path.as_bytes(),
+                            dep_id,
+                        )
+                    })
+                    .collect();
+                installed_count += dependencies.len();
 
                 if max_depth < node_modules.depth + 1 {
                     max_depth = node_modules.depth + 1;
@@ -621,7 +721,7 @@ Learn more about these at <magenta>https://bun.com/docs/cli/pm<r>.\n";
                 Output::println(format_args!(
                     "{} node_modules ({} installed)",
                     bstr::BStr::new(path),
-                    lockfile.buffers.hoisted_dependencies.len(),
+                    installed_count,
                 ));
                 let string_bytes = lockfile.buffers.string_bytes.as_slice();
                 let mut sorted_dependencies: Vec<DependencyID> =
@@ -637,6 +737,9 @@ Learn more about these at <magenta>https://bun.com/docs/cli/pm<r>.\n";
                 // unique so stability is irrelevant.
                 sorted_dependencies.sort_unstable_by(|a, b| by_name.cmp(*a, *b));
 
+                sorted_dependencies
+                    .retain(|&dep_id| installed.is_installed(lockfile, b"node_modules", dep_id));
+
                 if trusted_only {
                     sorted_dependencies.retain(|&dep_id| {
                         let package_id = lockfile.buffers.resolutions.as_slice()[dep_id as usize];
diff --git a/src/runtime/cli/pm_licenses_command.rs b/src/runtime/cli/pm_licenses_command.rs
index 625782c17a43..fdfead9a4eae 100644
--- a/src/runtime/cli/pm_licenses_command.rs
+++ b/src/runtime/cli/pm_licenses_command.rs
@@ -43,7 +43,7 @@ struct Entry {
 }
 
 /// Lazily-scanned, sorted entry names of `node_modules/.bun/`; `None` until first needed.
-struct BunStore {
+pub(crate) struct BunStore {
     entries: Option<Vec<Box<[u8]>>>,
 }
 
@@ -205,7 +205,7 @@ impl PmLicensesCommand {
         let buf = lockfile.buffers.string_bytes.as_slice();
 
         let mut log = Log::init();
-        let mut store = BunStore { entries: None };
+        let mut store = BunStore::init();
         let mut disk = DiskIndex { entries: None };
         let mut entries: Vec<Entry> = Vec::new();
         let mut missing: usize = 0;
@@ -523,6 +523,10 @@ fn author_of(json: &Expr) -> Option<Box<[u8]>> {
 }
 
 impl BunStore {
+    pub(crate) fn init() -> Self {
+        Self { entries: None }
+    }
+
     fn read_info(
         &mut self,
         path: &mut AutoAbsPath,
@@ -543,7 +547,7 @@ impl BunStore {
         read_package_info_at(path, top_len, &segments, log)
     }
 
-    fn lookup(
+    pub(crate) fn lookup(
         &mut self,
         path: &mut AutoAbsPath,
         top_len: usize,
diff --git a/test/cli/bun.test.ts b/test/cli/bun.test.ts
index 5dacc0582291..94ed7fb0203c 100644
--- a/test/cli/bun.test.ts
+++ b/test/cli/bun.test.ts
@@ -259,7 +259,7 @@ describe("bun", () => {
         "bun pm --help",
         ["pm"],
         [
-          /^ {2}bun pm ls +list the dependency tree according to the current lockfile$/m,
+          /^ {2}bun pm ls +list the tree of installed dependencies$/m,
           /^ {2}bun pm licenses +list installed packages grouped by license$/m,
         ],
       ],
diff --git a/test/cli/install/bun-pm.test.ts b/test/cli/install/bun-pm.test.ts
index b571a52a9437..856a3bc73b0c 100644
--- a/test/cli/install/bun-pm.test.ts
+++ b/test/cli/install/bun-pm.test.ts
@@ -1,6 +1,6 @@
 import { spawn } from "bun";
 import { afterAll, afterEach, beforeAll, beforeEach, describe, expect, it, test } from "bun:test";
-import { exists, mkdir, writeFile } from "fs/promises";
+import { exists, mkdir, rm, writeFile } from "fs/promises";
 import { bunEnv, bunEnv as env, bunExe, isLinux, isWindows, readdirSorted, tempDir, tmpdirSync } from "harness";
 import { cpSync } from "node:fs";
 import { join } from "path";
@@ -194,6 +194,134 @@ it("should list all dependencies when a resolution is longer than 512 bytes", as
   expect(exitCode).toBe(0);
 });
 
+it("should not list packages missing from node_modules", async () => {
+  const urls: string[] = [];
+  setHandler(dummyRegistry(urls));
+  await writeFile(
+    join(package_dir, "package.json"),
+    JSON.stringify({
+      name: "foo",
+      version: "0.0.1",
+      dependencies: {
+        bar: "latest",
+        moo: "./moo",
+      },
+    }),
+  );
+  await mkdir(join(package_dir, "moo"));
+  await writeFile(
+    join(package_dir, "moo", "package.json"),
+    JSON.stringify({
+      name: "moo",
+      version: "0.1.0",
+    }),
+  );
+  {
+    const { stderr, exited } = spawn({
+      cmd: [bunExe(), "install"],
+      cwd: package_dir,
+      stdout: "pipe",
+      stdin: "pipe",
+      stderr: "pipe",
+      env,
+    });
+    const err = await stderr.text();
+    expect(err).not.toContain("error:");
+    expect(err).toContain("Saved lockfile");
+    expect(await exited).toBe(0);
+  }
+  {
+    const { stdout, stderr, exited } = spawn({
+      cmd: [bunExe(), "pm", "ls"],
+      cwd: package_dir,
+      stdout: "pipe",
+      stdin: "pipe",
+      stderr: "pipe",
+      env,
+    });
+    expect(await stderr.text()).toBe("");
+    expect(await stdout.text()).toBe(`${package_dir} node_modules (2)
+├── bar@0.0.2
+└── moo@moo
+`);
+    expect(await exited).toBe(0);
+  }
+  // simulates `bun prune --production` or a platform-mismatched optional
+  // dependency: the package is in the lockfile but not on disk
+  await rm(join(package_dir, "node_modules", "bar"), { recursive: true });
+  {
+    const { stdout, stderr, exited } = spawn({
+      cmd: [bunExe(), "pm", "ls"],
+      cwd: package_dir,
+      stdout: "pipe",
+      stdin: "pipe",
+      stderr: "pipe",
+      env,
+    });
+    expect(await stderr.text()).toBe("");
+    expect(await stdout.text()).toBe(`${package_dir} node_modules (1)
+└── moo@moo
+`);
+    expect(await exited).toBe(0);
+  }
+  {
+    const { stdout, stderr, exited } = spawn({
+      cmd: [bunExe(), "pm", "ls", "--all"],
+      cwd: package_dir,
+      stdout: "pipe",
+      stdin: "pipe",
+      stderr: "pipe",
+      env,
+    });
+    expect(await stderr.text()).toBe("");
+    expect(await stdout.text()).toBe(`${package_dir} node_modules
+└── moo@moo
+`);
+    expect(await exited).toBe(0);
+  }
+});
+
+it("should error when node_modules does not exist", async () => {
+  const urls: string[] = [];
+  setHandler(dummyRegistry(urls));
+  await writeFile(
+    join(package_dir, "package.json"),
+    JSON.stringify({
+      name: "foo",
+      version: "0.0.1",
+      dependencies: {
+        bar: "latest",
+      },
+    }),
+  );
+  {
+    const { stderr, exited } = spawn({
+      cmd: [bunExe(), "install"],
+      cwd: package_dir,
+      stdout: "pipe",
+      stdin: "pipe",
+      stderr: "pipe",
+      env,
+    });
+    const err = await stderr.text();
+    expect(err).not.toContain("error:");
+    expect(err).toContain("Saved lockfile");
+    expect(await exited).toBe(0);
+  }
+  await rm(join(package_dir, "node_modules"), { recursive: true });
+  const { stdout, stderr, exited } = spawn({
+    cmd: [bunExe(), "pm", "ls"],
+    cwd: package_dir,
+    stdout: "pipe",
+    stdin: "pipe",
+    stderr: "pipe",
+    env,
+  });
+  expect(await stderr.text()).toContain("node_modules not found");
+  expect(await stdout.text()).toBe("");
+  expect(await exited).toBe(1);
+});
+
 it("should list top-level aliased dependency", async () => {
   const urls: string[] = [];
   setHandler(dummyRegistry(urls));
diff --git a/test/cli/install/frozen-lockfile-pruned.test.ts b/test/cli/install/frozen-lockfile-pruned.test.ts
index 1f9185079daa..2d47f4128837 100644
--- a/test/cli/install/frozen-lockfile-pruned.test.ts
+++ b/test/cli/install/frozen-lockfile-pruned.test.ts
@@ -659,26 +659,29 @@ describe.each(["hoisted", "isolated"] as Linker[])("linker: %s", linker => {
     expect(await exists(installedPath(packageDir, linker, "left-pad", "1.0.0"))).toBeFalse();
   });
 
-  // docs/pm/cli/install.mdx: the skipped workspaces stay in bun.lock, so lockfile-driven commands still see them.
-  test.concurrent("bun pm ls --all still lists the skipped workspace and its exclusive dependency", async () => {
-    const { packageDir, full } = await verbatimTree(linker);
-    await frozen(packageDir, linker, 0);
-
-    const { stdout, stderr, exitCode } = await spawnBun(packageDir, ["pm", "ls", "--all"]);
+  // The skipped workspace stays in bun.lock and is still listed, but its
+  // exclusive dependency was never installed so `bun pm ls` omits it.
+  test.concurrent(
+    "bun pm ls --all lists the skipped workspace but not its uninstalled exclusive dependency",
+    async () => {
+      const { packageDir, full } = await verbatimTree(linker);
+      await frozen(packageDir, linker, 0);
 
-    expect(stderr).toBe("");
-    expect(normalizeBunSnapshot(stdout, packageDir)).toMatchInlineSnapshot(`
-      "<dir> node_modules
-      ├── a-dep@1.0.1
-      ├── app@workspace:packages/app
-      ├── left-pad@1.0.0
-      ├── no-deps@1.0.0
-      ├── other@workspace:packages/other
-      └── shared@workspace:packages/shared"
-    `);
-    expect(await lockText(packageDir)).toBe(full);
-    expect(exitCode).toBe(0);
-  });
+      const { stdout, stderr, exitCode } = await spawnBun(packageDir, ["pm", "ls", "--all"]);
+
+      expect(stderr).toBe("");
+      expect(normalizeBunSnapshot(stdout, packageDir)).toMatchInlineSnapshot(`
+        "<dir> node_modules
+        ├── a-dep@1.0.1
+        ├── app@workspace:packages/app
+        ├── no-deps@1.0.0
+        ├── other@workspace:packages/other
+        └── shared@workspace:packages/shared"
+      `);
+      expect(await lockText(packageDir)).toBe(full);
+      expect(exitCode).toBe(0);
+    },
+  );
 
   test.concurrent("bun audit still submits the skipped workspace's exclusive dependency", async () => {
     const { packageDir, full } = await verbatimTree(linker);

From 151394c6e30e6c030f837b333874c7f03d9d612f Mon Sep 17 00:00:00 2001
From: Alistair Smith <hi@alistair.sh>
Date: Mon, 17 Aug 2026 02:22:35 +0000
Subject: [PATCH 145/258] cli: load a package.json and name a lockfile load
 step from one place (#39165)

---
 mordant-baseline.toml                         |   2 -
 .../WorkspacePackageJSONCache.rs              |  28 +++-
 src/install/lockfile.rs                       |   3 +-
 src/runtime/cli/outdated_command.rs           |  24 +---
 src/runtime/cli/pack_command.rs               |  93 ++++++--------
 src/runtime/cli/package_manager_command.rs    |  13 +-
 src/runtime/cli/update_interactive_command.rs | 121 +++++++-----------
 test/cli/install/bun-lock.test.ts             |  55 ++++++++
 test/cli/install/bun-pack.test.ts             |  44 +++++++
 .../cli/install/bun-update-transitive.test.ts |  14 ++
 10 files changed, 227 insertions(+), 170 deletions(-)

diff --git a/mordant-baseline.toml b/mordant-baseline.toml
index 48dd1c9f19a4..0af560a0287b 100644
--- a/mordant-baseline.toml
+++ b/mordant-baseline.toml
@@ -39,8 +39,6 @@
 "field_valid_only_when:src/runtime/shell/builtin/rm.rs" = 1
 "reimplemented_helper:src/runtime/api/bun/Terminal.rs" = 1
 "reimplemented_helper:src/runtime/hw_exports.rs" = 1
-"same_match_twice:src/runtime/cli/pack_command.rs" = 1
-"same_match_twice:src/runtime/cli/update_interactive_command.rs" = 2
 "same_match_twice:src/runtime/webcore/Blob.rs" = 2
 "unchecked_construction:src/runtime/api/js_bundle_completion_task.rs" = 1
 "unchecked_construction:src/runtime/cli/pack_command.rs" = 2
diff --git a/src/install/PackageManager/WorkspacePackageJSONCache.rs b/src/install/PackageManager/WorkspacePackageJSONCache.rs
index 3ef125dddb95..cef56492e5fc 100644
--- a/src/install/PackageManager/WorkspacePackageJSONCache.rs
+++ b/src/install/PackageManager/WorkspacePackageJSONCache.rs
@@ -114,14 +114,36 @@ pub enum GetResult<'a> {
     ParseErr(Error),
 }
 
+/// The step of [`WorkspacePackageJSONCache::get_with_path`] that failed.
+#[derive(Clone, Copy, PartialEq, Eq)]
+pub enum GetStep {
+    Read,
+    Parse,
+}
+
+impl GetStep {
+    /// The word for the step in a "failed to ... package.json" message.
+    pub fn verb(self) -> &'static str {
+        match self {
+            GetStep::Read => "read",
+            GetStep::Parse => "parse",
+        }
+    }
+}
+
 impl<'a> GetResult<'a> {
-    pub(crate) fn unwrap(self) -> Result<&'a mut MapEntry, Error> {
+    /// The entry, or the step that failed and its error.
+    pub fn entry(self) -> Result<&'a mut MapEntry, (GetStep, Error)> {
         match self {
             GetResult::Entry(entry) => Ok(entry),
-            GetResult::ReadErr(err) => Err(err),
-            GetResult::ParseErr(err) => Err(err),
+            GetResult::ReadErr(err) => Err((GetStep::Read, err)),
+            GetResult::ParseErr(err) => Err((GetStep::Parse, err)),
         }
     }
+
+    pub(crate) fn unwrap(self) -> Result<&'a mut MapEntry, Error> {
+        self.entry().map_err(|(_, err)| err)
+    }
 }
 
 #[derive(Default)]
diff --git a/src/install/lockfile.rs b/src/install/lockfile.rs
index 35929a6216ac..8c8c3cd6dd4a 100644
--- a/src/install/lockfile.rs
+++ b/src/install/lockfile.rs
@@ -341,7 +341,8 @@ pub enum LoadStep {
 }
 
 impl LoadStep {
-    pub(crate) fn verb(self) -> &'static str {
+    /// The word for the step in a "failed to ... lockfile" message.
+    pub fn verb(self) -> &'static str {
         match self {
             LoadStep::OpenFile => "open",
             LoadStep::ReadFile => "read",
diff --git a/src/runtime/cli/outdated_command.rs b/src/runtime/cli/outdated_command.rs
index 87ab0f2f9b6b..5139875dd328 100644
--- a/src/runtime/cli/outdated_command.rs
+++ b/src/runtime/cli/outdated_command.rs
@@ -7,8 +7,8 @@ use bun_core::strings;
 use bun_core::{Global, Output};
 use bun_glob as glob;
 use bun_install::dependency::{self, Behavior};
+use bun_install::lockfile::LoadResult;
 use bun_install::lockfile::package::PackageColumns as _;
-use bun_install::lockfile::{LoadResult, LoadStep};
 use bun_install::package_manager::{
     LogLevel, ManifestLoad, Subcommand, WorkspaceFilter, populate_manifest_cache,
 };
@@ -118,24 +118,10 @@ impl OutdatedCommand {
                 if not_silent
                     && !bun_install::migration::reported_unsupported_lockfile_version(&cause)
                 {
-                    match cause.step {
-                        LoadStep::OpenFile => Output::err_generic(
-                            "failed to open lockfile: {s}",
-                            (cause.value.name(),),
-                        ),
-                        LoadStep::ParseFile => Output::err_generic(
-                            "failed to parse lockfile: {s}",
-                            (cause.value.name(),),
-                        ),
-                        LoadStep::ReadFile => Output::err_generic(
-                            "failed to read lockfile: {s}",
-                            (cause.value.name(),),
-                        ),
-                        LoadStep::Migrating => Output::err_generic(
-                            "failed to migrate lockfile: {s}",
-                            (cause.value.name(),),
-                        ),
-                    }
+                    Output::err_generic(
+                        "failed to {s} lockfile: {s}",
+                        (cause.step.verb(), cause.value.name()),
+                    );
                     if ctx.log_ref().has_errors() {
                         // SAFETY: `log_ptr` aliases `manager.log` which is the
                         // `*logger.Log` borrowed from `Command::Context`; no
diff --git a/src/runtime/cli/pack_command.rs b/src/runtime/cli/pack_command.rs
index 0d922e4e72e0..35f9d2cf9819 100644
--- a/src/runtime/cli/pack_command.rs
+++ b/src/runtime/cli/pack_command.rs
@@ -1857,46 +1857,54 @@ fn opt_pack_gzip_level(m: &PackageManager) -> Option<&[u8]> {
 // `Some` only when FOR_PUBLISH == true.
 pub(crate) type PackReturn<'a, const FOR_PUBLISH: bool> = Option<Publish::Context<'a, true>>;
 
-pub(crate) fn pack<const FOR_PUBLISH: bool>(
-    ctx: &mut Context<'_>,
+/// The package.json being packed, through the manager's cache; a package.json
+/// that cannot be read or parsed ends the command.
+///
+/// `workspace_package_json_cache` and `log` are disjoint fields on
+/// `PackageManager`; route through raw-pointer field projections so the two
+/// `&mut` borrows don't conflict.
+fn package_json_entry<'a>(
+    manager_ptr: *mut PackageManager,
     abs_package_json_path: &ZStr,
-) -> Result<PackReturn<'static, FOR_PUBLISH>, PackError<FOR_PUBLISH>> {
-    // Raw pointer for the `pm_workspace_cache`/`pm_log` disjoint-field
-    // projections and the `'static` lifetime extension when returning
-    // `Publish::Context`.
-    let manager_ptr: *mut PackageManager = &raw mut *ctx.manager;
-    let log_level = ctx.manager.options.log_level;
-    let bump = pack_bump();
-    // Note: `workspace_package_json_cache` and `log` are disjoint fields on
-    // `PackageManager`; route through raw-pointer field projections so the
-    // two `&mut` borrows don't conflict.
-    let mut json = match pm_workspace_cache(manager_ptr).get_with_path(
+) -> &'a mut WorkspacePackageJSONCache::MapEntry {
+    let result = pm_workspace_cache(manager_ptr).get_with_path(
         pm_log(manager_ptr),
         abs_package_json_path.as_bytes(),
         WorkspacePackageJSONCache::GetJSONOptions {
             guess_indentation: true,
             ..Default::default()
         },
-    ) {
-        WorkspacePackageJSONCache::GetResult::ReadErr(err) => {
-            Output::err(
-                err,
-                "failed to read package.json: {}",
-                format_args!("{}", bstr::BStr::new(abs_package_json_path.as_bytes())),
-            );
-            Global::crash();
-        }
-        WorkspacePackageJSONCache::GetResult::ParseErr(err) => {
+    );
+    match result.entry() {
+        Ok(entry) => entry,
+        Err((step, err)) => {
             Output::err(
                 err,
-                "failed to parse package.json: {}",
-                format_args!("{}", bstr::BStr::new(abs_package_json_path.as_bytes())),
+                "failed to {} package.json: {}",
+                (
+                    step.verb(),
+                    bstr::BStr::new(abs_package_json_path.as_bytes()),
+                ),
             );
-            let _ = pm_log(manager_ptr).print(std::ptr::from_mut(Output::error_writer()));
+            if step == WorkspacePackageJSONCache::GetStep::Parse {
+                let _ = pm_log(manager_ptr).print(std::ptr::from_mut(Output::error_writer()));
+            }
             Global::crash();
         }
-        WorkspacePackageJSONCache::GetResult::Entry(entry) => entry,
-    };
+    }
+}
+
+pub(crate) fn pack<const FOR_PUBLISH: bool>(
+    ctx: &mut Context<'_>,
+    abs_package_json_path: &ZStr,
+) -> Result<PackReturn<'static, FOR_PUBLISH>, PackError<FOR_PUBLISH>> {
+    // Raw pointer for the `pm_workspace_cache`/`pm_log` disjoint-field
+    // projections and the `'static` lifetime extension when returning
+    // `Publish::Context`.
+    let manager_ptr: *mut PackageManager = &raw mut *ctx.manager;
+    let log_level = ctx.manager.options.log_level;
+    let bump = pack_bump();
+    let mut json = package_json_entry(manager_ptr, abs_package_json_path);
 
     if FOR_PUBLISH {
         if let Some(config) = json.root.get(b"publishConfig") {
@@ -2134,34 +2142,7 @@ pub(crate) fn pack<const FOR_PUBLISH: bool>(
         let cache_key: &[u8] = abs_package_json_path.as_bytes();
         let _ = pm_workspace_cache(manager_ptr).map.remove(cache_key);
 
-        // Re-read package.json from disk
-        json = match pm_workspace_cache(manager_ptr).get_with_path(
-            pm_log(manager_ptr),
-            abs_package_json_path.as_bytes(),
-            WorkspacePackageJSONCache::GetJSONOptions {
-                guess_indentation: true,
-                ..Default::default()
-            },
-        ) {
-            WorkspacePackageJSONCache::GetResult::ReadErr(err) => {
-                Output::err(
-                    err,
-                    "failed to read package.json: {}",
-                    format_args!("{}", bstr::BStr::new(abs_package_json_path.as_bytes())),
-                );
-                Global::crash();
-            }
-            WorkspacePackageJSONCache::GetResult::ParseErr(err) => {
-                Output::err(
-                    err,
-                    "failed to parse package.json: {}",
-                    format_args!("{}", bstr::BStr::new(abs_package_json_path.as_bytes())),
-                );
-                let _ = pm_log(manager_ptr).print(std::ptr::from_mut(Output::error_writer()));
-                Global::crash();
-            }
-            WorkspacePackageJSONCache::GetResult::Entry(entry) => entry,
-        };
+        json = package_json_entry(manager_ptr, abs_package_json_path);
 
         // Re-validate private flag after scripts may have modified it.
         if FOR_PUBLISH {
diff --git a/src/runtime/cli/package_manager_command.rs b/src/runtime/cli/package_manager_command.rs
index eb9e993dc645..dbc3478fdd32 100644
--- a/src/runtime/cli/package_manager_command.rs
+++ b/src/runtime/cli/package_manager_command.rs
@@ -6,7 +6,7 @@ use bun_core::fmt::PathSep;
 use bun_core::strings;
 use bun_core::{Global, Output, env_var, fmt as bun_fmt};
 use bun_install::dependency::Dependency;
-use bun_install::lockfile::{LoadResult, LoadStep, Lockfile, package::PackageColumns as _, tree};
+use bun_install::lockfile::{LoadResult, Lockfile, package::PackageColumns as _, tree};
 use bun_install::npm as Npm;
 use bun_install::package_manager_real::{
     CommandLineArguments, Subcommand, fetch_cache_directory_path, get_cache_directory,
@@ -128,15 +128,6 @@ impl<'a> ByName<'a> {
     }
 }
 
-fn load_step_verb(step: LoadStep) -> &'static str {
-    match step {
-        LoadStep::OpenFile => "open",
-        LoadStep::ReadFile => "read",
-        LoadStep::ParseFile => "parse",
-        LoadStep::Migrating => "migrate",
-    }
-}
-
 pub(crate) struct PackageManagerCommand;
 
 impl PackageManagerCommand {
@@ -170,7 +161,7 @@ impl PackageManagerCommand {
                 if not_silent && !migration::reported_unsupported_lockfile_version(err) {
                     Output::err_generic(
                         "failed to {s} lockfile: {s}",
-                        (load_step_verb(err.step), err.value.name()),
+                        (err.step.verb(), err.value.name()),
                     );
                 }
                 Global::exit(1);
diff --git a/src/runtime/cli/update_interactive_command.rs b/src/runtime/cli/update_interactive_command.rs
index 5f08811bca64..f8a7ec4cd9fb 100644
--- a/src/runtime/cli/update_interactive_command.rs
+++ b/src/runtime/cli/update_interactive_command.rs
@@ -9,8 +9,8 @@ use bun_alloc::Arena as Bump;
 use bun_collections::{StringHashMap, index_sort};
 use bun_core::{Global, Output};
 use bun_install::dependency::{self, Behavior};
+use bun_install::lockfile::LoadResult;
 use bun_install::lockfile::package::PackageColumns as _;
-use bun_install::lockfile::{LoadResult, LoadStep};
 use bun_install::package_manager::options::Do;
 use bun_install::package_manager::{
     LogLevel, ManifestLoad, Subcommand, WorkspaceFilter, populate_manifest_cache,
@@ -19,8 +19,8 @@ use bun_install::package_manager::{
 use bun_install::package_manager_real::command_line_arguments::UpdateGroups;
 use bun_install::update_scope::selects;
 use bun_install::{
-    CommandLineArguments, GetJsonOptions, GetJsonResult, INVALID_PACKAGE_ID, PackageID,
-    PackageManager, WorkspacePackageJsonCacheEntry, resolution,
+    CommandLineArguments, GetJsonOptions, INVALID_PACKAGE_ID, PackageID, PackageManager,
+    WorkspacePackageJsonCacheEntry, resolution,
 };
 use bun_install_types::DependencyGroup;
 use bun_js_printer::{self as js_printer, BufferPrinter, BufferWriter, PrintJsonOptions};
@@ -181,6 +181,36 @@ impl UpdateInteractiveCommand {
         }
     }
 
+    /// A workspace's package.json through the manager's cache. One that cannot
+    /// be read or parsed is reported and returns `None`, so the caller skips
+    /// that workspace and carries on with the others.
+    fn load_package_json<'m>(
+        manager: &'m mut PackageManager,
+        package_json_path: &[u8],
+    ) -> Option<&'m mut WorkspacePackageJsonCacheEntry> {
+        // `log_mut()` returns a borrow decoupled from `&self`, so it can
+        // overlap the `workspace_package_json_cache` field borrow.
+        let log = manager.log_mut();
+        let result = manager.workspace_package_json_cache.get_with_path(
+            log,
+            package_json_path,
+            GetJsonOptions {
+                guess_indentation: true,
+                ..Default::default()
+            },
+        );
+        match result.entry() {
+            Ok(entry) => Some(entry),
+            Err((step, err)) => {
+                Output::err_generic(
+                    "Failed to {s} package.json at {s}: {s}",
+                    (step.verb(), BStr::new(package_json_path), err.name()),
+                );
+                None
+            }
+        }
+    }
+
     // Helper to update a catalog entry at a specific path in the package.json AST
     // No `*PackageManager` parameter: there is no per-manager allocator,
     // and dropping it avoids overlapping `&mut PackageManager` with the live
@@ -334,36 +364,9 @@ impl UpdateInteractiveCommand {
             let package_json_path =
                 Self::build_package_json_path(root_dir, workspace_path, &mut path_buf);
 
-            // Load and parse the package.json
-            // Reshaped for borrowck — `log_mut()` returns a borrow
-            // decoupled from `&self`, so it can overlap the disjoint
-            // `workspace_package_json_cache` field borrow below.
-            let log = manager.log_mut();
-            let package_json: &mut WorkspacePackageJsonCacheEntry =
-                match manager.workspace_package_json_cache.get_with_path(
-                    log,
-                    package_json_path,
-                    GetJsonOptions {
-                        guess_indentation: true,
-                        ..Default::default()
-                    },
-                ) {
-                    GetJsonResult::ParseErr(err) => {
-                        Output::err_generic(
-                            "Failed to parse package.json at {s}: {s}",
-                            (BStr::new(package_json_path), err.name()),
-                        );
-                        continue;
-                    }
-                    GetJsonResult::ReadErr(err) => {
-                        Output::err_generic(
-                            "Failed to read package.json at {s}: {s}",
-                            (BStr::new(package_json_path), err.name()),
-                        );
-                        continue;
-                    }
-                    GetJsonResult::Entry(entry) => entry,
-                };
+            let Some(package_json) = Self::load_package_json(manager, package_json_path) else {
+                continue;
+            };
 
             let mut modified = false;
 
@@ -464,33 +467,9 @@ impl UpdateInteractiveCommand {
             let package_json_path =
                 Self::build_package_json_path(root_dir, workspace_path, &mut path_buf);
 
-            // Load and parse the package.json properly
-            let log = manager.log_mut();
-            let package_json: &mut WorkspacePackageJsonCacheEntry =
-                match manager.workspace_package_json_cache.get_with_path(
-                    log,
-                    package_json_path,
-                    GetJsonOptions {
-                        guess_indentation: true,
-                        ..Default::default()
-                    },
-                ) {
-                    GetJsonResult::ParseErr(err) => {
-                        Output::err_generic(
-                            "Failed to parse package.json at {s}: {s}",
-                            (BStr::new(package_json_path), err.name()),
-                        );
-                        continue;
-                    }
-                    GetJsonResult::ReadErr(err) => {
-                        Output::err_generic(
-                            "Failed to read package.json at {s}: {s}",
-                            (BStr::new(package_json_path), err.name()),
-                        );
-                        continue;
-                    }
-                    GetJsonResult::Entry(entry) => entry,
-                };
+            let Some(package_json) = Self::load_package_json(manager, package_json_path) else {
+                continue;
+            };
 
             edit_catalog_definitions(
                 &mut updates_for_workspace[..],
@@ -527,24 +506,10 @@ impl UpdateInteractiveCommand {
                 if not_silent
                     && !bun_install::migration::reported_unsupported_lockfile_version(&cause)
                 {
-                    match cause.step {
-                        LoadStep::OpenFile => Output::err_generic(
-                            "failed to open lockfile: {s}",
-                            (cause.value.name(),),
-                        ),
-                        LoadStep::ParseFile => Output::err_generic(
-                            "failed to parse lockfile: {s}",
-                            (cause.value.name(),),
-                        ),
-                        LoadStep::ReadFile => Output::err_generic(
-                            "failed to read lockfile: {s}",
-                            (cause.value.name(),),
-                        ),
-                        LoadStep::Migrating => Output::err_generic(
-                            "failed to migrate lockfile: {s}",
-                            (cause.value.name(),),
-                        ),
-                    }
+                    Output::err_generic(
+                        "failed to {s} lockfile: {s}",
+                        (cause.step.verb(), cause.value.name()),
+                    );
                     // SAFETY: `ctx.log` is set by `Command::create_context_data`
                     // for every subcommand and is non-null for the command's
                     // lifetime.
diff --git a/test/cli/install/bun-lock.test.ts b/test/cli/install/bun-lock.test.ts
index cee3f4065d46..32db4a3fdfca 100644
--- a/test/cli/install/bun-lock.test.ts
+++ b/test/cli/install/bun-lock.test.ts
@@ -1400,6 +1400,61 @@ describe.concurrent("hand-edited bun.lock that lists workspaces but has no packa
   });
 });
 
+// The commands that only read the lockfile name the step that failed and stop, without touching the registry.
+describe.concurrent("a bun.lock that does not parse", () => {
+  const projectFiles = {
+    "package.json": JSON.stringify({ name: "unparsable-lockfile", dependencies: { "no-deps": "1.0.0" } }),
+    "bun.lock": "this is not a lockfile\n",
+  };
+
+  async function run(prefix: string, ...args: string[]) {
+    using dir = tempDir(prefix, projectFiles);
+    await using proc = spawn({
+      cmd: [bunExe(), ...args],
+      cwd: String(dir),
+      env,
+      stdin: "ignore",
+      stdout: "pipe",
+      stderr: "pipe",
+    });
+    const [out, err, exitCode] = await Promise.all([proc.stdout.text(), proc.stderr.text(), proc.exited]);
+    return { out: normalizeBunSnapshot(out, String(dir)), err: normalizeBunSnapshot(err, String(dir)), exitCode };
+  }
+
+  it("bun outdated", async () => {
+    const { out, err, exitCode } = await run("unparsable-lockfile-outdated", "outdated");
+    expect(err).toMatchInlineSnapshot(`
+      "1 | this is not a lockfile
+          ^
+      error: Unexpected this
+          at bun.lock:1:1
+      error: failed to parse lockfile: ParserError"
+    `);
+    expect(out).toMatchInlineSnapshot(`"bun outdated <version> (<revision>)"`);
+    expect(exitCode).toBe(1);
+  });
+
+  it("bun update --interactive", async () => {
+    const { out, err, exitCode } = await run("unparsable-lockfile-update-interactive", "update", "--interactive");
+    expect(err).toMatchInlineSnapshot(`
+      "1 | this is not a lockfile
+          ^
+      error: Unexpected this
+          at bun.lock:1:1
+      error: failed to parse lockfile: ParserError"
+    `);
+    expect(out).toMatchInlineSnapshot(`"bun update --interactive <version> (<revision>)"`);
+    expect(exitCode).toBe(1);
+  });
+
+  it("bun pm ls", async () => {
+    const { out, err, exitCode } = await run("unparsable-lockfile-pm-ls", "pm", "ls");
+    expect(err).toMatchInlineSnapshot(`"error: failed to parse lockfile: ParserError"`);
+    expect(out).toMatchInlineSnapshot(`""`);
+    expect(exitCode).toBe(1);
+  });
+});
+
 const makeInstallRunner = (cwd: string) => async (args: string[]) => {
   await using proc = spawn({
     cmd: [bunExe(), ...args],
diff --git a/test/cli/install/bun-pack.test.ts b/test/cli/install/bun-pack.test.ts
index 169e7868e3d3..1120351c422a 100644
--- a/test/cli/install/bun-pack.test.ts
+++ b/test/cli/install/bun-pack.test.ts
@@ -1062,6 +1062,50 @@ test("lifecycle script modifying version updates tarball filename (#17195)", asy
   ]);
 });
 
+describe.concurrent("package.json that cannot be loaded", () => {
+  test("unparsable package.json", async () => {
+    using dir = tempDir("pack-unparsable-package-json", {
+      "package.json": `{ "name": "pack-unparsable", "version": "1.0.0",`,
+    });
+
+    const { err } = await packExpectError(String(dir), bunEnv);
+    // the parser's own diagnostic is printed along with the error
+    expect(err).toMatch(/at .*package\.json:1:\d+/);
+    expect(err).toMatch(/^ParserError: failed to parse package\.json: .*package\.json$/m);
+  });
+
+  test("prepack script removes package.json before it is re-read", async () => {
+    using dir = tempDir("pack-prepack-removes-package-json", {
+      "package.json": JSON.stringify({
+        name: "pack-prepack-removes",
+        version: "1.0.0",
+        scripts: { prepack: `${bunExe()} remove.js` },
+      }),
+      "remove.js": `require("fs").unlinkSync("package.json");`,
+    });
+
+    const { err } = await packExpectError(String(dir), bunEnv);
+    expect(err).toMatch(/^ENOENT: failed to read package\.json: .*package\.json$/m);
+    expect(await exists(join(String(dir), "pack-prepack-removes-1.0.0.tgz"))).toBeFalse();
+  });
+
+  test("prepack script leaves package.json unparsable before it is re-read", async () => {
+    using dir = tempDir("pack-prepack-breaks-package-json", {
+      "package.json": JSON.stringify({
+        name: "pack-prepack-breaks",
+        version: "1.0.0",
+        scripts: { prepack: `${bunExe()} break.js` },
+      }),
+      "break.js": `require("fs").writeFileSync("package.json", "{ broken\\n");`,
+    });
+
+    const { err } = await packExpectError(String(dir), bunEnv);
+    expect(err).toMatch(/at .*package\.json:1:\d+/);
+    expect(err).toMatch(/^ParserError: failed to parse package\.json: .*package\.json$/m);
+    expect(await exists(join(String(dir), "pack-prepack-breaks-1.0.0.tgz"))).toBeFalse();
+  });
+});
+
 describe("bundledDependnecies", () => {
   for (const bundledDependencies of ["bundledDependencies", "bundleDependencies"]) {
     test(`basic (${bundledDependencies})`, async () => {
diff --git a/test/cli/install/bun-update-transitive.test.ts b/test/cli/install/bun-update-transitive.test.ts
index 0fc3236993e2..a26369b14d1f 100644
--- a/test/cli/install/bun-update-transitive.test.ts
+++ b/test/cli/install/bun-update-transitive.test.ts
@@ -3390,3 +3390,17 @@ test.concurrent("`bun update -i -r` installs the version a workspace member's pe
   await frozen(dir);
   expect(exitCode).toBe(0);
 });
+
+// A member whose package.json no longer parses is reported and skipped; the other members are still written.
+test.concurrent(
+  "`bun update -i -r` reports a member whose package.json cannot be parsed and still updates the rest",
+  async () => {
+    const { dir } = await staleMembers("~1.0.0", "~1.0.0");
+    await write(join(dir, "packages/pkg2/package.json"), "{ broken\n");
+    const { stderr, exitCode } = await runInteractive(dir, "a\r", "-r");
+    expect(stderr).toMatch(/^error: Failed to parse package\.json at .*pkg2[\\/]package\.json: ParserError$/m);
+    expect(await packageJsonOf(dir, "packages/pkg1")).toStrictEqual(member("pkg1", { "no-deps": "~1.0.1" }));
+    expect(await packageJsonText(dir, "packages/pkg2")).toBe("{ broken\n");
+    expect(exitCode).toBe(1);
+  },
+);

From 59d04650990e703c3c2563a0841f4aa6799eb7a8 Mon Sep 17 00:00:00 2001
From: robobun <117481402+robobun@users.noreply.github.com>
Date: Mon, 17 Aug 2026 02:22:40 +0000
Subject: [PATCH 146/258] install: warn when a registry manifest advertises an
 integrity hash bun cannot use (#38484)

---
 mordant-baseline.toml                         |   1 -
 src/install/npm.rs                            |  32 +++++-
 .../bun-install-tarball-integrity.test.ts     | 100 +++++++++++++++++-
 3 files changed, 123 insertions(+), 10 deletions(-)

diff --git a/mordant-baseline.toml b/mordant-baseline.toml
index 0af560a0287b..5f1ced1a8e9b 100644
--- a/mordant-baseline.toml
+++ b/mordant-baseline.toml
@@ -10,7 +10,6 @@
 [bun_css]
 
 [bun_install]
-"defaulted_failure:src/install/npm.rs" = 1
 "interchangeable_aliases:src/install/lockfile/Tree.rs" = 1
 
 [bun_js_parser]
diff --git a/src/install/npm.rs b/src/install/npm.rs
index e86fcc837a3a..e63fda1da3e0 100644
--- a/src/install/npm.rs
+++ b/src/install/npm.rs
@@ -2707,16 +2707,40 @@ impl PackageManifest {
                             package_version.unpacked_size = n.value() as u32;
                         }
 
-                        if let Some(shasum_str) = dist.get(b"integrity").and_then(|v| v.as_str()) {
-                            package_version.integrity = Integrity::parse(shasum_str);
+                        let integrity_str = dist
+                            .get(b"integrity")
+                            .and_then(|v| v.as_str())
+                            .unwrap_or(b"");
+                        if !integrity_str.is_empty() {
+                            package_version.integrity = Integrity::parse(integrity_str);
                             if package_version.integrity.tag.is_supported() {
                                 break 'integrity;
                             }
                         }
 
+                        let mut malformed_shasum = false;
                         if let Some(shasum_str) = dist.get(b"shasum").and_then(|v| v.as_str()) {
-                            package_version.integrity =
-                                Integrity::parse_sha_sum(shasum_str).unwrap_or_default();
+                            match Integrity::parse_sha_sum(shasum_str) {
+                                Ok(integrity) => {
+                                    package_version.integrity = integrity;
+                                    if integrity.tag.is_supported() {
+                                        break 'integrity;
+                                    }
+                                }
+                                Err(_) => malformed_shasum = true,
+                            }
+                        }
+
+                        if !integrity_str.is_empty() || malformed_shasum {
+                            log.add_warning_fmt(
+                                None,
+                                bun_ast::Loc::EMPTY,
+                                format_args!(
+                                    "Unsupported or malformed integrity hash in registry metadata for {}@{}; its tarball will not be verified",
+                                    bstr::BStr::new(expected_name),
+                                    bstr::BStr::new(version_name),
+                                ),
+                            );
                         }
                     }
                 }
diff --git a/test/cli/install/bun-install-tarball-integrity.test.ts b/test/cli/install/bun-install-tarball-integrity.test.ts
index ed7bb622b99c..8776d1730f95 100644
--- a/test/cli/install/bun-install-tarball-integrity.test.ts
+++ b/test/cli/install/bun-install-tarball-integrity.test.ts
@@ -747,9 +747,11 @@ describe.concurrent("tarball integrity metadata forms", () => {
       tgz,
       sha512: "sha512-" + createHash("sha512").update(tgz).digest("base64"),
       sha384: "sha384-" + createHash("sha384").update(tgz).digest("base64"),
+      sha1: "sha1-" + createHash("sha1").update(tgz).digest("base64"),
+      shasum: createHash("sha1").update(tgz).digest("hex"),
     };
   }
-  function serveManifest(integrity: string, tgz: Buffer) {
+  function serveManifest(dist: { integrity?: string; shasum?: string }, tgz: Buffer) {
     const server = Bun.serve({
       port: 0,
       hostname: "127.0.0.1",
@@ -764,7 +766,7 @@ describe.concurrent("tarball integrity metadata forms", () => {
                 name: "pkg",
                 version: "1.0.0",
                 dist: {
-                  integrity,
+                  ...dist,
                   tarball: `http://127.0.0.1:${server.port}/pkg/-/pkg-1.0.0.tgz`,
                 },
               },
@@ -798,7 +800,7 @@ describe.concurrent("tarball integrity metadata forms", () => {
     const real = buildTarball(Buffer.from('{"name":"pkg","version":"1.0.0"}\n'));
     const other = buildTarball(Buffer.from('{"name":"other","version":"9.9.9"}\n'));
 
-    await using server = serveManifest(`${other.sha512} ${real.sha384}`, real.tgz);
+    await using server = serveManifest({ integrity: `${other.sha512} ${real.sha384}` }, real.tgz);
     using dir = projectDir("integrity-multi-hash", server.port);
 
     await using proc = spawn({
@@ -818,7 +820,7 @@ describe.concurrent("tarball integrity metadata forms", () => {
     const real = buildTarball(Buffer.from('{"name":"pkg","version":"1.0.0"}\n'));
     const other = buildTarball(Buffer.from('{"name":"other","version":"9.9.9"}\n'));
 
-    await using server = serveManifest(`${real.sha512} ${other.sha384}`, real.tgz);
+    await using server = serveManifest({ integrity: `${real.sha512} ${other.sha384}` }, real.tgz);
     using dir = projectDir("integrity-multi-hash-lock", server.port);
 
     await using proc = spawn({
@@ -841,7 +843,7 @@ describe.concurrent("tarball integrity metadata forms", () => {
     const real = buildTarball(Buffer.from('{"name":"pkg","version":"1.0.0"}\n'));
     const other = buildTarball(Buffer.from('{"name":"other","version":"9.9.9"}\n'));
 
-    await using server = serveManifest(`${other.sha512}?vcs=git`, real.tgz);
+    await using server = serveManifest({ integrity: `${other.sha512}?vcs=git` }, real.tgz);
     using dir = projectDir("integrity-option-suffix", server.port);
 
     await using proc = spawn({
@@ -924,6 +926,94 @@ describe.concurrent("tarball integrity metadata forms", () => {
     expect(stdout).not.toContain("1 package installed");
     expect(exitCode).not.toBe(0);
   });
+
+  it("verifies the tarball against the manifest shasum when there is no integrity field", async () => {
+    const real = buildTarball(Buffer.from('{"name":"pkg","version":"1.0.0"}\n'));
+    const other = buildTarball(Buffer.from('{"name":"other","version":"9.9.9"}\n'));
+
+    await using server = serveManifest({ shasum: other.shasum }, real.tgz);
+    using dir = projectDir("integrity-shasum-mismatch", server.port);
+
+    await using proc = spawn({
+      cmd: [bunExe(), "install"],
+      cwd: String(dir),
+      env: { ...env, BUN_INSTALL_CACHE_DIR: join(String(dir), ".cache") },
+      stdout: "pipe",
+      stderr: "pipe",
+    });
+    const [stderr, stdout, exitCode] = await Promise.all([proc.stderr.text(), proc.stdout.text(), proc.exited]);
+    expect(stderr).not.toContain("Unsupported or malformed integrity hash");
+    expect(stderr + stdout).toContain("Integrity check failed");
+    expect(stdout).not.toContain("1 package installed");
+    expect(exitCode).not.toBe(0);
+  });
+
+  it("falls back to the manifest shasum when the integrity field is unusable, without warning", async () => {
+    const real = buildTarball(Buffer.from('{"name":"pkg","version":"1.0.0"}\n'));
+
+    await using server = serveManifest({ integrity: "md5-AAAAAAAAAAAAAAAAAAAAAA==", shasum: real.shasum }, real.tgz);
+    using dir = projectDir("integrity-shasum-fallback", server.port);
+
+    await using proc = spawn({
+      cmd: [bunExe(), "install", "--save-text-lockfile"],
+      cwd: String(dir),
+      env: { ...env, BUN_INSTALL_CACHE_DIR: join(String(dir), ".cache") },
+      stdout: "pipe",
+      stderr: "pipe",
+    });
+    const [stderr, stdout, exitCode] = await Promise.all([proc.stderr.text(), proc.stdout.text(), proc.exited]);
+    expect(stderr).not.toContain("Unsupported or malformed integrity hash");
+    expect(stdout).toContain("1 package installed");
+    expect(await file(join(String(dir), "bun.lock")).text()).toContain(real.sha1);
+    expect(exitCode).toBe(0);
+  });
+
+  it.each([
+    // Same length as a sha1 hex digest, but not hex.
+    ["malformed shasum", { shasum: Buffer.alloc(40, "x").toString() }],
+    ["unsupported integrity algorithm", { integrity: "md5-AAAAAAAAAAAAAAAAAAAAAA==" }],
+    ["malformed integrity and empty shasum", { integrity: "sha512-!!!", shasum: "" }],
+  ] as const)("warns instead of silently skipping verification: %s", async (_label, dist) => {
+    const real = buildTarball(Buffer.from('{"name":"pkg","version":"1.0.0"}\n'));
+
+    await using server = serveManifest(dist, real.tgz);
+    using dir = projectDir("integrity-unusable", server.port);
+
+    await using proc = spawn({
+      cmd: [bunExe(), "install", "--save-text-lockfile"],
+      cwd: String(dir),
+      env: { ...env, BUN_INSTALL_CACHE_DIR: join(String(dir), ".cache") },
+      stdout: "pipe",
+      stderr: "pipe",
+    });
+    const [stderr, stdout, exitCode] = await Promise.all([proc.stderr.text(), proc.stdout.text(), proc.exited]);
+    expect(stderr).toContain(
+      "warn: Unsupported or malformed integrity hash in registry metadata for pkg@1.0.0; its tarball will not be verified",
+    );
+    expect(stdout).toContain("1 package installed");
+    // Nothing usable was advertised, so the lockfile carries no pin for it.
+    expect(await file(join(String(dir), "bun.lock")).text()).not.toMatch(/sha\d+-/);
+    expect(exitCode).toBe(0);
+  });
+
+  it("stays quiet when the manifest advertises no hash at all", async () => {
+    const real = buildTarball(Buffer.from('{"name":"pkg","version":"1.0.0"}\n'));
+
+    await using server = serveManifest({}, real.tgz);
+    using dir = projectDir("integrity-absent", server.port);
+
+    await using proc = spawn({
+      cmd: [bunExe(), "install"],
+      cwd: String(dir),
+      env: { ...env, BUN_INSTALL_CACHE_DIR: join(String(dir), ".cache") },
+      stdout: "pipe",
+      stderr: "pipe",
+    });
+    const [stderr, stdout, exitCode] = await Promise.all([proc.stderr.text(), proc.stdout.text(), proc.exited]);
+    expect(stderr).not.toContain("Unsupported or malformed integrity hash");
+    expect(stdout).toContain("1 package installed");
+    expect(exitCode).toBe(0);
+  });
 });
 
 describe.concurrent.each(["hoisted", "isolated"] as const)("tarball download failure (%s)", linker => {

From cfc2fbdc9afa7e53529831bdfd8fea53b19ceac5 Mon Sep 17 00:00:00 2001
From: robobun <117481402+robobun@users.noreply.github.com>
Date: Mon, 17 Aug 2026 02:23:15 +0000
Subject: [PATCH 147/258] install: describe the real --save default in bun link
 and bun unlink --help (#38915)

---
 completions/bun-cli.json                      | 10 +-
 docs/pm/cli/link.mdx                          |  6 +-
 docs/snippets/cli/link.mdx                    |  4 +-
 .../PackageManager/CommandLineArguments.rs    | 43 +++++++--
 test/cli/bun.test.ts                          | 10 ++
 test/cli/install/bun-link.test.ts             | 96 +++++++++++++++++++
 6 files changed, 153 insertions(+), 16 deletions(-)

diff --git a/completions/bun-cli.json b/completions/bun-cli.json
index 8b0d12dc057f..ddb896e42d6b 100644
--- a/completions/bun-cli.json
+++ b/completions/bun-cli.json
@@ -2308,14 +2308,14 @@
         },
         {
           "name": "no-save",
-          "description": "Don't update package.json or save a lockfile",
+          "description": "Don't update package.json or save a lockfile (the default)",
           "hasValue": false,
           "required": false,
           "multiple": false
         },
         {
           "name": "save",
-          "description": "Save to package.json (true by default)",
+          "description": "Update package.json and save a lockfile (false by default)",
           "hasValue": false,
           "required": false,
           "multiple": false
@@ -2531,7 +2531,7 @@
           "completionType": "package"
         }
       ],
-      "examples": ["bun link", "bun link <package>"],
+      "examples": ["bun link", "bun link <package>", "bun link --save <package>"],
       "usage": "Usage: bun link [flags] [<packages>]",
       "documentationUrl": "https://bun.com/docs/cli/link.",
       "dynamicCompletions": {}
@@ -2567,14 +2567,14 @@
         },
         {
           "name": "no-save",
-          "description": "Don't update package.json or save a lockfile",
+          "description": "Don't update package.json or save a lockfile (the default)",
           "hasValue": false,
           "required": false,
           "multiple": false
         },
         {
           "name": "save",
-          "description": "Save to package.json (true by default)",
+          "description": "Update package.json and save a lockfile (false by default)",
           "hasValue": false,
           "required": false,
           "multiple": false
diff --git a/docs/pm/cli/link.mdx b/docs/pm/cli/link.mdx
index 246b17275992..9f0d5d1040b7 100644
--- a/docs/pm/cli/link.mdx
+++ b/docs/pm/cli/link.mdx
@@ -31,7 +31,11 @@ cd /path/to/my-app
 bun link cool-pkg
 ```
 
-The `--save` flag also adds `cool-pkg` to the `dependencies` field of your app's package.json, with a version specifier that tells Bun to load from the registered local directory instead of installing from `npm`:
+Pass `--save` to also add `cool-pkg` to the `dependencies` field of your app's package.json, with a version specifier that tells Bun to load from the registered local directory instead of installing from `npm`:
+
+```bash terminal icon="terminal"
+bun link --save cool-pkg
+```
 
 ```json package.json icon="file-json"
 {
diff --git a/docs/snippets/cli/link.mdx b/docs/snippets/cli/link.mdx
index 87222e86fd75..e4ef4cd119a3 100644
--- a/docs/snippets/cli/link.mdx
+++ b/docs/snippets/cli/link.mdx
@@ -39,11 +39,11 @@ bun link <packages>
 </ParamField>
 
 <ParamField path="--no-save" type="boolean">
-  Has no effect. <code>bun link</code> updates <code>package.json</code> and the lockfile only with <code>--save</code>
+  Don't update <code>package.json</code> or save a lockfile (the default)
 </ParamField>
 
 <ParamField path="--save" type="boolean">
-  Save to <code>package.json</code>
+  Update <code>package.json</code> and save a lockfile (false by default)
 </ParamField>
 
 <ParamField path="--trust" type="boolean">
diff --git a/src/install/PackageManager/CommandLineArguments.rs b/src/install/PackageManager/CommandLineArguments.rs
index c0f526223e2e..e15a48d9c98f 100644
--- a/src/install/PackageManager/CommandLineArguments.rs
+++ b/src/install/PackageManager/CommandLineArguments.rs
@@ -69,11 +69,24 @@ const PRODUCTION_PARAMS: &[ParamType] = &[
     clap::param!("-P, --prod"),
 ];
 
-const SHARED_TAIL_PARAMS: &[ParamType] = &[
+const SAVE_PARAMS: &[ParamType] = &[
     clap::param!(
         "--no-save                             Don't update package.json or save a lockfile"
     ),
     clap::param!("--save                                Save to package.json (true by default)"),
+];
+
+// `parse` gives link and unlink the opposite default: they only save when --save is passed.
+const LINK_SAVE_PARAMS: &[ParamType] = &[
+    clap::param!(
+        "--no-save                             Don't update package.json or save a lockfile (the default)"
+    ),
+    clap::param!(
+        "--save                                Update package.json and save a lockfile (false by default)"
+    ),
+];
+
+const SHARED_TAIL_PARAMS: &[ParamType] = &[
     clap::param!(
         "--ca <STR>...                         Provide a Certificate Authority signing certificate"
     ),
@@ -135,8 +148,19 @@ const SHARED_TAIL_PARAMS: &[ParamType] = &[
     clap::param!("-h, --help                            Print this help menu"),
 ];
 
-const SHARED_PARAMS: &[ParamType] =
-    concat_params![SHARED_HEAD_PARAMS, PRODUCTION_PARAMS, SHARED_TAIL_PARAMS];
+const SHARED_PARAMS: &[ParamType] = concat_params![
+    SHARED_HEAD_PARAMS,
+    PRODUCTION_PARAMS,
+    SAVE_PARAMS,
+    SHARED_TAIL_PARAMS
+];
+
+const LINK_SHARED_PARAMS: &[ParamType] = concat_params![
+    SHARED_HEAD_PARAMS,
+    PRODUCTION_PARAMS,
+    LINK_SAVE_PARAMS,
+    SHARED_TAIL_PARAMS
+];
 
 pub(crate) static INSTALL_PARAMS: &[ParamType] = concat_params![
     SHARED_PARAMS,
@@ -172,6 +196,7 @@ pub(crate) static UPDATE_PARAMS: &[ParamType] = concat_params![
         ),
         clap::param!("-P, --prod"),
     ],
+    SAVE_PARAMS,
     SHARED_TAIL_PARAMS,
     &[
         clap::param!(
@@ -276,14 +301,14 @@ pub(crate) static REMOVE_PARAMS: &[ParamType] = concat_params![
 ];
 
 pub(crate) static LINK_PARAMS: &[ParamType] = concat_params![
-    SHARED_PARAMS,
+    LINK_SHARED_PARAMS,
     &[clap::param!(
         "<POS> ...                         \"name\" install package as a link"
     ),]
 ];
 
 pub(crate) static UNLINK_PARAMS: &[ParamType] = concat_params![
-    SHARED_PARAMS,
+    LINK_SHARED_PARAMS,
     &[clap::param!(
         "<POS> ...                         \"name\" uninstall package as a link"
     ),]
@@ -943,9 +968,12 @@ Full documentation is available at <magenta>https://bun.com/docs/cli/remove<r>.
   <d>Directory should contain a package.json.<r>
   <b><green>bun link<r>
 
-  <d>Add a previously-registered linkable package as a dependency of the current project.<r>
+  <d>Link a previously-registered linkable package into the current project's node_modules.<r>
   <b><green>bun link<r> <blue>\<package\><r>
 
+  <d>Also add it to the current project's package.json as a link: dependency.<r>
+  <b><green>bun link<r> <cyan>--save<r> <blue>\<package\><r>
+
 Full documentation is available at <magenta>https://bun.com/docs/cli/link<r>.
 ";
                 pretty_help(intro_text);
@@ -1458,8 +1486,7 @@ Full documentation is available at <magenta>https://bun.com/docs/pm/cli/prune<r>
             cli.tolerate_republish = args.flag(b"--tolerate-republish");
         }
 
-        // link and unlink default to not saving, all others default to
-        // saving.
+        // link and unlink default to not saving (see `LINK_SAVE_PARAMS`), all others to saving.
         if matches!(subcommand, Subcommand::Link | Subcommand::Unlink) {
             cli.no_save = !args.flag(b"--save");
         } else {
diff --git a/test/cli/bun.test.ts b/test/cli/bun.test.ts
index 94ed7fb0203c..b8f0d0e3ec44 100644
--- a/test/cli/bun.test.ts
+++ b/test/cli/bun.test.ts
@@ -271,6 +271,16 @@ describe("bun", () => {
           /^ {2}Add to the workspace catalog instead of pinning a version\n {2}bun add --catalog react\n {2}bun add --catalog=testing vitest$/m,
         ],
       ],
+      // The bare form only installs the symlink; package.json is written with --save (see the --save
+      // flag row), so the examples must say which form does what.
+      [
+        "bun link --help",
+        ["link"],
+        [
+          /^ {2}Link a previously-registered linkable package into the current project's node_modules\.\n {2}bun link <package>$/m,
+          /^ {2}Also add it to the current project's package\.json as a link: dependency\.\n {2}bun link --save <package>$/m,
+        ],
+      ],
       [
         "bun audit --help",
         ["audit"],
diff --git a/test/cli/install/bun-link.test.ts b/test/cli/install/bun-link.test.ts
index 0863bf41d813..e3ff82c2bbf6 100644
--- a/test/cli/install/bun-link.test.ts
+++ b/test/cli/install/bun-link.test.ts
@@ -7,6 +7,7 @@ import {
   isWindows,
   readdirSorted,
   runBunInstall,
+  tempDir,
   tmpdirSync,
   toBeValidBin,
   toHaveBins,
@@ -557,3 +558,98 @@ describe("link: specifier longer than the path buffers", () => {
     expect(exitCode).toBe(1);
   });
 });
+
+// The install family shares one flag table, but `bun link <package>` and `bun unlink` invert the
+// --save default (CommandLineArguments.parse): they only touch package.json and the lockfile when
+// --save is passed, so their --help has to describe the flag differently from bun install's.
+it.each([
+  ["install", "Save to package.json (true by default)", "Don't update package.json or save a lockfile"],
+  ["add", "Save to package.json (true by default)", "Don't update package.json or save a lockfile"],
+  ["update", "Save to package.json (true by default)", "Don't update package.json or save a lockfile"],
+  ["remove", "Save to package.json (true by default)", "Don't update package.json or save a lockfile"],
+  [
+    "link",
+    "Update package.json and save a lockfile (false by default)",
+    "Don't update package.json or save a lockfile (the default)",
+  ],
+  [
+    "unlink",
+    "Update package.json and save a lockfile (false by default)",
+    "Don't update package.json or save a lockfile (the default)",
+  ],
+])("bun %s --help describes the --save default it actually has", async (subcommand, save, noSave) => {
+  await using proc = spawn({
+    cmd: [bunExe(), subcommand, "--help"],
+    env,
+    stdout: "pipe",
+    stderr: "pipe",
+  });
+  const [stdout, stderr, exitCode] = await Promise.all([proc.stdout.text(), proc.stderr.text(), proc.exited]);
+
+  const lines = stdout.split(/\r?\n/).map(line => line.trim());
+  const descriptionOf = (flag: string) =>
+    lines
+      .find(line => line.startsWith(`${flag} `))
+      ?.slice(flag.length)
+      .trim();
+  expect({ "--save": descriptionOf("--save"), "--no-save": descriptionOf("--no-save"), stderr, exitCode }).toEqual({
+    "--save": save,
+    "--no-save": noSave,
+    stderr: "",
+    exitCode: 0,
+  });
+});
+
+it("bun link <package> only writes package.json and a lockfile when --save is passed", async () => {
+  const appPackageJson = JSON.stringify({ name: "app", version: "1.0.0" });
+  using dir = tempDir("bun-link-save", {
+    "lib/package.json": JSON.stringify({ name: "lib-to-link", version: "1.0.0" }),
+    "app/package.json": appPackageJson,
+  });
+  const app = join(String(dir), "app");
+  // Register the package in a global dir private to this test instead of the machine's real one.
+  const linkEnv = {
+    ...env,
+    BUN_INSTALL_GLOBAL_DIR: join(String(dir), "global", "install", "global"),
+    BUN_INSTALL_BIN: join(String(dir), "global", "bin"),
+  };
+  async function bun(cwd: string, ...args: string[]) {
+    await using proc = spawn({
+      cmd: [bunExe(), ...args],
+      cwd,
+      env: linkEnv,
+      stdin: "ignore",
+      stdout: "pipe",
+      stderr: "pipe",
+    });
+    const [stdout, stderr, exitCode] = await Promise.all([proc.stdout.text(), proc.stderr.text(), proc.exited]);
+    return { stdout, stderr, exitCode };
+  }
+
+  let { stdout, stderr, exitCode } = await bun(join(String(dir), "lib"), "link");
+  expect(stderr).toBe("");
+  expect(stdout).toContain('Success! Registered "lib-to-link"');
+  expect(exitCode).toBe(0);
+
+  ({ stdout, stderr, exitCode } = await bun(app, "link", "lib-to-link"));
+  expect(stderr).toBe("");
+  expect(stdout).toContain("installed lib-to-link@link:lib-to-link");
+  expect(exitCode).toBe(0);
+  expect(await file(join(app, "node_modules", "lib-to-link", "package.json")).json()).toEqual({
+    name: "lib-to-link",
+    version: "1.0.0",
+  });
+  expect(await file(join(app, "package.json")).text()).toBe(appPackageJson);
+  expect(await readdirSorted(app)).toEqual(["node_modules", "package.json"]);
+
+  ({ stdout, stderr, exitCode } = await bun(app, "link", "lib-to-link", "--save"));
+  expect(stderr).toContain("Saved lockfile");
+  expect(stdout).toContain("installed lib-to-link@link:lib-to-link");
+  expect(exitCode).toBe(0);
+  expect(await file(join(app, "package.json")).json()).toEqual({
+    name: "app",
+    version: "1.0.0",
+    dependencies: { "lib-to-link": "link:lib-to-link" },
+  });
+  expect(await readdirSorted(app)).toEqual(["bun.lock", "node_modules", "package.json"]);
+});

From 1cb7329e891c0eb51b334155fa0bf33dcac09ffc Mon Sep 17 00:00:00 2001
From: robobun <117481402+robobun@users.noreply.github.com>
Date: Mon, 17 Aug 2026 02:23:55 +0000
Subject: [PATCH 148/258] audit fix: report and rewrite the overrides rule that
 holds a vulnerable version (#38785)

---
 docs/pm/cli/audit.mdx                       |  13 +-
 src/install/audit_fix.rs                    | 246 +++++++++------
 src/install/audit_fix/json.rs               |  22 +-
 src/install/audit_fix/package_json_edits.rs | 222 ++++++++++++--
 src/install/dedupe.rs                       |  27 +-
 src/install/lockfile/OverrideMap.rs         |  33 +-
 test/cli/install/bun-audit.test.ts          | 320 ++++++++++++++++++--
 7 files changed, 717 insertions(+), 166 deletions(-)

diff --git a/docs/pm/cli/audit.mdx b/docs/pm/cli/audit.mdx
index 6285756ffc30..b011595e5339 100644
--- a/docs/pm/cli/audit.mdx
+++ b/docs/pm/cli/audit.mdx
@@ -72,13 +72,15 @@ The JSON is unfiltered — `--audit-level` and `--ignore` only affect the exit c
 bun audit fix
 ```
 
-Runs the audit, then upgrades each vulnerable package to the lowest non-vulnerable version that every dependent's range allows, and installs. Only `bun.lock` and `node_modules` change, with one exception: Bun treats a direct dependency pinned to an exact version as `^version`. If Bun finds a fix, it rewrites the pin in `package.json` (or the catalog entry).
+Runs the audit, then upgrades each vulnerable package to the lowest non-vulnerable version that every dependent's range allows, and installs. Only `bun.lock` and `node_modules` change, with one exception: Bun treats an exact version pin in your own `package.json` (a dependency, a catalog entry, or an [`overrides`](/pm/overrides) rule) as `^version`. If Bun finds a fix, it rewrites the pin.
 
 ```
 fixing:
   ms@0.7.0 → 0.7.1
   lodash@4.17.20 → 4.17.21
     package.json: 4.17.20 → 4.17.21
+  tar@6.1.11 → 6.1.12
+    package.json (overrides): 6.1.11 → 6.1.12
 
 blocked by a dependent's range:
   minimatch@0.3.0 → 3.0.2
@@ -86,16 +88,19 @@ blocked by a dependent's range:
   semver@5.7.1 → 6.3.1
     my-app depends on semver@^5.0.0
     bun audit fix --latest
+  qs@6.5.2 → 6.11.0
+    package.json overrides qs@~6.5.0 (express>qs)
+    bun audit fix --latest
 
 no published version fixes:
   left-pad@1.3.0  GHSA-xxxx-xxxx-xxxx
     bun audit fix --ignore GHSA-xxxx-xxxx-xxxx
 
-Fixed 2 vulnerabilities in 2 packages
+Fixed 3 vulnerabilities in 3 packages
 5 vulnerabilities remaining
 ```
 
-- **blocked by a dependent's range** — no safe version fits a dependent's declared range. If the range is in your own `package.json` or catalog, `bun audit fix --latest` gets past it. Otherwise, update the dependent or add an [`overrides`](/pm/overrides) entry.
+- **blocked by a dependent's range** — no safe version fits a dependent's declared range. If the range is your own (a `package.json` dependency, a catalog entry, or an `overrides` rule, reported as `package.json overrides ...`), `bun audit fix --latest` gets past it. Otherwise, update the dependent or add an [`overrides`](/pm/overrides) entry.
 - **no published version fixes** — every version Bun would install is vulnerable. Replace the package, or silence the advisory with the printed `--ignore` command.
 - If no newer version is safe but an older one is, Bun downgrades and marks the row `(downgrade)`. Bun only downgrades within the installed major version (within the installed minor version below 1.0.0), with or without `--latest`. When an advisory covers every `2.x` release, Bun lists the package under **no published version fixes** instead of installing a `1.x` release.
 - Bun still installs a safe version newer than `--minimum-release-age` and marks the row `(newer than --minimum-release-age)`.
@@ -112,7 +117,7 @@ Fixed 2 vulnerabilities in 2 packages
 bun audit fix --latest
 ```
 
-Same as `bun audit fix`, but ranges in your own `package.json` files and catalogs no longer block a fix. Bun rewrites them to accept the new version, keeping their style (`^5.0.0` → `^6.3.1`, `~5.7.1` → `~6.3.1`, exact stays exact). Ranges declared by third-party packages still block; use `overrides` for those.
+Same as `bun audit fix`, but ranges in your own `package.json` files, catalogs, and `overrides` no longer block a fix. Bun rewrites them to accept the new version, keeping their style (`^5.0.0` → `^6.3.1`, `~5.7.1` → `~6.3.1`, exact stays exact). Ranges declared by third-party packages still block; use `overrides` for those.
 
 ### Exit code
 
diff --git a/src/install/audit_fix.rs b/src/install/audit_fix.rs
index c1d01cd6d5ca..9a021032f9c1 100644
--- a/src/install/audit_fix.rs
+++ b/src/install/audit_fix.rs
@@ -3,6 +3,7 @@ use core::mem::ManuallyDrop;
 use std::io::Write as _;
 
 use bstr::BStr;
+use bun_ast::Expr;
 use bun_collections::{DynamicBitSet, HashMap, index_sort};
 use bun_core::{Global, Output, UnwrapOrOom as _, pretty, prettyln, strings};
 use bun_semver::query::Group;
@@ -10,6 +11,7 @@ use bun_semver::{self as Semver, SlicedString};
 
 use crate::dependency::Behavior;
 use crate::lockfile::Lockfile;
+use crate::lockfile::override_map::OverrideRule;
 use crate::lockfile::package::PackageColumns as _;
 use crate::npm::PackageManifest;
 use crate::package_manager::Options::{Do, Enable, LogLevel};
@@ -23,7 +25,7 @@ use crate::{
 
 mod json;
 mod package_json_edits;
-pub use package_json_edits::PackageJsonEdit;
+pub use package_json_edits::{EditSite, OverrideSelector, PackageJsonEdit};
 
 pub struct Advisory {
     pub package_name: Box<[u8]>,
@@ -52,11 +54,15 @@ pub struct PlannedEdge {
     pub parent: PackageID,
 }
 
+#[derive(PartialEq, Eq)]
 pub struct Blocker {
+    /// The dependent package or importer file; `package.json` when `override_rule` is set, since the range then comes from its `overrides`.
     pub dependent: Box<[u8]>,
     pub range: Box<[u8]>,
     pub bundled: bool,
     pub latest_fixes: bool,
+    /// Key of the `overrides` rule that holds the version, in the form `OverrideSelector::key` produces.
+    pub override_rule: Option<Box<[u8]>>,
 }
 
 pub struct BlockedFix {
@@ -183,9 +189,12 @@ pub struct FixOutcome {
 struct Edge {
     dep_id: DependencyID,
     parent: PackageID,
+    /// What the edge resolves against once overrides and catalogs are applied; `None` unless that is an npm range.
     range: Option<dependency::Version>,
+    /// The override rule's value when one applies, else the dependent's own specifier; shown when `range` is `None`.
     literal: Box<[u8]>,
     dependent: Box<[u8]>,
+    override_rule: Option<Box<[u8]>>,
     bundled: bool,
     peer: bool,
     latest_fixes: bool,
@@ -433,41 +442,38 @@ fn print_manifest_unavailable(manager: &PackageManager, items: &[ManifestUnavail
     Output::flush();
 }
 
+/// The root/workspace package.json (or catalog, or override rule) entry whose rewrite would move this edge: an exact pin, or with `latest` any npm range.
 fn pin_for(
     lockfile: &Lockfile,
-    dep_id: usize,
+    root_json: Option<&Expr>,
     dep: &Dependency,
     parent: PackageID,
+    rule: Option<OverrideRule<'_>>,
     latest: bool,
 ) -> Option<PackageJsonEdit> {
-    if parent == invalid_package_id || dep.behavior.is_bundled() || dep.behavior.is_workspace() {
+    if dep.behavior.is_bundled() || dep.behavior.is_workspace() {
         return None;
     }
     let buf = lockfile.buffers.string_bytes.as_slice();
-    let res = lockfile.packages.items_resolution();
-    let parent_res = &res[parent as usize];
-    if !matches!(
-        parent_res.tag,
-        ResolutionTag::Root | ResolutionTag::Workspace
-    ) {
-        return None;
-    }
-    let is_alias = dep.version.tag == DependencyVersionTag::Npm && dep.version.npm().is_alias;
-    if !is_alias
-        && lockfile
-            .overrides
-            .get(lockfile, dep_id as DependencyID, dep.name_hash)
-            .is_some()
-    {
-        return None;
-    }
-    let key: Box<[u8]> = Box::from(dep.name.slice(buf));
-    match dep.version.tag {
+    let name = dep.name.slice(buf);
+    let version = match rule {
+        Some(rule) => rule.version(),
+        None => {
+            if parent == invalid_package_id
+                || !matches!(
+                    lockfile.packages.items_resolution()[parent as usize].tag,
+                    ResolutionTag::Root | ResolutionTag::Workspace
+                )
+            {
+                return None;
+            }
+            &dep.version
+        }
+    };
+    match version.tag {
         DependencyVersionTag::Catalog => {
-            let catalog_name = dep.version.catalog().slice(buf);
-            let entry = lockfile
-                .catalogs
-                .find(buf, catalog_name, dep.name.slice(buf))?;
+            let catalog_name = version.catalog().slice(buf);
+            let entry = lockfile.catalogs.find(buf, catalog_name, name)?;
             if entry.version.tag != DependencyVersionTag::Npm
                 || (!latest && entry.version.npm().version.get_exact_version().is_none())
             {
@@ -476,24 +482,44 @@ fn pin_for(
             Some(PackageJsonEdit {
                 owner: 0,
                 file: Box::from(&b"package.json"[..]),
-                catalog: Some(Box::from(catalog_name)),
-                key,
+                site: EditSite::Catalog(Box::from(catalog_name)),
+                key: Box::from(name),
                 old_literal: Box::from(entry.version.literal.slice(buf)),
                 new_literal: Box::default(),
             })
         }
         DependencyVersionTag::Npm => {
             if !latest {
-                dep.version.npm().version.get_exact_version()?;
+                version.npm().version.get_exact_version()?;
+            }
+            let literal = version.literal.slice(buf);
+            match rule {
+                Some(rule) => {
+                    let selector = OverrideSelector::from_rule(rule, buf);
+                    let written =
+                        package_json_edits::override_literal(root_json?, name, &selector)?;
+                    // Differs when package.json spells the value as a `$ref` to a dependency; bun.lock stores what it resolved to.
+                    if *written != *strings::trim(literal, &strings::WHITESPACE_CHARS) {
+                        return None;
+                    }
+                    Some(PackageJsonEdit {
+                        owner: 0,
+                        file: Box::from(&b"package.json"[..]),
+                        site: EditSite::Override(selector),
+                        key: Box::from(name),
+                        old_literal: written,
+                        new_literal: Box::default(),
+                    })
+                }
+                None => Some(PackageJsonEdit {
+                    owner: parent,
+                    file: importer_file(lockfile, parent)?,
+                    site: EditSite::Dependencies,
+                    key: Box::from(name),
+                    old_literal: Box::from(literal),
+                    new_literal: Box::default(),
+                }),
             }
-            Some(PackageJsonEdit {
-                owner: parent,
-                file: importer_file(lockfile, parent)?,
-                catalog: None,
-                key,
-                old_literal: Box::from(dep.version.literal.slice(buf)),
-                new_literal: Box::default(),
-            })
         }
         _ => None,
     }
@@ -507,15 +533,12 @@ pub fn plan_fixes(manager: &mut PackageManager, advisories: &[Advisory]) -> crat
 
     let mut instances: Vec<Instance> = Vec::new();
     let mut checked_names: HashMap<PackageNameHash, ()> = HashMap::new();
-    {
+    let instance_of: Vec<u32> = {
         let lockfile = &*manager.lockfile;
         let buf = lockfile.buffers.string_bytes.as_slice();
         let names = lockfile.packages.items_name();
         let name_hashes = lockfile.packages.items_name_hash();
         let res = lockfile.packages.items_resolution();
-        let dep_slices = lockfile.packages.items_dependencies();
-        let deps = lockfile.buffers.dependencies.as_slice();
-        let resolutions = lockfile.buffers.resolutions.as_slice();
 
         let mut instance_of: Vec<u32> = vec![u32::MAX; res.len()];
         for pkg_id in 0..res.len() {
@@ -549,49 +572,63 @@ pub fn plan_fixes(manager: &mut PackageManager, advisories: &[Advisory]) -> crat
                 edges: Vec::new(),
             });
         }
+        instance_of
+    };
 
-        if !instances.is_empty() {
-            let mut parent_of: Vec<PackageID> = vec![invalid_package_id; deps.len()];
-            for (pkg_id, slice) in dep_slices.iter().enumerate() {
-                let end = (slice.end() as usize).min(deps.len());
-                for slot in &mut parent_of[(slice.begin() as usize).min(end)..end] {
-                    *slot = pkg_id as PackageID;
-                }
+    if !instances.is_empty() {
+        let root_json: Option<Expr> = (!manager.lockfile.overrides.is_empty())
+            .then(|| package_json_edits::root_package_json(manager));
+        let lockfile = &*manager.lockfile;
+        let buf = lockfile.buffers.string_bytes.as_slice();
+        let deps = lockfile.buffers.dependencies.as_slice();
+        let mut parent_of: Vec<PackageID> = vec![invalid_package_id; deps.len()];
+        for (pkg_id, slice) in lockfile.packages.items_dependencies().iter().enumerate() {
+            let end = (slice.end() as usize).min(deps.len());
+            for slot in &mut parent_of[(slice.begin() as usize).min(end)..end] {
+                *slot = pkg_id as PackageID;
             }
+        }
 
-            for (dep_id, &target) in resolutions.iter().enumerate() {
-                if target == invalid_package_id {
-                    continue;
-                }
-                let Some(&instance) = instance_of.get(target as usize) else {
-                    continue;
-                };
-                if instance == u32::MAX || deps[dep_id].behavior.is_optional_peer() {
-                    continue;
-                }
-                let dep = &deps[dep_id];
-                let parent = parent_of[dep_id];
-                let mut pin = pin_for(lockfile, dep_id, dep, parent, true);
-                let latest_fixes = !latest && pin.is_some();
-                if latest_fixes {
-                    pin = pin_for(lockfile, dep_id, dep, parent, false);
-                }
-                instances[instance as usize].edges.push(Edge {
-                    dep_id: dep_id as DependencyID,
-                    parent,
-                    range: crate::dedupe::effective_npm_range(
-                        lockfile,
-                        dep_id as DependencyID,
-                        dep,
-                    ),
-                    literal: Box::from(dep.version.literal.slice(buf)),
-                    dependent: dependent_label(lockfile, parent),
-                    bundled: dep.behavior.is_bundled(),
-                    peer: dep.behavior.is_peer(),
-                    latest_fixes,
-                    pin,
-                });
+        for (dep_id, &target) in lockfile.buffers.resolutions.iter().enumerate() {
+            if target == invalid_package_id {
+                continue;
+            }
+            let Some(&instance) = instance_of.get(target as usize) else {
+                continue;
+            };
+            if instance == u32::MAX || deps[dep_id].behavior.is_optional_peer() {
+                continue;
             }
+            let dep = &deps[dep_id];
+            let parent = parent_of[dep_id];
+            // A bundled copy ships inside its dependent whatever an override says, so it stays attributed to the dependent.
+            let rule = if dep.behavior.is_bundled() {
+                None
+            } else {
+                crate::dedupe::applied_override(lockfile, dep_id as DependencyID, dep)
+            };
+            let mut pin = pin_for(lockfile, root_json.as_ref(), dep, parent, rule, true);
+            let latest_fixes = !latest && pin.is_some();
+            if latest_fixes {
+                pin = pin_for(lockfile, root_json.as_ref(), dep, parent, rule, false);
+            }
+            instances[instance as usize].edges.push(Edge {
+                dep_id: dep_id as DependencyID,
+                parent,
+                range: crate::dedupe::effective_npm_range(lockfile, dep_id as DependencyID, dep),
+                literal: Box::from(
+                    rule.map_or(&dep.version, OverrideRule::version)
+                        .literal
+                        .slice(buf),
+                ),
+                dependent: dependent_label(lockfile, parent),
+                override_rule: rule
+                    .map(|rule| OverrideSelector::from_rule(rule, buf).key(dep.name.slice(buf))),
+                bundled: dep.behavior.is_bundled(),
+                peer: dep.behavior.is_peer(),
+                latest_fixes,
+                pin,
+            });
         }
     }
 
@@ -867,13 +904,14 @@ pub fn plan_fixes(manager: &mut PackageManager, advisories: &[Advisory]) -> crat
             });
         }
 
-        let blockers: Vec<Blocker> = inst
-            .edges
-            .iter()
-            .zip(&target)
-            .filter(|(_, t)| t.is_none())
-            .map(|(edge, _)| Blocker {
-                dependent: edge.dependent.clone(),
+        let mut blockers: Vec<Blocker> = Vec::new();
+        for (edge, _) in inst.edges.iter().zip(&target).filter(|(_, t)| t.is_none()) {
+            let blocker = Blocker {
+                dependent: if edge.override_rule.is_some() {
+                    Box::from(&b"package.json"[..])
+                } else {
+                    edge.dependent.clone()
+                },
                 range: if edge.bundled {
                     inst.from.clone()
                 } else {
@@ -884,8 +922,13 @@ pub fn plan_fixes(manager: &mut PackageManager, advisories: &[Advisory]) -> crat
                 },
                 bundled: edge.bundled,
                 latest_fixes: edge.latest_fixes,
-            })
-            .collect();
+                override_rule: edge.override_rule.clone(),
+            };
+            // Every edge a rule holds reports the same blocker.
+            if !blockers.contains(&blocker) {
+                blockers.push(blocker);
+            }
+        }
         if blockers.is_empty() {
             expected_gone.push((inst.name_hash, inst.from));
             continue;
@@ -954,10 +997,18 @@ impl FixPlan {
                 prettyln!("");
                 for edit in &fix.edits {
                     pretty!("    {}", BStr::new(&edit.file));
-                    match edit.catalog.as_deref() {
-                        None => {}
-                        Some(b"" | b"default") => pretty!(" (catalog)"),
-                        Some(catalog) => pretty!(" (catalog {})", BStr::new(catalog)),
+                    match &edit.site {
+                        EditSite::Dependencies => {}
+                        EditSite::Catalog(catalog) => match &**catalog {
+                            b"" | b"default" => pretty!(" (catalog)"),
+                            catalog => pretty!(" (catalog {})", BStr::new(catalog)),
+                        },
+                        EditSite::Override(selector) if selector.is_bare() => {
+                            pretty!(" (overrides)");
+                        }
+                        EditSite::Override(selector) => {
+                            pretty!(" (overrides {})", BStr::new(&selector.key(&edit.key)));
+                        }
                     }
                     prettyln!(
                         ": <d>{} {}<r> {}",
@@ -989,17 +1040,24 @@ impl FixPlan {
                 }
                 prettyln!("");
                 for blocker in &item.blockers {
-                    prettyln!(
+                    pretty!(
                         "    {} {} {}@{}",
                         BStr::new(&blocker.dependent),
                         if blocker.bundled {
                             "bundles"
+                        } else if blocker.override_rule.is_some() {
+                            "overrides"
                         } else {
                             "depends on"
                         },
                         BStr::new(&item.name),
                         BStr::new(&blocker.range)
                     );
+                    match &blocker.override_rule {
+                        Some(rule) if **rule != *item.name => pretty!(" ({})", BStr::new(rule)),
+                        _ => {}
+                    }
+                    prettyln!("");
                 }
                 if item.blockers.iter().any(|blocker| blocker.latest_fixes) {
                     prettyln!("    <cyan>bun audit fix --latest<r>");
diff --git a/src/install/audit_fix/json.rs b/src/install/audit_fix/json.rs
index 7e0a8dae8165..b6c26fc50fce 100644
--- a/src/install/audit_fix/json.rs
+++ b/src/install/audit_fix/json.rs
@@ -2,7 +2,7 @@ use std::io::Write as _;
 
 use bun_core::Output;
 
-use super::{FixOutcome, FixPlan, PackageJsonEdit};
+use super::{EditSite, FixOutcome, FixPlan, PackageJsonEdit};
 
 pub(super) fn write(plan: &FixPlan, outcome: Option<&FixOutcome>, dry_run: bool) {
     let (fixed, remaining) = match outcome {
@@ -59,7 +59,12 @@ pub(super) fn write(plan: &FixPlan, outcome: Option<&FixOutcome>, dry_run: bool)
             s(&mut out, &blocker.dependent);
             out.extend_from_slice(b",\"range\":");
             s(&mut out, &blocker.range);
-            let _ = write!(out, ",\"bundled\":{}}}", blocker.bundled);
+            let _ = write!(out, ",\"bundled\":{},\"override\":", blocker.bundled);
+            match &blocker.override_rule {
+                None => out.extend_from_slice(b"null"),
+                Some(rule) => s(&mut out, rule),
+            }
+            out.push(b'}');
         }
         out.extend_from_slice(b"]}");
     }
@@ -146,10 +151,15 @@ fn write_edit(out: &mut Vec<u8>, edit: &PackageJsonEdit) {
     out.extend_from_slice(b"{\"file\":");
     s(out, &edit.file);
     out.extend_from_slice(b",\"catalog\":");
-    match edit.catalog.as_deref() {
-        None => out.extend_from_slice(b"null"),
-        Some(b"") => out.extend_from_slice(b"\"default\""),
-        Some(catalog) => s(out, catalog),
+    match &edit.site {
+        EditSite::Catalog(catalog) if catalog.is_empty() => out.extend_from_slice(b"\"default\""),
+        EditSite::Catalog(catalog) => s(out, catalog),
+        EditSite::Dependencies | EditSite::Override(_) => out.extend_from_slice(b"null"),
+    }
+    out.extend_from_slice(b",\"override\":");
+    match &edit.site {
+        EditSite::Override(selector) => s(out, &selector.key(&edit.key)),
+        EditSite::Dependencies | EditSite::Catalog(_) => out.extend_from_slice(b"null"),
     }
     out.extend_from_slice(b",\"key\":");
     s(out, &edit.key);
diff --git a/src/install/audit_fix/package_json_edits.rs b/src/install/audit_fix/package_json_edits.rs
index 294acbfd0d29..3f94d3fb0fc8 100644
--- a/src/install/audit_fix/package_json_edits.rs
+++ b/src/install/audit_fix/package_json_edits.rs
@@ -1,4 +1,4 @@
-use bun_ast::{E, Expr};
+use bun_ast::{E, Expr, ExprData};
 use bun_collections::VecExt as _;
 use bun_collections::index_sort;
 use bun_core::strings;
@@ -8,7 +8,9 @@ use bun_semver::{PinnedVersion, Version};
 
 use crate::bun_fs::FileSystem;
 use crate::lockfile::CatalogMap;
+use crate::lockfile::override_map::OverrideRule;
 use crate::lockfile::package::PackageColumns as _;
+use crate::lockfile_real::override_selector::{Selector, parse_package_segment, parse_selector};
 use crate::package_manager_real::add_remove_with_filter::{
     WorkspaceTarget, fetch_entry_root, root_package_json_path, store_entry,
 };
@@ -27,16 +29,92 @@ const DEPENDENCY_GROUPS: [&[u8]; 4] = [
 pub struct PackageJsonEdit {
     pub owner: PackageID,
     pub file: Box<[u8]>,
-    pub catalog: Option<Box<[u8]>>,
+    pub site: EditSite,
+    /// The package whose range is rewritten.
     pub key: Box<[u8]>,
     pub old_literal: Box<[u8]>,
     pub new_literal: Box<[u8]>,
 }
 
+#[derive(Clone, PartialEq, Eq)]
+pub enum EditSite {
+    /// `key` in whichever of the four dependency groups of `file` declares `old_literal`.
+    Dependencies,
+    /// `key` in this catalog of the root package.json; empty means the default catalog.
+    Catalog(Box<[u8]>),
+    /// The rule for `key` in the root package.json's `overrides` (or `resolutions`).
+    Override(OverrideSelector),
+}
+
+/// A rule of the root package.json's `overrides`/`resolutions` as `OverrideMap` normalizes it, minus the target name (the edit's `key`).
+#[derive(Clone, PartialEq, Eq)]
+pub struct OverrideSelector {
+    /// Name and declared range of the dependent the rule is scoped to; the range is empty when any version of it qualifies.
+    pub parent: Option<(Box<[u8]>, Box<[u8]>)>,
+    /// Empty when the rule applies whatever range the dependent declares.
+    pub target_range: Box<[u8]>,
+}
+
+impl OverrideSelector {
+    pub(super) fn from_rule(rule: OverrideRule<'_>, buf: &[u8]) -> OverrideSelector {
+        match rule {
+            OverrideRule::Flat(_) => OverrideSelector {
+                parent: None,
+                target_range: Box::default(),
+            },
+            OverrideRule::Scoped(rule) => OverrideSelector {
+                parent: rule.parent.as_ref().map(|parent| {
+                    (
+                        Box::from(parent.name.slice(buf)),
+                        Box::from(parent.version.literal.slice(buf)),
+                    )
+                }),
+                target_range: Box::from(rule.target_range.literal.slice(buf)),
+            },
+        }
+    }
+
+    /// A plain `"name": ...` rule, as opposed to one scoped to a parent or to a declared range.
+    pub fn is_bare(&self) -> bool {
+        self.parent.is_none() && self.target_range.is_empty()
+    }
+
+    /// The rule's key in the `parent@range>name@range` form bun.lock writes, which `overrides` also accepts.
+    pub fn key(&self, name: &[u8]) -> Box<[u8]> {
+        let mut out: Vec<u8> = Vec::new();
+        if let Some((parent, parent_range)) = &self.parent {
+            push_segment(&mut out, parent, parent_range);
+            out.push(b'>');
+        }
+        push_segment(&mut out, name, &self.target_range);
+        out.into_boxed_slice()
+    }
+
+    fn matches(&self, name: &[u8], selector: &Selector<'_>) -> bool {
+        selector.target.name == name
+            && selector.target.range == &*self.target_range
+            && match (&self.parent, &selector.parent) {
+                (None, None) => true,
+                (Some((parent, parent_range)), Some(declared)) => {
+                    declared.name == &**parent && declared.range == &**parent_range
+                }
+                _ => false,
+            }
+    }
+}
+
+fn push_segment(out: &mut Vec<u8>, name: &[u8], range: &[u8]) {
+    out.extend_from_slice(name);
+    if !range.is_empty() {
+        out.push(b'@');
+        out.extend_from_slice(range);
+    }
+}
+
 impl PackageJsonEdit {
     pub(crate) fn same_site(&self, other: &PackageJsonEdit) -> bool {
         self.owner == other.owner
-            && self.catalog == other.catalog
+            && self.site == other.site
             && self.key == other.key
             && self.old_literal == other.old_literal
     }
@@ -145,8 +223,8 @@ fn apply_to_target(
         let _guard = bun_ast::expr::Disabler::scope();
         let arena = &manager.ast_arena;
         for edit in edits {
-            match &edit.catalog {
-                None => {
+            match &edit.site {
+                EditSite::Dependencies => {
                     for group in DEPENDENCY_GROUPS {
                         let Some(mut query) = root.as_property(group) else {
                             continue;
@@ -154,12 +232,19 @@ fn apply_to_target(
                         rewrite_property(arena, &mut query.expr, edit);
                     }
                 }
-                Some(catalog) => for_each_catalog_object(&root, |catalog_name, mut object| {
-                    if CatalogMap::same_name(catalog_name, catalog) {
-                        rewrite_property(arena, &mut object, edit);
-                    }
-                    Ok(())
-                })?,
+                EditSite::Catalog(catalog) => {
+                    for_each_catalog_object(&root, |catalog_name, mut object| {
+                        if CatalogMap::same_name(catalog_name, catalog) {
+                            rewrite_property(arena, &mut object, edit);
+                        }
+                        Ok(())
+                    })?;
+                }
+                EditSite::Override(selector) => {
+                    for_each_override_value(&root, &edit.key, selector, |value| {
+                        rewrite_value(arena, value, edit);
+                    });
+                }
             }
         }
     }
@@ -175,19 +260,118 @@ fn rewrite_property(arena: &bun_alloc::Arena, object: &mut Expr, edit: &PackageJ
         let Some(key) = prop.key.as_ref().and_then(Expr::as_utf8_string_literal) else {
             continue;
         };
-        if key != &*edit.key {
+        if key == &*edit.key {
+            rewrite_value(arena, &mut prop.value, edit);
+        }
+    }
+}
+
+fn rewrite_value(arena: &bun_alloc::Arena, value: &mut Option<Expr>, edit: &PackageJsonEdit) {
+    let Some(literal) = value.as_ref().and_then(Expr::as_utf8_string_literal) else {
+        return;
+    };
+    if strings::trim(literal, &strings::WHITESPACE_CHARS) != &*edit.old_literal {
+        return;
+    }
+    *value = Some(Expr::allocate(
+        arena,
+        E::EString::init(arena.alloc_slice_copy(&edit.new_literal)),
+        bun_ast::Loc::EMPTY,
+    ));
+}
+
+pub(super) fn root_package_json(manager: &mut PackageManager) -> Expr {
+    let target = WorkspaceTarget {
+        name: Box::default(),
+        name_hash: None,
+        package_json_path: root_package_json_path(),
+    };
+    fetch_entry_root(manager, &target)
+}
+
+/// The string the root package.json currently gives `name`'s rule `selector`; when several entries spell the same rule, the last one, which is the one `OverrideMap` keeps.
+pub(super) fn override_literal(
+    root: &Expr,
+    name: &[u8],
+    selector: &OverrideSelector,
+) -> Option<Box<[u8]>> {
+    let mut literal: Option<Box<[u8]>> = None;
+    for_each_override_value(root, name, selector, |value| {
+        if let Some(text) = value.as_ref().and_then(Expr::as_utf8_string_literal) {
+            literal = Some(Box::from(strings::trim(text, &strings::WHITESPACE_CHARS)));
+        }
+    });
+    literal
+}
+
+/// Visits, in file order, the value of every entry declaring `selector` for `name`, whichever of the accepted key spellings (`a>b`, `a/b`, `**/b`, `{"a": {"b": ..}}`, `{"b": {".": ..}}`) each uses.
+///
+/// Reads `overrides`, else `resolutions`, like `OverrideMap::parse_append`; npm's `"parent": { "child": .. }` form only counts in `overrides`, where the parser accepts it.
+fn for_each_override_value(
+    root: &Expr,
+    name: &[u8],
+    selector: &OverrideSelector,
+    mut f: impl FnMut(&mut Option<Expr>),
+) {
+    let (mut rules, nested) = match root.get(b"overrides") {
+        Some(overrides) => (overrides, true),
+        None => match root.get(b"resolutions") {
+            Some(resolutions) => (resolutions, false),
+            None => return,
+        },
+    };
+    let Some(object) = rules.data.e_object_mut() else {
+        return;
+    };
+    for prop in object.properties.slice_mut() {
+        let Some(key) = prop.key.as_ref().and_then(Expr::as_utf8_string_literal) else {
+            continue;
+        };
+        let is_group = nested
+            && prop
+                .value
+                .as_ref()
+                .is_some_and(|value| matches!(value.data, ExprData::EObject(_)));
+        if !is_group {
+            if parse_selector(key).is_ok_and(|rule| selector.matches(name, &rule)) {
+                f(&mut prop.value);
+            }
             continue;
         }
-        let Some(value) = prop.value.as_ref().and_then(Expr::as_utf8_string_literal) else {
+        let Ok(parent) = parse_package_segment(key) else {
             continue;
         };
-        if strings::trim(value, &strings::WHITESPACE_CHARS) != &*edit.old_literal {
+        let Some(group) = prop
+            .value
+            .as_mut()
+            .and_then(|value| value.data.e_object_mut())
+        else {
             continue;
+        };
+        for child in group.properties.slice_mut() {
+            let Some(child_key) = child.key.as_ref().and_then(Expr::as_utf8_string_literal) else {
+                continue;
+            };
+            let rule = if child_key == b"." {
+                Selector {
+                    parent: None,
+                    target: parent,
+                }
+            } else {
+                match parse_selector(child_key) {
+                    Ok(Selector {
+                        parent: None,
+                        target,
+                    }) => Selector {
+                        parent: Some(parent),
+                        target,
+                    },
+                    _ => continue,
+                }
+            };
+            if selector.matches(name, &rule) {
+                f(&mut child.value);
+            }
         }
-        prop.value = Some(Expr::allocate(
-            arena,
-            E::EString::init(arena.alloc_slice_copy(&edit.new_literal)),
-            bun_ast::Loc::EMPTY,
-        ));
     }
 }
diff --git a/src/install/dedupe.rs b/src/install/dedupe.rs
index bf50240ada80..0b593ae552fc 100644
--- a/src/install/dedupe.rs
+++ b/src/install/dedupe.rs
@@ -6,6 +6,7 @@ use bun_collections::bit_set::Range;
 use bun_collections::{DynamicBitSet, index_sort};
 use bun_core::{Global, Output, UnwrapOrOom as _, strings};
 
+use crate::lockfile::override_map::OverrideRule;
 use crate::lockfile::package::PackageColumns as _;
 use crate::lockfile::{LoadResult, Lockfile, Package, PackageIndexEntry};
 use crate::package_manager::Options::{Enable, LogLevel};
@@ -593,21 +594,27 @@ pub(crate) fn effective_npm_range(
         .filter(|version| version.tag == DependencyVersionTag::Npm)
 }
 
+/// The override rule the resolver applies to this edge; `workspace:` and `npm:` alias edges are never overridden (PackageManagerEnqueue.rs).
+pub(crate) fn applied_override<'a>(
+    lockfile: &'a Lockfile,
+    dep_id: DependencyID,
+    dep: &Dependency,
+) -> Option<OverrideRule<'a>> {
+    if dep.behavior.is_workspace()
+        || (dep.version.tag == DependencyVersionTag::Npm && dep.version.npm().is_alias)
+    {
+        return None;
+    }
+    lockfile.overrides.lookup(lockfile, dep_id, dep.name_hash)
+}
+
 pub(crate) fn effective_version(
     lockfile: &Lockfile,
     dep_id: DependencyID,
     dep: &Dependency,
 ) -> Option<dependency::Version> {
-    let mut version = if dep.behavior.is_workspace()
-        || (dep.version.tag == DependencyVersionTag::Npm && dep.version.npm().is_alias)
-    {
-        dep.version.clone()
-    } else {
-        lockfile
-            .overrides
-            .get(lockfile, dep_id, dep.name_hash)
-            .unwrap_or_else(|| dep.version.clone())
-    };
+    let mut version = applied_override(lockfile, dep_id, dep)
+        .map_or_else(|| dep.version.clone(), |rule| rule.version().clone());
     if version.tag == DependencyVersionTag::Catalog {
         version = lockfile
             .catalogs
diff --git a/src/install/lockfile/OverrideMap.rs b/src/install/lockfile/OverrideMap.rs
index 40e527a26bbf..981033a3aaba 100644
--- a/src/install/lockfile/OverrideMap.rs
+++ b/src/install/lockfile/OverrideMap.rs
@@ -39,6 +39,23 @@ pub struct ScopedOverride {
     pub(crate) dep: Dependency,
 }
 
+/// The rule `OverrideMap::lookup` chose for one dependency edge.
+#[derive(Clone, Copy)]
+pub(crate) enum OverrideRule<'a> {
+    Flat(&'a Dependency),
+    Scoped(&'a ScopedOverride),
+}
+
+impl<'a> OverrideRule<'a> {
+    #[inline]
+    pub(crate) fn version(self) -> &'a dependency::Version {
+        match self {
+            OverrideRule::Flat(dep) => &dep.version,
+            OverrideRule::Scoped(rule) => &rule.dep.version,
+        }
+    }
+}
+
 impl ScopedOverride {
     #[inline]
     pub(crate) fn parent_has_range(&self) -> bool {
@@ -154,24 +171,34 @@ impl OverrideMap {
         dependency_id: DependencyID,
         name_hash: PackageNameHash,
     ) -> Option<dependency::Version> {
+        self.lookup(lockfile, dependency_id, name_hash)
+            .map(|rule| rule.version().clone())
+    }
+
+    pub(crate) fn lookup(
+        &self,
+        lockfile: &Lockfile,
+        dependency_id: DependencyID,
+        name_hash: PackageNameHash,
+    ) -> Option<OverrideRule<'_>> {
         scoped_log!(OverrideMap, "looking up override for {:x}", name_hash);
         if self.scoped.is_empty() {
             return self.get_flat(name_hash);
         }
         if self.scoped_names.contains(&name_hash) {
             if let Some(rule) = self.scoped_rule_for(lockfile, dependency_id, name_hash) {
-                return Some(rule.dep.version.clone());
+                return Some(OverrideRule::Scoped(rule));
             }
         }
         self.get_flat(name_hash)
     }
 
     #[inline]
-    fn get_flat(&self, name_hash: PackageNameHash) -> Option<dependency::Version> {
+    fn get_flat(&self, name_hash: PackageNameHash) -> Option<OverrideRule<'_>> {
         if self.map.count() == 0 {
             return None;
         }
-        self.map.get(&name_hash).map(|dep| dep.version.clone())
+        self.map.get(&name_hash).map(OverrideRule::Flat)
     }
 
     fn scoped_rule_for<'s>(
diff --git a/test/cli/install/bun-audit.test.ts b/test/cli/install/bun-audit.test.ts
index 9d23b5c0abf7..170b0a5782cf 100644
--- a/test/cli/install/bun-audit.test.ts
+++ b/test/cli/install/bun-audit.test.ts
@@ -1717,7 +1717,7 @@ describe("`bun audit fix`", () => {
         to: "1.0.4",
         downgrade: false,
         latestFixes: true,
-        blockers: [{ dependent: "package.json", range: "<1.0.4", bundled: false }],
+        blockers: [{ dependent: "package.json", range: "<1.0.4", bundled: false, override: null }],
       },
       {
         name: "no-deps",
@@ -1725,7 +1725,7 @@ describe("`bun audit fix`", () => {
         to: "1.1.0",
         downgrade: false,
         latestFixes: false,
-        blockers: [{ dependent: "one-dep@1.0.0", range: "1.0.1", bundled: false }],
+        blockers: [{ dependent: "one-dep@1.0.0", range: "1.0.1", bundled: false, override: null }],
       },
     ]);
     expect(json.exitCode).toBe(1);
@@ -1759,7 +1759,7 @@ describe("`bun audit fix`", () => {
 
     const json = await auditFix(dir, "--json");
     expect(JSON.parse(json.stdout).blocked[0].blockers).toStrictEqual([
-      { dependent: "packages/pkg-a/package.json", range: "<1.0.4", bundled: false },
+      { dependent: "packages/pkg-a/package.json", range: "<1.0.4", bundled: false, override: null },
     ]);
     expect(json.exitCode).toBe(1);
   });
@@ -2443,15 +2443,156 @@ describe("`bun audit fix`", () => {
     await runBunInstall(installEnv(dir), dir, { frozenLockfile: true });
   });
 
-  test.concurrent("a version held by an overrides entry is blocked and the override is not rewritten", async () => {
+  test.concurrent("a direct dependency pinned by an overrides entry is fixed by rewriting the override", async () => {
     await using server = startRegistry({ "a-dep": [adv("<1.0.4")] });
     using dir = await setup(server, {
       name: "foo",
       dependencies: { "a-dep": "^1.0.2" },
       overrides: { "a-dep": "1.0.2" },
     });
+    expect(await lock(dir)).toContain('"a-dep@1.0.2"');
+
+    const { stdout, exitCode } = await auditFix(dir);
+    expect(normalizeBunSnapshot(stdout)).toMatchInlineSnapshot(`
+      "bun audit fix <version> (<revision>)
+
+      fixing:
+        ^ a-dep 1.0.2 -> 1.0.4
+          package.json (overrides): 1.0.2 -> 1.0.4
+
+      Fixed 1 vulnerability in 1 package (checked 1)"
+    `);
+    expect(exitCode).toBe(0);
+
+    expect(await pkgJson(dir)).toStrictEqual({
+      name: "foo",
+      dependencies: { "a-dep": "^1.0.2" },
+      overrides: { "a-dep": "1.0.4" },
+    });
+    const lockfile = await lock(dir);
+    expect(lockfile).toContain('"a-dep@1.0.4"');
+    expect(lockfile).not.toContain('"a-dep@1.0.2"');
+    expect(lockfile).toContain('"a-dep": "1.0.4"');
+    expect(await installedVersion(dir, "a-dep")).toBe("1.0.4");
+
+    expectClean(await audit(dir), 1);
+    await runBunInstall(installEnv(dir), dir, { frozenLockfile: true });
+  });
+
+  // one-range-dep and one-range-dep-too both declare no-deps@^1.0.0; only the override holds it at 1.0.0.
+  test.concurrent(
+    "a transitive dependency pinned by an overrides entry is fixed by rewriting the override",
+    async () => {
+      await using server = startRegistry({ "no-deps": [adv("<1.0.1")] });
+      using dir = await setup(server, {
+        name: "foo",
+        dependencies: { "one-range-dep": "1.0.0", "one-range-dep-too": "1.0.0" },
+        overrides: { "no-deps": "1.0.0" },
+      });
+      expect(await lock(dir)).toContain('"no-deps@1.0.0"');
+
+      const { stdout, stderr, exitCode } = await auditFix(dir);
+      expect(normalizeBunSnapshot(stdout)).toMatchInlineSnapshot(`
+      "bun audit fix <version> (<revision>)
+
+      fixing:
+        ^ no-deps 1.0.0 -> 1.0.1
+          package.json (overrides): 1.0.0 -> 1.0.1
+
+      Fixed 1 vulnerability in 1 package (checked 3)"
+    `);
+      expect(stderr).not.toContain("error:");
+      expect(exitCode).toBe(0);
+
+      expect(await pkgJson(dir)).toStrictEqual({
+        name: "foo",
+        dependencies: { "one-range-dep": "1.0.0", "one-range-dep-too": "1.0.0" },
+        overrides: { "no-deps": "1.0.1" },
+      });
+      const lockfile = await lock(dir);
+      expect(lockfile).toContain('"no-deps@1.0.1"');
+      expect(lockfile).not.toContain('"no-deps@1.0.0"');
+      expect(lockfile).toContain('"no-deps": "1.0.1"');
+      expect(await installedVersion(dir, "no-deps")).toBe("1.0.1");
+
+      expectClean(await audit(dir), 3);
+      await runBunInstall(installEnv(dir), dir, { frozenLockfile: true });
+    },
+  );
+
+  test.concurrent.each([
+    ["overrides", { "no-deps": "1.0.0" }, "(overrides)", { "no-deps": "1.0.1" }],
+    ["overrides", { "no-deps": { ".": "1.0.0" } }, "(overrides)", { "no-deps": { ".": "1.0.1" } }],
+    ["resolutions", { "**/no-deps": "1.0.0" }, "(overrides)", { "**/no-deps": "1.0.1" }],
+    [
+      "overrides",
+      { "one-range-dep>no-deps": "1.0.0" },
+      "(overrides one-range-dep>no-deps)",
+      { "one-range-dep>no-deps": "1.0.1" },
+    ],
+    [
+      "overrides",
+      { "one-range-dep": { "no-deps": "1.0.0" } },
+      "(overrides one-range-dep>no-deps)",
+      { "one-range-dep": { "no-deps": "1.0.1" } },
+    ],
+    [
+      "resolutions",
+      { "one-range-dep/no-deps": "1.0.0" },
+      "(overrides one-range-dep>no-deps)",
+      { "one-range-dep/no-deps": "1.0.1" },
+    ],
+    [
+      "overrides",
+      { "one-range-dep@1>no-deps": "1.0.0" },
+      "(overrides one-range-dep@1>no-deps)",
+      { "one-range-dep@1>no-deps": "1.0.1" },
+    ],
+    ["overrides", { "no-deps@<1.0.1": "1.0.0" }, "(overrides no-deps@<1.0.1)", { "no-deps@<1.0.1": "1.0.1" }],
+    // Two spellings of one rule: the last one is the rule bun applies, and every entry holding the version is rewritten.
+    [
+      "overrides",
+      { "**/no-deps": "1.0.0", "no-deps": "1.0.0" },
+      "(overrides)",
+      { "**/no-deps": "1.0.1", "no-deps": "1.0.1" },
+    ],
+    [
+      "overrides",
+      { "**/no-deps": "1.1.0", "no-deps": "1.0.0" },
+      "(overrides)",
+      { "**/no-deps": "1.1.0", "no-deps": "1.0.1" },
+    ],
+  ])("rewrites the rule in place when %s is written as %j", async (field, rules, label, rewritten) => {
+    await using server = startRegistry({ "no-deps": [adv("<1.0.1")] });
+    using dir = await setup(server, { name: "foo", dependencies: { "one-range-dep": "1.0.0" }, [field]: rules });
+    expect(await lock(dir)).toContain('"no-deps@1.0.0"');
+
+    const { stdout, exitCode } = await auditFix(dir);
+    expect(stdout).toContain(`  ^ no-deps 1.0.0 -> 1.0.1\n    package.json ${label}: 1.0.0 -> 1.0.1\n`);
+    expect(stdout).toContain("Fixed 1 vulnerability in 1 package");
+    expect(exitCode).toBe(0);
+
+    expect(await pkgJson(dir)).toStrictEqual({
+      name: "foo",
+      dependencies: { "one-range-dep": "1.0.0" },
+      [field]: rewritten,
+    });
+    const lockfile = await lock(dir);
+    expect(lockfile).toContain('"no-deps@1.0.1"');
+    expect(lockfile).not.toContain('"no-deps@1.0.0"');
+
+    await runBunInstall(installEnv(dir), dir, { frozenLockfile: true });
+  });
+
+  test.concurrent("an override written as a $reference is reported as the blocker and left alone", async () => {
+    await using server = startRegistry({ "no-deps": [adv("<1.0.1")] });
+    using dir = await setup(server, {
+      name: "foo",
+      dependencies: { "no-deps": "1.0.0", "one-range-dep": "1.0.0" },
+      overrides: { "no-deps": "$no-deps" },
+    });
     const lockBefore = await lock(dir);
-    expect(lockBefore).toContain('"a-dep@1.0.2"');
+    expect(lockBefore).toContain('"no-deps@1.0.0"');
     const pkgJsonBefore = await pkgJsonText(dir);
 
     const { stdout, exitCode } = await auditFix(dir);
@@ -2459,15 +2600,15 @@ describe("`bun audit fix`", () => {
       "bun audit fix <version> (<revision>)
 
       blocked by a dependent's range:
-        ^ a-dep 1.0.2 -> 1.0.4
-          package.json depends on a-dep@1.0.2
+        ^ no-deps 1.0.0 -> 1.0.1
+          package.json overrides no-deps@1.0.0
 
-      Fixed 0 of 1 vulnerability (checked 1)
+      Fixed 0 of 1 vulnerability (checked 2)
       1 vulnerability remaining"
     `);
     expect(exitCode).toBe(1);
-    expect(await lock(dir)).toBe(lockBefore);
     expect(await pkgJsonText(dir)).toBe(pkgJsonBefore);
+    expect(await lock(dir)).toBe(lockBefore);
   });
 
   test.concurrent("a pinned catalog entry is rewritten and the member keeps `catalog:`", async () => {
@@ -3233,7 +3374,9 @@ describe("`bun audit fix`", () => {
           to: "1.0.4",
           downgrade: false,
           newerThanMinimumReleaseAge: false,
-          packageJson: [{ file: "package.json", catalog: null, key: "a-dep", from: "1.0.2", to: "1.0.4" }],
+          packageJson: [
+            { file: "package.json", catalog: null, override: null, key: "a-dep", from: "1.0.2", to: "1.0.4" },
+          ],
         },
       ],
       blocked: [],
@@ -3325,7 +3468,7 @@ describe("`bun audit fix`", () => {
         to: "1.1.0",
         downgrade: false,
         latestFixes: false,
-        blockers: [{ dependent: "one-dep@1.0.0", range: "1.0.1", bundled: false }],
+        blockers: [{ dependent: "one-dep@1.0.0", range: "1.0.1", bundled: false, override: null }],
       },
     ]);
     expect(doc.unmatched).toStrictEqual([{ name: "no-deps", range: ">=9.0.0" }]);
@@ -3468,7 +3611,9 @@ describe("`bun audit fix`", () => {
           to: "1.0.4",
           downgrade: false,
           newerThanMinimumReleaseAge: false,
-          packageJson: [{ file: "package.json", catalog: null, key: "a-dep", from: "1.0.2", to: "1.0.4" }],
+          packageJson: [
+            { file: "package.json", catalog: null, override: null, key: "a-dep", from: "1.0.2", to: "1.0.4" },
+          ],
         },
       ],
       blocked: [],
@@ -3779,7 +3924,7 @@ describe("`bun audit fix`", () => {
         to: "2.0.0",
         downgrade: false,
         latestFixes: false,
-        blockers: [{ dependent: "package.json", range: "pre-1", bundled: false }],
+        blockers: [{ dependent: "package.json", range: "pre-1", bundled: false, override: null }],
       },
     ]);
     expect(exitCode).toBe(1);
@@ -3993,7 +4138,7 @@ describe("`bun audit fix`", () => {
         to: "1.0.1",
         downgrade: false,
         latestFixes: false,
-        blockers: [{ dependent: "bundled-1@1.0.0", range: "1.0.0", bundled: true }],
+        blockers: [{ dependent: "bundled-1@1.0.0", range: "1.0.0", bundled: true, override: null }],
       },
     ]);
     expect(doc).toMatchObject({ dryRun: false, fixed: 0, remaining: 1, fixes: [] });
@@ -4015,7 +4160,7 @@ describe("`bun audit fix`", () => {
         to: "1.0.1",
         downgrade: true,
         latestFixes: true,
-        blockers: [{ dependent: "package.json", range: "^1.1.0", bundled: false }],
+        blockers: [{ dependent: "package.json", range: "^1.1.0", bundled: false, override: null }],
       },
     ]);
     expect(doc).toMatchObject({ dryRun: false, fixed: 0, remaining: 1, fixes: [] });
@@ -4044,7 +4189,7 @@ describe("`bun audit fix`", () => {
         to: "1.0.1",
         downgrade: false,
         newerThanMinimumReleaseAge: false,
-        packageJson: [{ file: "package.json", catalog, key: "no-deps", from: "1.0.0", to: "1.0.1" }],
+        packageJson: [{ file: "package.json", catalog, override: null, key: "no-deps", from: "1.0.0", to: "1.0.1" }],
       },
     ]);
     expect(doc).toMatchObject({ dryRun: false, fixed: 1, remaining: 0 });
@@ -4374,7 +4519,9 @@ describe("`bun audit fix --latest`", () => {
         to: "2.0.0",
         downgrade: false,
         newerThanMinimumReleaseAge: false,
-        packageJson: [{ file: "package.json", catalog: null, key: "no-deps", from: "^1.0.0", to: "^2.0.0" }],
+        packageJson: [
+          { file: "package.json", catalog: null, override: null, key: "no-deps", from: "^1.0.0", to: "^2.0.0" },
+        ],
       },
     ]);
     expect(doc).toMatchObject({ dryRun: false, fixed: 1, remaining: 0, blocked: [] });
@@ -4501,24 +4648,137 @@ describe("`bun audit fix --latest`", () => {
     expect(await lock(dir)).toBe(lockBefore);
   });
 
-  test.concurrent("a version held by an overrides entry stays blocked", async () => {
-    await using server = startRegistry({ "a-dep": [adv("<1.0.4")] });
+  // Both dependents declare no-deps@^1.0.0, which also rejects 2.0.0; the override is what the user can change, so it alone is reported.
+  test.concurrent(
+    "a range held by an overrides entry is blocked on the override, which --latest rewrites",
+    async () => {
+      await using server = noDeps1x();
+      using dir = await setup(server, {
+        name: "foo",
+        dependencies: { "one-range-dep": "1.0.0", "one-range-dep-too": "1.0.0" },
+        overrides: { "no-deps": "~1.0.0" },
+      });
+      const lockBefore = await lock(dir);
+      expect(lockBefore).toContain('"no-deps@1.0.1"');
+      const pkgJsonBefore = await pkgJsonText(dir);
+
+      const blocked = await auditFix(dir);
+      expect(normalizeBunSnapshot(blocked.stdout)).toMatchInlineSnapshot(`
+      "bun audit fix <version> (<revision>)
+
+      blocked by a dependent's range:
+        ^ no-deps 1.0.1 -> 2.0.0
+          package.json overrides no-deps@~1.0.0
+          bun audit fix --latest
+
+      Fixed 0 of 1 vulnerability (checked 3)
+      1 vulnerability remaining"
+    `);
+      expect(blocked.exitCode).toBe(1);
+      expect(await pkgJsonText(dir)).toBe(pkgJsonBefore);
+      expect(await lock(dir)).toBe(lockBefore);
+
+      const { stdout, stderr, exitCode } = await auditFix(dir, "--latest");
+      expect(normalizeBunSnapshot(stdout)).toMatchInlineSnapshot(`
+      "bun audit fix <version> (<revision>)
+
+      fixing:
+        ^ no-deps 1.0.1 -> 2.0.0
+          package.json (overrides): ~1.0.0 -> ~2.0.0
+
+      Fixed 1 vulnerability in 1 package (checked 3)"
+    `);
+      expect(stderr).not.toContain("error:");
+      expect(exitCode).toBe(0);
+
+      expect(await pkgJson(dir)).toStrictEqual({
+        name: "foo",
+        dependencies: { "one-range-dep": "1.0.0", "one-range-dep-too": "1.0.0" },
+        overrides: { "no-deps": "~2.0.0" },
+      });
+      const lockfile = await lock(dir);
+      expect(lockfile).toContain('"no-deps@2.0.0"');
+      expect(lockfile).not.toContain('"no-deps@1.0.1"');
+      expect(lockfile).toContain('"no-deps": "~2.0.0"');
+      expect(await installedVersion(dir, "no-deps")).toBe("2.0.0");
+
+      expectClean(await audit(dir), 3);
+      await runBunInstall(installEnv(dir), dir, { frozenLockfile: true });
+    },
+  );
+
+  test.concurrent("a nested override is blocked with its key and rewritten under it", async () => {
+    await using server = noDeps1x();
     using dir = await setup(server, {
       name: "foo",
-      dependencies: { "a-dep": "^1.0.2" },
-      overrides: { "a-dep": "1.0.2" },
+      dependencies: { "one-range-dep": "1.0.0" },
+      overrides: { "one-range-dep>no-deps": "~1.0.0" },
     });
-    const lockBefore = await lock(dir);
-    const pkgJsonBefore = await pkgJsonText(dir);
+    expect(await lock(dir)).toContain('"no-deps@1.0.1"');
+
+    const blocked = await auditFix(dir);
+    expect(blocked.stdout).toContain(
+      "    package.json overrides no-deps@~1.0.0 (one-range-dep>no-deps)\n    bun audit fix --latest\n",
+    );
+    expect(blocked.exitCode).toBe(1);
 
     const { stdout, exitCode } = await auditFix(dir, "--latest");
-    expect(stdout).toContain("blocked by a dependent's range:");
-    expect(stdout).toContain("package.json depends on a-dep@1.0.2");
-    expect(stdout).not.toContain("fixing:");
-    expect(stdout).not.toContain("bun audit fix --latest");
-    expect(exitCode).toBe(1);
-    expect(await pkgJsonText(dir)).toBe(pkgJsonBefore);
-    expect(await lock(dir)).toBe(lockBefore);
+    expect(stdout).toContain(
+      "  ^ no-deps 1.0.1 -> 2.0.0\n    package.json (overrides one-range-dep>no-deps): ~1.0.0 -> ~2.0.0\n",
+    );
+    expect(stdout).toContain("Fixed 1 vulnerability in 1 package");
+    expect(exitCode).toBe(0);
+    expect((await pkgJson(dir)).overrides).toStrictEqual({ "one-range-dep>no-deps": "~2.0.0" });
+    expect(await installedVersion(dir, "no-deps")).toBe("2.0.0");
+
+    await runBunInstall(installEnv(dir), dir, { frozenLockfile: true });
+  });
+
+  test.concurrent("--json names the overrides rule on the blocker and on the edit that rewrites it", async () => {
+    await using server = noDeps1x();
+    using dir = await setup(server, {
+      name: "foo",
+      dependencies: { "one-range-dep": "1.0.0" },
+      overrides: { "one-range-dep>no-deps": "~1.0.0" },
+    });
+
+    const blocked = await auditFix(dir, "--json");
+    expect(JSON.parse(blocked.stdout).blocked).toStrictEqual([
+      {
+        name: "no-deps",
+        from: "1.0.1",
+        to: "2.0.0",
+        downgrade: false,
+        latestFixes: true,
+        blockers: [{ dependent: "package.json", range: "~1.0.0", bundled: false, override: "one-range-dep>no-deps" }],
+      },
+    ]);
+    expect(blocked.exitCode).toBe(1);
+
+    const { stdout, exitCode } = await auditFix(dir, "--latest", "--dry-run", "--json");
+    const doc = JSON.parse(stdout);
+    expect(doc.fixes).toStrictEqual([
+      {
+        name: "no-deps",
+        from: "1.0.1",
+        to: "2.0.0",
+        downgrade: false,
+        newerThanMinimumReleaseAge: false,
+        packageJson: [
+          {
+            file: "package.json",
+            catalog: null,
+            override: "one-range-dep>no-deps",
+            key: "no-deps",
+            from: "~1.0.0",
+            to: "~2.0.0",
+          },
+        ],
+      },
+    ]);
+    expect(doc).toMatchObject({ dryRun: true, fixed: 1, remaining: 0, blocked: [] });
+    expect(exitCode).toBe(0);
+    expect((await pkgJson(dir)).overrides).toStrictEqual({ "one-range-dep>no-deps": "~1.0.0" });
   });
 
   test.concurrent("a bundled dependency stays blocked without a --latest hint", async () => {

From c5a0cac8c0e8750d4f74f3c4c09aee2f8865c41d Mon Sep 17 00:00:00 2001
From: robobun <117481402+robobun@users.noreply.github.com>
Date: Mon, 17 Aug 2026 02:25:00 +0000
Subject: [PATCH 149/258] publish, pm whoami, audit: honor
 NODE_TLS_REJECT_UNAUTHORIZED=0 like bun install (#38093)

---
 src/install/npm.rs                   |  1 +
 src/runtime/cli/audit_command.rs     |  1 +
 src/runtime/cli/publish_command.rs   |  6 ++
 test/cli/install/bun-audit.test.ts   | 46 ++++++++++++++
 test/cli/install/bun-pm.test.ts      | 51 ++++++++++++++-
 test/cli/install/bun-publish.test.ts | 94 ++++++++++++++++++++++++++++
 6 files changed, 198 insertions(+), 1 deletion(-)

diff --git a/src/install/npm.rs b/src/install/npm.rs
index e63fda1da3e0..01821ef4f44e 100644
--- a/src/install/npm.rs
+++ b/src/install/npm.rs
@@ -164,6 +164,7 @@ pub fn whoami(manager: &mut PackageManager) -> Result<Vec<u8>, WhoamiError> {
         None,
         http::FetchRedirect::Follow,
     );
+    req.client.flags.reject_unauthorized = manager.tls_reject_unauthorized();
 
     let res = match req.send_sync(&mut response_buf) {
         Ok(res) => res,
diff --git a/src/runtime/cli/audit_command.rs b/src/runtime/cli/audit_command.rs
index f23723595e2d..a8cf3516bd9c 100644
--- a/src/runtime/cli/audit_command.rs
+++ b/src/runtime/cli/audit_command.rs
@@ -756,6 +756,7 @@ fn send_audit_request(
         None,
         http::FetchRedirect::Follow,
     );
+    req.client.flags.reject_unauthorized = pm.tls_reject_unauthorized();
     let reason = match req.send_sync(&mut response_buf) {
         Ok(res) if res.status_code() >= 400 => SkipReason::Status(res.status_code()),
         Ok(_) => {
diff --git a/src/runtime/cli/publish_command.rs b/src/runtime/cli/publish_command.rs
index 8fdede88f8fb..7184d84117b5 100644
--- a/src/runtime/cli/publish_command.rs
+++ b/src/runtime/cli/publish_command.rs
@@ -821,6 +821,7 @@ impl PublishCommand {
             None,
             http::FetchRedirect::Follow,
         );
+        req.client.flags.reject_unauthorized = manager.tls_reject_unauthorized();
 
         let Ok(res) = req.send_sync(&mut response_buf) else {
             return false;
@@ -938,6 +939,7 @@ impl PublishCommand {
         let publish_url = URL::parse(crate::cli::cli_dupe(&print_buf));
         print_buf.clear();
         let http_proxy = ctx.manager.http_proxy(&publish_url);
+        let reject_unauthorized = ctx.manager.tls_reject_unauthorized();
 
         let mut req = http::AsyncHTTP::init_sync(
             http::Method::PUT,
@@ -949,6 +951,7 @@ impl PublishCommand {
             None,
             http::FetchRedirect::Follow,
         );
+        req.client.flags.reject_unauthorized = reject_unauthorized;
 
         let res = match req.send_sync(&mut response_buf) {
             Ok(r) => r,
@@ -1043,6 +1046,7 @@ impl PublishCommand {
                     None,
                     http::FetchRedirect::Follow,
                 );
+                otp_req.client.flags.reject_unauthorized = reject_unauthorized;
 
                 let otp_res = match otp_req.send_sync(&mut response_buf) {
                     Ok(r) => r,
@@ -1257,6 +1261,7 @@ impl PublishCommand {
                     ctx.uses_workspaces,
                     ctx.manager.options.publish_config.auth_type,
                 )?;
+                let reject_unauthorized = ctx.manager.tls_reject_unauthorized();
 
                 let http_proxy = ctx.manager.http_proxy(&done_url);
 
@@ -1275,6 +1280,7 @@ impl PublishCommand {
                         None,
                         http::FetchRedirect::Follow,
                     );
+                    req.client.flags.reject_unauthorized = reject_unauthorized;
 
                     let res = match req.send_sync(response_buf) {
                         Ok(r) => r,
diff --git a/test/cli/install/bun-audit.test.ts b/test/cli/install/bun-audit.test.ts
index 170b0a5782cf..c12026f98d50 100644
--- a/test/cli/install/bun-audit.test.ts
+++ b/test/cli/install/bun-audit.test.ts
@@ -10,6 +10,7 @@ import {
   normalizeBunSnapshot,
   runBunInstall,
   tempDir,
+  tls,
 } from "harness";
 import { join } from "node:path";
 import { resolveBulkAdvisoryFixture } from "./registry/fixtures/audit/audit-fixtures";
@@ -4822,3 +4823,48 @@ describe("`bun audit fix --latest`", () => {
     expect(await lock(dir)).toBe(lockBefore);
   });
 });
+
+describe.concurrent("`bun audit` against a registry with a self-signed certificate", () => {
+  async function audit(env: NodeJS.Dict<string>) {
+    const requests: string[] = [];
+    using auditServer = Bun.serve({
+      port: 0,
+      tls,
+      fetch(req) {
+        requests.push(`${req.method} ${new URL(req.url).pathname}`);
+        return Response.json({});
+      },
+    });
+    using dir = tempDir("bun-test-audit-self-signed", fixture("safe-is-number@7"));
+
+    await using proc = spawn({
+      cmd: [bunExe(), "audit"],
+      stdout: "pipe",
+      stderr: "pipe",
+      cwd: String(dir),
+      env: {
+        ...env,
+        NPM_CONFIG_REGISTRY: `https://localhost:${auditServer.port}`,
+      },
+    });
+    const [stdout, stderr, exitCode] = await Promise.all([proc.stdout.text(), proc.stderr.text(), proc.exited]);
+    return { stdout, stderr, exitCode, requests };
+  }
+
+  test("NODE_TLS_REJECT_UNAUTHORIZED=0 turns verification off", async () => {
+    const { stdout, stderr, exitCode, requests } = await audit({ ...bunEnv, NODE_TLS_REJECT_UNAUTHORIZED: "0" });
+
+    expect(stderr).not.toContain("DEPTH_ZERO_SELF_SIGNED_CERT");
+    expect(stdout).toBe("No vulnerabilities found\n");
+    expect(requests).toEqual(["POST /-/npm/v1/security/advisories/bulk"]);
+    expect(exitCode).toBe(0);
+  });
+
+  test("verification stays on when the variable is unset", async () => {
+    const { stderr, exitCode, requests } = await audit({ ...bunEnv, NODE_TLS_REJECT_UNAUTHORIZED: undefined });
+
+    expect(stderr).toContain("DEPTH_ZERO_SELF_SIGNED_CERT");
+    expect(requests).toEqual([]);
+    expect(exitCode).toBe(1);
+  });
+});
diff --git a/test/cli/install/bun-pm.test.ts b/test/cli/install/bun-pm.test.ts
index 856a3bc73b0c..a6c5cc3f2d80 100644
--- a/test/cli/install/bun-pm.test.ts
+++ b/test/cli/install/bun-pm.test.ts
@@ -1,7 +1,7 @@
 import { spawn } from "bun";
 import { afterAll, afterEach, beforeAll, beforeEach, describe, expect, it, test } from "bun:test";
 import { exists, mkdir, rm, writeFile } from "fs/promises";
-import { bunEnv, bunEnv as env, bunExe, isLinux, isWindows, readdirSorted, tempDir, tmpdirSync } from "harness";
+import { bunEnv, bunEnv as env, bunExe, isLinux, isWindows, readdirSorted, tempDir, tls, tmpdirSync } from "harness";
 import { cpSync } from "node:fs";
 import { join } from "path";
 import {
@@ -900,6 +900,55 @@ test("bun pm whoami still works", async () => {
   expect(exitCode).toBe(1);
 });
 
+describe.concurrent("bun pm whoami against a registry with a self-signed certificate", () => {
+  async function whoami(env: NodeJS.Dict<string>) {
+    const requests: string[] = [];
+    using server = Bun.serve({
+      port: 0,
+      tls,
+      fetch(req) {
+        requests.push(`${req.method} ${new URL(req.url).pathname}`);
+        return Response.json({ username: "self-signed-user" });
+      },
+    });
+    using dir = tempDir("pm-whoami-self-signed", {
+      "package.json": JSON.stringify({ name: "whoami-self-signed", version: "1.0.0" }),
+      "bunfig.toml": Bun.TOML.stringify({
+        install: {
+          cache: false,
+          registry: { url: `https://localhost:${server.port}`, token: "self-signed-token" },
+        },
+      }),
+    });
+    await using proc = Bun.spawn({
+      cmd: [bunExe(), "pm", "whoami"],
+      cwd: String(dir),
+      stdout: "pipe",
+      stderr: "pipe",
+      env,
+    });
+    const [stdout, stderr, exitCode] = await Promise.all([proc.stdout.text(), proc.stderr.text(), proc.exited]);
+    return { stdout, stderr, exitCode, requests };
+  }
+
+  test("NODE_TLS_REJECT_UNAUTHORIZED=0 turns verification off", async () => {
+    const { stdout, stderr, exitCode, requests } = await whoami({ ...bunEnv, NODE_TLS_REJECT_UNAUTHORIZED: "0" });
+
+    expect(stderr).not.toContain("DEPTH_ZERO_SELF_SIGNED_CERT");
+    expect(stdout).toBe("self-signed-user\n");
+    expect(requests).toEqual(["GET /-/whoami"]);
+    expect(exitCode).toBe(0);
+  });
+
+  test("verification stays on when the variable is unset", async () => {
+    const { stderr, exitCode, requests } = await whoami({ ...bunEnv, NODE_TLS_REJECT_UNAUTHORIZED: undefined });
+
+    expect(stderr).toContain("DEPTH_ZERO_SELF_SIGNED_CERT");
+    expect(requests).toEqual([]);
+    expect(exitCode).toBe(1);
+  });
+});
+
 test.each([
   {
     name: "bun list executes pm ls",
diff --git a/test/cli/install/bun-publish.test.ts b/test/cli/install/bun-publish.test.ts
index 4c8b0a1789fa..350cbaf65516 100644
--- a/test/cli/install/bun-publish.test.ts
+++ b/test/cli/install/bun-publish.test.ts
@@ -11,6 +11,7 @@ import {
   pack,
   runBunInstall,
   tempDir,
+  tls,
   tmpdirSync,
 } from "harness";
 import { delimiter, join } from "path";
@@ -1825,3 +1826,96 @@ describe("--tolerate-republish", async () => {
     expect(err).not.toContain("error:");
   });
 });
+
+describe.concurrent("NODE_TLS_REJECT_UNAUTHORIZED=0", () => {
+  const rejectUnauthorizedOff = { ...env, NODE_TLS_REJECT_UNAUTHORIZED: "0" };
+  const rejectUnauthorizedOn = { ...env, NODE_TLS_REJECT_UNAUTHORIZED: undefined };
+
+  // The harness certificate is self-signed, so every request to this registry
+  // fails verification unless the client has turned it off.
+  function selfSignedRegistry(name: string, opts: { otp?: string } = {}) {
+    const requests: string[] = [];
+    const server = Bun.serve({
+      port: 0,
+      tls,
+      fetch(req) {
+        const { pathname } = new URL(req.url);
+        requests.push(`${req.method} ${pathname}`);
+        if (req.method === "PUT") {
+          if (opts.otp !== undefined && req.headers.get("npm-otp") !== opts.otp) {
+            return Response.json(
+              { authUrl: "customapp://login", doneUrl: `https://localhost:${server.port}/-/done` },
+              { status: 401, headers: { "www-authenticate": "OTP" } },
+            );
+          }
+          return new Response("OK");
+        }
+        if (pathname === "/-/done") {
+          return Response.json({ token: opts.otp });
+        }
+        // the --tolerate-republish manifest GET
+        return Response.json({ name, versions: { "1.0.0": {} } });
+      },
+    });
+    const dir = tempDir(`publish-self-signed-${name}`, {
+      "package.json": JSON.stringify({ name, version: "1.0.0" }),
+      "bunfig.toml": Bun.TOML.stringify({
+        install: {
+          cache: false,
+          registry: { url: `https://localhost:${server.port}`, token: "self-signed-token" },
+        },
+      }),
+    });
+    return {
+      requests,
+      packageDir: String(dir),
+      [Symbol.dispose]() {
+        server.stop(true);
+        dir[Symbol.dispose]();
+      },
+    };
+  }
+
+  test("publishes to a registry with a self-signed certificate", async () => {
+    using registry = selfSignedRegistry("tls-publish");
+
+    const { out, err, exitCode } = await publish(rejectUnauthorizedOff, registry.packageDir);
+
+    expect(err).not.toContain("DEPTH_ZERO_SELF_SIGNED_CERT");
+    expect(out).toContain(" + tls-publish@1.0.0");
+    expect(registry.requests).toEqual(["PUT /tls-publish"]);
+    expect(exitCode).toBe(0);
+  });
+
+  test("--tolerate-republish reads the manifest from a registry with a self-signed certificate", async () => {
+    using registry = selfSignedRegistry("tls-republish");
+
+    const { err, exitCode } = await publish(rejectUnauthorizedOff, registry.packageDir, "--tolerate-republish");
+
+    expect(err).toBe("warn: Registry already knows about version 1.0.0; skipping.\n");
+    expect(registry.requests).toEqual(["GET /tls-republish"]);
+    expect(exitCode).toBe(0);
+  });
+
+  test("web login polls the done url and retries with the OTP on a registry with a self-signed certificate", async () => {
+    using registry = selfSignedRegistry("tls-web-login", { otp: "123456" });
+
+    const { out, err, exitCode } = await publish(rejectUnauthorizedOff, registry.packageDir);
+
+    expect(err).not.toContain("DEPTH_ZERO_SELF_SIGNED_CERT");
+    expect(out).toContain("Authenticate your account at:");
+    expect(out).toContain(" + tls-web-login@1.0.0");
+    expect(registry.requests).toEqual(["PUT /tls-web-login", "GET /-/done", "PUT /tls-web-login"]);
+    expect(exitCode).toBe(0);
+  });
+
+  test("certificate verification stays on when the variable is unset", async () => {
+    using registry = selfSignedRegistry("tls-verified");
+
+    const { err, exitCode } = await publish(rejectUnauthorizedOn, registry.packageDir);
+
+    expect(err).toContain("DEPTH_ZERO_SELF_SIGNED_CERT");
+    expect(registry.requests).toEqual([]);
+    expect(exitCode).toBe(1);
+  });
+});

From b4ff8be9563b0df309be9bf563fbc64d36ae5a27 Mon Sep 17 00:00:00 2001
From: robobun <117481402+robobun@users.noreply.github.com>
Date: Mon, 17 Aug 2026 02:28:45 +0000
Subject: [PATCH 150/258] install: escape control characters in resolutions,
 specifiers, bin names and registry error text (#38631)

---
 src/install/PackageInstaller.rs               |   4 +-
 .../PackageManager/PackageManagerEnqueue.rs   |  50 +--
 .../PackageManager/install_with_manager.rs    |   4 +-
 src/install/PackageManager/patchPackage.rs    |   2 +-
 .../PackageManager/processDependencyList.rs   |  13 +-
 src/install/PackageManager/runTasks.rs        |  36 +-
 src/install/dependency.rs                     |   7 +-
 src/install/isolated_install.rs               |  12 +-
 src/install/isolated_install/Installer.rs     |  29 +-
 src/install/lockfile/Package.rs               |   4 +-
 src/install/lockfile/printer/tree_printer.rs  |  32 +-
 src/install/npm.rs                            |  12 +-
 src/install/patch_install.rs                  |   2 +-
 src/install/repository.rs                     |   4 +-
 src/runtime/cli/package_manager_command.rs    |  49 ++-
 src/runtime/cli/publish_command.rs            |   8 +-
 src/runtime/cli/why_command.rs                |  14 +-
 .../install/escape-control-characters.test.ts | 313 ++++++++++++++++++
 18 files changed, 467 insertions(+), 128 deletions(-)
 create mode 100644 test/cli/install/escape-control-characters.test.ts

diff --git a/src/install/PackageInstaller.rs b/src/install/PackageInstaller.rs
index 6016c23ecf1f..532f5a01fe11 100644
--- a/src/install/PackageInstaller.rs
+++ b/src/install/PackageInstaller.rs
@@ -2120,7 +2120,9 @@ impl<'a> PackageInstaller<'a> {
                                             "Blocked {} scripts for: {}@{}\n",
                                             count,
                                             bstr::BStr::new(alias.slice(string_buf!())),
-                                            resolution.fmt(string_buf!(), PathSep::Posix),
+                                            bun_core::fmt::EscapeControlChars(
+                                                resolution.fmt(string_buf!(), PathSep::Posix)
+                                            ),
                                         );
                                     }
                                     let entry = self
diff --git a/src/install/PackageManager/PackageManagerEnqueue.rs b/src/install/PackageManager/PackageManagerEnqueue.rs
index 883019bbcc17..1e150177d76e 100644
--- a/src/install/PackageManager/PackageManagerEnqueue.rs
+++ b/src/install/PackageManager/PackageManagerEnqueue.rs
@@ -115,13 +115,13 @@ pub fn enqueue_dependency_list(
             // `format_args!` borrows temporaries — bind the
             // formatter first so it outlives the macro expansion.
             let realname = dependency.realname();
-            let path_fmt = bun_fmt::fmt_path_u8(
+            let path_fmt = bun_fmt::EscapeControlChars(bun_fmt::fmt_path_u8(
                 this.lockfile.str(&realname),
                 bun_fmt::PathFormatOptions {
                     path_sep,
                     escape_backslashes: false,
                 },
-            );
+            ));
             let log = this.log_mut();
             if dependency.behavior.is_optional() || dependency.behavior.is_peer() {
                 log.add_warning_with_note(
@@ -857,8 +857,8 @@ pub fn enqueue_dependency_with_main_and_success_fn(
                                                 bun_ast::Loc::EMPTY,
                                                 format_args!(
                                                     "Package \"{}\" with tag \"{}\" not found, but package exists",
-                                                    bstr::BStr::new(this.lockfile.str(&name)),
-                                                    bstr::BStr::new(
+                                                    bun_fmt::escape_control_chars(this.lockfile.str(&name)),
+                                                    bun_fmt::escape_control_chars(
                                                         this.lockfile.str(&version.dist_tag().tag)
                                                     ),
                                                 ),
@@ -878,8 +878,10 @@ pub fn enqueue_dependency_with_main_and_success_fn(
                                             None,
                                             bun_ast::Loc::EMPTY,
                                             "No version matching \"{}\" found for specifier \"{}\"<r> <d>(but package exists)<r>",
-                                            bstr::BStr::new(this.lockfile.str(&version.literal)),
-                                            bstr::BStr::new(this.lockfile.str(&name)),
+                                            bun_fmt::escape_control_chars(
+                                                this.lockfile.str(&version.literal)
+                                            ),
+                                            bun_fmt::escape_control_chars(this.lockfile.str(&name)),
                                         );
                                     }
                                 }
@@ -897,8 +899,10 @@ pub fn enqueue_dependency_with_main_and_success_fn(
                                                 None,
                                                 bun_ast::Loc::EMPTY,
                                                 "Package \"{}\" with tag \"{}\" not found<r> <d>(all versions blocked by minimum-release-age: {} seconds)<r>",
-                                                bstr::BStr::new(this.lockfile.str(&name)),
-                                                bstr::BStr::new(
+                                                bun_fmt::escape_control_chars(
+                                                    this.lockfile.str(&name)
+                                                ),
+                                                bun_fmt::escape_control_chars(
                                                     this.lockfile.str(&version.dist_tag().tag)
                                                 ),
                                                 age_gate_ms / MS_PER_S,
@@ -909,10 +913,10 @@ pub fn enqueue_dependency_with_main_and_success_fn(
                                                 None,
                                                 bun_ast::Loc::EMPTY,
                                                 "No version matching \"{}\" found for specifier \"{}\"<r> <d>(blocked by minimum-release-age: {} seconds)<r>",
-                                                bstr::BStr::new(
+                                                bun_fmt::escape_control_chars(
                                                     this.lockfile.str(&version.literal)
                                                 ),
-                                                bstr::BStr::new(this.lockfile.str(&name)),
+                                                bun_fmt::escape_control_chars(this.lockfile.str(&name)),
                                                 age_gate_ms / MS_PER_S,
                                             );
                                         }
@@ -930,8 +934,8 @@ pub fn enqueue_dependency_with_main_and_success_fn(
                                                 bun_ast::Loc::EMPTY,
                                                 format_args!(
                                                     "Could not find package.json for \"file:{}\" dependency \"{}\"",
-                                                    bstr::BStr::new(this.lockfile.str(version.folder())),
-                                                    bstr::BStr::new(this.lockfile.str(&name)),
+                                                    bun_fmt::escape_control_chars(this.lockfile.str(version.folder())),
+                                                    bun_fmt::escape_control_chars(this.lockfile.str(&name)),
                                                 ),
                                             );
                                     } else {
@@ -940,7 +944,9 @@ pub fn enqueue_dependency_with_main_and_success_fn(
                                             bun_ast::Loc::EMPTY,
                                             format_args!(
                                                 "Could not find package.json for dependency \"{}\"",
-                                                bstr::BStr::new(this.lockfile.str(&name)),
+                                                bun_fmt::escape_control_chars(
+                                                    this.lockfile.str(&name)
+                                                ),
                                             ),
                                         );
                                     }
@@ -965,12 +971,12 @@ pub fn enqueue_dependency_with_main_and_success_fn(
                                 bun_core::pretty_errorln!(
                                     "   -> \"{}\": \"{}\" -> {}@{}",
                                     bstr::BStr::new(this.lockfile.str(&result.package.name)),
-                                    bstr::BStr::new(label),
+                                    bun_fmt::escape_control_chars(label),
                                     bstr::BStr::new(this.lockfile.str(&result.package.name)),
-                                    result.package.resolution.fmt(
+                                    bun_fmt::EscapeControlChars(result.package.resolution.fmt(
                                         this.lockfile.buffers.string_bytes.as_slice(),
                                         bun_fmt::PathSep::Auto
-                                    ),
+                                    )),
                                 );
                             }
                             // Resolve dependencies first
@@ -1510,12 +1516,12 @@ pub fn enqueue_dependency_with_main_and_success_fn(
                         bun_core::pretty_errorln!(
                             "   -> \"{}\": \"{}\" -> {}@{}",
                             bstr::BStr::new(this.lockfile.str(&result.package.name)),
-                            bstr::BStr::new(label),
+                            bun_fmt::escape_control_chars(label),
                             bstr::BStr::new(this.lockfile.str(&result.package.name)),
-                            result.package.resolution.fmt(
+                            bun_fmt::EscapeControlChars(result.package.resolution.fmt(
                                 this.lockfile.buffers.string_bytes.as_slice(),
                                 bun_fmt::PathSep::Auto
-                            ),
+                            )),
                         );
                     }
                     // We shouldn't see any dependencies
@@ -2594,7 +2600,7 @@ fn get_or_put_resolved_package(
                                     bun_core::pretty_errorln!(
                                         "<d>[minimum-release-age]<r> <b>{}@{}<r> selected <green>{}<r> instead of <yellow>{}<r> due to {}-second filter",
                                         bstr::BStr::new(package_name),
-                                        bstr::BStr::new(tag_str),
+                                        bun_fmt::escape_control_chars(tag_str),
                                         result.version.fmt(manifest_buf),
                                         newest.fmt(manifest_buf),
                                         min_age_seconds,
@@ -3052,10 +3058,10 @@ fn bind_existing_peer(
                 existing_package
                     .name
                     .fmt(this.lockfile.buffers.string_bytes.as_slice()),
-                existing_package.resolution.fmt(
+                bun_fmt::EscapeControlChars(existing_package.resolution.fmt(
                     this.lockfile.buffers.string_bytes.as_slice(),
                     bun_fmt::PathSep::Auto
-                ),
+                )),
             ),
         );
     }
diff --git a/src/install/PackageManager/install_with_manager.rs b/src/install/PackageManager/install_with_manager.rs
index fd15e795d581..5e99ae2aee38 100644
--- a/src/install/PackageManager/install_with_manager.rs
+++ b/src/install/PackageManager/install_with_manager.rs
@@ -1448,7 +1448,7 @@ fn add_dependency_error(manager: &mut PackageManager, dependency: &Dependency, e
     // taking `&mut` on `manager.log`.
     let realname = dependency.realname();
     let path = manager.lockfile.str(&realname).to_vec();
-    let path_fmt = bun_core::fmt::fmt_path(
+    let path_fmt = bun_core::fmt::EscapeControlChars(bun_core::fmt::fmt_path(
         &path,
         bun_core::fmt::PathFormatOptions {
             path_sep: match dependency.version.tag {
@@ -1457,7 +1457,7 @@ fn add_dependency_error(manager: &mut PackageManager, dependency: &Dependency, e
             },
             ..Default::default()
         },
-    );
+    ));
 
     let log = manager.log_mut();
     if dependency.behavior.is_optional() || dependency.behavior.is_peer() {
diff --git a/src/install/PackageManager/patchPackage.rs b/src/install/PackageManager/patchPackage.rs
index ec2cfeda70a0..dae36ff83267 100644
--- a/src/install/PackageManager/patchPackage.rs
+++ b/src/install/PackageManager/patchPackage.rs
@@ -1408,7 +1408,7 @@ fn pkg_info_for_name_and_version(
         bun_core::pretty_error!(
             "  {}@<blue>{}<r>\n",
             bstr::BStr::new(pkg.name.slice(strbuf)),
-            pkg.resolution.fmt(strbuf, PathSep::Posix)
+            bun_fmt::EscapeControlChars(pkg.resolution.fmt(strbuf, PathSep::Posix))
         );
 
         if i + 1 < pairs.len() {
diff --git a/src/install/PackageManager/processDependencyList.rs b/src/install/PackageManager/processDependencyList.rs
index 92ca76b219fb..f981db7b6c6b 100644
--- a/src/install/PackageManager/processDependencyList.rs
+++ b/src/install/PackageManager/processDependencyList.rs
@@ -154,7 +154,12 @@ impl PackageManager {
                                 Output::err(
                                     err,
                                     "failed to parse package.json for <b>{}<r>",
-                                    format_args!("{}", resolution.fmt_url(string_buf)),
+                                    format_args!(
+                                        "{}",
+                                        bun_core::fmt::EscapeControlChars(
+                                            resolution.fmt_url(string_buf)
+                                        )
+                                    ),
                                 );
                             }
                             self.crash();
@@ -240,7 +245,7 @@ impl PackageManager {
                         let string_buf = self.lockfile.buffers.string_bytes.as_slice();
                         bun_core::pretty_errorln!(
                             "<r><red>error:<r> expected package.json in <b>{}<r> to be a JSON file: {}\n",
-                            resolution.fmt_url(string_buf),
+                            bun_core::fmt::EscapeControlChars(resolution.fmt_url(string_buf)),
                             err.name(),
                         );
                     }
@@ -292,7 +297,9 @@ impl PackageManager {
                                 let string_buf = self.lockfile.buffers.string_bytes.as_slice();
                                 bun_core::pretty_errorln!(
                                     "<r><red>error:<r> expected package.json in <b>{}<r> to be a JSON file: {}\n",
-                                    resolution.fmt_url(string_buf),
+                                    bun_core::fmt::EscapeControlChars(
+                                        resolution.fmt_url(string_buf)
+                                    ),
                                     err.name(),
                                 );
                             }
diff --git a/src/install/PackageManager/runTasks.rs b/src/install/PackageManager/runTasks.rs
index 2828589c97dc..7f9c724973e3 100644
--- a/src/install/PackageManager/runTasks.rs
+++ b/src/install/PackageManager/runTasks.rs
@@ -28,7 +28,7 @@ use crate::isolated_install::store::{EntryColumns as _, NodeColumns as _};
 use crate::lifecycle_script_runner::InstallCtx;
 use crate::network_task::{Authorization, ForTarballError};
 use crate::package_manifest_map::Value as ManifestEntry;
-use bun_core::fmt::PathSep;
+use bun_core::fmt::{EscapeControlChars, PathSep, escape_control_chars};
 use bun_install::lockfile::Package;
 use bun_install::package_manager_task as Task;
 // Import the *module* under the `Options` name so `Options::LogLevel` resolves as a path
@@ -680,10 +680,12 @@ pub fn run_tasks<C: RunTasksCallbacks>(
                                 bun_ast::Loc::EMPTY,
                                 "{} downloading tarball <b>{}@{}<r>. Retrying {}/{}...",
                                 bstr::BStr::new(err.name().as_bytes()),
-                                bstr::BStr::new(extract.name.slice()),
-                                extract
-                                    .resolution
-                                    .fmt(&manager.lockfile.buffers.string_bytes, PathSep::Auto,),
+                                escape_control_chars(extract.name.slice()),
+                                EscapeControlChars(
+                                    extract
+                                        .resolution
+                                        .fmt(&manager.lockfile.buffers.string_bytes, PathSep::Auto),
+                                ),
                                 task.retried,
                                 manager.options.max_retry_count,
                             );
@@ -750,10 +752,12 @@ pub fn run_tasks<C: RunTasksCallbacks>(
                             bun_ast::Loc::EMPTY,
                             "{} downloading tarball <b>{}@{}<r>",
                             err.name(),
-                            bstr::BStr::new(extract.name.slice()),
-                            extract
-                                .resolution
-                                .fmt(&manager.lockfile.buffers.string_bytes, PathSep::Auto,),
+                            escape_control_chars(extract.name.slice()),
+                            EscapeControlChars(
+                                extract
+                                    .resolution
+                                    .fmt(&manager.lockfile.buffers.string_bytes, PathSep::Auto),
+                            ),
                         );
                     } else {
                         bun_ast::add_warning_pretty!(
@@ -762,10 +766,12 @@ pub fn run_tasks<C: RunTasksCallbacks>(
                             bun_ast::Loc::EMPTY,
                             "{} downloading tarball <b>{}@{}<r>",
                             err.name(),
-                            bstr::BStr::new(extract.name.slice()),
-                            extract
-                                .resolution
-                                .fmt(&manager.lockfile.buffers.string_bytes, PathSep::Auto,),
+                            escape_control_chars(extract.name.slice()),
+                            EscapeControlChars(
+                                extract
+                                    .resolution
+                                    .fmt(&manager.lockfile.buffers.string_bytes, PathSep::Auto),
+                            ),
                         );
                     }
                     if manager.subcommand != Subcommand::Remove {
@@ -838,7 +844,7 @@ pub fn run_tasks<C: RunTasksCallbacks>(
                             None,
                             bun_ast::Loc::EMPTY,
                             "<r><red><b>GET<r><red> {}<d> - {}<r>",
-                            bun_core::fmt::redacted_npm_url(metadata.url.slice()),
+                            bun_core::fmt::EscapeControlChars(bun_core::fmt::redacted_npm_url(metadata.url.slice())),
                             response.status_code,
                         );
                     } else {
@@ -847,7 +853,7 @@ pub fn run_tasks<C: RunTasksCallbacks>(
                             None,
                             bun_ast::Loc::EMPTY,
                             "<r><yellow><b>GET<r><yellow> {}<d> - {}<r>",
-                            bun_core::fmt::redacted_npm_url(metadata.url.slice()),
+                            bun_core::fmt::EscapeControlChars(bun_core::fmt::redacted_npm_url(metadata.url.slice())),
                             response.status_code,
                         );
                     }
diff --git a/src/install/dependency.rs b/src/install/dependency.rs
index bae9e1f8cc06..150a83333e1a 100644
--- a/src/install/dependency.rs
+++ b/src/install/dependency.rs
@@ -1500,7 +1500,7 @@ pub(crate) fn parse_with_tag(
                         bun_ast::Loc::EMPTY,
                         format_args!(
                             "invalid or unsupported dependency \"{}\"",
-                            bstr::BStr::new(dependency)
+                            bun_core::fmt::escape_control_chars(dependency)
                         ),
                     );
                 }
@@ -1621,7 +1621,10 @@ pub(crate) fn parse_with_tag(
                     log.add_error_fmt(
                         None,
                         bun_ast::Loc::EMPTY,
-                        format_args!("Unsupported protocol {}", bstr::BStr::new(dependency)),
+                        format_args!(
+                            "Unsupported protocol {}",
+                            bun_core::fmt::escape_control_chars(dependency)
+                        ),
                     );
                 }
                 return None;
diff --git a/src/install/isolated_install.rs b/src/install/isolated_install.rs
index 87e12035a1da..151786381d93 100644
--- a/src/install/isolated_install.rs
+++ b/src/install/isolated_install.rs
@@ -2456,7 +2456,9 @@ pub(crate) fn install_isolated_packages(
                                         "failed to enqueue package for download: {}@{}",
                                         (
                                             BStr::new(pkg_name.slice(string_buf)),
-                                            pkg_res.fmt(string_buf, bun_fmt::PathSep::Auto),
+                                            bun_fmt::EscapeControlChars(
+                                                pkg_res.fmt(string_buf, bun_fmt::PathSep::Auto),
+                                            ),
                                         ),
                                     );
                                     Output::flush();
@@ -2514,7 +2516,9 @@ pub(crate) fn install_isolated_packages(
                                         "failed to enqueue github package for download: {}@{}",
                                         (
                                             BStr::new(pkg_name.slice(string_buf)),
-                                            pkg_res.fmt(string_buf, bun_fmt::PathSep::Auto),
+                                            bun_fmt::EscapeControlChars(
+                                                pkg_res.fmt(string_buf, bun_fmt::PathSep::Auto),
+                                            ),
                                         ),
                                     );
                                     Output::flush();
@@ -2567,7 +2571,9 @@ pub(crate) fn install_isolated_packages(
                                         "failed to enqueue tarball for download: {}@{}",
                                         (
                                             BStr::new(pkg_name.slice(string_buf)),
-                                            pkg_res.fmt(string_buf, bun_fmt::PathSep::Auto),
+                                            bun_fmt::EscapeControlChars(
+                                                pkg_res.fmt(string_buf, bun_fmt::PathSep::Auto),
+                                            ),
                                         ),
                                     );
                                     Output::flush();
diff --git a/src/install/isolated_install/Installer.rs b/src/install/isolated_install/Installer.rs
index 3cca07b0cafe..337d594224bd 100644
--- a/src/install/isolated_install/Installer.rs
+++ b/src/install/isolated_install/Installer.rs
@@ -3,6 +3,7 @@ use std::io::Write as _;
 
 use bun_ast::Log;
 use bun_collections::{ArrayHashMap, DynamicBitSet, StringHashMap};
+use bun_core::fmt::{EscapeControlChars, escape_control_chars};
 use bun_core::{Environment, Global, Output};
 use bun_core::{ZStr, strings};
 use bun_paths::{self as paths, AbsPath, AutoAbsPath, AutoRelPath};
@@ -320,10 +321,10 @@ impl<'a> Installer<'a> {
             Output::err_generic(
                 "failed to download <b>{}@{}<r>: {}\n  <d>{}<r>",
                 (
-                    bstr::BStr::new(name),
-                    resolution.fmt(string_buf, bun_core::fmt::PathSep::Auto),
+                    escape_control_chars(name),
+                    EscapeControlChars(resolution.fmt(string_buf, bun_core::fmt::PathSep::Auto)),
                     bstr::BStr::new(download_error_reason(err)),
-                    bun_core::fmt::redacted_npm_url(url),
+                    EscapeControlChars(bun_core::fmt::redacted_npm_url(url)),
                 ),
             );
             Output::flush();
@@ -392,8 +393,8 @@ impl<'a> Installer<'a> {
                     link_err.clone(),
                     "failed to link package: {}@{}",
                     (
-                        bstr::BStr::new(pkg_name.slice(string_buf)),
-                        pkg_res.fmt(string_buf, bun_core::fmt::PathSep::Auto),
+                        escape_control_chars(pkg_name.slice(string_buf)),
+                        EscapeControlChars(pkg_res.fmt(string_buf, bun_core::fmt::PathSep::Auto)),
                     ),
                 );
             }
@@ -402,8 +403,8 @@ impl<'a> Installer<'a> {
                     symlink_err.clone(),
                     "failed to symlink dependencies for package: {}@{}",
                     (
-                        bstr::BStr::new(pkg_name.slice(string_buf)),
-                        pkg_res.fmt(string_buf, bun_core::fmt::PathSep::Auto),
+                        escape_control_chars(pkg_name.slice(string_buf)),
+                        EscapeControlChars(pkg_res.fmt(string_buf, bun_core::fmt::PathSep::Auto)),
                     ),
                 );
             }
@@ -420,8 +421,8 @@ impl<'a> Installer<'a> {
                 Output::err_generic(
                     "failed to patch package: {}@{}",
                     (
-                        bstr::BStr::new(pkg_name.slice(string_buf)),
-                        pkg_res.fmt(string_buf, bun_core::fmt::PathSep::Auto),
+                        escape_control_chars(pkg_name.slice(string_buf)),
+                        EscapeControlChars(pkg_res.fmt(string_buf, bun_core::fmt::PathSep::Auto)),
                     ),
                 );
                 let _ = patch_log.print(std::ptr::from_mut(Output::error_writer()));
@@ -431,8 +432,8 @@ impl<'a> Installer<'a> {
                     *bin_err,
                     "failed to link binaries for package: {}@{}",
                     (
-                        bstr::BStr::new(pkg_name.slice(string_buf)),
-                        pkg_res.fmt(string_buf, bun_core::fmt::PathSep::Auto),
+                        escape_control_chars(pkg_name.slice(string_buf)),
+                        EscapeControlChars(pkg_res.fmt(string_buf, bun_core::fmt::PathSep::Auto)),
                     ),
                 );
             }
@@ -457,10 +458,10 @@ impl<'a> Installer<'a> {
                 Output::err_generic(
                     "failed to download <b>{}@{}<r>: {}\n  <d>{}<r>",
                     (
-                        bstr::BStr::new(pkg_name.slice(string_buf)),
-                        pkg_res.fmt(string_buf, bun_core::fmt::PathSep::Auto),
+                        escape_control_chars(pkg_name.slice(string_buf)),
+                        EscapeControlChars(pkg_res.fmt(string_buf, bun_core::fmt::PathSep::Auto)),
                         bstr::BStr::new(download_error_reason(dl.err)),
-                        bun_core::fmt::redacted_npm_url(&dl.url),
+                        EscapeControlChars(bun_core::fmt::redacted_npm_url(&dl.url)),
                     ),
                 );
             }
diff --git a/src/install/lockfile/Package.rs b/src/install/lockfile/Package.rs
index 693755d72cf1..f2d69c25e423 100644
--- a/src/install/lockfile/Package.rs
+++ b/src/install/lockfile/Package.rs
@@ -1952,7 +1952,9 @@ impl Package<u64> {
                             format_args!(
                                 "No matching version for workspace dependency \"{}\". Version: \"{}\"",
                                 bstr::BStr::new(external_alias.slice(buf)),
-                                bstr::BStr::new(dependency_version.literal.slice(buf)),
+                                bun_core::fmt::escape_control_chars(
+                                    dependency_version.literal.slice(buf)
+                                ),
                             ),
                         );
                         return Err(crate::Error::InstallFailed);
diff --git a/src/install/lockfile/printer/tree_printer.rs b/src/install/lockfile/printer/tree_printer.rs
index 3bf736768cb6..623da0454523 100644
--- a/src/install/lockfile/printer/tree_printer.rs
+++ b/src/install/lockfile/printer/tree_printer.rs
@@ -4,7 +4,7 @@ use bun_semver as semver;
 
 use crate::lockfile_real::package::PackageColumns as _;
 use crate::package_manager_real::TrackInstalledBin;
-use bun_core::fmt::PathSep;
+use bun_core::fmt::{EscapeControlChars, PathSep, escape_control_chars};
 use bun_install::lockfile::{Printer, package::Meta as PackageMeta};
 use bun_install::{
     self as install, Bin, Dependency, DependencyID, DependencyVersionTag, INVALID_PACKAGE_ID,
@@ -541,16 +541,16 @@ where
                     "<r><green>+<r> <b>{s}<r><d>@{f}<r> <d>(<blue>v{f} available<r><d>)<r>\n",
                     true
                 ),
-                bstr::BStr::new(name),
-                resolution.fmt(string_buf, PathSep::Posix),
+                escape_control_chars(name),
+                EscapeControlChars(resolution.fmt(string_buf, PathSep::Posix)),
                 later_version_fmt,
             )?;
         } else {
             write!(
                 writer,
                 bun_core::pretty_fmt!("<r>+ {s}<r><d>@{f}<r> <d>(v{f} available)<r>\n", false),
-                bstr::BStr::new(name),
-                resolution.fmt(string_buf, PathSep::Posix),
+                escape_control_chars(name),
+                EscapeControlChars(resolution.fmt(string_buf, PathSep::Posix)),
                 later_version_fmt,
             )?;
         }
@@ -562,15 +562,15 @@ where
         write!(
             writer,
             bun_core::pretty_fmt!("<r><green>+<r> <b>{s}<r><d>@{f}<r>\n", true),
-            bstr::BStr::new(name),
-            resolution.fmt(string_buf, PathSep::Posix),
+            escape_control_chars(name),
+            EscapeControlChars(resolution.fmt(string_buf, PathSep::Posix)),
         )?;
     } else {
         write!(
             writer,
             bun_core::pretty_fmt!("<r>+ {s}<r><d>@{f}<r>\n", false),
-            bstr::BStr::new(name),
-            resolution.fmt(string_buf, PathSep::Posix),
+            escape_control_chars(name),
+            EscapeControlChars(resolution.fmt(string_buf, PathSep::Posix)),
         )?;
     }
 
@@ -591,7 +591,7 @@ where
         writer,
         ENABLE_ANSI_COLORS,
         "<r><green>installed<r> <b>{s}<r>",
-        bstr::BStr::new(dependency.name.slice(string_buf)),
+        escape_control_chars(dependency.name.slice(string_buf)),
     )?;
 
     if let Some(npm) = dependency.version.try_npm().filter(|npm| npm.is_alias) {
@@ -599,7 +599,7 @@ where
             writer,
             ENABLE_ANSI_COLORS,
             "<d>@npm:<r><b>{s}<r>",
-            bstr::BStr::new(npm.name.slice(string_buf)),
+            escape_control_chars(npm.name.slice(string_buf)),
         )?;
     }
 
@@ -607,7 +607,7 @@ where
         writer,
         ENABLE_ANSI_COLORS,
         "<d>@{f}<r>",
-        resolution.fmt(string_buf, PathSep::Posix),
+        EscapeControlChars(resolution.fmt(string_buf, PathSep::Posix)),
     )?;
     writer.write_str(if has_binaries {
         " with binaries:\n"
@@ -796,8 +796,8 @@ where
                 writer,
                 ENABLE_ANSI_COLORS,
                 " <r><b>{s}<r><d>@<b>{f}<r>\n",
-                bstr::BStr::new(package_name),
-                resolved[package_id as usize].fmt(string_buf, PathSep::Auto),
+                escape_control_chars(package_name),
+                EscapeControlChars(resolved[package_id as usize].fmt(string_buf, PathSep::Auto)),
             )?;
         }
     }
@@ -863,7 +863,7 @@ where
                                 writer,
                                 ENABLE_ANSI_COLORS,
                                 "<r> <d>- <r><b>{s}<r>\n",
-                                bstr::BStr::new(&owned[..]),
+                                escape_control_chars(&owned[..]),
                             )?;
 
                             manager.track_installed_bin = TrackInstalledBin::Basename(owned);
@@ -875,7 +875,7 @@ where
                             writer,
                             ENABLE_ANSI_COLORS,
                             "<r> <d>- <r><b>{s}<r>\n",
-                            bstr::BStr::new(bin_name),
+                            escape_control_chars(bin_name),
                         )?;
                     }
                 }
diff --git a/src/install/npm.rs b/src/install/npm.rs
index 01821ef4f44e..8890a105a114 100644
--- a/src/install/npm.rs
+++ b/src/install/npm.rs
@@ -184,7 +184,7 @@ pub fn whoami(manager: &mut PackageManager) -> Result<Vec<u8>, WhoamiError> {
 
     if let Some(notice) = res.header_if_other_is_absent(b"npm-notice", b"x-local-cache") {
         Output::print_error("\n");
-        bun_core::note!("{}", bstr::BStr::new(notice));
+        bun_core::note!("{}", bun_fmt::escape_control_chars(notice));
         Output::flush();
     }
 
@@ -250,7 +250,7 @@ pub fn response_error<const OTP_RESPONSE: bool>(
         } else {
             ""
         },
-        bstr::BStr::new(res.status_text()),
+        bun_fmt::escape_control_chars(res.status_text()),
         bun_fmt::redacted_npm_url(req.url.href),
     );
 
@@ -274,7 +274,7 @@ pub fn response_error<const OTP_RESPONSE: bool>(
                 Global::crash();
             }
         }
-        bun_core::pretty_errorln!("\n - {}", bstr::BStr::new(msg));
+        bun_core::pretty_errorln!("\n - {}", bun_fmt::escape_control_chars(msg));
     }
 
     Global::crash();
@@ -2129,7 +2129,7 @@ impl PackageManifest {
                 log.add_error_fmt(
                     Some(&source),
                     bun_ast::Loc::EMPTY,
-                    format_args!("npm error: {}", bstr::BStr::new(err)),
+                    format_args!("npm error: {}", bun_fmt::escape_control_chars(err)),
                 );
                 return Ok(None);
             }
@@ -2165,7 +2165,7 @@ impl PackageManifest {
                     bun_core::warn!(
                         "Package name mismatch. Expected <b>\"{}\"<r> but received <red>\"{}\"<r>",
                         bstr::BStr::new(expected_name),
-                        bstr::BStr::new(received_name),
+                        bun_fmt::escape_control_chars(received_name),
                     );
                 }
             }
@@ -2207,7 +2207,7 @@ impl PackageManifest {
                         prop.key_loc,
                         format_args!(
                             "Failed to parse dependency {}",
-                            bstr::BStr::new(version_name)
+                            bun_fmt::escape_control_chars(version_name)
                         ),
                     );
                     continue;
diff --git a/src/install/patch_install.rs b/src/install/patch_install.rs
index ded1c8904195..96ee9f239e46 100644
--- a/src/install/patch_install.rs
+++ b/src/install/patch_install.rs
@@ -525,7 +525,7 @@ impl PatchTask {
                         &e,
                         format_args!(
                             "failed trying to open temporary dir to apply patch to package: {}",
-                            BStr::new(&resolution_label)
+                            bun_core::fmt::escape_control_chars(&resolution_label)
                         ),
                     );
                     return Ok(());
diff --git a/src/install/repository.rs b/src/install/repository.rs
index d95bfbbf0fa5..f2c37763a328 100644
--- a/src/install/repository.rs
+++ b/src/install/repository.rs
@@ -858,7 +858,7 @@ impl RepositoryExt for Repository {
                     bun_ast::Loc::EMPTY,
                     format_args!(
                         "no commit matching \"{}\" found for \"{}\" (but repository exists)",
-                        BStr::new(committish),
+                        bun_core::fmt::escape_control_chars(committish),
                         BStr::new(name)
                     ),
                 );
@@ -889,7 +889,7 @@ impl RepositoryExt for Repository {
                 bun_ast::Loc::EMPTY,
                 format_args!(
                     "invalid git commit \"{}\" for \"{}\"",
-                    BStr::new(resolved),
+                    bun_core::fmt::escape_control_chars(resolved),
                     BStr::new(name)
                 ),
             );
diff --git a/src/runtime/cli/package_manager_command.rs b/src/runtime/cli/package_manager_command.rs
index dbc3478fdd32..def11b5a0043 100644
--- a/src/runtime/cli/package_manager_command.rs
+++ b/src/runtime/cli/package_manager_command.rs
@@ -756,21 +756,15 @@ Learn more about these at <magenta>https://bun.com/docs/cli/pm<r>.\n";
                     let name = dependencies[dependency_id as usize]
                         .name
                         .slice(string_bytes);
-                    let resolution =
-                        resolutions[package_id as usize].fmt(string_bytes, PathSep::Auto);
+                    let name = bun_fmt::escape_control_chars(name);
+                    let resolution = bun_fmt::EscapeControlChars(
+                        resolutions[package_id as usize].fmt(string_bytes, PathSep::Auto),
+                    );
 
                     if index < sorted_dependencies.len() - 1 {
-                        bun_core::prettyln!(
-                            "<d>├──<r> {}<r><d>@{}<r>\n",
-                            bstr::BStr::new(name),
-                            resolution,
-                        );
+                        bun_core::prettyln!("<d>├──<r> {}<r><d>@{}<r>\n", name, resolution);
                     } else {
-                        bun_core::prettyln!(
-                            "<d>└──<r> {}<r><d>@{}<r>\n",
-                            bstr::BStr::new(name),
-                            resolution,
-                        );
+                        bun_core::prettyln!("<d>└──<r> {}<r><d>@{}<r>\n", name, resolution);
                     }
                 }
             }
@@ -911,11 +905,15 @@ fn print_node_modules_folder_structure(
             if let Some(j) = strings::index_of(path, b"node_modules") {
                 bun_core::prettyln!(
                     "{}<d>@{}<r>",
-                    bstr::BStr::new(&path[0..j - 1]),
-                    directory_version,
+                    bun_fmt::escape_control_chars(&path[0..j - 1]),
+                    bun_fmt::EscapeControlChars(directory_version),
                 );
             } else {
-                bun_core::prettyln!("{}<d>@{}<r>", bstr::BStr::new(path), directory_version);
+                bun_core::prettyln!(
+                    "{}<d>@{}<r>",
+                    bun_fmt::escape_control_chars(path),
+                    bun_fmt::EscapeControlChars(directory_version),
+                );
             }
         } else {
             let mut cwd_buf = PathBuffer::uninit();
@@ -1024,8 +1022,8 @@ fn print_node_modules_folder_structure(
 
         bun_core::prettyln!(
             "{}<d>@{}<r>",
-            bstr::BStr::new(package_name),
-            resolutions[package_id as usize].fmt(string_bytes, PathSep::Auto),
+            bun_fmt::escape_control_chars(package_name),
+            bun_fmt::EscapeControlChars(resolutions[package_id as usize].fmt(string_bytes, PathSep::Auto)),
         );
     }
 
@@ -1091,19 +1089,14 @@ fn print_trusted_dependencies_flat(
     for (index, &dep_id) in trusted.iter().enumerate() {
         let package_id = resolutions_buf[dep_id as usize];
         let name = dependencies[dep_id as usize].name.slice(string_bytes);
-        let resolution = resolutions[package_id as usize].fmt(string_bytes, PathSep::Auto);
+        let name = bun_fmt::escape_control_chars(name);
+        let resolution = bun_fmt::EscapeControlChars(
+            resolutions[package_id as usize].fmt(string_bytes, PathSep::Auto),
+        );
         if index + 1 < trusted.len() {
-            bun_core::prettyln!(
-                "<d>├──<r> {}<r><d>@{}<r>\n",
-                bstr::BStr::new(name),
-                resolution,
-            );
+            bun_core::prettyln!("<d>├──<r> {}<r><d>@{}<r>\n", name, resolution);
         } else {
-            bun_core::prettyln!(
-                "<d>└──<r> {}<r><d>@{}<r>\n",
-                bstr::BStr::new(name),
-                resolution,
-            );
+            bun_core::prettyln!("<d>└──<r> {}<r><d>@{}<r>\n", name, resolution);
         }
     }
 }
diff --git a/src/runtime/cli/publish_command.rs b/src/runtime/cli/publish_command.rs
index 7184d84117b5..6f7c3d2e8e3d 100644
--- a/src/runtime/cli/publish_command.rs
+++ b/src/runtime/cli/publish_command.rs
@@ -988,7 +988,7 @@ impl PublishCommand {
 
                         Output::err_generic(
                             "unable to authenticate, need: {}",
-                            (bstr::BStr::new(www_authenticate),),
+                            (bun_fmt::escape_control_chars(www_authenticate),),
                         );
                         Global::crash();
                     } else if strings::contains(&response_buf.list, b"one-time pass") {
@@ -1014,7 +1014,7 @@ impl PublishCommand {
                 if let Some(notice) = res.header_if_other_is_absent(b"npm-notice", b"x-local-cache")
                 {
                     Output::print_error(format_args!("\n"));
-                    bun_core::note!("{}", bstr::BStr::new(notice));
+                    bun_core::note!("{}", bun_fmt::escape_control_chars(notice));
                     Output::flush();
                 }
 
@@ -1075,7 +1075,7 @@ impl PublishCommand {
                             otp_res.header_if_other_is_absent(b"npm-notice", b"x-local-cache")
                         {
                             Output::print_error(format_args!("\n"));
-                            bun_core::note!("{}", bstr::BStr::new(notice));
+                            bun_core::note!("{}", bun_fmt::escape_control_chars(notice));
                             Output::flush();
                         }
                     }
@@ -1355,7 +1355,7 @@ impl PublishCommand {
                                 res.header_if_other_is_absent(b"npm-notice", b"x-local-cache")
                             {
                                 Output::print_error(format_args!("\n"));
-                                bun_core::note!("{}", bstr::BStr::new(notice));
+                                bun_core::note!("{}", bun_fmt::escape_control_chars(notice));
                                 Output::flush();
                             }
 
diff --git a/src/runtime/cli/why_command.rs b/src/runtime/cli/why_command.rs
index a4ba088cf79b..3e4353ee2cd4 100644
--- a/src/runtime/cli/why_command.rs
+++ b/src/runtime/cli/why_command.rs
@@ -5,7 +5,7 @@ use std::io::Write as _;
 use bstr::BStr;
 
 use bun_collections::HashMap;
-use bun_core::fmt::PathSep;
+use bun_core::fmt::{PathSep, escape_control_chars};
 use bun_core::strings;
 use bun_core::{Global, Output};
 use bun_install::dependency::Behavior;
@@ -476,8 +476,8 @@ impl WhyCommand {
             let target_name = pkg_names[target_version.pkg_id as usize].slice(string_bytes);
             bun_core::prettyln!(
                 "<b>{}@{}<r>",
-                BStr::new(target_name),
-                BStr::new(&target_version.version)
+                escape_control_chars(target_name),
+                escape_control_chars(&target_version.version)
             );
 
             if let Some(dependents) = all_dependents.get(&target_version.pkg_id) {
@@ -542,19 +542,19 @@ fn print_package_with_type(prefix: &[u8], package: &DependentInfo) {
     }
 
     if package.workspace {
-        bun_core::pretty!("<blue>{}<r>", BStr::new(&package.name));
+        bun_core::pretty!("<blue>{}<r>", escape_control_chars(&package.name));
         if !package.version.is_empty() {
             bun_core::pretty!("<d><blue>@workspace<r>");
         }
     } else {
-        bun_core::pretty!("{}", BStr::new(&package.name));
+        bun_core::pretty!("{}", escape_control_chars(&package.name));
         if !package.version.is_empty() {
-            bun_core::pretty!("<d>@{}<r>", BStr::new(&package.version));
+            bun_core::pretty!("<d>@{}<r>", escape_control_chars(&package.version));
         }
     }
 
     if !package.spec.is_empty() {
-        bun_core::prettyln!(" <d>(requires {})<r>", BStr::new(&package.spec));
+        bun_core::prettyln!(" <d>(requires {})<r>", escape_control_chars(&package.spec));
     } else {
         bun_core::prettyln!("");
     }
diff --git a/test/cli/install/escape-control-characters.test.ts b/test/cli/install/escape-control-characters.test.ts
new file mode 100644
index 000000000000..14cd2936dad7
--- /dev/null
+++ b/test/cli/install/escape-control-characters.test.ts
@@ -0,0 +1,313 @@
+/**
+ * Strings the package manager prints but did not write itself must not be able
+ * to smuggle terminal control sequences into the user's terminal: here, the
+ * resolution and version specifier of a dependency (which any package.json in
+ * the tree controls), bin names (which the package controls), and the text of a
+ * registry's error response. Each control character has to come out spelled
+ * as its escape (`\x1b`, `\u009b`, ...).
+ *
+ * One fake registry serves every test. Any package name resolves to a packument
+ * whose 1.0.0 installs cleanly and whose 2.0.0 (the `latest` tag) depends on a
+ * dist-tag that does not exist; every tarball carries a poisoned bin name.
+ */
+import { afterAll, beforeAll, expect, test } from "bun:test";
+import { bunEnv, bunExe, isWindows, tempDir } from "harness";
+import { rm } from "node:fs/promises";
+import { join } from "node:path";
+
+// OSC "set window title" followed by CSI "clear screen".
+const ESC = "\x1b]0;pwned\x07\x1b[2J";
+const ESC_ESCAPED = "\\x1b]0;pwned\\x07\\x1b[2J";
+
+// U+009B is the one-character (C1) spelling of CSI. Unlike C0 bytes and DEL it
+// is accepted in file names, in URLs (bun percent-encodes it on the wire but
+// prints the specifier as written) and in an HTTP status line.
+const C1 = "\u009b31m";
+const C1_ESCAPED = "\\u009b31m";
+
+const BIN = `bin-${C1}-name`;
+const BIN_ESCAPED = `bin-${C1_ESCAPED}-name`;
+// Text that must come through untouched, next to the bytes that must not: a
+// backslash, `\u00a9` (also a two-byte character starting with 0xC2, like the C1
+// controls), a three-byte character, a four-byte one, a tab and DEL.
+const PASSTHROUGH = "a\\b \u00a9 \u20ac \u{1f600}";
+const BAD_TAG = `tag-${ESC}${PASSTHROUGH}\t${C1}\x7f`;
+const BAD_TAG_ESCAPED = `tag-${ESC_ESCAPED}${PASSTHROUGH}\\t${C1_ESCAPED}\\x7f`;
+
+// bun's own output is printable text and newlines; any other C0 byte, DEL or
+// C1 character in stdout/stderr came through from the fixture unescaped.
+const RAW_CONTROL = /[\x00-\x09\x0b-\x1f\x7f\x80-\x9f]/;
+
+let registry: Bun.Server;
+let registryUrl: string;
+let tarball: Promise<Uint8Array>;
+/** A tarball specifier that installs (the server ignores the path). */
+let tarballSpec: string;
+let tarballSpecEscaped: string;
+/** `dist.tarball` of `<name>` for the packages whose tarball tests break on purpose. */
+const distTarball = (name: string) => `${registryUrl}/${name}/-/dep-${C1}.tgz`;
+const distTarballEscaped = (name: string) => `${registryUrl}/${name}/-/dep-${C1_ESCAPED}.tgz`;
+/** Decoded request paths the server answers with a 404. */
+const brokenTarballPaths = new Set<string>();
+
+function packumentFor(name: string) {
+  const manifest = (version: string, dependencies: Record<string, string>) => ({
+    name,
+    version,
+    dist: { tarball: distTarball(name) },
+    bin: { [BIN]: "index.js" },
+    dependencies,
+  });
+  return {
+    name,
+    "dist-tags": { latest: "2.0.0", [`tag-${C1}`]: "1.0.0" },
+    versions: {
+      "1.0.0": manifest("1.0.0", name === "needs-dep" ? { dep: "1.0.0" } : {}),
+      "2.0.0": manifest("2.0.0", { sub: BAD_TAG }),
+    },
+  };
+}
+
+beforeAll(() => {
+  tarball = new Bun.Archive(
+    {
+      "package/package.json": JSON.stringify({ name: "dep", version: "1.0.0", bin: { [BIN]: "index.js" } }),
+      "package/index.js": "#!/usr/bin/env node\n",
+    },
+    { compress: "gzip" },
+  ).bytes();
+
+  registry = Bun.serve({
+    port: 0,
+    async fetch(req) {
+      const pathname = decodeURIComponent(new URL(req.url).pathname);
+      if (brokenTarballPaths.has(pathname)) {
+        return new Response("gone", { status: 404 });
+      }
+      if (pathname.startsWith("/failing/")) {
+        return new Response("try again", { status: 500 });
+      }
+      if (pathname.endsWith(".tgz")) {
+        return new Response(await tarball);
+      }
+      return Response.json(packumentFor(pathname.slice(1)));
+    },
+  });
+  registryUrl = `http://127.0.0.1:${registry.port}`;
+  tarballSpec = `${registryUrl}/tarballs/dep-${C1}.tgz`;
+  tarballSpecEscaped = `${registryUrl}/tarballs/dep-${C1_ESCAPED}.tgz`;
+  brokenTarballPaths.add(decodeURIComponent(new URL(distTarball("broken-tarball")).pathname));
+});
+
+afterAll(() => {
+  registry?.stop(true);
+});
+
+function project(name: string, packageJson: object, registry = registryUrl) {
+  return tempDir(`escape-controls-${name}`, {
+    "package.json": JSON.stringify({ name: "app", version: "1.0.0", ...packageJson }),
+    "bunfig.toml": `[install]\nregistry = "${registry}"\n`,
+  });
+}
+
+async function run(cwd: string, ...args: string[]) {
+  await using proc = Bun.spawn({
+    cmd: [bunExe(), ...args],
+    cwd,
+    env: { ...bunEnv, BUN_INSTALL_CACHE_DIR: join(cwd, ".bun-cache") },
+    stdout: "pipe",
+    stderr: "pipe",
+  });
+  const [stdout, stderr, exitCode] = await Promise.all([proc.stdout.text(), proc.stderr.text(), proc.exited]);
+  return { stdout, stderr, exitCode };
+}
+
+async function installOk(dir: string) {
+  const result = await run(dir, "install");
+  expect(result.stderr).not.toContain("error:");
+  expect(result.exitCode).toBe(0);
+  return result;
+}
+
+test.concurrent("bun install summary escapes the resolution", async () => {
+  using dir = project("install", { dependencies: { dep: tarballSpec } });
+  const { stdout, stderr } = await installOk(String(dir));
+  expect(stdout).toContain(`+ dep@${tarballSpecEscaped}`);
+  expect(stdout + stderr).not.toMatch(RAW_CONTROL);
+});
+
+test.concurrent("bun pm ls escapes the resolution", async () => {
+  using dir = project("pm-ls", { dependencies: { dep: tarballSpec } });
+  await installOk(String(dir));
+  for (const args of [
+    ["pm", "ls"],
+    ["pm", "ls", "--all"],
+  ]) {
+    const { stdout, stderr, exitCode } = await run(String(dir), ...args);
+    expect(stdout).toContain(`dep@${tarballSpecEscaped}`);
+    expect(stdout + stderr).not.toMatch(RAW_CONTROL);
+    expect(exitCode).toBe(0);
+  }
+});
+
+test.concurrent("bun why escapes the resolution and the specifier", async () => {
+  using dir = project("why", { dependencies: { dep: tarballSpec } });
+  await installOk(String(dir));
+  const { stdout, stderr, exitCode } = await run(String(dir), "why", "dep");
+  expect(stdout).toContain(`dep@${tarballSpecEscaped}`);
+  expect(stdout).toContain(`(requires ${tarballSpecEscaped})`);
+  expect(stdout + stderr).not.toMatch(RAW_CONTROL);
+  expect(exitCode).toBe(0);
+});
+
+test.concurrent("bun add escapes the bin names it reports", async () => {
+  using dir = project("add", {});
+  const { stdout, stderr, exitCode } = await run(String(dir), "add", "has-bin@1.0.0");
+  expect(stdout).toContain("installed has-bin@1.0.0 with binaries:");
+  expect(stdout).toContain(` - ${BIN_ESCAPED}`);
+  expect(stdout + stderr).not.toMatch(RAW_CONTROL);
+  expect(exitCode).toBe(0);
+});
+
+test.concurrent("resolution errors escape the dist-tag", async () => {
+  using dir = project("dist-tag", {});
+  const { stdout, stderr, exitCode } = await run(String(dir), "add", "unresolvable");
+  expect(stderr).toContain(`Package "sub" with tag "${BAD_TAG_ESCAPED}" not found, but package exists`);
+  expect(stderr).toContain(`sub@${BAD_TAG_ESCAPED} failed to resolve`);
+  expect(stdout + stderr).not.toMatch(RAW_CONTROL);
+  expect(exitCode).toBe(1);
+});
+
+test.concurrent("resolution errors escape a file: path", async () => {
+  using dir = project("file-path", { dependencies: { dep: `file:./missing-${C1}` } });
+  const { stdout, stderr, exitCode } = await run(String(dir), "install");
+  expect(stderr).toContain(`Could not find package.json for "file:missing-${C1_ESCAPED}" dependency "dep"`);
+  expect(stdout + stderr).not.toMatch(RAW_CONTROL);
+  expect(exitCode).toBe(1);
+});
+
+test.concurrent("bun patch lists the candidate resolutions escaped", async () => {
+  // Two lockfile entries named `dep`: the root's tarball and the registry's
+  // 1.0.0 that `needs-dep` depends on, so `bun patch dep` has to ask which one.
+  using dir = project("patch", { dependencies: { dep: tarballSpec, "needs-dep": "1.0.0" } });
+  await installOk(String(dir));
+  const { stdout, stderr, exitCode } = await run(String(dir), "patch", "dep");
+  expect(stderr).toContain("Found multiple versions of dep");
+  expect(stderr).toContain(`dep@${tarballSpecEscaped}`);
+  expect(stdout + stderr).not.toMatch(RAW_CONTROL);
+  expect(exitCode).not.toBe(0);
+});
+
+test.concurrent("a workspace range that matches nothing is reported escaped", async () => {
+  using dir = tempDir("escape-controls-workspace-range", {
+    "package.json": JSON.stringify({
+      name: "app",
+      version: "1.0.0",
+      workspaces: ["packages/*"],
+      dependencies: { ws: `workspace:^2.0.0-${C1}` },
+    }),
+    "packages/ws/package.json": JSON.stringify({ name: "ws", version: "1.0.0" }),
+  });
+  const { stdout, stderr, exitCode } = await run(String(dir), "install");
+  expect(stderr).toContain(
+    `No matching version for workspace dependency "ws". Version: "workspace:^2.0.0-${C1_ESCAPED}"`,
+  );
+  expect(stdout + stderr).not.toMatch(RAW_CONTROL);
+  expect(exitCode).toBe(1);
+});
+
+test.concurrent("a tarball specifier bun rejects is reported with the specifier escaped", async () => {
+  // C0 bytes are not valid in a URL, so this never gets as far as a request.
+  using dir = project("invalid-url", { dependencies: { dep: `${registryUrl}/tarballs/dep-${ESC}.tgz` } });
+  const { stdout, stderr, exitCode } = await run(String(dir), "install");
+  expect(stderr).toContain(`InvalidURL downloading tarball dep@${registryUrl}/tarballs/dep-${ESC_ESCAPED}.tgz`);
+  expect(stderr).toContain(`dep@${registryUrl}/tarballs/dep-${ESC_ESCAPED}.tgz failed to resolve`);
+  expect(stdout + stderr).not.toMatch(RAW_CONTROL);
+  expect(exitCode).toBe(1);
+});
+
+test.concurrent("the verbose resolve trace escapes the specifier and the resolution", async () => {
+  using dir = tempDir("escape-controls-resolve-trace", {
+    "package.json": JSON.stringify({
+      name: "app",
+      version: "1.0.0",
+      workspaces: ["packages/*"],
+      dependencies: { dep: `tag-${C1}`, ws: "workspace:*" },
+    }),
+    "bunfig.toml": `[install]\nregistry = "${registryUrl}"\n`,
+    [`packages/ws-${C1}/package.json`]: JSON.stringify({ name: "ws", version: "1.0.0" }),
+  });
+  const { stderr, exitCode } = await run(String(dir), "install", "--verbose");
+  // --verbose also dumps the HTTP client's request trace, which is not package
+  // manager output, so only the package manager's own lines are checked here.
+  expect(stderr).toContain(`"dep": "tag-${C1_ESCAPED}"`);
+  expect(stderr).toContain(`"ws": "packages/ws-${C1_ESCAPED}"`);
+  // The trace prints the resolution with the platform's path separator.
+  expect(stderr).toContain(`ws@workspace:packages${isWindows ? "\\" : "/"}ws-${C1_ESCAPED}`);
+  expect(stderr).not.toContain(`tag-${C1}`);
+  expect(stderr).not.toContain(`ws-${C1}`);
+  expect(exitCode).toBe(0);
+});
+
+test.concurrent("the verbose retry warning escapes the resolution", async () => {
+  // A 5xx is retried, and each retry is reported under --verbose before the final error.
+  const spec = `${registryUrl}/failing/dep-${C1}.tgz`;
+  const specEscaped = `${registryUrl}/failing/dep-${C1_ESCAPED}.tgz`;
+  using dir = project("retry", { dependencies: { dep: spec } });
+  const { stderr, exitCode } = await run(String(dir), "install", "--verbose");
+  // --verbose also dumps the HTTP client's request trace, which is not package
+  // manager output, so only the package manager's own lines are checked here.
+  expect(stderr).toContain(`downloading tarball dep@${specEscaped}. Retrying 1/`);
+  expect(stderr).toContain(`GET ${specEscaped} - 500`);
+  expect(stderr).not.toContain(`dep@${spec}`);
+  expect(stderr).not.toContain(`${spec} - 500`);
+  expect(exitCode).toBe(1);
+});
+
+test.concurrent("a tarball the registry cannot serve is reported with its URL escaped", async () => {
+  using dir = project("tarball-404", { dependencies: { "broken-tarball": "1.0.0" } });
+  const { stdout, stderr, exitCode } = await run(String(dir), "install");
+  expect(stderr).toContain(`GET ${distTarballEscaped("broken-tarball")} - 404`);
+  expect(stdout + stderr).not.toMatch(RAW_CONTROL);
+  expect(exitCode).toBe(1);
+});
+
+test.concurrent("the isolated installer reports a failed download with its URL escaped", async () => {
+  // With a lockfile already present, the isolated installer downloads the
+  // tarballs itself and reports failures through its own message.
+  using dir = project("isolated-404", { dependencies: { "breaks-later": "1.0.0" } });
+  await installOk(String(dir));
+  brokenTarballPaths.add(decodeURIComponent(new URL(distTarball("breaks-later")).pathname));
+  await rm(join(String(dir), "node_modules"), { recursive: true });
+  await rm(join(String(dir), ".bun-cache"), { recursive: true });
+
+  const { stdout, stderr, exitCode } = await run(String(dir), "install", "--linker", "isolated");
+  expect(stderr).toContain("failed to download breaks-later@1.0.0: 404 Not Found");
+  expect(stderr).toContain(`  ${distTarballEscaped("breaks-later")}`);
+  expect(stdout + stderr).not.toMatch(RAW_CONTROL);
+  expect(exitCode).toBe(1);
+});
+
+test.concurrent("registry error responses are escaped", async () => {
+  const body = JSON.stringify({ error: `denied${ESC}` });
+  const response =
+    `HTTP/1.1 403 Nope${C1}\r\n` +
+    `Content-Type: application/json\r\nContent-Length: ${Buffer.byteLength(body)}\r\nConnection: close\r\n\r\n` +
+    body;
+  using rawRegistry = Bun.listen({
+    hostname: "127.0.0.1",
+    port: 0,
+    socket: {
+      data(socket) {
+        socket.end(response);
+      },
+    },
+  });
+  using dir = project("registry-error", {}, `http://127.0.0.1:${rawRegistry.port}`);
+
+  const { stdout, stderr, exitCode } = await run(String(dir), "pm", "view", "forbidden");
+  expect(stderr).toContain(`403 Nope${C1_ESCAPED}: http://127.0.0.1:${rawRegistry.port}/forbidden`);
+  expect(stderr).toContain(` - denied${ESC_ESCAPED}`);
+  expect(stdout + stderr).not.toMatch(RAW_CONTROL);
+  expect(exitCode).toBe(1);
+});

From 7fd4f9f58664fc8d431878b1de5b4f1a9a6abe51 Mon Sep 17 00:00:00 2001
From: robobun <117481402+robobun@users.noreply.github.com>
Date: Mon, 17 Aug 2026 02:32:37 +0000
Subject: [PATCH 151/258] install: redact credentials in tarball and git URLs
 printed as resolutions and specifiers (#38977)

---
 src/bun_core/fmt.rs                           |  25 ++
 src/bun_core/lib.rs                           |  24 +-
 src/install/PackageInstaller.rs               |   6 +-
 .../PackageManager/PackageManagerEnqueue.rs   |   4 +-
 .../PackageManagerResolution.rs               |  13 +-
 .../PackageManager/processDependencyList.rs   |  14 +-
 src/install/PackageManager/runTasks.rs        |  20 +-
 src/install/isolated_install.rs               |   4 +-
 src/install/isolated_install/Installer.rs     |  25 +-
 src/install/lockfile/Package/Scripts.rs       |   5 +-
 src/install/lockfile/printer/tree_printer.rs  |  17 +-
 src/install/patch_install.rs                  |   2 +-
 src/jsc/AsyncModule.rs                        |  24 +-
 src/runtime/cli/package_manager_command.rs    |  18 +-
 src/runtime/cli/pm_licenses_command.rs        |   9 +-
 src/runtime/cli/why_command.rs                |  10 +-
 test/cli/install/redacted-config-logs.test.ts | 226 ++++++++++++++++++
 test/js/bun/util/highlighter.test.ts          |  14 ++
 18 files changed, 363 insertions(+), 97 deletions(-)

diff --git a/src/bun_core/fmt.rs b/src/bun_core/fmt.rs
index bbb8330e2761..1b9070fd8e3c 100644
--- a/src/bun_core/fmt.rs
+++ b/src/bun_core/fmt.rs
@@ -285,6 +285,31 @@ pub fn redacted_npm_url(str: &[u8]) -> RedactedNpmUrlFormatter<'_> {
     RedactedNpmUrlFormatter { url: str }
 }
 
+/// [`redacted_npm_url`] for a value that only exists as a `Display` impl: a
+/// lockfile resolution or a dependency specifier, which is the tarball or git
+/// URL written in package.json when the package came from one. Anything that
+/// does not contain a URL (a version, a path, a `github:` specifier) is written
+/// unchanged: the token and UUID masks are meant for URLs, and a version whose
+/// pre-release tag happens to look like one must not be masked.
+pub struct Redacted<T>(T);
+
+impl<T: Display> Display for Redacted<T> {
+    fn fmt(&self, f: &mut Formatter<'_>) -> fmt::Result {
+        // Rendered in full first: the inner impl may write in pieces, and the
+        // password scan is anchored at the start of the whole value.
+        let mut text = String::new();
+        write!(text, "{}", self.0)?;
+        if !strings::contains(text.as_bytes(), b"://") {
+            return f.write_str(&text);
+        }
+        redacted_npm_url(text.as_bytes()).fmt(f)
+    }
+}
+
+pub fn redacted<T: Display>(value: T) -> Redacted<T> {
+    Redacted(value)
+}
+
 // ───────────────────────────────────────────────────────────────────────────
 // RedactedSourceFormatter
 // ───────────────────────────────────────────────────────────────────────────
diff --git a/src/bun_core/lib.rs b/src/bun_core/lib.rs
index f53e3a38fcd4..5232b1ab93b7 100644
--- a/src/bun_core/lib.rs
+++ b/src/bun_core/lib.rs
@@ -2128,17 +2128,23 @@ pub(crate) mod strings_impl {
 
     /// Port of `bun.fmt.URLFormatter.findUrlPassword` — returns
     /// `(offset, len)` of the password segment, or None.
-    /// Only matches http:// and https:// schemes and rejects empty pw.
+    /// `s` must start with a URL (`https://`, `git+ssh://`, ...); rejects an
+    /// empty password.
     pub(crate) fn find_url_password(s: &[u8]) -> Option<(usize, usize)> {
-        // Case-sensitive prefix match; the search region is truncated at the
-        // first '\n' and at the end of the authority before scanning for '@'/':'.
-        let scheme_end = if s.starts_with(b"http://") {
-            7
-        } else if s.starts_with(b"https://") {
-            8
-        } else {
+        // RFC 3986 scheme (`git+https` is one scheme) followed by `://`; the
+        // search region is truncated at the first '\n' and at the end of the
+        // authority before scanning for '@'/':'.
+        if !s.first().is_some_and(u8::is_ascii_alphabetic) {
             return None;
-        };
+        }
+        let scheme_len = s
+            .iter()
+            .take_while(|&&b| b.is_ascii_alphanumeric() || matches!(b, b'+' | b'-' | b'.'))
+            .count();
+        if !s[scheme_len..].starts_with(b"://") {
+            return None;
+        }
+        let scheme_end = scheme_len + b"://".len();
         let mut rest = &s[scheme_end..];
         if let Some(nl) = crate::strings::index_of_char_usize(rest, b'\n') {
             rest = &rest[..nl];
diff --git a/src/install/PackageInstaller.rs b/src/install/PackageInstaller.rs
index 532f5a01fe11..a12ea5311187 100644
--- a/src/install/PackageInstaller.rs
+++ b/src/install/PackageInstaller.rs
@@ -1,7 +1,7 @@
 use core::sync::atomic::Ordering;
 
 use bun_collections::{ArrayHashMap, DynamicBitSet, StringHashMap};
-use bun_core::fmt::PathSep;
+use bun_core::fmt::{PathSep, redacted};
 use bun_core::{Global, Output};
 use bun_core::{ZStr, strings};
 use bun_paths::resolve_path::{dirname, join_abs_string_z, join_z_buf};
@@ -2120,9 +2120,7 @@ impl<'a> PackageInstaller<'a> {
                                             "Blocked {} scripts for: {}@{}\n",
                                             count,
                                             bstr::BStr::new(alias.slice(string_buf!())),
-                                            bun_core::fmt::EscapeControlChars(
-                                                resolution.fmt(string_buf!(), PathSep::Posix)
-                                            ),
+                                            bun_core::fmt::EscapeControlChars(redacted(resolution.fmt(string_buf!(), PathSep::Posix))),
                                         );
                                     }
                                     let entry = self
diff --git a/src/install/PackageManager/PackageManagerEnqueue.rs b/src/install/PackageManager/PackageManagerEnqueue.rs
index 1e150177d76e..434346eef70c 100644
--- a/src/install/PackageManager/PackageManagerEnqueue.rs
+++ b/src/install/PackageManager/PackageManagerEnqueue.rs
@@ -3058,10 +3058,10 @@ fn bind_existing_peer(
                 existing_package
                     .name
                     .fmt(this.lockfile.buffers.string_bytes.as_slice()),
-                bun_fmt::EscapeControlChars(existing_package.resolution.fmt(
+                bun_fmt::EscapeControlChars(bun_fmt::redacted(existing_package.resolution.fmt(
                     this.lockfile.buffers.string_bytes.as_slice(),
                     bun_fmt::PathSep::Auto
-                )),
+                ))),
             ),
         );
     }
diff --git a/src/install/PackageManager/PackageManagerResolution.rs b/src/install/PackageManager/PackageManagerResolution.rs
index 383d98846fec..2237bcd90a9e 100644
--- a/src/install/PackageManager/PackageManagerResolution.rs
+++ b/src/install/PackageManager/PackageManagerResolution.rs
@@ -2,6 +2,7 @@ use crate::lockfile::package::PackageColumns as _;
 use core::mem::ManuallyDrop;
 
 use bun_core::Output;
+use bun_core::fmt::redacted;
 use bun_core::strings;
 use bun_paths::PathBuffer;
 use bun_semver as semver;
@@ -387,20 +388,14 @@ impl PackageManager {
                     {
                         Output::err_generic(
                             "<b>{}<r><d> failed to resolve<r>",
-                            (bun_core::fmt::escape_control_chars(
-                                failed_dep.version.literal.slice(string_buf),
-                            ),),
+                            (bun_core::fmt::EscapeControlChars(redacted(failed_dep.version.literal.fmt(string_buf))),),
                         );
                     } else {
                         Output::err_generic(
                             "<b>{}<r><d>@<b>{}<r><d> failed to resolve<r>",
                             (
-                                bun_core::fmt::escape_control_chars(
-                                    failed_dep.name.slice(string_buf),
-                                ),
-                                bun_core::fmt::escape_control_chars(
-                                    failed_dep.version.literal.slice(string_buf),
-                                ),
+                                bun_core::fmt::escape_control_chars(failed_dep.name.slice(string_buf)),
+                                bun_core::fmt::EscapeControlChars(redacted(failed_dep.version.literal.fmt(string_buf))),
                             ),
                         );
                     }
diff --git a/src/install/PackageManager/processDependencyList.rs b/src/install/PackageManager/processDependencyList.rs
index f981db7b6c6b..0b6c92a44d3b 100644
--- a/src/install/PackageManager/processDependencyList.rs
+++ b/src/install/PackageManager/processDependencyList.rs
@@ -1,5 +1,6 @@
 use core::cell::Cell;
 
+use bun_core::fmt::redacted;
 use bun_core::{Global, Output};
 use bun_paths::dirname;
 use bun_paths::platform;
@@ -154,12 +155,7 @@ impl PackageManager {
                                 Output::err(
                                     err,
                                     "failed to parse package.json for <b>{}<r>",
-                                    format_args!(
-                                        "{}",
-                                        bun_core::fmt::EscapeControlChars(
-                                            resolution.fmt_url(string_buf)
-                                        )
-                                    ),
+                                    format_args!("{}", bun_core::fmt::EscapeControlChars(redacted(resolution.fmt_url(string_buf)))),
                                 );
                             }
                             self.crash();
@@ -245,7 +241,7 @@ impl PackageManager {
                         let string_buf = self.lockfile.buffers.string_bytes.as_slice();
                         bun_core::pretty_errorln!(
                             "<r><red>error:<r> expected package.json in <b>{}<r> to be a JSON file: {}\n",
-                            bun_core::fmt::EscapeControlChars(resolution.fmt_url(string_buf)),
+                            bun_core::fmt::EscapeControlChars(redacted(resolution.fmt_url(string_buf))),
                             err.name(),
                         );
                     }
@@ -297,9 +293,7 @@ impl PackageManager {
                                 let string_buf = self.lockfile.buffers.string_bytes.as_slice();
                                 bun_core::pretty_errorln!(
                                     "<r><red>error:<r> expected package.json in <b>{}<r> to be a JSON file: {}\n",
-                                    bun_core::fmt::EscapeControlChars(
-                                        resolution.fmt_url(string_buf)
-                                    ),
+                                    bun_core::fmt::EscapeControlChars(redacted(resolution.fmt_url(string_buf))),
                                     err.name(),
                                 );
                             }
diff --git a/src/install/PackageManager/runTasks.rs b/src/install/PackageManager/runTasks.rs
index 7f9c724973e3..87801f894839 100644
--- a/src/install/PackageManager/runTasks.rs
+++ b/src/install/PackageManager/runTasks.rs
@@ -28,7 +28,7 @@ use crate::isolated_install::store::{EntryColumns as _, NodeColumns as _};
 use crate::lifecycle_script_runner::InstallCtx;
 use crate::network_task::{Authorization, ForTarballError};
 use crate::package_manifest_map::Value as ManifestEntry;
-use bun_core::fmt::{EscapeControlChars, PathSep, escape_control_chars};
+use bun_core::fmt::{EscapeControlChars, PathSep, escape_control_chars, redacted};
 use bun_install::lockfile::Package;
 use bun_install::package_manager_task as Task;
 // Import the *module* under the `Options` name so `Options::LogLevel` resolves as a path
@@ -680,12 +680,12 @@ pub fn run_tasks<C: RunTasksCallbacks>(
                                 bun_ast::Loc::EMPTY,
                                 "{} downloading tarball <b>{}@{}<r>. Retrying {}/{}...",
                                 bstr::BStr::new(err.name().as_bytes()),
-                                escape_control_chars(extract.name.slice()),
-                                EscapeControlChars(
+                                bun_core::fmt::escape_control_chars(extract.name.slice()),
+                                bun_core::fmt::EscapeControlChars(redacted(
                                     extract
                                         .resolution
                                         .fmt(&manager.lockfile.buffers.string_bytes, PathSep::Auto),
-                                ),
+                                )),
                                 task.retried,
                                 manager.options.max_retry_count,
                             );
@@ -752,12 +752,12 @@ pub fn run_tasks<C: RunTasksCallbacks>(
                             bun_ast::Loc::EMPTY,
                             "{} downloading tarball <b>{}@{}<r>",
                             err.name(),
-                            escape_control_chars(extract.name.slice()),
-                            EscapeControlChars(
+                            bun_core::fmt::escape_control_chars(extract.name.slice()),
+                            bun_core::fmt::EscapeControlChars(redacted(
                                 extract
                                     .resolution
                                     .fmt(&manager.lockfile.buffers.string_bytes, PathSep::Auto),
-                            ),
+                            )),
                         );
                     } else {
                         bun_ast::add_warning_pretty!(
@@ -766,12 +766,12 @@ pub fn run_tasks<C: RunTasksCallbacks>(
                             bun_ast::Loc::EMPTY,
                             "{} downloading tarball <b>{}@{}<r>",
                             err.name(),
-                            escape_control_chars(extract.name.slice()),
-                            EscapeControlChars(
+                            bun_core::fmt::escape_control_chars(extract.name.slice()),
+                            bun_core::fmt::EscapeControlChars(redacted(
                                 extract
                                     .resolution
                                     .fmt(&manager.lockfile.buffers.string_bytes, PathSep::Auto),
-                            ),
+                            )),
                         );
                     }
                     if manager.subcommand != Subcommand::Remove {
diff --git a/src/install/isolated_install.rs b/src/install/isolated_install.rs
index 151786381d93..436ebb409f16 100644
--- a/src/install/isolated_install.rs
+++ b/src/install/isolated_install.rs
@@ -2571,9 +2571,9 @@ pub(crate) fn install_isolated_packages(
                                         "failed to enqueue tarball for download: {}@{}",
                                         (
                                             BStr::new(pkg_name.slice(string_buf)),
-                                            bun_fmt::EscapeControlChars(
+                                            bun_core::fmt::EscapeControlChars(bun_fmt::redacted(
                                                 pkg_res.fmt(string_buf, bun_fmt::PathSep::Auto),
-                                            ),
+                                            )),
                                         ),
                                     );
                                     Output::flush();
diff --git a/src/install/isolated_install/Installer.rs b/src/install/isolated_install/Installer.rs
index 337d594224bd..6e49a944088f 100644
--- a/src/install/isolated_install/Installer.rs
+++ b/src/install/isolated_install/Installer.rs
@@ -4,6 +4,7 @@ use std::io::Write as _;
 use bun_ast::Log;
 use bun_collections::{ArrayHashMap, DynamicBitSet, StringHashMap};
 use bun_core::fmt::{EscapeControlChars, escape_control_chars};
+use bun_core::fmt::redacted;
 use bun_core::{Environment, Global, Output};
 use bun_core::{ZStr, strings};
 use bun_paths::{self as paths, AbsPath, AutoAbsPath, AutoRelPath};
@@ -321,8 +322,8 @@ impl<'a> Installer<'a> {
             Output::err_generic(
                 "failed to download <b>{}@{}<r>: {}\n  <d>{}<r>",
                 (
-                    escape_control_chars(name),
-                    EscapeControlChars(resolution.fmt(string_buf, bun_core::fmt::PathSep::Auto)),
+                    bun_core::fmt::escape_control_chars(name),
+                    bun_core::fmt::EscapeControlChars(redacted(resolution.fmt(string_buf, bun_core::fmt::PathSep::Auto))),
                     bstr::BStr::new(download_error_reason(err)),
                     EscapeControlChars(bun_core::fmt::redacted_npm_url(url)),
                 ),
@@ -393,8 +394,8 @@ impl<'a> Installer<'a> {
                     link_err.clone(),
                     "failed to link package: {}@{}",
                     (
-                        escape_control_chars(pkg_name.slice(string_buf)),
-                        EscapeControlChars(pkg_res.fmt(string_buf, bun_core::fmt::PathSep::Auto)),
+                        bun_core::fmt::escape_control_chars(pkg_name.slice(string_buf)),
+                        bun_core::fmt::EscapeControlChars(redacted(pkg_res.fmt(string_buf, bun_core::fmt::PathSep::Auto))),
                     ),
                 );
             }
@@ -403,8 +404,8 @@ impl<'a> Installer<'a> {
                     symlink_err.clone(),
                     "failed to symlink dependencies for package: {}@{}",
                     (
-                        escape_control_chars(pkg_name.slice(string_buf)),
-                        EscapeControlChars(pkg_res.fmt(string_buf, bun_core::fmt::PathSep::Auto)),
+                        bun_core::fmt::escape_control_chars(pkg_name.slice(string_buf)),
+                        bun_core::fmt::EscapeControlChars(redacted(pkg_res.fmt(string_buf, bun_core::fmt::PathSep::Auto))),
                     ),
                 );
             }
@@ -421,8 +422,8 @@ impl<'a> Installer<'a> {
                 Output::err_generic(
                     "failed to patch package: {}@{}",
                     (
-                        escape_control_chars(pkg_name.slice(string_buf)),
-                        EscapeControlChars(pkg_res.fmt(string_buf, bun_core::fmt::PathSep::Auto)),
+                        bun_core::fmt::escape_control_chars(pkg_name.slice(string_buf)),
+                        bun_core::fmt::EscapeControlChars(redacted(pkg_res.fmt(string_buf, bun_core::fmt::PathSep::Auto))),
                     ),
                 );
                 let _ = patch_log.print(std::ptr::from_mut(Output::error_writer()));
@@ -432,8 +433,8 @@ impl<'a> Installer<'a> {
                     *bin_err,
                     "failed to link binaries for package: {}@{}",
                     (
-                        escape_control_chars(pkg_name.slice(string_buf)),
-                        EscapeControlChars(pkg_res.fmt(string_buf, bun_core::fmt::PathSep::Auto)),
+                        bun_core::fmt::escape_control_chars(pkg_name.slice(string_buf)),
+                        bun_core::fmt::EscapeControlChars(redacted(pkg_res.fmt(string_buf, bun_core::fmt::PathSep::Auto))),
                     ),
                 );
             }
@@ -458,8 +459,8 @@ impl<'a> Installer<'a> {
                 Output::err_generic(
                     "failed to download <b>{}@{}<r>: {}\n  <d>{}<r>",
                     (
-                        escape_control_chars(pkg_name.slice(string_buf)),
-                        EscapeControlChars(pkg_res.fmt(string_buf, bun_core::fmt::PathSep::Auto)),
+                        bun_core::fmt::escape_control_chars(pkg_name.slice(string_buf)),
+                        bun_core::fmt::EscapeControlChars(redacted(pkg_res.fmt(string_buf, bun_core::fmt::PathSep::Auto))),
                         bstr::BStr::new(download_error_reason(dl.err)),
                         EscapeControlChars(bun_core::fmt::redacted_npm_url(&dl.url)),
                     ),
diff --git a/src/install/lockfile/Package/Scripts.rs b/src/install/lockfile/Package/Scripts.rs
index d6cef80c2417..c8bb7d835683 100644
--- a/src/install/lockfile/Package/Scripts.rs
+++ b/src/install/lockfile/Package/Scripts.rs
@@ -1,7 +1,7 @@
 use bstr::BStr;
 
 use bun_core::ZBox;
-use bun_core::fmt::{EscapeControlChars, PathSep, escape_control_chars};
+use bun_core::fmt::{EscapeControlChars, PathSep, escape_control_chars, redacted};
 use bun_core::strings;
 use bun_install::lockfile::Lockfile;
 use bun_install::lockfile::Scripts as LockfileScripts;
@@ -444,7 +444,8 @@ impl List {
         resolution_buf: &[u8],
         format_type: PrintFormat,
     ) {
-        let resolution = EscapeControlChars(resolution.fmt(resolution_buf, PathSep::Posix));
+        let resolution =
+            EscapeControlChars(redacted(resolution.fmt(resolution_buf, PathSep::Posix)));
         let needle = bun_paths::NODE_MODULES_NEEDLE;
         if let Some(i) = strings::index_of(self.cwd.as_bytes(), needle) {
             bun_core::pretty!(
diff --git a/src/install/lockfile/printer/tree_printer.rs b/src/install/lockfile/printer/tree_printer.rs
index 623da0454523..b36d955f1d7b 100644
--- a/src/install/lockfile/printer/tree_printer.rs
+++ b/src/install/lockfile/printer/tree_printer.rs
@@ -4,7 +4,7 @@ use bun_semver as semver;
 
 use crate::lockfile_real::package::PackageColumns as _;
 use crate::package_manager_real::TrackInstalledBin;
-use bun_core::fmt::{EscapeControlChars, PathSep, escape_control_chars};
+use bun_core::fmt::{EscapeControlChars, PathSep, escape_control_chars, redacted};
 use bun_install::lockfile::{Printer, package::Meta as PackageMeta};
 use bun_install::{
     self as install, Bin, Dependency, DependencyID, DependencyVersionTag, INVALID_PACKAGE_ID,
@@ -529,6 +529,7 @@ where
     let packages_slice = this.lockfile.packages.slice();
     let resolution: Resolution = packages_slice.items_resolution()[package_id as usize];
     let name = dependency.name.slice(string_buf);
+    let version = EscapeControlChars(redacted(resolution.fmt(string_buf, PathSep::Posix)));
 
     let package_name = packages_slice.items_name()[package_id as usize].slice(string_buf);
     if let Some(later_version_fmt) =
@@ -542,7 +543,7 @@ where
                     true
                 ),
                 escape_control_chars(name),
-                EscapeControlChars(resolution.fmt(string_buf, PathSep::Posix)),
+                version,
                 later_version_fmt,
             )?;
         } else {
@@ -550,7 +551,7 @@ where
                 writer,
                 bun_core::pretty_fmt!("<r>+ {s}<r><d>@{f}<r> <d>(v{f} available)<r>\n", false),
                 escape_control_chars(name),
-                EscapeControlChars(resolution.fmt(string_buf, PathSep::Posix)),
+                version,
                 later_version_fmt,
             )?;
         }
@@ -563,14 +564,14 @@ where
             writer,
             bun_core::pretty_fmt!("<r><green>+<r> <b>{s}<r><d>@{f}<r>\n", true),
             escape_control_chars(name),
-            EscapeControlChars(resolution.fmt(string_buf, PathSep::Posix)),
+            version,
         )?;
     } else {
         write!(
             writer,
             bun_core::pretty_fmt!("<r>+ {s}<r><d>@{f}<r>\n", false),
             escape_control_chars(name),
-            EscapeControlChars(resolution.fmt(string_buf, PathSep::Posix)),
+            version,
         )?;
     }
 
@@ -607,7 +608,7 @@ where
         writer,
         ENABLE_ANSI_COLORS,
         "<d>@{f}<r>",
-        EscapeControlChars(resolution.fmt(string_buf, PathSep::Posix)),
+        bun_core::fmt::EscapeControlChars(redacted(resolution.fmt(string_buf, PathSep::Posix))),
     )?;
     writer.write_str(if has_binaries {
         " with binaries:\n"
@@ -796,8 +797,8 @@ where
                 writer,
                 ENABLE_ANSI_COLORS,
                 " <r><b>{s}<r><d>@<b>{f}<r>\n",
-                escape_control_chars(package_name),
-                EscapeControlChars(resolved[package_id as usize].fmt(string_buf, PathSep::Auto)),
+                bun_core::fmt::escape_control_chars(package_name),
+                bun_core::fmt::EscapeControlChars(redacted(resolved[package_id as usize].fmt(string_buf, PathSep::Auto))),
             )?;
         }
     }
diff --git a/src/install/patch_install.rs b/src/install/patch_install.rs
index 96ee9f239e46..3c0ae397aa58 100644
--- a/src/install/patch_install.rs
+++ b/src/install/patch_install.rs
@@ -525,7 +525,7 @@ impl PatchTask {
                         &e,
                         format_args!(
                             "failed trying to open temporary dir to apply patch to package: {}",
-                            bun_core::fmt::escape_control_chars(&resolution_label)
+                            bun_core::fmt::EscapeControlChars(bun_core::fmt::redacted(BStr::new(&resolution_label)))
                         ),
                     );
                     return Ok(());
diff --git a/src/jsc/AsyncModule.rs b/src/jsc/AsyncModule.rs
index 1c9d5c721cd3..3fe4d6d081ab 100644
--- a/src/jsc/AsyncModule.rs
+++ b/src/jsc/AsyncModule.rs
@@ -972,9 +972,11 @@ impl AsyncModule {
                 .string_bytes
                 .as_slice(),
         );
-        let resolution_fmt = result
-            .resolution
-            .fmt(string_bytes.slice(), bun_core::fmt::PathSep::Any);
+        let resolution_fmt = bun_core::fmt::redacted(
+            result
+                .resolution
+                .fmt(string_bytes.slice(), bun_core::fmt::PathSep::Any),
+        );
 
         let mut msg: Vec<u8> = Vec::new();
         let e = result.err;
@@ -1040,13 +1042,15 @@ impl AsyncModule {
                 "{} downloading package '{}@{}'",
                 e,
                 bstr::BStr::new(result.name),
-                result.resolution.fmt(
-                    vm.package_manager()
-                        .lockfile
-                        .buffers
-                        .string_bytes
-                        .as_slice(),
-                    bun_core::fmt::PathSep::Any,
+                bun_core::fmt::redacted(
+                    result.resolution.fmt(
+                        vm.package_manager()
+                            .lockfile
+                            .buffers
+                            .string_bytes
+                            .as_slice(),
+                        bun_core::fmt::PathSep::Any,
+                    )
                 )
             );
         }
diff --git a/src/runtime/cli/package_manager_command.rs b/src/runtime/cli/package_manager_command.rs
index def11b5a0043..43769c7f0703 100644
--- a/src/runtime/cli/package_manager_command.rs
+++ b/src/runtime/cli/package_manager_command.rs
@@ -756,10 +756,9 @@ Learn more about these at <magenta>https://bun.com/docs/cli/pm<r>.\n";
                     let name = dependencies[dependency_id as usize]
                         .name
                         .slice(string_bytes);
-                    let name = bun_fmt::escape_control_chars(name);
-                    let resolution = bun_fmt::EscapeControlChars(
+                    let resolution = bun_core::fmt::EscapeControlChars(bun_fmt::redacted(
                         resolutions[package_id as usize].fmt(string_bytes, PathSep::Auto),
-                    );
+                    ));
 
                     if index < sorted_dependencies.len() - 1 {
                         bun_core::prettyln!("<d>├──<r> {}<r><d>@{}<r>\n", name, resolution);
@@ -901,7 +900,8 @@ fn print_node_modules_folder_structure(
                     }
                 }
             }
-            let directory_version = resolutions[id as usize].fmt(string_bytes, PathSep::Auto);
+            let directory_version =
+                bun_fmt::redacted(resolutions[id as usize].fmt(string_bytes, PathSep::Auto));
             if let Some(j) = strings::index_of(path, b"node_modules") {
                 bun_core::prettyln!(
                     "{}<d>@{}<r>",
@@ -1023,7 +1023,9 @@ fn print_node_modules_folder_structure(
         bun_core::prettyln!(
             "{}<d>@{}<r>",
             bun_fmt::escape_control_chars(package_name),
-            bun_fmt::EscapeControlChars(resolutions[package_id as usize].fmt(string_bytes, PathSep::Auto)),
+            bun_fmt::EscapeControlChars(bun_fmt::redacted(
+                resolutions[package_id as usize].fmt(string_bytes, PathSep::Auto),
+            )),
         );
     }
 
@@ -1089,10 +1091,8 @@ fn print_trusted_dependencies_flat(
     for (index, &dep_id) in trusted.iter().enumerate() {
         let package_id = resolutions_buf[dep_id as usize];
         let name = dependencies[dep_id as usize].name.slice(string_bytes);
-        let name = bun_fmt::escape_control_chars(name);
-        let resolution = bun_fmt::EscapeControlChars(
-            resolutions[package_id as usize].fmt(string_bytes, PathSep::Auto),
-        );
+        let resolution =
+            bun_core::fmt::EscapeControlChars(bun_fmt::redacted(resolutions[package_id as usize].fmt(string_bytes, PathSep::Auto)));
         if index + 1 < trusted.len() {
             bun_core::prettyln!("<d>├──<r> {}<r><d>@{}<r>\n", name, resolution);
         } else {
diff --git a/src/runtime/cli/pm_licenses_command.rs b/src/runtime/cli/pm_licenses_command.rs
index fdfead9a4eae..e66af934ca19 100644
--- a/src/runtime/cli/pm_licenses_command.rs
+++ b/src/runtime/cli/pm_licenses_command.rs
@@ -4,7 +4,7 @@ use std::io::Write as _;
 use bstr::BStr;
 use bun_ast::{Expr, Log, Source};
 use bun_collections::{DynamicBitSet, StringHashMap, index_sort};
-use bun_core::fmt::{PathSep, escape_control_chars};
+use bun_core::fmt::{PathSep, escape_control_chars, redacted};
 use bun_core::{FileKind, Global, Output, strings};
 use bun_install::isolated_install::store::entry::fmt_store_key;
 use bun_install::lockfile::{Lockfile, package::PackageColumns as _, reachable, tree};
@@ -730,8 +730,8 @@ fn print_text(entries: &[Entry], long: bool, checked: usize, summary: bool) {
             bun_core::pretty!(
                 "<d>{}<r> {}<d>@{}<r>",
                 if last { "└──" } else { "├──" },
-                escape_control_chars(&entry.name),
-                escape_control_chars(&entry.version)
+                BStr::new(&entry.name),
+                bun_core::fmt::EscapeControlChars(redacted(BStr::new(&entry.version)))
             );
             if entry.dev_only {
                 bun_core::pretty!(" <d>(dev)<r>");
@@ -831,7 +831,8 @@ fn print_json(entries: &[Entry]) {
                 if i > 0 {
                     out.extend_from_slice(b", ");
                 }
-                json_string(&mut out, &entry.version);
+                let version = redacted(BStr::new(&entry.version)).to_string();
+                json_string(&mut out, version.as_bytes());
             }
             out.extend_from_slice(b"],\n      \"paths\": [");
             for (i, entry) in kept.iter().enumerate() {
diff --git a/src/runtime/cli/why_command.rs b/src/runtime/cli/why_command.rs
index 3e4353ee2cd4..c6ef47737a21 100644
--- a/src/runtime/cli/why_command.rs
+++ b/src/runtime/cli/why_command.rs
@@ -5,7 +5,7 @@ use std::io::Write as _;
 use bstr::BStr;
 
 use bun_collections::HashMap;
-use bun_core::fmt::{PathSep, escape_control_chars};
+use bun_core::fmt::{PathSep, escape_control_chars, redacted};
 use bun_core::strings;
 use bun_core::{Global, Output};
 use bun_install::dependency::Behavior;
@@ -476,8 +476,8 @@ impl WhyCommand {
             let target_name = pkg_names[target_version.pkg_id as usize].slice(string_bytes);
             bun_core::prettyln!(
                 "<b>{}@{}<r>",
-                escape_control_chars(target_name),
-                escape_control_chars(&target_version.version)
+                BStr::new(target_name),
+                bun_core::fmt::EscapeControlChars(redacted(BStr::new(&target_version.version)))
             );
 
             if let Some(dependents) = all_dependents.get(&target_version.pkg_id) {
@@ -549,12 +549,12 @@ fn print_package_with_type(prefix: &[u8], package: &DependentInfo) {
     } else {
         bun_core::pretty!("{}", escape_control_chars(&package.name));
         if !package.version.is_empty() {
-            bun_core::pretty!("<d>@{}<r>", escape_control_chars(&package.version));
+            bun_core::pretty!("<d>@{}<r>", bun_core::fmt::EscapeControlChars(redacted(BStr::new(&package.version))));
         }
     }
 
     if !package.spec.is_empty() {
-        bun_core::prettyln!(" <d>(requires {})<r>", escape_control_chars(&package.spec));
+        bun_core::prettyln!(" <d>(requires {})<r>", bun_core::fmt::EscapeControlChars(redacted(BStr::new(&package.spec))));
     } else {
         bun_core::prettyln!("");
     }
diff --git a/test/cli/install/redacted-config-logs.test.ts b/test/cli/install/redacted-config-logs.test.ts
index 015ef1bdf4d2..f3ac8292a800 100644
--- a/test/cli/install/redacted-config-logs.test.ts
+++ b/test/cli/install/redacted-config-logs.test.ts
@@ -476,3 +476,229 @@ describe.concurrent("bun install masks secrets in the registry-supplied URL it p
     }
   });
 });
+
+// A dependency declared as a tarball or git URL keeps that URL as its
+// resolution, and bun prints the resolution (or the specifier it was declared
+// with) in the install summary, in error messages and in the listing commands.
+// Any credential in the URL has to be masked at each of those places.
+describe.concurrent("tarball and git URLs declared in package.json are masked wherever bun echoes them", () => {
+  const password = "s3cret";
+  const token = "npm_" + "a1b2c3d4e5f6g7h8i9j0k1l2m3n4o5p6q7r8";
+
+  async function startTarballServer() {
+    const tarball = await new Bun.Archive(
+      {
+        "package/package.json": JSON.stringify({
+          name: "direct",
+          version: "1.0.0",
+          license: "MIT",
+          scripts: { postinstall: "echo postinstall" },
+        }),
+      },
+      { compress: "gzip" },
+    ).bytes();
+    return Bun.serve({
+      port: 0,
+      fetch(req) {
+        if (new URL(req.url).pathname === "/cdn/direct-1.0.0.tgz") return new Response(tarball);
+        return new Response("not found", { status: 404 });
+      },
+    });
+  }
+
+  // Every download attempt is met with an immediately closed connection, so
+  // the tarball can never be fetched and bun reports the failure by name.
+  function startClosingServer() {
+    return Bun.listen({
+      hostname: "localhost",
+      port: 0,
+      socket: {
+        open(socket) {
+          socket.end();
+        },
+        data() {},
+      },
+    });
+  }
+
+  type Host = { hostname: string; port: number };
+  const spec = ({ hostname, port }: Host, query = `?token=${token}`) =>
+    `http://carol:${password}@${hostname}:${port}/cdn/direct-1.0.0.tgz${query}`;
+  const masked = ({ hostname, port }: Host, query = "?token=***") =>
+    `http://carol:******@${hostname}:${port}/cdn/direct-1.0.0.tgz${query}`;
+
+  const packageJson = (dependency: string) => JSON.stringify({ name: "app", dependencies: { direct: dependency } });
+  // What a previous install of `packageJson(dependency)` writes to bun.lock.
+  const bunLock = (dependency: string) =>
+    JSON.stringify({
+      lockfileVersion: 1,
+      workspaces: { "": { name: "app", dependencies: { direct: dependency } } },
+      packages: { direct: [`direct@${dependency}`, {}, ""] },
+    });
+
+  // None of these installs has anything to ask a registry for; pointing the
+  // registry at the test's own server keeps a stray request off the network.
+  async function run(cwd: string, { hostname, port }: Host, args: string[]) {
+    await using proc = Bun.spawn({
+      cmd: [bunExe(), ...args],
+      cwd,
+      env: {
+        ...bunEnv,
+        npm_config_registry: `http://${hostname}:${port}/`,
+        BUN_INSTALL_CACHE_DIR: join(cwd, ".bun-cache"),
+      },
+      stdout: "pipe",
+      stderr: "pipe",
+    });
+    const [out, err, exitCode] = await Promise.all([proc.stdout.text(), proc.stderr.text(), proc.exited]);
+    return { out, err, exitCode };
+  }
+
+  function expectNoSecrets(...texts: string[]) {
+    for (const text of texts) {
+      expect(text).not.toContain(password);
+      expect(text).not.toContain(token);
+    }
+  }
+
+  test("install summary, then bun pm untrusted and bun pm licenses", async () => {
+    await using server = await startTarballServer();
+    const url = masked(server);
+    using dir = tempDir("redacted-resolution-install", { "package.json": packageJson(spec(server)) });
+
+    const install = await run(String(dir), server, ["install"]);
+    expect(install.out).toContain(`\n+ direct@${url}\n`);
+    expectNoSecrets(install.out, install.err);
+    expect(install.exitCode).toBe(0);
+
+    // The tarball's postinstall was blocked, so `bun pm untrusted` lists the
+    // package along with its resolution.
+    const untrusted = await run(String(dir), server, ["pm", "untrusted"]);
+    expect(untrusted.out).toContain(`direct @${url}\n`);
+    expectNoSecrets(untrusted.out, untrusted.err);
+    expect(untrusted.exitCode).toBe(0);
+
+    const licenses = await run(String(dir), server, ["pm", "licenses"]);
+    expect(licenses.out).toContain(`direct@${url}\n`);
+    expectNoSecrets(licenses.out, licenses.err);
+    expect(licenses.exitCode).toBe(0);
+
+    const licensesJson = await run(String(dir), server, ["pm", "licenses", "--json"]);
+    expect(JSON.parse(licensesJson.out)).toEqual({
+      MIT: [expect.objectContaining({ name: "direct", versions: [url] })],
+    });
+    expectNoSecrets(licensesJson.out, licensesJson.err);
+    expect(licensesJson.exitCode).toBe(0);
+  });
+
+  test("bun add <url>", async () => {
+    await using server = await startTarballServer();
+    using dir = tempDir("redacted-resolution-add", { "package.json": JSON.stringify({ name: "app" }) });
+
+    // No query string here: `bun add <url>` names its extraction directory
+    // after the URL's basename, and a `?` in a directory name is rejected on
+    // Windows, so a query string makes the add itself fail there.
+    const { out, err, exitCode } = await run(String(dir), server, ["add", spec(server, "")]);
+    expect(out).toContain(`installed direct@${masked(server, "")}\n`);
+    expectNoSecrets(out, err);
+    expect(exitCode).toBe(0);
+  });
+
+  test("bun install --dry-run", async () => {
+    await using server = await startTarballServer();
+    using dir = tempDir("redacted-resolution-dry-run", { "package.json": packageJson(spec(server)) });
+
+    const { out, err, exitCode } = await run(String(dir), server, ["install", "--dry-run"]);
+    expect(out).toContain(` direct@${masked(server)}\n`);
+    expectNoSecrets(out, err);
+    expect(exitCode).toBe(0);
+  });
+
+  test("bun pm ls and bun why read the resolution back out of bun.lock", async () => {
+    await using server = await startTarballServer();
+    const url = masked(server);
+    using dir = tempDir("redacted-resolution-ls", {
+      "package.json": packageJson(spec(server)),
+      "bun.lock": bunLock(spec(server)),
+    });
+
+    const ls = await run(String(dir), server, ["pm", "ls"]);
+    expect(ls.out).toContain(`└── direct@${url}\n`);
+    expectNoSecrets(ls.out, ls.err);
+    expect(ls.exitCode).toBe(0);
+
+    const why = await run(String(dir), server, ["why", "direct"]);
+    expect(why.out).toContain(`direct@${url}\n`);
+    expect(why.out).toContain(`app (requires ${url})\n`);
+    expectNoSecrets(why.out, why.err);
+    expect(why.exitCode).toBe(0);
+  });
+
+  test("an npm version whose pre-release tag looks like a UUID is printed unchanged", async () => {
+    await using server = await startTarballServer();
+    const stamped = "1.0.0-a1b2c3d4-e5f6-7890-abcd-ef1234567890";
+    using dir = tempDir("redacted-resolution-versions", {
+      "package.json": JSON.stringify({ name: "app", dependencies: { direct: spec(server), stamped } }),
+      "bun.lock": JSON.stringify({
+        lockfileVersion: 1,
+        workspaces: { "": { name: "app", dependencies: { direct: spec(server), stamped } } },
+        packages: {
+          direct: [`direct@${spec(server)}`, {}, ""],
+          stamped: [`stamped@${stamped}`, "", {}, ""],
+        },
+      }),
+    });
+
+    const { out, err, exitCode } = await run(String(dir), server, ["pm", "ls"]);
+    expect(out).toContain(`direct@${masked(server)}\n`);
+    expect(out).toContain(`stamped@${stamped}\n`);
+    expectNoSecrets(out, err);
+    expect(exitCode).toBe(0);
+  });
+
+  test("download failure: retry warnings, the final error and the unresolved dependency", async () => {
+    using server = startClosingServer();
+    const url = masked(server);
+    using dir = tempDir("redacted-resolution-download-failure", { "package.json": packageJson(spec(server)) });
+
+    const { out, err, exitCode } = await run(String(dir), server, ["install", "--verbose"]);
+    expect(err).toContain(` downloading tarball direct@${url}. Retrying 1/`);
+    expect(err).toContain(` downloading tarball direct@${url}\n`);
+    expect(err).toContain(`error: direct@${url} failed to resolve\n`);
+    expectNoSecrets(out, err);
+    expect(exitCode).toBe(1);
+  });
+
+  test("download failure with the isolated linker and an existing bun.lock", async () => {
+    using server = startClosingServer();
+    using dir = tempDir("redacted-resolution-isolated-download-failure", {
+      "package.json": packageJson(spec(server)),
+      "bun.lock": bunLock(spec(server)),
+    });
+
+    const { err, exitCode } = await run(String(dir), server, ["install", "--linker", "isolated"]);
+    // Only the resolution in the message is asserted: the request URL bun
+    // prints on the following line is a separate operand of this message.
+    expect(err).toContain(`error: failed to download direct@${masked(server)}: `);
+    expect(exitCode).toBe(1);
+  });
+
+  test("git URL specifier", async () => {
+    // The clone fails at once (the connection is closed before TLS starts);
+    // what is being tested is how the specifier is echoed afterwards.
+    using server = startClosingServer();
+    using dir = tempDir("redacted-resolution-git", {
+      "package.json": JSON.stringify({
+        name: "app",
+        dependencies: { repo: `git+https://carol:${password}@${server.hostname}:${server.port}/org/repo.git` },
+      }),
+    });
+
+    const { out, err, exitCode } = await run(String(dir), server, ["install"]);
+    expect(err).toContain(
+      `error: repo@git+https://carol:******@${server.hostname}:${server.port}/org/repo.git failed to resolve\n`,
+    );
+    expectNoSecrets(out, err);
+    expect(exitCode).toBe(1);
+  });
+});
diff --git a/test/js/bun/util/highlighter.test.ts b/test/js/bun/util/highlighter.test.ts
index 395b8adb2fbb..bd1e0a7b64c4 100644
--- a/test/js/bun/util/highlighter.test.ts
+++ b/test/js/bun/util/highlighter.test.ts
@@ -53,6 +53,20 @@ test("redacting highlighter still redacts values", () => {
   expect(out).toContain("*");
 });
 
+// The password of a URL is masked whatever the scheme is: dependency
+// specifiers are `git+https://` and `git+ssh://` URLs as often as `https://`.
+test.each([
+  ["https://user:hunter2@host/repo.git", "https://user:*******@host/repo.git"],
+  ["git+https://user:hunter2@host/repo.git", "git+https://user:*******@host/repo.git"],
+  ["git+ssh://user:hunter2@host:22/repo.git", "git+ssh://user:*******@host:22/repo.git"],
+  // scp-like: the `:` after the host is a path separator, not a password.
+  ["git+ssh://git@host:org/repo.git", "git+ssh://git@host:org/repo.git"],
+  // No scheme, so nothing is treated as a URL.
+  ["user:hunter2@host/repo.git", "user:hunter2@host/repo.git"],
+])("redacting highlighter masks the password in %p", (input, expected) => {
+  expect(highlighterRedacted(`x = "${input}"`)).toContain(`"${expected}"`);
+});
+
 // End-to-end: an error in bunfig.toml whose source line ends with an
 // unterminated template interpolation is printed through the redacting syntax
 // highlighter. This used to panic while printing the error message.

From e1e85d6cb54bf06dc8f4b869564c78054b1ea5a0 Mon Sep 17 00:00:00 2001
From: robobun <117481402+robobun@users.noreply.github.com>
Date: Mon, 17 Aug 2026 02:33:42 +0000
Subject: [PATCH 152/258] Normalize http_proxy/https_proxy env values through
 the WHATWG parser (#38043)

---
 src/dotenv/env_loader.rs                      |  38 ++--
 src/http/lib.rs                               |  45 ++--
 src/install/NetworkTask.rs                    |  25 ++-
 src/install/PackageManager.rs                 |   8 +-
 src/install/PackageManager/runTasks.rs        |   2 +-
 src/runtime/cli/audit_command.rs              |   2 +-
 src/runtime/cli/create_command.rs             |  23 +-
 src/runtime/cli/pm_view_command.rs            |   2 +-
 src/runtime/cli/upgrade_command.rs            |   6 +-
 src/runtime/server/RequestContext.rs          |   7 +-
 src/runtime/webcore/Blob.rs                   |  27 +--
 src/runtime/webcore/ReadableStream.rs         |   2 +-
 src/runtime/webcore/S3File.rs                 |  12 +-
 src/runtime/webcore/blob/Store.rs             |  10 +-
 src/standalone_graph/StandaloneModuleGraph.rs |   6 +-
 src/url/lib.rs                                |  53 ++---
 test/cli/install/bun-install-proxy.test.ts    |  62 ++++++
 test/cli/install/bun-install.test.ts          |  86 ++++++++
 test/js/bun/http/proxy.test.ts                | 199 +++++++++++++++++-
 test/js/web/fetch/fetch.test.ts               |  29 +++
 20 files changed, 485 insertions(+), 159 deletions(-)

diff --git a/src/dotenv/env_loader.rs b/src/dotenv/env_loader.rs
index 57b4464602a8..1bb173f1cf9d 100644
--- a/src/dotenv/env_loader.rs
+++ b/src/dotenv/env_loader.rs
@@ -9,7 +9,7 @@ use bun_core::{self, Output};
 use bun_core::{ZStr, strings};
 use bun_paths::{self, MAX_PATH_BYTES, PathBuffer};
 use bun_sys;
-use bun_url::URL;
+use bun_url::{OwnedURL, URL};
 use bun_which::which;
 use enumset::EnumSet;
 
@@ -322,7 +322,7 @@ impl Loader {
         result
     }
 
-    pub fn get_http_proxy_for(&self, url: &URL<'_>) -> Option<URL<'_>> {
+    pub fn get_http_proxy_for(&self, url: &URL<'_>) -> Option<OwnedURL> {
         self.get_http_proxy(url.is_http(), Some(url.hostname), Some(url.host))
     }
 
@@ -336,32 +336,31 @@ impl Loader {
     /// Get proxy URL for HTTP/HTTPS requests, respecting NO_PROXY.
     /// `hostname` is the host without port (e.g., "localhost")
     /// `host` is the host with port if present (e.g., "localhost:3000")
+    /// Normalized like `fetch()`'s `proxy` option (#16182); a value WTF::URL rejects is used as is.
     pub fn get_http_proxy(
         &self,
         is_http: bool,
         hostname: Option<&[u8]>,
         host: Option<&[u8]>,
-    ) -> Option<URL<'_>> {
-        // TODO: When Web Worker support is added, make sure to intern these strings
-        let mut http_proxy: Option<URL<'_>> = None;
-
+    ) -> Option<OwnedURL> {
         let proxy = if is_http {
             self.get_lower_then_upper(b"http_proxy", b"HTTP_PROXY")
         } else {
             self.get_lower_then_upper(b"https_proxy", b"HTTPS_PROXY")
-        };
-        if let Some(p) = proxy {
-            if !Self::is_emptyish(p) {
-                http_proxy = Some(URL::parse(p));
-            }
+        }?;
+        if Self::is_emptyish(proxy) || self.is_no_proxy(hostname, host) {
+            return None;
         }
+        Some(
+            URL::from_string(&bun_core::String::borrow_utf8(proxy))
+                .unwrap_or_else(|_| OwnedURL::from_href(Box::from(proxy))),
+        )
+    }
 
-        if http_proxy.is_some() && hostname.is_some() {
-            if self.is_no_proxy(hostname, host) {
-                return None;
-            }
-        }
-        http_proxy
+    /// The `no_proxy` / `NO_PROXY` list, or `None` when unset or empty-ish.
+    pub fn get_no_proxy(&self) -> Option<&[u8]> {
+        self.get_lower_then_upper(b"no_proxy", b"NO_PROXY")
+            .filter(|v| !Self::is_emptyish(v))
     }
 
     /// Returns true if the given hostname/host should bypass the proxy
@@ -371,12 +370,9 @@ impl Loader {
         // See the syntax at https://about.gitlab.com/blog/2021/01/27/we-need-to-talk-no-proxy/
         let Some(hn) = hostname else { return false };
 
-        let Some(no_proxy_text) = self.get_lower_then_upper(b"no_proxy", b"NO_PROXY") else {
+        let Some(no_proxy_text) = self.get_no_proxy() else {
             return false;
         };
-        if Self::is_emptyish(no_proxy_text) {
-            return false;
-        }
 
         for no_proxy_item in strings::split(no_proxy_text, b",") {
             let mut no_proxy_entry = strings::trim(no_proxy_item, &strings::WHITESPACE_CHARS);
diff --git a/src/http/lib.rs b/src/http/lib.rs
index 484e65693f05..8ed149667e41 100644
--- a/src/http/lib.rs
+++ b/src/http/lib.rs
@@ -675,54 +675,35 @@ pub struct ProxySettings {
 }
 
 impl ProxySettings {
-    /// Returns `None` when neither proxy is set: no re-evaluation is needed.
-    pub(crate) fn new(
-        http_proxy: Option<&[u8]>,
-        https_proxy: Option<&[u8]>,
-        no_proxy: Option<&[u8]>,
+    /// An empty href is "no proxy for that scheme"; `None` when neither is set.
+    fn new(
+        http_proxy: Box<[u8]>,
+        https_proxy: Box<[u8]>,
+        env: &bun_dotenv::Loader,
     ) -> Option<Box<Self>> {
-        let http_proxy = http_proxy.unwrap_or(b"");
-        let https_proxy = https_proxy.unwrap_or(b"");
         if http_proxy.is_empty() && https_proxy.is_empty() {
             return None;
         }
         Some(Box::new(Self {
-            http_proxy: http_proxy.into(),
-            https_proxy: https_proxy.into(),
-            no_proxy: no_proxy.unwrap_or(b"").into(),
+            http_proxy,
+            https_proxy,
+            no_proxy: env.get_no_proxy().unwrap_or(b"").into(),
         }))
     }
 
     /// Capture `http_proxy` / `https_proxy` / `no_proxy` from the process env.
     pub fn from_env(env: &bun_dotenv::Loader) -> Option<Box<Self>> {
-        #[inline]
-        fn is_emptyish(v: &[u8]) -> bool {
-            v.is_empty() || v == b"\"\"" || v == b"''"
-        }
-        // lowercase first; an empty lowercase value falls through to uppercase.
-        let read = |lower: &[u8], upper: &[u8]| -> Option<&[u8]> {
-            let v = env
-                .get(lower)
-                .filter(|v| !v.is_empty())
-                .or_else(|| env.get(upper))?;
-            if is_emptyish(v) { None } else { Some(v) }
+        let proxy_href = |is_http: bool| -> Box<[u8]> {
+            env.get_http_proxy(is_http, None, None)
+                .map_or_else(Box::default, bun_url::OwnedURL::into_href)
         };
-        Self::new(
-            read(b"http_proxy", b"HTTP_PROXY"),
-            read(b"https_proxy", b"HTTPS_PROXY"),
-            read(b"no_proxy", b"NO_PROXY"),
-        )
+        Self::new(proxy_href(true), proxy_href(false), env)
     }
 
     /// Build from an explicit `fetch(url, { proxy })` option. The same proxy is
     /// used for both schemes; NO_PROXY is still consulted per hop.
     pub fn from_explicit(proxy_href: &[u8], env: &bun_dotenv::Loader) -> Option<Box<Self>> {
-        let no_proxy = env
-            .get(b"no_proxy")
-            .filter(|v| !v.is_empty())
-            .or_else(|| env.get(b"NO_PROXY"))
-            .filter(|v| !(v.is_empty() || *v == b"\"\"" || *v == b"''"));
-        Self::new(Some(proxy_href), Some(proxy_href), no_proxy)
+        Self::new(proxy_href.into(), proxy_href.into(), env)
     }
 
     /// Proxy href to use for `url`, or `None` for a direct connection.
diff --git a/src/install/NetworkTask.rs b/src/install/NetworkTask.rs
index c0724ac12e7a..5d99a54f700a 100644
--- a/src/install/NetworkTask.rs
+++ b/src/install/NetworkTask.rs
@@ -11,7 +11,7 @@ use bun_http::{
     HeaderBuilder, async_http::Options as AsyncHTTPOptions,
 };
 use bun_threading::thread_pool::Batch;
-use bun_url::URL;
+use bun_url::{OwnedURL, URL};
 use std::io::Write as _;
 
 use crate::extract_tarball;
@@ -62,6 +62,8 @@ pub struct NetworkTask {
     // into `callback`; owning avoids that at the cost of one copy per tarball download.
     pub(crate) url_buf: Box<[u8]>,
     pub(crate) header_buf: Box<[u8]>,
+    /// Proxy href for this request (empty: direct); owned like `url_buf`, `AsyncHTTP` borrows it.
+    pub(crate) http_proxy_buf: Box<[u8]>,
     pub(crate) retried: u16,
     pub(crate) response_buffer: MutableString,
     // BACKREF: PackageManager owns this task via `preallocated_network_tasks`.
@@ -172,6 +174,22 @@ impl NetworkTask {
         unsafe { self.package_manager.assume_mut() }
     }
 
+    /// Stores the proxy for `url` in `http_proxy_buf` and returns the view the `AsyncHTTP` keeps.
+    fn http_proxy_for(&mut self, pm: &PackageManager, url: &URL<'_>) -> Option<URL<'static>> {
+        self.http_proxy_buf = pm
+            .http_proxy(url)
+            .map_or_else(Box::default, OwnedURL::into_href);
+        if self.http_proxy_buf.is_empty() {
+            return None;
+        }
+        // SAFETY: lifetime extension, same as `url_buf` in `for_manifest` /
+        // `for_tarball` — `run_tasks` drops `unsafe_http_client` before the slot
+        // (and this buffer) goes back to the pool.
+        Some(URL::parse(unsafe {
+            bun_ptr::detach_lifetime(&self.http_proxy_buf)
+        }))
+    }
+
     // Signature matches `HTTPClientResultCallback::new::<NetworkTask>`'s
     // `fn(*mut T, *mut AsyncHTTP, HTTPClientResult<'_>)` shape so it can be
     // installed directly without a separate trampoline.
@@ -688,7 +706,7 @@ impl NetworkTask {
 
         // SAFETY: `self.url_buf` outlives the request, same as `header_buf` above (see `s3/simple_request.rs`).
         let url = URL::parse(unsafe { bun_ptr::detach_lifetime(&self.url_buf) });
-        let http_proxy = pm.http_proxy(&url);
+        let http_proxy = self.http_proxy_for(pm, &url);
         let completion_callback = self.get_completion_callback();
         // MaybeUninit overwrite — see field doc; old slot value is
         // either uninitialized (fresh hive slot) or a stale bitwise copy from
@@ -912,7 +930,7 @@ impl NetworkTask {
         let url = URL::parse(unsafe { bun_ptr::detach_lifetime(&self.url_buf) });
 
         let mut http_options = AsyncHTTPOptions {
-            http_proxy: pm.http_proxy(&url),
+            http_proxy: self.http_proxy_for(pm, &url),
             ..Default::default()
         };
 
@@ -1047,6 +1065,7 @@ impl NetworkTask {
             addr_of_mut!((*slot).response).write(HTTPClientResult::default());
             addr_of_mut!((*slot).url_buf).write(Box::default());
             addr_of_mut!((*slot).header_buf).write(Box::default());
+            addr_of_mut!((*slot).http_proxy_buf).write(Box::default());
             addr_of_mut!((*slot).retried).write(0);
             addr_of_mut!((*slot).next).write(bun_threading::Link::new());
             addr_of_mut!((*slot).tarball_stream).write(None);
diff --git a/src/install/PackageManager.rs b/src/install/PackageManager.rs
index 50ba311f83ad..ce08b0d5a703 100644
--- a/src/install/PackageManager.rs
+++ b/src/install/PackageManager.rs
@@ -25,7 +25,7 @@ use bun_semver as Semver;
 use bun_sys::{self, Fd};
 use bun_threading::{ThreadPool, UnboundedQueue, thread_pool};
 use bun_transpiler as transpiler;
-use bun_url::URL;
+use bun_url::{OwnedURL, URL};
 
 // `bun.spawn.process.WaiterThread` — the force-waiter-thread flag was moved
 // down into `bun_spawn::process` (MOVE_DOWN b0); install just flips it during
@@ -908,10 +908,8 @@ impl PackageManager {
         Ok(unsafe { &mut *ptr })
     }
 
-    pub fn http_proxy(&self, url: &URL<'_>) -> Option<URL<'static>> {
-        // `env_mut()` yields an unbounded `&'a Loader` (process-lifetime
-        // singleton), so the returned `URL<'_>` borrows for `'static`.
-        self.env_mut().get_http_proxy_for(url)
+    pub fn http_proxy(&self, url: &URL<'_>) -> Option<OwnedURL> {
+        self.env().get_http_proxy_for(url)
     }
 
     pub fn tls_reject_unauthorized(&self) -> bool {
diff --git a/src/install/PackageManager/runTasks.rs b/src/install/PackageManager/runTasks.rs
index 87801f894839..f1497e172cf7 100644
--- a/src/install/PackageManager/runTasks.rs
+++ b/src/install/PackageManager/runTasks.rs
@@ -1834,7 +1834,7 @@ pub fn generate_network_task_for_tarball<'a>(
     // Full struct overwrite that resets
     // every other field (`retried`, `response`, `streaming_committed`,
     // `tarball_stream`, `streaming_extract_task`, `next`, `url_buf`,
-    // `signal_store`) to its struct default. The slot may be uninitialized
+    // `http_proxy_buf`, `signal_store`) to its struct default. The slot may be uninitialized
     // (`HiveArrayFallback::get()` heap fallback) or stale (reused hive slot).
     // SAFETY: `net_ptr` is the unique handle to a freshly-vended pool slot; no
     // other alias exists until we return it.
diff --git a/src/runtime/cli/audit_command.rs b/src/runtime/cli/audit_command.rs
index a8cf3516bd9c..3c052118de7f 100644
--- a/src/runtime/cli/audit_command.rs
+++ b/src/runtime/cli/audit_command.rs
@@ -752,7 +752,7 @@ fn send_audit_request(
         headers.entries,
         headers_buf,
         &final_compressed_body,
-        http_proxy,
+        http_proxy.as_ref().map(|proxy| proxy.url()),
         None,
         http::FetchRedirect::Follow,
     );
diff --git a/src/runtime/cli/create_command.rs b/src/runtime/cli/create_command.rs
index 62f438717a75..51971857256b 100644
--- a/src/runtime/cli/create_command.rs
+++ b/src/runtime/cli/create_command.rs
@@ -1952,7 +1952,7 @@ impl Example {
             header_entries,
             headers_buf,
             b"",
-            http_proxy,
+            http_proxy.as_ref().map(|proxy| proxy.url()),
             None,
             HTTP::FetchRedirect::Follow,
         ));
@@ -2038,13 +2038,13 @@ impl Example {
             *URL_.get() = Some(api_url.erase_lifetime());
         }
 
-        // SAFETY: `http_proxy` borrows from `env_loader`, which outlives this
-        // fn. Erased to `'static` because `async_http` is `cli_arena()`-backed
-        // (so its type parameter is `'static`), but the proxy URL is only read
-        // during the `send_sync()` calls below while `env_loader` is live.
-        let mut http_proxy: Option<URL<'static>> = env_loader
-            .get_http_proxy_for(unsafe { (*URL_.get()).as_ref().unwrap() })
-            .map(|u| unsafe { u.erase_lifetime() });
+        // `async_http` below lives in `cli_arena()` and is `'static`, so its proxy must be too.
+        fn arena_http_proxy(env_loader: &DotEnv::Loader, url: &URL<'_>) -> Option<URL<'static>> {
+            let proxy = env_loader.get_http_proxy_for(url)?;
+            Some(URL::parse(crate::cli::cli_dupe(proxy.href())))
+        }
+        // SAFETY: single-threaded CLI access to static URL_ (set just above)
+        let http_proxy = arena_http_proxy(env_loader, unsafe { (*URL_.get()).as_ref().unwrap() });
 
         // ensure very stable memory address
         let async_http: &mut HTTP::AsyncHTTP =
@@ -2137,10 +2137,7 @@ impl Example {
         // ensure very stable memory address
         let parsed_tarball_url = URL::parse(tarball_url);
 
-        // SAFETY: see note on `http_proxy` above.
-        http_proxy = env_loader
-            .get_http_proxy_for(&parsed_tarball_url)
-            .map(|u| unsafe { u.erase_lifetime() });
+        let http_proxy = arena_http_proxy(env_loader, &parsed_tarball_url);
 
         *async_http = HTTP::AsyncHTTP::init_sync(
             HTTP::Method::GET,
@@ -2193,7 +2190,7 @@ impl Example {
             Default::default(),
             b"",
             b"",
-            http_proxy,
+            http_proxy.as_ref().map(|proxy| proxy.url()),
             None,
             HTTP::FetchRedirect::Follow,
         ));
diff --git a/src/runtime/cli/pm_view_command.rs b/src/runtime/cli/pm_view_command.rs
index fda09c89cb88..bf15dd588018 100644
--- a/src/runtime/cli/pm_view_command.rs
+++ b/src/runtime/cli/pm_view_command.rs
@@ -128,7 +128,7 @@ pub(crate) fn view(
         headers.entries,
         header_buf,
         b"",
-        http_proxy,
+        http_proxy.as_ref().map(|proxy| proxy.url()),
         None,
         http::FetchRedirect::Follow,
     );
diff --git a/src/runtime/cli/upgrade_command.rs b/src/runtime/cli/upgrade_command.rs
index fcd16bf1b0bf..737053d86bb7 100644
--- a/src/runtime/cli/upgrade_command.rs
+++ b/src/runtime/cli/upgrade_command.rs
@@ -265,7 +265,7 @@ impl UpgradeCommand {
             header_entries,
             headers_buf,
             b"",
-            http_proxy,
+            http_proxy.as_ref().map(|proxy| proxy.url()),
             None,
             HTTP::FetchRedirect::Follow,
         ));
@@ -657,7 +657,7 @@ impl UpgradeCommand {
                 headers::EntryList::default(),
                 b"",
                 b"",
-                http_proxy,
+                http_proxy.as_ref().map(|proxy| proxy.url()),
                 None,
                 HTTP::FetchRedirect::Follow,
             ));
@@ -687,8 +687,6 @@ impl UpgradeCommand {
                 200 => {}
                 _ => return Err(crate::Error::HTTPError),
             }
-            // Release the immutable borrow of `env_loader` (via `http_proxy`)
-            // before the map mutations below.
             drop(async_http);
 
             let bytes = zip_file_buffer.slice();
diff --git a/src/runtime/server/RequestContext.rs b/src/runtime/server/RequestContext.rs
index 0e337adb45d5..5b5e1b9c10dc 100644
--- a/src/runtime/server/RequestContext.rs
+++ b/src/runtime/server/RequestContext.rs
@@ -2471,20 +2471,19 @@ where
                     let path = s3.path();
                     // `Transpiler::env_mut` is the safe accessor for the
                     // process-singleton dotenv loader (set during init).
-                    let proxy_url = global_this
+                    let proxy = global_this
                         .bun_vm()
                         .as_mut()
                         .transpiler
                         .env_mut()
-                        .get_http_proxy(true, None, None)
-                        .map(|proxy| proxy.href);
+                        .get_http_proxy(true, None, None);
 
                     let _ = S3::client::stat(
                         credentials,
                         path,
                         Self::on_s3_size_resolved_thunk,
                         this.as_ctx_ptr().cast::<c_void>(),
-                        proxy_url,
+                        proxy.as_ref().map(|proxy| proxy.href()),
                         s3.request_payer,
                     ); // TODO: properly propagate exception upwards
                     return;
diff --git a/src/runtime/webcore/Blob.rs b/src/runtime/webcore/Blob.rs
index 8c2a9d0eef54..d02f84cf6867 100644
--- a/src/runtime/webcore/Blob.rs
+++ b/src/runtime/webcore/Blob.rs
@@ -29,12 +29,9 @@ use crate::webcore::{self, Lifetime, ReadableStream, Request, Response, streams}
 
 bun_core::define_scoped_log!(debug, Blob, visible);
 
-/// `bunVM().transpiler.env.getHttpProxy(true, null, null)?.href` as an owned
-/// buffer. Owned (not borrowed) because the env loader's `URL<'_>` ties the
-/// `href` slice to a `&mut Loader` borrow that we cannot keep open across the
-/// S3 request setup.
+/// The `http_proxy` href S3 requests go through, if one is configured.
 #[inline]
-fn http_proxy_href(global: &JSGlobalObject) -> Option<Vec<u8>> {
+fn http_proxy_href(global: &JSGlobalObject) -> Option<Box<[u8]>> {
     // `Transpiler::env_mut` is the safe accessor for the process-singleton
     // dotenv loader (initialised before any JS runs).
     global
@@ -43,7 +40,7 @@ fn http_proxy_href(global: &JSGlobalObject) -> Option<Vec<u8>> {
         .transpiler
         .env_mut()
         .get_http_proxy(true, None, None)
-        .map(|p| p.href.to_vec())
+        .map(bun_url::OwnedURL::into_href)
 }
 
 #[path = "blob/Store.rs"]
@@ -1410,12 +1407,8 @@ impl BlobExt for Blob {
             };
 
             let path = s3.path();
-            // SAFETY: bun_vm() never returns null for a Bun-owned global; `env`
-            // is a live `*mut Loader` owned by the transpiler.
-            let proxy = unsafe {
-                (*global_this.bun_vm().as_mut().transpiler.env).get_http_proxy(true, None, None)
-            };
-            let proxy_url = proxy.map(|p| p.href);
+            let proxy = http_proxy_href(global_this);
+            let proxy_url = proxy.as_deref();
 
             // When no JS overrides were supplied, hand the store's *base*
             // credentials to the upload (`upload_stream` consumes an
@@ -1698,15 +1691,7 @@ impl BlobExt for Blob {
             // content-type writes below don't conflict.
             let s3 = store.data.as_s3();
             let path = s3.path();
-            // SAFETY: `bun_vm()` returns the live per-global VM; `transpiler.env`
-            // is the process-singleton dotenv loader, never null once init'd.
-            let proxy_url: Option<bun_url::URL<'_>> = unsafe {
-                (*global_this.bun_vm().as_mut().transpiler.env).get_http_proxy(true, None, None)
-            };
-            // Copy the href out of the env map before any reentrant JS (the
-            // `get_truthy`/credential getters below) can mutate `process.env`
-            // and free the backing allocation.
-            let proxy_owned: Option<Vec<u8>> = proxy_url.as_ref().map(|p| p.href.to_vec());
+            let proxy_owned = http_proxy_href(global_this);
             let proxy = proxy_owned.as_deref();
 
             if has_args && arg0.is_object() {
diff --git a/src/runtime/webcore/ReadableStream.rs b/src/runtime/webcore/ReadableStream.rs
index 848040a06468..54e4cc70f3ab 100644
--- a/src/runtime/webcore/ReadableStream.rs
+++ b/src/runtime/webcore/ReadableStream.rs
@@ -550,7 +550,7 @@ impl ReadableStream {
                     .transpiler
                     .env_mut()
                     .get_http_proxy(true, None, None);
-                let proxy_url = proxy.as_ref().map(|p| p.href);
+                let proxy_url = proxy.as_ref().map(|p| p.href());
 
                 crate::webcore::s3::client::readable_stream(
                     credentials,
diff --git a/src/runtime/webcore/S3File.rs b/src/runtime/webcore/S3File.rs
index 11826e19a9b3..e7c7d9a99a1d 100644
--- a/src/runtime/webcore/S3File.rs
+++ b/src/runtime/webcore/S3File.rs
@@ -482,7 +482,9 @@ impl S3BlobStatTask {
             path,
             S3BlobStatTask::on_s3_exists_resolved,
             this.cast::<core::ffi::c_void>(),
-            env.get_http_proxy(true, None, None).map(|proxy| proxy.href),
+            env.get_http_proxy(true, None, None)
+                .as_ref()
+                .map(|proxy| proxy.href()),
             s3_store.request_payer,
         )?;
         Ok(promise)
@@ -509,7 +511,9 @@ impl S3BlobStatTask {
             path,
             S3BlobStatTask::on_s3_stat_resolved,
             this.cast::<core::ffi::c_void>(),
-            env.get_http_proxy(true, None, None).map(|proxy| proxy.href),
+            env.get_http_proxy(true, None, None)
+                .as_ref()
+                .map(|proxy| proxy.href()),
             s3_store.request_payer,
         )?;
         Ok(promise)
@@ -536,7 +540,9 @@ impl S3BlobStatTask {
             path,
             S3BlobStatTask::on_s3_size_resolved,
             this.cast::<core::ffi::c_void>(),
-            env.get_http_proxy(true, None, None).map(|proxy| proxy.href),
+            env.get_http_proxy(true, None, None)
+                .as_ref()
+                .map(|proxy| proxy.href()),
             s3_store.request_payer,
         )?;
         Ok(promise)
diff --git a/src/runtime/webcore/blob/Store.rs b/src/runtime/webcore/blob/Store.rs
index f34c88640bcb..5e59d8fc70d9 100644
--- a/src/runtime/webcore/blob/Store.rs
+++ b/src/runtime/webcore/blob/Store.rs
@@ -20,7 +20,7 @@ use crate::webcore::s3::client::{
 };
 use bun_core::{ZigString, strings};
 use bun_http_types::MimeType::MimeType;
-use bun_url::URL;
+use bun_url::OwnedURL;
 
 #[cfg(unix)]
 use super::SizeType;
@@ -331,13 +331,13 @@ impl S3Ext for S3 {
         let value = promise.value();
         // `Transpiler::env_mut` is the safe accessor for the process-singleton
         // dotenv loader (never null once the VM is initialised).
-        let proxy_url: Option<URL<'_>> = global_this
+        let proxy_url: Option<OwnedURL> = global_this
             .bun_vm()
             .as_mut()
             .transpiler
             .env_mut()
             .get_http_proxy(true, None, None);
-        let proxy = proxy_url.as_ref().map(|url| url.href);
+        let proxy = proxy_url.as_ref().map(OwnedURL::href);
         let aws_options = self.get_credentials_with_options(extra_options, global_this)?;
         // `defer aws_options.deinit()` → Drop handles it.
 
@@ -423,13 +423,13 @@ impl S3Ext for S3 {
         let value = promise.value();
         // `Transpiler::env_mut` is the safe accessor for the process-singleton
         // dotenv loader (never null once the VM is initialised).
-        let proxy_url: Option<URL<'_>> = global_this
+        let proxy_url: Option<OwnedURL> = global_this
             .bun_vm()
             .as_mut()
             .transpiler
             .env_mut()
             .get_http_proxy(true, None, None);
-        let proxy = proxy_url.as_ref().map(|url| url.href);
+        let proxy = proxy_url.as_ref().map(OwnedURL::href);
         let aws_options = self.get_credentials_with_options(extra_options, global_this)?;
         // `defer aws_options.deinit()` → Drop handles it.
 
diff --git a/src/standalone_graph/StandaloneModuleGraph.rs b/src/standalone_graph/StandaloneModuleGraph.rs
index 6a1a7b82c97b..16726e4dbd12 100644
--- a/src/standalone_graph/StandaloneModuleGraph.rs
+++ b/src/standalone_graph/StandaloneModuleGraph.rs
@@ -1749,10 +1749,8 @@ pub(crate) fn download_to_path(
             // `progress.end()` below is sufficient: no fallible call sits between
             // `refresher.start` and it, so every exit path (including the
             // error returns after it) ends the node exactly once.
-            // Note: reshaped for borrowck — `get_http_proxy_for` borrows
-            // `env` for the proxy URL lifetime; read the bool first.
             let reject_unauthorized = env.get_tls_reject_unauthorized();
-            let http_proxy: Option<bun_url::URL<'_>> = env.get_http_proxy_for(&url);
+            let http_proxy = env.get_http_proxy_for(&url);
             let progress = refresher.start(b"Downloading", 0);
 
             let mut async_http = Box::new(bun_http::AsyncHTTP::init_sync(
@@ -1761,7 +1759,7 @@ pub(crate) fn download_to_path(
                 Default::default(),
                 b"",
                 b"",
-                http_proxy,
+                http_proxy.as_ref().map(|proxy| proxy.url()),
                 None,
                 bun_http::FetchRedirect::Follow,
             ));
diff --git a/src/url/lib.rs b/src/url/lib.rs
index be249e698626..fcfb3616e855 100644
--- a/src/url/lib.rs
+++ b/src/url/lib.rs
@@ -601,19 +601,22 @@ impl<'a> URL<'a> {
                 if !is_relative_path {
                     // if there's no protocol or @, it's ambiguous whether the colon is a port or a username.
                     if offset > 0 {
-                        // see https://github.com/oven-sh/bun/issues/1390
-                        let first_at =
-                            strings::index_of_char(&base[offset as usize..], b'@').unwrap_or(0);
-                        let first_colon =
-                            strings::index_of_char(&base[offset as usize..], b':').unwrap_or(0);
-
-                        if first_at > first_colon
-                            && first_at
-                                < strings::index_of_char(&base[offset as usize..], b'/')
-                                    .unwrap_or(u32::MAX)
-                        {
-                            offset += url.parse_username(&base[offset as usize..]).unwrap_or(0);
-                            offset += url.parse_password(&base[offset as usize..]).unwrap_or(0);
+                        let rest = &base[offset as usize..];
+                        // Userinfo ends at the last `@` before the path (#1390 had one in the
+                        // path). As in `parse_host`, `#` does not end the authority: raw
+                        // .npmrc / bunfig / tarball credentials may contain one unencoded.
+                        let authority =
+                            &rest[..strings::index_of_any(rest, b"/?").unwrap_or(rest.len())];
+                        if let Some(at) = strings::last_index_of_char(authority, b'@') {
+                            let userinfo = &authority[..at];
+                            match strings::index_of_char_usize(userinfo, b':') {
+                                Some(colon) => {
+                                    url.username = &userinfo[..colon];
+                                    url.password = &userinfo[colon + 1..];
+                                }
+                                None => url.username = userinfo,
+                            }
+                            offset += u32::try_from(at + 1).expect("int cast");
                         }
                     }
 
@@ -724,30 +727,6 @@ impl<'a> URL<'a> {
         None
     }
 
-    pub(crate) fn parse_username(&mut self, str: &'a [u8]) -> Option<u32> {
-        // reset it
-        self.username = b"";
-
-        if str.len() < b"@".len() {
-            return None;
-        }
-        for i in 0..str.len() {
-            match str[i] {
-                b':' | b'@' => {
-                    // we found a username, everything before this point in the slice is a username
-                    self.username = &str[0..i];
-                    return Some(u32::try_from(i + 1).expect("int cast"));
-                }
-                // if we reach a slash or "?", there's no username
-                b'?' | b'/' => {
-                    return None;
-                }
-                _ => {}
-            }
-        }
-        None
-    }
-
     pub(crate) fn parse_password(&mut self, str: &'a [u8]) -> Option<u32> {
         // reset it
         self.password = b"";
diff --git a/test/cli/install/bun-install-proxy.test.ts b/test/cli/install/bun-install-proxy.test.ts
index 960f80e3c0fb..4a4f2bf8ee7f 100644
--- a/test/cli/install/bun-install-proxy.test.ts
+++ b/test/cli/install/bun-install-proxy.test.ts
@@ -291,3 +291,65 @@ describe("registry commands honor http_proxy", () => {
     });
   });
 });
+
+// No squid needed: the proxy below only records what reaches it. `bun install`
+// resolves the proxy through the same env lookup as fetch(), which since
+// #16182 normalizes the value the way new URL() would, so this padded spelling
+// has to reach the proxy instead of being parsed into a bogus host.
+it("bun install routes registry requests through a non-normalized http_proxy value", async () => {
+  let directRegistryHits = 0;
+  using registry = Bun.serve({
+    hostname: "127.0.0.1",
+    port: 0,
+    fetch() {
+      directRegistryHits++;
+      return new Response(null, { status: 500 });
+    },
+  });
+  const proxyLog: string[] = [];
+  using proxy = Bun.listen<{ head: string }>({
+    hostname: "127.0.0.1",
+    port: 0,
+    socket: {
+      open(socket) {
+        socket.data = { head: "" };
+      },
+      data(socket, chunk) {
+        const head = (socket.data.head += new TextDecoder("latin1").decode(chunk));
+        if (!head.includes("\r\n\r\n")) return;
+        proxyLog.push(head.slice(0, head.indexOf("\r\n")));
+        socket.end("HTTP/1.1 404 Not Found\r\nContent-Length: 0\r\nConnection: close\r\n\r\n");
+      },
+    },
+  });
+  using dir = tempDir("install-env-proxy", {
+    "package.json": JSON.stringify({ name: "app", dependencies: { "only-behind-the-proxy": "1.0.0" } }),
+  });
+
+  await using proc = Bun.spawn({
+    cmd: [bunExe(), "install", "--registry", `http://127.0.0.1:${registry.port}/`],
+    cwd: String(dir),
+    env: {
+      ...bunEnv,
+      BUN_INSTALL_CACHE_DIR: join(String(dir), ".bun-cache"),
+      NO_PROXY: undefined,
+      no_proxy: undefined,
+      HTTP_PROXY: undefined,
+      HTTPS_PROXY: undefined,
+      https_proxy: undefined,
+      http_proxy: `  http:\\\\127.0.0.1:${proxy.port}  `,
+    },
+    stdout: "pipe",
+    stderr: "pipe",
+  });
+  const [stdout, stderr, exitCode] = await Promise.all([proc.stdout.text(), proc.stderr.text(), proc.exited]);
+  const manifestUrl = `http://127.0.0.1:${registry.port}/only-behind-the-proxy`;
+  expect({ proxyLog, directRegistryHits, stdout, stderr, exitCode }).toEqual({
+    proxyLog: [`GET ${manifestUrl} HTTP/1.1`],
+    directRegistryHits: 0,
+    stdout: expect.stringContaining("bun install v"),
+    // The proxy's 404 is what fails the install, not a failure to reach the proxy.
+    stderr: expect.stringContaining(`error: GET ${manifestUrl} - 404`),
+    exitCode: 1,
+  });
+});
diff --git a/test/cli/install/bun-install.test.ts b/test/cli/install/bun-install.test.ts
index 20a408d14bde..0940ffabcd16 100644
--- a/test/cli/install/bun-install.test.ts
+++ b/test/cli/install/bun-install.test.ts
@@ -5200,6 +5200,92 @@ describe.concurrent("bun-install", () => {
     });
   });
 
+  // Tarball URLs reach the URL parser as written, without WHATWG normalization.
+  // `user@` with a port used to be read as the hostname `user@127.0.0.1`
+  // (#16181, the second repro of #7416; sending the credentials as Basic auth,
+  // the rest of #7416, is a separate feature). Userinfo is delimited by the last
+  // `@` before the path, so an unencoded `@` or `#` inside it stays userinfo.
+  it.each(["user@", "user:pw@", "user@pass@", "user:p@ss@", "user:p#ss@", "us#er:pw@"])(
+    "connects to the host of http://%s127.0.0.1:<port>/pkg.tgz",
+    async userinfo => {
+      const requests: string[] = [];
+      using server = Bun.serve({
+        hostname: "127.0.0.1",
+        port: 0,
+        fetch(req) {
+          requests.push(`${req.method} ${new URL(req.url).pathname}`);
+          return new Response(null, { status: 404 });
+        },
+      });
+      const tarballUrl = `http://${userinfo}127.0.0.1:${server.port}/pkg.tgz`;
+      using dir = tempDir("tarball-userinfo", {
+        "package.json": JSON.stringify({ name: "foo", dependencies: { pkg: tarballUrl } }),
+      });
+      await using proc = spawn({
+        cmd: [bunExe(), "install"],
+        cwd: String(dir),
+        env: {
+          ...env,
+          BUN_INSTALL_CACHE_DIR: join(String(dir), ".bun-cache"),
+          http_proxy: undefined,
+          HTTP_PROXY: undefined,
+          https_proxy: undefined,
+          HTTPS_PROXY: undefined,
+        },
+        stdout: "pipe",
+        stderr: "pipe",
+      });
+      const [stdout, stderr, exitCode] = await Promise.all([proc.stdout.text(), proc.stderr.text(), proc.exited]);
+      expect({ requests, stdout, stderr, exitCode }).toEqual({
+        requests: ["GET /pkg.tgz"],
+        stdout: expect.stringContaining("bun install v1."),
+        // The server's 404 is what fails the install; before, the request never left the machine.
+        stderr: expect.stringContaining(`error: GET ${tarballUrl} - 404`),
+        exitCode: 1,
+      });
+    },
+  );
+
+  // Registry URLs from bunfig / .npmrc are parsed as written as well, and their
+  // credentials become the Authorization header; an unencoded `#` in the
+  // password has always been accepted there.
+  it("sends the credentials of a bunfig registry URL whose password contains a #", async () => {
+    const requests: string[] = [];
+    using registry = Bun.serve({
+      hostname: "127.0.0.1",
+      port: 0,
+      fetch(req) {
+        requests.push(`${req.method} ${new URL(req.url).pathname} ${req.headers.get("authorization")}`);
+        return new Response(null, { status: 404 });
+      },
+    });
+    using dir = tempDir("registry-userinfo", {
+      "package.json": JSON.stringify({ name: "foo", dependencies: { "some-pkg": "1.0.0" } }),
+      "bunfig.toml": `[install]\nregistry = "http://user:p#ss@127.0.0.1:${registry.port}/"\n`,
+    });
+    await using proc = spawn({
+      cmd: [bunExe(), "install"],
+      cwd: String(dir),
+      env: {
+        ...env,
+        BUN_INSTALL_CACHE_DIR: join(String(dir), ".bun-cache"),
+        http_proxy: undefined,
+        HTTP_PROXY: undefined,
+        https_proxy: undefined,
+        HTTPS_PROXY: undefined,
+      },
+      stdout: "pipe",
+      stderr: "pipe",
+    });
+    const [stdout, stderr, exitCode] = await Promise.all([proc.stdout.text(), proc.stderr.text(), proc.exited]);
+    expect({ requests, stdout, stderr, exitCode }).toEqual({
+      requests: [`GET /some-pkg Basic ${btoa("user:p#ss")}`],
+      stdout: expect.stringContaining("bun install v1."),
+      stderr: expect.stringContaining("some-pkg@1.0.0 failed to resolve"),
+      exitCode: 1,
+    });
+  });
+
   it("should handle GitHub URL with existing lockfile", async () => {
     await withContext(defaultOpts, async ctx => {
       const urls: string[] = [];
diff --git a/test/js/bun/http/proxy.test.ts b/test/js/bun/http/proxy.test.ts
index f53965c66cb9..3167050d26bc 100644
--- a/test/js/bun/http/proxy.test.ts
+++ b/test/js/bun/http/proxy.test.ts
@@ -523,9 +523,9 @@ test("proxy with long password (> 4096 chars) works correctly after redirect", a
 // must still send the colon. bun previously dropped the colon for empty
 // password and sent no header at all for empty username.
 //
-// Exercised via http_proxy in a subprocess (rather than the `{proxy}` option)
-// so the raw env string reaches bun_url::URL::parse without WHATWG
-// normalization first dropping the `:` and tripping the userinfo heuristic.
+// The `{proxy}` option and (since #16182) the env vars both go through the
+// WHATWG parser first, which serializes `user:@host:port` as `user@host:port`;
+// bun_url::URL::parse used to read that whole thing as the hostname.
 describe.each([
   { userinfo: "squidadmin:", decoded: "squidadmin:" },
   { userinfo: ":hunter2", decoded: ":hunter2" },
@@ -538,6 +538,20 @@ describe.each([
   const noProxyEnv = { ...bunEnv };
   for (const k of PROXY_ENV_KEYS) delete noProxyEnv[k];
 
+  test.concurrent("http target (absolute-form) via the proxy option", async () => {
+    const proxy = await createAuthCapturingProxy();
+    try {
+      const response = await fetch(httpServer.url, {
+        proxy: `http://${userinfo}@127.0.0.1:${proxy.port}`,
+        keepalive: false,
+      });
+      expect(response.status).toBe(200);
+      expect(proxy.capturedAuths).toEqual([expected]);
+    } finally {
+      await proxy.close();
+    }
+  });
+
   test.concurrent("http target (absolute-form)", async () => {
     const proxy = await createAuthCapturingProxy();
     try {
@@ -2320,3 +2334,182 @@ describe("http_proxy env var scheme is case-insensitive", () => {
     expect(exitCode).toBe(0);
   });
 });
+
+describe("http_proxy/https_proxy env values are normalized like the fetch() proxy option (#16182)", () => {
+  // fetch(url, { proxy }) runs the proxy URL through the WHATWG parser, so each
+  // spelling below is accepted there and means http://127.0.0.1:<port>/. The env
+  // vars used to be handed to the lenient internal parser as written, which sent
+  // the request to a bogus host or port instead of the proxy.
+  const unsetProxyEnv = {
+    NO_PROXY: undefined,
+    no_proxy: undefined,
+    HTTP_PROXY: undefined,
+    http_proxy: undefined,
+    HTTPS_PROXY: undefined,
+    https_proxy: undefined,
+  };
+
+  async function fetchThroughEnvProxy(envKey: string, spell: (proxyPort: number) => string, target: string) {
+    const proxy = await createProxyServer(false);
+    try {
+      const proxyPort = (proxy.server.address() as net.AddressInfo).port;
+      await using proc = Bun.spawn({
+        cmd: [
+          bunExe(),
+          "-e",
+          `const r = await fetch(process.env.TARGET, { keepalive: false, tls: { rejectUnauthorized: false } }); console.log(r.status);`,
+        ],
+        env: { ...bunEnv, ...unsetProxyEnv, [envKey]: spell(proxyPort), TARGET: target },
+        stdout: "pipe",
+        stderr: "pipe",
+      });
+      const [stdout, stderr, exitCode] = await Promise.all([proc.stdout.text(), proc.stderr.text(), proc.exited]);
+      return { stdout: stdout.trim(), stderr, exitCode, proxyLog: [...proxy.log] };
+    } finally {
+      // Not awaited, see the redirect test near the top of the file.
+      proxy.server.close();
+    }
+  }
+
+  const spellings = [
+    ["leading whitespace", "http_proxy", (p: number) => `  http://127.0.0.1:${p}`],
+    ["trailing whitespace", "HTTP_PROXY", (p: number) => `http://127.0.0.1:${p}  `],
+    ["tab inside the authority", "http_proxy", (p: number) => `http://127.0.0.1:\t${p}`],
+    ["backslashes", "HTTP_PROXY", (p: number) => `http:\\\\127.0.0.1:${p}`],
+    ["no slashes after the scheme", "http_proxy", (p: number) => `http:127.0.0.1:${p}`],
+    ["already normalized", "HTTP_PROXY", (p: number) => `http://127.0.0.1:${p}/`],
+    // new URL() rejects this one; it must keep getting the lenient treatment it always had.
+    ["scheme-less host:port", "http_proxy", (p: number) => `127.0.0.1:${p}`],
+  ] as const;
+
+  test.concurrent.each(spellings)("http target, %s", async (_label, envKey, spell) => {
+    const target = `http://127.0.0.1:${httpServer.port}/env-proxy`;
+    const { stdout, stderr, exitCode, proxyLog } = await fetchThroughEnvProxy(envKey, spell, target);
+    expect({ stdout, stderr, exitCode, proxyLog }).toEqual({
+      stdout: "200",
+      stderr: "",
+      exitCode: 0,
+      proxyLog: [`GET 127.0.0.1:${httpServer.port}/env-proxy`],
+    });
+  });
+
+  const httpsSpellings = [
+    ["leading whitespace", "https_proxy", (p: number) => `  http://127.0.0.1:${p}`],
+    ["backslashes", "HTTPS_PROXY", (p: number) => `http:\\\\127.0.0.1:${p}`],
+    ["no slashes after the scheme", "https_proxy", (p: number) => `http:127.0.0.1:${p}`],
+  ] as const;
+
+  test.concurrent.each(httpsSpellings)("https target (CONNECT), %s", async (_label, envKey, spell) => {
+    const target = `https://127.0.0.1:${httpsServer.port}/env-proxy`;
+    const { stdout, stderr, exitCode, proxyLog } = await fetchThroughEnvProxy(envKey, spell, target);
+    expect({ stdout, stderr, exitCode, proxyLog }).toEqual({
+      stdout: "200",
+      stderr: "",
+      exitCode: 0,
+      proxyLog: [`CONNECT 127.0.0.1:${httpsServer.port}`],
+    });
+  });
+
+  test.concurrent("every redirect hop uses the normalized proxy", async () => {
+    using origin = Bun.serve({
+      hostname: "127.0.0.1",
+      port: 0,
+      fetch: req =>
+        new URL(req.url).pathname === "/first"
+          ? new Response(null, { status: 302, headers: { Location: "/second" } })
+          : new Response("done"),
+    });
+    const { stdout, stderr, exitCode, proxyLog } = await fetchThroughEnvProxy(
+      "http_proxy",
+      p => `  http:\\\\127.0.0.1:${p}  `,
+      `http://127.0.0.1:${origin.port}/first`,
+    );
+    expect({ stdout, stderr, exitCode, proxyLog }).toEqual({
+      stdout: "200",
+      stderr: "",
+      exitCode: 0,
+      proxyLog: [`GET 127.0.0.1:${origin.port}/first`, `GET 127.0.0.1:${origin.port}/second`],
+    });
+  });
+
+  /** A proxy that answers every request itself with whatever `respond` builds from the request head. */
+  async function answeringProxy(respond: (headLines: string[]) => string) {
+    const log: string[] = [];
+    const server = net.createServer(socket => {
+      socket.on("error", () => {});
+      let head = "";
+      socket.on("data", chunk => {
+        head += chunk.toString("latin1");
+        const end = head.indexOf("\r\n\r\n");
+        if (end === -1) return;
+        socket.removeAllListeners("data");
+        const lines = head.slice(0, end).split("\r\n");
+        log.push(lines[0]);
+        socket.end(respond(lines));
+      });
+    });
+    server.listen(0, "127.0.0.1");
+    await once(server, "listening");
+    return { port: (server.address() as net.AddressInfo).port, log, [Symbol.dispose]: () => server.close() };
+  }
+
+  const credentialSpellings = [
+    // The WHATWG parser percent-encodes the space and leaves the %40 alone;
+    // Proxy-Authorization must carry the decoded credentials.
+    ["normalized by new URL()", (p: number) => `  http://us%40er:p ss@127.0.0.1:${p}  `, "us@er:p ss"],
+    // new URL() rejects this one (the # starts a fragment, leaving the port "p"),
+    // so it is used as written and has to keep working the way it always did.
+    ["rejected by new URL()", (p: number) => `http://user:p#ss@127.0.0.1:${p}`, "user:p#ss"],
+  ] as const;
+
+  test.concurrent.each(credentialSpellings)("credentials %s reach the proxy", async (_label, spell, decoded) => {
+    using proxy = await answeringProxy(lines => {
+      const auth = lines
+        .find(l => /^proxy-authorization:/i.test(l))
+        ?.slice("proxy-authorization:".length)
+        .trim();
+      return `HTTP/1.1 200 OK\r\nContent-Length: ${String(auth).length}\r\nConnection: close\r\n\r\n${auth}`;
+    });
+    const target = `http://127.0.0.1:${httpServer.port}/env-proxy-auth`;
+    await using proc = Bun.spawn({
+      cmd: [bunExe(), "-e", `console.log(await (await fetch(process.env.TARGET, { keepalive: false })).text());`],
+      env: { ...bunEnv, ...unsetProxyEnv, http_proxy: spell(proxy.port), TARGET: target },
+      stdout: "pipe",
+      stderr: "pipe",
+    });
+    const [stdout, stderr, exitCode] = await Promise.all([proc.stdout.text(), proc.stderr.text(), proc.exited]);
+    expect({ stdout: stdout.trim(), stderr, exitCode, proxyLog: proxy.log }).toEqual({
+      stdout: `Basic ${btoa(decoded)}`,
+      stderr: "",
+      exitCode: 0,
+      proxyLog: [`GET ${target} HTTP/1.1`],
+    });
+  });
+
+  test.concurrent("S3 requests read the same normalized value", async () => {
+    // S3 reads the env var through a different code path than fetch(), so it
+    // gets its own case. The proxy answers the absolute-form HEAD itself; the
+    // endpoint (this file's plain http origin) would answer without an ETag.
+    using proxy = await answeringProxy(
+      () => `HTTP/1.1 200 OK\r\nContent-Length: 5\r\nETag: "abc"\r\nConnection: close\r\n\r\n`,
+    );
+    const endpoint = `http://127.0.0.1:${httpServer.port}`;
+    await using proc = Bun.spawn({
+      cmd: [
+        bunExe(),
+        "-e",
+        `const s = await Bun.S3Client.stat("key", { accessKeyId: "x", secretAccessKey: "y", bucket: "b", endpoint: process.env.ENDPOINT }); console.log(s.size);`,
+      ],
+      env: { ...bunEnv, ...unsetProxyEnv, HTTP_PROXY: `http:127.0.0.1:${proxy.port}`, ENDPOINT: endpoint },
+      stdout: "pipe",
+      stderr: "pipe",
+    });
+    const [stdout, stderr, exitCode] = await Promise.all([proc.stdout.text(), proc.stderr.text(), proc.exited]);
+    expect({ stdout: stdout.trim(), stderr, exitCode, proxyLog: proxy.log }).toEqual({
+      stdout: "5",
+      stderr: "",
+      exitCode: 0,
+      proxyLog: [`HEAD ${endpoint}/b/key HTTP/1.1`],
+    });
+  });
+});
diff --git a/test/js/web/fetch/fetch.test.ts b/test/js/web/fetch/fetch.test.ts
index 97a34a33c2db..3ac85d18ff8a 100644
--- a/test/js/web/fetch/fetch.test.ts
+++ b/test/js/web/fetch/fetch.test.ts
@@ -3657,3 +3657,32 @@ it("verbose fetch logging escapes control characters coming from the peer", asyn
   expect(stderr).not.toMatch(/[\x80-\x9f]/);
   expect(exitCode).toBe(0);
 });
+
+describe("connects to the host of a URL whose authority contains an @", () => {
+  // After WHATWG normalization the request URL is re-read by bun's own URL
+  // parser to pick the host to connect to. It used to decide whether userinfo
+  // was present from the position of the first colon, so `user@host:port`
+  // (credentials without a password, plus an explicit port) was connected to
+  // as if `user@host` were the hostname. An @ outside the authority (#1390)
+  // must still not be mistaken for userinfo, and the Host header the server
+  // sees must be the bare host:port in every case.
+  it.each([
+    ["user@", "/creds"],
+    ["user@", ""],
+    ["user:pw@", "/creds"],
+    [":pw@", "/creds"],
+    ["", "/@/path"],
+    ["", "/?next=a@b"],
+  ])("http://%s127.0.0.1:<port>%s", async (userinfo, pathAndQuery) => {
+    using server = Bun.serve({
+      hostname: "127.0.0.1",
+      port: 0,
+      fetch: req => new Response(`${req.headers.get("host")} ${new URL(req.url).pathname}`),
+    });
+    const res = await fetch(`http://${userinfo}127.0.0.1:${server.port}${pathAndQuery}`, { keepalive: false });
+    expect({ status: res.status, hostAndPath: await res.text() }).toEqual({
+      status: 200,
+      hostAndPath: `127.0.0.1:${server.port} ${new URL(pathAndQuery, "http://x").pathname}`,
+    });
+  });
+});

From a55d541939065a91ae83358b987fda8ce939241f Mon Sep 17 00:00:00 2001
From: robobun <117481402+robobun@users.noreply.github.com>
Date: Mon, 17 Aug 2026 02:35:46 +0000
Subject: [PATCH 153/258] install: resolve .npmrc //host/ credentials by
 request URL (#38800)

---
 docs/pm/npmrc.mdx                             |   2 +-
 src/api/lib.rs                                |   2 +-
 src/ini/lib.rs                                |  23 +-
 src/install/NetworkTask.rs                    |  47 +--
 src/install/PackageManager.rs                 |   3 +
 .../PackageManager/PackageManagerOptions.rs   | 145 +++++++
 src/install/PackageManager/runTasks.rs        |  46 ++-
 src/install/npm.rs                            |  89 ++++
 src/options_types/schema.rs                   |  22 +
 test/cli/install/npmrc.test.ts                | 388 ++++++++++++++++++
 10 files changed, 733 insertions(+), 34 deletions(-)

diff --git a/docs/pm/npmrc.mdx b/docs/pm/npmrc.mdx
index adac6df65c44..0057cc54a586 100644
--- a/docs/pm/npmrc.mdx
+++ b/docs/pm/npmrc.mdx
@@ -13,7 +13,7 @@ Configuration is loaded in this order, with later sources overriding earlier one
 4. `BUN_CONFIG_REGISTRY` / `NPM_CONFIG_REGISTRY` and `BUN_CONFIG_TOKEN` / `NPM_CONFIG_TOKEN` environment variables
 5. Command-line flags such as `--registry`
 
-Bun matches credentials in `.npmrc` (`//<registry>/:_authToken`, etc.) to registries by host and path, even if you set the registry URL itself in `bunfig.toml`.
+Bun matches credentials in `.npmrc` (`//<registry>/:_authToken`, etc.) by host and path to the URLs it requests, so they apply no matter where you set the registry URL itself (`.npmrc`, `bunfig.toml`, an environment variable or `--registry`). Bun also uses them for tarballs a registry serves from a different host than its own, as long as that host has its own `//<host>/:_authToken` line; it never sends a registry's credentials to another host.
 
 Values may reference environment variables. Bun replaces `${NAME}` with the variable's value, or leaves it as-is if the variable is unset. `${NAME?}` becomes an empty string if unset.
 
diff --git a/src/api/lib.rs b/src/api/lib.rs
index 5ea6fdaf5719..1c8639c80dcf 100644
--- a/src/api/lib.rs
+++ b/src/api/lib.rs
@@ -9,7 +9,7 @@
 // ──────────────────────────────────────────────────────────────────────────
 
 pub use bun_options_types::schema::api::{
-    BunInstall, Ca, NodeLinker, NpmRegistry, NpmRegistryMap, PnpmMatcher,
+    BunInstall, Ca, NodeLinker, NpmRegistry, NpmRegistryMap, NpmUrlAuth, PnpmMatcher,
 };
 
 // ──────────────────────────────────────────────────────────────────────────
diff --git a/src/ini/lib.rs b/src/ini/lib.rs
index fed27f26583d..8c6097257892 100644
--- a/src/ini/lib.rs
+++ b/src/ini/lib.rs
@@ -131,7 +131,7 @@ mod draft {
     use core::ptr;
 
     use bun_alloc::{AllocError, Arena, ArenaVec, ArenaVecExt as _};
-    use bun_api::{self, BunInstall, NpmRegistry, npm_registry};
+    use bun_api::{self, BunInstall, NpmRegistry, NpmUrlAuth, npm_registry};
     use bun_ast::E::Rope;
     use bun_ast::{E, Expr, ExprData, StoreRef};
     use bun_ast::{Loc, Log, Source};
@@ -1183,6 +1183,26 @@ mod draft {
                 RegistryCredential::Email(email) => registry.email.clone_from(email),
             }
         }
+
+        /// Record this line under its `//host/path/` prefix so the package
+        /// manager can also resolve it by request URL (see `NpmUrlAuth`).
+        fn apply_to_url_auth(&self, url_auth: &mut Vec<NpmUrlAuth>) {
+            let entry = match url_auth
+                .iter_mut()
+                .find(|entry| entry.host == self.host && entry.pathname == self.pathname)
+            {
+                Some(entry) => entry,
+                None => {
+                    url_auth.push(NpmUrlAuth {
+                        host: self.host.clone(),
+                        pathname: self.pathname.clone(),
+                        credentials: NpmRegistry::default(),
+                    });
+                    url_auth.last_mut().expect("just pushed")
+                }
+            };
+            self.apply_to(&mut entry.credentials);
+        }
     }
 
     // ──────────────────────────────────────────────────────────────────────────
@@ -1594,6 +1614,7 @@ mod draft {
                     continue;
                 }
                 if let Some(auth) = RegistryAuth::from_config_item(conf_item, iter.log, source) {
+                    auth.apply_to_url_auth(&mut install.url_auth);
                     configs.push(auth);
                 }
             }
diff --git a/src/install/NetworkTask.rs b/src/install/NetworkTask.rs
index 5d99a54f700a..119abd07082b 100644
--- a/src/install/NetworkTask.rs
+++ b/src/install/NetworkTask.rs
@@ -64,6 +64,10 @@ pub struct NetworkTask {
     pub(crate) header_buf: Box<[u8]>,
     /// Proxy href for this request (empty: direct); owned like `url_buf`, `AsyncHTTP` borrows it.
     pub(crate) http_proxy_buf: Box<[u8]>,
+    /// Whether this request was allowed to carry registry credentials at all
+    /// (`github:` and URL tarball dependencies are not). Read back when a
+    /// 401/403 is reported, so the suggested fix is one that would apply.
+    pub(crate) authorization: Authorization,
     pub(crate) retried: u16,
     pub(crate) response_buffer: MutableString,
     // BACKREF: PackageManager owns this task via `preallocated_network_tasks`.
@@ -635,6 +639,8 @@ impl NetworkTask {
             }
         }
 
+        self.authorization = Authorization::AllowAuthorization;
+
         let mut header_builder = HeaderBuilder::default();
 
         count_auth(&mut header_builder, scope);
@@ -866,35 +872,22 @@ impl NetworkTask {
             None => None,
         };
 
-        // Only attach the registry `Authorization` header when the tarball URL
-        // origin matches the configured registry scope origin. The npm manifest
-        // is registry-controlled, so a malicious registry could otherwise point
-        // the tarball at an attacker-controlled host and receive the scope
-        // credentials. The empty-`tarball_url` branch builds the URL from
-        // `scope.url.href()`, so its origin matches and authorized downloads
-        // keep working.
-        // Compare (protocol, hostname, effective port) rather than the raw
-        // `URL.origin` slice — `origin` is a borrowed prefix of the input
-        // string and is not normalized for default ports, so a tarball URL of
-        // `https://host:443/...` would not byte-match a `.npmrc` registry of
-        // `https://host/...` even though they are the same origin. Some
-        // registries emit `dist.tarball` URLs with the default port spelled
-        // out; without normalization those installs lose the `Authorization`
-        // header and fail with 401.
-        let send_auth = matches!(authorization, Authorization::AllowAuthorization) && {
-            let tarball = URL::parse(&self.url_buf);
-            let registry = scope.url.url();
-            tarball.protocol == registry.protocol
-                && tarball.hostname == registry.hostname
-                && tarball.get_port_auto() == registry.get_port_auto()
+        self.authorization = authorization;
+        // The empty-`tarball_url` branch above built the URL from `scope.url`,
+        // so it is same-origin and gets the scope's credentials.
+        let credentials = match authorization {
+            Authorization::NoAuthorization => None,
+            Authorization::AllowAuthorization => pm
+                .options
+                .tarball_credentials(scope, &URL::parse(&self.url_buf)),
         };
 
         self.response_buffer = MutableString::init_empty();
 
         let mut header_builder = HeaderBuilder::default();
 
-        if send_auth {
-            count_auth(&mut header_builder, scope);
+        if let Some(credentials) = credentials {
+            count_auth(&mut header_builder, credentials);
         }
 
         // Same precedence as npm, where node derives `Authorization` from the
@@ -910,9 +903,10 @@ impl NetworkTask {
 
         let header_buf: &'static [u8] = if header_builder.header_count > 0 {
             header_builder.allocate()?;
-            match &url_authorization {
-                Some(value) => header_builder.append("Authorization", value),
-                None => append_auth(&mut header_builder, scope),
+            match (&url_authorization, credentials) {
+                (Some(value), _) => header_builder.append("Authorization", value),
+                (None, Some(credentials)) => append_auth(&mut header_builder, credentials),
+                (None, None) => {}
             }
             debug_assert_eq!(header_builder.content.len, header_builder.content.cap);
             self.header_buf = header_builder.content.move_to_slice();
@@ -1066,6 +1060,7 @@ impl NetworkTask {
             addr_of_mut!((*slot).url_buf).write(Box::default());
             addr_of_mut!((*slot).header_buf).write(Box::default());
             addr_of_mut!((*slot).http_proxy_buf).write(Box::default());
+            addr_of_mut!((*slot).authorization).write(Authorization::NoAuthorization);
             addr_of_mut!((*slot).retried).write(0);
             addr_of_mut!((*slot).next).write(bun_threading::Link::new());
             addr_of_mut!((*slot).tarball_stream).write(None);
diff --git a/src/install/PackageManager.rs b/src/install/PackageManager.rs
index ce08b0d5a703..3a195d9070f2 100644
--- a/src/install/PackageManager.rs
+++ b/src/install/PackageManager.rs
@@ -1398,6 +1398,7 @@ fn overlay_bunfig_install(install: &mut Api::BunInstall, bunfig: Api::BunInstall
     let Api::BunInstall {
         default_registry,
         scoped,
+        url_auth,
         lockfile_path,
         save_lockfile_path,
         cache_directory,
@@ -1446,6 +1447,8 @@ fn overlay_bunfig_install(install: &mut Api::BunInstall, bunfig: Api::BunInstall
         }
     }
 
+    install.url_auth.extend(url_auth);
+
     macro_rules! overlay {
         ($($field:ident),* $(,)?) => {
             $( if $field.is_some() { install.$field = $field; } )*
diff --git a/src/install/PackageManager/PackageManagerOptions.rs b/src/install/PackageManager/PackageManagerOptions.rs
index 52c014bb0de1..fcce29404bd0 100644
--- a/src/install/PackageManager/PackageManagerOptions.rs
+++ b/src/install/PackageManager/PackageManagerOptions.rs
@@ -5,6 +5,7 @@ use bun_paths::PathBuffer;
 
 use super::Subcommand;
 use super::command_line_arguments::{self, CommandLineArguments};
+use crate::network_task::Authorization;
 use bun_dotenv::Loader as DotEnvLoader;
 use bun_install::{Features, Npm};
 
@@ -26,6 +27,10 @@ pub struct Options {
     pub scope: Npm::registry::Scope,
 
     pub(crate) registries: Npm::registry::Map,
+    /// `.npmrc` `//host/path/` credential lines, resolved by request URL. Fills
+    /// in scopes whose registry was configured without credentials of its own
+    /// and authenticates tarballs hosted somewhere other than their registry.
+    pub(crate) url_auth: Vec<Npm::registry::UrlAuth>,
     pub(crate) cache_directory: &'static [u8],
     pub enable: Enable,
     pub do_: Do,
@@ -110,6 +115,7 @@ impl Default for Options {
             // Always assigned in `load()` before read.
             scope: Npm::registry::Scope::default(),
             registries: Npm::registry::Map::default(),
+            url_auth: Vec::new(),
             cache_directory: b"",
             enable: Enable::default(),
             do_: Do::default(),
@@ -258,6 +264,135 @@ impl Options {
             _ => &self.scope,
         }
     }
+
+    /// The credentials a tarball download may carry.
+    ///
+    /// The manifest that names the tarball URL comes from the registry, so a
+    /// malicious registry could point `dist.tarball` at a host of its choosing;
+    /// `scope`'s credentials therefore only go to `scope`'s own origin. Any
+    /// other origin gets exactly what the user configured for it in `.npmrc`
+    /// (`//that-host/:_authToken=...`), which covers registries that serve
+    /// tarballs from a separate host and lockfiles recorded against a
+    /// registry that has since moved; an origin without such a line gets
+    /// nothing.
+    pub(crate) fn tarball_credentials<'a>(
+        &'a self,
+        scope: &'a Npm::registry::Scope,
+        tarball: &bun_url::URL,
+    ) -> Option<&'a Npm::registry::Scope> {
+        if scope.has_credentials() && is_same_origin(tarball, &scope.url.url()) {
+            return Some(scope);
+        }
+        Npm::registry::UrlAuth::find(&self.url_auth, tarball)
+    }
+
+    /// Text to append to the `GET <url> - 401` line of a request that bun sent
+    /// without an `Authorization` header, saying which `.npmrc` line would have
+    /// supplied one. Empty when credentials were sent (the registry rejected
+    /// them, and the status line already says everything bun knows) and for
+    /// downloads that never carry registry credentials, where no `.npmrc` line
+    /// would change anything.
+    pub(crate) fn missing_credentials_note(
+        &self,
+        package_name: &[u8],
+        url: &[u8],
+        request: RequestKind,
+    ) -> Vec<u8> {
+        use std::io::Write as _;
+
+        let scope = self.scope_for_package_name(package_name);
+        let mut note = Vec::new();
+        match request {
+            RequestKind::Manifest => {
+                if scope.has_credentials() {
+                    return note;
+                }
+                let registry = scope.url.url();
+                let _ = write!(
+                    note,
+                    "\n  no credentials are configured for this registry; add //{}{}:_authToken=<token> to .npmrc",
+                    bstr::BStr::new(registry.host),
+                    RegistryPath(registry.pathname),
+                );
+            }
+            RequestKind::Tarball(Authorization::NoAuthorization) => {}
+            RequestKind::Tarball(Authorization::AllowAuthorization) => {
+                let url = bun_url::URL::parse(url);
+                if self.tarball_credentials(scope, &url).is_some() {
+                    return note;
+                }
+                if scope.has_credentials() {
+                    let _ = write!(
+                        note,
+                        "\n  the credentials configured for {} are not sent to {}; add //{}/:_authToken=<token> to .npmrc if this host needs them",
+                        bstr::BStr::new(scope.url.url().host),
+                        bstr::BStr::new(url.host),
+                        bstr::BStr::new(url.host),
+                    );
+                } else {
+                    let _ = write!(
+                        note,
+                        "\n  no credentials are configured for {}; add //{}/:_authToken=<token> to .npmrc",
+                        bstr::BStr::new(url.host),
+                        bstr::BStr::new(url.host),
+                    );
+                }
+            }
+        }
+        note
+    }
+
+    /// Give every scope that ended up without credentials the ones `.npmrc`
+    /// configures for its registry URL. This is how `--registry` and
+    /// `$NPM_CONFIG_REGISTRY` pick up a `//host/:_authToken=` line: they are
+    /// applied after the `.npmrc` files were read, so the loader could not
+    /// attach the line to them.
+    fn fill_credentials_from_url_auth(&mut self) {
+        if self.url_auth.is_empty() {
+            return;
+        }
+        let url_auth = &self.url_auth;
+        for scope in core::iter::once(&mut self.scope).chain(self.registries.values_mut()) {
+            if scope.has_credentials() {
+                continue;
+            }
+            let found = Npm::registry::UrlAuth::find(url_auth, &scope.url.url());
+            if let Some(credentials) = found {
+                scope.copy_credentials_from(credentials);
+            }
+        }
+    }
+}
+
+/// Scheme, host and effective port are equal. Compared component-wise rather
+/// than on the raw `URL.origin` slice: some registries spell out the default
+/// port in `dist.tarball` (`https://host:443/...`) while `.npmrc` does not.
+fn is_same_origin(a: &bun_url::URL, b: &bun_url::URL) -> bool {
+    a.protocol.eq_ignore_ascii_case(b.protocol)
+        && a.hostname.eq_ignore_ascii_case(b.hostname)
+        && a.get_port_auto() == b.get_port_auto()
+}
+
+#[derive(Clone, Copy)]
+pub(crate) enum RequestKind {
+    /// Always on the package's registry, so it carries the scope's credentials.
+    Manifest,
+    /// May be anywhere; see `Options::tarball_credentials`. Carries what the
+    /// request was enqueued with (`NetworkTask::authorization`).
+    Tarball(Authorization),
+}
+
+/// A registry pathname in the form `.npmrc` keys use: `/` or `/some/path/`.
+struct RegistryPath<'a>(&'a [u8]);
+
+impl core::fmt::Display for RegistryPath<'_> {
+    fn fmt(&self, f: &mut core::fmt::Formatter<'_>) -> core::fmt::Result {
+        write!(f, "{}", bstr::BStr::new(self.0))?;
+        if !self.0.ends_with(b"/") {
+            f.write_str("/")?;
+        }
+        Ok(())
+    }
 }
 
 #[derive(Copy, Clone, PartialEq, Eq, Default, Debug)]
@@ -439,6 +574,12 @@ impl Options {
                 }
             }
 
+            for url_auth in &config.url_auth {
+                if let Some(url_auth) = Npm::registry::UrlAuth::from_api(url_auth, env)? {
+                    self.url_auth.push(url_auth);
+                }
+            }
+
             if let Some(ca) = &config.ca {
                 match ca {
                     Api::Ca::List(ca_list) => {
@@ -895,6 +1036,10 @@ impl Options {
             self.enable.set(Enable::FORCE_SAVE_LOCKFILE, false);
         }
 
+        // After every source that can set a registry URL (bunfig, .npmrc,
+        // environment, command line) has been applied.
+        self.fill_credentials_from_url_auth();
+
         // moved from `defer { ... }` after scope assignment (see note above).
         self.did_override_default_scope = self.scope.url_hash != *Npm::registry::DEFAULT_URL_HASH;
 
diff --git a/src/install/PackageManager/runTasks.rs b/src/install/PackageManager/runTasks.rs
index f1497e172cf7..73340d4ea5c0 100644
--- a/src/install/PackageManager/runTasks.rs
+++ b/src/install/PackageManager/runTasks.rs
@@ -34,7 +34,7 @@ use bun_install::package_manager_task as Task;
 // Import the *module* under the `Options` name so `Options::LogLevel` resolves as a path
 // (matches the `Task` module-alias pattern above and `CommandLineArguments.rs`).
 use super::package_manager_options as Options;
-use super::package_manager_options::{Do, Enable};
+use super::package_manager_options::{Do, Enable, RequestKind};
 use crate::isolated_install::store as Store;
 
 // ──────────────────────────────────────────────────────────────────────────
@@ -482,23 +482,32 @@ pub fn run_tasks<C: RunTasksCallbacks>(
                         continue;
                     }
 
+                    let note = http_status_note(
+                        manager,
+                        response.status_code,
+                        name,
+                        &task.url_buf,
+                        RequestKind::Manifest,
+                    );
                     if manager.is_network_task_required(task.task_id) {
                         bun_ast::add_error_pretty!(
                             manager.log_mut(),
                             None,
                             bun_ast::Loc::EMPTY,
-                            "<r><red><b>GET<r><red> {}<d> - {}<r>",
+                            "<r><red><b>GET<r><red> {}<d> - {}<r>{}",
                             bun_core::fmt::redacted_npm_url(metadata.url.slice()),
                             response.status_code,
+                            bstr::BStr::new(&note),
                         );
                     } else {
                         bun_ast::add_warning_pretty!(
                             manager.log_mut(),
                             None,
                             bun_ast::Loc::EMPTY,
-                            "<r><yellow><b>GET<r><yellow> {}<d> - {}<r>",
+                            "<r><yellow><b>GET<r><yellow> {}<d> - {}<r>{}",
                             bun_core::fmt::redacted_npm_url(metadata.url.slice()),
                             response.status_code,
+                            bstr::BStr::new(&note),
                         );
                     }
                     if manager.subcommand != Subcommand::Remove {
@@ -838,23 +847,32 @@ pub fn run_tasks<C: RunTasksCallbacks>(
                         continue;
                     }
 
+                    let note = http_status_note(
+                        manager,
+                        response.status_code,
+                        extract.name.slice(),
+                        &task.url_buf,
+                        RequestKind::Tarball(task.authorization),
+                    );
                     if is_required {
                         bun_ast::add_error_pretty!(
                             manager.log_mut(),
                             None,
                             bun_ast::Loc::EMPTY,
-                            "<r><red><b>GET<r><red> {}<d> - {}<r>",
+                            "<r><red><b>GET<r><red> {}<d> - {}<r>{}",
                             bun_core::fmt::EscapeControlChars(bun_core::fmt::redacted_npm_url(metadata.url.slice())),
                             response.status_code,
+                            bstr::BStr::new(&note),
                         );
                     } else {
                         bun_ast::add_warning_pretty!(
                             manager.log_mut(),
                             None,
                             bun_ast::Loc::EMPTY,
-                            "<r><yellow><b>GET<r><yellow> {}<d> - {}<r>",
+                            "<r><yellow><b>GET<r><yellow> {}<d> - {}<r>{}",
                             bun_core::fmt::EscapeControlChars(bun_core::fmt::redacted_npm_url(metadata.url.slice())),
                             response.status_code,
+                            bstr::BStr::new(&note),
                         );
                     }
                     if manager.subcommand != Subcommand::Remove {
@@ -1573,6 +1591,24 @@ pub fn run_tasks<C: RunTasksCallbacks>(
     Ok(())
 }
 
+/// Extra line for the `GET <url> - <status>` message: on 401/403, what the
+/// user can configure to authenticate the request (see
+/// `Options::missing_credentials_note`); empty for every other status.
+fn http_status_note(
+    manager: &PackageManager,
+    status_code: u32,
+    package_name: &[u8],
+    url: &[u8],
+    request: RequestKind,
+) -> Vec<u8> {
+    match status_code {
+        401 | 403 => manager
+            .options
+            .missing_credentials_note(package_name, url, request),
+        _ => Vec::new(),
+    }
+}
+
 #[inline]
 pub fn pending_task_count(manager: &PackageManager) -> u32 {
     manager.pending_tasks.load(Ordering::Acquire)
diff --git a/src/install/npm.rs b/src/install/npm.rs
index 8890a105a114..7f00adbb00ca 100644
--- a/src/install/npm.rs
+++ b/src/install/npm.rs
@@ -331,6 +331,18 @@ pub mod registry {
             self.url_hash = Self::hash(strings::without_trailing_slash(self.url.href()));
         }
 
+        /// Whether requests to this scope carry an `Authorization` header.
+        pub(crate) fn has_credentials(&self) -> bool {
+            !self.token.is_empty() || !self.auth.is_empty()
+        }
+
+        /// Take `other`'s credentials, leaving this scope's registry URL as is.
+        pub(crate) fn copy_credentials_from(&mut self, other: &Scope) {
+            self.token.clone_from(&other.token);
+            self.auth.clone_from(&other.auth);
+            self.user.clone_from(&other.user);
+        }
+
         pub(crate) fn get_name(name: &[u8]) -> &[u8] {
             if name.is_empty() || name[0] != b'@' {
                 return name;
@@ -541,6 +553,83 @@ pub mod registry {
     // Keys are pre-hashed (`Scope::hash`), so don't re-hash them.
     pub type Map = HashMap<u64, Scope, bun_collections::IdentityContext<u64>>;
 
+    /// Credentials from a `.npmrc` `//host/path/:...` line, matched against
+    /// request URLs the way npm resolves credentials for a URL: the host
+    /// (including the port) must be the same and the key's path must be the
+    /// request path or one of its parent directories. Keys have no scheme, so
+    /// a key applies to both `http` and `https` requests to its host.
+    pub(crate) struct UrlAuth {
+        hostname: Box<[u8]>,
+        /// `None` when the key does not spell out a port, which means the
+        /// scheme's default port of whatever request is being matched.
+        port: Option<u16>,
+        /// Without trailing slash; `/` for a bare host.
+        pathname: Box<[u8]>,
+        /// Only the credential fields are meaningful; `url` is empty.
+        credentials: Scope,
+    }
+
+    impl UrlAuth {
+        /// `None` when the line carries nothing that can be sent as an
+        /// `Authorization` header (for example only an `email`), so it never
+        /// shadows a shallower key that does.
+        pub(crate) fn from_api(
+            api: &api::NpmUrlAuth,
+            env: &mut DotEnv,
+        ) -> Result<Option<UrlAuth>, AllocError> {
+            let credentials = Scope::from_api(b"", api.credentials.clone(), env)?;
+            if !credentials.has_credentials() {
+                return Ok(None);
+            }
+            let host = URL::parse(&api.host);
+            let port = if host.port.is_empty() {
+                None
+            } else {
+                match host.get_port() {
+                    Some(port) => Some(port),
+                    // `//host:notaport/` cannot match any request.
+                    None => return Ok(None),
+                }
+            };
+            if host.hostname.is_empty() {
+                return Ok(None);
+            }
+            Ok(Some(UrlAuth {
+                hostname: host.hostname.into(),
+                port,
+                pathname: api.pathname.clone(),
+                credentials,
+            }))
+        }
+
+        fn matches(&self, url: &URL) -> bool {
+            if !strings::eql_case_insensitive_ascii(url.hostname, &self.hostname, true) {
+                return false;
+            }
+            let port = url.get_port_auto();
+            let port_matches = match self.port {
+                Some(expected) => port == expected,
+                None => port == if url.is_https() { 443 } else { 80 },
+            };
+            if !port_matches {
+                return false;
+            }
+            let prefix: &[u8] = &self.pathname;
+            prefix == b"/"
+                || (url.pathname.starts_with(prefix)
+                    && url.pathname.get(prefix.len()).is_none_or(|&c| c == b'/'))
+        }
+
+        /// The credentials configured for `url`: the matching key with the
+        /// longest path (`//host/a/b/` beats `//host/`).
+        pub(crate) fn find<'a>(list: &'a [UrlAuth], url: &URL) -> Option<&'a Scope> {
+            list.iter()
+                .filter(|entry| entry.matches(url))
+                .max_by_key(|entry| entry.pathname.len())
+                .map(|entry| &entry.credentials)
+        }
+    }
+
     pub(crate) enum PackageVersionResponse {
         Cached(PackageManifest),
         Fresh(PackageManifest),
diff --git a/src/options_types/schema.rs b/src/options_types/schema.rs
index 01d16fb5a241..9884b84b8034 100644
--- a/src/options_types/schema.rs
+++ b/src/options_types/schema.rs
@@ -192,6 +192,24 @@ pub mod api {
         pub scopes: bun_collections::StringArrayHashMap<NpmRegistry>,
     }
 
+    /// The credentials `.npmrc` configures for one `//host/path/` prefix
+    /// (`//host/path/:_authToken=...`, `:_auth=`, `:username=` + `:_password=`).
+    ///
+    /// Unlike `default_registry` / `scoped`, these are not attached to a
+    /// registry declared in a config file: the package manager matches them
+    /// against the URL of each request, so they also apply to a registry
+    /// given on the command line or in the environment and to tarballs served
+    /// from a different host than the registry that published them.
+    #[derive(Default)]
+    pub struct NpmUrlAuth {
+        /// `host[:port]` as written between `//` and the first `/` of the key.
+        pub host: Box<[u8]>,
+        /// Pathname of the key without its trailing slash; `/` for a bare host.
+        pub pathname: Box<[u8]>,
+        /// Only the credential fields are set; `url` stays empty.
+        pub credentials: NpmRegistry,
+    }
+
     /// Value of `BunInstall.ca`; hoisted to a named type so callers can
     /// construct it.
     #[derive(Clone, Debug)]
@@ -217,6 +235,10 @@ pub mod api {
         pub default_registry: Option<NpmRegistry>,
         /// scoped
         pub scoped: Option<NpmRegistryMap>,
+        /// Every `//host/path/` credential prefix found in the `.npmrc` files,
+        /// in file order (a later file's lines override an earlier file's for
+        /// the same prefix).
+        pub url_auth: Vec<NpmUrlAuth>,
         /// lockfile_path
         pub lockfile_path: Option<Box<[u8]>>,
         /// save_lockfile_path
diff --git a/test/cli/install/npmrc.test.ts b/test/cli/install/npmrc.test.ts
index e499b67a7069..3e4068ed5ddd 100644
--- a/test/cli/install/npmrc.test.ts
+++ b/test/cli/install/npmrc.test.ts
@@ -1167,3 +1167,391 @@ describe.skipIf(!isIPv6())("registry on a bracketed IPv6 host", () => {
     expect(exitCode).not.toBe(0);
   });
 });
+
+// `//host/path/:_authToken=` lines are keyed by URL, not by a registry declared
+// in the same file. Like npm, they have to apply to whatever request ends up on
+// that host: a registry that only exists on the command line or in the
+// environment, or a tarball served from a different host than the registry.
+describe.concurrent("//host/ credential lines are matched against the request URL", () => {
+  const tgz = join(import.meta.dir, "registry", "packages", "no-deps", "no-deps-1.0.0.tgz");
+  const basic = (user: string, password: string) => `Basic ${Buffer.from(`${user}:${password}`).toString("base64")}`;
+  const packageJson = JSON.stringify({ name: "app", version: "1.0.0", dependencies: { "no-deps": "1.0.0" } });
+
+  type Req = { path: string; auth: string | null };
+
+  type MockRegistryOptions = {
+    /** Serve dist.tarball from another server instead of this one. */
+    tarballOrigin?: () => string;
+    /** Mount the registry under this path prefix instead of `/`. */
+    registryPath?: string;
+    /** Path of the tarball on its server. */
+    tarballPath?: string;
+    /** Let the manifest through without credentials; only the tarball is protected. */
+    publicManifest?: boolean;
+  };
+
+  // Serves no-deps@1.0.0 and answers 401 to any request that does not carry
+  // exactly `expectedAuth`.
+  function mockRegistry(expectedAuth: string, options: MockRegistryOptions = {}) {
+    const { tarballOrigin, registryPath = "", tarballPath = "/no-deps/-/no-deps-1.0.0.tgz", publicManifest } = options;
+    const requests: Req[] = [];
+    const server = Bun.serve({
+      port: 0,
+      hostname: "127.0.0.1",
+      fetch(req) {
+        const url = new URL(req.url);
+        const auth = req.headers.get("authorization");
+        requests.push({ path: url.pathname, auth });
+        const isManifest = url.pathname === `${registryPath}/no-deps`;
+        if (auth !== expectedAuth && !(isManifest && publicManifest)) {
+          return new Response("unauthorized", { status: 401 });
+        }
+        if (url.pathname === tarballPath) return new Response(Bun.file(tgz));
+        if (isManifest) {
+          const origin = tarballOrigin ? tarballOrigin() : `http://127.0.0.1:${server.port}`;
+          return Response.json({
+            name: "no-deps",
+            "dist-tags": { latest: "1.0.0" },
+            versions: {
+              "1.0.0": {
+                name: "no-deps",
+                version: "1.0.0",
+                dist: { tarball: `${origin}${tarballPath}` },
+              },
+            },
+          });
+        }
+        return new Response("not found", { status: 404 });
+      },
+    });
+    return {
+      requests,
+      host: `127.0.0.1:${server.port}`,
+      origin: `http://127.0.0.1:${server.port}`,
+      [Symbol.dispose]() {
+        server.stop(true);
+      },
+    };
+  }
+
+  async function install(dir: string, args: string[] = [], extraEnv: Record<string, string> = {}) {
+    // bunEnv spreads process.env; the user-level .npmrc of the machine running the
+    // tests must not leak in, and the cache must be cold so the tarball is fetched.
+    const spawnEnv: Record<string, string> = {
+      ...(env as Record<string, string>),
+      HOME: join(dir, "home"),
+      USERPROFILE: join(dir, "home"),
+      BUN_INSTALL_CACHE_DIR: join(dir, ".cache"),
+      ...extraEnv,
+    };
+    delete spawnEnv.XDG_CONFIG_HOME;
+    await using proc = Bun.spawn({
+      cmd: [bunExe(), "install", ...args],
+      cwd: dir,
+      env: spawnEnv,
+      stdout: "pipe",
+      stderr: "pipe",
+    });
+    const [stdout, stderr, exitCode] = await Promise.all([proc.stdout.text(), proc.stderr.text(), proc.exited]);
+    return { stdout, stderr, exitCode };
+  }
+
+  const manifestPath = "/no-deps";
+  const tarballPath = "/no-deps/-/no-deps-1.0.0.tgz";
+
+  test("--registry uses the token the user-level .npmrc has for that host", async () => {
+    using registry = mockRegistry("Bearer user-npmrc-token");
+    using dir = tempDir("npmrc-url-auth-cli-registry", {
+      "package.json": packageJson,
+      "home/.npmrc": `//${registry.host}/:_authToken=user-npmrc-token\n`,
+    });
+
+    const { stderr, exitCode } = await install(String(dir), ["--registry", `${registry.origin}/`]);
+
+    expect({ requests: registry.requests, exitCode, stderr }).toEqual({
+      requests: [
+        { path: manifestPath, auth: "Bearer user-npmrc-token" },
+        { path: tarballPath, auth: "Bearer user-npmrc-token" },
+      ],
+      exitCode: 0,
+      stderr: expect.not.stringContaining("401"),
+    });
+  });
+
+  test.each(["NPM_CONFIG_REGISTRY", "BUN_CONFIG_REGISTRY"])(
+    "a registry from %s uses the token the project .npmrc has for that host",
+    async variable => {
+      using registry = mockRegistry("Bearer env-registry-token");
+      using dir = tempDir("npmrc-url-auth-env-registry", {
+        "package.json": packageJson,
+        ".npmrc": `//${registry.host}/:_authToken=env-registry-token\n`,
+      });
+
+      const { exitCode } = await install(String(dir), [], { [variable]: `${registry.origin}/` });
+
+      expect({ requests: registry.requests, exitCode }).toEqual({
+        requests: [
+          { path: manifestPath, auth: "Bearer env-registry-token" },
+          { path: tarballPath, auth: "Bearer env-registry-token" },
+        ],
+        exitCode: 0,
+      });
+    },
+  );
+
+  test("username and _password lines for the --registry host are sent as basic auth", async () => {
+    using registry = mockRegistry(basic("alice", "open sesame"));
+    using dir = tempDir("npmrc-url-auth-basic", {
+      "package.json": packageJson,
+      ".npmrc": [
+        `//${registry.host}/:username=alice`,
+        `//${registry.host}/:_password=${Buffer.from("open sesame").toString("base64")}`,
+        "",
+      ].join("\n"),
+    });
+
+    const { exitCode } = await install(String(dir), ["--registry", `${registry.origin}/`]);
+
+    expect({ requests: registry.requests, exitCode }).toEqual({
+      requests: [
+        { path: manifestPath, auth: basic("alice", "open sesame") },
+        { path: tarballPath, auth: basic("alice", "open sesame") },
+      ],
+      exitCode: 0,
+    });
+  });
+
+  test("a 401 for credentials that were sent is reported without a suggestion", async () => {
+    using registry = mockRegistry("Bearer the-token-the-registry-wants");
+    using dir = tempDir("npmrc-url-auth-rejected", {
+      "package.json": packageJson,
+      ".npmrc": `//${registry.host}/:_authToken=revoked-token\n`,
+    });
+
+    const { stderr, exitCode } = await install(String(dir), ["--registry", `${registry.origin}/`]);
+
+    expect({ requests: registry.requests, exitCode }).toEqual({
+      requests: [{ path: manifestPath, auth: "Bearer revoked-token" }],
+      exitCode: 1,
+    });
+    expect(stderr).toContain(`error: GET ${registry.origin}${manifestPath} - 401\nerror:`);
+    expect(stderr).not.toContain(".npmrc");
+  });
+
+  // Tarball dependencies written as a URL never carry registry credentials, so
+  // there is no .npmrc line to suggest for them.
+  test("a 401 for a tarball dependency given by URL is reported without a suggestion", async () => {
+    using host = mockRegistry("Bearer something");
+    using dir = tempDir("npmrc-url-auth-url-dependency", {
+      "package.json": JSON.stringify({
+        name: "app",
+        version: "1.0.0",
+        dependencies: { "no-deps": `${host.origin}${tarballPath}` },
+      }),
+    });
+
+    const { stderr, exitCode } = await install(String(dir));
+
+    expect({ requests: host.requests, exitCode }).toEqual({
+      requests: [{ path: tarballPath, auth: null }],
+      exitCode: 1,
+    });
+    expect(stderr).toContain(`error: GET ${host.origin}${tarballPath} - 401\n`);
+    expect(stderr).not.toContain(".npmrc");
+  });
+
+  test("a tarball on a different host than its registry gets that host's own line", async () => {
+    using cdn = mockRegistry("Bearer cdn-token");
+    using registry = mockRegistry("Bearer registry-token", { tarballOrigin: () => cdn.origin });
+    using dir = tempDir("npmrc-url-auth-tarball-host", {
+      "package.json": packageJson,
+      ".npmrc": [
+        `registry=${registry.origin}/`,
+        `//${registry.host}/:_authToken=registry-token`,
+        `//${cdn.host}/:_authToken=cdn-token`,
+        "",
+      ].join("\n"),
+    });
+
+    const { exitCode } = await install(String(dir));
+
+    expect({ registry: registry.requests, cdn: cdn.requests, exitCode }).toEqual({
+      registry: [{ path: manifestPath, auth: "Bearer registry-token" }],
+      cdn: [{ path: tarballPath, auth: "Bearer cdn-token" }],
+      exitCode: 0,
+    });
+  });
+
+  test("username and _password lines for the tarball host are sent to it as basic auth", async () => {
+    using cdn = mockRegistry(basic("cdn-user", "cdn-pass"));
+    using registry = mockRegistry("Bearer registry-token", { tarballOrigin: () => cdn.origin });
+    using dir = tempDir("npmrc-url-auth-tarball-host-basic", {
+      "package.json": packageJson,
+      ".npmrc": [
+        `registry=${registry.origin}/`,
+        `//${registry.host}/:_authToken=registry-token`,
+        `//${cdn.host}/:username=cdn-user`,
+        `//${cdn.host}/:_password=${Buffer.from("cdn-pass").toString("base64")}`,
+        "",
+      ].join("\n"),
+    });
+
+    const { exitCode } = await install(String(dir));
+
+    expect({ registry: registry.requests, cdn: cdn.requests, exitCode }).toEqual({
+      registry: [{ path: manifestPath, auth: "Bearer registry-token" }],
+      cdn: [{ path: tarballPath, auth: basic("cdn-user", "cdn-pass") }],
+      exitCode: 0,
+    });
+  });
+
+  test("the line with the deepest path covering the tarball url wins; other paths on the host do not apply", async () => {
+    using cdn = mockRegistry("Bearer deep-token");
+    using registry = mockRegistry("Bearer registry-token", { tarballOrigin: () => cdn.origin });
+    using dir = tempDir("npmrc-url-auth-tarball-path", {
+      "package.json": packageJson,
+      ".npmrc": [
+        `registry=${registry.origin}/`,
+        `//${registry.host}/:_authToken=registry-token`,
+        `//${cdn.host}/no-deps-other/:_authToken=other-token`,
+        `//${cdn.host}/:_authToken=shallow-token`,
+        `//${cdn.host}/no-deps/:_authToken=deep-token`,
+        "",
+      ].join("\n"),
+    });
+
+    const { exitCode } = await install(String(dir));
+
+    expect({ cdn: cdn.requests, exitCode }).toEqual({
+      cdn: [{ path: tarballPath, auth: "Bearer deep-token" }],
+      exitCode: 0,
+    });
+  });
+
+  test("a line for another path on the tarball host does not authenticate it, even if it is a string prefix", async () => {
+    using cdn = mockRegistry("Bearer other-token");
+    using registry = mockRegistry("Bearer registry-token", { tarballOrigin: () => cdn.origin });
+    using dir = tempDir("npmrc-url-auth-tarball-wrong-path", {
+      "package.json": packageJson,
+      ".npmrc": [
+        `registry=${registry.origin}/`,
+        `//${registry.host}/:_authToken=registry-token`,
+        // "/no" is a prefix of "/no-deps/..." but not a parent directory of it.
+        `//${cdn.host}/no/:_authToken=other-token`,
+        "",
+      ].join("\n"),
+    });
+
+    const { stderr, exitCode } = await install(String(dir));
+
+    expect({ cdn: cdn.requests, exitCode }).toEqual({
+      cdn: [{ path: tarballPath, auth: null }],
+      exitCode: 1,
+    });
+    expect(stderr).toContain(
+      `error: GET ${cdn.origin}${tarballPath} - 401\n` +
+        `  the credentials configured for ${registry.host} are not sent to ${cdn.host}; ` +
+        `add //${cdn.host}/:_authToken=<token> to .npmrc if this host needs them\n`,
+    );
+  });
+
+  test("a 401 from a registry nothing is configured for says which .npmrc line would authenticate it", async () => {
+    using registry = mockRegistry("Bearer some-token");
+    using dir = tempDir("npmrc-url-auth-missing-note", { "package.json": packageJson });
+
+    const { stderr, exitCode } = await install(String(dir), ["--registry", `${registry.origin}/`]);
+
+    expect(registry.requests).toEqual([{ path: manifestPath, auth: null }]);
+    expect(stderr).toContain(
+      `error: GET ${registry.origin}${manifestPath} - 401\n` +
+        `  no credentials are configured for this registry; add //${registry.host}/:_authToken=<token> to .npmrc\n`,
+    );
+    expect(exitCode).toBe(1);
+  });
+
+  // https://github.com/oven-sh/bun/issues/30513: GitLab resolves packages through
+  // an instance-level registry path but serves tarballs from (and keys tokens to)
+  // a project-level path. The token line covers the tarball URL and nothing else.
+  test("a line keyed to the tarball path authenticates the tarball when the registry itself has no credentials", async () => {
+    const registryPath = "/api/v4/packages/npm";
+    const tarballPath = "/api/v4/projects/123/packages/npm/no-deps/-/no-deps-1.0.0.tgz";
+    using registry = mockRegistry("Bearer project-token", { registryPath, tarballPath, publicManifest: true });
+    using dir = tempDir("npmrc-url-auth-divergent-path", {
+      "package.json": packageJson,
+      ".npmrc": [
+        `registry=${registry.origin}${registryPath}/`,
+        `//${registry.host}/api/v4/projects/123/packages/npm/:_authToken=project-token`,
+        "",
+      ].join("\n"),
+    });
+
+    const { exitCode } = await install(String(dir));
+
+    expect({ requests: registry.requests, exitCode }).toEqual({
+      requests: [
+        { path: `${registryPath}/no-deps`, auth: null },
+        { path: tarballPath, auth: "Bearer project-token" },
+      ],
+      exitCode: 0,
+    });
+  });
+
+  test("a line keyed to a parent path of the registry url applies to the registry", async () => {
+    const registryPath = "/api/v4/packages/npm";
+    const tarballPath = `${registryPath}/no-deps/-/no-deps-1.0.0.tgz`;
+    using registry = mockRegistry("Bearer host-token", { registryPath, tarballPath });
+    using dir = tempDir("npmrc-url-auth-parent-path", {
+      "package.json": packageJson,
+      ".npmrc": [`registry=${registry.origin}${registryPath}/`, `//${registry.host}/:_authToken=host-token`, ""].join(
+        "\n",
+      ),
+    });
+
+    const { exitCode } = await install(String(dir));
+
+    expect({ requests: registry.requests, exitCode }).toEqual({
+      requests: [
+        { path: `${registryPath}/no-deps`, auth: "Bearer host-token" },
+        { path: tarballPath, auth: "Bearer host-token" },
+      ],
+      exitCode: 0,
+    });
+  });
+
+  test("a lockfile recorded against a registry that has since moved still downloads from the old host", async () => {
+    using oldRegistry = mockRegistry("Bearer old-token");
+    using newRegistry = mockRegistry("Bearer new-token");
+    using dir = tempDir("npmrc-url-auth-moved-registry", {
+      "package.json": packageJson,
+      ".npmrc": [`registry=${oldRegistry.origin}/`, `//${oldRegistry.host}/:_authToken=old-token`, ""].join("\n"),
+    });
+
+    const first = await install(String(dir));
+    expect(first.exitCode).toBe(0);
+    const lockfile = await Bun.file(join(String(dir), "bun.lock")).text();
+    expect(lockfile).toContain(`${oldRegistry.origin}${tarballPath}`);
+    oldRegistry.requests.length = 0;
+
+    // The registry moves; the user keeps credentials for both hosts, as npm
+    // needs them to for the same lockfile.
+    await Bun.write(
+      join(String(dir), ".npmrc"),
+      [
+        `registry=${newRegistry.origin}/`,
+        `//${newRegistry.host}/:_authToken=new-token`,
+        `//${oldRegistry.host}/:_authToken=old-token`,
+        "",
+      ].join("\n"),
+    );
+    await rm(join(String(dir), "node_modules"), { recursive: true, force: true });
+    await rm(join(String(dir), ".cache"), { recursive: true, force: true });
+
+    const second = await install(String(dir), ["--frozen-lockfile"]);
+
+    expect({ old: oldRegistry.requests, new: newRegistry.requests, exitCode: second.exitCode }).toEqual({
+      old: [{ path: tarballPath, auth: "Bearer old-token" }],
+      new: [],
+      exitCode: 0,
+    });
+  });
+});

From 4940a4fbbbfdec9142f7dd38c4d1943bef4e5573 Mon Sep 17 00:00:00 2001
From: robobun <117481402+robobun@users.noreply.github.com>
Date: Mon, 17 Aug 2026 02:37:44 +0000
Subject: [PATCH 154/258] Add --why to bun dedupe to show one level of
 dependents under each row (#39217)

---
 completions/bun-cli.json                      |   7 +
 completions/bun.bash                          |   2 +-
 completions/bun.fish                          |   3 +
 completions/bun.zsh                           |   1 +
 docs/pm/cli/dedupe.mdx                        |  21 +++
 .../PackageManager/CommandLineArguments.rs    |  14 ++
 .../PackageManager/PackageManagerOptions.rs   |   3 +
 src/install/dedupe.rs                         | 120 +++++++++++++++++-
 test/cli/install/bun-dedupe.test.ts           | 114 +++++++++++++++++
 9 files changed, 281 insertions(+), 4 deletions(-)

diff --git a/completions/bun-cli.json b/completions/bun-cli.json
index ddb896e42d6b..3d6d30cfbf4c 100644
--- a/completions/bun-cli.json
+++ b/completions/bun-cli.json
@@ -1875,6 +1875,13 @@
           "hasValue": false,
           "required": false,
           "multiple": false
+        },
+        {
+          "name": "why",
+          "description": "Also list each version's dependents and the ranges they asked for",
+          "hasValue": false,
+          "required": false,
+          "multiple": false
         }
       ],
       "positionalArgs": [
diff --git a/completions/bun.bash b/completions/bun.bash
index 92adf0b700ed..48b2f82ffb71 100644
--- a/completions/bun.bash
+++ b/completions/bun.bash
@@ -104,7 +104,7 @@ _bun_completions() {
     PACKAGE_OPTIONS[SHARED_OPTIONS_LONG]="--config --yarn --production --frozen-lockfile --no-save --dry-run --force --cache-dir --no-cache --silent --verbose --global --cwd --backend --link-native-bins --help";
     PACKAGE_OPTIONS[SHARED_OPTIONS_SHORT]="-c -y -p -f -g";
 
-    PACKAGE_OPTIONS[DEDUPE_OPTIONS_LONG]="--check";
+    PACKAGE_OPTIONS[DEDUPE_OPTIONS_LONG]="--check --why";
     PACKAGE_OPTIONS[PRUNE_OPTIONS_LONG]="--production --prod --omit --filter --dry-run --check --os --cpu --linker --silent --cwd --help";
     PACKAGE_OPTIONS[PRUNE_OPTIONS_SHORT]="-p -P -F -h";
     PACKAGE_OPTIONS[AUDIT_OPTIONS_LONG]="--json --audit-level --ignore --prod --production --omit --dry-run --latest --cwd --help";
diff --git a/completions/bun.fish b/completions/bun.fish
index 3332391a6aa7..3e79fe6e24b9 100644
--- a/completions/bun.fish
+++ b/completions/bun.fish
@@ -166,6 +166,9 @@ complete -c bun \
 complete -c bun \
 	-n "__fish_seen_subcommand_from dedupe" -l 'check' -d 'Exit with code 1 if the lockfile has duplicate versions that can be removed, without changing anything'
 
+complete -c bun \
+	-n "__fish_seen_subcommand_from dedupe" -l 'why' -d "Also list each version's dependents and the ranges they asked for"
+
 complete -c bun \
 	-n "__fish_seen_subcommand_from add" -d 'Popular' -a '(__fish__get_bun_packages)'
 
diff --git a/completions/bun.zsh b/completions/bun.zsh
index 3fb302df5196..e6730e01aa93 100644
--- a/completions/bun.zsh
+++ b/completions/bun.zsh
@@ -693,6 +693,7 @@ _bun_dedupe_completion() {
     _arguments -s -C \
         '1: :->cmd1' \
         '--check[Exit with code 1 if the lockfile has duplicate versions that can be removed, without changing anything]' \
+        '--why[Also list each version'"'"'s dependents and the ranges they asked for]' \
         '-c[Load config(bunfig.toml)]: :->config' \
         '--config[Load config(bunfig.toml)]: :->config' \
         '-y[Write a yarn.lock file (yarn v1)]' \
diff --git a/docs/pm/cli/dedupe.mdx b/docs/pm/cli/dedupe.mdx
index 47d947a6c137..5501daa389cc 100644
--- a/docs/pm/cli/dedupe.mdx
+++ b/docs/pm/cli/dedupe.mdx
@@ -44,6 +44,27 @@ bun dedupe v1.4.0 (abc12345)
 
 `--lockfile-only` rewrites `bun.lock` without installing.
 
+### `--why`
+
+`--why` adds one level of dependents under each row: the packages whose dependency edges pointed at the removed version or at the version(s) it moved to, grouped by the range they asked for.
+
+```bash terminal icon="terminal"
+bun dedupe --dry-run --why
+```
+
+```
+bun dedupe v1.4.0 (abc12345)
+
+↳ esbuild 0.15.10 → 0.15.11
+    wanted ^0.15.7 by esbuild-loader, tsup, vite +1 more
+    wanted ^0.15.8 by my-app
+
+1 duplicate version can be removed (checked 5 packages) [9.00ms]
+  bun dedupe
+```
+
+This shows at a glance why a version moved where it did: here `my-app`'s `^0.15.8` keeps `0.15.11` alive, and the `^0.15.7` edges are satisfied by it too. When a row has no arrow (the version is dropped because nothing reachable needs it anymore), its listed dependents are themselves removed versions, written as `name@version`. Use [`bun why`](/pm/cli/why) for the full dependency paths of a single package.
+
 ### Notes
 
 - Bun respects overrides and catalogs. It re-points each dependency using its effective range.
diff --git a/src/install/PackageManager/CommandLineArguments.rs b/src/install/PackageManager/CommandLineArguments.rs
index e15a48d9c98f..23053322cce5 100644
--- a/src/install/PackageManager/CommandLineArguments.rs
+++ b/src/install/PackageManager/CommandLineArguments.rs
@@ -459,6 +459,9 @@ static DEDUPE_PARAMS: &[ParamType] = concat_params![
         clap::param!(
             "--check                                Exit with code 1 if the lockfile has duplicate versions that can be removed, without changing anything"
         ),
+        clap::param!(
+            "--why                                  Also list each version's dependents and the ranges they asked for"
+        ),
         clap::param!("<POS> ...                              "),
     ]
 ];
@@ -470,6 +473,9 @@ const DEDUPE_HELP_PARAMS: &[ParamType] = &[
     clap::param!(
         "--dry-run                              Print the duplicate versions that would be removed without changing anything"
     ),
+    clap::param!(
+        "--why                                  Also list each version's dependents and the ranges they asked for"
+    ),
     clap::param!("--lockfile-only                        Rewrite bun.lock without installing"),
     clap::param!(
         "--frozen-lockfile                      Fail instead of rewriting bun.lock when duplicate versions can be removed"
@@ -553,6 +559,7 @@ pub struct CommandLineArguments {
     pub(crate) no_save: bool,
     pub(crate) dry_run: bool,
     pub(crate) check: bool,
+    pub(crate) why: bool,
     pub(crate) force: bool,
     pub(crate) no_cache: bool,
     pub log_level: Options::LogLevel,
@@ -643,6 +650,7 @@ impl Default for CommandLineArguments {
             no_save: false,
             dry_run: false,
             check: false,
+            why: false,
             force: false,
             no_cache: false,
             log_level: Options::LogLevel::default(),
@@ -1193,6 +1201,9 @@ Full documentation is available at <magenta>https://bun.com/docs/cli/why<r>.
   <d>Show what would be removed without changing anything<r>
   <b><green>bun dedupe<r> <cyan>--dry-run<r>
 
+  <d>Show which dependents wanted each version<r>
+  <b><green>bun dedupe<r> <cyan>--dry-run<r> <cyan>--why<r>
+
   <d>Rewrite bun.lock without installing<r>
   <b><green>bun dedupe<r> <cyan>--lockfile-only<r>
 
@@ -1429,6 +1440,9 @@ Full documentation is available at <magenta>https://bun.com/docs/pm/cli/prune<r>
             cli.check = true;
             cli.dry_run = true;
         }
+        if subcommand == Subcommand::Dedupe {
+            cli.why = args.flag(b"--why");
+        }
 
         if matches!(
             subcommand,
diff --git a/src/install/PackageManager/PackageManagerOptions.rs b/src/install/PackageManager/PackageManagerOptions.rs
index fcce29404bd0..a659802c1a6e 100644
--- a/src/install/PackageManager/PackageManagerOptions.rs
+++ b/src/install/PackageManager/PackageManagerOptions.rs
@@ -38,6 +38,7 @@ pub struct Options {
     pub(crate) update: DependencyGroup,
     pub dry_run: bool,
     pub check: bool,
+    pub why: bool,
     pub(crate) link_workspace_packages: bool,
     pub(crate) remote_package_features: Features,
     pub local_package_features: Features,
@@ -123,6 +124,7 @@ impl Default for Options {
             update: DependencyGroup::default(),
             dry_run: false,
             check: false,
+            why: false,
             link_workspace_packages: true,
             remote_package_features: Features {
                 optional_dependencies: true,
@@ -860,6 +862,7 @@ impl Options {
                 self.do_.set(Do::SAVE_LOCKFILE, false);
             }
             self.check = cli.check;
+            self.why = cli.why;
 
             if cli.no_summary || cli.log_level.is_silent() {
                 self.do_.set(Do::SUMMARY, false);
diff --git a/src/install/dedupe.rs b/src/install/dedupe.rs
index 0b593ae552fc..561ec7c4059b 100644
--- a/src/install/dedupe.rs
+++ b/src/install/dedupe.rs
@@ -309,6 +309,52 @@ pub(crate) fn label(lockfile: &Lockfile, id: PackageID) -> Vec<u8> {
     label
 }
 
+const MAX_DEPENDENTS_SHOWN: usize = 3;
+
+// Biggest group first, dependents in name order, versioned only when the name alone is ambiguous.
+fn format_wanted(
+    lockfile: &Lockfile,
+    group_of: &[u32],
+    mut groups: Vec<(Box<[u8]>, Vec<PackageID>)>,
+) -> Vec<Wanted> {
+    let buf = lockfile.buffers.string_bytes.as_slice();
+    let names = lockfile.packages.items_name();
+    index_sort::sort_vec_by(&mut groups, |(range_a, owners_a), (range_b, owners_b)| {
+        owners_b
+            .len()
+            .cmp(&owners_a.len())
+            .then_with(|| strings::order(range_a, range_b))
+    });
+    groups
+        .into_iter()
+        .map(|(range, mut owners)| {
+            index_sort::sort_vec_by(&mut owners, |&a, &b| {
+                strings::order(names[a as usize].slice(buf), names[b as usize].slice(buf))
+                    .then(a.cmp(&b))
+            });
+            let shown = owners.len().min(MAX_DEPENDENTS_SHOWN);
+            let mut dependents = Vec::new();
+            for (i, &owner) in owners[..shown].iter().enumerate() {
+                if i > 0 {
+                    dependents.extend_from_slice(b", ");
+                }
+                if group_of[owner as usize] == u32::MAX {
+                    dependents.extend_from_slice(names[owner as usize].slice(buf));
+                } else {
+                    dependents.extend_from_slice(&label(lockfile, owner));
+                }
+            }
+            if owners.len() > shown {
+                let _ = write!(dependents, " +{} more", owners.len() - shown);
+            }
+            Wanted {
+                range,
+                dependents: dependents.into_boxed_slice(),
+            }
+        })
+        .collect()
+}
+
 fn order_by_name_then_version(lockfile: &Lockfile, a: PackageID, b: PackageID) -> Ordering {
     let buf = lockfile.buffers.string_bytes.as_slice();
     let names = lockfile.packages.items_name();
@@ -326,6 +372,12 @@ fn sort_by_name_then_version(lockfile: &Lockfile, ids: &mut [PackageID]) {
     index_sort::sort_indices(ids, &mut |a, b| order_by_name_then_version(lockfile, a, b));
 }
 
+// One `wanted <range> by <dependents>` line under a row (`--why`).
+struct Wanted {
+    range: Box<[u8]>,
+    dependents: Box<[u8]>,
+}
+
 struct Row {
     name: Box<[u8]>,
     /// The removed version.
@@ -334,6 +386,7 @@ struct Row {
     to: Box<[u8]>,
     /// Every survivor is a lower major than `from`.
     downgrade: bool,
+    wanted: Vec<Wanted>,
 }
 
 #[derive(Default)]
@@ -347,7 +400,7 @@ fn plural(n: usize) -> &'static str {
     if n == 1 { "" } else { "s" }
 }
 
-fn dedupe_lockfile(lockfile: &mut Lockfile) -> Report {
+fn dedupe_lockfile(lockfile: &mut Lockfile, why: bool) -> Report {
     let buf = lockfile.buffers.string_bytes.as_slice();
     let pkg_res = lockfile.packages.items_resolution();
     let checked = pkg_res.len();
@@ -544,10 +597,59 @@ fn dedupe_lockfile(lockfile: &mut Lockfile) -> Report {
     }
 
     let names = lockfile.packages.items_name();
+
+    // Per row: dependents whose edges targeted the removed version or one of its survivors, by requested range.
+    let mut wanted: Vec<Vec<(Box<[u8]>, Vec<PackageID>)>> = vec![Vec::new(); removed.len()];
+    if why {
+        let deps = lockfile.buffers.dependencies.as_slice();
+        // A version explains the rows it was removed by and the rows whose edges moved onto it.
+        let mut explains: Vec<Vec<u32>> = vec![Vec::new(); pkg_res.len()];
+        for (i, &id) in removed.iter().enumerate() {
+            explains[id as usize].push(i as u32);
+        }
+        for (i, survivors) in targets.iter().enumerate() {
+            for &s in survivors {
+                explains[s as usize].push(i as u32);
+            }
+        }
+        // Owners come from the pre-dedupe tree so a dropped version's (themselves removed) dependents still show.
+        for (owner, slice) in lockfile.packages.items_dependencies().iter().enumerate() {
+            if !initial.is_set(owner) {
+                continue;
+            }
+            for dep_id in slice.begin() as usize..slice.end() as usize {
+                let Some(rows) = explains.get(original[dep_id] as usize) else {
+                    continue;
+                };
+                if rows.is_empty() {
+                    continue;
+                }
+                let dep = &deps[dep_id];
+                let literal = effective_version(lockfile, dep_id as DependencyID, dep)
+                    .map(|version| version.literal)
+                    .unwrap_or(dep.version.literal);
+                let range = literal.slice(buf);
+                for &r in rows {
+                    let groups = &mut wanted[r as usize];
+                    match groups.iter_mut().find(|(g, _)| strings::eql(g, range)) {
+                        Some((_, owners)) => {
+                            // Two aliases in one package can produce identical edges; list the owner once.
+                            if !owners.contains(&(owner as PackageID)) {
+                                owners.push(owner as PackageID);
+                            }
+                        }
+                        None => groups.push((Box::from(range), vec![owner as PackageID])),
+                    }
+                }
+            }
+        }
+    }
+
     let rows: Vec<Row> = removed
         .iter()
         .zip(&targets)
-        .map(|(&id, moved_to)| {
+        .zip(wanted)
+        .map(|((&id, moved_to), wanted)| {
             let from_version = pkg_res[id as usize].npm().version;
             let mut from: Vec<u8> = Vec::new();
             let _ = write!(from, "{}", from_version.fmt(buf));
@@ -573,6 +675,7 @@ fn dedupe_lockfile(lockfile: &mut Lockfile) -> Report {
                 from: from.into_boxed_slice(),
                 to: to.into_boxed_slice(),
                 downgrade,
+                wanted: format_wanted(lockfile, &group_of, wanted),
             }
         })
         .collect();
@@ -821,6 +924,17 @@ fn print_rows(report: &Report) {
                 BStr::new(&row.to)
             );
         }
+        let width = row.wanted.iter().map(|w| w.range.len()).max().unwrap_or(0);
+        for w in &row.wanted {
+            let mut range = Vec::with_capacity(width);
+            range.extend_from_slice(&w.range);
+            range.resize(width, b' ');
+            bun_core::prettyln!(
+                "    <d>wanted<r> {} <d>by<r> {}",
+                BStr::new(&range),
+                BStr::new(&w.dependents)
+            );
+        }
     }
     print_kept(&report.kept);
 }
@@ -863,7 +977,7 @@ pub fn dedupe_after_differ(manager: &mut PackageManager) {
         refuse_out_of_date(manager);
     }
 
-    let report = dedupe_lockfile(&mut manager.lockfile);
+    let report = dedupe_lockfile(&mut manager.lockfile, manager.options.why);
     if report.rows.is_empty() {
         report_already_deduplicated(manager, &report);
     }
diff --git a/test/cli/install/bun-dedupe.test.ts b/test/cli/install/bun-dedupe.test.ts
index 72873a224653..e81a953c2de2 100644
--- a/test/cli/install/bun-dedupe.test.ts
+++ b/test/cli/install/bun-dedupe.test.ts
@@ -314,6 +314,119 @@ test.concurrent("--dry-run prints what --check prints and exits 0", async () =>
   expect(await nodeModulesVersion(packageDir, "one-range-dep", "node_modules", "no-deps")).toBe("1.1.0");
 });
 
+// A `wanted <range> by <dependents>` line under a row; ranges are padded to the row's widest range.
+const wanted = (range: string, by: string, width = range.length) => `    wanted ${range.padEnd(width)} by ${by}`;
+
+test.concurrent("--why lists one level of dependents grouped by requested range", async () => {
+  const { packageDir, packageJson } = await registry.createTestDir();
+  await Promise.all(
+    ["a", "b", "c", "d"].map(name =>
+      write(
+        join(packageDir, "packages", name, "package.json"),
+        JSON.stringify({ name, dependencies: { "no-deps": "^1.0.0" } }),
+      ),
+    ),
+  );
+  const lockfile = await installTwice(
+    packageDir,
+    packageJson,
+    { name: "root", workspaces: ["packages/*"] },
+    { name: "root", workspaces: ["packages/*"], dependencies: { "no-deps": "1.0.0" } },
+  );
+  expect(lockfile).toContain('"no-deps@1.0.0"');
+  expect(lockfile).toContain('"no-deps@1.1.0"');
+
+  // The larger group first, dependents in name order, capped at three with a count of the rest.
+  const checked = lockPackageCount(lockfile);
+  const rows = [
+    "~ no-deps 1.1.0 -> 1.0.0",
+    wanted("^1.0.0", "a, b, c +1 more"),
+    wanted("1.0.0", "root", "^1.0.0".length),
+  ];
+  const check = await dedupe(packageDir, "--check", "--why");
+  expect(lines(check.stdout)).toStrictEqual([HEADER, ...rows, "", wouldRemove(1, checked), HINT]);
+  expect(check.stderr).toBe("");
+  expect(check.exitCode).toBe(1);
+  expect(await lock(packageDir)).toBe(lockfile);
+
+  // Without --why the rows stay terse.
+  const plain = await dedupe(packageDir, "--check");
+  expectWouldRemove(plain, "no-deps 1.1.0 -> 1.0.0", checked);
+  expect(plain.stdout).not.toContain("wanted");
+
+  // Applying with --why prints the same block before the summary.
+  const { stdout, stderr, exitCode } = await dedupe(packageDir, "--why");
+  const out = lines(stdout);
+  expect(out.slice(-5, -1)).toStrictEqual([...rows, ""]);
+  expect(out.at(-1)).toMatch(removedSummary(1, checked));
+  expect(stderr).not.toContain("error:");
+  expect(exitCode).toBe(0);
+  expect(await lock(packageDir)).not.toContain('"no-deps@1.1.0"');
+  await runBunInstall(installEnv(packageDir), packageDir, { frozenLockfile: true });
+});
+
+// The dropped no-deps@2.0.0 has no surviving dependent: --why shows the removed one-fixed-dep@2.0.0, versioned because the name is ambiguous.
+test.concurrent("--why explains a dropped version through its removed dependent", async () => {
+  const { packageDir, packageJson } = await registry.createTestDir();
+  const lockfile = await installTwice(
+    packageDir,
+    packageJson,
+    { name: "foo", dependencies: { "one-fixed-dep": ">=1.0.0" } },
+    { name: "foo", dependencies: { "one-fixed-dep": ">=1.0.0", "ofd": "npm:one-fixed-dep@1.0.0" } },
+  );
+  for (const label of ['"one-fixed-dep@1.0.0"', '"one-fixed-dep@2.0.0"', '"no-deps@1.0.0"', '"no-deps@2.0.0"']) {
+    expect(lockfile).toContain(label);
+  }
+
+  const checked = lockPackageCount(lockfile);
+  const check = await dedupe(packageDir, "--check", "--why");
+  expect(lines(check.stdout)).toStrictEqual([
+    HEADER,
+    "~ no-deps 2.0.0",
+    wanted("2.0.0", "one-fixed-dep@2.0.0"),
+    "~ one-fixed-dep 2.0.0 -> 1.0.0",
+    wanted(">=1.0.0", "foo", "npm:one-fixed-dep@1.0.0".length),
+    wanted("npm:one-fixed-dep@1.0.0", "foo"),
+    "",
+    wouldRemove(2, checked),
+    HINT,
+  ]);
+  expect(check.stderr).toBe("");
+  expect(check.exitCode).toBe(1);
+  expect(await lock(packageDir)).toBe(lockfile);
+});
+
+// Two aliases produce two identical edges from one package; --why lists the dependent once.
+test.concurrent("--why lists a dependent once when two aliases share the same range", async () => {
+  const { packageDir, packageJson } = await registry.createTestDir();
+  const lockfile = await installTwice(
+    packageDir,
+    packageJson,
+    { name: "foo", dependencies: { "one-range-dep": "1.0.0" } },
+    {
+      name: "foo",
+      dependencies: { "one-range-dep": "1.0.0", "nd1": "npm:no-deps@1.0.0", "nd2": "npm:no-deps@1.0.0" },
+    },
+  );
+  expect(lockfile).toContain('"no-deps@1.0.0"');
+  expect(lockfile).toContain('"no-deps@1.1.0"');
+
+  const checked = lockPackageCount(lockfile);
+  const check = await dedupe(packageDir, "--check", "--why");
+  expect(lines(check.stdout)).toStrictEqual([
+    HEADER,
+    "~ no-deps 1.1.0 -> 1.0.0",
+    wanted("^1.0.0", "one-range-dep", "npm:no-deps@1.0.0".length),
+    wanted("npm:no-deps@1.0.0", "foo"),
+    "",
+    wouldRemove(1, checked),
+    HINT,
+  ]);
+  expect(check.stderr).toBe("");
+  expect(check.exitCode).toBe(1);
+  expect(await lock(packageDir)).toBe(lockfile);
+});
+
 test.concurrent("--no-summary keeps the rows and the hint but drops the count line", async () => {
   const { packageDir, packageJson } = await registry.createTestDir();
   const lockBefore = await setupRangeDuplicate(packageDir, packageJson);
@@ -501,6 +614,7 @@ test.concurrent("--help", async () => {
   expect(flagLines.map(line => line.match(/--[\w-]+/)![0])).toStrictEqual([
     "--check",
     "--dry-run",
+    "--why",
     "--lockfile-only",
     "--frozen-lockfile",
     "--linker",

From fb80e2d46c1dc3434d913e9b09188f13c11ce313 Mon Sep 17 00:00:00 2001
From: robobun <117481402+robobun@users.noreply.github.com>
Date: Mon, 17 Aug 2026 02:43:37 +0000
Subject: [PATCH 155/258] publish: honor publishConfig.registry and
 publishConfig["@scope:registry"] (#38322)

---
 docs/pm/cli/publish.mdx                       |  28 +-
 docs/snippets/cli/publish.mdx                 |  10 +
 .../PackageManager/PackageManagerOptions.rs   | 166 ++++++++++-
 src/runtime/cli/pack_command.rs               |  30 +-
 src/runtime/cli/publish_command.rs            |  29 +-
 test/cli/install/bun-publish.test.ts          | 282 ++++++++++++++++++
 6 files changed, 476 insertions(+), 69 deletions(-)

diff --git a/docs/pm/cli/publish.mdx b/docs/pm/cli/publish.mdx
index a27e89a2cf0f..2139888a1f03 100644
--- a/docs/pm/cli/publish.mdx
+++ b/docs/pm/cli/publish.mdx
@@ -5,7 +5,7 @@ description: Use `bun publish` to publish a package to the npm registry
 
 import Publish from "/snippets/cli/publish.mdx";
 
-`bun publish` packs your package into a tarball and strips catalog and workspace protocols from the `package.json`, resolving versions if necessary. It then publishes to the registry specified in your configuration files. Both `bunfig.toml` and `.npmrc` files are supported.
+`bun publish` packs your package into a tarball and strips catalog and workspace protocols from the `package.json`, resolving versions if necessary. It then publishes to the registry specified in your configuration files or in the package's `publishConfig`. Both `bunfig.toml` and `.npmrc` files are supported.
 
 ```sh terminal icon="terminal"
 ## Publishing the package from the current working directory
@@ -81,6 +81,32 @@ You can also set `--tag` in the `publishConfig` field of your `package.json`.
 }
 ```
 
+### `publishConfig.registry`
+
+A package can pin the registry it is published to in the `publishConfig` field of its `package.json`, regardless of the registry configured for installs. `--registry` on the command line still overrides it.
+
+```json package.json icon="file-json"
+{
+  "name": "internal-package",
+  "publishConfig": {
+    "registry": "https://registry.myorg.example/"
+  }
+}
+```
+
+As in npm, `publishConfig.registry` replaces the default registry only. A registry configured for the package's scope (`@myorg:registry` in `.npmrc`, or `[install.scopes]` in `bunfig.toml`) still takes precedence over it; to replace that one, set the scope's key in `publishConfig` instead:
+
+```json package.json icon="file-json"
+{
+  "name": "@myorg/package",
+  "publishConfig": {
+    "@myorg:registry": "https://registry.myorg.example/"
+  }
+}
+```
+
+Credentials are the ones configured for that registry, the same as when it is the default registry: a `//registry.myorg.example/:_authToken=...` line in `.npmrc`, or a registry with the same URL in `bunfig.toml` or `.npmrc`. When there are none, the credentials of the registry the package would otherwise have been published to are used only if the pinned registry has the same origin; otherwise `bun publish` fails with a missing authentication error instead of sending them to a different registry.
+
 ### `--dry-run`
 
 `--dry-run` runs the publish process without publishing the package, so you can verify what would be published.
diff --git a/docs/snippets/cli/publish.mdx b/docs/snippets/cli/publish.mdx
index 7d542b1fd8cc..7c3805e00ffb 100644
--- a/docs/snippets/cli/publish.mdx
+++ b/docs/snippets/cli/publish.mdx
@@ -104,6 +104,16 @@ bun publish --otp 123456
 bun publish --registry https://my-private-registry.com
 ```
 
+A package can pin the registry it is published to with `publishConfig.registry` in its `package.json` (`--registry` still overrides it). Like npm, this replaces the default registry only; a registry configured for the package's scope takes precedence unless `publishConfig` also sets `@scope:registry`.
+
+```json package.json icon="file-json"
+{
+  "publishConfig": {
+    "registry": "https://my-private-registry.com" // [!code ++]
+  }
+}
+```
+
 #### SSL Certificates
 
 <ParamField path="--ca" type="string">
diff --git a/src/install/PackageManager/PackageManagerOptions.rs b/src/install/PackageManager/PackageManagerOptions.rs
index a659802c1a6e..b82ad0dd4ff9 100644
--- a/src/install/PackageManager/PackageManagerOptions.rs
+++ b/src/install/PackageManager/PackageManagerOptions.rs
@@ -1,6 +1,8 @@
 use crate::bun_schema::api as Api;
+use bun_alloc::{AllocError, Arena};
+use bun_ast::Expr;
 use bun_core::ZStr;
-use bun_core::{Output, env_var};
+use bun_core::{Global, Output, env_var};
 use bun_paths::PathBuffer;
 
 use super::Subcommand;
@@ -24,6 +26,8 @@ pub struct Options {
     pub bin_path: &'static ZStr,
 
     pub(crate) did_override_default_scope: bool,
+    /// `--registry` was given, so `publishConfig.registry` is ignored (as in npm).
+    pub(crate) registry_from_command_line: bool,
     pub scope: Npm::registry::Scope,
 
     pub(crate) registries: Npm::registry::Map,
@@ -113,6 +117,7 @@ impl Default for Options {
             explicit_global_directory: b"",
             bin_path: bun_paths::path_literal!("node_modules/.bin"),
             did_override_default_scope: false,
+            registry_from_command_line: false,
             // Always assigned in `load()` before read.
             scope: Npm::registry::Scope::default(),
             registries: Npm::registry::Map::default(),
@@ -395,6 +400,148 @@ impl core::fmt::Display for RegistryPath<'_> {
         }
         Ok(())
     }
+
+    /// The scope for `url` once it replaces `current`, with the credentials configured for `url`.
+    fn scope_for_registry_url(
+        &self,
+        name: &[u8],
+        current: &Npm::registry::Scope,
+        url: &[u8],
+    ) -> Result<Npm::registry::Scope, AllocError> {
+        let url_hash = Npm::registry::Scope::hash(bun_core::without_trailing_slash(url));
+        if let Some(configured) = core::iter::once(&self.scope)
+            .chain(self.registries.values())
+            .find(|scope| scope.url_hash == url_hash)
+        {
+            return Ok(Npm::registry::Scope {
+                name: name.into(),
+                ..configured.clone()
+            });
+        }
+
+        let mut scope = Npm::registry::Scope {
+            name: name.into(),
+            url: bun_url::OwnedURL::from_href(url.into()),
+            url_hash,
+            ..Default::default()
+        };
+        if let Some(credentials) = Npm::registry::UrlAuth::find(&self.url_auth, &scope.url.url()) {
+            scope.copy_credentials_from(credentials);
+            return Ok(scope);
+        }
+        // Unconfigured `url`: `current`'s credentials follow it only same-origin, and never to http.
+        let new_url = scope.url.url();
+        let current_url = current.url.url();
+        if bun_core::without_trailing_slash(new_url.host)
+            == bun_core::without_trailing_slash(current_url.host)
+            && (new_url.is_https() || !current_url.is_https())
+        {
+            scope.token.clone_from(&current.token);
+            scope.auth.clone_from(&current.auth);
+            scope.user.clone_from(&current.user);
+        }
+        Ok(scope)
+    }
+
+    /// Replaces the registry used by packages that have no registry for their scope.
+    fn set_default_registry(
+        &mut self,
+        url: &[u8],
+    ) -> Result<(), AllocError> {
+        self.scope = self.scope_for_registry_url(b"", &self.scope, url)?;
+        self.did_override_default_scope = self.scope.url_hash != *Npm::registry::DEFAULT_URL_HASH;
+        Ok(())
+    }
+
+    /// Replaces the registry used by the packages of `scope_name` (without the `@`).
+    fn set_scope_registry(
+        &mut self,
+        scope_name: &[u8],
+        url: &[u8],
+    ) -> Result<(), AllocError> {
+        let key = Npm::registry::Scope::hash(scope_name);
+        let current = match self.registries.get(&key) {
+            Some(scope) if *scope.name == *scope_name => scope,
+            _ => &self.scope,
+        };
+        let scope = self.scope_for_registry_url(scope_name, current, url)?;
+        self.registries.put(key, scope)
+    }
+
+    /// Applies the `publishConfig` of the package being published; command-line flags win over it.
+    pub fn apply_publish_config(
+        &mut self,
+        package_json: &Expr,
+        bump: &Arena,
+        package_name: &[u8],
+    ) -> Result<(), AllocError> {
+        let Some(config) = package_json.get(b"publishConfig") else {
+            return Ok(());
+        };
+
+        if self.publish_config.tag.is_empty() {
+            if let Some(tag) = config.get_string_cloned(bump, b"tag")? {
+                self.publish_config.tag = leak_static(tag);
+            }
+        }
+
+        if self.publish_config.access.is_none() {
+            if let Some(access) = config.get_string_cloned(bump, b"access")? {
+                self.publish_config.access = Some(Access::from_str(access).unwrap_or_else(|| {
+                    Output::err_generic("invalid `access` value: '{}'", (bstr::BStr::new(access),));
+                    Global::crash();
+                }));
+            }
+        }
+
+        // As in npm, `registry` replaces only the default registry; `@scope:registry` the scope's.
+        if !self.registry_from_command_line {
+            if let Some(url) = publish_config_registry(&config, bump, b"registry")? {
+                self.set_default_registry(url)?;
+            }
+        }
+
+        if !package_name.is_empty() && package_name[0] == b'@' {
+            let scope_name = Npm::registry::Scope::get_name(package_name);
+            let mut key = Vec::with_capacity(b"@:registry".len() + scope_name.len());
+            key.push(b'@');
+            key.extend_from_slice(scope_name);
+            key.extend_from_slice(b":registry");
+            if let Some(url) = publish_config_registry(&config, bump, &key)? {
+                self.set_scope_registry(scope_name, url)?;
+            }
+        }
+
+        Ok(())
+    }
+}
+
+/// `publishConfig[key]` as an http(s) URL; anything else errors rather than publishing elsewhere.
+fn publish_config_registry<'b>(
+    config: &Expr,
+    bump: &'b Arena,
+    key: &[u8],
+) -> Result<Option<&'b [u8]>, AllocError> {
+    let Some(value) = config.get(key) else {
+        return Ok(None);
+    };
+    match value.as_string_cloned(bump)? {
+        Some(url) if url.starts_with(b"https://") || url.starts_with(b"http://") => Ok(Some(url)),
+        Some(url) => {
+            Output::err_generic(
+                "invalid `{}` value in `publishConfig`: {}, expected a URL starting with 'https://' or 'http://'",
+                (bstr::BStr::new(key), bun_core::fmt::quote(url)),
+            );
+            Global::crash();
+        }
+        None => {
+            Output::err_generic(
+                "invalid `{}` value in `publishConfig`, expected a URL starting with 'https://' or 'http://'",
+                (bstr::BStr::new(key),),
+            );
+            Global::crash();
+        }
+    }
 }
 
 #[derive(Copy, Clone, PartialEq, Eq, Default, Debug)]
@@ -764,21 +911,12 @@ impl Options {
                 let api_registry = Api::NpmRegistry::from_url(cli.registry);
                 if api_registry.has_credentials() {
                     self.scope = Npm::registry::Scope::from_api(b"", api_registry, env)?;
+                    self.did_override_default_scope =
+                        self.scope.url_hash != *Npm::registry::DEFAULT_URL_HASH;
                 } else {
-                    let new_url = bun_url::URL::parse(&api_registry.url);
-                    let same_origin = {
-                        let prev_url = self.scope.url.url();
-                        bun_core::without_trailing_slash(new_url.host)
-                            == bun_core::without_trailing_slash(prev_url.host)
-                            && (new_url.is_https() || !prev_url.is_https())
-                    };
-                    if !same_origin {
-                        self.scope.token = Box::default();
-                        self.scope.auth = Box::default();
-                        self.scope.user = Box::default();
-                    }
-                    self.scope.set_url(api_registry.url);
+                    self.set_default_registry(&api_registry.url)?;
                 }
+                self.registry_from_command_line = true;
             }
         }
 
diff --git a/src/runtime/cli/pack_command.rs b/src/runtime/cli/pack_command.rs
index 35f9d2cf9819..7588f8e8dc5d 100644
--- a/src/runtime/cli/pack_command.rs
+++ b/src/runtime/cli/pack_command.rs
@@ -1906,33 +1906,6 @@ pub(crate) fn pack<const FOR_PUBLISH: bool>(
     let bump = pack_bump();
     let mut json = package_json_entry(manager_ptr, abs_package_json_path);
 
-    if FOR_PUBLISH {
-        if let Some(config) = json.root.get(b"publishConfig") {
-            if ctx.manager.options.publish_config.tag.is_empty() {
-                if let Some(tag) = config.get_string_cloned(bump, b"tag")? {
-                    ctx.manager.options.publish_config.tag = tag;
-                }
-            }
-            if ctx.manager.options.publish_config.access.is_none() {
-                if let Some((access, _)) = config.get_string(bump, b"access")? {
-                    ctx.manager.options.publish_config.access =
-                        match bun_install::Access::from_str(access) {
-                            Some(a) => Some(a),
-                            None => {
-                                Output::err_generic(
-                                    "invalid `access` value: '{}'",
-                                    format_args!("{}", bstr::BStr::new(access)),
-                                );
-                                Global::crash();
-                            }
-                        };
-                }
-            }
-        }
-
-        // maybe otp
-    }
-
     let mut package_name_expr: Expr = json
         .root
         .get(b"name")
@@ -1943,6 +1916,9 @@ pub(crate) fn pack<const FOR_PUBLISH: bool>(
     if FOR_PUBLISH {
         let is_scoped = bun_install::dependency::is_scoped_package_name(package_name)
             .map_err(|_| PackError::InvalidPackageName)?;
+        ctx.manager
+            .options
+            .apply_publish_config(&json.root, bump, package_name)?;
         if let Some(access) = ctx.manager.options.publish_config.access {
             if access == bun_install::Access::Restricted && !is_scoped {
                 return Err(PackError::RestrictedUnscopedPackage);
diff --git a/src/runtime/cli/publish_command.rs b/src/runtime/cli/publish_command.rs
index 6f7c3d2e8e3d..7d0da33fedf6 100644
--- a/src/runtime/cli/publish_command.rs
+++ b/src/runtime/cli/publish_command.rs
@@ -354,39 +354,14 @@ impl<'a, const DIRECTORY_PUBLISH: bool> Context<'a, DIRECTORY_PUBLISH> {
                 }
             }
 
-            if let Some(config) = json.get(b"publishConfig") {
-                if manager.options.publish_config.tag.is_empty() {
-                    if let Some(tag) = json_get_string_cloned(&config, &bump, b"tag")? {
-                        // Note: `PublishConfig.tag` is `&'static [u8]`; dupe the
-                        // bump-owned slice into the process-lifetime CLI arena.
-                        manager.options.publish_config.tag = crate::cli::cli_dupe(tag);
-                    }
-                }
-
-                if manager.options.publish_config.access.is_none() {
-                    if let Some(access) = json_get_string_cloned(&config, &bump, b"access")? {
-                        manager.options.publish_config.access = match Access::from_str(access) {
-                            Some(a) => Some(a),
-                            None => {
-                                Output::err_generic(
-                                    "invalid `access` value: '{}'",
-                                    (bstr::BStr::new(access),),
-                                );
-                                Global::crash();
-                            }
-                        };
-                    }
-                }
-
-                // maybe otp
-            }
-
             let name: Box<[u8]> = json_get_string_cloned(&json, &bump, b"name")?
                 .ok_or(FromTarballError::MissingPackageName)?
                 .into();
             let is_scoped = dependency::is_scoped_package_name(&name)
                 .map_err(|_| FromTarballError::InvalidPackageName)?;
 
+            manager.options.apply_publish_config(&json, &bump, &name)?;
+
             if let Some(access) = manager.options.publish_config.access {
                 if access == Access::Restricted && !is_scoped {
                     return Err(FromTarballError::RestrictedUnscopedPackage);
diff --git a/test/cli/install/bun-publish.test.ts b/test/cli/install/bun-publish.test.ts
index 350cbaf65516..891515b6ae08 100644
--- a/test/cli/install/bun-publish.test.ts
+++ b/test/cli/install/bun-publish.test.ts
@@ -1420,6 +1420,288 @@ describe("tag", async () => {
   });
 });
 
+describe("publishConfig registry", () => {
+  // Every request a registry receives, so a test can assert that a registry
+  // received exactly one PUT carrying its own token, or nothing at all.
+  function mockRegistry() {
+    const requests: { method: string; path: string; authorization: string | null }[] = [];
+    let manifest: any;
+    const server = Bun.serve({
+      port: 0,
+      hostname: "127.0.0.1",
+      async fetch(req) {
+        requests.push({
+          method: req.method,
+          path: new URL(req.url).pathname,
+          authorization: req.headers.get("authorization"),
+        });
+        if (req.method === "PUT") manifest = await req.json();
+        return new Response("OK");
+      },
+    });
+    return {
+      url: `http://127.0.0.1:${server.port}/`,
+      // What `//host/path/:_authToken=` lines in .npmrc key on.
+      npmrcToken: `//127.0.0.1:${server.port}/:_authToken=token-for-${server.port}`,
+      token: `token-for-${server.port}`,
+      requests,
+      get manifest() {
+        return manifest;
+      },
+      [Symbol.dispose]() {
+        server.stop(true);
+      },
+    };
+  }
+
+  const put = (path: string, token: string) => [{ method: "PUT", path, authorization: `Bearer ${token}` }];
+
+  test.concurrent("is published to, with the credentials .npmrc configures for it", async () => {
+    using configured = mockRegistry();
+    using pinned = mockRegistry();
+    using dir = tempDir("publish-config-registry", {
+      ".npmrc": `registry=${configured.url}\n${configured.npmrcToken}\n${pinned.npmrcToken}\n`,
+      "package.json": JSON.stringify({
+        name: "@corp/secretpkg",
+        version: "1.0.0",
+        publishConfig: { registry: pinned.url, access: "restricted", tag: "internal" },
+      }),
+    });
+
+    const { out, err, exitCode } = await publish(env, String(dir));
+    expect(err).not.toContain("error:");
+    expect(out).toContain(`Tag: internal\nAccess: restricted\nRegistry: ${pinned.url}\n`);
+    expect(out).toContain(" + @corp/secretpkg@1.0.0");
+    expect(exitCode).toBe(0);
+
+    expect(configured.requests).toEqual([]);
+    expect(pinned.requests).toEqual(put("/@corp%2fsecretpkg", pinned.token));
+    expect(pinned.manifest).toMatchObject({
+      "dist-tags": { internal: "1.0.0" },
+      access: "restricted",
+      versions: { "1.0.0": { dist: { tarball: `${pinned.url}@corp/secretpkg/-/@corp/secretpkg-1.0.0.tgz` } } },
+    });
+  });
+
+  test.concurrent("is published to when publishing a tarball", async () => {
+    using configured = mockRegistry();
+    using pinned = mockRegistry();
+    using dir = tempDir("publish-config-registry-tarball", {
+      ".npmrc": `registry=${configured.url}\n${configured.npmrcToken}\n${pinned.npmrcToken}\n`,
+      "package.json": JSON.stringify({
+        name: "@corp/secretpkg",
+        version: "1.0.0",
+        publishConfig: { registry: pinned.url, access: "restricted", tag: "internal" },
+      }),
+    });
+    await pack(String(dir), env);
+
+    const { out, err, exitCode } = await publish(env, String(dir), "./corp-secretpkg-1.0.0.tgz");
+    expect(err).not.toContain("error:");
+    expect(out).toContain(`Tag: internal\nAccess: restricted\nRegistry: ${pinned.url}\n`);
+    expect(out).toContain(" + @corp/secretpkg@1.0.0");
+    expect(exitCode).toBe(0);
+
+    expect(configured.requests).toEqual([]);
+    expect(pinned.requests).toEqual(put("/@corp%2fsecretpkg", pinned.token));
+    expect(pinned.manifest).toMatchObject({
+      "dist-tags": { internal: "1.0.0" },
+      access: "restricted",
+      versions: { "1.0.0": { dist: { tarball: `${pinned.url}@corp/secretpkg/-/@corp/secretpkg-1.0.0.tgz` } } },
+    });
+  });
+
+  test.concurrent("is what --dry-run reports", async () => {
+    using configured = mockRegistry();
+    using pinned = mockRegistry();
+    using dir = tempDir("publish-config-registry-dry-run", {
+      ".npmrc": `registry=${configured.url}\n${configured.npmrcToken}\n${pinned.npmrcToken}\n`,
+      "package.json": JSON.stringify({
+        name: "dry-run-pinned",
+        version: "1.0.0",
+        publishConfig: { registry: pinned.url },
+      }),
+    });
+
+    const { out, err, exitCode } = await publish(env, String(dir), "--dry-run");
+    expect(err).not.toContain("error:");
+    expect(out).toContain(`Registry: ${pinned.url}\n`);
+    expect(exitCode).toBe(0);
+    expect(configured.requests).toEqual([]);
+    expect(pinned.requests).toEqual([]);
+  });
+
+  test.concurrent("without credentials of its own, nothing is sent to the configured registry", async () => {
+    using configured = mockRegistry();
+    using pinned = mockRegistry();
+    using dir = tempDir("publish-config-registry-no-auth", {
+      ".npmrc": `registry=${configured.url}\n${configured.npmrcToken}\n`,
+      "package.json": JSON.stringify({
+        name: "@corp/secretpkg",
+        version: "1.0.0",
+        publishConfig: { registry: pinned.url },
+      }),
+    });
+
+    const { err, exitCode } = await publish(env, String(dir));
+    expect(err).toContain("error: missing authentication");
+    expect(exitCode).toBe(1);
+    expect(configured.requests).toEqual([]);
+    expect(pinned.requests).toEqual([]);
+  });
+
+  test.concurrent("keeps the credentials of the configured registry when it pins that same registry", async () => {
+    using configured = mockRegistry();
+    using dir = tempDir("publish-config-registry-same", {
+      "bunfig.toml": `[install]\nregistry = { url = "${configured.url}", token = "${configured.token}" }\n`,
+      "package.json": JSON.stringify({
+        name: "pinned-to-configured",
+        version: "1.0.0",
+        // No trailing slash, unlike the bunfig.toml url: still the same registry.
+        publishConfig: { registry: configured.url.slice(0, -1) },
+      }),
+    });
+
+    const { out, err, exitCode } = await publish(env, String(dir));
+    expect(err).not.toContain("error:");
+    expect(out).toContain(" + pinned-to-configured@1.0.0");
+    expect(exitCode).toBe(0);
+    expect(configured.requests).toEqual(put("/pinned-to-configured", configured.token));
+  });
+
+  test.concurrent("on the same origin as the configured registry, its credentials carry over", async () => {
+    using configured = mockRegistry();
+    using dir = tempDir("publish-config-registry-same-origin", {
+      "bunfig.toml": `[install]\nregistry = { url = "${configured.url}", token = "${configured.token}" }\n`,
+      "package.json": JSON.stringify({
+        name: "pinned-to-path",
+        version: "1.0.0",
+        publishConfig: { registry: `${configured.url}publish/` },
+      }),
+    });
+
+    const { out, err, exitCode } = await publish(env, String(dir));
+    expect(err).not.toContain("error:");
+    expect(out).toContain(`Registry: ${configured.url}publish/\n`);
+    expect(exitCode).toBe(0);
+    expect(configured.requests).toEqual(put("/publish/pinned-to-path", configured.token));
+  });
+
+  test.concurrent("loses to --registry", async () => {
+    using flag = mockRegistry();
+    using pinned = mockRegistry();
+    using dir = tempDir("publish-config-registry-flag", {
+      ".npmrc": `registry=${flag.url}\n${flag.npmrcToken}\n${pinned.npmrcToken}\n`,
+      "package.json": JSON.stringify({
+        name: "flag-wins",
+        version: "1.0.0",
+        publishConfig: { registry: pinned.url },
+      }),
+    });
+
+    const { out, err, exitCode } = await publish(env, String(dir), "--registry", flag.url);
+    expect(err).not.toContain("error:");
+    expect(out).toContain(`Registry: ${flag.url}\n`);
+    expect(exitCode).toBe(0);
+    expect(flag.requests).toEqual(put("/flag-wins", flag.token));
+    expect(pinned.requests).toEqual([]);
+  });
+
+  test.concurrent("--registry is given the credentials .npmrc configures for it", async () => {
+    using flag = mockRegistry();
+    using dir = tempDir("registry-flag-npmrc-auth", {
+      ".npmrc": `${flag.npmrcToken}\n`,
+      "package.json": JSON.stringify({ name: "flag-auth", version: "1.0.0" }),
+    });
+
+    const { out, err, exitCode } = await publish(env, String(dir), "--registry", flag.url);
+    expect(err).not.toContain("error:");
+    expect(out).toContain(" + flag-auth@1.0.0");
+    expect(exitCode).toBe(0);
+    expect(flag.requests).toEqual(put("/flag-auth", flag.token));
+  });
+
+  test.concurrent("does not override a registry configured for the package's scope", async () => {
+    using configured = mockRegistry();
+    using scoped = mockRegistry();
+    using pinned = mockRegistry();
+    using dir = tempDir("publish-config-registry-scoped", {
+      ".npmrc": [
+        `registry=${configured.url}`,
+        `@corp:registry=${scoped.url}`,
+        configured.npmrcToken,
+        scoped.npmrcToken,
+        pinned.npmrcToken,
+        "",
+      ].join("\n"),
+      "package.json": JSON.stringify({
+        name: "@corp/scoped-wins",
+        version: "1.0.0",
+        publishConfig: { registry: pinned.url },
+      }),
+    });
+
+    const { out, err, exitCode } = await publish(env, String(dir));
+    expect(err).not.toContain("error:");
+    expect(out).toContain(`Registry: ${scoped.url}\n`);
+    expect(exitCode).toBe(0);
+    expect(configured.requests).toEqual([]);
+    expect(scoped.requests).toEqual(put("/@corp%2fscoped-wins", scoped.token));
+    expect(pinned.requests).toEqual([]);
+  });
+
+  test.concurrent("@scope:registry overrides the registry configured for the scope", async () => {
+    using scoped = mockRegistry();
+    using pinned = mockRegistry();
+    using dir = tempDir("publish-config-scope-registry", {
+      ".npmrc": `@corp:registry=${scoped.url}\n${scoped.npmrcToken}\n${pinned.npmrcToken}\n`,
+      "package.json": JSON.stringify({
+        name: "@corp/pinned-scope",
+        version: "1.0.0",
+        publishConfig: { "@corp:registry": pinned.url },
+      }),
+    });
+
+    const { out, err, exitCode } = await publish(env, String(dir));
+    expect(err).not.toContain("error:");
+    expect(out).toContain(`Registry: ${pinned.url}\n`);
+    expect(exitCode).toBe(0);
+    expect(scoped.requests).toEqual([]);
+    expect(pinned.requests).toEqual(put("/@corp%2fpinned-scope", pinned.token));
+  });
+
+  const expected = "expected a URL starting with 'https://' or 'http://'";
+  test.concurrent.each([
+    [
+      "registry",
+      "ftp://127.0.0.1:1/",
+      `error: invalid \`registry\` value in \`publishConfig\`: "ftp://127.0.0.1:1/", ${expected}\n`,
+    ],
+    ["registry", ["http://127.0.0.1:1/"], `error: invalid \`registry\` value in \`publishConfig\`, ${expected}\n`],
+    ["registry", "", `error: invalid \`registry\` value in \`publishConfig\`: "", ${expected}\n`],
+    [
+      "@corp:registry",
+      "127.0.0.1:1",
+      `error: invalid \`@corp:registry\` value in \`publishConfig\`: "127.0.0.1:1", ${expected}\n`,
+    ],
+  ])("%s set to %j is an error, and nothing is published anywhere", async (key, value, message) => {
+    using configured = mockRegistry();
+    using dir = tempDir("publish-config-registry-invalid", {
+      ".npmrc": `registry=${configured.url}\n${configured.npmrcToken}\n`,
+      "package.json": JSON.stringify({
+        name: "@corp/invalid-registry",
+        version: "1.0.0",
+        publishConfig: { [key]: value },
+      }),
+    });
+
+    const { err, exitCode } = await publish(env, String(dir));
+    expect(err).toContain(message);
+    expect(exitCode).toBe(1);
+    expect(configured.requests).toEqual([]);
+  });
+});
+
 it("$npm_command is accurate during publish", async () => {
   const { packageDir, packageJson } = await registry.createTestDir();
   await write(

From 66ea950907fabcbdb0ec7c619ced4d0e21fa11e1 Mon Sep 17 00:00:00 2001
From: robobun <117481402+robobun@users.noreply.github.com>
Date: Mon, 17 Aug 2026 02:44:27 +0000
Subject: [PATCH 156/258] pack: skip bins reached through symlinks; publish: do
 not read the readme through a symlink (#38707)

---
 src/runtime/cli/pack_command.rs      |  43 +++++++++
 src/runtime/cli/publish_command.rs   |   3 +-
 test/cli/install/bun-pack.test.ts    | 128 +++++++++++++++++++++++++++
 test/cli/install/bun-publish.test.ts |  40 ++++++++-
 4 files changed, 212 insertions(+), 2 deletions(-)

diff --git a/src/runtime/cli/pack_command.rs b/src/runtime/cli/pack_command.rs
index 7588f8e8dc5d..c2684fac9c4d 100644
--- a/src/runtime/cli/pack_command.rs
+++ b/src/runtime/cli/pack_command.rs
@@ -1541,6 +1541,39 @@ fn bin_path_escapes_root(p: &[u8]) -> bool {
     path::is_absolute_loose(p) || p == b".." || p.starts_with(b"../")
 }
 
+/// `Unknown` if `bin_path` is missing or a parent component is not a real directory.
+fn bin_kind_without_following_symlinks(
+    abs_workspace_path: &[u8],
+    bin_path: &[u8],
+) -> bun_sys::FileKind {
+    // A trailing slash would make `lstat` resolve a symlink to a directory.
+    let bin_path = strings::without_trailing_slash(bin_path);
+    // By absolute path: on Windows `lstatat` reports a reparse point as its target's kind.
+    let mut spill: Vec<u8> = Vec::new();
+    let mut end = 0;
+    loop {
+        end += match strings::index_of_char_usize(&bin_path[end..], b'/') {
+            Some(i) => i,
+            None => bin_path.len() - end,
+        };
+        let abs_path = resolve_path::join_z_spill::<resolve_path::platform::Auto>(
+            &mut spill,
+            &[abs_workspace_path, &bin_path[..end]],
+        );
+        let kind = match bun_sys::lstat(abs_path) {
+            Ok(stat) => bun_sys::kind_from_mode(stat.st_mode as bun_sys::Mode),
+            Err(_) => return bun_sys::FileKind::Unknown,
+        };
+        if end == bin_path.len() {
+            return kind;
+        }
+        if kind != bun_sys::FileKind::Directory {
+            return bun_sys::FileKind::Unknown;
+        }
+        end += 1;
+    }
+}
+
 fn is_package_bin(bins: &[BinInfo], maybe_bin_path: &[u8]) -> bool {
     for bin in bins {
         match bin.ty {
@@ -2206,6 +2239,16 @@ pub(crate) fn pack<const FOR_PUBLISH: bool>(
     let bins = get_package_bins(&json.root)?;
 
     for bin in &bins {
+        let expected_kind = match bin.ty {
+            BinType::File => bun_sys::FileKind::File,
+            BinType::Dir => bun_sys::FileKind::Directory,
+        };
+        if bin_kind_without_following_symlinks(abs_workspace_path, bin.path.as_bytes())
+            != expected_kind
+        {
+            continue;
+        }
+
         match bin.ty {
             BinType::File => {
                 pack_queue.add(PackQueueItem {
diff --git a/src/runtime/cli/publish_command.rs b/src/runtime/cli/publish_command.rs
index 7d0da33fedf6..799130260d98 100644
--- a/src/runtime/cli/publish_command.rs
+++ b/src/runtime/cli/publish_command.rs
@@ -1562,7 +1562,8 @@ impl PublishCommand {
         let mut iter = DirIterator::iterate(workspace_dir);
         iter.resolve_unknown_entry_types = true;
         while let Some(entry) = iter.next().ok().flatten() {
-            if entry.kind == bun_sys::EntryKind::Directory {
+            // Symlinks are not packed, so a symlinked README is not the readme either.
+            if entry.kind != bun_sys::EntryKind::File {
                 continue;
             }
             // Entry names are UTF-8 on every platform.
diff --git a/test/cli/install/bun-pack.test.ts b/test/cli/install/bun-pack.test.ts
index 1120351c422a..d726b96cd1b7 100644
--- a/test/cli/install/bun-pack.test.ts
+++ b/test/cli/install/bun-pack.test.ts
@@ -2030,6 +2030,134 @@ describe("bins", () => {
       expect(tarball.entries[1].perm & 0o111).toBe(0o111);
     });
   });
+
+  test("that are not regular files are ignored", async () => {
+    await Promise.all([
+      write(
+        join(packageDir, "package.json"),
+        JSON.stringify({
+          name: "pack-bins-not-files",
+          version: "1.0.0",
+          bin: {
+            "a-directory": "lib",
+            "empty": "",
+            "real": "real-bin.js",
+          },
+        }),
+      ),
+      write(join(packageDir, "index.js"), "console.log('index')"),
+      write(join(packageDir, "lib", "a.js"), "console.log('a')"),
+      write(join(packageDir, "real-bin.js"), "console.log('real bin')"),
+    ]);
+
+    await pack(packageDir, bunEnv);
+
+    const tarball = readTarball(join(packageDir, "pack-bins-not-files-1.0.0.tgz"));
+    expect(tarball.entries.map(({ pathname }) => pathname)).toEqual([
+      "package/package.json",
+      "package/index.js",
+      "package/lib/a.js",
+      "package/real-bin.js",
+    ]);
+    expect(tarball.entries[3].perm & 0o111).toBe(0o111);
+  });
+
+  // Symlinks are never packed (same as npm). Bins are no exception: packing one
+  // would copy the link target, which may live outside the package.
+  const OUTSIDE = "console.log('outside the package')";
+
+  async function writeSymlinkedBins() {
+    const outside = join(packageDir, "outside");
+    const pkgDir = join(packageDir, "pkg");
+    await Promise.all([
+      write(join(outside, "secret.js"), OUTSIDE),
+      write(join(outside, "nested", "inner.js"), OUTSIDE),
+      write(
+        join(pkgDir, "package.json"),
+        JSON.stringify({
+          name: "pack-bins-symlink",
+          version: "1.0.0",
+          // `files` leaves out every bin so that only the bin handling can add them.
+          files: ["index.js"],
+          bin: {
+            "real": "real-bin.js",
+            "relative-link": "relative-link.js",
+            "absolute-link": "absolute-link.js",
+            "link-inside-package": "link-to-real.js",
+            "through-linked-dir": "linked-dir/inner.js",
+            // bin paths are normalized to `/` before they are checked
+            "through-linked-dir-backslash": "linked-dir\\inner.js",
+          },
+        }),
+      ),
+      write(join(pkgDir, "index.js"), "console.log('index')"),
+      write(join(pkgDir, "real-bin.js"), "console.log('real bin')"),
+    ]);
+    await Promise.all([
+      symlink(join("..", "outside", "secret.js"), join(pkgDir, "relative-link.js"), "file"),
+      symlink(join(outside, "secret.js"), join(pkgDir, "absolute-link.js"), "file"),
+      symlink("real-bin.js", join(pkgDir, "link-to-real.js"), "file"),
+      symlink(join("..", "outside", "nested"), join(pkgDir, "linked-dir"), "dir"),
+    ]);
+    return pkgDir;
+  }
+
+  test("that are symlinks, or behind a symlinked directory, are not packed", async () => {
+    const pkgDir = await writeSymlinkedBins();
+
+    await pack(pkgDir, bunEnv);
+
+    const tarball = readTarball(join(pkgDir, "pack-bins-symlink-1.0.0.tgz"));
+    expect(tarball.entries.map(({ pathname }) => pathname)).toEqual([
+      "package/package.json",
+      "package/index.js",
+      "package/real-bin.js",
+    ]);
+    for (const entry of tarball.entries) {
+      expect(entry.contents).not.toContain(OUTSIDE);
+    }
+    expect(tarball.entries[2].perm & 0o111).toBe(0o111);
+  });
+
+  test("that are symlinks are not listed by --dry-run", async () => {
+    const pkgDir = await writeSymlinkedBins();
+
+    const { out } = await pack(pkgDir, bunEnv, "--dry-run");
+
+    const packed = out
+      .split("\n")
+      .filter(line => line.startsWith("packed "))
+      .map(line => line.split(" ").at(-1));
+    expect(packed).toEqual(["package.json", "index.js", "real-bin.js"]);
+    expect(out).toContain("Total files: 3");
+  });
+
+  test('"directories.bin" that is a symlink is not packed', async () => {
+    const outside = join(packageDir, "outside");
+    const pkgDir = join(packageDir, "pkg");
+    await Promise.all([
+      write(join(outside, "bins", "a.js"), OUTSIDE),
+      write(join(outside, "bins", "b.js"), OUTSIDE),
+      write(
+        join(pkgDir, "package.json"),
+        JSON.stringify({
+          name: "pack-bins-dir-symlink",
+          version: "1.0.0",
+          directories: {
+            bin: "./bins/",
+          },
+        }),
+      ),
+      write(join(pkgDir, "index.js"), "console.log('index')"),
+    ]);
+    // A junction on Windows, where "junction" is ignored elsewhere and makes a plain symlink.
+    await symlink(join(outside, "bins"), join(pkgDir, "bins"), "junction");
+
+    await pack(pkgDir, bunEnv);
+
+    const tarball = readTarball(join(pkgDir, "pack-bins-dir-symlink-1.0.0.tgz"));
+    expect(tarball.entries.map(({ pathname }) => pathname)).toEqual(["package/package.json", "package/index.js"]);
+  });
 });
 
 test("unicode", async () => {
diff --git a/test/cli/install/bun-publish.test.ts b/test/cli/install/bun-publish.test.ts
index 891515b6ae08..f57786b843b9 100644
--- a/test/cli/install/bun-publish.test.ts
+++ b/test/cli/install/bun-publish.test.ts
@@ -1,7 +1,7 @@
 import { file, spawn, write } from "bun";
 import { afterAll, beforeAll, describe, expect, it, test } from "bun:test";
 import { chmodSync, existsSync, mkdirSync, readFileSync, writeFileSync } from "fs";
-import { exists, rm } from "fs/promises";
+import { exists, rm, symlink } from "fs/promises";
 import {
   VerdaccioRegistry,
   bunExe,
@@ -1886,6 +1886,44 @@ describe("readme", () => {
       readmeFilename: "README.md",
     });
   });
+
+  // A README that is a symlink is not packed (symlinks never are), so its
+  // target must not be published as the readme either.
+  test("a README that is a symlink is not sent as readme", async () => {
+    let captured: any = null;
+    using mock = Bun.serve({
+      port: 0,
+      async fetch(req) {
+        if (req.method === "PUT") captured = await req.json();
+        return new Response("OK", { status: 200 });
+      },
+    });
+
+    const dir = tmpdirSync();
+    const packageDir = join(dir, "pkg");
+    await Promise.all([
+      write(join(dir, "outside", "README.md"), "# outside the package"),
+      write(
+        join(packageDir, "bunfig.toml"),
+        Bun.TOML.stringify({
+          install: {
+            cache: false,
+            registry: { url: `http://localhost:${mock.port}`, token: "unused" },
+          },
+        }),
+      ),
+      write(join(packageDir, "package.json"), JSON.stringify({ name: "readme-pkg-3", version: "3.0.0" })),
+      write(join(packageDir, "index.js"), "module.exports = 3;"),
+    ]);
+    await symlink(join("..", "outside", "README.md"), join(packageDir, "README.md"), "file");
+
+    const { err, exitCode } = await publish(env, packageDir);
+    expect(err).not.toContain("error:");
+    expect(exitCode).toBe(0);
+
+    expect(captured.versions["3.0.0"]).not.toContainAnyKeys(["readme", "readmeFilename"]);
+    expect(JSON.stringify(captured)).not.toContain("outside the package");
+  });
 });
 
 test("dist.tarball in the published manifest does not include userinfo from the registry url", async () => {

From 8badee9df28455a5b52dc99fefa7876e99ed8e80 Mon Sep 17 00:00:00 2001
From: robobun <117481402+robobun@users.noreply.github.com>
Date: Mon, 17 Aug 2026 02:44:37 +0000
Subject: [PATCH 157/258] pack: store tarball entry names byte for byte
 (#38715)

---
 src/runtime/cli/pack_command.rs   | 21 ++++------
 test/cli/install/bun-pack.test.ts | 68 +++++++++++++++++++++++++++++++
 2 files changed, 76 insertions(+), 13 deletions(-)

diff --git a/src/runtime/cli/pack_command.rs b/src/runtime/cli/pack_command.rs
index c2684fac9c4d..6f4357d746b5 100644
--- a/src/runtime/cli/pack_command.rs
+++ b/src/runtime/cli/pack_command.rs
@@ -2465,9 +2465,9 @@ pub(crate) fn pack<const FOR_PUBLISH: bool>(
     // default is 9
     // https://github.com/npm/cli/blob/ec105f400281a5bfd17885de1ea3d54d0c231b27/node_modules/pacote/lib/util/tar-create-options.js#L12
     let compression_level: &[u8] = opt_pack_gzip_level(ctx.manager).unwrap_or(b"9");
-    write!(&mut print_buf, "{}\x00", bstr::BStr::new(compression_level)).expect("OOM");
-    // SAFETY: print_buf[compression_level.len()] == 0 written above
-    let level_z = ZStr::from_buf(&print_buf[..], compression_level.len());
+    print_buf.extend_from_slice(compression_level);
+    print_buf.push(0);
+    let level_z = ZStr::from_slice_with_nul(&print_buf[..]);
     match archive.write_set_filter_option(None, zstr_lit(b"compression-level\0"), level_z) {
         ArchiveResult::Failed | ArchiveResult::Fatal | ArchiveResult::Warn => {
             Output::err_generic(
@@ -3163,16 +3163,11 @@ fn add_archive_entry(
 ) -> *mut ArchiveEntry {
     // `entry` is the same pointer after `.clear()`.
     let entry = ArchiveEntry::opaque_ref(entry);
-    write!(
-        print_buf,
-        "{}{}\x00",
-        bstr::BStr::new(PACKAGE_PREFIX),
-        bstr::BStr::new(filename.as_bytes())
-    )
-    .expect("OOM");
-    let pathname_len = PACKAGE_PREFIX.len() + filename.as_bytes().len();
-    // SAFETY: print_buf[pathname_len] == 0 written above
-    let pathname = ZStr::from_buf(&print_buf[..], pathname_len);
+    // Not formatted through `BStr`: its `Display` rewrites bytes that are not valid UTF-8.
+    print_buf.extend_from_slice(PACKAGE_PREFIX);
+    print_buf.extend_from_slice(filename.as_bytes());
+    print_buf.push(0);
+    let pathname = ZStr::from_slice_with_nul(&print_buf[..]);
     #[cfg(windows)]
     entry.set_pathname_utf8(pathname);
     #[cfg(not(windows))]
diff --git a/test/cli/install/bun-pack.test.ts b/test/cli/install/bun-pack.test.ts
index d726b96cd1b7..081cabf339b2 100644
--- a/test/cli/install/bun-pack.test.ts
+++ b/test/cli/install/bun-pack.test.ts
@@ -2177,6 +2177,74 @@ test("unicode", async () => {
   expect(tarball.entries).toMatchObject([{ "pathname": "package/package.json" }, { "pathname": "package/äöüščří.js" }]);
 });
 
+// Reads the members of a .tgz without decoding their names: `readTarball` turns
+// names into JS strings, which maps the bytes this test is about onto U+FFFD.
+// Names are returned latin1-decoded (one char per stored byte) and collected
+// from every place the archive spells a name: the ustar header `name` field
+// and, when libarchive emits one, the `path` record of the pax header.
+function rawTarballMembers(tgz: Uint8Array) {
+  const tar = Buffer.from(Bun.gunzipSync(tgz));
+  const members: { names: Set<string>; contents: string }[] = [];
+  let paxPath: string | undefined;
+  for (let offset = 0; offset + 512 <= tar.length; ) {
+    const header = tar.subarray(offset, offset + 512);
+    if (header.every(byte => byte === 0)) break;
+    const nameField = header.subarray(0, 100);
+    const nameLength = nameField.indexOf(0) === -1 ? 100 : nameField.indexOf(0);
+    const name = nameField.toString("latin1", 0, nameLength);
+    const size = parseInt(header.toString("latin1", 124, 136), 8);
+    const typeflag = header.toString("latin1", 156, 157);
+    const data = tar.subarray(offset + 512, offset + 512 + size);
+    offset += 512 + Math.ceil(size / 512) * 512;
+
+    if (typeflag === "x") {
+      // pax extended header data is a sequence of "<record length> <key>=<value>\n"
+      for (let pos = 0; pos < data.length; ) {
+        const space = data.indexOf(" ", pos);
+        const recordLength = parseInt(data.toString("latin1", pos, space), 10);
+        const record = data.toString("latin1", space + 1, pos + recordLength - 1);
+        if (record.startsWith("path=")) paxPath = record.slice("path=".length);
+        pos += recordLength;
+      }
+      continue;
+    }
+
+    const names = new Set([name]);
+    if (paxPath !== undefined) names.add(paxPath);
+    paxPath = undefined;
+    members.push({ names, contents: data.toString("latin1") });
+  }
+  return members.sort((a, b) => (a.contents < b.contents ? -1 : 1));
+}
+
+// Only Linux lets a filename carry bytes that are not valid UTF-8 (APFS rejects
+// them and Windows filenames are UTF-16).
+test.skipIf(!isLinux)("filenames that are not valid UTF-8 are stored byte for byte", async () => {
+  const rawPath = (byte: number) => Buffer.concat([Buffer.from(`${packageDir}/x_`), Buffer.from([byte])]);
+  await Promise.all([
+    write(
+      join(packageDir, "package.json"),
+      JSON.stringify({
+        name: "pack-invalid-utf8",
+        version: "1.0.0",
+      }),
+    ),
+    // latin-1 "é", and a byte that is invalid in UTF-8 at any position
+    fs.writeFile(rawPath(0xe9), "ONE"),
+    fs.writeFile(rawPath(0xff), "TWO"),
+  ]);
+
+  const { out } = await pack(packageDir, bunEnv);
+  expect(out).toContain("Total files: 3");
+
+  const members = rawTarballMembers(await file(join(packageDir, "pack-invalid-utf8-1.0.0.tgz")).bytes());
+  expect(members).toEqual([
+    { names: new Set(["package/x_\xe9"]), contents: "ONE" },
+    { names: new Set(["package/x_\xff"]), contents: "TWO" },
+    { names: new Set(["package/package.json"]), contents: expect.stringContaining(`"pack-invalid-utf8"`) },
+  ]);
+});
+
 test("$npm_command is accurate", async () => {
   await write(
     join(packageDir, "package.json"),

From 1795b121ebe0e6b7b4b8ccf7448d0a9e36ec50d5 Mon Sep 17 00:00:00 2001
From: robobun <117481402+robobun@users.noreply.github.com>
Date: Mon, 17 Aug 2026 02:46:27 +0000
Subject: [PATCH 158/258] pack: pack a file listed under several bin names
 once, strip the trailing slash from directories.bin (#38720)

---
 src/runtime/cli/pack_command.rs      |  62 ++++++-----
 src/runtime/cli/publish_command.rs   | 104 ++++++++-----------
 test/cli/install/bun-pack.test.ts    | 148 +++++++++++++++++++++++++++
 test/cli/install/bun-publish.test.ts |  50 +++++++++
 4 files changed, 275 insertions(+), 89 deletions(-)

diff --git a/src/runtime/cli/pack_command.rs b/src/runtime/cli/pack_command.rs
index 6f4357d746b5..27b6b05dfe2f 100644
--- a/src/runtime/cli/pack_command.rs
+++ b/src/runtime/cli/pack_command.rs
@@ -1455,7 +1455,7 @@ fn get_bundled_deps(
 // ───────────────────────────────────────────────────────────────────────────
 
 #[derive(Clone, Copy, PartialEq, Eq)]
-enum BinType {
+pub(crate) enum BinType {
     File,
     Dir,
 }
@@ -1473,14 +1473,9 @@ fn get_package_bins(json: &Expr) -> Result<Vec<BinInfo>, AllocError> {
 
     if let Some(bin) = json.as_property(b"bin") {
         if let Some(bin_str) = bin.expr.as_string(pack_bump()) {
-            let normalized = normalize_buf_spill::<path::platform::Posix>(
-                &mut path_buf,
-                &mut path_spill,
-                bin_str,
-            );
-            if !bin_path_escapes_root(normalized) {
+            if let Some(subpath) = bin_subpath(bin_str, BinType::File, &mut path_buf, &mut path_spill) {
                 bins.push(BinInfo {
-                    path: ZBox::from_bytes(normalized),
+                    path: ZBox::from_bytes(subpath),
                     ty: BinType::File,
                 });
             }
@@ -1495,14 +1490,16 @@ fn get_package_bins(json: &Expr) -> Result<Vec<BinInfo>, AllocError> {
             for bin_prop in bin_obj.properties.slice() {
                 if let Some(bin_prop_value) = &bin_prop.value {
                     if let Some(bin_str) = bin_prop_value.as_string(pack_bump()) {
-                        let normalized = normalize_buf_spill::<path::platform::Posix>(
-                            &mut path_buf,
-                            &mut path_spill,
-                            bin_str,
-                        );
-                        if !bin_path_escapes_root(normalized) {
+                        let Some(subpath) = bin_subpath(bin_str, BinType::File, &mut path_buf, &mut path_spill)
+                        else {
+                            continue;
+                        };
+                        let already_listed = bins.iter().any(|existing| {
+                            strings::eql_long(existing.path.as_bytes(), subpath, true)
+                        });
+                        if !already_listed {
                             bins.push(BinInfo {
-                                path: ZBox::from_bytes(normalized),
+                                path: ZBox::from_bytes(subpath),
                                 ty: BinType::File,
                             });
                         }
@@ -1518,14 +1515,9 @@ fn get_package_bins(json: &Expr) -> Result<Vec<BinInfo>, AllocError> {
         if let ExprData::EObject(directories_obj) = &directories.expr.data {
             if let Some(bin) = directories_obj.as_property(b"bin") {
                 if let Some(bin_str) = bin.expr.as_string(pack_bump()) {
-                    let normalized = normalize_buf_spill::<path::platform::Posix>(
-                        &mut path_buf,
-                        &mut path_spill,
-                        bin_str,
-                    );
-                    if !bin_path_escapes_root(normalized) {
+                    if let Some(subpath) = bin_subpath(bin_str, BinType::Dir, &mut path_buf, &mut path_spill) {
                         bins.push(BinInfo {
-                            path: ZBox::from_bytes(normalized),
+                            path: ZBox::from_bytes(subpath),
                             ty: BinType::Dir,
                         });
                     }
@@ -1537,8 +1529,25 @@ fn get_package_bins(json: &Expr) -> Result<Vec<BinInfo>, AllocError> {
     Ok(bins)
 }
 
-fn bin_path_escapes_root(p: &[u8]) -> bool {
-    path::is_absolute_loose(p) || p == b".." || p.starts_with(b"../")
+pub(crate) fn bin_subpath<'a>(
+    value: &[u8],
+    ty: BinType,
+    buf: &'a mut [u8],
+    spill: &'a mut Vec<u8>,
+) -> Option<&'a [u8]> {
+    let normalized: &'a [u8] = normalize_buf_spill::<path::platform::Posix>(buf, spill, value);
+    let subpath = match ty {
+        BinType::Dir => strings::without_trailing_slash(normalized),
+        BinType::File if normalized.ends_with(b"/") || normalized == b"package.json" => {
+            return None;
+        }
+        BinType::File => normalized,
+    };
+    (!is_package_root_or_outside(subpath)).then_some(subpath)
+}
+
+pub(crate) fn is_package_root_or_outside(p: &[u8]) -> bool {
+    p.is_empty() || p == b"." || path::is_absolute_loose(p) || p == b".." || p.starts_with(b"../")
 }
 
 /// `Unknown` if `bin_path` is missing or a parent component is not a real directory.
@@ -1583,9 +1592,8 @@ fn is_package_bin(bins: &[BinInfo], maybe_bin_path: &[u8]) -> bool {
                 }
             }
             BinType::Dir => {
-                let bin_without_trailing = strings::without_trailing_slash(bin.path.as_bytes());
-                if maybe_bin_path.starts_with(bin_without_trailing) {
-                    let remain = &maybe_bin_path[bin_without_trailing.len()..];
+                if maybe_bin_path.starts_with(bin.path.as_bytes()) {
+                    let remain = &maybe_bin_path[bin.path.as_bytes().len()..];
                     if remain.len() > 1
                         && remain[0] == b'/'
                         && strings::index_of_char(&remain[1..], b'/').is_none()
diff --git a/src/runtime/cli/publish_command.rs b/src/runtime/cli/publish_command.rs
index 799130260d98..ae1be3a29755 100644
--- a/src/runtime/cli/publish_command.rs
+++ b/src/runtime/cli/publish_command.rs
@@ -1584,6 +1584,16 @@ impl PublishCommand {
         None
     }
 
+    fn bin_target<'a>(
+        value: &[u8],
+        path_buf: &'a mut [u8],
+        path_spill: &'a mut Vec<u8>,
+    ) -> Option<&'a ZStr> {
+        let target: &'a ZStr =
+            normalize_buf_z_spill::<path::platform::Posix>(path_buf, path_spill, value);
+        (!pack::is_package_root_or_outside(target.as_bytes())).then_some(target)
+    }
+
     fn normalize_bin(
         json: &mut Expr,
         bump: &bun_alloc::Arena,
@@ -1604,32 +1614,26 @@ impl PublishCommand {
             match &bin_query.expr.data {
                 ExprData::EString(bin_str) => {
                     let mut bin_props: Vec<G::Property> = Vec::new();
-                    let normalized = strings::without_prefix_comptime_z(
-                        normalize_buf_z_spill::<path::platform::Posix>(
-                            &mut *path_buf,
-                            &mut path_spill,
-                            bin_str.string(bump)?,
-                        ),
-                        b"./",
-                    );
-                    if !bun_sys::exists_at(workspace_root, normalized) {
-                        bun_core::warn!(
-                            "bin '{}' does not exist",
-                            bstr::BStr::new(normalized.as_bytes()),
-                        );
-                    }
+                    if let Some(value) = Self::bin_target(bin_str.string(bump)?, &mut *path_buf, &mut path_spill) {
+                        if !bun_sys::exists_at(workspace_root, value) {
+                            bun_core::warn!(
+                                "bin '{}' does not exist",
+                                bstr::BStr::new(value.as_bytes()),
+                            );
+                        }
 
-                    bin_props.push(G::Property {
-                        key: Some(Expr::init(
-                            E::String::init(leak!(package_name)),
-                            bun_ast::Loc::EMPTY,
-                        )),
-                        value: Some(Expr::init(
-                            E::String::init(leak!(normalized.as_bytes())),
-                            bun_ast::Loc::EMPTY,
-                        )),
-                        ..Default::default()
-                    });
+                        bin_props.push(G::Property {
+                            key: Some(Expr::init(
+                                E::String::init(leak!(package_name)),
+                                bun_ast::Loc::EMPTY,
+                            )),
+                            value: Some(Expr::init(
+                                E::String::init(leak!(value.as_bytes())),
+                                bun_ast::Loc::EMPTY,
+                            )),
+                            ..Default::default()
+                        });
+                    }
 
                     json.data
                         .e_object_mut()
@@ -1672,33 +1676,17 @@ impl PublishCommand {
                             continue;
                         }
 
-                        let value: Option<bun_core::ZBox> = 'value: {
-                            if let Some(value) = &bin_prop.value {
-                                if let Some(vs) = value.data.as_e_string() {
-                                    if vs.len() != 0 {
-                                        break 'value Some(bun_core::ZBox::from_bytes(
-                                            strings::without_prefix_comptime_z(
-                                                // replace separators
-                                                normalize_buf_z_spill::<path::platform::Posix>(
-                                                    &mut *path_buf,
-                                                    &mut path_spill,
-                                                    vs.string(bump)?,
-                                                ),
-                                                b"./",
-                                            )
-                                            .as_bytes(),
-                                        ));
-                                    }
-                                }
-                            }
-                            None
+                        let Some(value) =
+                            bin_prop.value.as_ref().and_then(|v| v.data.as_e_string())
+                        else {
+                            continue;
                         };
-                        let Some(value) = value else { continue };
-                        if value.is_empty() {
+                        let Some(value) = Self::bin_target(value.string(bump)?, &mut *path_buf, &mut path_spill)
+                        else {
                             continue;
-                        }
+                        };
 
-                        if !bun_sys::exists_at(workspace_root, &value) {
+                        if !bun_sys::exists_at(workspace_root, value) {
                             bun_core::warn!(
                                 "bin '{}' does not exist",
                                 bstr::BStr::new(value.as_bytes()),
@@ -1739,20 +1727,12 @@ impl PublishCommand {
                     return Ok(());
                 };
                 let mut bin_props: Vec<G::Property> = Vec::new();
-                let normalized_bin_dir = bun_core::ZBox::from_bytes(
-                    strings::without_trailing_slash(strings::without_prefix(
-                        normalize_buf_spill::<path::platform::Posix>(
-                            &mut *path_buf,
-                            &mut path_spill,
-                            bin_dir_str,
-                        ),
-                        b"./",
-                    )),
-                );
-
-                if normalized_bin_dir.is_empty() {
+                let Some(bin_dir_subpath) =
+                    pack::bin_subpath(bin_dir_str, pack::BinType::Dir, &mut *path_buf, &mut path_spill)
+                else {
                     return Ok(());
-                }
+                };
+                let normalized_bin_dir = bun_core::ZBox::from_bytes(bin_dir_subpath);
 
                 let bin_dir = match bun_sys::openat(
                     workspace_root,
diff --git a/test/cli/install/bun-pack.test.ts b/test/cli/install/bun-pack.test.ts
index 081cabf339b2..bf1ce6180f88 100644
--- a/test/cli/install/bun-pack.test.ts
+++ b/test/cli/install/bun-pack.test.ts
@@ -2158,6 +2158,154 @@ describe("bins", () => {
     const tarball = readTarball(join(pkgDir, "pack-bins-dir-symlink-1.0.0.tgz"));
     expect(tarball.entries.map(({ pathname }) => pathname)).toEqual(["package/package.json", "package/index.js"]);
   });
+
+  // Paths resolve against the package root, as in npm, so all four name one file.
+  test("the same file under several bin names is packed once", async () => {
+    await Promise.all([
+      write(
+        join(packageDir, "package.json"),
+        JSON.stringify({
+          name: "pack-bins-same-file",
+          version: "1.0.0",
+          bin: {
+            "one": "cli.js",
+            "two": "cli.js",
+            "three": "./cli.js",
+            "four": "../cli.js",
+          },
+        }),
+      ),
+      write(join(packageDir, "cli.js"), "console.log('hello')"),
+    ]);
+
+    const { out } = await pack(packageDir, bunEnv);
+
+    const tarball = readTarball(join(packageDir, "pack-bins-same-file-1.0.0.tgz"));
+    expect(tarball.entries).toMatchObject([{ pathname: "package/package.json" }, { pathname: "package/cli.js" }]);
+    expect(tarball.entries[1].perm & 0o111).toBe(0o111);
+    expect(out).toContain("Total files: 2");
+  });
+
+  // None of these name a file that can be packed as a bin: the package root, a
+  // file spelled as a directory, a directory, and the root package.json (which
+  // is always in the tarball). The package packs as if "bin" were absent.
+  test.each(["", ".", "cli.js/", "lib/", "package.json"])('"bin" of %p is ignored', async bin => {
+    await Promise.all([
+      write(
+        join(packageDir, "package.json"),
+        JSON.stringify({
+          name: "pack-bins-not-a-file",
+          version: "1.0.0",
+          bin,
+        }),
+      ),
+      write(join(packageDir, "cli.js"), "console.log('cli')"),
+      write(join(packageDir, "lib", "a.js"), "console.log('a')"),
+    ]);
+
+    await pack(packageDir, bunEnv);
+
+    const tarball = readTarball(join(packageDir, "pack-bins-not-a-file-1.0.0.tgz"));
+    expect(
+      tarball.entries.map(entry => ({ pathname: entry.pathname, executable: (entry.perm & 0o111) !== 0 })),
+    ).toEqual([
+      { pathname: "package/package.json", executable: false },
+      { pathname: "package/cli.js", executable: false },
+      { pathname: "package/lib/a.js", executable: false },
+    ]);
+  });
+
+  test("ignored entries of a bin object do not affect the others", async () => {
+    await Promise.all([
+      write(
+        join(packageDir, "package.json"),
+        JSON.stringify({
+          name: "pack-bins-partly-ignored",
+          version: "1.0.0",
+          bin: {
+            "dir": "lib/",
+            "cli": "cli.js",
+            "pkg": "package.json",
+          },
+        }),
+      ),
+      write(join(packageDir, "cli.js"), "console.log('cli')"),
+      write(join(packageDir, "lib", "a.js"), "console.log('a')"),
+    ]);
+
+    await pack(packageDir, bunEnv);
+
+    const tarball = readTarball(join(packageDir, "pack-bins-partly-ignored-1.0.0.tgz"));
+    expect(
+      tarball.entries.map(entry => ({ pathname: entry.pathname, executable: (entry.perm & 0o111) !== 0 })),
+    ).toEqual([
+      { pathname: "package/package.json", executable: false },
+      { pathname: "package/cli.js", executable: true },
+      { pathname: "package/lib/a.js", executable: false },
+    ]);
+  });
+
+  // The bin directory is packed by its own walk, and the walk over the rest of
+  // the package has to skip it. Each `files` value below routes that skip
+  // through a different walk.
+  describe('"directories.bin" with a trailing slash', () => {
+    test.each([
+      [undefined, ["package/index.js", "package/lib/bins/bin.js", "package/lib/index.js"]],
+      [["index.js"], ["package/index.js", "package/lib/bins/bin.js"]],
+      [["lib"], ["package/lib/bins/bin.js", "package/lib/index.js"]],
+      [["lib/bins"], ["package/lib/bins/bin.js"]],
+    ])("files: %p", async (files, expected) => {
+      await Promise.all([
+        write(
+          join(packageDir, "package.json"),
+          JSON.stringify({
+            name: "pack-bins-dir-trailing-slash",
+            version: "1.0.0",
+            files,
+            directories: {
+              bin: "./lib/bins/",
+            },
+          }),
+        ),
+        write(join(packageDir, "index.js"), "console.log('index')"),
+        write(join(packageDir, "lib", "index.js"), "console.log('lib')"),
+        write(join(packageDir, "lib", "bins", "bin.js"), "console.log('bin')"),
+      ]);
+
+      await pack(packageDir, bunEnv);
+
+      const tarball = readTarball(join(packageDir, "pack-bins-dir-trailing-slash-1.0.0.tgz"));
+      expect(tarball.entries.map(entry => entry.pathname)).toEqual(["package/package.json", ...expected]);
+      const bin = tarball.entries.find(entry => entry.pathname === "package/lib/bins/bin.js");
+      expect(bin.perm & 0o111).toBe(0o111);
+    });
+  });
+
+  test.each(["", ".", "./"])('"directories.bin" of %p (the package root) is ignored', async bin => {
+    await Promise.all([
+      write(
+        join(packageDir, "package.json"),
+        JSON.stringify({
+          name: "pack-bins-dir-root",
+          version: "1.0.0",
+          directories: {
+            bin,
+          },
+        }),
+      ),
+      write(join(packageDir, "index.js"), "console.log('index')"),
+      write(join(packageDir, "lib", "a.js"), "console.log('a')"),
+    ]);
+
+    await pack(packageDir, bunEnv);
+
+    const tarball = readTarball(join(packageDir, "pack-bins-dir-root-1.0.0.tgz"));
+    expect(tarball.entries).toMatchObject([
+      { pathname: "package/package.json" },
+      { pathname: "package/index.js" },
+      { pathname: "package/lib/a.js" },
+    ]);
+  });
 });
 
 test("unicode", async () => {
diff --git a/test/cli/install/bun-publish.test.ts b/test/cli/install/bun-publish.test.ts
index f57786b843b9..346e5f144c00 100644
--- a/test/cli/install/bun-publish.test.ts
+++ b/test/cli/install/bun-publish.test.ts
@@ -1926,6 +1926,56 @@ describe("readme", () => {
   });
 });
 
+// The manifest "bin" that reaches the registry. Paths are resolved against the
+// package root the way npm does it ("../cli.js" is "cli.js"), a value that
+// resolves to the root itself is dropped, other values are kept as written (npm
+// keeps "lib/" as well), and "directories.bin" is expanded with the same rule
+// the tarball uses.
+describe("bin in the published manifest", () => {
+  test.each([
+    [{ bin: "cli.js" }, { "bin-pkg": "cli.js" }],
+    [{ bin: "../cli.js" }, { "bin-pkg": "cli.js" }],
+    [{ bin: "" }, {}],
+    [{ bin: "." }, {}],
+    [{ bin: { x: "lib/", y: "./cli.js", z: "", w: ".", v: "../../cli.js" } }, { x: "lib/", y: "cli.js", v: "cli.js" }],
+    [{ directories: { bin: "bins/" } }, { "a.js": "bins/a.js" }],
+    [{ directories: { bin: "" } }, undefined],
+    [{ directories: { bin: "." } }, undefined],
+  ])("%j", async (fields, expected) => {
+    let captured: any = null;
+    using mock = Bun.serve({
+      port: 0,
+      async fetch(req) {
+        if (req.method === "PUT") captured = await req.json();
+        return new Response("OK", { status: 200 });
+      },
+    });
+
+    const packageDir = tmpdirSync();
+    await Promise.all([
+      write(
+        join(packageDir, "bunfig.toml"),
+        Bun.TOML.stringify({
+          install: {
+            cache: false,
+            registry: { url: `http://localhost:${mock.port}`, token: "unused" },
+          },
+        }),
+      ),
+      write(join(packageDir, "package.json"), JSON.stringify({ name: "bin-pkg", version: "1.0.0", ...fields })),
+      write(join(packageDir, "cli.js"), "#!/usr/bin/env node\n"),
+      write(join(packageDir, "lib", "a.js"), "module.exports = 1;"),
+      write(join(packageDir, "bins", "a.js"), "#!/usr/bin/env node\n"),
+    ]);
+
+    const { err, exitCode } = await publish(env, packageDir);
+    expect(err).not.toContain("error:");
+    expect(exitCode).toBe(0);
+
+    expect(captured.versions["1.0.0"].bin).toEqual(expected);
+  });
+});
+
 test("dist.tarball in the published manifest does not include userinfo from the registry url", async () => {
   let captured: any = null;
   using mock = Bun.serve({

From c25f95a0ce72e5cd8d22de032d460f47ed2fae19 Mon Sep 17 00:00:00 2001
From: robobun <117481402+robobun@users.noreply.github.com>
Date: Mon, 17 Aug 2026 02:48:33 +0000
Subject: [PATCH 159/258] pm pack: resolve relative --destination and
 --filename against the invoking directory (#38739)

---
 src/runtime/cli/pack_command.rs            |  39 ++++-
 src/runtime/cli/package_manager_command.rs |   2 +-
 src/runtime/cli/publish_command.rs         |   4 +-
 test/cli/install/bun-pack.test.ts          | 165 +++++++++++++++++++++
 4 files changed, 200 insertions(+), 10 deletions(-)

diff --git a/src/runtime/cli/pack_command.rs b/src/runtime/cli/pack_command.rs
index 27b6b05dfe2f..d9865447ba18 100644
--- a/src/runtime/cli/pack_command.rs
+++ b/src/runtime/cli/pack_command.rs
@@ -120,6 +120,9 @@ pub(crate) struct Context<'a> {
     /// pointer in this file. `manager.lockfile` is incorrect
     pub(crate) lockfile: Option<&'a Lockfile>,
 
+    /// Where the command was run from; relative `--destination`/`--filename` resolve against it.
+    pub(crate) original_cwd: &'a [u8],
+
     pub(crate) bundled_deps: Vec<BundledDep>,
 
     pub(crate) stats: Stats,
@@ -204,6 +207,7 @@ impl PackCommand {
     pub(crate) fn exec_with_manager(
         ctx: Command::Context<'_>,
         manager: &mut PackageManager,
+        original_cwd: &[u8],
     ) -> crate::Result<()> {
         use bun_install::lockfile::{LoadResult, LoadStep};
 
@@ -276,6 +280,7 @@ impl PackCommand {
             manager,
             command_ctx: ctx,
             lockfile: lockfile_ref,
+            original_cwd,
             bundled_deps: Vec::new(),
             stats: Stats::default(),
         };
@@ -2392,6 +2397,7 @@ pub(crate) fn pack<const FOR_PUBLISH: bool>(
                 let (abs_tarball_dest, _) = tarball_destination(
                     opt_pack_destination(ctx.manager),
                     opt_pack_filename(ctx.manager),
+                    ctx.original_cwd,
                     abs_workspace_path,
                     package_name,
                     package_version,
@@ -2529,6 +2535,7 @@ pub(crate) fn pack<const FOR_PUBLISH: bool>(
     } else {
         Some(pack_destination(
             ctx.manager,
+            ctx.original_cwd,
             abs_workspace_path,
             package_name,
             package_version,
@@ -2886,9 +2893,11 @@ fn has_unsafe_tarball_filename_part(value: &[u8]) -> bool {
         || strings::contains_any(value, b"\\:\0")
 }
 
+/// Returns the tarball path and the length of the directory the caller creates (0 for `--filename`).
 fn tarball_destination<'a>(
     pack_destination: &[u8],
     pack_filename: &[u8],
+    original_cwd: &[u8],
     abs_workspace_path: &[u8],
     package_name: &[u8],
     package_version: &[u8],
@@ -2905,25 +2914,37 @@ fn tarball_destination<'a>(
         Global::crash();
     }
     if !pack_filename.is_empty() {
-        if pack_filename.len() + 1 > dest_buf.len() {
+        // Leave room for the NUL terminator written after the join.
+        let join_buf_len = dest_buf.len() - 1;
+        let Some(tarball_name_len) =
+            resolve_path::join_abs_string_buf_checked::<resolve_path::platform::Auto>(
+                original_cwd,
+                &mut dest_buf[..join_buf_len],
+                &[pack_filename],
+            )
+            .map(<[u8]>::len)
+        else {
             Output::err_generic(
                 "archive filename too long: \"{}\"",
                 format_args!("{}", bstr::BStr::new(pack_filename)),
             );
             Global::crash();
-        }
-        dest_buf[..pack_filename.len()].copy_from_slice(pack_filename);
-        dest_buf[pack_filename.len()] = 0;
-        let tarball_name_len = pack_filename.len() + 1;
+        };
+        dest_buf[tarball_name_len] = 0;
 
-        // SAFETY: NUL written at pack_filename.len()
-        return (ZStr::from_buf(&dest_buf[..], tarball_name_len - 1), 0);
+        // SAFETY: NUL written at tarball_name_len
+        return (ZStr::from_buf(&dest_buf[..], tarball_name_len), 0);
     } else {
+        let destination_base = if pack_destination.is_empty() {
+            abs_workspace_path
+        } else {
+            original_cwd
+        };
         let (dir_len_trimmed, dir_len_full) = {
             let Some(tarball_destination_dir) = resolve_path::join_abs_string_buf_checked::<
                 resolve_path::platform::Auto,
             >(
-                abs_workspace_path, dest_buf, &[pack_destination]
+                destination_base, dest_buf, &[pack_destination]
             ) else {
                 Output::err_generic(
                     "archive destination name too long: \"{}/{}\"",
@@ -3044,6 +3065,7 @@ impl<'a> fmt::Display for TarballNameFormatter<'a> {
 /// Resolves where `bun pm pack` writes the tarball and creates that directory.
 fn pack_destination<'a>(
     manager: &PackageManager,
+    original_cwd: &[u8],
     abs_workspace_path: &[u8],
     package_name: &[u8],
     package_version: &[u8],
@@ -3052,6 +3074,7 @@ fn pack_destination<'a>(
     let (abs_tarball_dest, dir_end) = tarball_destination(
         opt_pack_destination(manager),
         opt_pack_filename(manager),
+        original_cwd,
         abs_workspace_path,
         package_name,
         package_version,
diff --git a/src/runtime/cli/package_manager_command.rs b/src/runtime/cli/package_manager_command.rs
index 43769c7f0703..27e1e370f39c 100644
--- a/src/runtime/cli/package_manager_command.rs
+++ b/src/runtime/cli/package_manager_command.rs
@@ -366,7 +366,7 @@ Learn more about these at <magenta>https://bun.com/docs/cli/pm<r>.\n";
             ScanCommand::exec_with_manager(&mut *ctx, pm, &cwd)?;
             Global::exit(0);
         } else if strings::eql_comptime(subcommand, b"pack") {
-            PackCommand::exec_with_manager(ctx, pm)?;
+            PackCommand::exec_with_manager(ctx, pm, &cwd)?;
             Global::exit(0);
         } else if strings::eql_comptime(subcommand, b"whoami") {
             let username = match Npm::whoami(pm) {
diff --git a/src/runtime/cli/publish_command.rs b/src/runtime/cli/publish_command.rs
index ae1be3a29755..9cfa7d0ad175 100644
--- a/src/runtime/cli/publish_command.rs
+++ b/src/runtime/cli/publish_command.rs
@@ -437,6 +437,7 @@ impl<'a, const DIRECTORY_PUBLISH: bool> Context<'a, DIRECTORY_PUBLISH> {
     pub(crate) fn from_workspace(
         ctx: Command::Context<'a>,
         manager: &'a mut PackageManager,
+        original_cwd: &[u8],
     ) -> Result<Context<'static, true>, FromWorkspaceError> {
         let mut lockfile = Lockfile::default();
         let manager_ptr: *mut PackageManager = manager;
@@ -496,6 +497,7 @@ impl<'a, const DIRECTORY_PUBLISH: bool> Context<'a, DIRECTORY_PUBLISH> {
             manager: unsafe { &mut *manager_ptr },
             command_ctx: ctx,
             lockfile: lockfile_ref,
+            original_cwd,
             bundled_deps: Vec::new(),
             stats: pack::Stats::default(),
         };
@@ -599,7 +601,7 @@ impl PublishCommand {
             return Ok(());
         }
 
-        let context = match Context::<true>::from_workspace(ctx, manager) {
+        let context = match Context::<true>::from_workspace(ctx, manager, &original_cwd) {
             Ok(c) => c,
             Err(err) => {
                 use pack::PackError;
diff --git a/test/cli/install/bun-pack.test.ts b/test/cli/install/bun-pack.test.ts
index bf1ce6180f88..6fd0bace3634 100644
--- a/test/cli/install/bun-pack.test.ts
+++ b/test/cli/install/bun-pack.test.ts
@@ -628,6 +628,171 @@ describe("flags", () => {
     // --dry-run never writes the tarball.
     expect(await exists(join(packageDir, "pack-quiet-dry-test-1.1.1.tgz"))).toBeFalse();
   });
+
+  describe("relative --destination and --filename resolve against the cwd", () => {
+    // `bun pm pack` chdirs to the package root, or to the workspace root above it, before packing.
+    // The flags were typed relative to the directory the command was run from, so that is what
+    // they must resolve against: not the directory bun chdir'd to, and not the packed package's directory.
+    const packageJsonEntry = { pathname: "package/package.json" };
+
+    test.concurrent("--filename from a workspace package", async () => {
+      using dir = tempDir("pack-cwd-filename-workspace", {
+        "package.json": JSON.stringify({ name: "pack-cwd-root", version: "0.0.0", workspaces: ["packages/*"] }),
+        "packages/pkg/package.json": JSON.stringify({ name: "pack-cwd-pkg", version: "1.2.3" }),
+      });
+      const pkgDir = join(String(dir), "packages", "pkg");
+
+      const { out } = await pack(pkgDir, bunEnv, "--quiet", "--filename=./pkg.tgz");
+
+      expect(out).toBe(`${join(pkgDir, "pkg.tgz")}\n`);
+      expect(await exists(join(String(dir), "pkg.tgz"))).toBeFalse();
+      expect(readTarball(join(pkgDir, "pkg.tgz")).entries).toMatchObject([packageJsonEntry]);
+    });
+
+    test.concurrent("--destination from a workspace package", async () => {
+      using dir = tempDir("pack-cwd-destination-workspace", {
+        "package.json": JSON.stringify({ name: "pack-cwd-root", version: "0.0.0", workspaces: ["packages/*"] }),
+        "packages/pkg/package.json": JSON.stringify({ name: "pack-cwd-pkg", version: "1.2.3" }),
+      });
+      const pkgDir = join(String(dir), "packages", "pkg");
+
+      const { out } = await pack(pkgDir, bunEnv, "--quiet", "--destination=./out");
+
+      const tarballPath = join(pkgDir, "out", "pack-cwd-pkg-1.2.3.tgz");
+      expect(out).toBe(`${tarballPath}\n`);
+      expect(await exists(join(String(dir), "out"))).toBeFalse();
+      expect(readTarball(tarballPath).entries).toMatchObject([packageJsonEntry]);
+    });
+
+    test.concurrent("--destination from a subdirectory of a workspace package", async () => {
+      using dir = tempDir("pack-cwd-destination-workspace-subdir", {
+        "package.json": JSON.stringify({ name: "pack-cwd-root", version: "0.0.0", workspaces: ["packages/*"] }),
+        "packages/pkg/package.json": JSON.stringify({ name: "pack-cwd-pkg", version: "1.2.3" }),
+        "packages/pkg/src": {},
+      });
+      const pkgDir = join(String(dir), "packages", "pkg");
+
+      // cwd is packages/pkg/src, the packed package is packages/pkg, and bun chdir'd to the workspace root
+      const { out } = await pack(join(pkgDir, "src"), bunEnv, "--quiet", "--destination=../dist");
+
+      const tarballPath = join(pkgDir, "dist", "pack-cwd-pkg-1.2.3.tgz");
+      expect(out).toBe(`${tarballPath}\n`);
+      expect(await exists(join(String(dir), "packages", "dist"))).toBeFalse();
+      expect(await exists(join(String(dir), "dist"))).toBeFalse();
+      expect(readTarball(tarballPath).entries).toMatchObject([packageJsonEntry]);
+    });
+
+    test.concurrent("--destination from a subdirectory of the package", async () => {
+      using dir = tempDir("pack-cwd-destination-subdir", {
+        "package.json": JSON.stringify({ name: "pack-cwd-subdir", version: "1.0.0" }),
+        "sub": {},
+      });
+      const subDir = join(String(dir), "sub");
+
+      const { out } = await pack(subDir, bunEnv, "--quiet", "--destination=./out");
+
+      const tarballPath = join(subDir, "out", "pack-cwd-subdir-1.0.0.tgz");
+      expect(out).toBe(`${tarballPath}\n`);
+      expect(await exists(join(String(dir), "out"))).toBeFalse();
+      expect(readTarball(tarballPath).entries).toMatchObject([packageJsonEntry]);
+    });
+
+    test.concurrent("--filename from a subdirectory of the package", async () => {
+      using dir = tempDir("pack-cwd-filename-subdir", {
+        "package.json": JSON.stringify({ name: "pack-cwd-subdir", version: "1.0.0" }),
+        // --filename does not create directories, so both candidate locations exist up front
+        "sub/out": {},
+        "out": {},
+      });
+      const subDir = join(String(dir), "sub");
+
+      const { out } = await pack(subDir, bunEnv, "--quiet", "--filename=out/pkg.tgz");
+
+      expect(out).toBe(`${join(subDir, "out", "pkg.tgz")}\n`);
+      expect(await exists(join(String(dir), "out", "pkg.tgz"))).toBeFalse();
+      expect(readTarball(join(subDir, "out", "pkg.tgz")).entries).toMatchObject([packageJsonEntry]);
+    });
+
+    test.concurrent("--dry-run prints the path the tarball would be written to", async () => {
+      using dir = tempDir("pack-cwd-dry-run", {
+        "package.json": JSON.stringify({ name: "pack-cwd-dry-run", version: "1.0.0" }),
+        "sub": {},
+      });
+      const subDir = join(String(dir), "sub");
+
+      const [{ out: destinationOut }, { out: filenameOut }] = await Promise.all([
+        pack(subDir, bunEnv, "--quiet", "--dry-run", "--destination=./out"),
+        pack(subDir, bunEnv, "--quiet", "--dry-run", "--filename=./pkg.tgz"),
+      ]);
+
+      expect(destinationOut).toBe(`${join(subDir, "out", "pack-cwd-dry-run-1.0.0.tgz")}\n`);
+      expect(filenameOut).toBe(`${join(subDir, "pkg.tgz")}\n`);
+      expect(await exists(join(subDir, "out"))).toBeFalse();
+      expect(await exists(join(String(dir), "out"))).toBeFalse();
+      expect(await exists(join(subDir, "pkg.tgz"))).toBeFalse();
+      expect(await exists(join(String(dir), "pkg.tgz"))).toBeFalse();
+    });
+
+    test.concurrent("absolute paths are used as given", async () => {
+      using dir = tempDir("pack-cwd-absolute", {
+        "package.json": JSON.stringify({ name: "pack-cwd-root", version: "0.0.0", workspaces: ["packages/*"] }),
+        "packages/pkg/package.json": JSON.stringify({ name: "pack-cwd-pkg", version: "1.2.3" }),
+        "elsewhere": {},
+      });
+      const pkgDir = join(String(dir), "packages", "pkg");
+      const elsewhere = join(String(dir), "elsewhere");
+
+      const [{ out: filenameOut }, { out: destinationOut }] = await Promise.all([
+        pack(pkgDir, bunEnv, "--quiet", `--filename=${join(elsewhere, "named.tgz")}`),
+        pack(pkgDir, bunEnv, "--quiet", `--destination=${join(elsewhere, "out")}`),
+      ]);
+
+      expect(filenameOut).toBe(`${join(elsewhere, "named.tgz")}\n`);
+      expect(destinationOut).toBe(`${join(elsewhere, "out", "pack-cwd-pkg-1.2.3.tgz")}\n`);
+      expect(readTarball(join(elsewhere, "named.tgz")).entries).toMatchObject([packageJsonEntry]);
+      expect(readTarball(join(elsewhere, "out", "pack-cwd-pkg-1.2.3.tgz")).entries).toMatchObject([packageJsonEntry]);
+    });
+
+    test.concurrent("the default location is still the packed package's directory", async () => {
+      using dir = tempDir("pack-cwd-default", {
+        "package.json": JSON.stringify({ name: "pack-cwd-root", version: "0.0.0", workspaces: ["packages/*"] }),
+        "packages/pkg/package.json": JSON.stringify({ name: "pack-cwd-pkg", version: "1.2.3" }),
+        "packages/pkg/src": {},
+      });
+      const pkgDir = join(String(dir), "packages", "pkg");
+
+      const { out } = await pack(join(pkgDir, "src"), bunEnv, "--quiet");
+
+      expect(out).toBe("pack-cwd-pkg-1.2.3.tgz\n");
+      expect(await exists(join(pkgDir, "src", "pack-cwd-pkg-1.2.3.tgz"))).toBeFalse();
+      expect(await exists(join(String(dir), "pack-cwd-pkg-1.2.3.tgz"))).toBeFalse();
+      expect(readTarball(join(pkgDir, "pack-cwd-pkg-1.2.3.tgz")).entries).toMatchObject([packageJsonEntry]);
+    });
+
+    // PATH_MAX is 4096 on Linux and 1024 on macOS. Windows' path buffer is larger than any command line.
+    describe.skipIf(isWindows)("--filename longer than PATH_MAX", () => {
+      const longName = Buffer.alloc(5000, "f").toString();
+      const packageJson = JSON.stringify({ name: "pack-cwd-long-filename", version: "1.0.0" });
+
+      test.concurrent("is reported as an error", async () => {
+        using dir = tempDir("pack-cwd-long-filename", { "package.json": packageJson });
+
+        const { err } = await packExpectError(String(dir), bunEnv, `--filename=${longName}`);
+
+        expect(err).toContain(`error: archive filename too long: "${longName}"\n`);
+      });
+
+      test.concurrent("packs when the resolved path fits", async () => {
+        using dir = tempDir("pack-cwd-long-filename-normalized", { "package.json": packageJson });
+
+        // `<5000 bytes>/../pkg.tgz` resolves to `<cwd>/pkg.tgz`.
+        const { out } = await pack(String(dir), bunEnv, "--quiet", `--filename=${longName}/../pkg.tgz`);
+
+        expect(out).toBe(`${join(String(dir), "pkg.tgz")}\n`);
+        expect(readTarball(join(String(dir), "pkg.tgz")).entries).toMatchObject([packageJsonEntry]);
+      });
+    });
+  });
 });
 
 // The tarball used to be streamed to its destination while it was being built, so any failure on

From 336133ac54c4f0216348d1a33f8cdfe05cff1deb Mon Sep 17 00:00:00 2001
From: robobun <117481402+robobun@users.noreply.github.com>
Date: Mon, 17 Aug 2026 02:51:46 +0000
Subject: [PATCH 160/258] pack/publish: resolve workspace: and catalog: specs
 from the package.json files, not bun.lock (#38813)

---
 .../PackageManager/package_json_write_back.rs |   4 +-
 .../PackageManager/workspace_manifests.rs     | 109 +++++-
 src/runtime/cli/pack_command.rs               | 365 +++++++-----------
 src/runtime/cli/publish_command.rs            |  59 +--
 test/cli/install/bun-pack.test.ts             | 277 ++++++++++++-
 test/cli/install/bun-publish.test.ts          | 108 ++++++
 test/cli/install/catalogs.test.ts             |  57 ++-
 7 files changed, 672 insertions(+), 307 deletions(-)

diff --git a/src/install/PackageManager/package_json_write_back.rs b/src/install/PackageManager/package_json_write_back.rs
index d1c93f801592..3c22399fc6ba 100644
--- a/src/install/PackageManager/package_json_write_back.rs
+++ b/src/install/PackageManager/package_json_write_back.rs
@@ -10,7 +10,7 @@ use crate::dependency::DependencyExt as _;
 use crate::lockfile::package::PackageColumns as _;
 use crate::lockfile::{Lockfile, Package};
 use crate::resolution::Tag as ResolutionTag;
-use crate::{Dependency, PackageID, PackageNameHash, invalid_package_id};
+use crate::{Dependency, Features, PackageID, PackageNameHash, invalid_package_id};
 
 use super::add_catalog;
 use super::add_remove_with_filter::{
@@ -298,7 +298,7 @@ fn target_package_ids(lockfile: &Lockfile, edited: &[EditedPackageJson]) -> Vec<
 /// Re-parses the edited files the way `bun install` would and copies every declared literal that differs (and, for the root, `overrides` + `catalogs`) into `manager.lockfile`, so the next install's differ sees no change.
 fn sync_lockfile(manager: &mut PackageManager, edited: &[EditedPackageJson]) -> crate::Result<()> {
     let mut scratch = super::workspace_manifests::ScratchManifests::new();
-    scratch.parse_root(manager)?;
+    scratch.parse_root(manager, Features::main())?;
     let mut root_pkg = Some(core::mem::take(&mut scratch.root));
     let mut parsed: Vec<(usize, Package)> = Vec::with_capacity(edited.len());
     for (i, e) in edited.iter().enumerate() {
diff --git a/src/install/PackageManager/workspace_manifests.rs b/src/install/PackageManager/workspace_manifests.rs
index aeade57954aa..a459b638a2aa 100644
--- a/src/install/PackageManager/workspace_manifests.rs
+++ b/src/install/PackageManager/workspace_manifests.rs
@@ -1,3 +1,5 @@
+use core::fmt;
+
 use bstr::BStr;
 use bun_collections::HashMap;
 use bun_core::{Global, Output};
@@ -11,6 +13,7 @@ use super::add_remove_with_filter::{WorkspaceTarget, fetch_entry, root_package_j
 use super::workspace_selection::WorkspaceGraph;
 
 /// Root + member package.json files parsed the way `bun install` parses them, into a throw-away lockfile.
+/// Errors the parse only logs (an invalid catalog range, say) fail it here, as they fail `bun install`.
 pub(crate) struct ScratchManifests {
     pub(crate) lockfile: Lockfile,
     pub(crate) log: bun_ast::Log,
@@ -27,7 +30,12 @@ impl ScratchManifests {
     }
 
     /// Must run first: it fills `lockfile.workspace_paths`, which `workspace:` rows in every file resolve through.
-    pub(crate) fn parse_root(&mut self, manager: &mut PackageManager) -> crate::Result<()> {
+    /// `features` must include `workspaces` for that, and `is_main` for the catalogs.
+    pub(crate) fn parse_root(
+        &mut self,
+        manager: &mut PackageManager,
+        features: Features,
+    ) -> crate::Result<()> {
         let root_target = WorkspaceTarget {
             name: Box::default(),
             name_hash: None,
@@ -46,8 +54,9 @@ impl ScratchManifests {
             &root_source,
             root_json,
             &mut resolver,
-            Features::main(),
-        )
+            features,
+        )?;
+        self.fail_on_logged_errors()
     }
 
     pub(crate) fn parse_member(
@@ -71,8 +80,77 @@ impl ScratchManifests {
             &mut resolver,
             Features::WORKSPACE,
         )?;
+        self.fail_on_logged_errors()?;
         Ok(pkg)
     }
+
+    fn fail_on_logged_errors(&self) -> crate::Result<()> {
+        if self.log.has_errors() {
+            return Err(crate::Error::InstallFailed);
+        }
+        Ok(())
+    }
+}
+
+/// The workspace versions and catalogs `bun pm pack` / `bun publish` substitute, read from the
+/// package.json files as they are now. Not from bun.lock: it has the versions of the last install,
+/// and releases bump versions between that install and the publish.
+pub struct WorkspaceManifests {
+    lockfile: Lockfile,
+    root_package_json_path: Box<[u8]>,
+}
+
+impl WorkspaceManifests {
+    /// Exits with `bun install`'s errors when the root package.json or a workspace does not parse.
+    pub fn load(manager: &mut PackageManager) -> WorkspaceManifests {
+        // Only the two things pack reads: the `workspaces` walk and the catalogs. The root's own
+        // dependency sections are not parsed, so `bun install`'s checks on them (a `workspace:1.2.3`
+        // range no workspace satisfies, say) do not decide whether a package packs.
+        let features = Features {
+            is_main: true,
+            workspaces: true,
+            dependencies: false,
+            peer_dependencies: false,
+            ..Features::default()
+        };
+        let mut scratch = ScratchManifests::new();
+        if let Err(err) = scratch.parse_root(manager, features) {
+            crash(
+                &mut scratch.log,
+                err,
+                format_args!("failed to read the workspace's package.json files"),
+            );
+        }
+        WorkspaceManifests {
+            lockfile: scratch.lockfile,
+            root_package_json_path: root_package_json_path(),
+        }
+    }
+
+    /// The package.json whose `workspaces` and catalogs these are: the workspace root's when the
+    /// package being packed is one of its workspaces, otherwise the package's own.
+    pub fn root_package_json_path(&self) -> &[u8] {
+        &self.root_package_json_path
+    }
+
+    /// The `version` in the package.json of the workspace named `name`. `None` when no workspace
+    /// has that name or its package.json has no (semver) version.
+    pub fn workspace_version(&self, name: &[u8]) -> Option<impl fmt::Display + '_> {
+        let name_hash: PackageNameHash = bun_semver::string::Builder::string_hash(name);
+        let version = self.lockfile.workspace_versions.get(&name_hash)?;
+        Some(version.fmt(self.lockfile.buffers.string_bytes.as_slice()))
+    }
+
+    /// The range catalog `catalog_name` (`""` and `"default"` both name the default catalog)
+    /// declares for `dependency_name`, as written in the root package.json.
+    pub fn catalog_version(&self, catalog_name: &[u8], dependency_name: &[u8]) -> Option<&[u8]> {
+        let string_buf = self.lockfile.buffers.string_bytes.as_slice();
+        let dependency = self
+            .lockfile
+            .catalogs
+            .find(string_buf, catalog_name, dependency_name)?;
+        Some(dependency.version.literal.slice(string_buf))
+    }
 }
 
 /// Graph index i == `targets[i]`; the target whose `name_hash` is `None` is the root.
@@ -82,8 +160,8 @@ pub(crate) fn relation_graph(
     pattern: &[u8],
 ) -> WorkspaceGraph {
     let mut scratch = ScratchManifests::new();
-    if let Err(err) = scratch.parse_root(manager) {
-        crash(&mut scratch.log, pattern, err);
+    if let Err(err) = scratch.parse_root(manager, Features::main()) {
+        crash_for_filter(&mut scratch.log, pattern, err);
     }
 
     let mut parsed: Vec<(u32, Package)> = Vec::with_capacity(targets.len());
@@ -94,7 +172,7 @@ pub(crate) fn relation_graph(
         }
         match scratch.parse_member(manager, target) {
             Ok(pkg) => parsed.push((i as u32, pkg)),
-            Err(err) => crash(&mut scratch.log, pattern, err),
+            Err(err) => crash_for_filter(&mut scratch.log, pattern, err),
         }
     }
 
@@ -150,14 +228,23 @@ pub(crate) fn relation_graph(
     WorkspaceGraph::from_edges(targets.len(), edges)
 }
 
-fn crash(log: &mut bun_ast::Log, pattern: &[u8], err: crate::Error) -> ! {
+fn crash_for_filter(log: &mut bun_ast::Log, pattern: &[u8], err: crate::Error) -> ! {
+    crash(
+        log,
+        err,
+        format_args!(
+            "failed to read the workspace dependencies for --filter \"{}\"",
+            BStr::new(pattern)
+        ),
+    )
+}
+
+/// The parse errors explain the failure when there are any; `what` and `err` are the fallback.
+fn crash(log: &mut bun_ast::Log, err: crate::Error, what: fmt::Arguments<'_>) -> ! {
     if log.has_errors() {
         let _ = log.print(std::ptr::from_mut(Output::error_writer()));
     } else {
-        Output::err_generic(
-            "failed to read the workspace dependencies for --filter \"{}\": {}",
-            (BStr::new(pattern), err.name()),
-        );
+        Output::err_generic("{}: {}", (what, err.name()));
     }
     Global::crash();
 }
diff --git a/src/runtime/cli/pack_command.rs b/src/runtime/cli/pack_command.rs
index d9865447ba18..a1060fc64aab 100644
--- a/src/runtime/cli/pack_command.rs
+++ b/src/runtime/cli/pack_command.rs
@@ -8,9 +8,10 @@ use bun_alloc::AllocError;
 use bun_collections::StringHashMap;
 use bun_core::{Global, Output, Progress, fmt as bun_fmt};
 use bun_glob as glob;
+use bun_install::PackageManager;
 use bun_install::package_manager::LogLevel;
+use bun_install::package_manager::workspace_manifests::WorkspaceManifests;
 use bun_install::package_manager::workspace_package_json_cache as WorkspacePackageJSONCache;
-use bun_install::{Lockfile, PackageManager};
 use bun_parsers::json as JSON;
 // Note: `WorkspacePackageJSONCache` returns the T2 value-subset
 // `bun_ast::Expr` (see `bun_install::bun_json`), not the full T4
@@ -114,12 +115,6 @@ pub(crate) struct Context<'a> {
     // allocator param dropped — global mimalloc (see PORTING.md §Allocators)
     pub(crate) command_ctx: Command::Context<'a>,
 
-    /// `bun pack` does not require a lockfile, but
-    /// it's possible we will need it for finding
-    /// workspace versions. This is the only valid lockfile
-    /// pointer in this file. `manager.lockfile` is incorrect
-    pub(crate) lockfile: Option<&'a Lockfile>,
-
     /// Where the command was run from; relative `--destination`/`--filename` resolve against it.
     pub(crate) original_cwd: &'a [u8],
 
@@ -209,8 +204,6 @@ impl PackCommand {
         manager: &mut PackageManager,
         original_cwd: &[u8],
     ) -> crate::Result<()> {
-        use bun_install::lockfile::{LoadResult, LoadStep};
-
         if manager.options.log_level != LogLevel::Silent
             && manager.options.log_level != LogLevel::Quiet
         {
@@ -221,56 +214,6 @@ impl PackCommand {
             Output::flush();
         }
 
-        let mut lockfile = Lockfile::default();
-        // `log` is non-null after `PackageManager::init()`.
-        let log_ptr: *mut bun_ast::Log = manager.log;
-        let manager_ptr: *mut PackageManager = manager;
-        // SAFETY: `manager_ptr`/`log_ptr` came from live `&mut`; reborrowed
-        // disjointly (`log` is a separate allocation from the manager fields
-        // `load_from_cwd` touches).
-        let load_from_disk_result = lockfile
-            .load_from_cwd::<false>(Some(unsafe { &mut *manager_ptr }), unsafe { &mut *log_ptr });
-
-        let lockfile_ref: Option<&Lockfile> = match load_from_disk_result {
-            LoadResult::Ok(ok) => Some(&*ok.lockfile),
-            LoadResult::Err(cause) => 'err: {
-                match cause.step {
-                    LoadStep::OpenFile => {
-                        if cause.value == bun_install::Error::Sys(bun_errno::SystemErrno::ENOENT) {
-                            break 'err None;
-                        }
-                        Output::err_generic(
-                            "failed to open lockfile: {}",
-                            format_args!("{}", cause.value.name()),
-                        );
-                    }
-                    LoadStep::ParseFile => {
-                        Output::err_generic(
-                            "failed to parse lockfile: {}",
-                            format_args!("{}", cause.value.name()),
-                        );
-                    }
-                    LoadStep::ReadFile => {
-                        Output::err_generic(
-                            "failed to read lockfile: {}",
-                            format_args!("{}", cause.value.name()),
-                        );
-                    }
-                    LoadStep::Migrating => {
-                        Output::err_generic(
-                            "failed to migrate lockfile: {}",
-                            format_args!("{}", cause.value.name()),
-                        );
-                    }
-                }
-                if pm_log(manager_ptr).has_errors() {
-                    let _ = pm_log(manager_ptr).print(std::ptr::from_mut(Output::error_writer()));
-                }
-                Global::crash();
-            }
-            LoadResult::NotFound => None,
-        };
-
         // Note: split-borrowing through
         // `Context` would conflict with `&mut PackageManager`, so capture the
         // package.json path before constructing `Context`.
@@ -279,7 +222,6 @@ impl PackCommand {
         let mut pack_ctx = Context {
             manager,
             command_ctx: ctx,
-            lockfile: lockfile_ref,
             original_cwd,
             bundled_deps: Vec::new(),
             stats: Stats::default(),
@@ -2145,25 +2087,9 @@ pub(crate) fn pack<const FOR_PUBLISH: bool>(
         break 'post_scripts (postpack_script, None, None, did_run_scripts);
     };
 
-    // If any lifecycle scripts ran, they may have modified package.json,
-    // so we need to re-read it from disk to pick up any changes.
+    // The scripts may have edited any package.json in the workspace, and the cache predates them.
     if ran_scripts {
-        // Invalidate the cached entry by removing it.
-        // On Windows, the cache key is stored with POSIX path separators,
-        // so we need to convert the path before removing.
-        #[cfg(windows)]
-        let mut cache_key_buf = PathBuffer::uninit();
-        #[cfg(windows)]
-        let cache_key: &[u8] = {
-            let len = abs_package_json_path.as_bytes().len();
-            cache_key_buf[..len].copy_from_slice(abs_package_json_path.as_bytes());
-            path::dangerously_convert_path_to_posix_in_place::<u8>(&mut cache_key_buf[..len]);
-            &cache_key_buf[..len]
-        };
-        #[cfg(not(windows))]
-        let cache_key: &[u8] = abs_package_json_path.as_bytes();
-        let _ = pm_workspace_cache(manager_ptr).map.remove(cache_key);
-
+        pm_workspace_cache(manager_ptr).map.clear();
         json = package_json_entry(manager_ptr, abs_package_json_path);
 
         // Re-validate private flag after scripts may have modified it.
@@ -2203,7 +2129,13 @@ pub(crate) fn pack<const FOR_PUBLISH: bool>(
     }
 
     // Create the edited package.json content after lifecycle scripts have run
-    let edited_package_json = edit_root_package_json(ctx.lockfile, json)?;
+    let workspace_manifests =
+        needs_workspace_manifests(json.root).then(|| WorkspaceManifests::load(ctx.manager));
+    if workspace_manifests.is_some() {
+        // Loading added the other workspaces' package.json files to the cache `json` points into.
+        json = package_json_entry(manager_ptr, abs_package_json_path);
+    }
+    let edited_package_json = edit_root_package_json(workspace_manifests.as_ref(), json)?;
 
     let root_dir: Dir = 'root_dir: {
         let mut path_buf = PathBuffer::uninit();
@@ -3270,165 +3202,142 @@ fn add_archive_entry(
     entry.clear()
 }
 
-/// Strips workspace and catalog protocols from dependency versions then
-/// returns the printed json
-fn edit_root_package_json(
-    maybe_lockfile: Option<&Lockfile>,
-    json: &mut WorkspacePackageJSONCache::MapEntry,
-) -> Result<Box<[u8]>, AllocError> {
+/// What the tarball's package.json gets in place of a `workspace:` or `catalog:` spec.
+enum Substitution<'a> {
+    /// `workspace:^`, `workspace:~`, `workspace:*`: the workspace's current version behind that prefix.
+    WorkspaceVersion { prefix: &'static str },
+    /// `workspace:1.2.3`, `workspace:1.x`, ...: the range as written.
+    WorkspaceRange(&'a [u8]),
+    /// `catalog:` / `catalog:<name>`: that catalog's entry for the dependency.
+    Catalog { catalog_name: &'a [u8] },
+}
+
+impl<'a> Substitution<'a> {
+    fn for_spec(spec: &'a [u8]) -> Option<Substitution<'a>> {
+        if let Some(range) = strings::without_prefix_if_possible_comptime(spec, b"workspace:") {
+            return Some(match range {
+                b"^" => Substitution::WorkspaceVersion { prefix: "^" },
+                b"~" => Substitution::WorkspaceVersion { prefix: "~" },
+                b"*" => Substitution::WorkspaceVersion { prefix: "" },
+                _ => Substitution::WorkspaceRange(range),
+            });
+        }
+        let catalog_name = strings::without_prefix_if_possible_comptime(spec, b"catalog:")?;
+        Some(Substitution::Catalog {
+            catalog_name: strings::trim(catalog_name, &strings::WHITESPACE_CHARS),
+        })
+    }
+
+    fn needs_workspace_manifests(&self) -> bool {
+        !matches!(self, Substitution::WorkspaceRange(_))
+    }
+}
+
+/// Section order is the order errors get reported in.
+fn for_each_dependency(
+    package_json: Expr,
+    mut f: impl FnMut(&'static [u8], &mut bun_ast::G::Property),
+) {
     use bun_install_types::DependencyGroup;
-    // preserve deps→dev→peer→optional order (error-message ordering)
-    for dependency_group in [
+    for group in [
         DependencyGroup::DEPENDENCIES,
         DependencyGroup::DEV,
         DependencyGroup::PEER,
         DependencyGroup::OPTIONAL,
-    ]
-    .map(|g| g.prop)
-    {
-        if let Some(dependencies_expr) = json.root.get(dependency_group) {
-            if let ExprData::EObject(mut dependencies) = dependencies_expr.data {
-                for dependency in dependencies.properties.slice_mut() {
-                    if dependency.key.is_none() {
-                        continue;
-                    }
-                    if dependency.value.is_none() {
-                        continue;
-                    }
-
-                    let Some(package_spec) = dependency
-                        .value
-                        .as_ref()
-                        .expect("infallible: prop has value")
-                        .as_utf8_string_literal()
-                    else {
-                        continue;
-                    };
-                    let package_spec = bun_install::dependency::trim_literal(package_spec);
-                    if let Some(without_workspace_protocol) =
-                        strings::without_prefix_if_possible_comptime(package_spec, b"workspace:")
-                    {
-                        // TODO: make semver parsing more strict. `^`, `~` are not valid
-
-                        if without_workspace_protocol.len() == 1 {
-                            // TODO: this might be too strict
-                            let c = without_workspace_protocol[0];
-                            if c == b'^' || c == b'~' || c == b'*' {
-                                let dependency_name = match dependency
-                                    .key
-                                    .as_ref()
-                                    .expect("infallible: prop has key")
-                                    .as_utf8_string_literal()
-                                {
-                                    Some(n) => n,
-                                    None => {
-                                        Output::err_generic(
-                                            "expected string value for dependency name in \"{}\"",
-                                            format_args!("{}", bstr::BStr::new(dependency_group)),
-                                        );
-                                        Global::crash();
-                                    }
-                                };
-
-                                let resolved = 'failed_to_resolve: {
-                                    // find the current workspace version and append to package spec without `workspace:`
-                                    let Some(lockfile) = maybe_lockfile else {
-                                        break 'failed_to_resolve false;
-                                    };
-                                    let Some(workspace_version) = lockfile.workspace_versions.get(
-                                        &Semver::string::Builder::string_hash(dependency_name),
-                                    ) else {
-                                        break 'failed_to_resolve false;
-                                    };
-                                    let prefix: &[u8] = match c {
-                                        b'^' => b"^",
-                                        b'~' => b"~",
-                                        b'*' => b"",
-                                        _ => unreachable!(),
-                                    };
-                                    // Format on the heap then copy into the
-                                    // pack arena; `EString::init` erases the
-                                    // lifetime.
-                                    let tmp = format!(
-                                        "{}{}",
-                                        bstr::BStr::new(prefix),
-                                        workspace_version
-                                            .fmt(lockfile.buffers.string_bytes.as_slice()),
-                                    );
-                                    let data = pack_bump().alloc_slice_copy(tmp.as_bytes());
-                                    dependency.value = Some(Expr::init(
-                                        E::EString::init(data),
-                                        Default::default(),
-                                    ));
-                                    true
-                                };
-                                if resolved {
-                                    continue;
-                                }
-
-                                // only produce this error only when we need to get the workspace version
-                                Output::err_generic(
-                                    "Failed to resolve workspace version for \"{}\" in `{}`. Run <cyan>`bun install`<r> and try again.",
-                                    (
-                                        bstr::BStr::new(dependency_name),
-                                        bstr::BStr::new(dependency_group),
-                                    ),
-                                );
-                                Global::crash();
-                            }
-                        }
+    ] {
+        let Some(section) = package_json.get(group.prop) else {
+            continue;
+        };
+        let ExprData::EObject(mut dependencies) = section.data else {
+            continue;
+        };
+        for dependency in dependencies.properties.slice_mut() {
+            f(group.prop, dependency);
+        }
+    }
+}
 
-                        let dup = pack_bump().alloc_slice_copy(without_workspace_protocol);
-                        dependency.value =
-                            Some(Expr::init(E::EString::init(dup), Default::default()));
-                    } else if let Some(catalog_name_str) =
-                        strings::without_prefix_if_possible_comptime(package_spec, b"catalog:")
-                    {
-                        let dep_name_str = dependency
-                            .key
-                            .as_ref()
-                            .expect("infallible: prop has key")
-                            .as_utf8_string_literal()
-                            .expect("infallible: is_string checked");
-
-                        let lockfile = match maybe_lockfile {
-                            Some(l) => l,
-                            None => {
-                                Output::err_generic(
-                                    "Failed to resolve catalog version for \"{}\" in `{}` (catalogs require a lockfile).",
-                                    (
-                                        bstr::BStr::new(dep_name_str),
-                                        bstr::BStr::new(dependency_group),
-                                    ),
-                                );
-                                Global::crash();
-                            }
-                        };
+/// Packages without such specs must pack whatever state the rest of the workspace is in.
+fn needs_workspace_manifests(package_json: Expr) -> bool {
+    let mut needed = false;
+    for_each_dependency(package_json, |_, dependency| {
+        needed |= dependency
+            .value
+            .as_ref()
+            .and_then(Expr::as_utf8_string_literal)
+            .and_then(Substitution::for_spec)
+            .is_some_and(|substitution| substitution.needs_workspace_manifests());
+    });
+    needed
+}
 
-                        let map_buf: &[u8] = lockfile.buffers.string_bytes.as_slice();
-                        let catalog_name =
-                            strings::trim(catalog_name_str, &strings::WHITESPACE_CHARS);
-                        let Some(dep) = lockfile.catalogs.find(map_buf, catalog_name, dep_name_str)
-                        else {
-                            Output::err_generic(
-                                "Failed to resolve catalog version for \"{}\" in `{}` (no matching catalog dependency).",
-                                (
-                                    bstr::BStr::new(dep_name_str),
-                                    bstr::BStr::new(dependency_group),
-                                ),
-                            );
-                            Global::crash();
-                        };
+/// Edits `json.root` in place (`bun publish` sends that tree to the registry) and returns it printed.
+/// `workspace_manifests` is `Some` whenever `needs_workspace_manifests(json.root)` is.
+fn edit_root_package_json(
+    workspace_manifests: Option<&WorkspaceManifests>,
+    json: &mut WorkspacePackageJSONCache::MapEntry,
+) -> Result<Box<[u8]>, AllocError> {
+    let bump = pack_bump();
+    for_each_dependency(json.root, |dependency_group, dependency| {
+        let (Some(name), Some(spec)) = (dependency.key.as_ref(), dependency.value.as_ref()) else {
+            return;
+        };
+        let Some(substitution) = spec
+            .as_utf8_string_literal()
+            .and_then(Substitution::for_spec)
+        else {
+            return;
+        };
+        let Some(dependency_name) = name.as_utf8_string_literal() else {
+            Output::err_generic(
+                "expected string value for dependency name in \"{}\"",
+                format_args!("{}", bstr::BStr::new(dependency_group)),
+            );
+            Global::crash();
+        };
+        let manifests =
+            || workspace_manifests.expect("pack() loads the manifests when a spec needs them");
+        let fail = |what: &str, why: fmt::Arguments<'_>| -> ! {
+            Output::err_generic(
+                "Failed to resolve {} version for \"{}\" in `{}` ({}).",
+                (
+                    what,
+                    bstr::BStr::new(dependency_name),
+                    bstr::BStr::new(dependency_group),
+                    why,
+                ),
+            );
+            Global::crash();
+        };
 
-                        let literal =
-                            pack_bump().alloc_slice_copy(dep.version.literal.slice(map_buf));
-                        dependency.value =
-                            Some(Expr::init(E::EString::init(literal), Default::default()));
-                    }
+        // `E::EString::init` keeps a pointer to the bytes, so they go into the pack arena.
+        let replacement: &[u8] = match substitution {
+            Substitution::WorkspaceRange(range) => bump.alloc_slice_copy(range),
+            Substitution::WorkspaceVersion { prefix } => {
+                let Some(version) = manifests().workspace_version(dependency_name) else {
+                    fail(
+                        "workspace",
+                        format_args!(
+                            "\"{}\" has no workspace named \"{}\", or its package.json has no version",
+                            bstr::BStr::new(manifests().root_package_json_path()),
+                            bstr::BStr::new(dependency_name),
+                        ),
+                    )
+                };
+                bump.alloc_slice_copy(format!("{prefix}{version}").as_bytes())
+            }
+            Substitution::Catalog { catalog_name } => {
+                match manifests().catalog_version(catalog_name, dependency_name) {
+                    Some(version) => bump.alloc_slice_copy(version),
+                    None => fail("catalog", format_args!("no matching catalog dependency")),
                 }
             }
-        }
-    }
+        };
+        dependency.value = Some(Expr::init(
+            E::EString::init(replacement),
+            Default::default(),
+        ));
+    });
 
     let has_trailing_newline = !json.source.contents.is_empty()
         && json.source.contents[json.source.contents.len() - 1] == b'\n';
diff --git a/src/runtime/cli/publish_command.rs b/src/runtime/cli/publish_command.rs
index 9cfa7d0ad175..35fabf99280a 100644
--- a/src/runtime/cli/publish_command.rs
+++ b/src/runtime/cli/publish_command.rs
@@ -11,8 +11,7 @@ use bun_core::{Environment, Global, Output};
 use bun_core::{ZStr, strings};
 use bun_dotenv as dotenv;
 use bun_http as http;
-use bun_install::lockfile::{LoadResult, LoadStep};
-use bun_install::{self as install, Lockfile, Npm, PackageManager, Subcommand};
+use bun_install::{self as install, Npm, PackageManager, Subcommand};
 use bun_libarchive::lib::{Archive, ArchiveIterator, IteratorResult as ArchiveIterResult};
 use bun_parsers::json as json_mod;
 use bun_paths::resolve_path::{join_abs_string_buf_checked, normalize_buf_spill, normalize_buf_z_spill};
@@ -439,64 +438,14 @@ impl<'a, const DIRECTORY_PUBLISH: bool> Context<'a, DIRECTORY_PUBLISH> {
         manager: &'a mut PackageManager,
         original_cwd: &[u8],
     ) -> Result<Context<'static, true>, FromWorkspaceError> {
-        let mut lockfile = Lockfile::default();
-        let manager_ptr: *mut PackageManager = manager;
-        let log: &mut bun_ast::Log = manager.log_mut();
-        // SAFETY: `manager_ptr` was just derived from `manager: &'a mut PackageManager`;
-        // `log` borrows the disjoint `.log` field, so the re-derived `&mut`
-        // never touches memory the live `log` borrow covers.
-        let load_from_disk_result =
-            lockfile.load_from_cwd::<false>(Some(unsafe { &mut *manager_ptr }), log);
-
-        let lockfile_ref: Option<&Lockfile> = match load_from_disk_result {
-            LoadResult::Ok(ok) => Some(&*ok.lockfile),
-            LoadResult::NotFound => None,
-            LoadResult::Err(cause) => 'err: {
-                match cause.step {
-                    LoadStep::OpenFile => {
-                        if cause.value == bun_install::Error::Sys(bun_errno::SystemErrno::ENOENT) {
-                            break 'err None;
-                        }
-                        Output::err_generic("failed to open lockfile: {}", (cause.value.name(),));
-                    }
-                    LoadStep::ParseFile => {
-                        Output::err_generic("failed to parse lockfile: {}", (cause.value.name(),));
-                    }
-                    LoadStep::ReadFile => {
-                        Output::err_generic("failed to read lockfile: {}", (cause.value.name(),));
-                    }
-                    LoadStep::Migrating => {
-                        Output::err_generic(
-                            "failed to migrate lockfile: {}",
-                            (cause.value.name(),),
-                        );
-                    }
-                }
-
-                if log.has_errors() {
-                    let _ = log.print(std::ptr::from_mut(Output::error_writer()));
-                }
-
-                Global::crash();
-            }
-        };
-
         // Note: capture the package.json path before constructing
         // `pack::Context` so the `&mut PackageManager` borrow doesn't conflict.
-        // SAFETY: `manager_ptr` came from `&'a mut PackageManager`.
-        let abs_pkg_json = bun_core::ZBox::from_bytes(
-            unsafe { &*manager_ptr }
-                .original_package_json_path
-                .as_bytes(),
-        );
+        let abs_pkg_json =
+            bun_core::ZBox::from_bytes(manager.original_package_json_path.as_bytes());
 
         let mut pack_ctx = pack::Context {
-            // SAFETY: `manager_ptr` came from `&'a mut PackageManager`;
-            // `lockfile_ref` borrows the local `lockfile`, not the manager,
-            // so the re-derived `&mut` is the only live manager borrow.
-            manager: unsafe { &mut *manager_ptr },
+            manager,
             command_ctx: ctx,
-            lockfile: lockfile_ref,
             original_cwd,
             bundled_deps: Vec::new(),
             stats: pack::Stats::default(),
diff --git a/test/cli/install/bun-pack.test.ts b/test/cli/install/bun-pack.test.ts
index 6fd0bace3634..0704578e6f64 100644
--- a/test/cli/install/bun-pack.test.ts
+++ b/test/cli/install/bun-pack.test.ts
@@ -1111,12 +1111,12 @@ describe("workspaces", () => {
     });
   }
 
-  test("fails gracefully when workspace version fails to resolve", async () => {
+  test("resolves workspace:* from the workspace's package.json without a lockfile", async () => {
     await Promise.all([
       write(
         join(packageDir, "package.json"),
         JSON.stringify({
-          name: "pack-workspace-protocol-fail",
+          name: "pack-workspace-protocol-no-lockfile",
           version: "2.2.3",
           workspaces: ["pkgs/*"],
           dependencies: {
@@ -1128,19 +1128,278 @@ describe("workspaces", () => {
       write(join(packageDir, "pkgs", "pkg1", "package.json"), JSON.stringify({ name: "pkg1", version: "1.1.1" })),
     ]);
 
-    const { err } = await packExpectError(packageDir, bunEnv);
-    expect(err).toContain(
-      'error: Failed to resolve workspace version for "pkg1" in `dependencies`. Run `bun install` and try again.',
-    );
-
-    await runBunInstall(bunEnv, packageDir);
     await pack(packageDir, bunEnv);
-    const tarball = readTarball(join(packageDir, "pack-workspace-protocol-fail-2.2.3.tgz"));
+
+    const tarball = readTarball(join(packageDir, "pack-workspace-protocol-no-lockfile-2.2.3.tgz"));
     expect(tarball.entries).toMatchObject([
       { "pathname": "package/package.json" },
       { "pathname": "package/pkgs/pkg1/package.json" },
       { "pathname": "package/root.js" },
     ]);
+    expect(JSON.parse(tarball.entries[0].contents).dependencies).toEqual({ "pkg1": "1.1.1" });
+  });
+
+  test("fails when no workspace with a version matches a workspace:* dependency", async () => {
+    await Promise.all([
+      write(join(packageDir, "package.json"), JSON.stringify({ name: "root", workspaces: ["pkgs/*"] })),
+      write(join(packageDir, "pkgs", "unversioned", "package.json"), JSON.stringify({ name: "unversioned" })),
+      write(
+        join(packageDir, "pkgs", "app1", "package.json"),
+        JSON.stringify({ name: "app1", version: "1.0.0", dependencies: { "not-a-workspace": "workspace:*" } }),
+      ),
+      write(
+        join(packageDir, "pkgs", "app2", "package.json"),
+        JSON.stringify({ name: "app2", version: "1.0.0", devDependencies: { "unversioned": "workspace:^" } }),
+      ),
+    ]);
+
+    const app1 = await packExpectError(join(packageDir, "pkgs", "app1"), bunEnv);
+    expect(app1.err).toContain('error: Failed to resolve workspace version for "not-a-workspace" in `dependencies` (');
+    expect(app1.err).toContain(
+      'package.json" has no workspace named "not-a-workspace", or its package.json has no version).',
+    );
+    expect(await exists(join(packageDir, "pkgs", "app1", "app1-1.0.0.tgz"))).toBeFalse();
+
+    const app2 = await packExpectError(join(packageDir, "pkgs", "app2"), bunEnv);
+    expect(app2.err).toContain('error: Failed to resolve workspace version for "unversioned" in `devDependencies` (');
+    expect(app2.err).toContain(
+      'package.json" has no workspace named "unversioned", or its package.json has no version).',
+    );
+    expect(await exists(join(packageDir, "pkgs", "app2", "app2-1.0.0.tgz"))).toBeFalse();
+  });
+
+  // https://github.com/oven-sh/bun/issues/20477: a release bumps versions (`bun pm version`,
+  // changesets) after the last `bun install`, so bun.lock still has the versions from before
+  // the bump when the packages get packed and published.
+  test("uses the versions and catalogs in the package.json files, not the ones in bun.lock", async () => {
+    const rootPackageJson = (react: string) =>
+      JSON.stringify({
+        name: "mono",
+        private: true,
+        workspaces: { packages: ["packages/*"], catalog: { react } },
+      });
+    const corePackageJson = (version: string) => JSON.stringify({ name: "@acme/core", version });
+    const utilsPackageJson = (version: string) =>
+      JSON.stringify({
+        name: "@acme/utils",
+        version,
+        dependencies: { "@acme/core": "workspace:*" },
+        devDependencies: { "@acme/core": "workspace:~" },
+        peerDependencies: { "@acme/core": "workspace:^", "react": "catalog:" },
+        // optional so that `bun install` does not need a registry to install react
+        peerDependenciesMeta: { react: { optional: true } },
+      });
+    const coreDir = join(packageDir, "packages", "core");
+    const utilsDir = join(packageDir, "packages", "utils");
+
+    await Promise.all([
+      write(join(packageDir, "package.json"), rootPackageJson("^18.3.1")),
+      write(join(coreDir, "package.json"), corePackageJson("1.2.3")),
+      write(join(utilsDir, "package.json"), utilsPackageJson("0.4.0")),
+    ]);
+    await runBunInstall(bunEnv, packageDir);
+
+    await Promise.all([
+      write(join(packageDir, "package.json"), rootPackageJson("^19.1.0")),
+      write(join(coreDir, "package.json"), corePackageJson("1.3.0")),
+      write(join(utilsDir, "package.json"), utilsPackageJson("0.4.1")),
+    ]);
+    const lockfile = await file(join(packageDir, "bun.lock")).text();
+    expect(lockfile).toContain('"version": "1.2.3"');
+    expect(lockfile).toContain('"react": "^18.3.1"');
+
+    await pack(utilsDir, bunEnv);
+
+    const tarball = readTarball(join(utilsDir, "acme-utils-0.4.1.tgz"));
+    expect(JSON.parse(tarball.entries[0].contents)).toEqual({
+      name: "@acme/utils",
+      version: "0.4.1",
+      dependencies: { "@acme/core": "1.3.0" },
+      devDependencies: { "@acme/core": "~1.3.0" },
+      peerDependencies: { "@acme/core": "^1.3.0", "react": "^19.1.0" },
+      peerDependenciesMeta: { react: { optional: true } },
+    });
+  });
+
+  test("packing the workspace root uses the versions in the workspaces' package.json files", async () => {
+    await Promise.all([
+      write(
+        join(packageDir, "package.json"),
+        JSON.stringify({
+          name: "pack-workspace-root",
+          version: "2.0.0",
+          workspaces: ["pkgs/*"],
+          dependencies: { "pkg1": "workspace:*" },
+        }),
+      ),
+      write(join(packageDir, "pkgs", "pkg1", "package.json"), JSON.stringify({ name: "pkg1", version: "1.1.1" })),
+    ]);
+    await runBunInstall(bunEnv, packageDir);
+    await write(join(packageDir, "pkgs", "pkg1", "package.json"), JSON.stringify({ name: "pkg1", version: "1.2.0" }));
+
+    await pack(packageDir, bunEnv);
+
+    const tarball = readTarball(join(packageDir, "pack-workspace-root-2.0.0.tgz"));
+    expect(JSON.parse(tarball.entries[0].contents).dependencies).toEqual({ "pkg1": "1.2.0" });
+  });
+
+  test("sees the versions a prepack script writes to other workspaces", async () => {
+    const pkg1PackageJson = join(packageDir, "pkgs", "pkg1", "package.json");
+    await Promise.all([
+      write(join(packageDir, "package.json"), JSON.stringify({ name: "root", workspaces: ["pkgs/*"] })),
+      write(pkg1PackageJson, JSON.stringify({ name: "pkg1", version: "1.0.0" })),
+      write(
+        join(packageDir, "pkgs", "app", "package.json"),
+        JSON.stringify({
+          name: "app",
+          version: "1.0.0",
+          scripts: { prepack: `${bunExe()} bump-pkg1.js` },
+          dependencies: { "pkg1": "workspace:*" },
+        }),
+      ),
+      write(
+        join(packageDir, "pkgs", "app", "bump-pkg1.js"),
+        `require("fs").writeFileSync(${JSON.stringify(pkg1PackageJson)}, JSON.stringify({ name: "pkg1", version: "2.0.0" }));`,
+      ),
+    ]);
+    await runBunInstall(bunEnv, packageDir);
+
+    await pack(join(packageDir, "pkgs", "app"), bunEnv);
+
+    const tarball = readTarball(join(packageDir, "pkgs", "app", "app-1.0.0.tgz"));
+    expect(JSON.parse(tarball.entries[0].contents).dependencies).toEqual({ "pkg1": "2.0.0" });
+  });
+
+  // pack does not read the lockfile, so a lockfile that would not parse (mid-rebase, truncated) does
+  // not get in the way, whether or not the package has specs to resolve.
+  const unreadableLockfiles = [
+    { label: "an empty bun.lock", file: "bun.lock", contents: "" },
+    {
+      label: "a bun.lock with git conflict markers",
+      file: "bun.lock",
+      contents: `{
+  "lockfileVersion": 1,
+  "workspaces": {
+    "": {
+      "name": "root",
+<<<<<<< HEAD
+      "dependencies": {},
+=======
+      "devDependencies": {},
+>>>>>>> feature
+    },
+  },
+  "packages": {},
+}
+`,
+    },
+    { label: "a corrupt bun.lockb", file: "bun.lockb", contents: "not a lockfile" },
+  ];
+
+  for (const { label, file: lockfile, contents } of unreadableLockfiles) {
+    test(`packs a package without workspace specs next to ${label}`, async () => {
+      await Promise.all([
+        write(join(packageDir, "package.json"), JSON.stringify({ name: "pack-bad-lockfile", version: "1.0.0" })),
+        write(join(packageDir, "index.js"), "module.exports = 1"),
+        write(join(packageDir, lockfile), contents),
+      ]);
+
+      const { err } = await pack(packageDir, bunEnv);
+      expect(err).toBe("");
+
+      const tarball = readTarball(join(packageDir, "pack-bad-lockfile-1.0.0.tgz"));
+      expect(tarball.entries).toMatchObject([
+        { "pathname": "package/package.json" },
+        { "pathname": "package/index.js" },
+      ]);
+    });
+
+    test(`resolves workspace:* next to ${label}`, async () => {
+      await Promise.all([
+        write(join(packageDir, "package.json"), JSON.stringify({ name: "root", workspaces: ["pkgs/*"] })),
+        write(join(packageDir, "pkgs", "pkg1", "package.json"), JSON.stringify({ name: "pkg1", version: "1.1.1" })),
+        write(
+          join(packageDir, "pkgs", "app", "package.json"),
+          JSON.stringify({ name: "app", version: "1.0.0", dependencies: { "pkg1": "workspace:*" } }),
+        ),
+        write(join(packageDir, lockfile), contents),
+      ]);
+
+      const { err } = await pack(join(packageDir, "pkgs", "app"), bunEnv);
+      expect(err).toBe("");
+
+      const tarball = readTarball(join(packageDir, "pkgs", "app", "app-1.0.0.tgz"));
+      expect(JSON.parse(tarball.entries[0].contents).dependencies).toEqual({ "pkg1": "1.1.1" });
+    });
+  }
+
+  // Only the root's `workspaces` and catalogs are read to resolve a spec. Its own dependency sections
+  // are `bun install`'s business: a `workspace:<range>` there is packed as written (see the table
+  // above) and does not have to match the workspace, whether the root or a member is being packed.
+  describe("a workspace: range in the root that no workspace satisfies", () => {
+    beforeEach(async () => {
+      await Promise.all([
+        write(
+          join(packageDir, "package.json"),
+          JSON.stringify({
+            name: "root",
+            version: "1.0.0",
+            workspaces: ["pkgs/*"],
+            dependencies: { "pkg1": "workspace:9.9.9", "pkg2": "workspace:*" },
+          }),
+        ),
+        write(join(packageDir, "pkgs", "pkg1", "package.json"), JSON.stringify({ name: "pkg1", version: "1.0.1" })),
+        write(join(packageDir, "pkgs", "pkg2", "package.json"), JSON.stringify({ name: "pkg2", version: "2.0.0" })),
+        write(
+          join(packageDir, "pkgs", "app", "package.json"),
+          JSON.stringify({ name: "app", version: "1.0.0", dependencies: { "pkg2": "workspace:^" } }),
+        ),
+      ]);
+    });
+
+    test("packing the root", async () => {
+      await pack(packageDir, bunEnv);
+
+      const tarball = readTarball(join(packageDir, "root-1.0.0.tgz"));
+      expect(JSON.parse(tarball.entries[0].contents).dependencies).toEqual({ "pkg1": "9.9.9", "pkg2": "2.0.0" });
+    });
+
+    test("packing a member", async () => {
+      await pack(join(packageDir, "pkgs", "app"), bunEnv);
+
+      const tarball = readTarball(join(packageDir, "pkgs", "app", "app-1.0.0.tgz"));
+      expect(JSON.parse(tarball.entries[0].contents).dependencies).toEqual({ "pkg2": "^2.0.0" });
+    });
+  });
+
+  describe("a workspaces entry that does not exist", () => {
+    beforeEach(async () => {
+      await Promise.all([
+        write(
+          join(packageDir, "package.json"),
+          JSON.stringify({ name: "root", workspaces: ["pkgs/pkg1", "pkgs/app", "pkgs/plain", "pkgs/missing"] }),
+        ),
+        write(join(packageDir, "pkgs", "pkg1", "package.json"), JSON.stringify({ name: "pkg1", version: "1.0.0" })),
+        write(
+          join(packageDir, "pkgs", "app", "package.json"),
+          JSON.stringify({ name: "app", version: "1.0.0", dependencies: { "pkg1": "workspace:*" } }),
+        ),
+        write(join(packageDir, "pkgs", "plain", "package.json"), JSON.stringify({ name: "plain", version: "1.0.0" })),
+      ]);
+    });
+
+    test("fails a pack that has to resolve a workspace: spec, with bun install's error", async () => {
+      const { err } = await packExpectError(join(packageDir, "pkgs", "app"), bunEnv);
+      expect(err).toContain('error: Workspace not found "pkgs/missing"');
+      expect(err).toContain("package.json:1:");
+      expect(await exists(join(packageDir, "pkgs", "app", "app-1.0.0.tgz"))).toBeFalse();
+    });
+
+    test("does not affect a pack that has nothing to resolve", async () => {
+      const { err } = await pack(join(packageDir, "pkgs", "plain"), bunEnv);
+      expect(err).toBe("");
+      expect(await exists(join(packageDir, "pkgs", "plain", "plain-1.0.0.tgz"))).toBeTrue();
+    });
   });
 });
 
diff --git a/test/cli/install/bun-publish.test.ts b/test/cli/install/bun-publish.test.ts
index 346e5f144c00..ad4157026bbf 100644
--- a/test/cli/install/bun-publish.test.ts
+++ b/test/cli/install/bun-publish.test.ts
@@ -851,6 +851,114 @@ test("can publish workspace package", async () => {
   expect(await file(join(packageDir, "node_modules", "publish-pkg-3", "package.json")).json()).toEqual(pkgJson);
 });
 
+// https://github.com/oven-sh/bun/issues/20477: releases bump the versions after the last `bun install`,
+// so the manifest sent to the registry has to use the package.json files, not bun.lock.
+test("publishes the workspace versions and catalog ranges currently in package.json", async () => {
+  let captured: any = null;
+  using mock = Bun.serve({
+    port: 0,
+    async fetch(req) {
+      if (req.method === "PUT") captured = await req.json();
+      return new Response("OK", { status: 200 });
+    },
+  });
+
+  const packageDir = tmpdirSync();
+  const coreDir = join(packageDir, "packages", "core");
+  const utilsDir = join(packageDir, "packages", "utils");
+  const rootPackageJson = (react: string) =>
+    JSON.stringify({ name: "mono", private: true, workspaces: { packages: ["packages/*"], catalog: { react } } });
+  const corePackageJson = (version: string) => JSON.stringify({ name: "@acme/core", version });
+  const utilsPackageJson = (version: string) =>
+    JSON.stringify({
+      name: "@acme/utils",
+      version,
+      dependencies: { "@acme/core": "workspace:*" },
+      peerDependencies: { "@acme/core": "workspace:^", "react": "catalog:" },
+      // optional so that `bun install` does not ask the mock registry for react
+      peerDependenciesMeta: { react: { optional: true } },
+    });
+
+  await Promise.all([
+    write(
+      join(packageDir, "bunfig.toml"),
+      Bun.TOML.stringify({
+        install: {
+          cache: false,
+          registry: { url: `http://localhost:${mock.port}`, token: "unused" },
+        },
+      }),
+    ),
+    write(join(packageDir, "package.json"), rootPackageJson("^18.3.1")),
+    write(join(coreDir, "package.json"), corePackageJson("1.2.3")),
+    write(join(utilsDir, "package.json"), utilsPackageJson("0.4.0")),
+  ]);
+  await runBunInstall(env, packageDir);
+
+  // the release bump, without another install
+  await Promise.all([
+    write(join(packageDir, "package.json"), rootPackageJson("^19.1.0")),
+    write(join(coreDir, "package.json"), corePackageJson("1.3.0")),
+    write(join(utilsDir, "package.json"), utilsPackageJson("0.4.1")),
+  ]);
+
+  const { err, exitCode } = await publish(env, utilsDir);
+  expect(err).not.toContain("error:");
+  expect(exitCode).toBe(0);
+
+  expect(captured.versions["0.4.1"]).toMatchObject({
+    name: "@acme/utils",
+    version: "0.4.1",
+    dependencies: { "@acme/core": "1.3.0" },
+    peerDependencies: { "@acme/core": "^1.3.0", "react": "^19.1.0" },
+  });
+});
+
+test("publishes a workspace package next to a bun.lock that does not parse", async () => {
+  let captured: any = null;
+  using mock = Bun.serve({
+    port: 0,
+    async fetch(req) {
+      if (req.method === "PUT") captured = await req.json();
+      return new Response("OK", { status: 200 });
+    },
+  });
+
+  const packageDir = tmpdirSync();
+  const utilsDir = join(packageDir, "packages", "utils");
+  await Promise.all([
+    write(
+      join(packageDir, "bunfig.toml"),
+      Bun.TOML.stringify({
+        install: { registry: { url: `http://localhost:${mock.port}`, token: "unused" } },
+      }),
+    ),
+    write(
+      join(packageDir, "package.json"),
+      JSON.stringify({ name: "mono", private: true, workspaces: ["packages/*"] }),
+    ),
+    write(join(packageDir, "bun.lock"), "<<<<<<< HEAD\n"),
+    write(
+      join(packageDir, "packages", "core", "package.json"),
+      JSON.stringify({ name: "@acme/core", version: "1.3.0" }),
+    ),
+    write(
+      join(utilsDir, "package.json"),
+      JSON.stringify({ name: "@acme/utils", version: "0.4.1", dependencies: { "@acme/core": "workspace:^" } }),
+    ),
+  ]);
+
+  const { err, exitCode } = await publish(env, utilsDir);
+  expect(err).toBe("");
+  expect(exitCode).toBe(0);
+
+  expect(captured.versions["0.4.1"]).toMatchObject({
+    name: "@acme/utils",
+    version: "0.4.1",
+    dependencies: { "@acme/core": "^1.3.0" },
+  });
+});
+
 describe("--dry-run", async () => {
   test("does not publish", async () => {
     const { packageDir, packageJson } = await registry.createTestDir();
diff --git a/test/cli/install/catalogs.test.ts b/test/cli/install/catalogs.test.ts
index f548c2a57f39..f3373b5734c8 100644
--- a/test/cli/install/catalogs.test.ts
+++ b/test/cli/install/catalogs.test.ts
@@ -1913,11 +1913,64 @@ describe("peer dependencies", () => {
     });
   });
 
-  // package.json is edited after the install so bun.lock's catalogs are the ones that lack the entry.
+  // The root catalog is the one in package.json right now, not the one bun.lock recorded at the last install.
+  test.concurrent("bun pm pack substitutes the catalog range edited into package.json after the install", async () => {
+    const dir = await makeRepo({
+      catalog: { "no-deps": "^1.0.0" },
+      peerSpec: "catalog:",
+      libVersion: "1.2.3",
+      linker: "hoisted",
+    });
+    await install(dir, "hoisted");
+    await rewriteRootPackageJson(dir, { catalog: { "no-deps": "^2.0.0" } });
+    expect(await Bun.file(join(dir, "bun.lock")).text()).toContain('"no-deps": "^1.0.0"');
+
+    const libDir = join(dir, "packages", "lib");
+    await pack(libDir, bunEnv);
+    const tarball = readTarball(join(libDir, "lib-1.2.3.tgz"));
+    const packageJson = tarball.entries.find(
+      (entry: { pathname: string }) => entry.pathname === "package/package.json",
+    );
+    expect(JSON.parse(packageJson.contents)).toStrictEqual({
+      name: "lib",
+      version: "1.2.3",
+      peerDependencies: { "no-deps": "^2.0.0" },
+    });
+  });
+
+  // The catalog parse logs this error and skips the entry; pack reports it like `bun install` does
+  // instead of complaining that the entry is missing.
+  test.concurrent("bun pm pack reports an invalid catalog range at its definition", async () => {
+    const dir = await makeRepo({
+      catalog: { "no-deps": ".:" },
+      peerSpec: "catalog:",
+      libVersion: "1.2.3",
+      linker: "hoisted",
+    });
+    const libDir = join(dir, "packages", "lib");
+
+    await using proc = spawn({
+      cmd: [bunExe(), "pm", "pack"],
+      cwd: libDir,
+      env: bunEnv,
+      stdout: "pipe",
+      stderr: "pipe",
+    });
+    const [out, err, exitCode] = await Promise.all([proc.stdout.text(), proc.stderr.text(), proc.exited]);
+    const normalizedErr = normalizeBunSnapshot(err, dir);
+    expect(normalizedErr).toContain("error: Invalid dependency version\n");
+    expect(normalizedErr).toContain("at <dir>/package.json:");
+    expect(normalizedErr).not.toContain("no matching catalog dependency");
+    expect(normalizeBunSnapshot(out, dir)).toBe("bun pack <version> (<revision>)");
+    expect(exitCode).toBe(1);
+    expect(existsSync(join(libDir, "lib-1.2.3.tgz"))).toBeFalse();
+  });
+
+  // lib's package.json is edited after the install; the root catalog never had these entries.
   describe.each([
     ["a-dep", "catalog:"],
     ["no-deps", "catalog:missing"],
-  ] as const)("bun pm pack with a %s peer of %s missing from the lockfile's catalogs", (peerName, peerSpec) => {
+  ] as const)("bun pm pack with a %s peer of %s missing from the catalogs", (peerName, peerSpec) => {
     test.concurrent("fails without writing a tarball", async () => {
       const dir = await makeRepo({
         catalog: { "no-deps": ">=1.0.0" },

From 9cd2ed680b95d7ef07f17257c41d2dcb4e43178c Mon Sep 17 00:00:00 2001
From: robobun <117481402+robobun@users.noreply.github.com>
Date: Mon, 17 Aug 2026 02:53:12 +0000
Subject: [PATCH 161/258] pack: publish workspace: directory dependencies as
 the workspace's version (#38835)

---
 docs/pm/workspaces.mdx                        |   7 +
 .../PackageManager/workspace_manifests.rs     |  49 ++++-
 src/runtime/cli/pack_command.rs               |  64 +++++-
 test/cli/install/bun-pack.test.ts             | 192 ++++++++++++++++++
 test/cli/install/bun-publish.test.ts          |  53 +++++
 5 files changed, 354 insertions(+), 11 deletions(-)

diff --git a/docs/pm/workspaces.mdx b/docs/pm/workspaces.mdx
index e60a963e1bee..2761a4fe3730 100644
--- a/docs/pm/workspaces.mdx
+++ b/docs/pm/workspaces.mdx
@@ -92,6 +92,13 @@ A specific version takes precedence over the package's `package.json` version:
 "workspace:1.0.2" -> "1.0.2" // Even if current version is 1.0.1
 ```
 
+You can also reference a workspace package by the path of its directory. The path is relative to the `package.json` that declares the dependency. Bun publishes the version of the package in that directory. When the dependency name differs from the package name, Bun publishes an `npm:` alias:
+
+```
+"pkg-b": "workspace:../pkg-b" -> "pkg-b": "1.0.1"
+"b": "workspace:../pkg-b"     -> "b": "npm:pkg-b@1.0.1"
+```
+
 Workspaces have a few major benefits.
 
 - **Split code into logical parts.** If one package relies on another, add it as a dependency in `package.json`. If package `b` depends on `a`, `bun install` installs your local `packages/a` directory into `node_modules` instead of downloading it from the npm registry.
diff --git a/src/install/PackageManager/workspace_manifests.rs b/src/install/PackageManager/workspace_manifests.rs
index a459b638a2aa..ae707f3721cc 100644
--- a/src/install/PackageManager/workspace_manifests.rs
+++ b/src/install/PackageManager/workspace_manifests.rs
@@ -3,9 +3,11 @@ use core::fmt;
 use bstr::BStr;
 use bun_collections::HashMap;
 use bun_core::{Global, Output};
+use bun_paths::{platform, resolve_path};
+use bun_resolver::fs::FileSystem;
 
 use crate::dependency::{Behavior, Tag as DependencyTag};
-use crate::lockfile::{Lockfile, Package};
+use crate::lockfile::{DependencySlice, Lockfile, Package};
 use crate::{Features, PackageNameHash};
 
 use super::PackageManager;
@@ -97,6 +99,8 @@ impl ScratchManifests {
 /// and releases bump versions between that install and the publish.
 pub struct WorkspaceManifests {
     lockfile: Lockfile,
+    /// Has a `Behavior::WORKSPACE` entry per workspace: its name and root-relative directory.
+    root_dependencies: DependencySlice,
     root_package_json_path: Box<[u8]>,
 }
 
@@ -123,10 +127,53 @@ impl WorkspaceManifests {
         }
         WorkspaceManifests {
             lockfile: scratch.lockfile,
+            root_dependencies: scratch.root.dependencies,
             root_package_json_path: root_package_json_path(),
         }
     }
 
+    /// Whether `name` is one of the workspaces (the root package is not one).
+    pub fn has_workspace(&self, name: &[u8]) -> bool {
+        let name_hash: PackageNameHash = bun_semver::string::Builder::string_hash(name);
+        self.lockfile.workspace_paths.contains(&name_hash)
+    }
+
+    /// The workspace `workspace:<path>` in `package_dir` links, per `Package::parse_dependency`.
+    pub fn workspace_name_at_path(&self, package_dir: &[u8], path: &[u8]) -> Option<&[u8]> {
+        // Joined as a path, `workspace:` alone would name `package_dir` itself.
+        if path.is_empty() {
+            return None;
+        }
+        let top_level_dir = FileSystem::get().top_level_dir();
+        let mut directory_buf = bun_paths::path_buffer_pool::get();
+        let directory = resolve_path::join_abs_string_buf_checked::<platform::Auto>(
+            top_level_dir,
+            &mut directory_buf[..],
+            &[package_dir, path],
+        )?;
+        let relative_directory: &[u8] = resolve_path::relative(top_level_dir, directory);
+        // The workspaces' directories are stored with `/` separators on every platform.
+        #[cfg(windows)]
+        let mut posix_buf = bun_paths::path_buffer_pool::get();
+        #[cfg(windows)]
+        let relative_directory: &[u8] = {
+            let len = relative_directory.len();
+            posix_buf[..len].copy_from_slice(relative_directory);
+            bun_paths::dangerously_convert_path_to_posix_in_place::<u8>(&mut posix_buf[..len]);
+            &posix_buf[..len]
+        };
+
+        let string_buf = self.lockfile.buffers.string_bytes.as_slice();
+        self.root_dependencies
+            .get(self.lockfile.buffers.dependencies.as_slice())
+            .iter()
+            .find(|dependency| {
+                dependency.behavior.is_workspace()
+                    && dependency.version.workspace().slice(string_buf) == relative_directory
+            })
+            .map(|dependency| dependency.name.slice(string_buf))
+    }
+
     /// The package.json whose `workspaces` and catalogs these are: the workspace root's when the
     /// package being packed is one of its workspaces, otherwise the package's own.
     pub fn root_package_json_path(&self) -> &[u8] {
diff --git a/src/runtime/cli/pack_command.rs b/src/runtime/cli/pack_command.rs
index a1060fc64aab..d280438af20b 100644
--- a/src/runtime/cli/pack_command.rs
+++ b/src/runtime/cli/pack_command.rs
@@ -2135,7 +2135,8 @@ pub(crate) fn pack<const FOR_PUBLISH: bool>(
         // Loading added the other workspaces' package.json files to the cache `json` points into.
         json = package_json_entry(manager_ptr, abs_package_json_path);
     }
-    let edited_package_json = edit_root_package_json(workspace_manifests.as_ref(), json)?;
+    let edited_package_json =
+        edit_root_package_json(workspace_manifests.as_ref(), abs_workspace_path, json)?;
 
     let root_dir: Dir = 'root_dir: {
         let mut path_buf = PathBuffer::uninit();
@@ -3206,8 +3207,8 @@ fn add_archive_entry(
 enum Substitution<'a> {
     /// `workspace:^`, `workspace:~`, `workspace:*`: the workspace's current version behind that prefix.
     WorkspaceVersion { prefix: &'static str },
-    /// `workspace:1.2.3`, `workspace:1.x`, ...: the range as written.
-    WorkspaceRange(&'a [u8]),
+    /// `workspace:1.x` on a dependency that is a workspace, or a directory, `workspace:../core`.
+    WorkspaceRangeOrDirectory(&'a [u8]),
     /// `catalog:` / `catalog:<name>`: that catalog's entry for the dependency.
     Catalog { catalog_name: &'a [u8] },
 }
@@ -3219,7 +3220,7 @@ impl<'a> Substitution<'a> {
                 b"^" => Substitution::WorkspaceVersion { prefix: "^" },
                 b"~" => Substitution::WorkspaceVersion { prefix: "~" },
                 b"*" => Substitution::WorkspaceVersion { prefix: "" },
-                _ => Substitution::WorkspaceRange(range),
+                _ => Substitution::WorkspaceRangeOrDirectory(range),
             });
         }
         let catalog_name = strings::without_prefix_if_possible_comptime(spec, b"catalog:")?;
@@ -3227,10 +3228,6 @@ impl<'a> Substitution<'a> {
             catalog_name: strings::trim(catalog_name, &strings::WHITESPACE_CHARS),
         })
     }
-
-    fn needs_workspace_manifests(&self) -> bool {
-        !matches!(self, Substitution::WorkspaceRange(_))
-    }
 }
 
 /// Section order is the order errors get reported in.
@@ -3266,15 +3263,52 @@ fn needs_workspace_manifests(package_json: Expr) -> bool {
             .as_ref()
             .and_then(Expr::as_utf8_string_literal)
             .and_then(Substitution::for_spec)
-            .is_some_and(|substitution| substitution.needs_workspace_manifests());
+            .is_some();
     });
     needed
 }
 
+/// Directory first: `"pkg1": "workspace:../pkg1"` reads both ways; only a directory has a version.
+fn publish_spec_for_workspace_range_or_directory(
+    manifests: &WorkspaceManifests,
+    package_dir: &[u8],
+    dependency_name: &[u8],
+    spec: &[u8],
+) -> Result<Vec<u8>, String> {
+    let Some(workspace_name) = manifests.workspace_name_at_path(package_dir, spec) else {
+        // `workspace:<name>@<range>` installs workspace `<name>` under `dependency_name`.
+        let is_alias = strings::last_index_of_char(spec, b'@')
+            .is_some_and(|at| at > 0 && manifests.has_workspace(&spec[..at]));
+        if manifests.has_workspace(dependency_name) || is_alias {
+            return Ok(spec.to_vec());
+        }
+        return Err(format!(
+            "\"{}\" has no workspace named \"{}\" and no workspace in the directory \"{}\"",
+            bstr::BStr::new(manifests.root_package_json_path()),
+            bstr::BStr::new(dependency_name),
+            bstr::BStr::new(spec),
+        ));
+    };
+    let Some(version) = manifests.workspace_version(workspace_name) else {
+        return Err(format!(
+            "the package.json of workspace \"{}\" in the directory \"{}\" has no version",
+            bstr::BStr::new(workspace_name),
+            bstr::BStr::new(spec),
+        ));
+    };
+    Ok(if workspace_name == dependency_name {
+        format!("{version}").into_bytes()
+    } else {
+        // What pnpm publishes too: the alias installs the workspace's package under this name.
+        format!("npm:{}@{version}", bstr::BStr::new(workspace_name)).into_bytes()
+    })
+}
+
 /// Edits `json.root` in place (`bun publish` sends that tree to the registry) and returns it printed.
 /// `workspace_manifests` is `Some` whenever `needs_workspace_manifests(json.root)` is.
 fn edit_root_package_json(
     workspace_manifests: Option<&WorkspaceManifests>,
+    package_dir: &[u8],
     json: &mut WorkspacePackageJSONCache::MapEntry,
 ) -> Result<Box<[u8]>, AllocError> {
     let bump = pack_bump();
@@ -3312,7 +3346,6 @@ fn edit_root_package_json(
 
         // `E::EString::init` keeps a pointer to the bytes, so they go into the pack arena.
         let replacement: &[u8] = match substitution {
-            Substitution::WorkspaceRange(range) => bump.alloc_slice_copy(range),
             Substitution::WorkspaceVersion { prefix } => {
                 let Some(version) = manifests().workspace_version(dependency_name) else {
                     fail(
@@ -3326,6 +3359,17 @@ fn edit_root_package_json(
                 };
                 bump.alloc_slice_copy(format!("{prefix}{version}").as_bytes())
             }
+            Substitution::WorkspaceRangeOrDirectory(spec) => {
+                match publish_spec_for_workspace_range_or_directory(
+                    manifests(),
+                    package_dir,
+                    dependency_name,
+                    spec,
+                ) {
+                    Ok(published) => bump.alloc_slice_copy(&published),
+                    Err(why) => fail("workspace", format_args!("{why}")),
+                }
+            }
             Substitution::Catalog { catalog_name } => {
                 match manifests().catalog_version(catalog_name, dependency_name) {
                     Some(version) => bump.alloc_slice_copy(version),
diff --git a/test/cli/install/bun-pack.test.ts b/test/cli/install/bun-pack.test.ts
index 0704578e6f64..bd648fe709c8 100644
--- a/test/cli/install/bun-pack.test.ts
+++ b/test/cli/install/bun-pack.test.ts
@@ -1401,6 +1401,198 @@ describe("workspaces", () => {
       expect(await exists(join(packageDir, "pkgs", "plain", "plain-1.0.0.tgz"))).toBeTrue();
     });
   });
+
+  // pkgs/ui depends on its sibling workspaces by directory (`workspace:../core`)
+  async function createDirectoryWorkspace(uiDependencies: Record<string, Record<string, string>>) {
+    await Promise.all([
+      write(
+        join(packageDir, "package.json"),
+        JSON.stringify({ name: "root", workspaces: ["pkgs/*", "pkgs/@scoped/*"] }),
+      ),
+      write(join(packageDir, "pkgs", "core", "package.json"), JSON.stringify({ name: "@acme/core", version: "1.2.3" })),
+      write(join(packageDir, "pkgs", "plain", "package.json"), JSON.stringify({ name: "plain", version: "0.5.0" })),
+      write(
+        join(packageDir, "pkgs", "@scoped", "thing", "package.json"),
+        JSON.stringify({ name: "thing", version: "0.0.7" }),
+      ),
+      write(
+        join(packageDir, "pkgs", "ui", "package.json"),
+        JSON.stringify({ name: "@acme/ui", version: "2.0.0", ...uiDependencies }),
+      ),
+    ]);
+  }
+
+  test("replaces workspace: directories with the version of the workspace in that directory", async () => {
+    await createDirectoryWorkspace({
+      dependencies: {
+        "core": "workspace:../core",
+        // declared under the workspace's own name, so no alias is needed
+        "@acme/core": "workspace:../core",
+        "core-dot": "workspace:./../core",
+        "core-slash": "workspace:../core/",
+        // the `@` in the directory does not make this `workspace:<name>@<range>`
+        "scoped-dir": "workspace:../@scoped/thing",
+        "self": "workspace:.",
+      },
+      devDependencies: {
+        "plain": "workspace:../plain",
+      },
+      peerDependencies: {
+        "plain-peer": "workspace:../plain",
+      },
+      optionalDependencies: {
+        "plain-optional": "workspace:../plain",
+      },
+    });
+    // every one of these is a spec `bun install` links
+    await runBunInstall(bunEnv, packageDir);
+
+    await pack(join(packageDir, "pkgs", "ui"), bunEnv);
+
+    const tarball = readTarball(join(packageDir, "pkgs", "ui", "acme-ui-2.0.0.tgz"));
+    expect(JSON.parse(tarball.entries[0].contents)).toEqual({
+      name: "@acme/ui",
+      version: "2.0.0",
+      dependencies: {
+        "core": "npm:@acme/core@1.2.3",
+        "@acme/core": "1.2.3",
+        "core-dot": "npm:@acme/core@1.2.3",
+        "core-slash": "npm:@acme/core@1.2.3",
+        "scoped-dir": "npm:thing@0.0.7",
+        "self": "npm:@acme/ui@2.0.0",
+      },
+      devDependencies: {
+        "plain": "0.5.0",
+      },
+      peerDependencies: {
+        "plain-peer": "npm:plain@0.5.0",
+      },
+      optionalDependencies: {
+        "plain-optional": "npm:plain@0.5.0",
+      },
+    });
+  });
+
+  test("replaces workspace: directories in the workspace root with the versions in the workspaces' package.json files", async () => {
+    await createDirectoryWorkspace({});
+    await write(
+      join(packageDir, "package.json"),
+      JSON.stringify({
+        name: "pack-workspace-root-directories",
+        version: "3.0.0",
+        workspaces: ["pkgs/*", "pkgs/@scoped/*"],
+        dependencies: {
+          "core": "workspace:pkgs/core",
+          "plain": "workspace:./pkgs/plain",
+        },
+      }),
+    );
+    await runBunInstall(bunEnv, packageDir);
+    // bumped after the install, so bun.lock still says 0.5.0
+    await write(join(packageDir, "pkgs", "plain", "package.json"), JSON.stringify({ name: "plain", version: "0.6.0" }));
+
+    await pack(packageDir, bunEnv);
+
+    const tarball = readTarball(join(packageDir, "pack-workspace-root-directories-3.0.0.tgz"));
+    expect(tarball.entries[0]).toMatchObject({ pathname: "package/package.json" });
+    expect(JSON.parse(tarball.entries[0].contents).dependencies).toEqual({
+      "core": "npm:@acme/core@1.2.3",
+      "plain": "0.6.0",
+    });
+  });
+
+  test("replaces a workspace: directory given as a bare directory name", async () => {
+    // `bun install` joins whatever follows `workspace:` onto the declaring package.json's directory,
+    // so from the root the directory name alone is enough. Only a dependency that is itself a
+    // workspace reads it as a version range instead.
+    await Promise.all([
+      write(
+        join(packageDir, "package.json"),
+        JSON.stringify({
+          name: "pack-workspace-bare-directory",
+          version: "3.0.0",
+          workspaces: ["core", "plain"],
+          dependencies: { "bare": "workspace:core", "@acme/core": "workspace:core", "plain": "workspace:0.x" },
+        }),
+      ),
+      write(join(packageDir, "core", "package.json"), JSON.stringify({ name: "@acme/core", version: "1.2.3" })),
+      write(join(packageDir, "plain", "package.json"), JSON.stringify({ name: "plain", version: "0.5.0" })),
+    ]);
+    await runBunInstall(bunEnv, packageDir);
+
+    await pack(packageDir, bunEnv);
+
+    const tarball = readTarball(join(packageDir, "pack-workspace-bare-directory-3.0.0.tgz"));
+    expect(tarball.entries[0]).toMatchObject({ pathname: "package/package.json" });
+    expect(JSON.parse(tarball.entries[0].contents).dependencies).toEqual({
+      "bare": "npm:@acme/core@1.2.3",
+      "@acme/core": "1.2.3",
+      "plain": "0.x",
+    });
+  });
+
+  test("replaces workspace: directories without a lockfile", async () => {
+    await createDirectoryWorkspace({ dependencies: { "core": "workspace:../core", "plain": "workspace:../plain" } });
+
+    await pack(join(packageDir, "pkgs", "ui"), bunEnv);
+
+    const tarball = readTarball(join(packageDir, "pkgs", "ui", "acme-ui-2.0.0.tgz"));
+    expect(JSON.parse(tarball.entries[0].contents).dependencies).toEqual({
+      "core": "npm:@acme/core@1.2.3",
+      "plain": "0.5.0",
+    });
+  });
+
+  test("copies workspace: aliases as written", async () => {
+    // `workspace:<name>@<range>` installs workspace <name> under the dependency's name; it is
+    // neither a directory nor a range of the dependency, and must not be rejected as one.
+    await createDirectoryWorkspace({
+      dependencies: { "core-alias": "workspace:@acme/core@^1.0.0", "plain-alias": "workspace:plain@*" },
+    });
+
+    await pack(join(packageDir, "pkgs", "ui"), bunEnv);
+
+    const tarball = readTarball(join(packageDir, "pkgs", "ui", "acme-ui-2.0.0.tgz"));
+    expect(JSON.parse(tarball.entries[0].contents).dependencies).toEqual({
+      "core-alias": "@acme/core@^1.0.0",
+      "plain-alias": "plain@*",
+    });
+  });
+
+  const notAWorkspaceSpecs = [
+    // exists on disk, but the root's `workspaces` does not list it (written below)
+    { group: "devDependencies", name: "unlisted", spec: "workspace:../../unlisted" },
+    { group: "dependencies", name: "missing", spec: "workspace:../missing" },
+    // a range only means something for a dependency that is itself a workspace
+    { group: "peerDependencies", name: "not-a-workspace", spec: "workspace:1.2.3" },
+    // and `<name>@<range>` only when <name> is a workspace
+    { group: "optionalDependencies", name: "bogus-alias", spec: "workspace:nope@*" },
+  ];
+
+  for (const { group, name, spec } of notAWorkspaceSpecs) {
+    test(`fails when a workspace: spec is neither a workspace's directory nor a workspace's range: ${spec}`, async () => {
+      await createDirectoryWorkspace({ dependencies: { "plain": "workspace:../plain" }, [group]: { [name]: spec } });
+      await write(join(packageDir, "unlisted", "package.json"), JSON.stringify({ name: "unlisted", version: "1.0.0" }));
+
+      const { err } = await packExpectError(join(packageDir, "pkgs", "ui"), bunEnv);
+      expect(err).toContain(`error: Failed to resolve workspace version for "${name}" in \`${group}\` (`);
+      expect(err).toContain(
+        `package.json" has no workspace named "${name}" and no workspace in the directory "${spec.slice("workspace:".length)}").`,
+      );
+      expect(await exists(join(packageDir, "pkgs", "ui", "acme-ui-2.0.0.tgz"))).toBeFalse();
+    });
+  }
+
+  test("fails when the workspace in a workspace: directory has no version", async () => {
+    await createDirectoryWorkspace({ dependencies: { "no-version": "workspace:../unversioned" } });
+    await write(join(packageDir, "pkgs", "unversioned", "package.json"), JSON.stringify({ name: "unversioned" }));
+
+    const { err } = await packExpectError(join(packageDir, "pkgs", "ui"), bunEnv);
+    expect(err).toContain(
+      'error: Failed to resolve workspace version for "no-version" in `dependencies` (the package.json of workspace "unversioned" in the directory "../unversioned" has no version).',
+    );
+    expect(await exists(join(packageDir, "pkgs", "ui", "acme-ui-2.0.0.tgz"))).toBeFalse();
+  });
 });
 
 test("lifecycle scripts execution order", async () => {
diff --git a/test/cli/install/bun-publish.test.ts b/test/cli/install/bun-publish.test.ts
index ad4157026bbf..7e190cb1ceff 100644
--- a/test/cli/install/bun-publish.test.ts
+++ b/test/cli/install/bun-publish.test.ts
@@ -959,6 +959,59 @@ test("publishes a workspace package next to a bun.lock that does not parse", asy
   });
 });
 
+test("a published package can depend on another workspace by its directory", async () => {
+  const { packageDir, packageJson } = await registry.createTestDir();
+  const bunfig = await registry.authBunfig("workspacepath");
+  const corePkgJson = { name: "publish-pkg-path-core", version: "1.2.3" };
+  await Promise.all([
+    rm(join(registry.packagesPath, "publish-pkg-path-core"), { recursive: true, force: true }),
+    rm(join(registry.packagesPath, "publish-pkg-path-ui"), { recursive: true, force: true }),
+    write(join(packageDir, "bunfig.toml"), bunfig),
+    write(packageJson, JSON.stringify({ name: "root", workspaces: ["packages/*"] })),
+    write(join(packageDir, "packages", "core", "package.json"), JSON.stringify(corePkgJson)),
+    write(
+      join(packageDir, "packages", "ui", "package.json"),
+      JSON.stringify({
+        name: "publish-pkg-path-ui",
+        version: "2.0.0",
+        dependencies: {
+          "core-alias": "workspace:../core",
+          "publish-pkg-path-core": "workspace:../core",
+        },
+      }),
+    ),
+  ]);
+
+  for (const pkg of ["core", "ui"]) {
+    const { out, err, exitCode } = await publish(env, join(packageDir, "packages", pkg));
+    expect(err).not.toContain("error:");
+    expect(out).toContain(`+ publish-pkg-path-${pkg}@`);
+    expect(exitCode).toBe(0);
+  }
+
+  // consume the published package from the registry
+  await Promise.all([
+    rm(join(packageDir, "packages"), { recursive: true, force: true }),
+    write(packageJson, JSON.stringify({ name: "root", dependencies: { "publish-pkg-path-ui": "2.0.0" } })),
+  ]);
+  await runBunInstall(env, packageDir);
+
+  expect(await file(join(packageDir, "node_modules", "publish-pkg-path-ui", "package.json")).json()).toEqual({
+    name: "publish-pkg-path-ui",
+    version: "2.0.0",
+    dependencies: {
+      "core-alias": "npm:publish-pkg-path-core@1.2.3",
+      "publish-pkg-path-core": "1.2.3",
+    },
+  });
+  expect(
+    await Promise.all([
+      file(join(packageDir, "node_modules", "core-alias", "package.json")).json(),
+      file(join(packageDir, "node_modules", "publish-pkg-path-core", "package.json")).json(),
+    ]),
+  ).toEqual([corePkgJson, corePkgJson]);
+});
+
 describe("--dry-run", async () => {
   test("does not publish", async () => {
     const { packageDir, packageJson } = await registry.createTestDir();

From 4447340d7a4682ce8d6b1c200596ab5b279afbd5 Mon Sep 17 00:00:00 2001
From: robobun <117481402+robobun@users.noreply.github.com>
Date: Mon, 17 Aug 2026 02:54:17 +0000
Subject: [PATCH 162/258] pack: publish workspace: aliases as npm: aliases
 (#38788)

---
 docs/pm/workspaces.mdx               |   8 ++
 src/runtime/cli/pack_command.rs      | 100 +++++++++++++++++------
 test/cli/install/bun-pack.test.ts    | 117 +++++++++++++++++++++++----
 test/cli/install/bun-publish.test.ts |  56 +++++++++++++
 4 files changed, 242 insertions(+), 39 deletions(-)

diff --git a/docs/pm/workspaces.mdx b/docs/pm/workspaces.mdx
index 2761a4fe3730..da2d68697713 100644
--- a/docs/pm/workspaces.mdx
+++ b/docs/pm/workspaces.mdx
@@ -99,6 +99,14 @@ You can also reference a workspace package by the path of its directory. The pat
 "b": "workspace:../pkg-b"     -> "b": "npm:pkg-b@1.0.1"
 ```
 
+To install a workspace package under a different name, put the package name in front of the version: `workspace:<name>@<version>`. Bun publishes these as `npm:` aliases too:
+
+```
+"b": "workspace:pkg-b@*"     -> "b": "npm:pkg-b@1.0.1"
+"b": "workspace:pkg-b@^"     -> "b": "npm:pkg-b@^1.0.1"
+"b": "workspace:pkg-b@1.0.1" -> "b": "npm:pkg-b@1.0.1"
+```
+
 Workspaces have a few major benefits.
 
 - **Split code into logical parts.** If one package relies on another, add it as a dependency in `package.json`. If package `b` depends on `a`, `bun install` installs your local `packages/a` directory into `node_modules` instead of downloading it from the npm registry.
diff --git a/src/runtime/cli/pack_command.rs b/src/runtime/cli/pack_command.rs
index d280438af20b..3961764231f3 100644
--- a/src/runtime/cli/pack_command.rs
+++ b/src/runtime/cli/pack_command.rs
@@ -3207,7 +3207,8 @@ fn add_archive_entry(
 enum Substitution<'a> {
     /// `workspace:^`, `workspace:~`, `workspace:*`: the workspace's current version behind that prefix.
     WorkspaceVersion { prefix: &'static str },
-    /// `workspace:1.x` on a dependency that is a workspace, or a directory, `workspace:../core`.
+    /// Another workspace under this dependency's name, `workspace:@acme/core@*`; a directory,
+    /// `workspace:../core`; or `workspace:1.x` on a dependency that is itself a workspace.
     WorkspaceRangeOrDirectory(&'a [u8]),
     /// `catalog:` / `catalog:<name>`: that catalog's entry for the dependency.
     Catalog { catalog_name: &'a [u8] },
@@ -3215,6 +3216,7 @@ enum Substitution<'a> {
 
 impl<'a> Substitution<'a> {
     fn for_spec(spec: &'a [u8]) -> Option<Substitution<'a>> {
+        let spec = bun_install::dependency::trim_literal(spec);
         if let Some(range) = strings::without_prefix_if_possible_comptime(spec, b"workspace:") {
             return Some(match range {
                 b"^" => Substitution::WorkspaceVersion { prefix: "^" },
@@ -3268,40 +3270,88 @@ fn needs_workspace_manifests(package_json: Expr) -> bool {
     needed
 }
 
-/// Directory first: `"pkg1": "workspace:../pkg1"` reads both ways; only a directory has a version.
+/// Alias first, as the installer reads it; directory before range, since only a directory has a version.
 fn publish_spec_for_workspace_range_or_directory(
     manifests: &WorkspaceManifests,
     package_dir: &[u8],
     dependency_name: &[u8],
     spec: &[u8],
 ) -> Result<Vec<u8>, String> {
-    let Some(workspace_name) = manifests.workspace_name_at_path(package_dir, spec) else {
-        // `workspace:<name>@<range>` installs workspace `<name>` under `dependency_name`.
-        let is_alias = strings::last_index_of_char(spec, b'@')
-            .is_some_and(|at| at > 0 && manifests.has_workspace(&spec[..at]));
-        if manifests.has_workspace(dependency_name) || is_alias {
-            return Ok(spec.to_vec());
-        }
-        return Err(format!(
-            "\"{}\" has no workspace named \"{}\" and no workspace in the directory \"{}\"",
-            bstr::BStr::new(manifests.root_package_json_path()),
-            bstr::BStr::new(dependency_name),
-            bstr::BStr::new(spec),
-        ));
-    };
-    let Some(version) = manifests.workspace_version(workspace_name) else {
-        return Err(format!(
-            "the package.json of workspace \"{}\" in the directory \"{}\" has no version",
-            bstr::BStr::new(workspace_name),
-            bstr::BStr::new(spec),
+    let alias = split_workspace_alias(spec);
+    if let Some((workspace_name, range)) = alias.filter(|(name, _)| manifests.has_workspace(name)) {
+        let range = strings::trim(range, &strings::WHITESPACE_CHARS);
+        // The installer links an empty range like `*`.
+        let prefix = match range {
+            b"" | b"*" => Some(""),
+            b"^" => Some("^"),
+            b"~" => Some("~"),
+            _ => None,
+        };
+        let Some(prefix) = prefix else {
+            return Ok(publish_workspace(
+                dependency_name,
+                workspace_name,
+                bstr::BStr::new(range),
+            ));
+        };
+        let Some(version) = manifests.workspace_version(workspace_name) else {
+            return Err(format!(
+                "the package.json of workspace \"{}\" has no version",
+                bstr::BStr::new(workspace_name),
+            ));
+        };
+        return Ok(publish_workspace(
+            dependency_name,
+            workspace_name,
+            format_args!("{prefix}{version}"),
         ));
+    }
+    if let Some(workspace_name) = manifests.workspace_name_at_path(package_dir, spec) {
+        let Some(version) = manifests.workspace_version(workspace_name) else {
+            return Err(format!(
+                "the package.json of workspace \"{}\" in the directory \"{}\" has no version",
+                bstr::BStr::new(workspace_name),
+                bstr::BStr::new(spec),
+            ));
+        };
+        return Ok(publish_workspace(dependency_name, workspace_name, version));
+    }
+    if alias.is_none() && manifests.has_workspace(dependency_name) {
+        return Ok(spec.to_vec());
+    }
+    Err(format!(
+        "\"{}\" has no workspace named \"{}\" and no workspace in the directory \"{}\"",
+        bstr::BStr::new(manifests.root_package_json_path()),
+        bstr::BStr::new(alias.map_or(dependency_name, |(workspace_name, _)| workspace_name)),
+        bstr::BStr::new(spec),
+    ))
+}
+
+/// `<name>@<range>` of `workspace:<name>@<range>`, which installs workspace `<name>` under the
+/// dependency's name. `<name>` may be scoped, so it ends at the last `@`; what a directory such as
+/// `../@scope/pkg` leaves in front of its last `@` is not a package name, so that is not an alias.
+fn split_workspace_alias(spec: &[u8]) -> Option<(&[u8], &[u8])> {
+    let at = strings::last_index_of_char(spec, b'@').filter(|at| *at > 0)?;
+    let (name, range) = (&spec[..at], &spec[at + 1..]);
+    let is_package_name = match bun_install::dependency::is_scoped_package_name(name) {
+        Ok(true) => true,
+        Ok(false) => !strings::contains_char(name, b'/'),
+        Err(_) => false,
     };
-    Ok(if workspace_name == dependency_name {
-        format!("{version}").into_bytes()
+    is_package_name.then_some((name, range))
+}
+
+/// The version itself under the workspace's own name, otherwise the `npm:` alias pnpm publishes too.
+fn publish_workspace(
+    dependency_name: &[u8],
+    workspace_name: &[u8],
+    version: impl fmt::Display,
+) -> Vec<u8> {
+    if workspace_name == dependency_name {
+        version.to_string().into_bytes()
     } else {
-        // What pnpm publishes too: the alias installs the workspace's package under this name.
         format!("npm:{}@{version}", bstr::BStr::new(workspace_name)).into_bytes()
-    })
+    }
 }
 
 /// Edits `json.root` in place (`bun publish` sends that tree to the registry) and returns it printed.
diff --git a/test/cli/install/bun-pack.test.ts b/test/cli/install/bun-pack.test.ts
index bd648fe709c8..e186fc3043f6 100644
--- a/test/cli/install/bun-pack.test.ts
+++ b/test/cli/install/bun-pack.test.ts
@@ -1071,6 +1071,10 @@ describe("workspaces", () => {
     { input: "workspace:-", expected: "-" },
     // leading whitespace is not part of the specifier
     { input: " workspace:^", expected: "^1.1.1" },
+    // aliasing a workspace under its own name needs no `npm:` alias
+    { input: "workspace:pkg1@*", expected: "1.1.1" },
+    { input: "workspace:pkg1@~", expected: "~1.1.1" },
+    { input: "workspace:pkg1@1.x", expected: "1.x" },
   ];
 
   for (const { input, expected } of withLockfileWorkspaceProtocolTests) {
@@ -1543,33 +1547,118 @@ describe("workspaces", () => {
     });
   });
 
-  test("copies workspace: aliases as written", async () => {
-    // `workspace:<name>@<range>` installs workspace <name> under the dependency's name; it is
-    // neither a directory nor a range of the dependency, and must not be rejected as one.
+  // `"core-star": "workspace:@acme/core@*"` installs workspace @acme/core under the name core-star
+  test("replaces workspace: aliases with npm: aliases", async () => {
     await createDirectoryWorkspace({
-      dependencies: { "core-alias": "workspace:@acme/core@^1.0.0", "plain-alias": "workspace:plain@*" },
+      dependencies: {
+        "core-star": "workspace:@acme/core@*",
+        "core-caret": "workspace:@acme/core@^",
+        "core-tilde": "workspace:@acme/core@~",
+        "core-range": "workspace:@acme/core@^1.0.0",
+        "core-exact": "workspace:@acme/core@1.2.3",
+        "core-tag": "workspace:@acme/core@latest",
+        "core-spaced": "workspace:@acme/core@ ^ ",
+        // `bun install` links an empty range like `*`
+        "core-empty": "workspace:@acme/core@",
+        "thing-star": "workspace:thing@*",
+      },
+      devDependencies: {
+        "plain-star": "workspace:plain@*",
+        "plain-range": "workspace:plain@0.x",
+      },
+      peerDependencies: {
+        "plain-peer": "workspace:plain@^",
+      },
+      optionalDependencies: {
+        "plain-optional": "workspace:plain@~",
+      },
     });
+    // every one of these is a spec `bun install` links
+    await runBunInstall(bunEnv, packageDir);
 
     await pack(join(packageDir, "pkgs", "ui"), bunEnv);
 
     const tarball = readTarball(join(packageDir, "pkgs", "ui", "acme-ui-2.0.0.tgz"));
-    expect(JSON.parse(tarball.entries[0].contents).dependencies).toEqual({
-      "core-alias": "@acme/core@^1.0.0",
-      "plain-alias": "plain@*",
+    expect(JSON.parse(tarball.entries[0].contents)).toEqual({
+      name: "@acme/ui",
+      version: "2.0.0",
+      dependencies: {
+        "core-star": "npm:@acme/core@1.2.3",
+        "core-caret": "npm:@acme/core@^1.2.3",
+        "core-tilde": "npm:@acme/core@~1.2.3",
+        "core-range": "npm:@acme/core@^1.0.0",
+        "core-exact": "npm:@acme/core@1.2.3",
+        "core-tag": "npm:@acme/core@latest",
+        "core-spaced": "npm:@acme/core@^1.2.3",
+        "core-empty": "npm:@acme/core@1.2.3",
+        "thing-star": "npm:thing@0.0.7",
+      },
+      devDependencies: {
+        "plain-star": "npm:plain@0.5.0",
+        "plain-range": "npm:plain@0.x",
+      },
+      peerDependencies: {
+        "plain-peer": "npm:plain@^0.5.0",
+      },
+      optionalDependencies: {
+        "plain-optional": "npm:plain@~0.5.0",
+      },
     });
   });
 
+  test("replaces workspace: aliases with the versions in the package.json files, without a lockfile", async () => {
+    await createDirectoryWorkspace({
+      dependencies: { "core": "workspace:@acme/core@*", "plain-caret": "workspace:plain@^" },
+    });
+    await runBunInstall(bunEnv, packageDir);
+    // bumped after the install, so bun.lock still says 1.2.3
+    await write(
+      join(packageDir, "pkgs", "core", "package.json"),
+      JSON.stringify({ name: "@acme/core", version: "1.3.0" }),
+    );
+
+    await pack(join(packageDir, "pkgs", "ui"), bunEnv);
+    const installed = readTarball(join(packageDir, "pkgs", "ui", "acme-ui-2.0.0.tgz"));
+    expect(JSON.parse(installed.entries[0].contents).dependencies).toEqual({
+      "core": "npm:@acme/core@1.3.0",
+      "plain-caret": "npm:plain@^0.5.0",
+    });
+
+    await rm(join(packageDir, "bun.lock"));
+    await rm(join(packageDir, "pkgs", "ui", "acme-ui-2.0.0.tgz"));
+    await pack(join(packageDir, "pkgs", "ui"), bunEnv);
+    const uninstalled = readTarball(join(packageDir, "pkgs", "ui", "acme-ui-2.0.0.tgz"));
+    expect(uninstalled.entries[0].contents).toBe(installed.entries[0].contents);
+  });
+
+  test("fails when the workspace a workspace: alias installs has no version", async () => {
+    await createDirectoryWorkspace({
+      dependencies: { "core": "workspace:@acme/core@*" },
+      devDependencies: { "no-version": "workspace:unversioned@^" },
+    });
+    await write(join(packageDir, "pkgs", "unversioned", "package.json"), JSON.stringify({ name: "unversioned" }));
+
+    const { err } = await packExpectError(join(packageDir, "pkgs", "ui"), bunEnv);
+    expect(err).toContain(
+      'error: Failed to resolve workspace version for "no-version" in `devDependencies` (the package.json of workspace "unversioned" has no version).',
+    );
+    expect(await exists(join(packageDir, "pkgs", "ui", "acme-ui-2.0.0.tgz"))).toBeFalse();
+  });
+
   const notAWorkspaceSpecs = [
     // exists on disk, but the root's `workspaces` does not list it (written below)
-    { group: "devDependencies", name: "unlisted", spec: "workspace:../../unlisted" },
-    { group: "dependencies", name: "missing", spec: "workspace:../missing" },
+    { group: "devDependencies", name: "unlisted", spec: "workspace:../../unlisted", reported: "unlisted" },
+    { group: "dependencies", name: "missing", spec: "workspace:../missing", reported: "missing" },
+    // the `@` in a directory does not make it `<name>@<range>`; the error names the dependency
+    { group: "dependencies", name: "scoped-dir", spec: "workspace:../@scoped/missing", reported: "scoped-dir" },
     // a range only means something for a dependency that is itself a workspace
-    { group: "peerDependencies", name: "not-a-workspace", spec: "workspace:1.2.3" },
-    // and `<name>@<range>` only when <name> is a workspace
-    { group: "optionalDependencies", name: "bogus-alias", spec: "workspace:nope@*" },
+    { group: "peerDependencies", name: "not-a-workspace", spec: "workspace:1.2.3", reported: "not-a-workspace" },
+    // and `<name>@<range>` only when <name> is a workspace, whatever the range, so the error names <name>
+    { group: "optionalDependencies", name: "bogus-alias", spec: "workspace:nope@*", reported: "nope" },
+    { group: "dependencies", name: "bogus-alias", spec: "workspace:@acme/nope@^1.0.0", reported: "@acme/nope" },
   ];
 
-  for (const { group, name, spec } of notAWorkspaceSpecs) {
+  for (const { group, name, spec, reported } of notAWorkspaceSpecs) {
     test(`fails when a workspace: spec is neither a workspace's directory nor a workspace's range: ${spec}`, async () => {
       await createDirectoryWorkspace({ dependencies: { "plain": "workspace:../plain" }, [group]: { [name]: spec } });
       await write(join(packageDir, "unlisted", "package.json"), JSON.stringify({ name: "unlisted", version: "1.0.0" }));
@@ -1577,7 +1666,7 @@ describe("workspaces", () => {
       const { err } = await packExpectError(join(packageDir, "pkgs", "ui"), bunEnv);
       expect(err).toContain(`error: Failed to resolve workspace version for "${name}" in \`${group}\` (`);
       expect(err).toContain(
-        `package.json" has no workspace named "${name}" and no workspace in the directory "${spec.slice("workspace:".length)}").`,
+        `package.json" has no workspace named "${reported}" and no workspace in the directory "${spec.slice("workspace:".length)}").`,
       );
       expect(await exists(join(packageDir, "pkgs", "ui", "acme-ui-2.0.0.tgz"))).toBeFalse();
     });
diff --git a/test/cli/install/bun-publish.test.ts b/test/cli/install/bun-publish.test.ts
index 7e190cb1ceff..debc8f154211 100644
--- a/test/cli/install/bun-publish.test.ts
+++ b/test/cli/install/bun-publish.test.ts
@@ -1012,6 +1012,62 @@ test("a published package can depend on another workspace by its directory", asy
   ).toEqual([corePkgJson, corePkgJson]);
 });
 
+test("a published package can depend on another workspace through a workspace: alias", async () => {
+  const { packageDir, packageJson } = await registry.createTestDir();
+  const bunfig = await registry.authBunfig("workspacealias");
+  const corePkgJson = { name: "publish-pkg-alias-core", version: "1.2.3" };
+  await Promise.all([
+    rm(join(registry.packagesPath, "publish-pkg-alias-core"), { recursive: true, force: true }),
+    rm(join(registry.packagesPath, "publish-pkg-alias-ui"), { recursive: true, force: true }),
+    write(join(packageDir, "bunfig.toml"), bunfig),
+    write(packageJson, JSON.stringify({ name: "root", workspaces: ["packages/*"] })),
+    write(join(packageDir, "packages", "core", "package.json"), JSON.stringify(corePkgJson)),
+    write(
+      join(packageDir, "packages", "ui", "package.json"),
+      JSON.stringify({
+        name: "publish-pkg-alias-ui",
+        version: "2.0.0",
+        dependencies: {
+          "core-alias": "workspace:publish-pkg-alias-core@*",
+          "core-compatible": "workspace:publish-pkg-alias-core@^",
+          "publish-pkg-alias-core": "workspace:publish-pkg-alias-core@*",
+        },
+      }),
+    ),
+  ]);
+
+  for (const pkg of ["core", "ui"]) {
+    const { out, err, exitCode } = await publish(env, join(packageDir, "packages", pkg));
+    expect(err).not.toContain("error:");
+    expect(out).toContain(`+ publish-pkg-alias-${pkg}@`);
+    expect(exitCode).toBe(0);
+  }
+
+  // consume the published package from the registry
+  await Promise.all([
+    rm(join(packageDir, "packages"), { recursive: true, force: true }),
+    write(packageJson, JSON.stringify({ name: "root", dependencies: { "publish-pkg-alias-ui": "2.0.0" } })),
+  ]);
+  await runBunInstall(env, packageDir);
+
+  expect(await file(join(packageDir, "node_modules", "publish-pkg-alias-ui", "package.json")).json()).toEqual({
+    name: "publish-pkg-alias-ui",
+    version: "2.0.0",
+    dependencies: {
+      "core-alias": "npm:publish-pkg-alias-core@1.2.3",
+      "core-compatible": "npm:publish-pkg-alias-core@^1.2.3",
+      "publish-pkg-alias-core": "1.2.3",
+    },
+  });
+  expect(
+    await Promise.all([
+      file(join(packageDir, "node_modules", "core-alias", "package.json")).json(),
+      file(join(packageDir, "node_modules", "core-compatible", "package.json")).json(),
+      file(join(packageDir, "node_modules", "publish-pkg-alias-core", "package.json")).json(),
+    ]),
+  ).toEqual([corePkgJson, corePkgJson, corePkgJson]);
+});
+
 describe("--dry-run", async () => {
   test("does not publish", async () => {
     const { packageDir, packageJson } = await registry.createTestDir();

From 93fa66e08afdd20e1151625c9c21d304c22b2a05 Mon Sep 17 00:00:00 2001
From: robobun <117481402+robobun@users.noreply.github.com>
Date: Mon, 17 Aug 2026 02:55:55 +0000
Subject: [PATCH 163/258] install: link over an empty directory left at
 node_modules/<pkg> with the isolated linker (#37757)

---
 src/install/isolated_install/Symlinker.rs |  10 ++-
 test/cli/install/isolated-install.test.ts | 104 ++++++++++++++++++++++
 2 files changed, 111 insertions(+), 3 deletions(-)

diff --git a/src/install/isolated_install/Symlinker.rs b/src/install/isolated_install/Symlinker.rs
index 52c90735abba..f4cdcda503a2 100644
--- a/src/install/isolated_install/Symlinker.rs
+++ b/src/install/isolated_install/Symlinker.rs
@@ -76,7 +76,7 @@ impl Symlinker {
                                     },
                                 },
                                 // readlink failed for a reason other than NOENT —
-                                // dest exists but isn't a symlink. If it's a real
+                                // dest exists but isn't a symlink. If it's a non-empty
                                 // directory, leave it: this is the `bun patch <pkg>`
                                 // workspace (a detached copy the user is editing
                                 // before `--commit`), and `deleteTree` here would
@@ -100,9 +100,13 @@ impl Symlinker {
                                         false
                                     };
                                     if is_dir {
-                                        return Ok(false);
+                                        // rmdir succeeds only on an empty directory.
+                                        if bun_sys::rmdir(self.dest.slice_z()).is_err() {
+                                            return Ok(false);
+                                        }
+                                    } else {
+                                        let _ = bun_sys::unlink(self.dest.slice_z());
                                     }
-                                    let _ = bun_sys::unlink(self.dest.slice_z());
                                     return self.symlink().map(|()| true);
                                 }
                             };
diff --git a/test/cli/install/isolated-install.test.ts b/test/cli/install/isolated-install.test.ts
index 5f66b796aca3..b75de18d0a33 100644
--- a/test/cli/install/isolated-install.test.ts
+++ b/test/cli/install/isolated-install.test.ts
@@ -2738,6 +2738,110 @@ test("successfully removes and corrects symlinks", async () => {
   );
 });
 
+describe("empty directory where a dependency symlink belongs", () => {
+  // ninja creates the directory of every declared output before running the
+  // command, and bun's own build declares `node_modules/<pkg>/package.json` as
+  // outputs of its `bun install` step, so the install finds an empty
+  // `node_modules/<pkg>/`. Only a directory with contents may be left in
+  // place: that is what `bun patch <pkg>` produces while the user edits it.
+
+  test("new dependency is linked over a pre-created empty directory", async () => {
+    const { packageJson, packageDir } = await registry.createTestDir({ bunfigOpts: { linker: "isolated" } });
+
+    await write(packageJson, JSON.stringify({ name: "test-pkg-empty-dir", dependencies: { "no-deps": "1.0.0" } }));
+    await runBunInstall(bunEnv, packageDir);
+
+    await write(
+      packageJson,
+      JSON.stringify({ name: "test-pkg-empty-dir", dependencies: { "no-deps": "1.0.0", "what-bin": "1.0.0" } }),
+    );
+    await mkdir(join(packageDir, "node_modules", "what-bin"));
+
+    const { out } = await runBunInstall(bunEnv, packageDir);
+    expect(out).toContain("what-bin@1.0.0");
+
+    expect(readlinkSync(join(packageDir, "node_modules", "what-bin"))).toBe(
+      join(".bun", "what-bin@1.0.0", "node_modules", "what-bin"),
+    );
+    const bin = process.platform === "win32" ? "what-bin.bunx" : "what-bin";
+    expect(existsSync(join(packageDir, "node_modules", ".bin", bin))).toBe(true);
+  });
+
+  test("re-running install repairs links that became empty directories", async () => {
+    const { packageJson, packageDir } = await registry.createTestDir({ bunfigOpts: { linker: "isolated" } });
+
+    await write(
+      packageJson,
+      JSON.stringify({
+        name: "test-pkg-empty-dir-repair",
+        dependencies: { "no-deps": "1.0.0", "@types/is-number": "1.0.0" },
+      }),
+    );
+    await runBunInstall(bunEnv, packageDir);
+
+    const links = [
+      join(packageDir, "node_modules", "no-deps"),
+      join(packageDir, "node_modules", "@types", "is-number"),
+      join(packageDir, "node_modules", ".bun", "node_modules", "no-deps"),
+      join(packageDir, "node_modules", ".bun", "node_modules", "@types", "is-number"),
+    ];
+    const expected = links.map(link => readlinkSync(link));
+    for (const link of links) {
+      await rm(link);
+      await mkdir(link);
+    }
+
+    await runBunInstall(bunEnv, packageDir, { savesLockfile: false });
+
+    expect(links.map(link => readlinkSync(link))).toEqual(expected);
+  });
+
+  test("workspace dependency is linked over an empty directory", async () => {
+    const { packageDir } = await registry.createTestDir({
+      bunfigOpts: { linker: "isolated" },
+      files: {
+        "package.json": JSON.stringify({ name: "test-pkg-empty-dir-workspace", workspaces: ["packages/*"] }),
+        "packages/pkg-1/package.json": JSON.stringify({
+          name: "pkg-1",
+          version: "1.0.0",
+          dependencies: { "a-dep": "1.0.1" },
+        }),
+      },
+    });
+
+    await runBunInstall(bunEnv, packageDir);
+
+    const link = join(packageDir, "packages", "pkg-1", "node_modules", "a-dep");
+    const expected = readlinkSync(link);
+    expect(expected).toBe(join("..", "..", "..", "node_modules", ".bun", "a-dep@1.0.1", "node_modules", "a-dep"));
+    await rm(link);
+    await mkdir(link);
+
+    await runBunInstall(bunEnv, packageDir, { savesLockfile: false });
+
+    expect(readlinkSync(link)).toBe(expected);
+  });
+
+  test("a directory with contents is left in place", async () => {
+    const { packageJson, packageDir } = await registry.createTestDir({ bunfigOpts: { linker: "isolated" } });
+
+    await write(
+      packageJson,
+      JSON.stringify({ name: "test-pkg-dir-with-contents", dependencies: { "no-deps": "1.0.0" } }),
+    );
+    await runBunInstall(bunEnv, packageDir);
+
+    const workspace = join(packageDir, "node_modules", "no-deps");
+    await rm(workspace);
+    await write(join(workspace, "index.js"), "module.exports = 'USER_EDITS';\n");
+
+    await runBunInstall(bunEnv, packageDir, { savesLockfile: false });
+
+    expect(lstatSync(workspace).isSymbolicLink()).toBe(false);
+    expect(await file(join(workspace, "index.js")).text()).toBe("module.exports = 'USER_EDITS';\n");
+  });
+});
+
 test("runs lifecycle scripts correctly", async () => {
   // due to binary linking between preinstall and the remaining lifecycle scripts
   // there is special handling for preinstall scripts we should test.

From 05f0c62a48067cde18985d1b3233d518dde1662d Mon Sep 17 00:00:00 2001
From: robobun <117481402+robobun@users.noreply.github.com>
Date: Mon, 17 Aug 2026 02:57:28 +0000
Subject: [PATCH 164/258] install(windows): store an absolute target in .bunx
 shims when the package dir is on another drive (#38018)

---
 src/install/bin.rs                            |  28 ++--
 src/install/windows-shim/BinLinkingShim.rs    |  49 ++++--
 src/install/windows-shim/bun_shim_impl.rs     |  88 ++++++----
 test/cli/install/bun-install-registry.test.ts | 150 +++++++++++++++++-
 4 files changed, 259 insertions(+), 56 deletions(-)

diff --git a/src/install/bin.rs b/src/install/bin.rs
index d6ed56e13bf7..fa496e344fe9 100644
--- a/src/install/bin.rs
+++ b/src/install/bin.rs
@@ -1183,12 +1183,19 @@ impl<'a> Linker<'a> {
             resolve_path::dirname::<PlatformAuto>(abs_dest.as_bytes()),
             abs_target.as_bytes(),
         );
-        debug_assert!(strings::has_prefix(rel_target.as_bytes(), b"..\\"));
 
-        let rel_target_w = strings::to_w_path_normalized(
-            target_buf.as_mut_slice(),
-            &rel_target.as_bytes()[b"..\\".len()..],
-        );
+        // The shim resolves `bin_path` against the parent of its own directory,
+        // so the leading `..\` is implied. `relative` yields no `..\` when the
+        // target is on another drive (it returns the absolute path) or when the
+        // target is inside the bin directory itself, both of which happen with
+        // global installs; those shims store the absolute target.
+        let (bin_path, is_absolute_target): (&[u8], bool) =
+            match strings::without_prefix_if_possible_comptime(rel_target.as_bytes(), b"..\\") {
+                Some(rel_to_parent) => (rel_to_parent, false),
+                None => (abs_target.as_bytes(), true),
+            };
+
+        let bin_path_w = strings::to_w_path_normalized(target_buf.as_mut_slice(), bin_path);
 
         let shebang = 'shebang: {
             let first_content_chunk: Option<&[u8]> = 'contents: {
@@ -1205,7 +1212,7 @@ impl<'a> Linker<'a> {
             };
 
             if let Some(chunk) = first_content_chunk {
-                match WinShimShebang::parse(chunk, rel_target_w) {
+                match WinShimShebang::parse(chunk, bin_path_w) {
                     Ok(s) => break 'shebang s,
                     Err(_) => {
                         self.err = Some(crate::Error::InvalidBinCount);
@@ -1213,12 +1220,13 @@ impl<'a> Linker<'a> {
                     }
                 }
             } else {
-                break 'shebang WinShimShebang::parse_from_bin_path(rel_target_w);
+                break 'shebang WinShimShebang::parse_from_bin_path(bin_path_w);
             }
         };
 
         let shim = WinBinLinkingShim {
-            bin_path: rel_target_w,
+            bin_path: bin_path_w,
+            is_absolute_target,
             shebang,
         };
 
@@ -1267,6 +1275,8 @@ impl<'a> Linker<'a> {
         // so each return path calls `Self::chmod_on_ok` explicitly instead.
 
         let abs_dest_dir = resolve_path::dirname::<PlatformAuto>(abs_dest.as_bytes());
+        // Usually starts with `..`, but a global install may nest the package
+        // directory inside the bin directory; any relative path works here.
         // One `..` per component of `abs_dest_dir` can make this longer than `abs_target`.
         let rel_bound = abs_target.len() + 3 * (strings::count_char(abs_dest_dir, SEP) + 1) + 2;
         let mut rel_spill: Vec<u8>;
@@ -1278,8 +1288,6 @@ impl<'a> Linker<'a> {
         };
         let rel_target = resolve_path::relative_buf_z(rel_buf, abs_dest_dir, abs_target.as_bytes());
 
-        debug_assert!(strings::has_prefix(rel_target.as_bytes(), b".."));
-
         match sys::symlink_running_executable(rel_target, abs_dest) {
             sys::Result::Err(err) => {
                 if err.get_errno() != sys::Errno::EEXIST && err.get_errno() != sys::Errno::ENOENT {
diff --git a/src/install/windows-shim/BinLinkingShim.rs b/src/install/windows-shim/BinLinkingShim.rs
index 24c180c0db76..e030209a5bd7 100644
--- a/src/install/windows-shim/BinLinkingShim.rs
+++ b/src/install/windows-shim/BinLinkingShim.rs
@@ -9,6 +9,13 @@
 //! [WSTR:program][u16:0][WSTR:args][u32:bin_path_byte_len][u32:arg_byte_len]
 //! - args always ends with a trailing space
 //!
+//! `bin_path` is normally relative to the parent of the directory containing
+//! the shim (`node_modules` for `node_modules/.bin/foo.exe`), which is what
+//! keeps a `node_modules` tree relocatable. When no such relative path exists
+//! (a global install whose bin directory is on a different drive than the
+//! package directory, or whose package directory is inside the bin directory)
+//! `Flags::is_absolute_target` is set and `bin_path` is the absolute path.
+//!
 //! See `bun_shim_impl.rs` for more details on how this file is consumed.
 //!
 //! ## `shim_standalone` feature
@@ -22,7 +29,7 @@
 /// Random numbers are chosen for validation purposes
 /// These arbitrary numbers will probably not show up in the other fields.
 /// This will reveal off-by-one mistakes.
-// The encoding is an open-ended 13-bit value, so model it as a transparent u16
+// The encoding is an open-ended 12-bit value, so model it as a transparent u16
 // newtype rather than an exhaustive enum.
 #[repr(transparent)]
 #[derive(Copy, Clone, Eq, PartialEq)]
@@ -32,10 +39,14 @@ impl VersionFlag {
     const CURRENT: VersionFlag = VersionFlag::V5;
 
     /// Fixed bugs where passing arguments did not always work.
-    const V5: VersionFlag = VersionFlag(5478);
+    ///
+    /// Was the 13-bit value 5478 at bit 3 of `Flags` before
+    /// `Flags::is_absolute_target` took that bit; `2739 << 4` is the same bit
+    /// pattern. The assertions below `Flags` explain and pin this.
+    const V5: VersionFlag = VersionFlag(2739);
 
-    /// Maximum 13-bit value.
-    const MAX: VersionFlag = VersionFlag((1u16 << 13) - 1);
+    /// Maximum 12-bit value.
+    const MAX: VersionFlag = VersionFlag((1u16 << 12) - 1);
 
     #[inline]
     pub(crate) const fn bits(self) -> u16 {
@@ -43,7 +54,7 @@ impl VersionFlag {
     }
 }
 
-// Packed u16 bitfield (three bools + a 13-bit version tag): `#[repr(transparent)]`
+// Packed u16 bitfield (four bools + a 12-bit version tag): `#[repr(transparent)]`
 // newtype with manual shift accessors (LSB first).
 #[repr(transparent)]
 #[derive(Copy, Clone, Eq, PartialEq)]
@@ -55,13 +66,15 @@ impl Flags {
         is_node_or_bun: bool,
         is_node: bool,
         has_shebang: bool,
+        is_absolute_target: bool,
         version_tag: VersionFlag,
     ) -> Flags {
         Flags(
             (is_node_or_bun as u16)
                 | ((is_node as u16) << 1)
                 | ((has_shebang as u16) << 2)
-                | (version_tag.0 << 3),
+                | ((is_absolute_target as u16) << 3)
+                | (version_tag.0 << 4),
         )
     }
 
@@ -90,9 +103,15 @@ impl Flags {
     pub(crate) const fn has_shebang(self) -> bool {
         (self.0 & 0b100) != 0
     }
+    // indicates that bin_path is an absolute path instead of being relative to
+    // the parent of the directory containing the shim
+    #[inline]
+    pub(crate) const fn is_absolute_target(self) -> bool {
+        (self.0 & 0b1000) != 0
+    }
     #[inline]
     pub(crate) const fn version_tag(self) -> VersionFlag {
-        VersionFlag(self.0 >> 3)
+        VersionFlag(self.0 >> 4)
     }
 
     #[inline]
@@ -101,12 +120,19 @@ impl Flags {
     }
 
     pub(crate) fn is_valid(self) -> bool {
-        let mask: u16 = Flags::new(false, false, false, VersionFlag::MAX).bits();
-        let compare_to: u16 = Flags::new(false, false, false, VersionFlag::CURRENT).bits();
+        let mask: u16 = Flags::new(false, false, false, false, VersionFlag::MAX).bits();
+        let compare_to: u16 = Flags::new(false, false, false, false, VersionFlag::CURRENT).bits();
         (self.0 & mask) == compare_to
     }
 }
 
+// Launchers that predate `is_absolute_target` validate `bits >> 3 == 5478`. A relative
+// shim must still satisfy that (they keep working on existing installs, and the bunx fast
+// path in a newer bun.exe keeps accepting the files they wrote), and an absolute shim must
+// not (they would otherwise resolve the absolute path as a relative one).
+const _: () = assert!(Flags::new(false, false, false, false, VersionFlag::V5).bits() == 5478 << 3);
+const _: () = assert!(Flags::new(false, false, false, true, VersionFlag::V5).bits() >> 3 != 5478);
+
 // ──────────────────────────────────────────────────────────────────────────
 // Host-side encoding / embedding. None of this is compiled into the
 // standalone shim PE — the doc header says "The latter exe does not include
@@ -341,8 +367,10 @@ mod host {
     }
 
     pub(crate) struct BinLinkingShim<'a> {
-        /// Relative to node_modules. Do not include slash
+        /// Relative to the parent of the directory containing the shim (do not
+        /// include a leading slash), or absolute when `is_absolute_target` is set.
         pub(crate) bin_path: &'a [u16],
+        pub(crate) is_absolute_target: bool,
         /// Information found within the target file's shebang
         pub(crate) shebang: Option<Shebang<'a>>,
     }
@@ -392,6 +420,7 @@ mod host {
                 is_node_or_bun,
                 /* is_node */ false,
                 /* has_shebang */ self.shebang.is_some(),
+                self.is_absolute_target,
                 VersionFlag::CURRENT,
             );
 
diff --git a/src/install/windows-shim/bun_shim_impl.rs b/src/install/windows-shim/bun_shim_impl.rs
index b25cfb74cde9..b8ed0d0b2290 100644
--- a/src/install/windows-shim/bun_shim_impl.rs
+++ b/src/install/windows-shim/bun_shim_impl.rs
@@ -11,6 +11,12 @@
 //! launcher exe. We read that (see `BinLinkingShim.rs` for the creation of this file)
 //! and then we call NtCreateProcess to spawn the correct child process.
 //!
+//! The target path stored in the `.bunx` file is usually relative to the parent of the
+//! directory the launcher lives in, and is read into memory directly after that directory's
+//! path to form the absolute path without copying. When the `.bunx` file carries
+//! `Flags::is_absolute_target`, the stored path is already absolute and is used as-is from
+//! where it was read.
+//!
 //! Every attempt possible to make this file as minimal as possible has been made.
 //! Which has unfortunatly made is difficult to read. To make up for this, every
 //! part of this program is documented as much as possible, including links to
@@ -37,7 +43,9 @@
 //! This file is compiled twice: into bun.exe (for the bunx fast paths below) and as
 //! the standalone `bun_shim_impl.exe` PE (see `main.rs` / the `shim_standalone`
 //! feature), which is then `include_bytes!`-embedded into Bun by `BinLinkingShim.rs`.
-//! When the encoding changes, `BinLinkingShim::VersionFlag::CURRENT` should be bumped.
+//! When the encoding changes, `BinLinkingShim::VersionFlag::CURRENT` should be bumped, unless
+//! the change only affects files carrying a new flag bit that older launchers already reject
+//! (see the assertions below `Flags` in `BinLinkingShim.rs`).
 //!
 //! Theorized and written by @paperclover during one of the most entranced all-nighters of her life.
 
@@ -899,6 +907,8 @@ fn launcher<const MODE: LauncherMode, Ctx: BunCtx>(bun_ctx: Ctx) -> LauncherRet
         );
     }
 
+    let metadata_ptr: *mut u16 = read_ptr;
+
     // All three `read_len` outcomes land on initialized memory:
     //   - SUCCESS, read_len >= 2  → inside the bytes NtReadFile just wrote.
     //   - SUCCESS, read_len < 2   → moves *backward* into the image-path prefix we
@@ -925,6 +935,7 @@ fn launcher<const MODE: LauncherMode, Ctx: BunCtx>(bun_ctx: Ctx) -> LauncherRet
         debug!("    is_node_or_bun: {}", flags.is_node_or_bun());
         debug!("    is_node: {}", flags.is_node());
         debug!("    has_shebang: {}", flags.has_shebang());
+        debug!("    is_absolute_target: {}", flags.is_absolute_target());
         debug!("    version_tag: {}", flags.version_tag().bits());
     }
 
@@ -938,6 +949,26 @@ fn launcher<const MODE: LauncherMode, Ctx: BunCtx>(bun_ctx: Ctx) -> LauncherRet
         return LauncherMode::fail(MODE, FailReason::InvalidShimValidation);
     }
 
+    // Where the target's absolute path starts in buf1. A relative bin path was read in directly
+    // after the parent of the launcher's directory, so the absolute path starts right after the
+    // NT object prefix. An absolute bin path is complete on its own, so it starts where it was
+    // read and the directory left in front of it is never used:
+    //
+    //   relative: '\??\C:\Users\chloe\project\node_modules\my-cli\src\app.js"#...'
+    //                 ^ bin_path_start
+    //   absolute: '\??\C:\Users\chloe\.bun\E:\store\node_modules\my-cli\src\app.js"#...'
+    //                                     ^ bin_path_start (== metadata_ptr)
+    //
+    // Either way the u16 right before it is a `\` (the end of the NT prefix, or the separator
+    // the directory walk above stopped on) which the no-shebang path below may overwrite.
+    let bin_path_start: *mut u16 = if flags.is_absolute_target() {
+        metadata_ptr
+    } else {
+        // SAFETY: NT_OBJECT_PREFIX was written at the start of buf1 above.
+        unsafe { buf1_u16.add(NT_OBJECT_PREFIX.len()) }
+    };
+    debug_assert!(unsafe { *bin_path_start.sub(1) } == '\\' as u16);
+
     let mut spawn_command_line: *mut u16 = if !flags.has_shebang() {
         'spawn_command_line: {
             // no shebang, which means the command line is simply going to be the joined file exe
@@ -951,12 +982,13 @@ fn launcher<const MODE: LauncherMode, Ctx: BunCtx>(bun_ctx: Ctx) -> LauncherRet
             //                                                                  ^^ flags
             //                                                         zero char|
 
-            // change the \ from '\??\' to '""
+            // change the \ before the path (the one from '\??\' here) to '"'
             // the ending quote is assumed to already exist as per the format
             // BUF1: '\??"C:\Users\chloe\project\node_modules\my-cli\src\app.js"##!!!!!!!!!!'
-            //           ^
-            // SAFETY: index 3 is within buf1.
-            unsafe { *buf1_u16.add(3) = '"' as u16 };
+            //           ^ opening_quote_ptr
+            // SAFETY: the u16 before bin_path_start is inside buf1 (see where it is computed).
+            let opening_quote_ptr: *mut u16 = unsafe { bin_path_start.sub(1) };
+            unsafe { *opening_quote_ptr = '"' as u16 };
 
             // Copy user arguments in, overwriting old data. Remember that we ensured the arguments
             // this started with a space.
@@ -996,12 +1028,7 @@ fn launcher<const MODE: LauncherMode, Ctx: BunCtx>(bun_ctx: Ctx) -> LauncherRet
                     .write_unaligned(0);
             }
 
-            // SAFETY: buf1_u8 + 2*(4-1) is 2-byte-aligned (buf1 is u16-aligned, offset is even).
-            break 'spawn_command_line unsafe {
-                buf1_u8
-                    .add(2 * (NT_OBJECT_PREFIX.len() - 1/* "\"".len */))
-                    .cast::<u16>()
-            };
+            break 'spawn_command_line opening_quote_ptr;
         }
     } else {
         'spawn_command_line: {
@@ -1080,17 +1107,15 @@ fn launcher<const MODE: LauncherMode, Ctx: BunCtx>(bun_ctx: Ctx) -> LauncherRet
                 }
                 // BUF1: '\??\C:\Users\chloe\project\node_modules\my-cli\src\app.js"#node #####!!!!!!!!!!'
                 //            ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~^  ^ read_ptr
-                let len = ((read_ptr as usize) - (buf1_u8 as usize) - shebang_arg_len_u8 as usize)
+                //            ^ bin_path_start
+                let len = ((read_ptr as usize)
+                    - shebang_arg_len_u8 as usize
+                    - (bin_path_start as usize))
                     / 2
-                    - NT_OBJECT_PREFIX.len()
                     - 2 /* "\"\x00".len */;
-                // SAFETY: buf1_u16 + 4 .. + 4 + len is within buf1; the next char is '"' (the metadata format places '"' after the bin path).
-                let launch_slice =
-                    unsafe { bun_core::ffi::slice_mut(buf1_u16.add(NT_OBJECT_PREFIX.len()), len) };
-                debug_assert_eq!(
-                    unsafe { *buf1_u16.add(NT_OBJECT_PREFIX.len() + len) },
-                    '"' as u16
-                );
+                // SAFETY: bin_path_start .. + len is within buf1; the next char is '"' (the metadata format places '"' after the bin path).
+                let launch_slice = unsafe { bun_core::ffi::slice_mut(bin_path_start, len) };
+                debug_assert_eq!(unsafe { *bin_path_start.add(len) }, '"' as u16);
                 bun_ctx.direct_launch_with_bun_js(launch_slice);
                 return LauncherMode::fail(MODE, FailReason::CouldNotDirectLaunch);
             }
@@ -1112,9 +1137,9 @@ fn launcher<const MODE: LauncherMode, Ctx: BunCtx>(bun_ctx: Ctx) -> LauncherRet
             //
             // BUF1: '\??\C:\Users\chloe\project\node_modules\my-cli\src\app.js"#node #####!!!!!!!!!!'
             //            ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~^ ^ read_ptr
-            let length_of_filename_u8 = (read_ptr as usize)
-                - (buf1_u8 as usize)
-                - 2 * (NT_OBJECT_PREFIX.len() + 1/* "\x00".len */);
+            //            ^ bin_path_start
+            let length_of_filename_u8 =
+                (read_ptr as usize) - (bin_path_start as usize) - 2 * 1 /* "\x00".len */;
             if shebang_arg_len_u8 as usize
                 + 2 /* "\"".len */
                 + length_of_filename_u8
@@ -1147,18 +1172,15 @@ fn launcher<const MODE: LauncherMode, Ctx: BunCtx>(bun_ctx: Ctx) -> LauncherRet
             // Copy the filename in. There is no leading " but there is a trailing "
             // BUF1: '\??\C:\Users\chloe\project\node_modules\my-cli\src\app.js"#node #####!!!!!!!!!!'
             //            ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~^ ^ read_ptr
+            //            ^ bin_path_start
             // BUF2: 'node "C:\Users\chloe\project\node_modules\my-cli\src\app.js"!!!!!!!!!!!!!!!!!!!!'
             // SAFETY: slice within buf1.
-            let filename: &[u8] = unsafe {
-                bun_core::ffi::slice(
-                    buf1_u8.add(2 * NT_OBJECT_PREFIX.len()),
-                    length_of_filename_u8,
-                )
-            };
-            // `filename` is a UTF-16 byte view: its base is `buf1_u8 + 2*NT_OBJECT_PREFIX.len()`
-            // (even offset from a `*mut u16`-derived pointer ⇒ 2-aligned) and its length is the
-            // difference of two `*mut u16`-derived addresses minus an even constant ⇒ even.
-            // `bytemuck::cast_slice` checks both invariants at runtime, so no `unsafe` needed.
+            let filename: &[u8] =
+                unsafe { bun_core::ffi::slice(bin_path_start.cast::<u8>(), length_of_filename_u8) };
+            // `filename` is a UTF-16 byte view: its base is a `*mut u16` into buf1 (⇒ 2-aligned)
+            // and its length is the difference of two `*mut u16`-derived addresses minus an even
+            // constant ⇒ even. `bytemuck::cast_slice` checks both invariants at runtime, so no
+            // `unsafe` needed.
             let filename_u16: &[u16] = bytemuck::cast_slice(filename);
             if DBG {
                 debug!("filename and quote: '{}'", fmt16(filename_u16));
diff --git a/test/cli/install/bun-install-registry.test.ts b/test/cli/install/bun-install-registry.test.ts
index 82fb0aceb268..0ae5a9ce4fe9 100644
--- a/test/cli/install/bun-install-registry.test.ts
+++ b/test/cli/install/bun-install-registry.test.ts
@@ -1,7 +1,7 @@
 import { file, spawn, write } from "bun";
 import { install_test_helpers, npm_manifest_test_helpers } from "bun:internal-for-testing";
-import { afterAll, beforeEach, describe, expect, setDefaultTimeout, test } from "bun:test";
-import { copyFileSync, existsSync, mkdirSync } from "fs";
+import { afterAll, beforeAll, beforeEach, describe, expect, setDefaultTimeout, test } from "bun:test";
+import { copyFileSync, existsSync, mkdirSync, readFileSync } from "fs";
 import { cp, exists, lstat, mkdir, readlink, rename, rm, writeFile } from "fs/promises";
 import {
   assertManifestsPopulated,
@@ -24,7 +24,7 @@ import {
   VerdaccioRegistry,
   writeShebangScript,
 } from "harness";
-import { join, resolve } from "path";
+import { delimiter, join, resolve } from "path";
 const { parseLockfile } = install_test_helpers;
 
 expect.extend({
@@ -10092,6 +10092,24 @@ describe("outdated", () => {
 // This test is to verify that BinLinkingShim.zig creates correct shim files as
 // well as bun_shim_impl.exe works in various edge cases. There are many fast
 // paths for many many cases.
+// The parts of a Windows `.bunx` file that the tests below look at (the layout
+// is documented in src/install/windows-shim/BinLinkingShim.rs): the UTF-16
+// target path, which ends at a `"`, and the flags word that ends the file. Bit 3
+// of the flags is `is_absolute_target`; the bits above it are the format
+// version. Launchers built before that bit existed check the version bits for
+// exactly this value, so it must stay the same for both kinds of shim.
+const BUNX_VERSION_BITS = 0xab30;
+function readBunxShim(path: string) {
+  const bytes = readFileSync(path);
+  const text = bytes.toString("utf16le");
+  const flags = bytes.readUInt16LE(bytes.length - 2);
+  return {
+    target: text.slice(0, text.indexOf('"')),
+    isAbsoluteTarget: (flags & 0b1000) !== 0,
+    versionBits: flags & 0xfff0,
+  };
+}
+
 describe("windows bin linking shim should work", async () => {
   if (!isWindows) return;
 
@@ -10170,6 +10188,20 @@ describe("windows bin linking shim should work", async () => {
     { bin: "uses-native", name: `exe ${packageDir}\\node_modules\\bunx-bins\\uses-native.ts` },
   ];
 
+  test("the .bunx files store the target relative to node_modules", () => {
+    const binDir = join(packageDir, "node_modules", ".bin");
+    expect(readBunxShim(join(binDir, "native.bunx"))).toEqual({
+      target: "bunx-bins\\native.exe",
+      isAbsoluteTarget: false,
+      versionBits: BUNX_VERSION_BITS,
+    });
+    expect(readBunxShim(join(binDir, "bin-bun.bunx"))).toEqual({
+      target: "bunx-bins\\bin-bun.ts",
+      isAbsoluteTarget: false,
+      versionBits: BUNX_VERSION_BITS,
+    });
+  });
+
   for (const { bin, name } of bins) {
     test(`bun run ${bin} arg1 arg2`, async () => {
       var { stdout, stderr, exited } = spawn({
@@ -10247,6 +10279,118 @@ describe("windows bin linking shim should work", async () => {
   }
 });
 
+// Bin links are created relative to the bin dir, and a global install can put
+// the global bin dir and the global package dir anywhere relative to each
+// other. Bin linking used to assume that path always starts with `..`. On
+// Windows that matters: a `.bunx` file stores the target relative to the parent
+// of the directory holding the shim, which is impossible when the two dirs are
+// on different drives (https://github.com/oven-sh/bun/issues/23414), so the
+// shim has to store the absolute target instead. CI machines have a single
+// drive, so this uses the other layout whose relative path does not start with
+// `..`: the package dir nested inside the bin dir. Both layouts take the same
+// path through the linker and the shim.
+describe("global bin links when the package dir is inside the bin dir", () => {
+  let root: string;
+  let binDir: string;
+  let globalDir: string;
+  let globalEnv: Record<string, string | undefined>;
+
+  beforeAll(async () => {
+    root = tmpdirSync();
+    binDir = join(root, "bin");
+    globalDir = join(binDir, "global");
+    const tmp = join(root, "tmp");
+    await mkdir(tmp);
+    // `env` is shared with the file-level beforeEach, which points its cache and
+    // temp dirs at whichever test ran last; pin them so `bunx` below (which puts
+    // `<temp>/bunx-*/node_modules/.bin` ahead of PATH) sees the same thing in
+    // every run.
+    globalEnv = mergeWindowEnvs([
+      env,
+      {
+        BUN_INSTALL_BIN: binDir,
+        BUN_INSTALL_GLOBAL_DIR: globalDir,
+        BUN_INSTALL_CACHE_DIR: join(root, "cache"),
+        BUN_TMPDIR: tmp,
+        TMPDIR: tmp,
+        TEMP: tmp,
+        PATH: binDir + delimiter + process.env.PATH,
+      },
+    ]);
+
+    await writeFile(
+      join(root, "bunfig.toml"),
+      Bun.TOML.stringify({
+        install: {
+          cache: false,
+          registry: `http://localhost:${port}/`,
+        },
+      }),
+    );
+
+    const { stdout, stderr, exited } = spawn({
+      cmd: [bunExe(), "install", "-g", "--linker=hoisted", `--config=${join(root, "bunfig.toml")}`, "bunx-bins"],
+      cwd: root,
+      stdout: "pipe",
+      stderr: "pipe",
+      env: globalEnv,
+    });
+    const err = await stderr.text();
+    expect(err).not.toContain("error:");
+    expect(await stdout.text()).toContain("bunx-bins@1.0.0");
+    expect(await exited).toBe(0);
+  });
+
+  test.skipIf(isWindows)("the bins are symlinks relative to the bin dir", async () => {
+    expect(await readlink(join(binDir, "bin-bun"))).toBe(join("global", "node_modules", "bunx-bins", "bin-bun.ts"));
+    expect(await exists(join(binDir, "bin-bun"))).toBe(true);
+  });
+
+  test.skipIf(!isWindows)("the .bunx files store the absolute path of the target", () => {
+    const packageDir = join(globalDir, "node_modules", "bunx-bins");
+    expect(readBunxShim(join(binDir, "native.bunx"))).toEqual({
+      target: join(packageDir, "native.exe"),
+      isAbsoluteTarget: true,
+      versionBits: BUNX_VERSION_BITS,
+    });
+    expect(readBunxShim(join(binDir, "bin-bun.bunx"))).toEqual({
+      target: join(packageDir, "bin-bun.ts"),
+      isAbsoluteTarget: true,
+      versionBits: BUNX_VERSION_BITS,
+    });
+  });
+
+  // `native` has no shebang, so the shim launches the target itself. `bin-bun`
+  // has a `#!/usr/bin/env bun` shebang, so the shim launches `bun <target>`.
+  // Running the `.exe` exercises the standalone shim; `bunx` finds the `.exe`
+  // in PATH and reads the `.bunx` file inside bun.exe instead; `bun --bun x`
+  // additionally runs the target in-process instead of spawning `bun`.
+  const runs: [name: string, cmd: () => string[], expected: string][] = [
+    ["native.exe", () => [join(binDir, "native.exe")], "i am exe arg1 arg2"],
+    ["bin-bun.exe", () => [join(binDir, "bin-bun.exe")], "i am bin-bun arg1 arg2"],
+    ["bun x native", () => [bunExe(), "x", "native"], "i am exe arg1 arg2"],
+    ["bun x bin-bun", () => [bunExe(), "x", "bin-bun"], "i am bin-bun arg1 arg2"],
+    ["bun --bun x bin-bun", () => [bunExe(), "--bun", "x", "bin-bun"], "i am bin-bun arg1 arg2"],
+  ];
+
+  for (const [name, cmd, expected] of runs) {
+    test.skipIf(!isWindows)(`${name} arg1 arg2`, async () => {
+      const { stdout, stderr, exited } = spawn({
+        cmd: [...cmd(), "arg1", "arg2"],
+        cwd: root,
+        stdout: "pipe",
+        stderr: "pipe",
+        env: globalEnv,
+      });
+      const err = await stderr.text();
+      expect(err.trim()).toBe("");
+      const out = await stdout.text();
+      expect(out.trim()).toBe(expected);
+      expect(await exited).toBe(0);
+    });
+  }
+});
+
 test("rejects dependency aliases containing relative path segments", async () => {
   // A dependency alias is used verbatim as a folder name when building install
   // paths (`node_modules/<alias>/node_modules/...`). `one-fixed-dep@2.0.0`

From b7c8a29a2d469d6db6bab3e7f1637c13698b5b06 Mon Sep 17 00:00:00 2001
From: robobun <117481402+robobun@users.noreply.github.com>
Date: Mon, 17 Aug 2026 02:59:27 +0000
Subject: [PATCH 165/258] run, install: honor --no-env-file / --env-file for
 scripts run through the bun exec hop (#38182)

---
 src/install/lifecycle_script_runner.rs        | 97 +++++++++++++------
 src/runtime/cli/filter_run.rs                 | 43 +++-----
 src/runtime/cli/multi_run.rs                  | 42 +++-----
 .../bun-install-lifecycle-scripts.test.ts     | 28 ++++++
 test/cli/run/filter-workspace.test.ts         | 92 ++++++++++++++++++
 5 files changed, 215 insertions(+), 87 deletions(-)

diff --git a/src/install/lifecycle_script_runner.rs b/src/install/lifecycle_script_runner.rs
index 430648e9aef1..529a61214adf 100644
--- a/src/install/lifecycle_script_runner.rs
+++ b/src/install/lifecycle_script_runner.rs
@@ -247,6 +247,67 @@ pub fn replace_package_manager_run(
     Ok(())
 }
 
+/// argv for spawning a package.json script: `<shell> -c <script>` with the
+/// POSIX shell the caller found, otherwise (always on Windows)
+/// `bun exec --no-env-file <script>`.
+///
+/// The envp the caller spawns with is the script's entire environment either
+/// way: `sh` adds nothing to it, and `--no-env-file` keeps `bun exec` from
+/// loading the `.env*` files in the script's cwd on top of it.
+pub struct ScriptArgv<'a> {
+    /// Elements are bare nullable pointers (an `Option<*const c_char>` would
+    /// not be one word each); terminated by a null after the last argument,
+    /// which for the shell form is one slot early.
+    argv: [*const c_char; 5],
+    _borrowed: core::marker::PhantomData<&'a ZStr>,
+}
+
+impl<'a> ScriptArgv<'a> {
+    pub fn new(shell: Option<&'a ZStr>, script: &'a ZStr) -> Result<Self, crate::Error> {
+        // `find_shell` yields cmd.exe on Windows, which does not take `-c`.
+        let argv = match shell {
+            Some(shell) if cfg!(unix) => [
+                shell.as_ptr(),
+                c"-c".as_ptr(),
+                script.as_ptr(),
+                core::ptr::null(),
+                core::ptr::null(),
+            ],
+            _ => [
+                bun_core::self_exe_path()?.as_ptr(),
+                c"exec".as_ptr(),
+                c"--no-env-file".as_ptr(),
+                script.as_ptr(),
+                core::ptr::null(),
+            ],
+        };
+        Ok(Self {
+            argv,
+            _borrowed: core::marker::PhantomData,
+        })
+    }
+
+    /// `bun install --ignore-scripts --no-save`, for a git dependency's `prepare` step.
+    pub fn install_dependencies() -> Result<Self, crate::Error> {
+        let mut argv: [*const c_char; 5] = [core::ptr::null(); 5];
+        argv[0] = bun_core::self_exe_path()?.as_ptr();
+        for (slot, arg) in argv[1..].iter_mut().zip(INSTALL_DEPENDENCIES_ARGS) {
+            *slot = arg.as_ptr();
+        }
+        const _: () = assert!(INSTALL_DEPENDENCIES_ARGS.len() + 2 <= 5);
+        Ok(Self {
+            argv,
+            _borrowed: core::marker::PhantomData,
+        })
+    }
+
+    /// The null-terminated array `spawn_process` takes; valid while `self`
+    /// (and the strings it borrows) is.
+    pub fn as_ptr(&self) -> *const *const c_char {
+        self.argv.as_ptr()
+    }
+}
+
 pub struct LifecycleScriptSubprocess<'a> {
     pub(crate) package_name: Box<[u8]>,
 
@@ -670,45 +731,19 @@ impl<'a> LifecycleScriptSubprocess<'a> {
                 == PrepareDependencies::Pending
                 && next_script_index as usize >= ScriptsList::FIRST_PREPARE_INDEX;
 
-            // `[_]?[*:0]const u8` argv array with trailing null. Element type MUST be
-            // bare `*const c_char` (null sentinel), never `Option<*const c_char>` —
-            // raw pointers are already nullable, and `Option<*const T>` is a 2-word
-            // (tag, ptr) pair, not niche-optimized. Casting a `[Option<*const c_char>; N]`
-            // to `Argv` would interleave discriminant words and EFAULT in the kernel.
-            // Sized for the longer of the two argvs built below.
-            const ARGV_LEN: usize = INSTALL_DEPENDENCIES_ARGS.len() + 2;
-            let mut argv: [*const c_char; ARGV_LEN] = [core::ptr::null(); ARGV_LEN];
-            const _: () = assert!(
-                core::mem::size_of::<[*const c_char; ARGV_LEN]>()
-                    == ARGV_LEN * core::mem::size_of::<usize>()
-            );
-
             // Owns the script bytes `argv` points into until the spawn below.
             let mut copy_script: Vec<u8> = Vec::new();
-            let command_line: &[u8] = if installing_dependencies {
+            let (argv, command_line): (ScriptArgv, &[u8]) = if installing_dependencies {
                 (*this).prepare_dependencies = PrepareDependencies::Installing(
                     NestedInstallCleanup::begin(cwd, &(*this).package_name),
                 );
-                argv[0] = bun_core::self_exe_path()?.as_ptr();
-                for (slot, arg) in argv[1..].iter_mut().zip(INSTALL_DEPENDENCIES_ARGS) {
-                    *slot = arg.as_ptr();
-                }
-                INSTALL_DEPENDENCIES_COMMAND_LINE
+                (ScriptArgv::install_dependencies()?, INSTALL_DEPENDENCIES_COMMAND_LINE)
             } else {
                 copy_script.reserve_exact(original_script.len() + 1);
                 replace_package_manager_run(&mut copy_script, original_script)?;
                 copy_script.push(0);
                 let combined_script: &ZStr = ZStr::from_slice_with_nul(&copy_script);
-
-                if (*this).shell_bin.is_some() && !cfg!(windows) {
-                    argv[0] = (*this).shell_bin.unwrap().as_ptr();
-                    argv[1] = c"-c".as_ptr();
-                } else {
-                    argv[0] = bun_core::self_exe_path()?.as_ptr();
-                    argv[1] = c"exec".as_ptr();
-                }
-                argv[2] = combined_script.as_ptr();
-                combined_script.as_bytes()
+                (ScriptArgv::new((*this).shell_bin, combined_script)?, combined_script.as_bytes())
             };
 
             if (*this).foreground && (*manager).options.log_level != crate::LogLevel::Silent {
@@ -818,9 +853,7 @@ impl<'a> LifecycleScriptSubprocess<'a> {
                 .insert(this.cast::<LifecycleScriptSubprocess<'static>>());
             let spawned = match bun_spawn::spawn_process(
                 &spawn_options,
-                // argv is a `[*const c_char; N]` with trailing null — exactly the
-                // `[*:null]?[*:0]const u8` layout `spawn_process` expects (1 word/elt).
-                argv.as_mut_ptr().cast(),
+                argv.as_ptr(),
                 envp,
             ) {
                 Ok(Ok(s)) => s,
diff --git a/src/runtime/cli/filter_run.rs b/src/runtime/cli/filter_run.rs
index cce11da791c2..15bd75c2d64a 100644
--- a/src/runtime/cli/filter_run.rs
+++ b/src/runtime/cli/filter_run.rs
@@ -14,6 +14,7 @@ use bun_core::{Global, Output};
 use bun_core::{ZStr, strings};
 use bun_event_loop::EventLoopHandle;
 use bun_event_loop::MiniEventLoop::{self as MiniEventLoopMod, MiniEventLoop};
+use bun_install::lifecycle_script_runner::ScriptArgv;
 use bun_io::{BufferedReader, ReadState};
 use bun_sys as sys;
 
@@ -91,16 +92,7 @@ impl<'a> ProcessHandle<'a> {
         state.remaining_scripts += 1;
         let handle = self;
 
-        let argv: [*const c_char; 4] = [
-            state.shell_bin.as_ptr().cast(),
-            if cfg!(unix) {
-                c"-c".as_ptr()
-            } else {
-                c"exec".as_ptr()
-            },
-            handle.config.combined.as_ptr().cast(),
-            core::ptr::null(),
-        ];
+        let argv = ScriptArgv::new(state.shell_bin, handle.config.combined)?;
         let start_time = Instant::now();
         let spawned: spawn::SpawnProcessResult = 'brk: {
             // Get the envp with the PATH configured
@@ -122,8 +114,8 @@ impl<'a> ProcessHandle<'a> {
             }
             // SAFETY: see above; reborrow through raw ptr to avoid overlapping &mut with guard.
             let envp = unsafe { (*env_ptr).map.create_null_delimited_env_map()? };
-            // SAFETY: `argv`/`envp` are local null-terminated C-string arrays
-            // with argv[0] non-null; valid for this call.
+            // SAFETY: `argv` and `envp` are null-terminated C-string arrays
+            // (argv[0] non-null) owned by locals that outlive this call.
             break 'brk unsafe {
                 spawn::spawn_process(
                     &handle.options,
@@ -327,7 +319,8 @@ struct State<'a> {
     draw_buf: Vec<u8>,
     last_lines_written: usize,
     pretty_output: bool,
-    shell_bin: &'static ZStr, // intentionally leaked (process exits)
+    /// POSIX shell the scripts run under; `None` on Windows (see `ScriptArgv`).
+    shell_bin: Option<&'static ZStr>,
     aborted: bool,
     // Raw `*mut` — process-lifetime singleton owned
     // by Transpiler; ProcessHandle::start mutates `env.map` (PATH swap) so a
@@ -935,20 +928,16 @@ pub(crate) fn run_scripts_with_filter(
     bun_io::ParentDeathWatchdog::install_on_event_loop(MiniEventLoop::as_event_loop_ctx(unsafe {
         &mut *event_loop
     }));
-    let shell_bin: &'static ZStr = {
-        #[cfg(unix)]
-        {
-            RunCommand::find_shell(
-                // SAFETY: env_ptr is the live process-lifetime DotEnv loader.
-                unsafe { (*env_ptr).get(b"PATH") }.unwrap_or(b""),
-                fsinstance.top_level_dir,
-            )
-            .ok_or(crate::Error::MissingShell)?
-        }
-        #[cfg(not(unix))]
-        {
-            bun_core::self_exe_path().map_err(|_| crate::Error::MissingShell)?
-        }
+    let shell_bin: Option<&'static ZStr> = if cfg!(unix) {
+        let shell = RunCommand::find_shell(
+            // SAFETY: env_ptr is the live process-lifetime DotEnv loader.
+            unsafe { (*env_ptr).get(b"PATH") }.unwrap_or(b""),
+            fsinstance.top_level_dir,
+        )
+        .ok_or(crate::Error::MissingShell)?;
+        Some(shell)
+    } else {
+        None
     };
 
     let handles: Box<[ProcessHandle]> = Vec::with_capacity(scripts.len()).into();
diff --git a/src/runtime/cli/multi_run.rs b/src/runtime/cli/multi_run.rs
index 930c556ac928..dc4b3f1bc0c4 100644
--- a/src/runtime/cli/multi_run.rs
+++ b/src/runtime/cli/multi_run.rs
@@ -6,10 +6,11 @@ use std::time::Instant;
 use crate::Error;
 use bun_collections::{StringArrayHashMap, VecExt};
 use bun_core::strings;
-use bun_core::{self as bun, Global, Output, UnwrapOrOom};
+use bun_core::{self as bun, Global, Output, UnwrapOrOom, ZStr};
 use bun_event_loop::EventLoopHandle;
 use bun_event_loop::MiniEventLoop::MiniEventLoop;
 use bun_install::package_manager::workspace_selection;
+use bun_install::lifecycle_script_runner::ScriptArgv;
 use bun_io::BufferedReader;
 use bun_paths as path;
 
@@ -143,17 +144,10 @@ impl<'a> ProcessHandle<'a> {
         let state = unsafe { &mut *self.state.cast_mut() };
         state.remaining_scripts += 1;
 
-        // Null-terminated argv array, as required by spawnProcess.
-        let argv: [*const c_char; 4] = [
-            state.shell_bin.as_ptr().cast::<c_char>(),
-            if cfg!(unix) {
-                c"-c".as_ptr()
-            } else {
-                c"exec".as_ptr()
-            },
-            self.config.command.as_ptr().cast::<c_char>(),
-            ptr::null(),
-        ];
+        let argv = ScriptArgv::new(
+            state.shell_bin,
+            ZStr::from_slice_with_nul(&self.config.command),
+        )?;
 
         let start_time = Instant::now();
         let envp;
@@ -169,8 +163,8 @@ impl<'a> ProcessHandle<'a> {
             });
             // SAFETY: same loader; the `_restore` guard's closure has not fired yet.
             envp = unsafe { (*env_ptr).map.create_null_delimited_env_map()? };
-            // SAFETY: `argv`/`envp` are local null-terminated C-string arrays
-            // with argv[0] non-null; valid for this call.
+            // SAFETY: `argv` and `envp` are null-terminated C-string arrays
+            // (argv[0] non-null) owned by locals that outlive this call.
             unsafe {
                 spawn::spawn_process(
                     &self.options,
@@ -352,8 +346,8 @@ struct State<'a> {
     event_loop_handle: EventLoopHandle,
     remaining_scripts: usize,
     max_label_len: usize,
-    // NUL-terminated (last byte is 0) for argv[0].
-    shell_bin: Box<[u8]>,
+    /// POSIX shell the scripts run under; `None` on Windows (see `ScriptArgv`).
+    shell_bin: Option<&'static ZStr>,
     aborted: bool,
     no_exit_on_error: bool,
     env: *mut DotEnvLoader,
@@ -911,22 +905,14 @@ pub(crate) fn run(ctx: &mut Command::ContextData) -> Result<core::convert::Infal
     bun_io::ParentDeathWatchdog::install_on_event_loop(event_loop_handle_to_ctx(
         EventLoopHandle::init_mini(event_loop),
     ));
-    // shell_bin is NUL-terminated ([:0]const u8) for argv use.
-    let shell_bin: Box<[u8]> = if cfg!(unix) {
+    let shell_bin: Option<&'static ZStr> = if cfg!(unix) {
         // SAFETY: env_ptr is the process-lifetime DotEnv loader; the &mut borrow passed to
         // init_global above has been released, so this read does not alias a live &mut.
         let path_env = unsafe { (*env_ptr).get(b"PATH") }.unwrap_or(b"");
-        Box::from(
-            RunCommand::find_shell(path_env, cwd)
-                .ok_or(crate::Error::MissingShell)?
-                .as_bytes_with_nul(),
-        )
+        let shell = RunCommand::find_shell(path_env, cwd).ok_or(crate::Error::MissingShell)?;
+        Some(shell)
     } else {
-        Box::from(
-            bun::self_exe_path()
-                .map_err(|_| crate::Error::MissingShell)?
-                .as_bytes_with_nul(),
-        )
+        None
     };
 
     // Build ScriptConfigs and ProcessHandles
diff --git a/test/cli/install/bun-install-lifecycle-scripts.test.ts b/test/cli/install/bun-install-lifecycle-scripts.test.ts
index b01d72bc737a..b3c6036f5fd2 100644
--- a/test/cli/install/bun-install-lifecycle-scripts.test.ts
+++ b/test/cli/install/bun-install-lifecycle-scripts.test.ts
@@ -645,6 +645,34 @@ test.concurrent.skipIf(!canForceExdevTmpdir)(
   },
 );
 
+// The environment `bun install` built is all a lifecycle script gets. On
+// Windows (and on POSIX without a shell) the script runs through `bun exec`,
+// which used to load the .env* files of the script's own directory on top of
+// that, so a workspace package's .env reached its scripts there and nowhere else.
+test.concurrent("lifecycle scripts do not get the .env files of the package directory", async () => {
+  using ctx = await setupTest();
+  const { packageDir, packageJson, env } = ctx;
+  const pkgDir = join(packageDir, "packages", "pkg1");
+
+  await mkdir(pkgDir, { recursive: true });
+  await Promise.all([
+    writeFile(packageJson, JSON.stringify({ name: "foo", version: "1.0.0", workspaces: ["packages/*"] })),
+    writeFile(
+      join(pkgDir, "package.json"),
+      JSON.stringify({
+        name: "pkg1",
+        version: "1.0.0",
+        scripts: { postinstall: "echo PKG_DOTENV=$PKG_DOTENV INHERITED=$LIFECYCLE_INHERITED > seen.txt" },
+      }),
+    ),
+    writeFile(join(pkgDir, ".env"), "PKG_DOTENV=leaked"),
+  ]);
+
+  await runBunInstall({ ...env, PKG_DOTENV: undefined, LIFECYCLE_INHERITED: "from-install" }, packageDir);
+
+  expect((await file(join(pkgDir, "seen.txt")).text()).trim()).toBe("PKG_DOTENV= INHERITED=from-install");
+});
+
 test.concurrent("default trusted dependencies require the canonical registry tarball URL", async () => {
   using ctx = await setupTest();
   const { packageDir, packageJson, env } = ctx;
diff --git a/test/cli/run/filter-workspace.test.ts b/test/cli/run/filter-workspace.test.ts
index a22306c4108d..383dad8df8f8 100644
--- a/test/cli/run/filter-workspace.test.ts
+++ b/test/cli/run/filter-workspace.test.ts
@@ -1091,6 +1091,98 @@ describe.skipIf(!isWindows).each([
   );
 });
 
+// The script runner never passes the default .env* files into package.json
+// scripts (see "does not pass variables from .env files into scripts" in
+// env.test.ts): the script's own bun instance loads them, so a script such as
+// `NODE_ENV=production bun start` reads .env.production and not the
+// .env.development the runner would have picked (#9635). The environment the
+// runner did build is passed as envp, which on POSIX goes straight to `sh -c`.
+// On Windows `--filter` / `--parallel` go through a `bun exec` hop, which used
+// to auto-load the package directory's .env* files on top of envp, ignoring
+// the --no-env-file / --env-file given to the runner.
+describe.each([
+  { via: "--filter", argv: (script: string) => ["--filter", "app", script], cwd: (root: string) => root },
+  {
+    via: "run --parallel",
+    argv: (script: string) => ["--parallel", script],
+    cwd: (root: string) => join(root, "packages", "app"),
+  },
+])("$via: scripts only see the environment the runner built", ({ argv, cwd }) => {
+  function workspace() {
+    return tempDir("filter-env-files", {
+      "package.json": JSON.stringify({ name: "ws", workspaces: ["packages/*"] }),
+      "packages/app/package.json": JSON.stringify({
+        name: "app",
+        scripts: {
+          "show-env": "echo ENV_FILE_NAME=$ENV_FILE_NAME CUSTOM=$CUSTOM_VAR INHERITED=$INHERITED_VAR",
+          "show-env-prod": `NODE_ENV=production "${bunExe()}" show-env.js`,
+        },
+      }),
+      "packages/app/show-env.js": `
+        const { ENV_FILE_NAME = "", CUSTOM_VAR = "", INHERITED_VAR = "" } = process.env;
+        console.log("ENV_FILE_NAME=" + ENV_FILE_NAME + " CUSTOM=" + CUSTOM_VAR + " INHERITED=" + INHERITED_VAR);
+      `,
+      // Whichever NODE_ENV the test runner itself is under, one of these is in
+      // the default set, so auto-loading shows up as a non-empty ENV_FILE_NAME.
+      "packages/app/.env": "ENV_FILE_NAME=.env",
+      "packages/app/.env.development": "ENV_FILE_NAME=.env.development",
+      "packages/app/.env.production": "ENV_FILE_NAME=.env.production",
+      "packages/app/.env.test": "ENV_FILE_NAME=.env.test",
+      "packages/app/.env.custom": "CUSTOM_VAR=from-custom",
+    });
+  }
+
+  async function run(root: string, runnerFlags: string[], script = "show-env") {
+    await using proc = Bun.spawn({
+      cmd: [bunExe(), "run", ...runnerFlags, ...argv(script)],
+      cwd: cwd(root),
+      env: { ...bunEnv, ENV_FILE_NAME: undefined, CUSTOM_VAR: undefined, INHERITED_VAR: "from-parent" },
+      stdout: "pipe",
+      stderr: "pipe",
+    });
+    const [stdout, stderr, exitCode] = await Promise.all([proc.stdout.text(), proc.stderr.text(), proc.exited]);
+    const line = stdout.match(/ENV_FILE_NAME=(\S*) CUSTOM=(\S*) INHERITED=(\S*)/);
+    if (!line) throw new Error(`script output missing.\nstdout: ${stdout}\nstderr: ${stderr}`);
+    return { envFile: line[1], custom: line[2], inherited: line[3], exitCode };
+  }
+
+  test.concurrent("the package directory's .env* files are not loaded", async () => {
+    using dir = workspace();
+    expect(await run(String(dir), [])).toEqual({ envFile: "", custom: "", inherited: "from-parent", exitCode: 0 });
+  });
+
+  test.concurrent("--no-env-file", async () => {
+    using dir = workspace();
+    expect(await run(String(dir), ["--no-env-file"])).toEqual({
+      envFile: "",
+      custom: "",
+      inherited: "from-parent",
+      exitCode: 0,
+    });
+  });
+
+  test.concurrent("--env-file loads only the requested file", async () => {
+    using dir = workspace();
+    const envFile = join(String(dir), "packages", "app", ".env.custom");
+    expect(await run(String(dir), ["--env-file", envFile])).toEqual({
+      envFile: "",
+      custom: "from-custom",
+      inherited: "from-parent",
+      exitCode: 0,
+    });
+  });
+
+  test.concurrent("a script that sets its own NODE_ENV gets the matching .env file (#9635)", async () => {
+    using dir = workspace();
+    expect(await run(String(dir), [], "show-env-prod")).toEqual({
+      envFile: ".env.production",
+      custom: "",
+      inherited: "from-parent",
+      exitCode: 0,
+    });
+  });
+});
+
 describe("output timing", () => {
   // A script is finished when its process exits: output it already wrote is
   // drained at that point, but a detached child still holding the pipe write

From a8f1780d1bdf0ab60d65ca2add70eaebbfea2ae8 Mon Sep 17 00:00:00 2001
From: robobun <117481402+robobun@users.noreply.github.com>
Date: Mon, 17 Aug 2026 03:00:48 +0000
Subject: [PATCH 166/258] install: warn instead of failing when
 minimum-release-age blocks a peer dependency (#38995)

---
 .../PackageManager/PackageManagerEnqueue.rs   |  62 ++--
 test/cli/install/minimum-release-age.test.ts  | 279 ++++++++++++++++++
 2 files changed, 318 insertions(+), 23 deletions(-)

diff --git a/src/install/PackageManager/PackageManagerEnqueue.rs b/src/install/PackageManager/PackageManagerEnqueue.rs
index 434346eef70c..10cadfddaa8b 100644
--- a/src/install/PackageManager/PackageManagerEnqueue.rs
+++ b/src/install/PackageManager/PackageManagerEnqueue.rs
@@ -849,7 +849,7 @@ pub fn enqueue_dependency_with_main_and_success_fn(
                                     if let Some(fail) = fail_fn {
                                         fail(this, dependency, id, err);
                                     } else if dependency.behavior.is_peer() {
-                                        warn_unmet_peer_dependency(this, name, &version);
+                                        warn_unmet_peer_dependency(this, name, &version, err);
                                     } else {
                                         this.log_mut()
                     .add_error_fmt(
@@ -871,7 +871,7 @@ pub fn enqueue_dependency_with_main_and_success_fn(
                                     if let Some(fail) = fail_fn {
                                         fail(this, dependency, id, err);
                                     } else if dependency.behavior.is_peer() {
-                                        warn_unmet_peer_dependency(this, name, &version);
+                                        warn_unmet_peer_dependency(this, name, &version, err);
                                     } else {
                                         bun_ast::add_error_pretty!(
                                             this.log_mut(),
@@ -890,6 +890,8 @@ pub fn enqueue_dependency_with_main_and_success_fn(
                                 if dependency.behavior.is_required() {
                                     if let Some(fail) = fail_fn {
                                         fail(this, dependency, id, err);
+                                    } else if dependency.behavior.is_peer() {
+                                        warn_unmet_peer_dependency(this, name, &version, err);
                                     } else {
                                         let age_gate_ms =
                                             this.options.minimum_release_age_ms.unwrap_or(0.0);
@@ -1145,19 +1147,13 @@ pub fn enqueue_dependency_with_main_and_success_fn(
                                                                 excludes,
                                                             )
                                                     {
-                                                        let package_name = this.lockfile.str(&name);
-                                                        let min_age_seconds = min_age_ms / MS_PER_S;
-                                                        let _ = this.log_mut().add_error_fmt(
-                                                            None,
-                                                            bun_ast::Loc::EMPTY,
-                                                            format_args!(
-                                                                "Version \"{}@{}\" was published within minimum release age of {} seconds",
-                                                                bstr::BStr::new(package_name),
-                                                                find_result.version.fmt(&loaded_manifest.as_ref().unwrap().string_buf),
-                                                                min_age_seconds,
-                                                            ),
-                                                        );
-                                                        return Ok(());
+                                                        // Reported by the `TooRecentVersion` arm above, like a fresh manifest would be.
+                                                        resolve_result_ =
+                                                            Err(crate::Error::TooRecentVersion);
+                                                        let _ = this
+                                                            .network_dedupe_map
+                                                            .remove(&task_id);
+                                                        continue 'retry_with_new_resolve_result;
                                                     }
                                                 }
                                                 // reshaped for borrowck — `find_result`
@@ -1737,21 +1733,37 @@ pub fn enqueue_dependency_with_main_and_success_fn(
 }
 
 /// Unmet peers stay unresolved instead of failing the install; see `may_stay_unresolved`.
+/// `err` is the `NoMatchingVersion` / `DistTagNotFound` / `TooRecentVersion` the lookup returned.
 #[cold]
 #[inline(never)]
 fn warn_unmet_peer_dependency(
     this: &PackageManager,
     name: SemverString,
     version: &dependency::Version,
+    err: crate::Error,
 ) {
-    bun_ast::add_warning_pretty!(
-        this.log_mut(),
-        None,
-        bun_ast::Loc::EMPTY,
-        "No version matching \"{}\" found for peer dependency \"{}\"<r> <d>(but package exists)<r>",
-        bstr::BStr::new(this.lockfile.str(&version.literal)),
-        bstr::BStr::new(this.lockfile.str(&name)),
-    );
+    let literal = bstr::BStr::new(this.lockfile.str(&version.literal));
+    let name = bstr::BStr::new(this.lockfile.str(&name));
+    if err == crate::Error::TooRecentVersion {
+        bun_ast::add_warning_pretty!(
+            this.log_mut(),
+            None,
+            bun_ast::Loc::EMPTY,
+            "No version matching \"{}\" found for peer dependency \"{}\"<r> <d>(blocked by minimum-release-age: {} seconds)<r>",
+            literal,
+            name,
+            this.options.minimum_release_age_ms.unwrap_or(0.0) / MS_PER_S,
+        );
+    } else {
+        bun_ast::add_warning_pretty!(
+            this.log_mut(),
+            None,
+            bun_ast::Loc::EMPTY,
+            "No version matching \"{}\" found for peer dependency \"{}\"<r> <d>(but package exists)<r>",
+            literal,
+            name,
+        );
+    }
 }
 
 /// `enqueue_local_tarball` would read the path relative to the project, not to the declarer.
@@ -2645,6 +2657,10 @@ fn get_or_put_resolved_package(
                     match err_type {
                         Npm::FindVersionError::TooRecent
                         | Npm::FindVersionError::AllVersionsTooRecent => {
+                            // The peer pass may still bind it to a same-named package in the tree.
+                            if behavior.is_peer() && !install_peer {
+                                return Ok(None);
+                            }
                             return Err(crate::Error::TooRecentVersion);
                         }
                         Npm::FindVersionError::NotFound => None, // Handle below with existing logic
diff --git a/test/cli/install/minimum-release-age.test.ts b/test/cli/install/minimum-release-age.test.ts
index c4c115fd091e..1bbaa11885bc 100644
--- a/test/cli/install/minimum-release-age.test.ts
+++ b/test/cli/install/minimum-release-age.test.ts
@@ -3,6 +3,7 @@ import { afterAll, beforeAll, describe, expect, setDefaultTimeout, test } from "
 import { bunEnv, bunExe, normalizeBunSnapshot, tempDir } from "harness";
 import { rmSync } from "node:fs";
 import { join } from "node:path";
+import { readdir, rm } from "node:fs/promises";
 
 // These tests drive real `bun install` runs against a mock registry, which is
 // slow under the debug/ASAN build — give them the same generous timeout the
@@ -2941,6 +2942,284 @@ describe("minimum-release-age", () => {
     });
   });
 
+  // A required peer that nothing in the tree provides and that no published
+  // version satisfies only warns and stays unresolved (bun-lock.test.ts, "peer
+  // no published version satisfies"). A peer whose satisfying versions are all
+  // blocked by the age gate has to end up the same way on every path that can
+  // report the blocked lookup, and each of those paths has to give the other
+  // dependency kinds the same answer as well.
+  describe("every satisfying version blocked", () => {
+    const AGE_GATE = 3 * SECONDS_PER_DAY;
+    const blockedSuffix = `(blocked by minimum-release-age: ${AGE_GATE} seconds)`;
+    const blockedPeerWarning = (range: string, name = "gated") =>
+      `warn: No version matching "${range}" found for peer dependency "${name}" ${blockedSuffix}`;
+
+    // gated@2.0.0 is the only version the dependencies below accept and it is
+    // inside the age window; every version of `fresh` is inside it.
+    const registryPackages: Record<
+      string,
+      { time: Record<string, string>; peerDependencies?: Record<string, string> }
+    > = {
+      gated: { time: { "1.0.0": daysAgo(30), "2.0.0": daysAgo(1) } },
+      fresh: { time: { "1.0.0": daysAgo(1) } },
+      "needs-gated": { time: { "1.0.0": daysAgo(30) }, peerDependencies: { gated: "^2.0.0" } },
+    };
+
+    function serveRegistry() {
+      const requests: string[] = [];
+      const server = Bun.serve({
+        port: 0,
+        fetch(req) {
+          const { origin, pathname } = new URL(req.url);
+          requests.push(pathname);
+          const tarball = pathname.match(/^\/([^/]+)\/-\/\1-(\d+\.\d+\.\d+)\.tgz$/);
+          if (tarball) return new Response(createTarball(tarball[1], tarball[2]));
+          const name = pathname.slice(1);
+          const pkg = registryPackages[name];
+          if (!pkg) return new Response("Not Found", { status: 404 });
+          const versions: Record<string, unknown> = {};
+          for (const version of Object.keys(pkg.time)) {
+            versions[version] = {
+              name,
+              version,
+              dist: { tarball: `${origin}/${name}/-/${name}-${version}.tgz` },
+              peerDependencies: pkg.peerDependencies,
+            };
+          }
+          return Response.json({
+            name,
+            "dist-tags": { latest: Object.keys(pkg.time).at(-1) },
+            versions,
+            time: pkg.time,
+          });
+        },
+      });
+      return {
+        origin: server.url.origin,
+        requests,
+        [Symbol.dispose]() {
+          server.stop(true);
+        },
+      };
+    }
+
+    function createProject(registryOrigin: string, files: Record<string, string>) {
+      return tempDir("age-gated-peer", { ...files, ".npmrc": `registry=${registryOrigin}` });
+    }
+
+    async function install(dir: string, { args = [] as string[], env = {} as Record<string, string> } = {}) {
+      await using proc = Bun.spawn({
+        cmd: [bunExe(), "install", "--minimum-release-age", `${AGE_GATE}`, ...args],
+        cwd: dir,
+        // One manifest/tarball cache per project, so the second install of a
+        // test sees exactly what its first install cached.
+        env: { ...bunEnv, BUN_INSTALL_CACHE_DIR: `${dir}/.bun-cache`, ...env },
+        stdout: "ignore",
+        stderr: "pipe",
+      });
+      const [stderr, exitCode] = await Promise.all([proc.stderr.text(), proc.exited]);
+      return { stderr, exitCode };
+    }
+
+    async function reResolve(dir: string) {
+      await rm(`${dir}/bun.lock`, { force: true });
+      await rm(`${dir}/node_modules`, { recursive: true, force: true });
+    }
+
+    type InstallOptions = Parameters<typeof install>[1];
+    type InstallResult = Awaited<ReturnType<typeof install>>;
+
+    // `bun install` writes fetched manifests to the cache from a background
+    // thread and does not wait for that on exit, so a small install can finish
+    // before its manifests are on disk. Resolve from scratch until `manifests`
+    // of them are; every run has to produce the same result.
+    async function installUntilManifestsCached(
+      dir: string,
+      manifests: number,
+      expectResult: (result: InstallResult) => void,
+      options?: InstallOptions,
+    ) {
+      for (let attempt = 0; ; attempt++) {
+        expectResult(await install(dir, options));
+        const cached = (await readdir(`${dir}/.bun-cache`).catch((): string[] => [])).filter(name =>
+          name.endsWith(".npm"),
+        );
+        if (cached.length >= manifests) return;
+        if (attempt === 20) throw new Error(`only ${cached.length} of ${manifests} manifests were cached`);
+        await reResolve(dir);
+      }
+    }
+
+    test.concurrent("peer declared by a registry package", async () => {
+      using registry = serveRegistry();
+      using dir = createProject(registry.origin, {
+        "package.json": JSON.stringify({ name: "app", dependencies: { "needs-gated": "1.0.0" } }),
+      });
+
+      let { stderr, exitCode } = await install(String(dir));
+      expect(stderr).toContain(blockedPeerWarning("^2.0.0"));
+      expect(stderr).not.toContain("error:");
+      expect(exitCode).toBe(0);
+      expect(await Bun.file(`${dir}/node_modules/needs-gated/package.json`).exists()).toBeTrue();
+      expect(await Bun.file(`${dir}/node_modules/gated/package.json`).exists()).toBeFalse();
+      const lockfile = await Bun.file(`${dir}/bun.lock`).text();
+      expect(lockfile.replaceAll(registry.origin, "<registry>")).toMatchInlineSnapshot(`
+        "{
+          "lockfileVersion": 1,
+          "configVersion": 1,
+          "workspaces": {
+            "": {
+              "name": "app",
+              "dependencies": {
+                "needs-gated": "1.0.0",
+              },
+            },
+          },
+          "packages": {
+            "needs-gated": ["needs-gated@1.0.0", "<registry>/needs-gated/-/needs-gated-1.0.0.tgz", { "peerDependencies": { "gated": "^2.0.0" } }, ""],
+          }
+        }
+        "
+      `);
+
+      ({ stderr, exitCode } = await install(String(dir), { args: ["--frozen-lockfile"] }));
+      expect(stderr).not.toContain("error:");
+      expect(exitCode).toBe(0);
+      expect(await Bun.file(`${dir}/bun.lock`).text()).toBe(lockfile);
+    });
+
+    test.concurrent("peers declared by the root package and a workspace (range, exact pin, dist-tag)", async () => {
+      using registry = serveRegistry();
+      using dir = createProject(registry.origin, {
+        "package.json": JSON.stringify({
+          name: "app",
+          workspaces: ["packages/*"],
+          peerDependencies: { gated: "^2.0.0", fresh: "latest" },
+        }),
+        "packages/ws/package.json": JSON.stringify({ name: "ws", peerDependencies: { gated: "2.0.0" } }),
+      });
+
+      let { stderr, exitCode } = await install(String(dir));
+      expect(stderr).toContain(blockedPeerWarning("^2.0.0"));
+      expect(stderr).toContain(blockedPeerWarning("2.0.0"));
+      expect(stderr).toContain(blockedPeerWarning("latest", "fresh"));
+      expect(stderr).not.toContain("error:");
+      expect(exitCode).toBe(0);
+      const lockfile = await Bun.file(`${dir}/bun.lock`).text();
+      expect(lockfile).toMatchInlineSnapshot(`
+        "{
+          "lockfileVersion": 2,
+          "configVersion": 1,
+          "workspaces": {
+            "": {
+              "name": "app",
+              "peerDependencies": {
+                "fresh": "latest",
+                "gated": "^2.0.0",
+              },
+            },
+            "packages/ws": {
+              "name": "ws",
+              "peerDependencies": {
+                "gated": "2.0.0",
+              },
+            },
+          },
+          "packages": {
+            "ws": ["ws@workspace:packages/ws"],
+          }
+        }
+        "
+      `);
+
+      ({ stderr, exitCode } = await install(String(dir), { args: ["--frozen-lockfile"] }));
+      expect(stderr).not.toContain("error:");
+      expect(exitCode).toBe(0);
+      expect(await Bun.file(`${dir}/bun.lock`).text()).toBe(lockfile);
+    });
+
+    // An exact pin whose cached manifest has expired is answered from that
+    // manifest instead of being looked up again, which is a separate place the
+    // blocked version gets reported from. BUN_MANIFEST_CACHE=1 keeps writing
+    // the cache but treats everything in it as expired, so the second install
+    // of `gated@2.0.0` (declared as `group`) takes that path; it has to say the
+    // same thing the first install said from the fresh manifest.
+    const staleManifests = { env: { BUN_MANIFEST_CACHE: "1" } };
+    async function expectSameAnswerFromExpiredManifest(
+      group: "dependencies" | "optionalDependencies" | "peerDependencies",
+      expectResult: (result: InstallResult) => void,
+    ) {
+      using registry = serveRegistry();
+      using dir = createProject(registry.origin, {
+        "package.json": JSON.stringify({ name: "app", [group]: { gated: "2.0.0" } }),
+      });
+
+      await installUntilManifestsCached(String(dir), 1, expectResult, staleManifests);
+      expect(registry.requests).toContain("/gated");
+
+      await reResolve(String(dir));
+      registry.requests.length = 0;
+      expectResult(await install(String(dir), staleManifests));
+      expect(registry.requests).toEqual([]);
+    }
+
+    test.concurrent("peer exact pin answered from an expired cached manifest", async () => {
+      await expectSameAnswerFromExpiredManifest("peerDependencies", ({ stderr, exitCode }) => {
+        expect(stderr).toContain(blockedPeerWarning("2.0.0"));
+        expect(stderr).not.toContain("error:");
+        expect(exitCode).toBe(0);
+      });
+    });
+
+    test.concurrent("regular exact pin answered from an expired cached manifest", async () => {
+      await expectSameAnswerFromExpiredManifest("dependencies", ({ stderr, exitCode }) => {
+        expect(stderr).toContain(`error: No version matching`);
+        expect(stderr).toContain(blockedSuffix);
+        expect(exitCode).toBe(1);
+      });
+    });
+
+    test.concurrent("optional exact pin answered from an expired cached manifest", async () => {
+      await expectSameAnswerFromExpiredManifest("optionalDependencies", ({ stderr, exitCode }) => {
+        expect(stderr).not.toContain("error:");
+        expect(exitCode).toBe(0);
+      });
+    });
+
+    test.concurrent(
+      "peer bound to the version already in the tree, with and without a warm manifest cache",
+      async () => {
+        using registry = serveRegistry();
+        using dir = createProject(registry.origin, {
+          "package.json": JSON.stringify({
+            name: "app",
+            dependencies: { gated: "^1.0.0", "needs-gated": "1.0.0" },
+          }),
+        });
+
+        const expectBoundToInstalledVersion = ({ stderr, exitCode }: InstallResult) => {
+          expect(stderr).toContain('warn: incorrect peer dependency "gated@1.0.0"');
+          expect(stderr).not.toContain("blocked by minimum-release-age");
+          expect(stderr).not.toContain("error:");
+          expect(exitCode).toBe(0);
+        };
+
+        await installUntilManifestsCached(String(dir), 2, expectBoundToInstalledVersion);
+        const lockfile = await Bun.file(`${dir}/bun.lock`).text();
+        expect(lockfile).toContain('"gated@1.0.0"');
+
+        // With both manifests in the cache the peer is looked up synchronously
+        // while regular dependencies are still being resolved, before the pass
+        // that binds peers to what the tree contains.
+        await reResolve(String(dir));
+        registry.requests.length = 0;
+        expectBoundToInstalledVersion(await install(String(dir)));
+        expect(registry.requests).toEqual([]);
+        expect(await Bun.file(`${dir}/bun.lock`).text()).toBe(lockfile);
+      },
+    );
+  });
+
   describe("clock skew scenarios", () => {
     test("handles packages with future timestamps", async () => {
       using dir = tempDir("future-timestamp", {

From 65321d0dd07f7af0b34c4c3e9c5ef9eaea50ad8b Mon Sep 17 00:00:00 2001
From: robobun <117481402+robobun@users.noreply.github.com>
Date: Mon, 17 Aug 2026 03:02:19 +0000
Subject: [PATCH 167/258] semver: record cloned prerelease/build tag offsets
 against the whole destination buffer (#38687)

---
 src/install/PackageManager.rs                 |  9 ++--
 .../PackageManagerResolution.rs               | 17 +------
 src/semver/Version.rs                         | 49 +++++++------------
 test/cli/install/bun-update.test.ts           | 20 ++++++++
 4 files changed, 42 insertions(+), 53 deletions(-)

diff --git a/src/install/PackageManager.rs b/src/install/PackageManager.rs
index 3a195d9070f2..5a367ed55f79 100644
--- a/src/install/PackageManager.rs
+++ b/src/install/PackageManager.rs
@@ -605,11 +605,10 @@ pub struct PackageUpdateInfo {
 impl PackageUpdateInfo {
     /// `version`'s tag strings live in `buf` (a lockfile string buffer that cleaning rebuilds), so the original keeps its own copy of them.
     pub(crate) fn set_original_version(&mut self, version: Semver::Version, buf: &[u8]) {
-        let mut tag_buf =
-            vec![0u8; version.tag.pre.len() + version.tag.build.len()].into_boxed_slice();
-        let mut cursor: &mut [u8] = &mut tag_buf;
-        self.original_version = Some(version.clone_into(buf, &mut cursor));
-        self.original_version_string_buf = tag_buf;
+        // clone because the lockfile buffer may reallocate
+        let mut tag_buf = Vec::new();
+        self.original_version = Some(version.clone_into(buf, &mut tag_buf));
+        self.original_version_string_buf = tag_buf.into_boxed_slice();
     }
 }
 
diff --git a/src/install/PackageManager/PackageManagerResolution.rs b/src/install/PackageManager/PackageManagerResolution.rs
index 2237bcd90a9e..ce6165dbef47 100644
--- a/src/install/PackageManager/PackageManagerResolution.rs
+++ b/src/install/PackageManager/PackageManagerResolution.rs
@@ -140,23 +140,8 @@ impl PackageManager {
             if !parsed.valid || parsed.wildcard != semver::query::Wildcard::None {
                 continue;
             }
-            // not handling OOM
             // TODO: wildcard
-            let mut version = parsed.version.min();
-            let total = (version.tag.build.len() + version.tag.pre.len()) as usize;
-            if total > 0 {
-                let len_before = tags_buf.len();
-                // `clone_into` writes exactly `total` bytes (build.len + pre.len)
-                // into `available` and advances it; zero-fill the tail first so
-                // we can hand it out as a safe `&mut [u8]` instead of slicing
-                // raw spare capacity.
-                tags_buf.resize(len_before + total, 0);
-                let mut available = &mut tags_buf[len_before..];
-                let new_version = version.clone_into(name, &mut available);
-                version = new_version;
-            }
-
-            list.push(version);
+            list.push(parsed.version.min().clone_into(name, tags_buf));
         }
 
         Ok(list)
diff --git a/src/semver/Version.rs b/src/semver/Version.rs
index f87b8a231f80..91bc25bd766a 100644
--- a/src/semver/Version.rs
+++ b/src/semver/Version.rs
@@ -114,13 +114,16 @@ impl<T: VersionInt> VersionType<T> {
         Self::parse(SlicedString { buf: slice, slice })
     }
 
-    pub fn clone_into(self, slice: &[u8], buf: &mut &mut [u8]) -> Self {
+    /// Copies the pre/build tag strings out of `buf` (the buffer `self` was
+    /// parsed against) onto the end of `dest`. The returned version slices
+    /// against the whole of `dest`.
+    pub fn clone_into(self, buf: &[u8], dest: &mut Vec<u8>) -> Self {
         Self {
             major: self.major,
             minor: self.minor,
             patch: self.patch,
             _tag_padding: Default::default(),
-            tag: self.tag.clone_into(slice, buf),
+            tag: self.tag.clone_into(buf, dest),
         }
     }
 
@@ -1011,39 +1014,21 @@ impl Tag {
         self.pre.order(&rhs.pre, lhs_buf, rhs_buf)
     }
 
-    pub fn clone_into(self, slice: &[u8], buf: &mut &mut [u8]) -> Tag {
-        let pre: SemverString;
-        let build: SemverString;
-
-        if self.pre.is_inline() {
-            pre = self.pre.value;
-        } else {
-            let pre_slice = self.pre.slice(slice);
-            buf[..pre_slice.len()].copy_from_slice(pre_slice);
-            // reshaped for borrowck —
-            // capture the init args before advancing `buf`.
-            pre = SemverString::init(buf, &buf[0..pre_slice.len()]);
-            *buf = &mut core::mem::take(buf)[pre_slice.len()..];
+    /// See `VersionType::clone_into`.
+    pub(crate) fn clone_into(self, buf: &[u8], dest: &mut Vec<u8>) -> Tag {
+        Tag {
+            pre: Self::clone_string_into(self.pre, buf, dest),
+            build: Self::clone_string_into(self.build, buf, dest),
         }
+    }
 
-        if self.build.is_inline() {
-            build = self.build.value;
-        } else {
-            let build_slice = self.build.slice(slice);
-            buf[..build_slice.len()].copy_from_slice(build_slice);
-            build = SemverString::init(buf, &buf[0..build_slice.len()]);
-            *buf = &mut core::mem::take(buf)[build_slice.len()..];
+    fn clone_string_into(str: ExternalString, buf: &[u8], dest: &mut Vec<u8>) -> ExternalString {
+        if str.is_inline() {
+            return str;
         }
-
-        Tag {
-            pre: ExternalString {
-                value: pre,
-                hash: self.pre.hash,
-            },
-            build: ExternalString {
-                value: build,
-                hash: self.build.hash,
-            },
+        ExternalString {
+            value: bun_core::handle_oom(SemverString::init_append_if_needed(dest, str.slice(buf))),
+            hash: str.hash,
         }
     }
 
diff --git a/test/cli/install/bun-update.test.ts b/test/cli/install/bun-update.test.ts
index 21a0a9e23553..95f190e585eb 100644
--- a/test/cli/install/bun-update.test.ts
+++ b/test/cli/install/bun-update.test.ts
@@ -1401,6 +1401,26 @@ it("should print UTF-8 arrows correctly with colors enabled", async () => {
   expect(await exited2).toBe(0);
 });
 
+// The previous version in the "^ name old -> new" line is copied out of the old
+// lockfile before it is rebuilt. Tags longer than 8 bytes are stored as offsets
+// into that copy, so use a prerelease tag and a build tag that are both longer.
+it("should print the previous prerelease and build tags in the update summary", async () => {
+  const urls: string[] = [];
+  const oldVersion = "1.0.0-canary.20240101+build.20240101";
+  const newVersion = "1.0.0-canary.20240102+build.20240102";
+  // `as` serves the existing baz tarballs for these versions.
+  setHandler(dummyRegistry(urls, { [oldVersion]: { as: "0.0.3" }, latest: oldVersion }));
+  await writeFile(
+    join(package_dir, "package.json"),
+    JSON.stringify({ name: "foo", dependencies: { baz: "^1.0.0-canary.20240101" } }),
+  );
+  expect(await runInPackageDir("install", "--linker=hoisted")).toContain(`+ baz@${oldVersion}`);
+
+  setHandler(dummyRegistry(urls, { [oldVersion]: { as: "0.0.3" }, [newVersion]: { as: "0.0.5" }, latest: newVersion }));
+  const out = await runInPackageDir("update", "--linker=hoisted");
+  expect(out).toContain(`^ baz ${oldVersion} -> ${newVersion}`);
+});
+
 type PerNameManifests = Record<
   string,
   { versions: Record<string, { dependencies?: Record<string, string> }>; latest: string }

From 007e7c5d4a5c4425875c62cc8c7b8bcd64f566e7 Mon Sep 17 00:00:00 2001
From: robobun <117481402+robobun@users.noreply.github.com>
Date: Mon, 17 Aug 2026 03:05:53 +0000
Subject: [PATCH 168/258] auto-install: report why a root dependency could not
 be resolved (#38180)

---
 src/install/PackageManager.rs                 |  38 +--
 .../PackageManager/PackageManagerEnqueue.rs   |  65 ++----
 .../PackageManager/processDependencyList.rs   |   1 -
 src/install_types/lib.rs                      |   2 +-
 src/install_types/resolver_hooks.rs           |  48 +---
 src/jsc/AsyncModule.rs                        |  81 +------
 src/jsc/VirtualMachine.rs                     |  36 ++-
 src/runtime/jsc_hooks.rs                      |  30 +--
 test/cli/run/run-autoinstall.test.ts          | 219 ++++++++++++++++++
 test/js/bun/resolve/resolve-error.test.ts     |  32 ++-
 10 files changed, 336 insertions(+), 216 deletions(-)

diff --git a/src/install/PackageManager.rs b/src/install/PackageManager.rs
index 5a367ed55f79..cfe34b94a262 100644
--- a/src/install/PackageManager.rs
+++ b/src/install/PackageManager.rs
@@ -184,9 +184,8 @@ use crate::resolvers::folder_resolver::{
 };
 use bun_install::lockfile::{self, Lockfile};
 use bun_install::{
-    Dependency, DependencyID, NetworkTask, PackageID, PackageManifestMap,
-    PackageNameAndVersionHash, PackageNameHash, PatchTask, PreinstallState, TaskCallbackContext,
-    initialize_store,
+    DependencyID, NetworkTask, PackageID, PackageManifestMap, PackageNameAndVersionHash,
+    PackageNameHash, PatchTask, PreinstallState, TaskCallbackContext, initialize_store,
 };
 
 // ──────────────────────────────────────────────────────────────────────────
@@ -284,7 +283,6 @@ pub type PatchTaskQueue = UnboundedQueue<PatchTask /* , .next */>;
 pub type AsyncNetworkTaskQueue = UnboundedQueue<NetworkTask /* , .next */>;
 
 pub(crate) type SuccessFn = fn(&mut PackageManager, DependencyID, PackageID);
-pub(crate) type FailFn = fn(&mut PackageManager, &Dependency, PackageID, Error);
 
 // Default to a maximum of 64 simultaneous HTTP requests for bun install if no proxy is specified
 // if a proxy IS specified, default to 64. We have different values because we might change this in the future.
@@ -645,7 +643,7 @@ pub enum TrackInstalledBin {
     Basename(Box<[u8]>),
 }
 
-// MOVE_DOWN: data struct + accessors live in `bun_install_types::WakeHandler`
+// MOVE_DOWN: the data struct lives in `bun_install_types::WakeHandler`
 // (single definition the resolver also stores). The `handler` second arg is
 // erased to `*mut c_void` there because that crate cannot name
 // `PackageManager`; `wake_raw()` casts it back at the call site.
@@ -915,26 +913,6 @@ impl PackageManager {
         self.env().get_tls_reject_unauthorized()
     }
 
-    pub(crate) fn fail_root_resolution(
-        &mut self,
-        dependency: &Dependency,
-        dependency_id: DependencyID,
-        err: Error,
-    ) {
-        if let Some(ctx) = self.on_wake.context {
-            // SAFETY: `ctx` is the `WakeHandler::context` registered alongside
-            // this callback (a live `*mut Queue`); see `runtime::jsc_hooks`.
-            unsafe {
-                (self.on_wake.get_on_dependency_error())(
-                    ctx.as_ptr(),
-                    dependency,
-                    dependency_id,
-                    err.name(),
-                );
-            }
-        }
-    }
-
     /// Raw-pointer wake for concurrent task-thread callers (see
     /// `isolated_install::Installer::Task::callback`). Never materializes
     /// `&mut PackageManager`, so two task threads finishing simultaneously do
@@ -951,12 +929,10 @@ impl PackageManager {
         // only form field pointers via `addr_of!`/`addr_of_mut!` (no whole-struct
         // borrow) and `wakeup()` is internally synchronized for cross-thread use.
         unsafe {
-            let on_wake = &*core::ptr::addr_of!((*this).on_wake);
-            if let Some(ctx) = on_wake.context {
-                // `WakeHandler.handler`'s second arg is the erased
-                // `*mut PackageManager` (`bun_install_types` cannot name this
-                // type); cast back to `*mut c_void` here.
-                (on_wake.get_handler())(ctx.as_ptr(), this.cast::<c_void>());
+            if let Some(wake) = (*core::ptr::addr_of!((*this).on_wake)).0 {
+                // `handler`'s second arg is the erased `*mut PackageManager`
+                // (`bun_install_types` cannot name this type).
+                (wake.handler)(wake.context.as_ptr(), this.cast::<c_void>());
             }
             (*core::ptr::addr_of_mut!((*this).event_loop)).wakeup();
         }
diff --git a/src/install/PackageManager/PackageManagerEnqueue.rs b/src/install/PackageManager/PackageManagerEnqueue.rs
index 10cadfddaa8b..83f6ba389307 100644
--- a/src/install/PackageManager/PackageManagerEnqueue.rs
+++ b/src/install/PackageManager/PackageManagerEnqueue.rs
@@ -20,7 +20,7 @@ use crate::lockfile::PackageIndexEntry;
 use crate::lockfile::package::Package;
 use crate::lockfile_real as Lockfile;
 use crate::package_manager_real::{
-    self, FailFn, PackageManager, SuccessFn, TaskCallbackList, determine_preinstall_state,
+    self, PackageManager, SuccessFn, TaskCallbackList, determine_preinstall_state,
     get_cache_directory, get_preinstall_state, get_temporary_directory, run_tasks,
     set_preinstall_state,
 };
@@ -50,15 +50,6 @@ fn verbose_install() -> bool {
 // `PatchTask.callback` discriminant — routed to the real
 // `patch_install::Callback` enum (CalcHash / Apply).
 
-// `SuccessFn` / `FailFn` are bare `fn(&mut PackageManager, ...)` pointers; the
-// real bodies are inherent methods, so reference them via the type path.
-#[allow(non_upper_case_globals)]
-const assign_resolution: SuccessFn = PackageManager::assign_resolution;
-#[allow(non_upper_case_globals)]
-const assign_root_resolution: SuccessFn = PackageManager::assign_root_resolution;
-#[allow(non_upper_case_globals)]
-const fail_root_resolution: FailFn = PackageManager::fail_root_resolution;
-
 // The `use package_manager_real::PackageManager`
 // above already pulls the `declare_scope!`-generated `static PackageManager: ScopedLogger`
 // (value namespace) alongside the struct (type namespace), so re-declaring it here
@@ -85,8 +76,7 @@ pub fn enqueue_dependency_with_main(
         dependency,
         resolution,
         install_peer,
-        assign_resolution,
-        None,
+        PackageManager::assign_resolution,
         false,
     )
 }
@@ -462,8 +452,7 @@ pub fn enqueue_dependency_to_root(
             &dependency,
             invalid_package_id,
             false,
-            assign_root_resolution,
-            Some(fail_root_resolution),
+            PackageManager::assign_root_resolution,
             true,
         ) {
             return DependencyToEnqueue::Failure(err);
@@ -645,12 +634,10 @@ pub fn enqueue_dependency_with_main_and_success_fn(
     resolution: PackageID,
     install_peer: bool,
     success_fn: SuccessFn,
-    fail_fn: Option<FailFn>,
-    // The two `SuccessFn` candidates
-    // (`assign_resolution` / `assign_root_resolution`) have byte-identical
-    // bodies in release builds, so Apple ld64 (which ignores `.llvm_addrsig`)
-    // folds them and a runtime fn-pointer address comparison is unsound. Thread
-    // an explicit flag instead.
+    // True for runtime auto-install's root enqueues
+    // (`enqueue_dependency_to_root`): their resolution errors go to `this.log`
+    // instead of propagating. An explicit flag, not a `success_fn` address
+    // comparison: the linker may fold the byte-identical fn bodies.
     is_root: bool,
 ) -> crate::Result<()> {
     if dependency.behavior.is_optional_peer() {
@@ -798,10 +785,6 @@ pub fn enqueue_dependency_with_main_and_success_fn(
         }
     };
     if let Some(invalid_name) = invalid_name {
-        if let Some(fail) = fail_fn {
-            fail(this, dependency, id, crate::Error::InvalidDependencyName);
-            return Ok(());
-        }
         let name = bun_fmt::escape_control_chars(invalid_name);
         if dependency.behavior.is_required() {
             this.log_mut().add_error_fmt(
@@ -846,9 +829,7 @@ pub fn enqueue_dependency_with_main_and_success_fn(
                         Err(err) => {
                             if err == crate::Error::DistTagNotFound {
                                 if dependency.behavior.is_required() {
-                                    if let Some(fail) = fail_fn {
-                                        fail(this, dependency, id, err);
-                                    } else if dependency.behavior.is_peer() {
+                                    if dependency.behavior.is_peer() {
                                         warn_unmet_peer_dependency(this, name, &version, err);
                                     } else {
                                         this.log_mut()
@@ -862,15 +843,14 @@ pub fn enqueue_dependency_with_main_and_success_fn(
                                                         this.lockfile.str(&version.dist_tag().tag)
                                                     ),
                                                 ),
-                                            );
+                                            ),
+                                        );
                                     }
                                 }
                                 return Ok(());
                             } else if err == crate::Error::NoMatchingVersion {
                                 if dependency.behavior.is_required() {
-                                    if let Some(fail) = fail_fn {
-                                        fail(this, dependency, id, err);
-                                    } else if dependency.behavior.is_peer() {
+                                    if dependency.behavior.is_peer() {
                                         warn_unmet_peer_dependency(this, name, &version, err);
                                     } else {
                                         bun_ast::add_error_pretty!(
@@ -888,9 +868,7 @@ pub fn enqueue_dependency_with_main_and_success_fn(
                                 return Ok(());
                             } else if err == crate::Error::TooRecentVersion {
                                 if dependency.behavior.is_required() {
-                                    if let Some(fail) = fail_fn {
-                                        fail(this, dependency, id, err);
-                                    } else if dependency.behavior.is_peer() {
+                                    if dependency.behavior.is_peer() {
                                         warn_unmet_peer_dependency(this, name, &version, err);
                                     } else {
                                         let age_gate_ms =
@@ -927,9 +905,7 @@ pub fn enqueue_dependency_with_main_and_success_fn(
                                 return Ok(());
                             } else if err == crate::Error::MissingPackageJSON {
                                 if dependency.behavior.is_required() {
-                                    if let Some(fail) = fail_fn {
-                                        fail(this, dependency, id, err);
-                                    } else if version.tag == dependency::version::Tag::Folder {
+                                    if version.tag == dependency::version::Tag::Folder {
                                         this.log_mut()
                     .add_error_fmt(
                                                 None,
@@ -954,11 +930,18 @@ pub fn enqueue_dependency_with_main_and_success_fn(
                                     }
                                 }
                                 return Ok(());
+                            } else if is_root {
+                                this.log_mut().add_error_fmt(
+                                    None,
+                                    bun_ast::Loc::EMPTY,
+                                    format_args!(
+                                        "{} while resolving package \"{}\"",
+                                        err.name(),
+                                        bun_fmt::escape_control_chars(this.lockfile.str(&name)),
+                                    ),
+                                );
+                                return Ok(());
                             } else {
-                                if let Some(fail) = fail_fn {
-                                    fail(this, dependency, id, err);
-                                    return Ok(());
-                                }
                                 return Err(err);
                             }
                         }
diff --git a/src/install/PackageManager/processDependencyList.rs b/src/install/PackageManager/processDependencyList.rs
index 0b6c92a44d3b..61370bd89688 100644
--- a/src/install/PackageManager/processDependencyList.rs
+++ b/src/install/PackageManager/processDependencyList.rs
@@ -365,7 +365,6 @@ impl PackageManager {
                     resolution,
                     install_peer,
                     pm_resolution::assign_root_resolution,
-                    Some(PackageManager::fail_root_resolution),
                     true,
                 )?;
                 if let Some(ptr) = any_root {
diff --git a/src/install_types/lib.rs b/src/install_types/lib.rs
index 7b6731bf0159..73348f932c71 100644
--- a/src/install_types/lib.rs
+++ b/src/install_types/lib.rs
@@ -11,7 +11,7 @@ pub use resolver_hooks::{
     NegatableEnum, NegatableExt, NpmInfo, OperatingSystem, PackageID, PackageJsonView,
     PackageNameHash, PreinstallState, Repository, Resolution, ResolutionSlice, ResolutionTag,
     ResolutionValue, TagInfo, TarballInfo, TaskCallbackContext, TruncatedPackageNameHash, URI,
-    VersionSlice, VersionedURL, VersionedURLType, WakeHandler,
+    VersionSlice, VersionedURL, VersionedURLType, WakeHandler, WakeTarget,
 };
 
 // The canonical ExternalString / SlicedString / SemverString definitions live
diff --git a/src/install_types/resolver_hooks.rs b/src/install_types/resolver_hooks.rs
index 7ab83e481d40..30b8da9f2910 100644
--- a/src/install_types/resolver_hooks.rs
+++ b/src/install_types/resolver_hooks.rs
@@ -1295,45 +1295,21 @@ pub struct TaskCallbackContext {
     pub root_request_id: u32,
 }
 
-/// Opaque
-/// (ctx-ptr + 2 fn-ptrs) handle the runtime installs to nudge the JS event
-/// loop when a network task completes. The resolver only stores and forwards
-/// it; the fields are `Option` so `Default` is all-None.
-///
-/// `handler`'s second parameter (`*PackageManager`) is erased to
-/// `*mut c_void` because that concrete type lives in `bun_install` (a higher
-/// tier); `bun_install::PackageManager::wake` casts at the call site.
-/// `on_dependency_error`'s `Dependency` parameter is *not* erased — the type
-/// lives in this crate — so callers pass the borrow directly.
+/// Opaque (ctx-ptr + fn-ptr) handle the runtime installs to nudge the JS
+/// event loop when a network task completes. The resolver only stores and
+/// forwards it; `Default` is unregistered (`None`).
 // Clone: bitwise OK — `context` is a non-owning opaque backref the runtime
-// installed; the handler fn-ptrs are POD.
+// installed; the fn-ptr is POD.
 #[derive(Default, Copy, Clone)]
-pub struct WakeHandler {
-    pub context: Option<NonNull<c_void>>,
-    pub handler: Option<fn(*mut c_void, *mut c_void)>,
-    pub on_dependency_error:
-        Option<unsafe fn(*mut c_void, &Dependency, DependencyID, &'static str)>,
-}
-
-impl WakeHandler {
-    #[inline]
-    pub fn get_handler(&self) -> fn(*mut c_void, *mut c_void) {
-        // `handler` is Some whenever `context` is Some: the sole installer
-        // (runtime::jsc_hooks) sets `context`, `handler`, and
-        // `on_dependency_error` together in one struct literal, and callers
-        // gate on `context.is_some()` before invoking — so this unwrap cannot
-        // fire.
-        self.handler.unwrap()
-    }
+pub struct WakeHandler(pub Option<WakeTarget>);
 
-    #[inline]
-    pub fn get_on_dependency_error(
-        &self,
-    ) -> unsafe fn(*mut c_void, &Dependency, DependencyID, &'static str) {
-        // Same invariant as `get_handler`: set together with `context` by the
-        // sole installer; callers gate on `context.is_some()`.
-        self.on_dependency_error.unwrap()
-    }
+/// `handler`'s second parameter (`*PackageManager`) is erased to
+/// `*mut c_void` because that concrete type lives in `bun_install` (a higher
+/// tier); `bun_install::PackageManager::wake_raw` casts at the call site.
+#[derive(Copy, Clone)]
+pub struct WakeTarget {
+    pub context: NonNull<c_void>,
+    pub handler: fn(*mut c_void, *mut c_void),
 }
 
 // ─── DependencyGroup (lockfile::Package::DependencyGroup) ─────────────────
diff --git a/src/jsc/AsyncModule.rs b/src/jsc/AsyncModule.rs
index 3fe4d6d081ab..6ffd0805dbd8 100644
--- a/src/jsc/AsyncModule.rs
+++ b/src/jsc/AsyncModule.rs
@@ -3,8 +3,7 @@ use core::ffi::c_void;
 use bun_alloc::Arena as ArenaAllocator;
 use bun_bundler::transpiler::ParseResult;
 use bun_core::{OwnedString, String as BunString, ZigString};
-use bun_install::dependency::Dependency;
-use bun_install::{DependencyID, Resolution};
+use bun_install::Resolution;
 use bun_io::KeepAlive;
 use bun_resolver::fs as Fs;
 
@@ -72,11 +71,10 @@ pub struct Queue {
     pub(crate) scheduled: u32,
 }
 
-/// What the resolver's `WakeHandler` carries as its opaque context: the
-/// module queue (for the JS-thread dependency-error callback) and the VM's
-/// weak handle (for wake-ups from the process-wide install / HTTP threads,
-/// which outlive any one VM). Allocated once per VM at registration and kept
-/// for the VM's lifetime.
+/// The resolver `WakeHandler`'s opaque context: the module queue plus the
+/// VM's weak handle the process-wide install / HTTP threads (which outlive
+/// any one VM) post the poll task through. Allocated once per VM at
+/// registration and kept for the VM's lifetime.
 pub struct WakeContext {
     pub queue: *mut Queue,
     pub handle: crate::VmHandle,
@@ -323,59 +321,6 @@ impl Queue {
         self.vm().package_manager().drain_dependency_list();
     }
 
-    /// # Safety
-    /// `ctx` must point to a live [`Queue`] (the `WakeHandler::context`
-    /// registered in `runtime::jsc_hooks`).
-    pub unsafe fn on_dependency_error(
-        ctx: *mut c_void,
-        dependency: &Dependency,
-        root_dependency_id: DependencyID,
-        err: &'static str,
-    ) {
-        // SAFETY: ctx was registered as *Queue when installing this callback.
-        let this: &mut Queue = unsafe { bun_ptr::callback_ctx::<Queue>(ctx) };
-        bun_core::scoped_log!(
-            AsyncModule,
-            "onDependencyError: {}",
-            bstr::BStr::new(this.vm().package_manager().lockfile.str(&dependency.name))
-        );
-
-        // retain_mut lets Drop free removed modules.
-        this.map.retain_mut(|module| {
-            for pending in module.parse_result.pending_imports.iter() {
-                if pending.root_dependency_id != root_dependency_id {
-                    continue;
-                }
-                let import_record_id = pending.import_record_id;
-                // S017: per-thread VM singleton (safe accessor) instead of
-                // `container_of`-derived `*mut`; provenance is the original
-                // allocation, disjoint from the `&mut module` borrow above.
-                let vm = VirtualMachine::get().as_mut();
-                // reshaped for borrowck — `lockfile.str()` ties the
-                // returned slice to `&vm`, which conflicts with passing
-                // `&mut vm` to `resolve_error`. The lockfile string buffer is
-                // stable across `resolve_error` (no realloc on the error
-                // path); detach the borrow via raw ptr.
-                let name =
-                    bun_ptr::RawSlice::new(vm.package_manager().lockfile.str(&dependency.name));
-                module
-                    .resolve_error(
-                        vm,
-                        import_record_id,
-                        &PackageResolveError {
-                            name: name.slice(),
-                            err,
-                            url: b"",
-                            version: dependency.version.clone(),
-                        },
-                    )
-                    .expect("unreachable");
-                return false; // continue :outer — drop this module
-            }
-            true
-        });
-    }
-
     /// `WakeHandler::handler` — runs on install / HTTP-callback threads
     /// (`PackageManager::wake_raw`). `ctx` is the [`WakeContext`] registered in
     /// `runtime/jsc_hooks.rs`; the VM is reached only through its handle.
@@ -391,17 +336,15 @@ impl Queue {
         }
     }
 
-    /// `WakeHandler::on_dependency_error` context accessor — JS thread.
-    ///
-    /// # Safety
-    /// `ctx` is the leaked `WakeContext` registered in `runtime/jsc_hooks.rs`.
-    pub unsafe fn queue_from_wake_context(ctx: *mut c_void) -> *mut Queue {
-        // SAFETY: fn contract.
-        unsafe { (*ctx.cast::<WakeContext>()).queue }
-    }
-
     pub fn on_poll(&mut self) {
         bun_core::scoped_log!(AsyncModule, "onPoll");
+        if self.map.is_empty() {
+            // Wakes also fire for tasks a synchronous auto-install
+            // (`enqueue_dependency_to_root`) is blocked on. That waiter drains
+            // them itself; draining here would drop their failures (no module
+            // to deliver them to).
+            return;
+        }
         self.run_tasks();
         self.poll_modules();
     }
diff --git a/src/jsc/VirtualMachine.rs b/src/jsc/VirtualMachine.rs
index 0fc97494243f..1fa0490852f9 100644
--- a/src/jsc/VirtualMachine.rs
+++ b/src/jsc/VirtualMachine.rs
@@ -4679,21 +4679,16 @@ impl VirtualMachine {
             mode.is_esm(),
             IS_A_FILE_PATH,
         );
-        if let Err(err_) = resolve_result {
-            let err = err_;
+        if let Err(err) = resolve_result {
             let import_kind = mode.import_kind();
             // Find a `.resolve`-metadata msg if the log has one.
-            let msg = log
+            let resolve_msg_index = log
                 .msgs
                 .iter()
-                .find_map(|m| {
-                    if let bun_ast::Metadata::Resolve(_) = &m.metadata {
-                        Some(m.clone())
-                    } else {
-                        None
-                    }
-                })
-                .unwrap_or_else(|| {
+                .position(|m| matches!(m.metadata, bun_ast::Metadata::Resolve(_)));
+            let mut msg = match resolve_msg_index {
+                Some(i) => log.msgs[i].clone(),
+                None => {
                     let printed = crate::ResolveMessage::fmt(
                         specifier_utf8.slice(),
                         source_utf8.slice(),
@@ -4709,7 +4704,24 @@ impl VirtualMachine {
                         }),
                         ..Default::default()
                     }
-                });
+                }
+            };
+            // The resolver and auto-install log why a resolution failed
+            // (`GET <url> - 404`, an unreadable directory, ...) in the scoped
+            // `log`, which dies with this frame; carry those lines as notes on
+            // the `ResolveMessage`. Dedup by text: `_resolve` retries once
+            // after busting the directory cache and can log a failure twice.
+            let mut notes = core::mem::take(&mut msg.notes).into_vec();
+            for (i, logged) in log.msgs.iter().enumerate() {
+                if Some(i) == resolve_msg_index
+                    || !matches!(logged.kind, bun_ast::Kind::Err | bun_ast::Kind::Warn)
+                    || notes.iter().any(|note| note.text == logged.data.text)
+                {
+                    continue;
+                }
+                notes.push(logged.data.clone());
+            }
+            msg.notes = notes.into_boxed_slice();
             *res = ErrorableString::err(
                 ErrorCode(ErrorCode::JS_ERROR_OBJECT),
                 crate::ResolveMessage::create(global, &msg, source_utf8.slice())?,
diff --git a/src/runtime/jsc_hooks.rs b/src/runtime/jsc_hooks.rs
index 840585ff825a..e46993ef5158 100644
--- a/src/runtime/jsc_hooks.rs
+++ b/src/runtime/jsc_hooks.rs
@@ -472,37 +472,19 @@ unsafe fn init_runtime_state(
                     // from CLI args to the resolver so symlinked node_modules
                     // entries resolve via their link path (peer deps stay reachable).
                     t.resolver.opts.preserve_symlinks = preserve_symlinks;
-                    let wake_ctx: *mut bun_jsc::async_module::WakeContext = &raw mut **(*state)
+                    let wake_ctx: &mut bun_jsc::async_module::WakeContext = &mut **(*state)
                         .wake_ctx
                         .insert(Box::new(bun_jsc::async_module::WakeContext {
                             queue: &raw mut (*vm).modules,
                             handle: (*vm).handle(),
                             kind: (*vm).current_loop_kind(),
                         }));
-                    t.resolver.on_wake_package_manager = bun_resolver::install_types::WakeHandler {
-                        context: core::ptr::NonNull::new(wake_ctx.cast()),
-                        handler: Some(bun_jsc::async_module::Queue::on_wake_handler),
-                        on_dependency_error: Some({
-                            unsafe fn adapter(
-                                ctx: *mut core::ffi::c_void,
-                                dep: &bun_resolver::install_types::Dependency,
-                                id: bun_resolver::install_types::DependencyID,
-                                err: &'static str,
-                            ) {
-                                // SAFETY: `ctx` is the `WakeContext` set just above; its queue is `(*vm).modules`.
-                                unsafe {
-                                    bun_jsc::async_module::Queue::on_dependency_error(
-                                        bun_jsc::async_module::Queue::queue_from_wake_context(ctx)
-                                            .cast(),
-                                        dep,
-                                        id,
-                                        err,
-                                    )
-                                }
-                            }
-                            adapter
+                    t.resolver.on_wake_package_manager = bun_resolver::install_types::WakeHandler(
+                        Some(bun_resolver::install_types::WakeTarget {
+                            context: core::ptr::NonNull::from(wake_ctx).cast(),
+                            handler: bun_jsc::async_module::Queue::on_wake_handler,
                         }),
-                    };
+                    );
                     // Branch on `opts.graph` here — with a module graph,
                     // auto_jsx=true would
                     // `read_dir_info(cwd)` and cache its tsconfig.json BEFORE
diff --git a/test/cli/run/run-autoinstall.test.ts b/test/cli/run/run-autoinstall.test.ts
index 8f1e67ab40c6..7d9e77747eda 100644
--- a/test/cli/run/run-autoinstall.test.ts
+++ b/test/cli/run/run-autoinstall.test.ts
@@ -263,6 +263,225 @@ describe.concurrent("auto-install uses the version range from package.json", ()
   });
 });
 
+// A registry that has a manifest for `name` whose only version points at a
+// tarball the registry then answers with a 404. Every other path is a 404 too.
+function registryWithMissingTarball(name: string) {
+  const requests: string[] = [];
+  const tarballPath = `/${name}/-/${name}-1.0.0.tgz`;
+  const registry = Bun.serve({
+    port: 0,
+    fetch(req) {
+      const { pathname } = new URL(req.url);
+      requests.push(pathname);
+      if (pathname !== `/${name}`) return new Response("not found", { status: 404 });
+      return Response.json({
+        name,
+        "dist-tags": { latest: "1.0.0" },
+        versions: { "1.0.0": { name, version: "1.0.0", dist: { tarball: `${origin}${tarballPath}` } } },
+      });
+    },
+  });
+  const origin = `http://127.0.0.1:${registry.port}`;
+  return {
+    requests,
+    origin,
+    tarballPath,
+    tarballUrl: `${origin}${tarballPath}`,
+    [Symbol.dispose]() {
+      registry.stop(true);
+    },
+  };
+}
+
+async function runWithRegistry(registryOrigin: string, entry: string, source: string, installOptions = "") {
+  using dir = tempDir("autoinstall-error-report", {
+    [entry]: source,
+    "bunfig.toml": `[install]\nregistry = "${registryOrigin}/"\n${installOptions}`,
+  });
+  await using proc = Bun.spawn({
+    cmd: [bunExe(), entry],
+    cwd: String(dir),
+    env: { ...bunEnv, BUN_INSTALL_CACHE_DIR: join(String(dir), ".bun-cache") },
+    stdout: "pipe",
+    stderr: "pipe",
+  });
+  const [stdout, stderr, exitCode] = await Promise.all([proc.stdout.text(), proc.stderr.text(), proc.exited]);
+  return { stdout, stderr, exitCode };
+}
+
+// While auto-installing, the package manager writes the reason a package could
+// not be installed (the tarball GET and its status, a network error name, ...)
+// into the log of the resolve that triggered it. Those lines are attached to
+// the ResolveMessage as notes; without them the only output is
+// "<error name> while resolving package '...'".
+describe.concurrent("auto-install reports why a package could not be installed", () => {
+  test("tarball 404, static import", async () => {
+    const name = "pkg-whose-tarball-is-missing";
+    using r = registryWithMissingTarball(name);
+    const { stderr, exitCode } = await runWithRegistry(r.origin, "index.js", `import "${name}";\n`);
+
+    expect(r.requests).toEqual([`/${name}`, r.tarballPath]);
+    expect(stderr).toContain(`note: GET ${r.tarballUrl} - 404`);
+    expect(exitCode).toBe(1);
+  });
+
+  test("tarball 404, require()", async () => {
+    const name = "pkg-whose-tarball-is-missing-cjs";
+    using r = registryWithMissingTarball(name);
+    const { stderr, exitCode } = await runWithRegistry(r.origin, "index.cjs", `require("${name}");\n`);
+
+    expect(r.requests).toEqual([`/${name}`, r.tarballPath]);
+    expect(stderr).toContain(`note: GET ${r.tarballUrl} - 404`);
+    expect(exitCode).toBe(1);
+  });
+
+  test("tarball 404, dynamic import() caught and logged by the script", async () => {
+    const name = "pkg-whose-tarball-is-missing-dynamic";
+    using r = registryWithMissingTarball(name);
+    const { stdout, stderr, exitCode } = await runWithRegistry(
+      r.origin,
+      "index.js",
+      `try {\n  await import("${name}");\n} catch (err) {\n  console.log(err);\n}\n`,
+    );
+
+    expect(r.requests).toEqual([`/${name}`, r.tarballPath]);
+    expect(stdout).toContain(`package '${name}'`);
+    expect(stdout).toContain(`note: GET ${r.tarballUrl} - 404`);
+    expect(stderr).toBe("");
+    expect(exitCode).toBe(0);
+  });
+
+  test("manifest 404", async () => {
+    const name = "pkg-whose-manifest-is-missing";
+    using r = registryWithMissingTarball("some-other-package");
+    const { stderr, exitCode } = await runWithRegistry(r.origin, "index.js", `import "${name}";\n`);
+
+    expect(r.requests).toEqual([`/${name}`]);
+    expect(stderr).toContain(`error: Cannot find package '${name}'`);
+    expect(stderr).toContain(`note: GET ${r.origin}/${name} - 404`);
+    expect(exitCode).toBe(1);
+  });
+});
+
+// A registry whose every package has exactly one version, 1.0.0, published now.
+// `pkg-with-bad-tarball-url` exists too, but its manifest does not say where
+// the tarball is.
+function registryWithOneFreshVersion() {
+  const registry = Bun.serve({
+    port: 0,
+    fetch(req) {
+      const name = decodeURIComponent(new URL(req.url).pathname.slice(1));
+      const tarball = name === "pkg-with-bad-tarball-url" ? "not a url" : `http://127.0.0.1:1/${name}-1.0.0.tgz`;
+      return Response.json({
+        name,
+        "dist-tags": { latest: "1.0.0" },
+        versions: { "1.0.0": { name, version: "1.0.0", dist: { tarball } } },
+        time: { "1.0.0": new Date().toISOString() },
+      });
+    },
+  });
+  return {
+    origin: `http://127.0.0.1:${registry.port}`,
+    [Symbol.dispose]() {
+      registry.stop(true);
+    },
+  };
+}
+
+function noteLines(stderr: string) {
+  return stderr.split("\n").filter(line => line.startsWith("note: "));
+}
+
+// The manifest exists but nothing in it satisfies the request. These failures
+// belong to the dependency auto-install enqueues on the root, whose errors used
+// to go to a callback that never reported them, so they printed a bare
+// "Cannot find package". Each one now prints the same line `bun install` does,
+// exactly once: the runtime retries a failed resolve after busting its
+// directory cache, and the retry reports the same failure again.
+describe.concurrent("auto-install reports why a package could not be resolved", () => {
+  test("version the registry does not have", async () => {
+    using r = registryWithOneFreshVersion();
+    const { stderr, exitCode } = await runWithRegistry(r.origin, "index.js", `import "pkg-without-v2@2.0.0";\n`);
+
+    expect(stderr).toContain("error: Cannot find package 'pkg-without-v2@2.0.0'");
+    expect(noteLines(stderr)).toEqual([
+      'note: No version matching "2.0.0" found for specifier "pkg-without-v2" (but package exists)',
+    ]);
+    expect(exitCode).toBe(1);
+  });
+
+  test("version the registry does not have, require()", async () => {
+    using r = registryWithOneFreshVersion();
+    const { stderr, exitCode } = await runWithRegistry(r.origin, "index.cjs", `require("pkg-without-v2@2.0.0");\n`);
+
+    expect(stderr).toContain("error: Cannot find package 'pkg-without-v2@2.0.0'");
+    expect(noteLines(stderr)).toEqual([
+      'note: No version matching "2.0.0" found for specifier "pkg-without-v2" (but package exists)',
+    ]);
+    expect(exitCode).toBe(1);
+  });
+
+  test("dist-tag the registry does not have", async () => {
+    using r = registryWithOneFreshVersion();
+    const { stderr, exitCode } = await runWithRegistry(r.origin, "index.js", `import "pkg-without-canary@canary";\n`);
+
+    expect(stderr).toContain("error: Cannot find package 'pkg-without-canary@canary'");
+    expect(noteLines(stderr)).toEqual([
+      'note: Package "pkg-without-canary" with tag "canary" not found, but package exists',
+    ]);
+    expect(exitCode).toBe(1);
+  });
+
+  test("version blocked by minimumReleaseAge", async () => {
+    using r = registryWithOneFreshVersion();
+    const { stderr, exitCode } = await runWithRegistry(
+      r.origin,
+      "index.js",
+      `import "pkg-published-today@1.0.0";\n`,
+      "minimumReleaseAge = 86400\n",
+    );
+
+    expect(stderr).toContain("error: Cannot find package 'pkg-published-today@1.0.0'");
+    expect(noteLines(stderr)).toEqual([
+      expect.stringMatching(
+        /^note: No version matching "[^"]+" found for specifier "[^"]+" \(blocked by minimum-release-age: 86400 seconds\)$/,
+      ),
+    ]);
+    expect(exitCode).toBe(1);
+  });
+
+  test("dist-tag whose versions are all blocked by minimumReleaseAge", async () => {
+    using r = registryWithOneFreshVersion();
+    const { stderr, exitCode } = await runWithRegistry(
+      r.origin,
+      "index.js",
+      `import "pkg-published-today";\n`,
+      "minimumReleaseAge = 86400\n",
+    );
+
+    expect(stderr).toContain("error: Cannot find package 'pkg-published-today'");
+    expect(noteLines(stderr)).toEqual([
+      'note: Package "pkg-published-today" with tag "latest" not found (all versions blocked by minimum-release-age: 86400 seconds)',
+    ]);
+    expect(exitCode).toBe(1);
+  });
+
+  // Any other error ends up named after its error code, like the
+  // "'main' returned error.InvalidURL" line `bun install` prints after the
+  // specific message.
+  test("error without a dedicated message", async () => {
+    using r = registryWithOneFreshVersion();
+    const { stderr, exitCode } = await runWithRegistry(r.origin, "index.js", `import "pkg-with-bad-tarball-url";\n`);
+
+    expect(stderr).toContain("while resolving package 'pkg-with-bad-tarball-url' from");
+    expect(noteLines(stderr)).toEqual([
+      'note: Expected tarball URL to start with https:// or http://, got "not a url" while fetching package "pkg-with-bad-tarball-url"',
+      'note: InvalidURL while resolving package "pkg-with-bad-tarball-url"',
+    ]);
+    expect(exitCode).toBe(1);
+  });
+});
+
 test("--install=fallback to install missing packages", async () => {
   const dir = tmpdirSync();
   mkdirSync(dir, { recursive: true });
diff --git a/test/js/bun/resolve/resolve-error.test.ts b/test/js/bun/resolve/resolve-error.test.ts
index c608c2800a83..dc94b697880a 100644
--- a/test/js/bun/resolve/resolve-error.test.ts
+++ b/test/js/bun/resolve/resolve-error.test.ts
@@ -1,8 +1,38 @@
 import { describe, expect, it } from "bun:test";
-import { bunEnv, bunExe, tempDir } from "harness";
+import { bunEnv, bunExe, normalizeBunSnapshot, tempDir } from "harness";
 import path from "node:path";
 
 describe("ResolveMessage", () => {
+  it("carries what the resolver logged while failing as notes", async () => {
+    // The resolver records the reason it gave up (here: the dependency's
+    // package.json does not parse) in the log of the failing resolve. That
+    // used to be discarded, leaving a bare "Cannot find package".
+    using dir = tempDir("resolve-error-notes", {
+      "index.js": `import "badjson";\n`,
+      "node_modules/badjson/package.json": `{ "name": "badjson", "main":\n`,
+    });
+    await using proc = Bun.spawn({
+      cmd: [bunExe(), "index.js"],
+      env: bunEnv,
+      cwd: String(dir),
+      stdout: "pipe",
+      stderr: "pipe",
+    });
+    const [stdout, stderr, exitCode] = await Promise.all([proc.stdout.text(), proc.stderr.text(), proc.exited]);
+    expect(stdout).toBe("");
+    expect(normalizeBunSnapshot(stderr, String(dir))).toMatchInlineSnapshot(`
+      "error: Cannot find package 'badjson' from '<dir>/index.js'
+
+      1 | { "name": "badjson", "main":
+                                      ^
+      note: Unexpected end of file
+         at <dir>/node_modules/badjson/package.json:1:29
+
+      Bun v<bun-version>"
+    `);
+    expect(exitCode).toBe(1);
+  });
+
   it("position object does not segfault", async () => {
     try {
       await import("./file-importing-nonexistent-file.js");

From 8d9e76085dc6a120c1abeb81daebf02369ff42b3 Mon Sep 17 00:00:00 2001
From: robobun <117481402+robobun@users.noreply.github.com>
Date: Mon, 17 Aug 2026 03:06:51 +0000
Subject: [PATCH 169/258] install: only open package.json for writing in the
 commands that rewrite it (#38745)

---
 src/install/PackageManager.rs                 |  49 ++---
 .../PackageManager/package_json_write_back.rs |   6 +-
 src/runtime/cli/pm_trusted_command.rs         |  37 ++--
 test/cli/install/bun-pack.test.ts             |  31 +++-
 test/cli/install/bun-pm.test.ts               | 168 +++++++++++++++++-
 test/cli/install/bun-publish.test.ts          |  26 +++
 .../install/migration/pnpm-lock-v9.test.ts    |  37 +++-
 test/harness.ts                               |  49 +++++
 8 files changed, 361 insertions(+), 42 deletions(-)

diff --git a/src/install/PackageManager.rs b/src/install/PackageManager.rs
index cfe34b94a262..5f2bec76221f 100644
--- a/src/install/PackageManager.rs
+++ b/src/install/PackageManager.rs
@@ -340,8 +340,6 @@ pub struct PackageManager {
     /// Only set in `bun pm`
     pub root_package_json_name_at_time_of_init: Box<[u8]>,
 
-    pub root_package_json_file: bun_sys::File,
-
     /// The package id corresponding to the workspace the install is happening in. Could be root, or
     /// could be any of the workspaces.
     pub root_package_id: RootPackageId,
@@ -549,6 +547,24 @@ impl Subcommand {
     pub(crate) fn should_chdir_to_root(self) -> bool {
         !matches!(self, Self::Link)
     }
+
+    /// `init` opens package.json read-write for these so a read-only file fails before any work.
+    pub(crate) fn writes_package_json(self, has_package_args: bool) -> bool {
+        match self {
+            Self::Add | Self::Remove | Self::Update | Self::Patch | Self::PatchCommit => true,
+            Self::Install | Self::Link => has_package_args,
+            Self::Pm
+            | Self::Unlink
+            | Self::Outdated
+            | Self::Pack
+            | Self::Publish
+            | Self::Audit
+            | Self::Info
+            | Self::Why
+            | Self::Dedupe
+            | Self::Prune => false,
+        }
+    }
 }
 
 /// The resolved outcome of `--filter` for one install: the importer ids whose dependencies get installed.
@@ -1585,14 +1601,10 @@ pub fn init(
         let mut this_cwd: &[u8] = original_cwd;
         let mut created_package_json = false;
         let child_json: bun_sys::File = 'child: {
-            // if we are only doing `bun install` (no args), then we can open as read_only
-            // in all other cases we will need to write new data later.
-            // this is relevant because it allows us to succeed an install if package.json
-            // is readable but not writable
-            //
-            // probably wont matter as if package.json isn't writable, it's likely that
-            // the underlying directory and node_modules isn't either.
-            let need_write = subcommand != Subcommand::Install || cli.positionals.len() > 1;
+            // --dry-run and --no-save clear `Do::WRITE_PACKAGE_JSON` once the options load.
+            let need_write = subcommand.writes_package_json(cli.positionals.len() > 1)
+                && !cli.dry_run
+                && !cli.no_save;
 
             loop {
                 let mut package_json_path_buf = PathBuffer::uninit();
@@ -1696,11 +1708,12 @@ pub fn init(
                     parent_path_buf[parent_without_trailing_slash.len() + b"/package.json".len()] =
                         0;
 
+                    // Finding the workspace root must not depend on its package.json being writable.
                     let json_file = match bun_sys::File::openat(
                         bun_sys::Fd::cwd(),
                         &parent_path_buf
                             [..parent_without_trailing_slash.len() + b"/package.json".len()],
-                        bun_sys::O::RDWR | bun_sys::O::CLOEXEC,
+                        bun_sys::O::RDONLY | bun_sys::O::CLOEXEC,
                         0,
                     ) {
                         Ok(f) => f,
@@ -1831,10 +1844,6 @@ pub fn init(
                                 // process-lifetime (`set_top_level_dir` requires `'static`).
                                 fs.set_top_level_dir(fs.dirname_store().append(parent)?);
                                 let _ = child_json.close();
-                                #[cfg(windows)]
-                                {
-                                    json_file.seek_to(0)?;
-                                }
                                 workspace_name_hash =
                                     Some(Semver::string::Builder::string_hash(&entry.name));
                                 break 'root_package_json_file json_file;
@@ -1886,6 +1895,8 @@ pub fn init(
         root_buf[plen] = 0;
         ROOT_PACKAGE_JSON_PATH.write(ZStr::from_raw(root_buf.as_ptr(), plen));
     }
+    // From here on package.json is read (and, by the commands that do, written) by path.
+    let _ = root_package_json_file.close();
 
     // Returns the resolver's BSSMap-owned
     // `*EntriesOption` slot.
@@ -2082,7 +2093,6 @@ pub fn init(
         // zero-bit pattern is UB; allocate the real (empty) lockfile here directly.
         // `Lockfile::default()` ≡ `Lockfile::init_empty()`.
         wr!(lockfile, Box::new(Lockfile::default()));
-        wr!(root_package_json_file, root_package_json_file);
         // .progress
         wr!(event_loop, AnyEventLoop::init());
         wr!(
@@ -2523,13 +2533,6 @@ fn init_with_runtime_once(
         // `Lockfile` holds `HashMap`/`Vec`/`NonNull` (zero-bit pattern is
         // UB), so allocate the real empty lockfile here directly instead of a zeroed placeholder.
         wr!(lockfile, Box::new(Lockfile::default()));
-        // `.root_package_json_file` is never read in the runtime
-        // path. Use the explicit invalid-fd sentinel rather than `mem::zeroed()` —
-        // on posix `Fd(0)` is stdin, not the invalid marker.
-        wr!(
-            root_package_json_file,
-            bun_sys::File::from_fd(Fd::invalid())
-        );
         // erased *mut () set by tier-6; `js_current()` resolves the per-thread JS
         // event loop via `bun_io::__bun_get_vm_ctx` (link-time, definer in bun_runtime).
         wr!(event_loop, AnyEventLoop::js_current());
diff --git a/src/install/PackageManager/package_json_write_back.rs b/src/install/PackageManager/package_json_write_back.rs
index 3c22399fc6ba..92d90eed07b2 100644
--- a/src/install/PackageManager/package_json_write_back.rs
+++ b/src/install/PackageManager/package_json_write_back.rs
@@ -81,11 +81,11 @@ pub(crate) fn record_migrated_root(manager: &mut PackageManager) {
 
 /// `bun pm migrate` and `bun pm trust` save the lockfile without consulting `--dry-run` / `--no-save`, so the
 /// package.json that belongs with it is written the same way instead of through `flush`, which those flags disable.
+/// The lockfile is already on disk at this point, so a package.json that cannot be written (a read-only checkout)
+/// is reported and left as it was rather than failing the command.
 pub fn write_migrated_root(manager: &mut PackageManager) {
     if let Some(root) = take_migrated_root(manager) {
-        if !write_target(manager, &root) {
-            Global::exit(1);
-        }
+        let _ = write_target(manager, &root);
     }
 }
 
diff --git a/src/runtime/cli/pm_trusted_command.rs b/src/runtime/cli/pm_trusted_command.rs
index 4898792f5c8a..6fbf10ec7ae2 100644
--- a/src/runtime/cli/pm_trusted_command.rs
+++ b/src/runtime/cli/pm_trusted_command.rs
@@ -440,6 +440,31 @@ impl TrustCommand {
             Global::crash();
         }
 
+        // Opened before any script runs: package.json is rewritten at the end, and a script
+        // whose trust cannot be recorded must not run.
+        // SAFETY: `ROOT_PACKAGE_JSON_PATH` is set during `PackageManager::init`
+        // (single-threaded startup) and immutable thereafter.
+        let root_package_json_path = unsafe { ROOT_PACKAGE_JSON_PATH.read() };
+        let root_file = match bun_sys::File::openat(
+            bun_sys::Fd::cwd(),
+            root_package_json_path.as_bytes(),
+            bun_sys::O::RDWR | bun_sys::O::CLOEXEC,
+            0,
+        ) {
+            Ok(file) => file,
+            Err(err) => {
+                Output::err(
+                    &err,
+                    "could not open \"{s}\" for writing",
+                    (bstr::BStr::new(root_package_json_path.as_bytes()),),
+                );
+                bun_core::note!(
+                    "bun pm trust adds the packages to trustedDependencies in package.json"
+                );
+                Global::crash();
+            }
+        };
+
         let mut scripts_node: Progress::Node;
         // SAFETY: `pm_raw` singleton; `progress` is owned inline.
         let show_progress = unsafe { (*pm_raw).options.log_level.show_progress() };
@@ -540,20 +565,10 @@ impl TrustCommand {
         // does not touch.
         unsafe { package_json_write_back::write_migrated_root(&mut *pm_raw) };
 
-        // SAFETY: `pm_raw` singleton; this scope takes over the descriptor
-        // (the original `pm.root_package_json_file` is replaced with INVALID so
-        // its eventual drop is a no-op).
-        let root_file = unsafe {
-            let fd = (*pm_raw).root_package_json_file.handle;
-            (*pm_raw).root_package_json_file.handle = bun_core::Fd::INVALID;
-            bun_sys::File::from_fd(fd)
-        };
         let package_json_contents = root_file.read_to_end().map_err(crate::Error::from)?;
 
-        // SAFETY: `ROOT_PACKAGE_JSON_PATH` is set during `PackageManager::init`
-        // (single-threaded startup) and immutable thereafter.
         let package_json_source = bun_ast::Source::init_path_string(
-            unsafe { ROOT_PACKAGE_JSON_PATH.read() }.as_bytes(),
+            root_package_json_path.as_bytes(),
             package_json_contents.as_slice(),
         );
 
diff --git a/test/cli/install/bun-pack.test.ts b/test/cli/install/bun-pack.test.ts
index e186fc3043f6..153509e4fc46 100644
--- a/test/cli/install/bun-pack.test.ts
+++ b/test/cli/install/bun-pack.test.ts
@@ -2,7 +2,7 @@ import { file, gunzipSync, spawn, write } from "bun";
 import { readTarball } from "bun:internal-for-testing";
 import { beforeEach, describe, expect, test } from "bun:test";
 import { chmod, exists, lstat, mkdir, rm, symlink } from "fs/promises";
-import { MAX_PATH_BYTES, bunEnv, bunExe, isLinux, isWindows, pack, runBunInstall, tempDir, tmpdirSync } from "harness";
+import { MAX_PATH_BYTES, bunEnv, bunExe, isLinux, isWindows, pack, runBunInstall, tempDir, tmpdirSync, unprivilegedSpawnOptions } from "harness";
 import fs from "node:fs/promises";
 import { join } from "path";
 
@@ -67,6 +67,35 @@ test("the archive is not padded to a full tar record", async () => {
   expect(tar.byteLength).toBe(6 * 512);
 });
 
+// pack only reads package.json, so a file that is readable but not writable (a read-only
+// checkout, a file owned by another user) must not stop it.
+test.skipIf(isWindows)("read-only package.json", async () => {
+  using dir = tempDir("pack-read-only", {
+    "package.json": JSON.stringify({ name: "pack-read-only", version: "1.2.3" }),
+    "index.js": "console.log('hello ./index.js')",
+  });
+  await fs.chmod(join(String(dir), "package.json"), 0o444);
+  using unprivileged = unprivilegedSpawnOptions(String(dir));
+
+  await using proc = spawn({
+    cmd: [bunExe(), "pm", "pack"],
+    cwd: String(dir),
+    env: bunEnv,
+    stdout: "pipe",
+    stderr: "pipe",
+    stdin: "ignore",
+    ...unprivileged,
+  });
+  const [out, err, exitCode] = await Promise.all([proc.stdout.text(), proc.stderr.text(), proc.exited]);
+
+  expect(err).toBe("");
+  expect(out).toContain("pack-read-only-1.2.3.tgz");
+  expect(exitCode).toBe(0);
+
+  const tarball = readTarball(join(String(dir), "pack-read-only-1.2.3.tgz"));
+  expect(tarball.entries).toMatchObject([{ "pathname": "package/package.json" }, { "pathname": "package/index.js" }]);
+});
+
 test("in subdirectory", async () => {
   await Promise.all([
     write(
diff --git a/test/cli/install/bun-pm.test.ts b/test/cli/install/bun-pm.test.ts
index a6c5cc3f2d80..b15886f765e0 100644
--- a/test/cli/install/bun-pm.test.ts
+++ b/test/cli/install/bun-pm.test.ts
@@ -1,7 +1,7 @@
 import { spawn } from "bun";
 import { afterAll, afterEach, beforeAll, beforeEach, describe, expect, it, test } from "bun:test";
-import { exists, mkdir, rm, writeFile } from "fs/promises";
-import { bunEnv, bunEnv as env, bunExe, isLinux, isWindows, readdirSorted, tempDir, tls, tmpdirSync } from "harness";
+import { chmod, exists, mkdir, rm, writeFile } from "fs/promises";
+import { bunEnv, bunEnv as env, bunExe, isLinux, isWindows, readdirSorted, tempDir, tls, tmpdirSync, unprivilegedSpawnOptions } from "harness";
 import { cpSync } from "node:fs";
 import { join } from "path";
 import {
@@ -1494,3 +1494,167 @@ describe.concurrent.skipIf(isWindows)("global directories longer than the path b
     expect(exitCode).toBe(0);
   });
 });
+
+// A package.json that is readable but not writable (a read-only checkout, a file owned by
+// another user) must only stop the commands that actually rewrite it.
+describe.skipIf(isWindows)("read-only package.json", () => {
+  // Nothing here may reach a registry.
+  const offlineEnv = { ...env, npm_config_registry: "http://127.0.0.1:1/" };
+
+  function run(cwd: string, unprivileged: ReturnType<typeof unprivilegedSpawnOptions>, ...args: string[]) {
+    const { stdout, stderr, exited } = spawn({
+      cmd: [bunExe(), ...args],
+      cwd,
+      env: offlineEnv,
+      stdout: "pipe",
+      stderr: "pipe",
+      ...unprivileged,
+    });
+    return Promise.all([stdout.text(), stderr.text(), exited]);
+  }
+
+  // An installed project whose package.json was made read-only afterwards. `dep` is a
+  // local dependency whose postinstall was blocked, so there is something to trust; `other`
+  // is a local package that is not a dependency yet, so there is something to add.
+  async function installedProject() {
+    const dir = tempDir("pm-read-only-package-json", {
+      "package.json": JSON.stringify({ name: "read-only", version: "1.0.0", dependencies: { dep: "file:./dep" } }),
+      "dep/package.json": JSON.stringify({
+        name: "dep",
+        version: "1.0.0",
+        scripts: { postinstall: "echo ran > ran.txt" },
+      }),
+      "other/package.json": JSON.stringify({ name: "other", version: "1.0.0" }),
+    });
+    const unprivileged = unprivilegedSpawnOptions(String(dir));
+    const project = {
+      dir: String(dir),
+      run: (...args: string[]) => run(String(dir), unprivileged, ...args),
+      [Symbol.dispose]() {
+        unprivileged[Symbol.dispose]();
+        dir[Symbol.dispose]();
+      },
+    };
+    try {
+      const [, err, exitCode] = await project.run("install");
+      expect(err).toContain("Saved lockfile");
+      expect(exitCode).toBe(0);
+      await chmod(join(project.dir, "package.json"), 0o444);
+    } catch (e) {
+      project[Symbol.dispose]();
+      throw e;
+    }
+    return project;
+  }
+
+  test("commands that only read package.json work", async () => {
+    using project = await installedProject();
+
+    const results: { args: string[]; out: string; err: string; exitCode: number }[] = [];
+    for (const args of [["pm", "bin"], ["pm", "ls"], ["pm", "pkg", "get", "name"], ["why", "dep"], ["outdated"]]) {
+      const [out, err, exitCode] = await project.run(...args);
+      results.push({ args, out, err, exitCode });
+    }
+
+    expect(results).toEqual([
+      { args: ["pm", "bin"], out: join(project.dir, "node_modules", ".bin") + "\n", err: "", exitCode: 0 },
+      { args: ["pm", "ls"], out: expect.stringContaining("dep@dep"), err: "", exitCode: 0 },
+      { args: ["pm", "pkg", "get", "name"], out: '"read-only"\n', err: "", exitCode: 0 },
+      { args: ["why", "dep"], out: expect.stringContaining("dep@dep"), err: "", exitCode: 0 },
+      { args: ["outdated"], out: expect.stringMatching(/^bun outdated v/), err: "", exitCode: 0 },
+    ]);
+  });
+
+  test("bun pm trust refuses before running any script", async () => {
+    using project = await installedProject();
+    const packageJson = join(project.dir, "package.json");
+    const lockfile = join(project.dir, "bun.lock");
+    const ranMarker = join(project.dir, "node_modules", "dep", "ran.txt");
+    const lockfileBefore = await Bun.file(lockfile).text();
+
+    {
+      const [out, err, exitCode] = await project.run("pm", "trust", "dep");
+      expect(err).toContain(`EACCES: Permission denied: could not open "${packageJson}" for writing`);
+      expect(out).toBe("");
+      expect(exitCode).toBe(1);
+      expect(await exists(ranMarker)).toBeFalse();
+      expect(await Bun.file(lockfile).text()).toBe(lockfileBefore);
+    }
+
+    // Once package.json is writable again the same command runs the script and records the trust.
+    await chmod(packageJson, 0o644);
+    {
+      const [out, err, exitCode] = await project.run("pm", "trust", "dep");
+      expect(err).not.toContain("error");
+      expect(out).toContain("1 script ran across 1 package");
+      expect(exitCode).toBe(0);
+      expect(await exists(ranMarker)).toBeTrue();
+      expect(await Bun.file(packageJson).json()).toMatchObject({ trustedDependencies: ["dep"] });
+      expect(await Bun.file(lockfile).text()).toContain("trustedDependencies");
+    }
+  });
+
+  test("commands that rewrite package.json still refuse up front", async () => {
+    using project = await installedProject();
+
+    const results: { args: string[]; out: string; err: string; exitCode: number }[] = [];
+    for (const args of [["add", "./other"], ["remove", "dep"], ["update"]]) {
+      const [out, err, exitCode] = await project.run(...args);
+      results.push({ args, out, err, exitCode });
+    }
+
+    const refused = {
+      out: "",
+      err: expect.stringContaining(
+        `EACCES: Permission denied while opening "${join(project.dir, "package.json")}"\nnote: package.json must be writable`,
+      ),
+      exitCode: 1,
+    };
+    expect(results).toEqual([
+      { args: ["add", "./other"], ...refused },
+      { args: ["remove", "dep"], ...refused },
+      { args: ["update"], ...refused },
+    ]);
+  });
+
+  // --dry-run and --no-save turn the same commands into readers of package.json.
+  test("--dry-run and --no-save do not need a writable package.json", async () => {
+    using project = await installedProject();
+    const packageJson = join(project.dir, "package.json");
+    const packageJsonBefore = await Bun.file(packageJson).text();
+
+    const results: { args: string[]; err: string; exitCode: number }[] = [];
+    for (const args of [
+      ["add", "./other", "--dry-run"],
+      ["remove", "dep", "--dry-run"],
+      ["update", "--dry-run"],
+      ["add", "./other", "--no-save"],
+    ]) {
+      const [, err, exitCode] = await project.run(...args);
+      results.push({ args, err, exitCode });
+    }
+
+    expect(results).toEqual([
+      { args: ["add", "./other", "--dry-run"], err: "", exitCode: 0 },
+      { args: ["remove", "dep", "--dry-run"], err: "", exitCode: 0 },
+      { args: ["update", "--dry-run"], err: "", exitCode: 0 },
+      { args: ["add", "./other", "--no-save"], err: "", exitCode: 0 },
+    ]);
+    expect(await Bun.file(packageJson).text()).toBe(packageJsonBefore);
+  });
+
+  test("a read-only root package.json is still found from a workspace member", async () => {
+    using dir = tempDir("pm-read-only-workspace-root", {
+      "package.json": JSON.stringify({ name: "root", workspaces: ["packages/*"] }),
+      "packages/member/package.json": JSON.stringify({ name: "member", version: "1.0.0" }),
+    });
+    await chmod(join(String(dir), "package.json"), 0o444);
+    using unprivileged = unprivilegedSpawnOptions(String(dir));
+
+    const [out, err, exitCode] = await run(join(String(dir), "packages", "member"), unprivileged, "pm", "bin");
+
+    expect(err).toBe("");
+    expect(out).toBe(join(String(dir), "node_modules", ".bin") + "\n");
+    expect(exitCode).toBe(0);
+  });
+});
diff --git a/test/cli/install/bun-publish.test.ts b/test/cli/install/bun-publish.test.ts
index debc8f154211..71b5796e8245 100644
--- a/test/cli/install/bun-publish.test.ts
+++ b/test/cli/install/bun-publish.test.ts
@@ -13,6 +13,7 @@ import {
   tempDir,
   tls,
   tmpdirSync,
+  unprivilegedSpawnOptions,
 } from "harness";
 import { delimiter, join } from "path";
 
@@ -1153,6 +1154,31 @@ describe("--dry-run", async () => {
     expect(err).not.toContain("hunter2");
     expect(exitCode).toBe(0);
   });
+  // publish only reads package.json, so a file that is readable but not writable (a
+  // read-only checkout, a file owned by another user) must not stop it.
+  test.skipIf(isWindows)("read-only package.json", async () => {
+    using dir = tempDir("publish-read-only", {
+      "package.json": JSON.stringify({ name: "dry-run-read-only", version: "4.4.4" }),
+      "index.js": "",
+    });
+    chmodSync(join(String(dir), "package.json"), 0o444);
+    using unprivileged = unprivilegedSpawnOptions(String(dir));
+
+    await using proc = spawn({
+      cmd: [bunExe(), "publish", "--dry-run"],
+      cwd: String(dir),
+      // Credentials in the URL satisfy the auth check; --dry-run stops before any request.
+      env: { ...env, npm_config_registry: "http://someuser:hunter2@127.0.0.1:1/" },
+      stdout: "pipe",
+      stderr: "pipe",
+      ...unprivileged,
+    });
+    const [out, err, exitCode] = await Promise.all([proc.stdout.text(), proc.stderr.text(), proc.exited]);
+
+    expect(err).toBe("");
+    expect(out).toContain(" + dry-run-read-only@4.4.4 (dry-run)");
+    expect(exitCode).toBe(0);
+  });
 });
 
 describe.concurrent("credentials in the registry url", () => {
diff --git a/test/cli/install/migration/pnpm-lock-v9.test.ts b/test/cli/install/migration/pnpm-lock-v9.test.ts
index 432f2456cf92..0be4c7f4a1ca 100644
--- a/test/cli/install/migration/pnpm-lock-v9.test.ts
+++ b/test/cli/install/migration/pnpm-lock-v9.test.ts
@@ -1,6 +1,6 @@
 import { afterAll, beforeAll, describe, expect, test } from "bun:test";
-import { appendFileSync, existsSync, readdirSync, realpathSync, rmSync, writeFileSync } from "fs";
-import { bunEnv, bunExe, nodeModulesPackages, tempDir, VerdaccioRegistry } from "harness";
+import { appendFileSync, chmodSync, existsSync, readdirSync, realpathSync, rmSync, writeFileSync } from "fs";
+import { VerdaccioRegistry, bunEnv, bunExe, isWindows, nodeModulesPackages, tempDir, unprivilegedSpawnOptions } from "harness";
 import { dirname, join } from "path";
 
 const verdaccio = new VerdaccioRegistry();
@@ -3586,6 +3586,39 @@ catalog:
       expect(exitCode).toBe(1);
       expect(existsSync(join(String(dir), "bun.lock"))).toBe(false);
     });
+
+    // A read-only checkout still gets its bun.lock; the fields that could not be moved are named.
+    test.concurrent.skipIf(isWindows)("a read-only package.json keeps its fields and is reported", async () => {
+      const packageJson = JSON.stringify({ name: "overrides-read-only", pnpm: { overrides: { plain: "1.0.0" } } });
+      using dir = tempDir("pnpm-v9-overrides-read-only", {
+        "package.json": packageJson,
+        "pnpm-lock.yaml": overridesLockfile("  plain: 1.0.0"),
+      });
+      chmodSync(join(String(dir), "package.json"), 0o444);
+      using unprivileged = unprivilegedSpawnOptions(String(dir));
+
+      await using proc = Bun.spawn({
+        cmd: [bunExe(), "pm", "migrate"],
+        cwd: String(dir),
+        env: { ...bunEnv, BUN_INSTALL_CACHE_DIR: join(String(dir), ".bun-cache") },
+        stdout: "pipe",
+        stderr: "pipe",
+        ...unprivileged,
+      });
+      const [stdout, stderr, exitCode] = await Promise.all([proc.stdout.text(), proc.stderr.text(), proc.exited]);
+
+      expect(stderr).toContain("failed to write package.json");
+      expect(stderr).toContain("EACCES");
+      expect(stderr).toContain("migrated lockfile from pnpm-lock.yaml");
+      expect(stdout).toBe("");
+      expect(exitCode).toBe(0);
+      expect(await Bun.file(join(String(dir), "package.json")).text()).toBe(packageJson);
+      expect(overridesSection(await bunLockOf(String(dir)))).toMatchInlineSnapshot(`
+        "  "overrides": {
+            "plain": "1.0.0",
+          },"
+      `);
+    });
   });
 
   // The settings moved out of `pnpm` / pnpm-workspace.yaml are edited into package.json in memory while the
diff --git a/test/harness.ts b/test/harness.ts
index 8b4bc67b4e51..bb58e519a7a0 100644
--- a/test/harness.ts
+++ b/test/harness.ts
@@ -498,6 +498,55 @@ export function tempDirWithFilesAnon(filesOrAbsolutePathToCopyFolderFrom: Direct
   return base;
 }
 
+/**
+ * `Bun.spawn` options for a child that must be subject to file permission bits,
+ * for tests where e.g. a `chmod 444` file has to be unwritable.
+ *
+ * Root bypasses permission bits, so when the tests run as root the child is
+ * run as uid/gid 65534 ("nobody" on Linux and macOS): `dir` is handed over to
+ * that user, and every ancestor it could not traverse (CI points TMPDIR at a
+ * mode 0700 directory) gets `o+x` until the returned value is disposed. When
+ * the tests already run unprivileged, the child runs as the current user and
+ * nothing is changed. POSIX only.
+ *
+ * @example
+ * ```ts
+ * using dir = tempDir("read-only", { "package.json": "{}" });
+ * fs.chmodSync(join(String(dir), "package.json"), 0o444);
+ * using unprivileged = unprivilegedSpawnOptions(String(dir));
+ * await using proc = Bun.spawn({ cmd: [bunExe(), "pm", "pack"], cwd: String(dir), env: bunEnv, ...unprivileged });
+ * ```
+ */
+export function unprivilegedSpawnOptions(dir: string): { uid?: number; gid?: number } & Disposable {
+  const restoreModes: [path: string, mode: number][] = [];
+  const options: { uid?: number; gid?: number } & Disposable = {
+    [Symbol.dispose]() {
+      for (const [path, mode] of restoreModes) fs.chmodSync(path, mode);
+    },
+  };
+  if (isWindows || process.getuid!() !== 0) return options;
+
+  const NOBODY = 65534;
+  try {
+    fs.chownSync(dir, NOBODY, NOBODY);
+    for (const entry of fs.readdirSync(dir, { recursive: true, encoding: "utf8" })) {
+      fs.lchownSync(join(dir, entry), NOBODY, NOBODY);
+    }
+    for (let parent = dirname(dir); parent !== dirname(parent); parent = dirname(parent)) {
+      const mode = fs.statSync(parent).mode & 0o7777;
+      if (mode & 0o001) continue;
+      fs.chmodSync(parent, mode | 0o001);
+      restoreModes.push([parent, mode]);
+    }
+  } catch (e) {
+    options[Symbol.dispose]();
+    throw e;
+  }
+  options.uid = NOBODY;
+  options.gid = NOBODY;
+  return options;
+}
+
 export interface BunRunResult {
   stdout: string;
   stderr: string;

From 875a8f1108716512f4037fdcb64b077f4dfc00e7 Mon Sep 17 00:00:00 2001
From: robobun <117481402+robobun@users.noreply.github.com>
Date: Mon, 17 Aug 2026 03:10:50 +0000
Subject: [PATCH 170/258] install: filter optionalDependencies by libc and
 record it in the lockfile (#38797)

---
 completions/bun-cli.json                      |  24 +
 completions/bun.bash                          |   5 +-
 completions/bun.fish                          |   1 +
 completions/bun.zsh                           |   1 +
 docs/pm/cli/install.mdx                       |  14 +-
 docs/pm/cli/prune.mdx                         |   2 +-
 docs/snippets/cli/link.mdx                    |   4 +
 docs/snippets/cli/patch.mdx                   |   4 +
 src/install/NetworkTask.rs                    |  22 +
 src/install/PackageInstaller.rs               |   4 +
 .../PackageManager/CommandLineArguments.rs    | 111 ++--
 .../PackageManager/PackageManagerEnqueue.rs   |  55 +-
 .../PackageManager/PackageManagerLifecycle.rs |  27 +-
 .../PackageManager/PackageManagerOptions.rs   |  27 +-
 .../PackageManager/PopulateManifestCache.rs   |  32 +-
 src/install/PackageManager/runTasks.rs        | 206 ++++++-
 src/install/PackageManifestMap.rs             | 130 ++---
 src/install/isolated_install/Installer.rs     |   3 +
 src/install/lockfile.rs                       |  12 +-
 src/install/lockfile/Package.rs               |   8 +-
 src/install/lockfile/Package/Meta.rs          |  20 +-
 src/install/lockfile/Tree.rs                  |  14 +-
 src/install/lockfile/bun.lock.rs              |  34 +-
 .../lockfile_json_stringify_for_debugging.rs  |   7 +
 src/install/lockfile/printer/tree_printer.rs  |   1 +
 src/install/lockfile/reachable.rs             |  33 +-
 src/install/migration.rs                      |   3 +-
 src/install/migration/npm_lock.rs             |  72 ++-
 src/install/npm.rs                            |   8 +-
 src/install/patch_install.rs                  |   6 +-
 src/install/pnpm.rs                           |   4 +-
 src/install/postinstall_optimizer.rs          |  15 +-
 src/install_types/resolver_hooks.rs           |  50 +-
 src/jsc/AsyncModule.rs                        |   2 +
 src/runtime/cli/pm_licenses_command.rs        |   2 +-
 .../__snapshots__/bun-lock.test.ts.snap       |   4 +-
 test/cli/install/bun-install-cpu-os.test.ts   | 524 ++++++++++++++++--
 .../bun-install-native-binlink.test.ts        |  65 +++
 test/cli/install/bun-install-registry.test.ts |  22 +-
 test/cli/install/bun-lock.test.ts             |   9 +-
 test/cli/install/bun-pm-licenses.test.ts      |  10 +-
 test/cli/install/bun-prune.test.ts            |  35 ++
 test/cli/install/dep-glibc-1.0.0.tgz          | Bin 0 -> 219 bytes
 test/cli/install/dep-musl-2.0.0.tgz           | Bin 0 -> 216 bytes
 test/cli/install/dep-universal-3.0.0.tgz      | Bin 214 -> 217 bytes
 test/cli/install/dummy.registry.ts            |  30 +-
 test/cli/install/migration/migrate.test.ts    |  85 +++
 .../create-native-binlink-libc-packages.ts    |  75 +++
 .../package.json                              |  31 ++
 .../test-native-binlink-libc-glibc-1.0.0.tgz  | Bin 0 -> 364 bytes
 .../package.json                              |  31 ++
 .../test-native-binlink-libc-musl-1.0.0.tgz   | Bin 0 -> 364 bytes
 .../test-native-binlink-libc/package.json     |  26 +
 .../test-native-binlink-libc-1.0.0.tgz        | Bin 0 -> 391 bytes
 54 files changed, 1564 insertions(+), 346 deletions(-)
 create mode 100644 test/cli/install/dep-glibc-1.0.0.tgz
 create mode 100644 test/cli/install/dep-musl-2.0.0.tgz
 create mode 100644 test/cli/install/registry/packages/create-native-binlink-libc-packages.ts
 create mode 100644 test/cli/install/registry/packages/test-native-binlink-libc-glibc/package.json
 create mode 100644 test/cli/install/registry/packages/test-native-binlink-libc-glibc/test-native-binlink-libc-glibc-1.0.0.tgz
 create mode 100644 test/cli/install/registry/packages/test-native-binlink-libc-musl/package.json
 create mode 100644 test/cli/install/registry/packages/test-native-binlink-libc-musl/test-native-binlink-libc-musl-1.0.0.tgz
 create mode 100644 test/cli/install/registry/packages/test-native-binlink-libc/package.json
 create mode 100644 test/cli/install/registry/packages/test-native-binlink-libc/test-native-binlink-libc-1.0.0.tgz

diff --git a/completions/bun-cli.json b/completions/bun-cli.json
index 3d6d30cfbf4c..b930ee4b2815 100644
--- a/completions/bun-cli.json
+++ b/completions/bun-cli.json
@@ -1411,6 +1411,14 @@
           "required": false,
           "multiple": false
         },
+        {
+          "name": "libc",
+          "description": "Override libc for optional dependencies (e.g., glibc, musl, * for all)",
+          "hasValue": true,
+          "valueType": "val",
+          "required": false,
+          "multiple": false
+        },
         {
           "name": "help",
           "shortName": "h",
@@ -1861,6 +1869,14 @@
           "required": false,
           "multiple": false
         },
+        {
+          "name": "libc",
+          "description": "Override libc for optional dependencies (e.g., glibc, musl, * for all)",
+          "hasValue": true,
+          "valueType": "val",
+          "required": false,
+          "multiple": false
+        },
         {
           "name": "help",
           "shortName": "h",
@@ -1947,6 +1963,14 @@
           "required": false,
           "multiple": false
         },
+        {
+          "name": "libc",
+          "description": "Prune for a different libc than the current one",
+          "hasValue": true,
+          "valueType": "val",
+          "required": false,
+          "multiple": false
+        },
         {
           "name": "linker",
           "description": "Prune a node_modules installed with the given linker (one of \"isolated\" or \"hoisted\")",
diff --git a/completions/bun.bash b/completions/bun.bash
index 48b2f82ffb71..ab071e3aca25 100644
--- a/completions/bun.bash
+++ b/completions/bun.bash
@@ -105,7 +105,7 @@ _bun_completions() {
     PACKAGE_OPTIONS[SHARED_OPTIONS_SHORT]="-c -y -p -f -g";
 
     PACKAGE_OPTIONS[DEDUPE_OPTIONS_LONG]="--check --why";
-    PACKAGE_OPTIONS[PRUNE_OPTIONS_LONG]="--production --prod --omit --filter --dry-run --check --os --cpu --linker --silent --cwd --help";
+    PACKAGE_OPTIONS[PRUNE_OPTIONS_LONG]="--production --prod --omit --filter --dry-run --check --os --cpu --libc --linker --silent --cwd --help";
     PACKAGE_OPTIONS[PRUNE_OPTIONS_SHORT]="-p -P -F -h";
     PACKAGE_OPTIONS[AUDIT_OPTIONS_LONG]="--json --audit-level --ignore --prod --production --omit --dry-run --latest --cwd --help";
     PACKAGE_OPTIONS[AUDIT_OPTIONS_SHORT]="-L";
@@ -139,6 +139,9 @@ _bun_completions() {
         --linker)
             COMPREPLY=( $(compgen -W "isolated hoisted" -- "${cur_word}") );
             return;;
+        --libc)
+            COMPREPLY=( $(compgen -W "glibc musl" -- "${cur_word}") );
+            return;;
         --cwd|--public-dir)
             COMPREPLY=( $(compgen -d -- "${cur_word}" ));
             return;;
diff --git a/completions/bun.fish b/completions/bun.fish
index 3e79fe6e24b9..9acf8bb292ab 100644
--- a/completions/bun.fish
+++ b/completions/bun.fish
@@ -229,6 +229,7 @@ complete -c bun -n "__fish_seen_subcommand_from prune" -s "p" -l "production" -d
 complete -c bun -n "__fish_seen_subcommand_from prune" -s "P" -l "prod" -d "Also remove packages that are only needed by devDependencies" -f
 complete -c bun -n "__fish_seen_subcommand_from prune" -l "os" -r -d "Prune for a different operating system than the current one" -f
 complete -c bun -n "__fish_seen_subcommand_from prune" -l "cpu" -r -d "Prune for a different CPU architecture than the current one" -f
+complete -c bun -n "__fish_seen_subcommand_from prune" -l "libc" -r -a "glibc musl" -d "Prune for a different libc than the current one" -f
 complete -c bun -n "__fish_seen_subcommand_from prune" -l "linker" -r -a "isolated hoisted" -d "Prune a node_modules installed with the given linker" -f
 complete -c bun -n "__fish_seen_subcommand_from prune" -s "F" -l "filter" -r -d "Prune only the matching workspaces" -f
 complete -c bun -n "__fish_seen_subcommand_from prune" -l "silent" -d "Don't log anything" -f
diff --git a/completions/bun.zsh b/completions/bun.zsh
index e6730e01aa93..22ee60492abf 100644
--- a/completions/bun.zsh
+++ b/completions/bun.zsh
@@ -741,6 +741,7 @@ _bun_prune_completion() {
         '--check[Exit with code 1 if node_modules has packages that can be removed, without deleting anything]' \
         '*--os[Prune for a different operating system than the current one]:os' \
         '*--cpu[Prune for a different CPU architecture than the current one]:cpu' \
+        '*--libc[Prune for a different libc than the current one]:libc:(glibc musl)' \
         '--linker[Prune a node_modules installed with the given linker]:linker:(isolated hoisted)' \
         '*--filter[Only prune the node_modules folders of the matching workspaces]:workspace pattern' \
         '*-F[Only prune the node_modules folders of the matching workspaces]:workspace pattern' \
diff --git a/docs/pm/cli/install.mdx b/docs/pm/cli/install.mdx
index 6f362d7debce..08bd2a0b77dd 100644
--- a/docs/pm/cli/install.mdx
+++ b/docs/pm/cli/install.mdx
@@ -433,22 +433,28 @@ jobs:
 
 ## Platform-specific dependencies?
 
-Bun stores normalized `cpu` and `os` values from npm in the lockfile, along with the resolved packages. It skips downloading, extracting, and installing packages disabled for the current target at runtime. This means the lockfile doesn't change between platforms/architectures even if the packages ultimately installed do change.
+Bun stores normalized `cpu`, `os` and `libc` values from npm in the lockfile, along with the resolved packages. It skips downloading, extracting, and installing packages disabled for the current target at runtime. This means the lockfile doesn't change between platforms/architectures even if the packages ultimately installed do change.
 
-### `--cpu` and `--os` flags
+The `libc` field (`"glibc"` or `"musl"`) is how native packages such as `@rollup/rollup-linux-x64-gnu` and `@rollup/rollup-linux-x64-musl` tell the two Linux variants apart. npm only includes it in the full package metadata, so Bun requests the full metadata for `optionalDependencies`, where these variants are declared, and keeps using the smaller abbreviated metadata for everything else. Accordingly, `libc` is only checked for `optionalDependencies`: a package listed in `dependencies` or `devDependencies` is installed regardless of its `libc` field. By default, Bun on Linux installs the variant for the libc it was built against (the regular build is glibc, the `-musl` build is musl), and Bun on other operating systems does not filter by `libc` at all. The `--libc` flag below overrides this either way, for example to install for a Linux target from macOS.
+
+### `--cpu`, `--os` and `--libc` flags
 
 You can override the target platform for package selection:
 
 ```bash
-bun install --cpu=x64 --os=linux
+bun install --cpu=x64 --os=linux --libc=musl
 ```
 
-These flags install packages for the specified platform instead of the current system. Use them for cross-platform builds or when preparing deployments for different environments.
+These flags install packages for the specified platform instead of the current system. Use them for cross-platform builds or when preparing deployments for different environments, for example installing on a glibc machine for an Alpine image.
 
 **Accepted values for `--cpu`**: `arm`, `arm64`, `ia32`, `mips`, `mipsel`, `ppc`, `ppc64`, `s390`, `s390x`, `x32`, `x64`
 
 **Accepted values for `--os`**: `aix`, `darwin`, `freebsd`, `linux`, `openbsd`, `sunos`, `win32`, `android`
 
+**Accepted values for `--libc`**: `glibc`, `musl`
+
+Each flag can be repeated, takes `*` to allow every value, and takes `!name` to exclude one: `--libc='*'` installs both the glibc and the musl variant.
+
 ## Peer dependencies?
 
 Bun handles peer dependencies like Yarn: `bun install` installs them automatically. If the dependency is marked optional in `peerDependenciesMeta`, Bun uses an existing dependency if possible.
diff --git a/docs/pm/cli/prune.mdx b/docs/pm/cli/prune.mdx
index 5db2c86cd61f..40f2674b02c9 100644
--- a/docs/pm/cli/prune.mdx
+++ b/docs/pm/cli/prune.mdx
@@ -74,7 +74,7 @@ bun prune --production --filter app
 - Uses the same linker as `bun install` would. If `node_modules` was created with the other linker, `bun prune` refuses to run. Pass the matching `--linker`, or run `bun install`.
 - Matches packages by name. If a package is at the wrong version, Bun leaves it for `bun install` to replace. Bun only removes a nested copy (`node_modules/a/node_modules/b`) once the correct version is installed above it; otherwise Bun keeps it and prints a warning.
 - Never removes workspace folders, `.bin` entries still in use, dot-directories like `.cache`, plain files, or anything outside `node_modules`.
-- Removes packages disabled for the current `os`/`cpu`. Pass `--os`/`--cpu` to prune for another platform.
+- Removes packages disabled for the current `os`/`cpu`/`libc`. Pass `--os`/`--cpu`/`--libc` to prune for another platform.
 - Works on a pruned monorepo checkout (e.g. `turbo prune` output) the same way `bun install --frozen-lockfile` does.
 - If any entry fails to delete, the command still removes the rest and exits `1`.
 - `--global` is not supported.
diff --git a/docs/snippets/cli/link.mdx b/docs/snippets/cli/link.mdx
index e4ef4cd119a3..107c7abf34cb 100644
--- a/docs/snippets/cli/link.mdx
+++ b/docs/snippets/cli/link.mdx
@@ -147,6 +147,10 @@ bun link <packages>
   all)
 </ParamField>
 
+<ParamField path="--libc" type="string">
+  Override libc for optional dependencies (e.g., <code>glibc</code>, <code>musl</code>, <code>*</code> for all)
+</ParamField>
+
 ### Global Configuration &amp; Context
 
 <ParamField path="--config" type="string">
diff --git a/docs/snippets/cli/patch.mdx b/docs/snippets/cli/patch.mdx
index 71d991157771..1f74a5270ec0 100644
--- a/docs/snippets/cli/patch.mdx
+++ b/docs/snippets/cli/patch.mdx
@@ -159,6 +159,10 @@ bun patch <package>@<version>
   all)
 </ParamField>
 
+<ParamField path="--libc" type="string">
+  Override libc for optional dependencies (e.g., <code>glibc</code>, <code>musl</code>, <code>*</code> for all)
+</ParamField>
+
 ### Global Configuration &amp; Context
 
 <ParamField path="--config" type="string">
diff --git a/src/install/NetworkTask.rs b/src/install/NetworkTask.rs
index 119abd07082b..c753f1478ceb 100644
--- a/src/install/NetworkTask.rs
+++ b/src/install/NetworkTask.rs
@@ -132,6 +132,28 @@ pub struct DedupeMapEntry {
     /// later `enqueue_*_for_download` can observe the failure instead of
     /// re-scheduling the entire network task (and its retry cycle) a second time.
     pub(crate) failed: bool,
+    /// Manifest tasks only: a request for the extended document has been issued
+    /// for this task id. See `PackageManager::has_created_manifest_task`.
+    pub(crate) is_extended_manifest: bool,
+    /// Manifest tasks only: a request for the abbreviated document has been
+    /// issued for this task id.
+    pub(crate) has_abbreviated_manifest_request: bool,
+    /// Manifest tasks only: the extended request failed. Every dependency on the
+    /// package now resolves from the abbreviated document instead
+    /// (`PackageManager::needs_extended_manifest`), which is the pre-libc
+    /// behavior for this one package.
+    pub(crate) extended_manifest_failed: bool,
+}
+
+impl DedupeMapEntry {
+    /// Whether the document a dependency needs has been requested.
+    pub(crate) fn manifest_requested(&mut self, extended: bool) -> &mut bool {
+        if extended {
+            &mut self.is_extended_manifest
+        } else {
+            &mut self.has_abbreviated_manifest_request
+        }
+    }
 }
 /// `Id` is already a wyhash output, so identity hashing
 /// (hash = value bits) avoids re-hashing.
diff --git a/src/install/PackageInstaller.rs b/src/install/PackageInstaller.rs
index a12ea5311187..dbc381ab3cf3 100644
--- a/src/install/PackageInstaller.rs
+++ b/src/install/PackageInstaller.rs
@@ -625,6 +625,7 @@ impl<'a> PackageInstaller<'a> {
                         PostinstallOptimizer::NativeBinlink => {
                             let target_cpu = manager.options.cpu;
                             let target_os = manager.options.os;
+                            let target_libc = manager.options.libc;
                             if let Some(replacement_pkg_id) =
                                 PostinstallOptimizer::get_native_binlink_replacement_package_id(
                                     pkg_resolutions_lists[package_id as usize]
@@ -632,6 +633,7 @@ impl<'a> PackageInstaller<'a> {
                                     pkg_metas,
                                     target_cpu,
                                     target_os,
+                                    target_libc,
                                 )
                             {
                                 let Some(target_tree_id) = find_native_binlink_target_tree(
@@ -2044,6 +2046,7 @@ impl<'a> PackageInstaller<'a> {
                                     self.lockfile().packages.items_meta(),
                                     self.manager().options.cpu,
                                     self.manager().options.os,
+                                    self.manager().options.libc,
                                 )
                             {
                                 if PackageManager::verbose_install() {
@@ -2362,6 +2365,7 @@ impl<'a> PackageInstaller<'a> {
                             self.lockfile().packages.items_meta(),
                             self.manager().options.cpu,
                             self.manager().options.os,
+                            self.manager().options.libc,
                         )
                     {
                         if PackageManager::verbose_install() {
diff --git a/src/install/PackageManager/CommandLineArguments.rs b/src/install/PackageManager/CommandLineArguments.rs
index 23053322cce5..59881567dd74 100644
--- a/src/install/PackageManager/CommandLineArguments.rs
+++ b/src/install/PackageManager/CommandLineArguments.rs
@@ -32,6 +32,41 @@ fn pretty_help(text: &str) {
     Output::pretty(text);
 }
 
+/// `--cpu` / `--os` / `--libc`: each may be repeated, values combine like the
+/// package.json arrays they filter against (`!name` negates, `*` or `any`
+/// allows everything, `none` is accepted as-is). `None` when the flag was not
+/// passed. `Negatable::apply` tolerates unknown names because a package.json
+/// may name a platform this build does not know; on the command line an
+/// unknown name, negated or not, is a typo and fatal.
+fn parse_platform_flag<T: Npm::NegatableEnum>(
+    values: &[&[u8]],
+    what: &str,
+    valid_names: &str,
+) -> Option<T> {
+    if values.is_empty() {
+        return None;
+    }
+    let mut negatable = Npm::Negatable::<T>::default();
+    for &value in values {
+        match value {
+            b"*" => negatable.had_wildcard = true,
+            b"any" | b"none" => negatable.apply(value),
+            _ => {
+                let name = value.strip_prefix(b"!").unwrap_or(value);
+                if T::lookup_name(name).is_none() {
+                    Output::err_generic(
+                        "Invalid {}: '{}'. Valid values are: *, any, {}. Use !name to negate.",
+                        (what, bstr::BStr::new(value), valid_names),
+                    );
+                    Global::crash();
+                }
+                negatable.apply(value);
+            }
+        }
+    }
+    Some(negatable.combine())
+}
+
 type ParamType = clap::Param<clap::Help>;
 
 // `bun_clap::concat_params!` is a const-fn slice concat over `Param<Help>`, so combined tables
@@ -145,6 +180,9 @@ const SHARED_TAIL_PARAMS: &[ParamType] = &[
     clap::param!(
         "--os <STR>...                         Override operating system for optional dependencies (e.g., linux, darwin, * for all)"
     ),
+    clap::param!(
+        "--libc <STR>...                       Override libc for optional dependencies (e.g., glibc, musl, * for all)"
+    ),
     clap::param!("-h, --help                            Print this help menu"),
 ];
 
@@ -520,6 +558,9 @@ const PRUNE_HELP_PARAMS: &[ParamType] = &[
     clap::param!(
         "--cpu <STR>...                         Prune for a different CPU architecture than the current one"
     ),
+    clap::param!(
+        "--libc <STR>...                        Prune for a different libc than the current one"
+    ),
     clap::param!(
         "--linker <STR>                         Prune a node_modules installed with the given linker (one of \"isolated\" or \"hoisted\")"
     ),
@@ -624,9 +665,10 @@ pub struct CommandLineArguments {
     pub audit_level: Option<AuditLevel>,
     pub audit_ignore_list: &'static [&'static [u8]],
 
-    // CPU and OS overrides for optional dependencies
+    // CPU, OS and libc overrides for optional dependencies
     pub(crate) cpu: Npm::Architecture,
     pub(crate) os: Npm::OperatingSystem,
+    pub(crate) libc: Npm::Libc,
 }
 
 impl Default for CommandLineArguments {
@@ -713,6 +755,7 @@ impl Default for CommandLineArguments {
 
             cpu: Npm::Architecture::CURRENT,
             os: Npm::OperatingSystem::CURRENT,
+            libc: Npm::Libc::CURRENT,
         }
     }
 }
@@ -1549,58 +1592,22 @@ Full documentation is available at <magenta>https://bun.com/docs/pm/cli/prune<r>
             cli.config = Some(opt);
         }
 
-        // Parse multiple --cpu flags and combine them using Negatable
-        let cpu_values = args.options(b"--cpu");
-        if !cpu_values.is_empty() {
-            let mut cpu_negatable = Npm::Architecture::NONE.negatable();
-            for cpu_str in cpu_values {
-                // apply() already handles "any" as wildcard and negation with !
-                cpu_negatable.apply(cpu_str);
-
-                // Support * as an alias for "any"
-                if *cpu_str == *b"*" {
-                    cpu_negatable.had_wildcard = true;
-                    cpu_negatable.had_unrecognized_values = false;
-                } else if cpu_negatable.had_unrecognized_values
-                    && *cpu_str != *b"any"
-                    && *cpu_str != *b"none"
-                {
-                    // Only error for truly unrecognized values (not "any" or "none")
-                    Output::err_generic(
-                        "Invalid CPU architecture: '{}'. Valid values are: *, any, arm, arm64, ia32, mips, mipsel, ppc, ppc64, s390, s390x, x32, x64. Use !name to negate.",
-                        (bstr::BStr::new(cpu_str),),
-                    );
-                    Global::crash();
-                }
-            }
-            cli.cpu = cpu_negatable.combine();
+        if let Some(cpu) = parse_platform_flag(
+            args.options(b"--cpu"),
+            "CPU architecture",
+            "arm, arm64, ia32, mips, mipsel, ppc, ppc64, s390, s390x, x32, x64",
+        ) {
+            cli.cpu = cpu;
         }
-
-        // Parse multiple --os flags and combine them using Negatable
-        let os_values = args.options(b"--os");
-        if !os_values.is_empty() {
-            let mut os_negatable = Npm::OperatingSystem::NONE.negatable();
-            for os_str in os_values {
-                // apply() already handles "any" as wildcard and negation with !
-                os_negatable.apply(os_str);
-
-                // Support * as an alias for "any"
-                if *os_str == *b"*" {
-                    os_negatable.had_wildcard = true;
-                    os_negatable.had_unrecognized_values = false;
-                } else if os_negatable.had_unrecognized_values
-                    && *os_str != *b"any"
-                    && *os_str != *b"none"
-                {
-                    // Only error for truly unrecognized values (not "any" or "none")
-                    Output::err_generic(
-                        "Invalid operating system: '{}'. Valid values are: *, any, aix, darwin, freebsd, linux, openbsd, sunos, win32, android. Use !name to negate.",
-                        (bstr::BStr::new(os_str),),
-                    );
-                    Global::crash();
-                }
-            }
-            cli.os = os_negatable.combine();
+        if let Some(os) = parse_platform_flag(
+            args.options(b"--os"),
+            "operating system",
+            "aix, darwin, freebsd, linux, openbsd, sunos, win32, android",
+        ) {
+            cli.os = os;
+        }
+        if let Some(libc) = parse_platform_flag(args.options(b"--libc"), "libc", "glibc, musl") {
+            cli.libc = libc;
         }
 
         if matches!(subcommand, Subcommand::Add | Subcommand::Install) {
diff --git a/src/install/PackageManager/PackageManagerEnqueue.rs b/src/install/PackageManager/PackageManagerEnqueue.rs
index 83f6ba389307..2b6ecab5d6e7 100644
--- a/src/install/PackageManager/PackageManagerEnqueue.rs
+++ b/src/install/PackageManager/PackageManagerEnqueue.rs
@@ -1057,12 +1057,13 @@ pub fn enqueue_dependency_with_main_and_success_fn(
                         }
 
                         if !dependency.behavior.is_peer() || install_peer {
-                            if !this.has_created_network_task(
+                            let needs_extended_manifest =
+                                this.needs_extended_manifest(dependency.behavior, task_id);
+                            if !this.has_created_manifest_task(
                                 task_id,
                                 dependency.behavior.is_required(),
+                                needs_extended_manifest,
                             ) {
-                                let needs_extended_manifest =
-                                    this.options.minimum_release_age_ms.is_some();
                                 if this.options.enable.manifest_cache() {
                                     let mut expired = false;
                                     // SAFETY: `this_ptr` is the live exclusive
@@ -1133,9 +1134,10 @@ pub fn enqueue_dependency_with_main_and_success_fn(
                                                         // Reported by the `TooRecentVersion` arm above, like a fresh manifest would be.
                                                         resolve_result_ =
                                                             Err(crate::Error::TooRecentVersion);
-                                                        let _ = this
-                                                            .network_dedupe_map
-                                                            .remove(&task_id);
+                                                        this.manifest_request_not_sent(
+                                                            task_id,
+                                                            needs_extended_manifest,
+                                                        );
                                                         continue 'retry_with_new_resolve_result;
                                                     }
                                                 }
@@ -1167,8 +1169,10 @@ pub fn enqueue_dependency_with_main_and_success_fn(
                                                     .flatten()
                                                 {
                                                     resolve_result_ = Ok(Some(new_resolve_result));
-                                                    let _ =
-                                                        this.network_dedupe_map.remove(&task_id);
+                                                    this.manifest_request_not_sent(
+                                                        task_id,
+                                                        needs_extended_manifest,
+                                                    );
                                                     continue 'retry_with_new_resolve_result;
                                                 }
                                             }
@@ -1177,7 +1181,10 @@ pub fn enqueue_dependency_with_main_and_success_fn(
                                         // Was it recent enough to just load it without the network call?
                                         if this.options.enable.manifest_cache_control() && !expired
                                         {
-                                            let _ = this.network_dedupe_map.remove(&task_id);
+                                            this.manifest_request_not_sent(
+                                                task_id,
+                                                needs_extended_manifest,
+                                            );
                                             continue 'retry_from_manifests_ptr;
                                         }
                                     }
@@ -2282,6 +2289,10 @@ fn get_or_put_resolved_package_with_find_result(
     let pins = !behavior.is_peer()
         && version.tag == dependency::version::Tag::Npm
         && version.npm().version.is_exact();
+    let npm_resolution = Resolution::init(ResolutionTagged::Npm(ResolutionNpmValue {
+        version: find_result.version,
+        url: find_result.package.tarball_url.value,
+    }));
     if let Some(id) = this.lockfile.get_package_id(
         name_hash,
         if should_update || suppress_peer_satisfies {
@@ -2289,14 +2300,26 @@ fn get_or_put_resolved_package_with_find_result(
         } else {
             Some(version)
         },
-        &Resolution::init(ResolutionTagged::Npm(ResolutionNpmValue {
-            version: find_result.version,
-            url: find_result.package.tarball_url.value,
-        })),
+        &npm_resolution,
     ) {
         if pins {
             this.lockfile.mark_pinned_by_reuse(id);
         }
+        // The existing entry may have been created from the abbreviated
+        // manifest (a regular dependency elsewhere in the tree, or a lockfile
+        // written before `libc` was recorded); this manifest knows the libc.
+        if find_result.package.libc != Npm::Libc::NONE {
+            let buf = this.lockfile.buffers.string_bytes.as_slice();
+            let same_version = this.lockfile.packages.items_resolution()[id as usize].eql(
+                &npm_resolution,
+                buf,
+                buf,
+            );
+            let meta = &mut this.lockfile.packages.items_meta_mut()[id as usize];
+            if same_version && meta.libc == Npm::Libc::NONE {
+                meta.libc = find_result.package.libc;
+            }
+        }
         success_fn(this, dependency_id, id);
         return Ok(Some(ResolvedPackageResult {
             package: *this.lockfile.packages.get(id as usize),
@@ -2346,6 +2369,7 @@ fn get_or_put_resolved_package_with_find_result(
     let result = match determine_preinstall_state(
         this,
         &package,
+        behavior,
         &mut name_and_version_hash,
         &mut patchfile_hash,
     ) {
@@ -2509,7 +2533,10 @@ fn get_or_put_resolved_package(
             // materializing `&mut *this_ptr` after `name_str`/`scope` are
             // derived from it would pop their borrow-stack tags under SB.
             let cache_ctx = this.manifest_disk_cache_ctx();
-            let needs_ext = this.options.minimum_release_age_ms.is_some();
+            let needs_ext = this.needs_extended_manifest(
+                behavior,
+                Task::Id::for_manifest(this.lockfile.str(&name)),
+            );
             let this_ptr: *mut PackageManager = this;
             // SAFETY: `string_bytes` is not resized between here and the
             // `find_result` lookup; `manifest` lives in `this.manifests` and
diff --git a/src/install/PackageManager/PackageManagerLifecycle.rs b/src/install/PackageManager/PackageManagerLifecycle.rs
index aa52d8f33ce2..caef511a4193 100644
--- a/src/install/PackageManager/PackageManagerLifecycle.rs
+++ b/src/install/PackageManager/PackageManagerLifecycle.rs
@@ -25,7 +25,7 @@ use crate::lockfile_real::package::scripts::List as ScriptsList;
 use crate::package_manager_real::Command;
 use crate::resolution_real::Tag as ResolutionTag;
 use bun_install::lockfile::{Lockfile, Package};
-use bun_install::{PackageID, PackageManager, PreinstallState, invalid_package_id};
+use bun_install::{Behavior, PackageID, PackageManager, PreinstallState, invalid_package_id};
 
 impl PackageManager {
     pub(crate) fn ensure_preinstall_state_list_capacity(&mut self, count: usize) {
@@ -63,9 +63,11 @@ impl PackageManager {
     /// A separate `lockfile` parameter would always be `manager.lockfile` at every call
     /// site; collapsed onto `self.lockfile` to avoid the
     /// `&mut self` / `&self.lockfile` aliasing borrowck rejects.
+    /// `dependency` is the dependency `pkg` is being resolved for.
     pub fn determine_preinstall_state(
         &mut self,
         pkg: &Package,
+        dependency: Behavior,
         out_name_and_version_hash: &mut Option<u64>,
         out_patchfile_hash: &mut Option<u64>,
     ) -> PreinstallState {
@@ -73,10 +75,23 @@ impl PackageManager {
             PreinstallState::Unknown => {
                 // Do not automatically start downloading packages which are disabled
                 // i.e. don't download all of esbuild's versions or SWCs
-                if pkg.is_disabled(self.options.cpu, self.options.os) {
+                if !pkg.meta.arch.is_match(self.options.cpu)
+                    || !pkg.meta.os.is_match(self.options.os)
+                {
                     self.set_preinstall_state(pkg.meta.id, PreinstallState::Done);
                     return PreinstallState::Done;
                 }
+                // Nor the other libc's variant of a native package. Unlike os/cpu this only
+                // holds for the dependency at hand (`Libc::for_dependency`): a regular
+                // dependency on the same package resolved later still installs it, and the
+                // installer downloads it at that point because the state is left untouched.
+                if !pkg
+                    .meta
+                    .libc
+                    .is_match(self.options.libc.for_dependency(dependency))
+                {
+                    return PreinstallState::Done;
+                }
 
                 let patch_hash: Option<u64> = 'brk: {
                     if self.lockfile.patched_dependencies.len() == 0 {
@@ -593,8 +608,14 @@ pub fn get_preinstall_state(this: &PackageManager, package_id: PackageID) -> Pre
 pub fn determine_preinstall_state(
     this: &mut PackageManager,
     pkg: &Package,
+    dependency: Behavior,
     out_name_and_version_hash: &mut Option<u64>,
     out_patchfile_hash: &mut Option<u64>,
 ) -> PreinstallState {
-    this.determine_preinstall_state(pkg, out_name_and_version_hash, out_patchfile_hash)
+    this.determine_preinstall_state(
+        pkg,
+        dependency,
+        out_name_and_version_hash,
+        out_patchfile_hash,
+    )
 }
diff --git a/src/install/PackageManager/PackageManagerOptions.rs b/src/install/PackageManager/PackageManagerOptions.rs
index b82ad0dd4ff9..75765a6cc269 100644
--- a/src/install/PackageManager/PackageManagerOptions.rs
+++ b/src/install/PackageManager/PackageManagerOptions.rs
@@ -9,7 +9,7 @@ use super::Subcommand;
 use super::command_line_arguments::{self, CommandLineArguments};
 use crate::network_task::Authorization;
 use bun_dotenv::Loader as DotEnvLoader;
-use bun_install::{Features, Npm};
+use bun_install::{Behavior, Features, Npm};
 
 // `string` fields are `[]const u8` borrowed from CLI args / bunfig config,
 // which live for the process lifetime. There is no `deinit` on Options. Mapped to
@@ -104,10 +104,31 @@ pub struct Options {
     pub cpu: Npm::Architecture,
     /// Override OS for optional dependencies filtering
     pub os: Npm::OperatingSystem,
+    /// Override libc for optional dependencies filtering
+    pub libc: Npm::Libc,
 
     pub(crate) config_version: Option<ConfigVersion>,
 }
 
+impl Options {
+    /// Whether picking versions needs the full registry document instead of the
+    /// abbreviated one: only the full one has the publish times `minimumReleaseAge`
+    /// filters on.
+    pub(crate) fn needs_extended_manifest_to_pick_versions(&self) -> bool {
+        self.minimum_release_age_ms.is_some()
+    }
+
+    /// Whether resolving `dependency` needs the full registry document. Besides
+    /// the publish times, the abbreviated document lacks the `libc` field, which
+    /// is only enforced for optional dependencies (`Libc::for_dependency`), so
+    /// only those pay for the larger document. This is also what decides the
+    /// `libc` recorded in the lockfile, so it does not depend on the host: a
+    /// lockfile written on macOS still filters on Linux.
+    pub(crate) fn needs_extended_manifest(&self, dependency: Behavior) -> bool {
+        self.needs_extended_manifest_to_pick_versions() || dependency.is_optional()
+    }
+}
+
 impl Default for Options {
     fn default() -> Self {
         Self {
@@ -174,6 +195,7 @@ impl Default for Options {
             minimum_release_age_excludes: None,
             cpu: Npm::Architecture::CURRENT,
             os: Npm::OperatingSystem::CURRENT,
+            libc: Npm::Libc::CURRENT,
             config_version: None,
         }
     }
@@ -1089,9 +1111,10 @@ impl Options {
                     .store(backend as u8, core::sync::atomic::Ordering::Relaxed);
             }
 
-            // CPU and OS are now parsed as enums in CommandLineArguments, just copy them
+            // CPU, OS and libc are now parsed as enums in CommandLineArguments, just copy them
             self.cpu = cli.cpu;
             self.os = cli.os;
+            self.libc = cli.libc;
 
             self.do_.set(Do::UPDATE_TO_LATEST, cli.latest);
             self.do_.set(Do::RECURSIVE, cli.recursive);
diff --git a/src/install/PackageManager/PopulateManifestCache.rs b/src/install/PackageManager/PopulateManifestCache.rs
index 92750c35cc3c..0ceb71398ccc 100644
--- a/src/install/PackageManager/PopulateManifestCache.rs
+++ b/src/install/PackageManager/PopulateManifestCache.rs
@@ -50,7 +50,8 @@ fn start_manifest_task(
     needs_extended_manifest: bool,
 ) -> Result<(), StartManifestTaskError> {
     let task_id = Task::Id::for_manifest(pkg_name);
-    if run_tasks::has_created_network_task(manager, task_id, is_required) {
+    if run_tasks::has_created_manifest_task(manager, task_id, is_required, needs_extended_manifest)
+    {
         return Ok(());
     }
     if manager.options.log_level.show_progress() {
@@ -94,6 +95,8 @@ fn start_manifest_task(
 #[derive(Clone, Copy)]
 pub enum Packages<'a> {
     /// Every npm package in the lockfile; best-effort (the post-migration backfill), so failures are warnings.
+    /// The only mode that records platform fields, so the only one that requests the extended document
+    /// for optional dependencies (`Options::needs_extended_manifest`); the other two just pick versions.
     All,
     /// The direct dependencies of these workspace packages; a required one failing is an error, see [`print_fetch_failures`].
     Ids(&'a [PackageID]),
@@ -149,9 +152,14 @@ pub fn populate_manifest_cache(
 
     match packages {
         Packages::All => {
-            let mut seen_pkg_ids: HashMap<PackageID, ()> = HashMap::new();
+            // Value: whether the extended document was already requested for the
+            // package. A package that is a regular dependency of one package and an
+            // optional dependency of another needs the extended one whichever of its
+            // dependencies comes first (`has_created_manifest_task` dedupes the
+            // requests themselves).
+            let mut seen_pkg_ids: HashMap<PackageID, bool> = HashMap::new();
 
-            for _dep_id in 0..dependencies.len() {
+            for (_dep_id, dep) in dependencies.iter().enumerate() {
                 let dep_id: DependencyID = DependencyID::try_from(_dep_id).expect("int cast");
 
                 let pkg_id = resolutions[dep_id as usize];
@@ -159,10 +167,15 @@ pub fn populate_manifest_cache(
                     continue;
                 }
 
-                // `getOrPut(pkg_id).found_existing` — value is `void`, so this is a set insert.
-                if seen_pkg_ids.insert(pkg_id, ()).is_some() {
+                // `options` is not mutated between here and the
+                // `start_manifest_task` call — read via the BACKREF `mgr_ref`.
+                let needs_extended_manifest = mgr_ref.options.needs_extended_manifest(dep.behavior);
+
+                let seen = seen_pkg_ids.get_or_put(pkg_id)?;
+                if seen.found_existing && (*seen.value_ptr || !needs_extended_manifest) {
                     continue;
                 }
+                *seen.value_ptr = needs_extended_manifest;
 
                 let res = &pkg_resolutions[pkg_id as usize];
                 if res.tag != ResolutionTag::Npm {
@@ -171,9 +184,6 @@ pub fn populate_manifest_cache(
 
                 let pkg_name = pkg_names[pkg_id as usize];
                 let pkg_name_slice = pkg_name.slice(string_buf);
-                // `options` is not mutated between here and the
-                // `start_manifest_task` call — read via the BACKREF `mgr_ref`.
-                let needs_extended_manifest = mgr_ref.options.minimum_release_age_ms.is_some();
 
                 // `scope_for_package_name` borrows only `options` (via the
                 // BACKREF `mgr_ref`); `manifests` is a disjoint field projected
@@ -232,7 +242,8 @@ pub fn populate_manifest_cache(
 
                     // `options` read via BACKREF `mgr_ref` — see provenance-root
                     // note above.
-                    let needs_extended_manifest = mgr_ref.options.minimum_release_age_ms.is_some();
+                    let needs_extended_manifest =
+                        mgr_ref.options.needs_extended_manifest_to_pick_versions();
                     let package_name = pkg_names[pkg_id as usize].slice(string_buf);
                     // See disjoint-field note on the `.All` arm above.
                     let scope =
@@ -268,12 +279,13 @@ pub fn populate_manifest_cache(
             }
         }
         Packages::Exact(ids) => {
+            let needs_extended_manifest =
+                mgr_ref.options.needs_extended_manifest_to_pick_versions();
             for &pkg_id in ids {
                 if pkg_resolutions[pkg_id as usize].tag != ResolutionTag::Npm {
                     continue;
                 }
                 let package_name = pkg_names[pkg_id as usize].slice(string_buf);
-                let needs_extended_manifest = mgr_ref.options.minimum_release_age_ms.is_some();
                 let scope =
                     bun_ptr::BackRef::new(mgr_ref.options.scope_for_package_name(package_name));
                 // SAFETY: `manifests` is disjoint from `options`/`lockfile`; `manager_ptr` is the SRW root.
diff --git a/src/install/PackageManager/runTasks.rs b/src/install/PackageManager/runTasks.rs
index 73340d4ea5c0..82b19cbaa4c5 100644
--- a/src/install/PackageManager/runTasks.rs
+++ b/src/install/PackageManager/runTasks.rs
@@ -27,7 +27,6 @@ use crate::isolated_install::installer as store_installer;
 use crate::isolated_install::store::{EntryColumns as _, NodeColumns as _};
 use crate::lifecycle_script_runner::InstallCtx;
 use crate::network_task::{Authorization, ForTarballError};
-use crate::package_manifest_map::Value as ManifestEntry;
 use bun_core::fmt::{EscapeControlChars, PathSep, escape_control_chars, redacted};
 use bun_install::lockfile::Package;
 use bun_install::package_manager_task as Task;
@@ -417,6 +416,47 @@ pub fn run_tasks<C: RunTasksCallbacks>(
                     }
                 }
 
+                let request_failed = task
+                    .response
+                    .metadata
+                    .as_ref()
+                    .is_none_or(|metadata| metadata.response.status_code > 399);
+                // Only while resolving: the manifests-only callers (lockfile
+                // migrations, `bun outdated`, ...) have nothing waiting that
+                // could fall back, so for them a failed request is just that.
+                if request_failed
+                    && is_extended_manifest
+                    && !C::MANIFESTS_ONLY
+                    && manager.fall_back_to_abbreviated_manifest(task.task_id)
+                {
+                    let reason = match task.response.metadata.as_ref() {
+                        Some(metadata) => format!("HTTP {}", metadata.response.status_code),
+                        None => task
+                            .response
+                            .fail
+                            .map(crate::Error::from)
+                            .unwrap_or(crate::Error::HTTPError)
+                            .name()
+                            .to_string(),
+                    };
+                    bun_ast::add_warning_pretty!(
+                        manager.log_mut(),
+                        None,
+                        bun_ast::Loc::EMPTY,
+                        "{} downloading the full package metadata for <b>{}<r>, using the abbreviated metadata: its <b>libc<r> field will not be checked",
+                        reason,
+                        bstr::BStr::new(name),
+                    );
+
+                    process_manifest_task_queue::<C>(
+                        manager,
+                        task.task_id,
+                        extract_ctx,
+                        install_peer,
+                    )?;
+                    continue;
+                }
+
                 let Some(metadata) = task.response.metadata.as_ref() else {
                     // Handle non-retry-able errors.
                     let err = task
@@ -555,15 +595,11 @@ pub fn run_tasks<C: RunTasksCallbacks>(
 
                         manifest.pkg.public_max_age = timestamp_this_tick.unwrap();
 
-                        // reshaped for borrowck —
-                        // `bun_collections::HashMap` lacks `get_or_put` for
-                        // non-`Default` values, so insert by-value (overwriting
-                        // any prior entry) and reborrow.
+                        // Insert by-value and reborrow below; `insert` may keep
+                        // an extended manifest that arrived in the meantime, in
+                        // which case that is the one written back to disk.
                         let name_hash = manifest.pkg.name.hash;
-                        manager
-                            .manifests
-                            .hash_map
-                            .insert(name_hash, ManifestEntry::Manifest(manifest));
+                        manager.manifests.insert(name_hash, manifest)?;
 
                         if manager.options.enable.contains(Enable::MANIFEST_CACHE) {
                             // reshaped for borrowck — compute the
@@ -592,16 +628,9 @@ pub fn run_tasks<C: RunTasksCallbacks>(
                             continue;
                         }
 
-                        let dependency_list_entry = manager
-                            .task_queue
-                            .get_mut(&task.task_id)
-                            .expect("infallible: task queued");
-
-                        let dependency_list = core::mem::take(dependency_list_entry);
-
-                        process_dependency_list_for_ctx::<C>(
+                        process_manifest_task_queue::<C>(
                             manager,
-                            dependency_list,
+                            task.task_id,
                             extract_ctx,
                             install_peer,
                         )?;
@@ -1031,18 +1060,7 @@ pub fn run_tasks<C: RunTasksCallbacks>(
                     continue;
                 }
 
-                let dependency_list_entry = manager
-                    .task_queue
-                    .get_mut(&task.id)
-                    .expect("infallible: task queued");
-                let dependency_list = core::mem::take(dependency_list_entry);
-
-                process_dependency_list_for_ctx::<C>(
-                    manager,
-                    dependency_list,
-                    extract_ctx,
-                    install_peer,
-                )?;
+                process_manifest_task_queue::<C>(manager, task.id, extract_ctx, install_peer)?;
 
                 if let Some(name) = progress_name {
                     manager.set_node_name::<true>(
@@ -1792,6 +1810,92 @@ pub fn has_created_network_task(
     gpe.found_existing
 }
 
+/// `has_created_network_task` for manifest requests, which are deduplicated per
+/// document: a package that is a regular dependency of one package and an
+/// optional dependency of another is requested both ways, whichever of the two
+/// dependencies comes first, since the abbreviated document does not cover the
+/// dependency that needs the extended one (see
+/// `PackageManager::needs_extended_manifest`). Both responses drain the same
+/// `task_queue` entry and `PackageManifestMap::insert` keeps the extended one.
+pub fn has_created_manifest_task(
+    this: &mut PackageManager,
+    task_id: Task::Id,
+    is_required: bool,
+    needs_extended_manifest: bool,
+) -> bool {
+    has_created_network_task(this, task_id, is_required);
+    let entry = this
+        .network_dedupe_map
+        .get_mut(&task_id)
+        .expect("inserted by has_created_network_task");
+    core::mem::replace(entry.manifest_requested(needs_extended_manifest), true)
+}
+
+/// The caller of `has_created_manifest_task` resolved from the manifest cache
+/// instead of sending the request it was cleared to send. Forget that request;
+/// the entry stays as long as it records anything else (a request of the other
+/// kind that is in flight, or a failed extended request), otherwise a later
+/// dependency would request that document again or wait for it.
+pub fn manifest_request_not_sent(
+    this: &mut PackageManager,
+    task_id: Task::Id,
+    needs_extended_manifest: bool,
+) {
+    let Some(entry) = this.network_dedupe_map.get_mut(&task_id) else {
+        return;
+    };
+    *entry.manifest_requested(needs_extended_manifest) = false;
+    if !entry.is_extended_manifest
+        && !entry.has_abbreviated_manifest_request
+        && !entry.extended_manifest_failed
+    {
+        let _ = this.network_dedupe_map.remove(&task_id);
+    }
+}
+
+/// `Options::needs_extended_manifest`, unless the extended request for this
+/// package has failed and the abbreviated one stands in for it
+/// (`fall_back_to_abbreviated_manifest`). Every lookup on the resolve path goes
+/// through this so that dependencies enqueued after the failure resolve from the
+/// abbreviated document too instead of waiting for a response that is not coming.
+pub fn needs_extended_manifest(
+    this: &PackageManager,
+    dependency: Behavior,
+    task_id: Task::Id,
+) -> bool {
+    if this.options.needs_extended_manifest_to_pick_versions() {
+        return true;
+    }
+    this.options.needs_extended_manifest(dependency)
+        && !this
+            .network_dedupe_map
+            .get(&task_id)
+            .is_some_and(|entry| entry.extended_manifest_failed)
+}
+
+/// Called when the request for the extended document of a manifest has failed
+/// for good. From then on the package behaves as it did before libc was read:
+/// every dependency on it resolves from the abbreviated document, losing only
+/// the `libc` filtering of this one package. The caller re-enqueues the
+/// dependencies that were waiting for the extended document; each of them then
+/// resolves from the abbreviated document if it is cached or was requested as
+/// well, and otherwise the first of them requests it (`has_created_manifest_task`
+/// dedupes that request), whose failure is then reported like that of any other
+/// manifest. Returns false when there is nothing to fall back to because the
+/// extended document is what versions are picked from (`minimumReleaseAge`):
+/// the abbreviated one has no publish times.
+pub fn fall_back_to_abbreviated_manifest(this: &mut PackageManager, task_id: Task::Id) -> bool {
+    if this.options.needs_extended_manifest_to_pick_versions() {
+        return false;
+    }
+    let entry = this
+        .network_dedupe_map
+        .get_or_put(task_id)
+        .expect("unreachable");
+    entry.value_ptr.extended_manifest_failed = true;
+    true
+}
+
 pub fn is_network_task_required(this: &PackageManager, task_id: Task::Id) -> bool {
     match this.network_dedupe_map.get(&task_id) {
         Some(v) => v.is_required,
@@ -1980,6 +2084,31 @@ impl PackageManager {
         has_created_network_task(self, task_id, is_required)
     }
     #[inline]
+    pub(crate) fn has_created_manifest_task(
+        &mut self,
+        task_id: Task::Id,
+        is_required: bool,
+        needs_extended_manifest: bool,
+    ) -> bool {
+        has_created_manifest_task(self, task_id, is_required, needs_extended_manifest)
+    }
+    #[inline]
+    pub(crate) fn manifest_request_not_sent(
+        &mut self,
+        task_id: Task::Id,
+        needs_extended_manifest: bool,
+    ) {
+        manifest_request_not_sent(self, task_id, needs_extended_manifest)
+    }
+    #[inline]
+    pub(crate) fn needs_extended_manifest(&self, dependency: Behavior, task_id: Task::Id) -> bool {
+        needs_extended_manifest(self, dependency, task_id)
+    }
+    #[inline]
+    pub(crate) fn fall_back_to_abbreviated_manifest(&mut self, task_id: Task::Id) -> bool {
+        fall_back_to_abbreviated_manifest(self, task_id)
+    }
+    #[inline]
     pub(crate) fn is_network_task_required(&self, task_id: Task::Id) -> bool {
         is_network_task_required(self, task_id)
     }
@@ -2001,6 +2130,23 @@ impl PackageManager {
     }
 }
 
+/// Resolves the dependencies waiting for the manifest with this task id. A
+/// dependency that still cannot be resolved (it needs the extended document and
+/// the response was the abbreviated one) queues itself up again.
+fn process_manifest_task_queue<C: RunTasksCallbacks>(
+    manager: &mut PackageManager,
+    task_id: Task::Id,
+    extract_ctx: &mut C::Ctx,
+    install_peer: bool,
+) -> crate::Result<()> {
+    let dependency_list_entry = manager
+        .task_queue
+        .get_mut(&task_id)
+        .expect("infallible: task queued");
+    let dependency_list = core::mem::take(dependency_list_entry);
+    process_dependency_list_for_ctx::<C>(manager, dependency_list, extract_ctx, install_peer)
+}
+
 /// Adapter wrapping the existing `PackageManager::process_dependency_list` so
 /// it can be driven by a `RunTasksCallbacks` impl, dispatching `on_resolve`
 /// if any root dep changed.
diff --git a/src/install/PackageManifestMap.rs b/src/install/PackageManifestMap.rs
index cdd492b83b82..fc8f4e942eb4 100644
--- a/src/install/PackageManifestMap.rs
+++ b/src/install/PackageManifestMap.rs
@@ -74,11 +74,32 @@ impl PackageManifestMap {
         )
     }
 
+    /// Stores a manifest that was just fetched. When the same package was
+    /// requested both abbreviated and extended during this install (it is a
+    /// regular dependency of one package and an optional dependency of
+    /// another), the extended response must win regardless of which one
+    /// arrives last, otherwise the dependencies waiting for the extended one
+    /// would never resolve.
+    ///
+    /// This only decides what this install resolves from. A fetched document
+    /// is written to the disk cache by the task that parsed it, before it gets
+    /// here, so when both were fetched the disk ends up with whichever save
+    /// finished last; if that was the abbreviated one, the next resolve that
+    /// needs the extended document fetches it again, nothing else depends on it.
     pub(crate) fn insert(
         &mut self,
         name_hash: PackageNameHash,
         manifest: npm::PackageManifest,
     ) -> Result<(), bun_alloc::AllocError> {
+        if !manifest.pkg.has_extended_manifest
+            && matches!(
+                self.hash_map.get(&name_hash),
+                Some(Value::Manifest(existing))
+                    if existing.pkg.has_extended_manifest && existing.name() == manifest.name()
+            )
+        {
+            return Ok(());
+        }
         self.hash_map.insert(name_hash, Value::Manifest(manifest));
         Ok(())
     }
@@ -144,6 +165,11 @@ impl PackageManifestMap {
     /// `timestamp_for_manifest_cache_control`) are hoisted into
     /// [`DiskCacheCtx`] so callers never hold `&mut pm.manifests` and a
     /// `PackageManager` borrow simultaneously.
+    ///
+    /// With `needs_extended_manifest`, an abbreviated manifest is reported as
+    /// missing so the caller fetches the extended one. The entry itself is left
+    /// untouched: it is still valid for the callers that don't need the
+    /// extended fields, and `insert` replaces it once the extended one arrives.
     pub(crate) fn by_name_hash_allow_expired(
         &mut self,
         ctx: DiskCacheCtx,
@@ -154,11 +180,15 @@ impl PackageManifestMap {
         cache_behavior: CacheBehavior,
         needs_extended_manifest: bool,
     ) -> Option<&mut npm::PackageManifest> {
+        let usable = |m: &npm::PackageManifest| {
+            m.name() == name && (!needs_extended_manifest || m.pkg.has_extended_manifest)
+        };
+
         if cache_behavior == CacheBehavior::LoadFromMemory {
             let entry = self.hash_map.get_mut(&name_hash)?;
             return match entry {
-                Value::Manifest(m) if m.name() == name => Some(m),
-                Value::Expired(m) if m.name() == name => {
+                Value::Manifest(m) if usable(m) => Some(m),
+                Value::Expired(m) if usable(m) => {
                     if let Some(expiry) = is_expired {
                         *expiry = true;
                         Some(m)
@@ -170,90 +200,42 @@ impl PackageManifestMap {
             };
         }
 
-        match self.hash_map.entry(name_hash) {
-            Entry::Occupied(occ) => {
-                let value_ptr = occ.into_mut();
-                if let Value::Manifest(m) | Value::Expired(m) = &*value_ptr {
-                    if m.name() != name {
-                        return None;
-                    }
-                }
-                // Compute the demote decision first without holding a borrow
-                // that escapes the fn.
-                let demote = matches!(
-                    value_ptr,
-                    Value::Manifest(m)
-                        if needs_extended_manifest && !m.pkg.has_extended_manifest
-                );
-                if demote {
-                    let Value::Manifest(m) = core::mem::replace(value_ptr, Value::NotFound) else {
-                        unreachable!()
-                    };
-                    *value_ptr = Value::Expired(m);
-                } else if let Value::Manifest(m) = value_ptr {
-                    return Some(m);
-                }
-
-                if let Some(expiry) = is_expired {
-                    if let Value::Expired(m) = value_ptr {
-                        *expiry = true;
-                        return Some(m);
-                    }
-                }
-
-                None
-            }
+        let value_ptr = match self.hash_map.entry(name_hash) {
+            Entry::Occupied(occ) => occ.into_mut(),
             Entry::Vacant(vac) => {
+                let mut loaded = None;
                 if ctx.enable_manifest_cache {
                     // `ctx.cache_directory` is `Some` iff `enable_manifest_cache`
                     // (see `manifest_disk_cache_ctx`).
                     let cache_fd = ctx.cache_directory.expect("cache_directory");
-                    if let Some(manifest) = npm::package_manifest::Serializer::load_by_file_id(
+                    loaded = npm::package_manifest::Serializer::load_by_file_id(
                         scope, cache_fd, name, name_hash,
                     )
                     .ok()
-                    .flatten()
-                    {
-                        if needs_extended_manifest && !manifest.pkg.has_extended_manifest {
-                            let value_ptr = vac.insert(Value::Expired(manifest));
-                            if let Some(expiry) = is_expired {
-                                *expiry = true;
-                                let Value::Expired(m) = value_ptr else {
-                                    unreachable!()
-                                };
-                                return Some(m);
-                            }
-                            return None;
-                        }
-
+                    .flatten();
+                }
+                vac.insert(match loaded {
+                    Some(manifest)
                         if ctx.enable_manifest_cache_control
                             && manifest.pkg.public_max_age
-                                > ctx.timestamp_for_manifest_cache_control
-                        {
-                            let value_ptr = vac.insert(Value::Manifest(manifest));
-                            let Value::Manifest(m) = value_ptr else {
-                                unreachable!()
-                            };
-                            return Some(m);
-                        } else {
-                            let value_ptr = vac.insert(Value::Expired(manifest));
-
-                            if let Some(expiry) = is_expired {
-                                *expiry = true;
-                                let Value::Expired(m) = value_ptr else {
-                                    unreachable!()
-                                };
-                                return Some(m);
-                            }
-
-                            return None;
-                        }
+                                > ctx.timestamp_for_manifest_cache_control =>
+                    {
+                        Value::Manifest(manifest)
                     }
-                }
-
-                vac.insert(Value::NotFound);
-                None
+                    Some(manifest) => Value::Expired(manifest),
+                    None => Value::NotFound,
+                })
             }
+        };
+
+        match value_ptr {
+            Value::Manifest(m) if usable(m) => Some(m),
+            Value::Expired(m) if usable(m) => {
+                let expiry = is_expired?;
+                *expiry = true;
+                Some(m)
+            }
+            _ => None,
         }
     }
 }
diff --git a/src/install/isolated_install/Installer.rs b/src/install/isolated_install/Installer.rs
index 6e49a944088f..294eacc6a3fc 100644
--- a/src/install/isolated_install/Installer.rs
+++ b/src/install/isolated_install/Installer.rs
@@ -1778,6 +1778,7 @@ impl Task {
                                     pkg_metas,
                                     manager.options.cpu,
                                     manager.options.os,
+                                    manager.options.libc,
                                 )
                         {
                             break 'enqueue_lifecycle_scripts;
@@ -2388,12 +2389,14 @@ impl<'a> Installer<'a> {
                     let manager = self.manager();
                     let target_cpu = manager.options.cpu;
                     let target_os = manager.options.os;
+                    let target_libc = manager.options.libc;
                     if let Some(replacement_pkg_id) =
                         postinstall_optimizer::PostinstallOptimizer::get_native_binlink_replacement_package_id(
                             pkg_resolutions_lists[pkg_id as usize].get(pkg_resolutions_buffer),
                             pkg_metas,
                             target_cpu,
                             target_os,
+                            target_libc,
                         )
                     {
                         for (new_entry_id, new_node_id) in entry_node_ids.iter().enumerate() {
diff --git a/src/install/lockfile.rs b/src/install/lockfile.rs
index 8c8c3cd6dd4a..c8af7a6bd2d8 100644
--- a/src/install/lockfile.rs
+++ b/src/install/lockfile.rs
@@ -840,14 +840,13 @@ impl Lockfile {
         meta: &package::Meta,
         cpu: Npm::Architecture,
         os: Npm::OperatingSystem,
+        libc: Npm::Libc,
     ) -> bool {
-        if meta.is_disabled(cpu, os) {
-            return true;
-        }
-
         let dep = &self.buffers.dependencies[dep_id as usize];
 
-        dep.behavior.is_bundled() || !dep.behavior.is_enabled(features)
+        meta.is_disabled(cpu, os, libc.for_dependency(dep.behavior))
+            || dep.behavior.is_bundled()
+            || !dep.behavior.is_enabled(features)
     }
 
     pub fn resolve_catalog_dependency(&self, dep: &Dependency) -> Option<DependencyVersion> {
@@ -1688,6 +1687,9 @@ impl Lockfile {
                         if pkg_meta.arch == Npm::Architecture::ALL {
                             pkg_meta.arch = pkg.package.cpu;
                         }
+                        if pkg_meta.libc == Npm::Libc::NONE {
+                            pkg_meta.libc = pkg.package.libc;
+                        }
                     }
                 }
                 _ => {}
diff --git a/src/install/lockfile/Package.rs b/src/install/lockfile/Package.rs
index f2d69c25e423..34ba727f3bd0 100644
--- a/src/install/lockfile/Package.rs
+++ b/src/install/lockfile/Package.rs
@@ -450,13 +450,6 @@ impl<SemverIntType: VersionInt> Alphabetizer<SemverIntType> {
     }
 }
 
-impl<SemverIntType: VersionInt> Package<SemverIntType> {
-    #[inline]
-    pub(crate) fn is_disabled(&self, cpu: Npm::Architecture, os: Npm::OperatingSystem) -> bool {
-        self.meta.is_disabled(cpu, os)
-    }
-}
-
 // `clone` / `from_package_json` / `from_npm` / `parse*` all interact
 // with `Lockfile`, whose package list is concretely `MultiArrayList<Package<u64>>`.
 // `Package<SemverIntType>` is only ever instantiated at `u64` for these
@@ -863,6 +856,7 @@ impl Package<u64> {
 
             package.meta.arch = package_version.cpu;
             package.meta.os = package_version.os;
+            package.meta.libc = package_version.libc;
             package.meta.integrity = package_version.integrity;
             package
                 .meta
diff --git a/src/install/lockfile/Package/Meta.rs b/src/install/lockfile/Package/Meta.rs
index 2ac6e612756f..b10b0eba64bc 100644
--- a/src/install/lockfile/Package/Meta.rs
+++ b/src/install/lockfile/Package/Meta.rs
@@ -1,5 +1,5 @@
 use bun_install::integrity::Integrity;
-use bun_install::npm::{Architecture, OperatingSystem};
+use bun_install::npm::{Architecture, Libc, OperatingSystem};
 use bun_install::{INVALID_PACKAGE_ID, Origin, PackageID};
 use bun_semver::String;
 
@@ -18,7 +18,10 @@ pub struct Meta {
 
     pub(crate) arch: Architecture,
     pub(crate) os: OperatingSystem,
-    pub(crate) _padding_os: u16,
+    /// Occupies what used to be padding, so a `bun.lockb` written before this
+    /// field existed reads back as `Libc::NONE` (not declared).
+    pub(crate) libc: Libc,
+    pub(crate) _padding_libc: u8,
 
     pub(crate) id: PackageID,
 
@@ -52,7 +55,8 @@ impl Default for Meta {
             _padding_origin: 0,
             arch: Architecture::ALL,
             os: OperatingSystem::ALL,
-            _padding_os: 0,
+            libc: Libc::NONE,
+            _padding_libc: 0,
             id: INVALID_PACKAGE_ID,
             man_dir: String::default(),
             integrity: Integrity::default(),
@@ -63,10 +67,11 @@ impl Default for Meta {
 }
 
 impl Meta {
-    /// Does the `cpu` arch and `os` match the requirements listed in the package?
-    /// This is completely unrelated to "devDependencies", "peerDependencies", "optionalDependencies" etc
-    pub fn is_disabled(&self, cpu: Architecture, os: OperatingSystem) -> bool {
-        !self.arch.is_match(cpu) || !self.os.is_match(os)
+    /// Does the `cpu` arch, `os` and `libc` match the requirements listed in the package?
+    /// This is completely unrelated to "devDependencies", "peerDependencies", "optionalDependencies" etc,
+    /// except that callers pass `Libc::for_dependency` of the dependency being checked as `libc`.
+    pub fn is_disabled(&self, cpu: Architecture, os: OperatingSystem, libc: Libc) -> bool {
+        !self.arch.is_match(cpu) || !self.os.is_match(os) || !self.libc.is_match(libc)
     }
 
     pub(crate) fn has_install_script(&self) -> bool {
@@ -110,6 +115,7 @@ impl Meta {
             integrity: self.integrity,
             arch: self.arch,
             os: self.os,
+            libc: self.libc,
             origin: self.origin,
             has_install_script: self.has_install_script,
             ..Meta::default()
diff --git a/src/install/lockfile/Tree.rs b/src/install/lockfile/Tree.rs
index 04f3ebdd2ec4..5b2fb04b01bb 100644
--- a/src/install/lockfile/Tree.rs
+++ b/src/install/lockfile/Tree.rs
@@ -415,7 +415,8 @@ pub enum BuilderMethod {
 
     /// This will filter out disabled dependencies, resulting in more aggresive
     /// hoisting compared to `.resolvable`. We skip dependencies based on 'os', 'cpu',
-    /// 'libc' (TODO), and omitted dependency types (`--omit=dev/peer/optional`).
+    /// 'libc' (optional dependencies only, see `Libc::for_dependency`), and omitted
+    /// dependency types (`--omit=dev/peer/optional`).
     /// Dependencies of a disabled package are not included in the output.
     Filter,
 }
@@ -624,7 +625,11 @@ pub(crate) fn is_filtered_dependency_or_workspace(
     let dep = &lockfile.buffers.dependencies.as_slice()[dep_id as usize];
     let parent_res = &pkg_resolutions[parent_pkg_id as usize];
 
-    if pkg_metas[pkg_id as usize].is_disabled(manager.options.cpu, manager.options.os) {
+    if pkg_metas[pkg_id as usize].is_disabled(
+        manager.options.cpu,
+        manager.options.os,
+        manager.options.libc.for_dependency(dep.behavior),
+    ) {
         if manager.options.log_level.is_verbose() {
             let meta = &pkg_metas[pkg_id as usize];
             let name = lockfile.str(&pkg_names[pkg_id as usize]);
@@ -643,6 +648,11 @@ pub(crate) fn is_filtered_dependency_or_workspace(
                     "<d>Skip installing<r> <b>{}<r> <d>- cpu mismatch<r>",
                     bstr::BStr::new(name)
                 );
+            } else {
+                bun_core::pretty_errorln!(
+                    "<d>Skip installing<r> <b>{}<r> <d>- libc mismatch<r>",
+                    bstr::BStr::new(name)
+                );
             }
         }
         return true;
diff --git a/src/install/lockfile/bun.lock.rs b/src/install/lockfile/bun.lock.rs
index bf824b0db939..5cdc2bfb106a 100644
--- a/src/install/lockfile/bun.lock.rs
+++ b/src/install/lockfile/bun.lock.rs
@@ -754,7 +754,7 @@ impl Stringifier {
                         });
                     }
 
-                    // INFO = { prod/dev/optional/peer dependencies, os, cpu, libc (TODO), bin, binDir }
+                    // INFO = { prod/dev/optional/peer dependencies, os, cpu, libc, bin, binDir }
 
                     // first index is resolution for each type of package
                     // npm         -> [ "name@version", registry (TODO: remove if default), INFO, integrity]
@@ -1031,7 +1031,7 @@ impl Stringifier {
         Ok(())
     }
 
-    /// Writes a single line object. Contains dependencies, os, cpu, libc (soon), and bin
+    /// Writes a single line object. Contains dependencies, os, cpu, libc, and bin
     /// { "devDependencies": { "one": "1.1.1", "two": "2.2.2" }, "os": "none" }
     fn write_package_info_object(
         writer: &mut Writer,
@@ -1146,15 +1146,6 @@ impl Stringifier {
             writer.write_all(b" \"bundled\": true")?;
         }
 
-        // TODO(dylan-conway)
-        // if (meta.libc != .all) {
-        //     try writer.writeAll(
-        //         \\"libc": [
-        //     );
-        //     try Negatable(Npm.Libc).toJson(meta.libc, writer);
-        //     try writer.writeAll("], ");
-        // }
-
         if meta.os != Npm::OperatingSystem::ALL {
             if any {
                 writer.write_byte(b',')?;
@@ -1175,6 +1166,20 @@ impl Stringifier {
             Negatable::<Npm::Architecture>::to_json(meta.arch, &mut AsFmt::new(writer))?;
         }
 
+        // Undeclared and "both" are the same thing at install time, so only a
+        // restriction to one libc is written. `Negatable::to_json` would spell
+        // it as the negation of the other one ("!musl"); the name is clearer.
+        if let Some(libc) = meta.libc.single_name() {
+            if any {
+                writer.write_byte(b',')?;
+            } else {
+                any = true;
+            }
+            writer.write_all(b" \"libc\": \"")?;
+            writer.write_all(libc)?;
+            writer.write_byte(b'"')?;
+        }
+
         if bin.tag != BinTag::None {
             if any {
                 writer.write_byte(b',')?;
@@ -2882,10 +2887,9 @@ pub(crate) fn parse_into_binary_lockfile(
                                 pkg.meta.arch =
                                     Npm::negatable_from_json_value::<Npm::Architecture>(arch);
                             }
-                            // TODO(dylan-conway)
-                            // if (os_cpu_libc_obj.get("libc")) |libc| {
-                            //     pkg.meta.libc = Negatable(Npm.Libc).fromJson(allocator, libc);
-                            // }
+                            if let Some(libc) = deps_os_cpu_libc_bin_bundle_obj.get(b"libc") {
+                                pkg.meta.libc = Npm::negatable_from_json_value::<Npm::Libc>(libc);
+                            }
                         }
                     }
                     ResolutionTag::Root => {
diff --git a/src/install/lockfile/lockfile_json_stringify_for_debugging.rs b/src/install/lockfile/lockfile_json_stringify_for_debugging.rs
index 4ccd658ff901..f6273c31b87c 100644
--- a/src/install/lockfile/lockfile_json_stringify_for_debugging.rs
+++ b/src/install/lockfile/lockfile_json_stringify_for_debugging.rs
@@ -385,6 +385,13 @@ where
                 let _ = w.end_array();
             }
 
+            if let Some(libc) = pkg.meta.libc.single_name() {
+                w.object_field(b"libc")?;
+                w.begin_array()?;
+                w.write(libc)?;
+                let _ = w.end_array();
+            }
+
             w.object_field(b"integrity")?;
             if pkg.meta.integrity.tag != IntegrityTag::UNKNOWN {
                 w.print(format_args!("\"{}\"", pkg.meta.integrity))?;
diff --git a/src/install/lockfile/printer/tree_printer.rs b/src/install/lockfile/printer/tree_printer.rs
index b36d955f1d7b..9155f3c65526 100644
--- a/src/install/lockfile/printer/tree_printer.rs
+++ b/src/install/lockfile/printer/tree_printer.rs
@@ -264,6 +264,7 @@ fn should_print_package_install(
         &pkg_metas[package_id as usize],
         this.options.cpu,
         this.options.os,
+        this.options.libc,
     ) {
         return ShouldPrintPackageInstallResult::No;
     }
diff --git a/src/install/lockfile/reachable.rs b/src/install/lockfile/reachable.rs
index c4e86629b8e1..4ed71abd1347 100644
--- a/src/install/lockfile/reachable.rs
+++ b/src/install/lockfile/reachable.rs
@@ -2,7 +2,7 @@ use crate::dependency::{Behavior, Dependency};
 use crate::lockfile::DependencySlice;
 use crate::lockfile::package::{Meta, PackageColumns as _};
 use crate::lockfile_real::Lockfile;
-use crate::npm::{Architecture, OperatingSystem};
+use crate::npm::{Architecture, Libc, OperatingSystem};
 use crate::{PackageID, PackageManager};
 use bun_collections::DynamicBitSet;
 use bun_core::UnwrapOrOom;
@@ -15,7 +15,7 @@ pub struct Options {
     pub peer: bool,
     pub optional_peer: bool,
     pub bundled: bool,
-    pub platform: Option<(Architecture, OperatingSystem)>,
+    pub platform: Option<(Architecture, OperatingSystem, Libc)>,
 }
 
 impl Options {
@@ -31,7 +31,7 @@ impl Options {
         }
     }
 
-    // What `bun install` would link with the manager's `--production` / `--omit` / os / cpu settings.
+    // What `bun install` would link with the manager's `--production` / `--omit` / os / cpu / libc settings.
     pub(crate) fn install(manager: &PackageManager) -> Options {
         let features = manager.options.local_package_features;
         Options {
@@ -41,7 +41,11 @@ impl Options {
             peer: features.peer_dependencies,
             optional_peer: features.peer_dependencies,
             bundled: false,
-            platform: Some((manager.options.cpu, manager.options.os)),
+            platform: Some((
+                manager.options.cpu,
+                manager.options.os,
+                manager.options.libc,
+            )),
         }
     }
 }
@@ -116,7 +120,7 @@ pub fn dev_packages_from(
                 continue;
             }
             if behavior.is_dev() && walk.follows(behavior) {
-                walk.admit(target, &mut seen, &mut worklist);
+                walk.admit(target, behavior, &mut seen, &mut worklist);
             }
         }
     }
@@ -180,12 +184,20 @@ impl<'a> Walk<'a> {
         }
     }
 
-    fn admit(&self, target: PackageID, seen: &mut DynamicBitSet, worklist: &mut Vec<PackageID>) {
+    // `behavior` is the edge `target` is reached through; like the tree builder
+    // (`is_filtered_dependency_or_workspace`), libc only disables optional edges.
+    fn admit(
+        &self,
+        target: PackageID,
+        behavior: Behavior,
+        seen: &mut DynamicBitSet,
+        worklist: &mut Vec<PackageID>,
+    ) {
         if seen.is_set_allow_out_of_bound(target as usize, true) {
             return;
         }
-        if let Some((cpu, os)) = self.options.platform
-            && self.metas[target as usize].is_disabled(cpu, os)
+        if let Some((cpu, os, libc)) = self.options.platform
+            && self.metas[target as usize].is_disabled(cpu, os, libc.for_dependency(behavior))
         {
             return;
         }
@@ -197,10 +209,11 @@ impl<'a> Walk<'a> {
         while let Some(parent) = worklist.pop() {
             let slice = self.dep_slices[parent as usize];
             for dep_id in slice.begin() as usize..slice.end() as usize {
-                if !(self.follow_all || self.follows(self.deps[dep_id].behavior)) {
+                let behavior = self.deps[dep_id].behavior;
+                if !(self.follow_all || self.follows(behavior)) {
                     continue;
                 }
-                self.admit(self.resolutions[dep_id], seen, worklist);
+                self.admit(self.resolutions[dep_id], behavior, seen, worklist);
             }
         }
     }
diff --git a/src/install/migration.rs b/src/install/migration.rs
index 9c4c2ce01b55..583714376d68 100644
--- a/src/install/migration.rs
+++ b/src/install/migration.rs
@@ -487,7 +487,7 @@ fn migrate_npm_lockfile<'a>(
     }))
 }
 
-/// A fresh resolve only records `os`/`cpu` for the root and npm registry
+/// A fresh resolve only records `os`/`cpu`/`libc` for the root and npm registry
 /// packages (`Package::from_npm`); folder, tarball, git, and workspace packages
 /// install unconditionally, so a migrated lockfile must not constrain them.
 pub(crate) fn clear_non_registry_platform_constraints(lockfile: &mut Lockfile) {
@@ -498,6 +498,7 @@ pub(crate) fn clear_non_registry_platform_constraints(lockfile: &mut Lockfile) {
                 let meta = &mut lockfile.packages.items_meta_mut()[i];
                 meta.arch = Npm::Architecture::ALL;
                 meta.os = Npm::OperatingSystem::ALL;
+                meta.libc = Npm::Libc::NONE;
             }
         }
     }
diff --git a/src/install/migration/npm_lock.rs b/src/install/migration/npm_lock.rs
index cafa4d077de0..19a4fc8f250f 100644
--- a/src/install/migration/npm_lock.rs
+++ b/src/install/migration/npm_lock.rs
@@ -24,6 +24,7 @@ use crate::lockfile::{self, Lockfile, PackageListEntry};
 use crate::lockfile_real::package::PackageColumns as _;
 use crate::lockfile_real::package::workspace_map::WorkspaceMap;
 use crate::npm as Npm;
+use crate::npm::NegatableExt as _;
 use crate::repository::{Repository, RepositoryExt as _, is_safe_resolved_tag};
 use crate::resolution::{self, Resolution, TaggedValue as ResTagged};
 use crate::versioned_url::VersionedURLType;
@@ -81,6 +82,26 @@ fn parse_bundle(pkg: &E::ObjectJSON) -> Result<Bundle, Error> {
     }
 }
 
+/// The `os` / `cpu` / `libc` of a package-lock entry: npm copies the field
+/// from package.json as-is, so a single string is accepted like npm does.
+fn parse_platform_list<T: Npm::NegatableEnum>(value: &E::JsonValue) -> Result<T, Error> {
+    let mut list = T::NONE.negatable();
+    if let Some(s) = value.as_str() {
+        list.apply(s);
+        return Ok(list.combine());
+    }
+    let Some(arr) = value.as_array() else {
+        return Err(Error::InvalidNPMLockfile);
+    };
+    for item in arr.items() {
+        let Some(s) = item.as_str() else {
+            return Err(Error::InvalidNPMLockfile);
+        };
+        list.apply(s);
+    }
+    Ok(list.combine())
+}
+
 fn entry_object(entry: &E::PropertyJSON) -> &E::ObjectJSON {
     let Some(pkg) = entry.value.as_object() else {
         unreachable!("npm lockfile: build_index rejected non-object entries")
@@ -335,48 +356,19 @@ impl<'a> Migrator<'a> {
                 lockfile::Origin::Npm
             },
 
-            arch: if let Some(cpu_array) = pkg.get(b"cpu") {
-                'arch: {
-                    let mut arch = Npm::Architecture::NONE.negatable();
-                    let Some(arr) = cpu_array.as_array() else {
-                        return Err(Error::InvalidNPMLockfile);
-                    };
-                    let items = arr.items();
-                    if items.is_empty() {
-                        break 'arch arch.combine();
-                    }
-                    for item in items {
-                        let Some(s) = item.as_str() else {
-                            return Err(Error::InvalidNPMLockfile);
-                        };
-                        arch.apply(s);
-                    }
-                    break 'arch arch.combine();
-                }
-            } else {
-                Npm::Architecture::ALL
+            arch: match pkg.get(b"cpu") {
+                Some(cpu) => parse_platform_list(cpu)?,
+                None => Npm::Architecture::ALL,
             },
 
-            os: if let Some(os_array) = pkg.get(b"os") {
-                'os: {
-                    let mut os = Npm::OperatingSystem::NONE.negatable();
-                    let Some(arr) = os_array.as_array() else {
-                        return Err(Error::InvalidNPMLockfile);
-                    };
-                    let items = arr.items();
-                    if items.is_empty() {
-                        break 'os Npm::OperatingSystem::ALL;
-                    }
-                    for item in items {
-                        let Some(s) = item.as_str() else {
-                            return Err(Error::InvalidNPMLockfile);
-                        };
-                        os.apply(s);
-                    }
-                    break 'os os.combine();
-                }
-            } else {
-                Npm::OperatingSystem::ALL
+            os: match pkg.get(b"os") {
+                Some(os) => parse_platform_list(os)?,
+                None => Npm::OperatingSystem::ALL,
+            },
+
+            libc: match pkg.get(b"libc") {
+                Some(libc) => parse_platform_list(libc)?,
+                None => Npm::Libc::NONE,
             },
 
             man_dir: SemverString::default(),
diff --git a/src/install/npm.rs b/src/install/npm.rs
index 7f00adbb00ca..d9b173a6cef0 100644
--- a/src/install/npm.rs
+++ b/src/install/npm.rs
@@ -833,7 +833,9 @@ pub struct PackageVersion {
     /// `"cpu"` field in package.json
     pub(crate) cpu: Architecture,
 
-    /// `"libc"` field in package.json
+    /// `"libc"` field in package.json. The abbreviated registry document omits
+    /// it, so this is only populated when the manifest was fetched with
+    /// `has_extended_manifest` (`Libc::NONE` = not declared).
     pub(crate) libc: Libc,
 
     /// `hasInstallScript` field in registry API.
@@ -964,7 +966,9 @@ pub struct NpmPackage {
     pub(crate) versions_buf: VersionSlice,
     pub(crate) string_lists_buf: ExternalStringList,
 
-    // Flag to indicate if we have timestamp data from extended manifest
+    /// Fetched with `Accept: application/json` (the full document) rather than
+    /// the abbreviated one, so `publish_timestamp_ms` and `PackageVersion.libc`
+    /// are populated. See `PackageManager::needs_extended_manifest`.
     pub(crate) has_extended_manifest: bool,
     pub(crate) _padding_tail: [u8; 7],
 }
diff --git a/src/install/patch_install.rs b/src/install/patch_install.rs
index 3c0ae397aa58..32635bd881cc 100644
--- a/src/install/patch_install.rs
+++ b/src/install/patch_install.rs
@@ -283,12 +283,14 @@ impl PatchTask {
             let pkg_name = pkg.name;
             let pkg_resolution_tag = pkg.resolution.tag;
             let name_and_version_hash = calc_hash.name_and_version_hash;
+            let dep_behavior = manager.lockfile.buffers.dependencies[dep_id as usize].behavior;
 
             let mut out_name_and_version_hash: Option<u64> = None;
             let mut out_patchfile_hash: Option<u64> = None;
             manager.set_preinstall_state(pkg_meta_id, PreinstallState::Unknown);
             match manager.determine_preinstall_state(
                 &pkg,
+                dep_behavior,
                 &mut out_name_and_version_hash,
                 &mut out_patchfile_hash,
             ) {
@@ -325,9 +327,7 @@ impl PatchTask {
                         TaskId::for_npm_package(manager.lockfile.str(&pkg_name), pkg_npm_version);
                     debug_assert!(!manager.network_dedupe_map.contains_key(&task_id));
 
-                    let is_required = manager.lockfile.buffers.dependencies[dep_id as usize]
-                        .behavior
-                        .is_required();
+                    let is_required = dep_behavior.is_required();
                     let pkg_again: Package = *manager.lockfile.packages.get(pkg_id as usize);
                     let network_task: *mut crate::NetworkTask =
                         package_manager::generate_network_task_for_tarball(
diff --git a/src/install/pnpm.rs b/src/install/pnpm.rs
index a9ded026e91c..43fa84fc6300 100644
--- a/src/install/pnpm.rs
+++ b/src/install/pnpm.rs
@@ -1404,7 +1404,9 @@ pub(crate) fn migrate_pnpm_lockfile<'a>(
                 if let Some(cpu_expr) = package_obj.get(b"cpu") {
                     pkg.meta.arch = npm::negatable_from_json::<npm::Architecture>(&cpu_expr)?;
                 }
-                // TODO: libc
+                if let Some(libc_expr) = package_obj.get(b"libc") {
+                    pkg.meta.libc = npm::negatable_from_json::<npm::Libc>(&libc_expr)?;
+                }
 
                 let (off, len, has_unbound_peers) = parse_append_package_dependencies(
                     lockfile,
diff --git a/src/install/postinstall_optimizer.rs b/src/install/postinstall_optimizer.rs
index 5a7f06e89d28..85e4dff10e3f 100644
--- a/src/install/postinstall_optimizer.rs
+++ b/src/install/postinstall_optimizer.rs
@@ -94,9 +94,15 @@ impl PostinstallOptimizer {
         metas: &[Meta],
         target_cpu: npm::Architecture,
         target_os: npm::OperatingSystem,
+        target_libc: npm::Libc,
     ) -> Option<PackageID> {
         // Loop through the list of optional dependencies with platform-specific constraints
-        // Find a matching target-specific dependency.
+        // Find a matching target-specific dependency. The glibc and musl variants of a
+        // package share os/cpu, so libc decides between them. Unlike when installing
+        // (`Libc::for_dependency`), it is checked whatever kind of dependency the variant
+        // is: a match is installed either way, and a variant declaring another libc is
+        // not the binary for this target even if a regular dependency installs it; with
+        // no match the package's own bin and scripts are used, as for any other package.
         for &resolution in resolutions {
             if (resolution as usize) >= metas.len() {
                 continue;
@@ -105,7 +111,10 @@ impl PostinstallOptimizer {
             if meta.arch == npm::Architecture::ALL || meta.os == npm::OperatingSystem::ALL {
                 continue;
             }
-            if meta.arch.is_match(target_cpu) && meta.os.is_match(target_os) {
+            if meta.arch.is_match(target_cpu)
+                && meta.os.is_match(target_os)
+                && meta.libc.is_match(target_libc)
+            {
                 return Some(resolution);
             }
         }
@@ -171,6 +180,7 @@ impl List {
         metas: &[Meta],
         target_cpu: npm::Architecture,
         target_os: npm::OperatingSystem,
+        target_libc: npm::Libc,
     ) -> bool {
         // The feature flag defaults to false; see note on the binlinker flag above.
         if bun_core::env_var::feature_flag::BUN_FEATURE_FLAG_DISABLE_IGNORE_SCRIPTS
@@ -198,6 +208,7 @@ impl List {
                     metas,
                     target_cpu,
                     target_os,
+                    target_libc,
                 )
                 .is_some()
             }
diff --git a/src/install_types/resolver_hooks.rs b/src/install_types/resolver_hooks.rs
index 30b8da9f2910..bb42522b84af 100644
--- a/src/install_types/resolver_hooks.rs
+++ b/src/install_types/resolver_hooks.rs
@@ -873,6 +873,13 @@ negatable_names! { OperatingSystem: u16, OPERATING_SYSTEM_NAMES => [
 
 // ──────────────────────────────────────────────────────────────────────────
 
+/// https://docs.npmjs.com/cli/v10/configuring-npm/package-json#libc
+///
+/// Unlike `os`/`cpu`, the zero value does not mean "matches nothing": it is
+/// what a package without a `libc` field gets, and what every manifest cache
+/// entry, `bun.lockb` and `bun.lock` written before this field was read
+/// contains. [`is_match`](Self::is_match) treats it as "not declared", so
+/// such packages install on every libc.
 #[repr(transparent)]
 #[derive(Clone, Copy, PartialEq, Eq, Default)]
 pub struct Libc(pub u8);
@@ -886,12 +893,53 @@ impl Libc {
 
     pub(crate) const ALL_VALUE: u8 = Self::GLIBC | Self::MUSL;
 
-    // TODO: runtime libc detection
+    /// The libc that packages are filtered against by default. Bun is
+    /// statically tied to one libc (the musl build is a separate binary, see
+    /// `bun_core::Environment::IS_MUSL`), so the build target is the host libc.
+    /// Other operating systems have no libc in the npm sense, so nothing is
+    /// filtered there.
+    #[cfg(all(target_os = "linux", target_env = "musl"))]
+    pub const CURRENT: Self = Self(Self::MUSL);
+    #[cfg(all(target_os = "linux", not(target_env = "musl")))]
+    pub const CURRENT: Self = Self(Self::GLIBC);
+    #[cfg(not(target_os = "linux"))]
+    pub const CURRENT: Self = Self::ALL;
+
+    /// `self` is the package's declaration, `target` the libc being installed for.
+    #[inline]
+    pub fn is_match(self, target: Self) -> bool {
+        self.0 == 0 || (self.0 & target.0) != 0
+    }
 
+    /// The libc to filter a package against when it is reached through a
+    /// dependency with `behavior`, `self` being the target libc (`--libc`).
+    ///
+    /// A package's `libc` is only requested from the registry for optional
+    /// dependencies (the abbreviated manifest used for everything else does not
+    /// carry it), so it is also only enforced on them. Through a regular
+    /// dependency a package installs on every libc, whether or not its `libc`
+    /// happens to be known from an optional edge, a migrated lockfile or the
+    /// manifest cache; otherwise what gets installed would depend on that.
+    #[inline]
+    pub fn for_dependency(self, behavior: Behavior) -> Self {
+        if behavior.is_optional() {
+            self
+        } else {
+            Self::ALL
+        }
+    }
     #[inline]
     pub(crate) fn has(self, other: u8) -> bool {
         (self.0 & other) != 0
     }
+    /// The declared libc when the package is restricted to exactly one
+    /// (`"glibc"` / `"musl"`); `None` when undeclared or unrestricted.
+    pub fn single_name(self) -> Option<&'static [u8]> {
+        Self::NAME_MAP_KVS
+            .iter()
+            .find(|(_, bit)| *bit == self.0)
+            .map(|(name, _)| *name)
+    }
 }
 
 negatable_names! { Libc: u8, LIBC_NAMES => [ b"musl" => MUSL, b"glibc" => GLIBC ] }
diff --git a/src/jsc/AsyncModule.rs b/src/jsc/AsyncModule.rs
index 6ffd0805dbd8..eb30a87a8bf1 100644
--- a/src/jsc/AsyncModule.rs
+++ b/src/jsc/AsyncModule.rs
@@ -524,6 +524,7 @@ impl Queue {
 
                     let package = pm.lockfile.packages.get(package_id as usize);
                     debug_assert!(package.resolution.tag != install::resolution::Tag::Root);
+                    let dependency = pm.lockfile.buffers.dependencies[root_id as usize].behavior;
 
                     let mut name_and_version_hash: Option<u64> = None;
                     let mut patchfile_hash: Option<u64> = None;
@@ -532,6 +533,7 @@ impl Queue {
                     // `&mut self`/`&self.lockfile` aliasing borrowck rejects.
                     match pm.determine_preinstall_state(
                         &package,
+                        dependency,
                         &mut name_and_version_hash,
                         &mut patchfile_hash,
                     ) {
diff --git a/src/runtime/cli/pm_licenses_command.rs b/src/runtime/cli/pm_licenses_command.rs
index e66af934ca19..d449f75607dc 100644
--- a/src/runtime/cli/pm_licenses_command.rs
+++ b/src/runtime/cli/pm_licenses_command.rs
@@ -169,7 +169,7 @@ impl PmLicensesCommand {
             peer: features.peer_dependencies,
             optional_peer: features.peer_dependencies,
             bundled: true,
-            platform: Some((pm.options.cpu, pm.options.os)),
+            platform: Some((pm.options.cpu, pm.options.os, pm.options.libc)),
         };
         let resolutions = lockfile.buffers.resolutions.as_slice();
         let walk = if flags.dev_only {
diff --git a/test/cli/install/__snapshots__/bun-lock.test.ts.snap b/test/cli/install/__snapshots__/bun-lock.test.ts.snap
index 77f5c4a45c56..5c8e21d0b550 100644
--- a/test/cli/install/__snapshots__/bun-lock.test.ts.snap
+++ b/test/cli/install/__snapshots__/bun-lock.test.ts.snap
@@ -374,9 +374,9 @@ exports[`should not change formatting unexpectedly 2`] = `
 
     "native-foo-x86": ["native-foo-x86@1.0.0", "http://localhost:1234/native-foo-x86/-/native-foo-x86-1.0.0.tgz", { "os": "none", "cpu": "none" }, "sha512-pUktFGar8JctgQh4Ow5Y9bMp3PB5bHBgbC6M3igED5q99z51WErG2GO3LnPG651SyHtRf+zdeMdhGFWzP54apQ=="],
 
-    "native-libc-glibc": ["native-libc-glibc@1.0.0", "http://localhost:1234/native-libc-glibc/-/native-libc-glibc-1.0.0.tgz", {}, "sha512-D7ivPUqV+bs4jZCFt/fm0BRchhE1kO3XMKZ7/Tt3cF2gfJcewMy/zuId79iaVn9aztJYkOk1GWFpMPXmX5rJHA=="],
+    "native-libc-glibc": ["native-libc-glibc@1.0.0", "http://localhost:1234/native-libc-glibc/-/native-libc-glibc-1.0.0.tgz", { "libc": "glibc" }, "sha512-D7ivPUqV+bs4jZCFt/fm0BRchhE1kO3XMKZ7/Tt3cF2gfJcewMy/zuId79iaVn9aztJYkOk1GWFpMPXmX5rJHA=="],
 
-    "native-libc-musl": ["native-libc-musl@1.0.0", "http://localhost:1234/native-libc-musl/-/native-libc-musl-1.0.0.tgz", {}, "sha512-1uffg8IA4EJ4VUnuZU4zyRO9EyduuNfbqg2MMVCWSMAsQkfzZnNR0hqtL0GW/EuhE8FWU/FE//Srf1px1pnN2Q=="],
+    "native-libc-musl": ["native-libc-musl@1.0.0", "http://localhost:1234/native-libc-musl/-/native-libc-musl-1.0.0.tgz", { "libc": "musl" }, "sha512-1uffg8IA4EJ4VUnuZU4zyRO9EyduuNfbqg2MMVCWSMAsQkfzZnNR0hqtL0GW/EuhE8FWU/FE//Srf1px1pnN2Q=="],
 
     "optional-native": ["optional-native@1.0.0", "http://localhost:1234/optional-native/-/optional-native-1.0.0.tgz", { "optionalDependencies": { "native-bar-x64": "1.0.0", "native-foo-x64": "1.0.0", "native-foo-x86": "1.0.0", "native-libc-glibc": "1.0.0", "native-libc-musl": "1.0.0" } }, "sha512-E+XTkTpxRqU09BnKGkOkS9vk0sPDhPtArBw6FfL5ciYkb7k6EljnqXEQ1b9l0S1YCVZxZkOZIJCYZfCwj7AgSw=="],
 
diff --git a/test/cli/install/bun-install-cpu-os.test.ts b/test/cli/install/bun-install-cpu-os.test.ts
index faaf362daa45..2379a60c7508 100644
--- a/test/cli/install/bun-install-cpu-os.test.ts
+++ b/test/cli/install/bun-install-cpu-os.test.ts
@@ -1,15 +1,18 @@
 import { spawn } from "bun";
 import { afterAll, afterEach, beforeAll, beforeEach, describe, expect, it } from "bun:test";
-import { rm, writeFile } from "fs/promises";
-import { bunEnv, bunExe, readdirSorted, toMatchNodeModulesAt } from "harness";
+import { exists, rm, writeFile } from "fs/promises";
+import { bunEnv, bunExe, isLinux, libcFamily, readdirSorted, toMatchNodeModulesAt } from "harness";
 import { join } from "path";
 import {
+  ABBREVIATED_MANIFEST_ACCEPT,
   dummyAfterAll,
   dummyAfterEach,
   dummyBeforeAll,
   dummyBeforeEach,
   dummyRegistry,
+  FULL_MANIFEST_ACCEPT,
   package_dir,
+  root_url,
   setHandler,
 } from "./dummy.registry.js";
 
@@ -220,56 +223,33 @@ describe("bun install --cpu and --os flags", () => {
     expect(await readdirSorted(join(package_dir, "node_modules"))).toEqual([".cache", "dep-multi-cpu"]);
   });
 
-  it("should error on invalid CPU architecture", async () => {
+  // A negated unknown name is just as much of a typo as a plain one.
+  it.each([
+    ["--cpu", "invalid-cpu", "Invalid CPU architecture: 'invalid-cpu'"],
+    ["--cpu", "!invalid-cpu", "Invalid CPU architecture: '!invalid-cpu'"],
+    ["--os", "invalid-os", "Invalid operating system: 'invalid-os'"],
+    ["--os", "!invalid-os", "Invalid operating system: '!invalid-os'"],
+  ])("should error on %s %s", async (flag, value, message) => {
     await writeFile(
       join(package_dir, "package.json"),
       JSON.stringify({
-        name: "test-invalid-cpu",
+        name: "test-invalid-platform",
         version: "1.0.0",
         dependencies: {},
       }),
     );
 
     const { stderr, exited } = spawn({
-      cmd: [bunExe(), "install", "--cpu", "invalid-cpu"],
+      cmd: [bunExe(), "install", flag, value],
       cwd: package_dir,
       env: bunEnv,
-      stdout: "pipe",
+      stdout: "ignore",
       stderr: "pipe",
     });
 
-    const exitCode = await exited;
-    const stderrText = await stderr.text();
-
+    const [stderrText, exitCode] = await Promise.all([stderr.text(), exited]);
+    expect(stderrText).toContain(message);
     expect(exitCode).toBe(1);
-    expect(stderrText).toContain("Invalid CPU architecture");
-    expect(stderrText).toContain("invalid-cpu");
-  });
-
-  it("should error on invalid OS", async () => {
-    await writeFile(
-      join(package_dir, "package.json"),
-      JSON.stringify({
-        name: "test-invalid-os",
-        version: "1.0.0",
-        dependencies: {},
-      }),
-    );
-
-    const { stderr, exited } = spawn({
-      cmd: [bunExe(), "install", "--os", "invalid-os"],
-      cwd: package_dir,
-      env: bunEnv,
-      stdout: "pipe",
-      stderr: "pipe",
-    });
-
-    const exitCode = await exited;
-    const stderrText = await stderr.text();
-
-    expect(exitCode).toBe(1);
-    expect(stderrText).toContain("Invalid operating system");
-    expect(stderrText).toContain("invalid-os");
   });
 
   it("should skip installing packages with negated CPU/OS", async () => {
@@ -605,3 +585,473 @@ describe("bun install --cpu and --os flags", () => {
     expect(await readdirSorted(join(package_dir, "node_modules"))).toEqual([".cache", "dep-arm64", "dep-ppc64"]);
   });
 });
+
+describe("bun install --libc flag and the libc field", () => {
+  // Every package served by dummyRegistry shares one version table, so each variant gets its own
+  // version: dep-glibc@1.0.0 declares glibc, dep-musl@2.0.0 declares musl, dep-universal@3.0.0
+  // declares nothing. Like registry.npmjs.org, dummyRegistry only includes `libc` in the full
+  // manifest, so a variant can only be skipped if bun asked for the full manifest.
+  const variants = {
+    "1.0.0": { libc: ["glibc"] },
+    "2.0.0": { libc: ["musl"] },
+    "3.0.0": {},
+  };
+
+  /** Serves `info` and records the Accept header of every manifest request, keyed by package name. */
+  function serveRecordingAccepts(urls: string[], info: any = variants) {
+    return serveByName(urls, {}, dummyRegistry(urls, info));
+  }
+
+  /**
+   * Like `serveRecordingAccepts`, with a version table per package name (`fallback` serves the rest).
+   * The full manifest of the packages in `withoutFullManifest` is a 404, as on a registry that only
+   * has the abbreviated document.
+   */
+  function serveByName(
+    urls: string[],
+    tables: Record<string, any>,
+    fallback: ReturnType<typeof dummyRegistry> = dummyRegistry(urls, variants),
+    withoutFullManifest: string[] = [],
+  ) {
+    const accepts: Record<string, string[]> = {};
+    const registries = Object.fromEntries(
+      Object.entries(tables).map(([name, info]) => [name, dummyRegistry(urls, info)]),
+    );
+    setHandler(request => {
+      if (request.url.endsWith(".tgz")) return fallback(request);
+      const name = new URL(request.url).pathname.slice(1);
+      const accept = request.headers.get("accept")!;
+      (accepts[name] ??= []).push(accept);
+      if (withoutFullManifest.includes(name) && accept === FULL_MANIFEST_ACCEPT) {
+        urls.push(request.url);
+        return new Response("not found", { status: 404 });
+      }
+      return (registries[name] ?? fallback)(request);
+    });
+    return accepts;
+  }
+
+  function clear(accepts: Record<string, string[]>, urls: string[]) {
+    for (const name of Object.keys(accepts)) delete accepts[name];
+    urls.length = 0;
+  }
+
+  /** Runs `bun install`, which has to succeed, and returns its stderr. */
+  const install = (...args: string[]) => installWithEnv(bunEnv, ...args);
+
+  /**
+   * `dummyBeforeEach` disables the cache, and with it the manifest cache. The tests about manifests
+   * that are already cached re-enable it, with the cache inside the package directory; they run every
+   * install with the returned environment.
+   */
+  async function enableManifestCache() {
+    await writeFile(
+      join(package_dir, "bunfig.toml"),
+      Bun.TOML.stringify({ install: { registry: root_url, saveTextLockfile: false } }),
+    );
+    return { ...bunEnv, BUN_INSTALL_CACHE_DIR: join(package_dir, ".bun-cache") };
+  }
+
+  async function installWithEnv(env: typeof bunEnv, ...args: string[]) {
+    const { stderr, exited } = spawn({
+      cmd: [bunExe(), "install", ...args],
+      cwd: package_dir,
+      env,
+      stdout: "ignore",
+      stderr: "pipe",
+    });
+    const [err, exitCode] = await Promise.all([stderr.text(), exited]);
+    expect(err).not.toContain("error:");
+    expect(exitCode).toBe(0);
+    return err;
+  }
+
+  const installedVersion = async (...path: string[]) =>
+    ((await Bun.file(join(package_dir, "node_modules", ...path, "package.json")).json()) as { version: string })
+      .version;
+
+  /** Installed packages: node_modules entries with a package.json (the .cache directory has none). */
+  async function installed() {
+    const names = await readdirSorted(join(package_dir, "node_modules"));
+    const hasPackageJson = await Promise.all(
+      names.map(name => exists(join(package_dir, "node_modules", name, "package.json"))),
+    );
+    return names.filter((_, i) => hasPackageJson[i]);
+  }
+
+  const tarballs = (urls: string[]) =>
+    urls
+      .filter(url => url.endsWith(".tgz"))
+      .map(url => url.slice(url.lastIndexOf("/") + 1))
+      .sort();
+
+  const writePackageJson = (deps: Record<string, Record<string, string>>) =>
+    writeFile(join(package_dir, "package.json"), JSON.stringify({ name: "test-libc", version: "1.0.0", ...deps }));
+
+  async function lockfileEntry(name: string) {
+    const lockfile = await Bun.file(join(package_dir, "bun.lock")).text();
+    return lockfile.split("\n").find(line => line.trimStart().startsWith(`"${name}": ["${name}@`));
+  }
+
+  it("filters optionalDependencies by --libc and records libc in bun.lock", async () => {
+    const urls: string[] = [];
+    const accepts = serveRecordingAccepts(urls);
+    await writePackageJson({
+      dependencies: { "dep-universal": "3.0.0" },
+      optionalDependencies: { "dep-glibc": "1.0.0", "dep-musl": "2.0.0" },
+    });
+
+    await install("--libc", "glibc", "--save-text-lockfile");
+    expect(await installed()).toEqual(["dep-glibc", "dep-universal"]);
+    // Only optional dependencies pay for the full manifest; the skipped variant is never downloaded.
+    expect(accepts).toEqual({
+      "dep-universal": [ABBREVIATED_MANIFEST_ACCEPT],
+      "dep-glibc": [FULL_MANIFEST_ACCEPT],
+      "dep-musl": [FULL_MANIFEST_ACCEPT],
+    });
+    expect(tarballs(urls)).toEqual(["dep-glibc-1.0.0.tgz", "dep-universal-3.0.0.tgz"]);
+    expect(await lockfileEntry("dep-glibc")).toContain(`{ "libc": "glibc" }`);
+    expect(await lockfileEntry("dep-musl")).toContain(`{ "libc": "musl" }`);
+    expect(await lockfileEntry("dep-universal")).toContain(", {}");
+
+    // The lockfile alone decides what a frozen install for the other libc gets: no manifest is fetched.
+    await rm(join(package_dir, "node_modules"), { recursive: true, force: true });
+    clear(accepts, urls);
+    await install("--libc", "musl", "--frozen-lockfile");
+    expect(await installed()).toEqual(["dep-musl", "dep-universal"]);
+    expect(accepts).toEqual({});
+    expect(tarballs(urls)).toEqual(["dep-musl-2.0.0.tgz", "dep-universal-3.0.0.tgz"]);
+  });
+
+  it("records libc in bun.lockb", async () => {
+    setHandler(dummyRegistry([], variants));
+    await writePackageJson({ optionalDependencies: { "dep-glibc": "1.0.0", "dep-musl": "2.0.0" } });
+
+    await install("--libc", "musl");
+    expect(await installed()).toEqual(["dep-musl"]);
+    expect(await exists(join(package_dir, "bun.lockb"))).toBe(true);
+
+    await rm(join(package_dir, "node_modules"), { recursive: true, force: true });
+    await install("--libc", "glibc", "--frozen-lockfile");
+    expect(await installed()).toEqual(["dep-glibc"]);
+  });
+
+  it("defaults to the libc this build of bun uses on Linux and does not filter by libc elsewhere", async () => {
+    setHandler(dummyRegistry([], variants));
+    await writePackageJson({ optionalDependencies: { "dep-glibc": "1.0.0", "dep-musl": "2.0.0" } });
+
+    await install();
+    expect(await installed()).toEqual(
+      isLinux ? [libcFamily === "musl" ? "dep-musl" : "dep-glibc"] : ["dep-glibc", "dep-musl"],
+    );
+  });
+
+  // The same spellings --os and --cpu accept: `*` or `any` for every value, a repeated flag, and `!name`.
+  it.each([
+    [
+      ["--libc", "*"],
+      ["dep-glibc", "dep-musl"],
+    ],
+    [
+      ["--libc", "any"],
+      ["dep-glibc", "dep-musl"],
+    ],
+    [
+      ["--libc", "glibc", "--libc", "musl"],
+      ["dep-glibc", "dep-musl"],
+    ],
+    [["--libc", "!glibc"], ["dep-musl"]],
+    [["--libc=glibc"], ["dep-glibc"]],
+  ])("bun install %p installs %p", async (flags, expected) => {
+    setHandler(dummyRegistry([], variants));
+    await writePackageJson({ optionalDependencies: { "dep-glibc": "1.0.0", "dep-musl": "2.0.0" } });
+
+    await install(...flags);
+    expect(await installed()).toEqual(expected);
+  });
+
+  it("combines with --os and --cpu", async () => {
+    setHandler(
+      dummyRegistry([], {
+        "1.0.0": { os: ["linux"], cpu: ["x64"], libc: ["glibc"] },
+        "2.0.0": { os: ["linux"], cpu: ["x64"], libc: ["musl"] },
+      }),
+    );
+    await writePackageJson({ optionalDependencies: { "dep-glibc": "1.0.0", "dep-musl": "2.0.0" } });
+
+    await install("--os", "linux", "--cpu", "x64", "--libc", "musl");
+    expect(await installed()).toEqual(["dep-musl"]);
+
+    await rm(join(package_dir, "node_modules"), { recursive: true, force: true });
+    await rm(join(package_dir, "bun.lockb"), { force: true });
+    await install("--os", "darwin", "--cpu", "x64", "--libc", "musl");
+    expect(await installed()).toEqual([]);
+  });
+
+  it("does not trust a cached abbreviated manifest for an optional dependency", async () => {
+    const urls: string[] = [];
+    const accepts = serveRecordingAccepts(urls);
+    const env = await enableManifestCache();
+    // As regular dependencies both variants install from the abbreviated manifests, which get cached.
+    await writePackageJson({ dependencies: { "dep-glibc": "1.0.0", "dep-musl": "2.0.0" } });
+    await installWithEnv(env, "--libc", "glibc");
+    expect(await installed()).toEqual(["dep-glibc", "dep-musl"]);
+    expect(accepts).toEqual({
+      "dep-glibc": [ABBREVIATED_MANIFEST_ACCEPT],
+      "dep-musl": [ABBREVIATED_MANIFEST_ACCEPT],
+    });
+
+    // Resolving the same exact versions again as regular dependencies is served by the cache.
+    await rm(join(package_dir, "bun.lockb"), { force: true });
+    clear(accepts, urls);
+    await installWithEnv(env, "--libc", "glibc");
+    expect(accepts).toEqual({});
+
+    // As optional dependencies, the cached manifests have these versions but not their libc, so the
+    // full manifests are fetched instead of resolving from the cache.
+    await rm(join(package_dir, "bun.lockb"), { force: true });
+    await rm(join(package_dir, "node_modules", "dep-glibc"), { recursive: true });
+    await rm(join(package_dir, "node_modules", "dep-musl"), { recursive: true });
+    await writePackageJson({ optionalDependencies: { "dep-glibc": "1.0.0", "dep-musl": "2.0.0" } });
+    await installWithEnv(env, "--libc", "glibc");
+    expect(await installed()).toEqual(["dep-glibc"]);
+    expect(accepts).toEqual({
+      "dep-glibc": [FULL_MANIFEST_ACCEPT],
+      "dep-musl": [FULL_MANIFEST_ACCEPT],
+    });
+  });
+
+  it("records libc for a package that is both a regular and an optional dependency, and only filters the optional one", async () => {
+    const urls: string[] = [];
+    // dep-universal@3.0.0 optionally depends on dep-musl@2.0.0, which the root also depends on
+    // directly. The root's edge only needs the abbreviated manifest; dep-universal's edge needs the
+    // full one, and its libc must end up on the shared lockfile entry no matter which response
+    // arrives first. It only disables dep-universal's optional edge: the root's regular dependency
+    // installs dep-musl like it did before libc was read at all.
+    const accepts = serveRecordingAccepts(urls, {
+      "2.0.0": { libc: ["musl"] },
+      "3.0.0": { optionalDependencies: { "dep-musl": "2.0.0" } },
+    });
+    await writePackageJson({ dependencies: { "dep-universal": "3.0.0", "dep-musl": "2.0.0" } });
+
+    await install("--libc", "glibc", "--save-text-lockfile");
+    expect(await installed()).toEqual(["dep-musl", "dep-universal"]);
+    expect(accepts["dep-musl"].sort()).toEqual([FULL_MANIFEST_ACCEPT, ABBREVIATED_MANIFEST_ACCEPT].sort());
+    expect(await lockfileEntry("dep-musl")).toContain(`{ "libc": "musl" }`);
+
+    // The lockfile now knows dep-musl's libc. Whether the root gets it still depends only on how the
+    // root depends on it, not on that knowledge: a devDependency is a regular dependency too.
+    for (const [group, expected] of [
+      ["optionalDependencies", ["dep-universal"]],
+      ["devDependencies", ["dep-musl", "dep-universal"]],
+    ] as const) {
+      await rm(join(package_dir, "node_modules"), { recursive: true, force: true });
+      await writePackageJson({ dependencies: { "dep-universal": "3.0.0" }, [group]: { "dep-musl": "2.0.0" } });
+      await install("--libc", "glibc");
+      expect(await installed()).toEqual([...expected]);
+      expect(await lockfileEntry("dep-musl")).toContain(`{ "libc": "musl" }`);
+    }
+  });
+
+  it("installs a package for its regular dependents when an optional dependent skips it for libc", async () => {
+    const urls: string[] = [];
+    // dep-universal@3.0.0 depends on dep-musl@2.0.0 optionally and on dep-both@1.0.0, which depends
+    // on dep-musl@2.0.0 regularly. With --libc glibc, dep-universal's edge is skipped but dep-both's
+    // is not. The optional edge is normally resolved first (it waits for one manifest, dep-both's
+    // edge for two), so skipping it must leave the package downloadable for the later edge.
+    serveByName(urls, {
+      "dep-universal": {
+        "3.0.0": { dependencies: { "dep-both": "1.0.0" }, optionalDependencies: { "dep-musl": "2.0.0" } },
+      },
+      "dep-both": { "1.0.0": { dependencies: { "dep-musl": "2.0.0" } } },
+      "dep-musl": { "2.0.0": { libc: ["musl"] } },
+    });
+    await writePackageJson({ dependencies: { "dep-universal": "3.0.0" } });
+
+    await install("--libc", "glibc", "--save-text-lockfile");
+    expect(await installed()).toEqual(["dep-both", "dep-musl", "dep-universal"]);
+    expect(tarballs(urls)).toEqual(["dep-both-1.0.0.tgz", "dep-musl-2.0.0.tgz", "dep-universal-3.0.0.tgz"]);
+    expect(await lockfileEntry("dep-musl")).toContain(`{ "libc": "musl" }`);
+  });
+
+  it("falls back to the abbreviated manifest when the request for the full one fails", async () => {
+    const urls: string[] = [];
+    // baz@0.0.3 is a regular dependency of the root and baz@0.0.5 an optional dependency of
+    // dep-universal@3.0.0, so baz is requested both ways, and the registry only has the abbreviated
+    // document. The optional edge then resolves from that document, which has no libc, so baz@0.0.5
+    // is installed the way it was before libc was read; the install neither fails nor drops the edge.
+    const accepts = serveByName(
+      urls,
+      {
+        baz: { "0.0.3": { libc: ["musl"] }, "0.0.5": { libc: ["musl"] } },
+        "dep-universal": { "3.0.0": { optionalDependencies: { baz: "0.0.5" } } },
+      },
+      undefined,
+      ["baz"],
+    );
+    await writePackageJson({ dependencies: { "dep-universal": "3.0.0", baz: "0.0.3" } });
+
+    const err = await install("--libc", "glibc", "--save-text-lockfile");
+    expect(err).toContain(
+      "warn: HTTP 404 downloading the full package metadata for baz, using the abbreviated metadata: its libc field will not be checked",
+    );
+    expect(accepts.baz.sort()).toEqual([FULL_MANIFEST_ACCEPT, ABBREVIATED_MANIFEST_ACCEPT].sort());
+    expect(await installed()).toEqual(["baz", "dep-universal"]);
+    expect(await installedVersion("baz")).toBe("0.0.3");
+    expect(await installedVersion("dep-universal", "node_modules", "baz")).toBe("0.0.5");
+    expect(await Bun.file(join(package_dir, "bun.lock")).text()).not.toContain(`"libc"`);
+
+    // Everything was resolved and saved, so installing from the lockfile needs no manifest at all.
+    await rm(join(package_dir, "node_modules"), { recursive: true, force: true });
+    clear(accepts, urls);
+    expect(await install("--libc", "glibc", "--frozen-lockfile")).not.toContain("warn:");
+    expect(accepts).toEqual({});
+    expect(await installedVersion("dep-universal", "node_modules", "baz")).toBe("0.0.5");
+  });
+
+  it("falls back to the abbreviated manifest when the optional dependency is reached before the regular one", async () => {
+    const urls: string[] = [];
+    // Same registry, but here the regular dependency on baz comes from dep-both, which is only
+    // resolved after its own manifest arrives, so the optional edge from dep-universal requests baz
+    // first and its 404 may even be processed before the regular edge exists. Whichever of the two
+    // requests the abbreviated document, both edges resolve from it, exactly as in the other order.
+    const accepts = serveByName(
+      urls,
+      {
+        baz: { "0.0.5": { libc: ["musl"] } },
+        "dep-universal": {
+          "3.0.0": { dependencies: { "dep-both": "1.0.0" }, optionalDependencies: { baz: "0.0.5" } },
+        },
+        "dep-both": { "1.0.0": { dependencies: { baz: "0.0.5" } } },
+      },
+      undefined,
+      ["baz"],
+    );
+    await writePackageJson({ dependencies: { "dep-universal": "3.0.0" } });
+
+    const err = await install("--libc", "glibc", "--save-text-lockfile");
+    expect(err).toContain("warn: HTTP 404 downloading the full package metadata for baz");
+    expect(accepts.baz.sort()).toEqual([FULL_MANIFEST_ACCEPT, ABBREVIATED_MANIFEST_ACCEPT].sort());
+    expect(await installed()).toEqual(["baz", "dep-both", "dep-universal"]);
+    expect(await lockfileEntry("baz")).not.toContain(`"libc"`);
+
+    // Both edges were resolved, including the optional one that was waiting when the full request
+    // failed, so installing from the lockfile needs no manifest at all.
+    await rm(join(package_dir, "node_modules"), { recursive: true, force: true });
+    clear(accepts, urls);
+    expect(await install("--libc", "glibc", "--frozen-lockfile")).not.toContain("warn:");
+    expect(accepts).toEqual({});
+    expect(await installed()).toEqual(["baz", "dep-both", "dep-universal"]);
+  });
+
+  it("falls back to the abbreviated manifest for a package that is only an optional dependency", async () => {
+    const urls: string[] = [];
+    // Nothing requested the abbreviated document, so the dependency that was waiting for the full
+    // one requests it once the full one has failed: the package installs as it did before libc was
+    // read instead of being left out.
+    const accepts = serveByName(urls, { baz: { "0.0.5": { libc: ["musl"] } } }, undefined, ["baz"]);
+    await writePackageJson({ optionalDependencies: { baz: "0.0.5" } });
+
+    const err = await install("--libc", "glibc", "--save-text-lockfile");
+    expect(err).toContain("warn: HTTP 404 downloading the full package metadata for baz");
+    expect(accepts.baz).toEqual([FULL_MANIFEST_ACCEPT, ABBREVIATED_MANIFEST_ACCEPT]);
+    expect(await installed()).toEqual(["baz"]);
+    expect(await lockfileEntry("baz")).not.toContain(`"libc"`);
+
+    await rm(join(package_dir, "node_modules"), { recursive: true, force: true });
+    clear(accepts, urls);
+    expect(await install("--libc", "glibc", "--frozen-lockfile")).not.toContain("warn:");
+    expect(accepts).toEqual({});
+    expect(await installed()).toEqual(["baz"]);
+  });
+
+  it("falls back to a cached abbreviated manifest without requesting it again", async () => {
+    const urls: string[] = [];
+    // First install: baz is a regular dependency, so its abbreviated manifest ends up in the cache.
+    const tables = {
+      baz: { "0.0.5": { libc: ["musl"] } },
+      "dep-universal": {
+        "3.0.0": { dependencies: { "dep-both": "1.0.0" }, optionalDependencies: { baz: "0.0.5" } },
+      },
+      "dep-both": { "1.0.0": { dependencies: { baz: "0.0.5" } } },
+    };
+    serveByName(urls, tables, undefined, ["baz"]);
+    const env = await enableManifestCache();
+    await writePackageJson({ dependencies: { baz: "0.0.5" } });
+    await installWithEnv(env, "--libc", "glibc");
+    expect(await installed()).toEqual(["baz"]);
+
+    // Second install: the optional edge from dep-universal requests the full document, which fails,
+    // and the regular edge from dep-both is satisfied by the cached abbreviated one, which the
+    // optional edge then falls back to as well. The dedupe entry of the failing request has to
+    // survive the cache hit: the install must not fail, and the cached document is not requested.
+    await rm(join(package_dir, "bun.lockb"), { force: true });
+    await rm(join(package_dir, "node_modules", "baz"), { recursive: true });
+    const accepts = serveByName(urls, tables, undefined, ["baz"]);
+    await writePackageJson({ dependencies: { "dep-universal": "3.0.0" } });
+
+    const err = await installWithEnv(env, "--libc", "glibc", "--save-text-lockfile");
+    expect(err).toContain("warn: HTTP 404 downloading the full package metadata for baz");
+    expect(accepts.baz).toEqual([FULL_MANIFEST_ACCEPT]);
+    expect(await installed()).toEqual(["baz", "dep-both", "dep-universal"]);
+    expect(await lockfileEntry("baz")).not.toContain(`"libc"`);
+
+    await rm(join(package_dir, "node_modules"), { recursive: true, force: true });
+    clear(accepts, urls);
+    expect(await install("--libc", "glibc", "--frozen-lockfile")).not.toContain("warn:");
+    expect(accepts).toEqual({});
+    expect(await installed()).toEqual(["baz", "dep-both", "dep-universal"]);
+  });
+
+  it("records libc when migrating a yarn.lock whose package is a regular dependency first and an optional one later", async () => {
+    const urls: string[] = [];
+    // The yarn.lock migration fetches every package's manifest to fill in os, cpu and libc. The
+    // root's regular dependency on dep-musl comes first; dep-universal's optional dependency on it,
+    // which is what makes the full manifest necessary, comes later and must still get it requested.
+    const accepts = serveByName(urls, {
+      "dep-universal": { "3.0.0": { optionalDependencies: { "dep-musl": "2.0.0" } } },
+      "dep-musl": { "2.0.0": { libc: ["musl"] } },
+    });
+    await writePackageJson({ dependencies: { "dep-universal": "3.0.0", "dep-musl": "2.0.0" } });
+    await writeFile(
+      join(package_dir, "yarn.lock"),
+      [
+        "# THIS IS AN AUTOGENERATED FILE. DO NOT EDIT THIS FILE DIRECTLY.",
+        "# yarn lockfile v1",
+        "",
+        "",
+        "dep-musl@2.0.0:",
+        '  version "2.0.0"',
+        '  resolved "https://registry.yarnpkg.com/dep-musl/-/dep-musl-2.0.0.tgz#0000000000000000000000000000000000000000"',
+        "",
+        "dep-universal@3.0.0:",
+        '  version "3.0.0"',
+        '  resolved "https://registry.yarnpkg.com/dep-universal/-/dep-universal-3.0.0.tgz#0000000000000000000000000000000000000000"',
+        "  optionalDependencies:",
+        '    dep-musl "2.0.0"',
+        "",
+      ].join("\n"),
+    );
+
+    await install("--save-text-lockfile", "--lockfile-only");
+    expect(accepts["dep-musl"]).toContain(FULL_MANIFEST_ACCEPT);
+    expect(await lockfileEntry("dep-musl")).toContain(`{ "libc": "musl" }`);
+  });
+
+  // None of these may silently turn into "every libc".
+  it.each(["bionic", "!bionic", "!", ""])("should error on --libc %p", async value => {
+    await writePackageJson({});
+
+    const { stderr, exited } = spawn({
+      cmd: [bunExe(), "install", `--libc=${value}`],
+      cwd: package_dir,
+      env: bunEnv,
+      stdout: "ignore",
+      stderr: "pipe",
+    });
+
+    const [stderrText, exitCode] = await Promise.all([stderr.text(), exited]);
+    expect(stderrText).toContain(`Invalid libc: '${value}'. Valid values are: *, any, glibc, musl.`);
+    expect(exitCode).toBe(1);
+  });
+});
diff --git a/test/cli/install/bun-install-native-binlink.test.ts b/test/cli/install/bun-install-native-binlink.test.ts
index 1f5e6433d135..5f7ecf3389a5 100644
--- a/test/cli/install/bun-install-native-binlink.test.ts
+++ b/test/cli/install/bun-install-native-binlink.test.ts
@@ -210,6 +210,71 @@ describe.concurrent("native binlink optimization", () => {
     });
   }
 
+  // test-native-binlink-libc has a glibc and a musl platform package with identical os/cpu
+  // lists (the shape of @anthropic-ai/claude-code, which is on the default list). Only the one
+  // matching the target libc is installed, so the bin has to be linked to that one and not to
+  // whichever comes first.
+  for (const linker of ["hoisted", "isolated"]) {
+    for (const libc of ["glibc", "musl"]) {
+      test(`links the bin to the ${libc} platform package with linker ${linker}`, async () => {
+        const env = { ...bunEnv };
+        const { packageDir, packageJson } = await verdaccio.createTestDir();
+        env.BUN_INSTALL_CACHE_DIR = join(packageDir, ".bun-cache");
+        env.BUN_TMPDIR = env.TMPDIR = env.TEMP = join(packageDir, ".bun-tmp");
+
+        await writeFile(
+          join(packageDir, "bunfig.toml"),
+          Bun.TOML.stringify({
+            install: {
+              cache: join(packageDir, ".bun-cache"),
+              registry: verdaccio.registryUrl(),
+              linker,
+            },
+          }),
+        );
+        await writeFile(
+          packageJson,
+          JSON.stringify({
+            name: "test-app",
+            version: "1.0.0",
+            dependencies: { "test-native-binlink-libc": "1.0.0" },
+            nativeDependencies: ["test-native-binlink-libc"],
+            trustedDependencies: ["test-native-binlink-libc"],
+          }),
+        );
+
+        const install = spawn({
+          cmd: [bunExe(), "install", "--libc", libc],
+          cwd: packageDir,
+          stdout: "ignore",
+          stdin: "ignore",
+          stderr: "pipe",
+          env,
+        });
+        const [installStderr, installExitCode] = await Promise.all([install.stderr.text(), install.exited]);
+        expect(installStderr).not.toContain("error:");
+        expect(installExitCode).toBe(0);
+
+        const binDir = join(packageDir, "node_modules", ".bin");
+        expect(readBinTarget(binDir, "test-binlink-libc-cmd")).toContain(
+          join(`test-native-binlink-libc-${libc}`, "bin", "main.js"),
+        );
+
+        const bin = spawn({
+          cmd: [binEntry(binDir, "test-binlink-libc-cmd")],
+          cwd: packageDir,
+          stdout: "pipe",
+          stdin: "ignore",
+          stderr: "inherit",
+          env,
+        });
+        const [binStdout, binExitCode] = await Promise.all([bin.stdout.text(), bin.exited]);
+        expect(binStdout).toContain(`SUCCESS: Using test-native-binlink-libc-${libc}`);
+        expect(binExitCode).toBe(0);
+      });
+    }
+  }
+
   // The postinstall skip must apply to every copy of a nativeDependencies
   // package in the tree, not just the hoisted one. Previously a second,
   // differently-versioned esbuild nested under a transitive dependent would
diff --git a/test/cli/install/bun-install-registry.test.ts b/test/cli/install/bun-install-registry.test.ts
index 0ae5a9ce4fe9..6a4205704d73 100644
--- a/test/cli/install/bun-install-registry.test.ts
+++ b/test/cli/install/bun-install-registry.test.ts
@@ -9,6 +9,7 @@ import {
   bunEnv as env,
   isFlaky,
   isLinux,
+  isLinux,
   isWindows,
   mergeWindowEnvs,
   normalizeBunSnapshot,
@@ -3905,6 +3906,15 @@ test("it should invalid cached package if package.json is missing", async () =>
   ]);
 });
 
+// The dependency set below includes optional-native, whose optional dependencies include
+// native-libc-glibc and native-libc-musl. On Linux the one for the other libc is skipped;
+// elsewhere libc is not filtered.
+const installsWithOptionalNative = isLinux ? 18 : 19;
+const installedCountWithOptionalNative = `${installsWithOptionalNative} packages installed`;
+const checkedCountWithOptionalNative = expect.stringContaining(
+  `Checked ${installsWithOptionalNative} installs across 23 packages (no changes)`,
+);
+
 test("it should install with missing bun.lockb, node_modules, and/or cache", async () => {
   // first clean install
   await writeFile(
@@ -3959,7 +3969,7 @@ test("it should install with missing bun.lockb, node_modules, and/or cache", asy
     expect.stringContaining("+ uses-what-bin@1.5.0"),
     expect.stringContaining("+ what-bin@1.0.0"),
     "",
-    "19 packages installed",
+    installedCountWithOptionalNative,
     "",
     "Blocked 1 postinstall. Run `bun pm untrusted` for details.",
     "",
@@ -4003,7 +4013,7 @@ test("it should install with missing bun.lockb, node_modules, and/or cache", asy
     expect.stringContaining("+ uses-what-bin@1.5.0"),
     expect.stringContaining("+ what-bin@1.0.0"),
     "",
-    "19 packages installed",
+    installedCountWithOptionalNative,
     "",
     "Blocked 1 postinstall. Run `bun pm untrusted` for details.",
     "",
@@ -4049,7 +4059,7 @@ test("it should install with missing bun.lockb, node_modules, and/or cache", asy
     expect(out.replace(/\s*\[[0-9\.]+m?s\]\s*$/, "").split(/\r?\n/)).toEqual([
       expect.stringContaining("bun install v1."),
       "",
-      expect.stringContaining("Checked 19 installs across 23 packages (no changes)"),
+      checkedCountWithOptionalNative,
     ]);
 
     expect(await exited).toBe(0);
@@ -4076,7 +4086,7 @@ test("it should install with missing bun.lockb, node_modules, and/or cache", asy
   expect(out.replace(/\s*\[[0-9\.]+m?s\]\s*$/, "").split(/\r?\n/)).toEqual([
     expect.stringContaining("bun install v1."),
     "",
-    expect.stringContaining("Checked 19 installs across 23 packages (no changes)"),
+    checkedCountWithOptionalNative,
   ]);
   expect(await exited).toBe(0);
   assertManifestsPopulated(join(packageDir, ".bun-cache"), registryUrl());
@@ -4105,7 +4115,7 @@ test("it should install with missing bun.lockb, node_modules, and/or cache", asy
   expect(out.replace(/\s*\[[0-9\.]+m?s\]\s*$/, "").split(/\r?\n/)).toEqual([
     expect.stringContaining("bun install v1."),
     "",
-    expect.stringContaining("Checked 19 installs across 23 packages (no changes)"),
+    checkedCountWithOptionalNative,
   ]);
 });
 
@@ -7514,7 +7524,7 @@ test("missing package on reinstall, some with binaries", async () => {
     expect.stringContaining("+ uses-what-bin@1.5.0"),
     expect.stringContaining("+ what-bin@1.0.0"),
     "",
-    "19 packages installed",
+    installedCountWithOptionalNative,
     "",
     "Blocked 1 postinstall. Run `bun pm untrusted` for details.",
     "",
diff --git a/test/cli/install/bun-lock.test.ts b/test/cli/install/bun-lock.test.ts
index 32db4a3fdfca..16741f3829f2 100644
--- a/test/cli/install/bun-lock.test.ts
+++ b/test/cli/install/bun-lock.test.ts
@@ -5,6 +5,7 @@ import { access, copyFile, cp, exists, open, rm, writeFile } from "fs/promises";
 import {
   bunExe,
   bunEnv as env,
+  isLinux,
   isWindows,
   normalizeBunSnapshot,
   readdirSorted,
@@ -475,6 +476,11 @@ index d156130662798530e852e1afaec5b1c03d429cdc..b4ddf35975a952fdaed99f2b14236519
     .replaceAll(/\s*\[[0-9\.]+m?s\]\s*$/g, "")
     .split(/\r?\n/)
     .slice(1);
+  // optional-native depends on native-libc-glibc and native-libc-musl; on Linux only the one
+  // matching the host libc is installed, elsewhere libc is not filtered. The lockfile is the
+  // same everywhere.
+  const installedLine = `${isLinux ? 12 : 13} packages installed`;
+  expect(out1.pop()).toBe(installedLine);
   expect(out1).toMatchInlineSnapshot(`
     [
       "preinstall",
@@ -483,7 +489,6 @@ index d156130662798530e852e1afaec5b1c03d429cdc..b4ddf35975a952fdaed99f2b14236519
       "+ optional-native@1.0.0",
       "+ uses-what-bin@1.0.0 (v1.5.0 available)",
       "",
-      "13 packages installed",
     ]
   `);
 
@@ -507,13 +512,13 @@ index d156130662798530e852e1afaec5b1c03d429cdc..b4ddf35975a952fdaed99f2b14236519
     .replaceAll(/\s*\[[0-9\.]+m?s\]\s*$/g, "")
     .split(/\r?\n/)
     .slice(1);
+  expect(out2.pop()).toBe(installedLine);
   expect(out2).toMatchInlineSnapshot(`
     [
       "preinstall",
       "",
       "+ bundled-1@1.0.0",
       "",
-      "13 packages installed",
     ]
   `);
 
diff --git a/test/cli/install/bun-pm-licenses.test.ts b/test/cli/install/bun-pm-licenses.test.ts
index 19bda7b38109..f375534d84d1 100644
--- a/test/cli/install/bun-pm-licenses.test.ts
+++ b/test/cli/install/bun-pm-licenses.test.ts
@@ -1,7 +1,7 @@
 import { spawn } from "bun";
 import { afterAll, beforeAll, describe, expect, test } from "bun:test";
 import { copyFileSync, existsSync, mkdirSync, readFileSync, readdirSync, renameSync, rmSync, writeFileSync } from "fs";
-import { VerdaccioRegistry, bunEnv, bunExe, normalizeBunSnapshot, tempDir } from "harness";
+import { VerdaccioRegistry, bunEnv, bunExe, isLinux, libcFamily, normalizeBunSnapshot, tempDir } from "harness";
 import { isAbsolute, join, sep } from "path";
 import { pathToFileURL } from "url";
 
@@ -693,7 +693,7 @@ describe("bun pm licenses", () => {
     expect(names(await licensesJson(dir))).toStrictEqual(["a-dep", "no-deps", "one-dep"]);
   });
 
-  test.concurrent("os/cpu-skipped optional dependencies are omitted, their parent is listed", async () => {
+  test.concurrent("os/cpu/libc-skipped optional dependencies are omitted, their parent is listed", async () => {
     const dir = await setup("hoisted", { "package.json": pkg({ dependencies: { "optional-native": "1.0.0" } }) });
     const installedNatives = [
       "native-bar-x64",
@@ -704,7 +704,11 @@ describe("bun pm licenses", () => {
     ]
       .filter(name => existsSync(join(dir, "node_modules", name, "package.json")))
       .map(name => u(name, "1.0.0"));
-    expect(installedNatives.map(entry => entry.name)).not.toContain("native-foo-x64");
+    // native-foo-* and native-bar-* declare operating systems that do not exist. Of the two libc
+    // variants, Linux installs the one this build of bun is for; other systems do not filter by libc.
+    expect(installedNatives.map(entry => entry.name)).toStrictEqual(
+      isLinux ? [`native-libc-${libcFamily}`] : ["native-libc-glibc", "native-libc-musl"],
+    );
 
     expect(await licensesJson(dir)).toStrictEqual({
       Unknown: [...installedNatives, u("optional-native", "1.0.0")],
diff --git a/test/cli/install/bun-prune.test.ts b/test/cli/install/bun-prune.test.ts
index 9b5420819412..62dc3c9b1fdb 100644
--- a/test/cli/install/bun-prune.test.ts
+++ b/test/cli/install/bun-prune.test.ts
@@ -1961,6 +1961,40 @@ test.concurrent.each([["--os=aix"], ["--cpu=s390x"]])(
   },
 );
 
+// native-libc-glibc and native-libc-musl differ only in their `libc` field. The libc is passed
+// explicitly throughout because the default differs per host (and non-Linux hosts do not filter).
+test.concurrent("--libc removes the variant of the other libc, pruning for the installed libc keeps it", async () => {
+  const { packageDir: dir, packageJson } = await registry.createTestDir();
+  await write(
+    packageJson,
+    JSON.stringify({
+      name: "foo",
+      optionalDependencies: { "native-libc-glibc": "1.0.0", "native-libc-musl": "1.0.0" },
+    }),
+  );
+  expect(await install(dir, "--libc=glibc")).toContain("+ native-libc-glibc@1.0.0");
+  const nm = join(dir, "node_modules");
+  const glibc = join(nm, "native-libc-glibc", "package.json");
+  const musl = join(nm, "native-libc-musl", "package.json");
+  expect([existsSync(glibc), existsSync(musl)]).toStrictEqual([true, false]);
+
+  const same = await prune(dir, "--libc=glibc");
+  expect(out(same.stdout)).toEndWith(NOTHING(1, 1));
+  expect(same.exitCode).toBe(0);
+  expect(existsSync(glibc)).toBeTrue();
+
+  const other = await prune(dir, "--libc=musl");
+  expect(lines(other.stdout)).toStrictEqual([BANNER, "", "- native-libc-glibc@1.0.0", REMOVED(1, 1)]);
+  expect(other.exitCode).toBe(0);
+  expect(existsSync(glibc)).toBeFalse();
+
+  expect(await install(dir, "--libc=musl")).toContain("+ native-libc-musl@1.0.0");
+  expect([existsSync(glibc), existsSync(musl)]).toStrictEqual([false, true]);
+  const musl2 = await prune(dir, "--libc=musl");
+  expect(out(musl2.stdout)).toEndWith(NOTHING(1, 1));
+  expect(musl2.exitCode).toBe(0);
+});
+
 test.concurrent.each(["hoisted", "isolated"] as Linker[])(
   "%s: an npm: alias is kept under its alias name",
   async linker => {
@@ -3427,6 +3461,7 @@ test.concurrent("--help lists every flag; -F is --filter, -p is --production", a
           --dry-run         Print what would be removed without deleting anything
           --os=<val>        Prune for a different operating system than the current one
           --cpu=<val>       Prune for a different CPU architecture than the current one
+          --libc=<val>      Prune for a different libc than the current one
           --linker=<val>    Prune a node_modules installed with the given linker (one of "isolated" or "hoisted")
       -F, --filter=<val>    Only prune the node_modules folders of the matching workspaces
           --silent          Don't log anything
diff --git a/test/cli/install/dep-glibc-1.0.0.tgz b/test/cli/install/dep-glibc-1.0.0.tgz
new file mode 100644
index 0000000000000000000000000000000000000000..69c83173b25d2988c39afb66f9151773e8b82449
GIT binary patch
literal 219
zcmV<103`n(iwFP!000021MSpJYQr!PhGDIJ3ZZrDjESp7Lm*dCZDHKTKiEkygxo!H
z+(Ob#H;HNK`)meg1QJM}T9<ve!Y|sX#_xSot2>jxrs<^y->W2Il`LPZB#E^W){S+k
zw5S>E`<?5;QPlr*jI=hjtGs#DCim@gu`S;+^E9>(zU#}T9w$jGu}s~{m6ujo=Y9z9
z#YCq_;g9;v{o?C3AF;<z`Im8an}12k|17E|-*0{Fhqmc<y<T5^0-GuHE7A=B00000
V00000008idodL6oS1$l4002!xXxRV&

literal 0
HcmV?d00001

diff --git a/test/cli/install/dep-musl-2.0.0.tgz b/test/cli/install/dep-musl-2.0.0.tgz
new file mode 100644
index 0000000000000000000000000000000000000000..6ceec8772618d72d9b2b43932af08fa86689d1ae
GIT binary patch
literal 216
zcmV;}04M(+iwFP!000021MSq!io!4$h2gAw6(MV<e%0EAGT^NQ8>BP#ho%)_@ZL?W
zBDis*GQ+&j=D^oL0_jO(H{W*arp=h~m#-`JWD;a)dd}cJC6R@a`681f$ubG+hMXxa
z>J56|*)|+S{ZBuU)~2$hGfQo9*L;+{-<ioU-MiKobv1mL#S+UnEp2fg6;<vI;de37
zF;e)eF1?>#uk#gqJnFxs^ZWiwO8?)Ytn+^7Vs~ijw)6V)_6V%U(ywSY0000000000
S0002MZ*~HP)1>$SC;$N8glWtG

literal 0
HcmV?d00001

diff --git a/test/cli/install/dep-universal-3.0.0.tgz b/test/cli/install/dep-universal-3.0.0.tgz
index 027565ef7e416bc6e50d9364e810ec2371f6bb80..a8650a155f0c2e68c2a9117c29bce958157bd8ad 100644
GIT binary patch
literal 217
zcmV;~04Dz*iwFP!000021MSq!io!4yhT*Jx6(Q@f9>>~+GBCFira`JUE&UN;n0ueJ
z)lD~UR21K5bHYg=f#geNfA)6k=G9o^T~m5>V-loEGSpyNWwH2FvRtKMkfsvW4OMAT
z570HOt;12&d-{#EHr^J_thLEpHS2tSbai77=A)nL$9d`d*<~!TjNQWKLo4^0JB2r6
zqQ6Mt1)Xz0zue?K_PCaRS;;j2l92z0D9WrmxY(VlvThswHTeX-$Ix#`Hvj+t00000
T00000z?1q1Y&}w704M+eF~(;a

literal 214
zcmb2|=3oE==C@Z)XB{>WXiZ%ITf|8^KgxL1T$Z3u28+awu2q(dZ(8`|?&6B8Re|g8
zaR0fV#$vqS=A6v8r+3$u-i(&7*(BKcE!FaRMx<+*Yf{-JeZFN=Y|hP$Ib{>L>8jKG
z-oFXfODE~IJlwr=>p%Oi3-{Vu*It>LJ>M-pKIZyuH~Uw=7xUSbb@>=wyxx94PE>kD
z?bBs5{^|aYIKMyg$^9qK9RAfGvJ6RnY-GN5p>$Pg(97x03-pSAT~5Em4{<w~{9t~U
N!DC|2D+Ub)1^|pkWTF57

diff --git a/test/cli/install/dummy.registry.ts b/test/cli/install/dummy.registry.ts
index 282efcb0507a..ccf3679dd1c8 100644
--- a/test/cli/install/dummy.registry.ts
+++ b/test/cli/install/dummy.registry.ts
@@ -48,6 +48,26 @@ let server: Server;
 export let root_url: string;
 export let check_npm_auth_type = { check: true };
 
+/** What `bun install` sends for a regular dependency: the abbreviated document. */
+export const ABBREVIATED_MANIFEST_ACCEPT = "application/vnd.npm.install-v1+json; q=1.0, application/json; q=0.8, */*";
+/** Sent for optional dependencies (and with `minimumReleaseAge`): the full document. */
+export const FULL_MANIFEST_ACCEPT = "application/json, */*";
+
+/**
+ * Like registry.npmjs.org, the abbreviated document has no `libc` field, so a
+ * test that gives a version `libc` only sees it filtered if bun asked for the
+ * full document.
+ */
+function manifestVersionInfo(request: Request, info: any) {
+  const accept = request.headers.get("accept");
+  expect([ABBREVIATED_MANIFEST_ACCEPT, FULL_MANIFEST_ACCEPT]).toContain(accept);
+  if (accept === ABBREVIATED_MANIFEST_ACCEPT && "libc" in info) {
+    const { libc, ...abbreviated } = info;
+    return abbreviated;
+  }
+  return info;
+}
+
 // ============================================================================
 // Concurrent Test Context Support
 // ============================================================================
@@ -191,9 +211,6 @@ export function dummyRegistryForContext(
     if (url.endsWith(".tgz")) {
       return new Response(file(join(import.meta.dir, basename(url).toLowerCase())), { status });
     }
-    expect(request.headers.get("accept")).toBe(
-      "application/vnd.npm.install-v1+json; q=1.0, application/json; q=0.8, */*",
-    );
     if (check_npm_auth_type.check) {
       expect(request.headers.get("npm-auth-type")).toBe(null);
     }
@@ -214,7 +231,7 @@ export function dummyRegistryForContext(
         dist: {
           tarball: `${ctx.registry_url}${name}-${info[version].as ?? version}.tgz`,
         },
-        ...info[version],
+        ...manifestVersionInfo(request, info[version]),
       };
     }
 
@@ -268,9 +285,6 @@ export function dummyRegistry(
       const tgzPath = join(tgzDir ?? import.meta.dir, basename(url).toLowerCase());
       return new Response(file(tgzPath), { status });
     }
-    expect(request.headers.get("accept")).toBe(
-      "application/vnd.npm.install-v1+json; q=1.0, application/json; q=0.8, */*",
-    );
     if (check_npm_auth_type.check) {
       expect(request.headers.get("npm-auth-type")).toBe(null);
     }
@@ -287,7 +301,7 @@ export function dummyRegistry(
         dist: {
           tarball: `${url}-${info[version].as ?? version}.tgz`,
         },
-        ...info[version],
+        ...manifestVersionInfo(request, info[version]),
       };
     }
 
diff --git a/test/cli/install/migration/migrate.test.ts b/test/cli/install/migration/migrate.test.ts
index 85cd8b69f4b3..99f90553a3a0 100644
--- a/test/cli/install/migration/migrate.test.ts
+++ b/test/cli/install/migration/migrate.test.ts
@@ -794,6 +794,91 @@ test.concurrent("pnpm-lock.yaml migration does not platform-skip a regular file:
   expect(await Bun.file(join(testDir, "node_modules", "a", "package.json")).json()).toHaveProperty("name", "a");
 });
 
+// `libc` is carried over for registry packages like `os`/`cpu` are, and like them is dropped
+// for a `file:` dependency, which a fresh resolve installs unconditionally. Nothing is installed
+// (port 1 refuses connections), only the lockfile is migrated.
+describe.each([
+  [
+    "package-lock.json",
+    {
+      "package-lock.json": JSON.stringify({
+        name: "repro",
+        lockfileVersion: 3,
+        requires: true,
+        packages: {
+          "": { name: "repro", dependencies: { "native-musl": "1.0.0", a: "file:vendor/a" } },
+          "node_modules/native-musl": {
+            version: "1.0.0",
+            resolved: "http://localhost:1/native-musl/-/native-musl-1.0.0.tgz",
+            integrity:
+              "sha512-1uffg8IA4EJ4VUnuZU4zyRO9EyduuNfbqg2MMVCWSMAsQkfzZnNR0hqtL0GW/EuhE8FWU/FE//Srf1px1pnN2Q==",
+            os: ["linux"],
+            libc: ["musl"],
+          },
+          "node_modules/a": { resolved: "vendor/a", link: true },
+          // npm copies the field as written in package.json, which may be a bare string.
+          "vendor/a": { version: "1.0.0", libc: "musl" },
+        },
+      }),
+    },
+  ],
+  [
+    "pnpm-lock.yaml",
+    {
+      "pnpm-lock.yaml": [
+        "lockfileVersion: '9.0'",
+        "",
+        "importers:",
+        "",
+        "  .:",
+        "    dependencies:",
+        "      a:",
+        "        specifier: file:vendor/a",
+        "        version: file:vendor/a",
+        "      native-musl:",
+        "        specifier: 1.0.0",
+        "        version: 1.0.0",
+        "",
+        "packages:",
+        "",
+        "  a@file:vendor/a:",
+        "    resolution: {directory: vendor/a, type: directory}",
+        "    libc: [musl]",
+        "    version: 1.0.0",
+        "",
+        "  native-musl@1.0.0:",
+        "    resolution: {integrity: sha512-1uffg8IA4EJ4VUnuZU4zyRO9EyduuNfbqg2MMVCWSMAsQkfzZnNR0hqtL0GW/EuhE8FWU/FE//Srf1px1pnN2Q==}",
+        "    os: [linux]",
+        "    libc: [musl]",
+        "",
+        "snapshots:",
+        "",
+        "  a@file:vendor/a: {}",
+        "",
+        "  native-musl@1.0.0: {}",
+        "",
+      ].join("\n"),
+    },
+  ],
+])("%s migration keeps the libc of registry packages", (lockfile, lockfileFiles) => {
+  test.concurrent("bun.lock records it", async () => {
+    await using testDir = tempDir("migrate-libc", {
+      "package.json": JSON.stringify({ name: "repro", dependencies: { "native-musl": "1.0.0", a: "file:vendor/a" } }),
+      "vendor/a/package.json": JSON.stringify({ name: "a", version: "1.0.0", libc: ["musl"] }),
+      "bunfig.toml": '[install]\nregistry = "http://localhost:1/"\n',
+      ...lockfileFiles,
+    });
+
+    const { stderr, exitCode } = await install(testDir, "--lockfile-only");
+    expect(stderr).toContain(`migrated lockfile from ${lockfile}`);
+    expect(exitCode).toBe(0);
+
+    const lines = (await Bun.file(join(testDir, "bun.lock")).text()).split("\n").map(line => line.trim());
+    expect(lines.find(line => line.startsWith('"native-musl": ['))).toContain(`{ "os": "linux", "libc": "musl" }`);
+    expect(lines.find(line => line.startsWith('"a": ['))).toBe('"a": ["a@file:vendor/a", {}],');
+  });
+});
+
 describe("package-lock.json migration fixes", () => {
   const ARBORIST = join(import.meta.dir, "npm-arborist");
   const arboristFixtures: { name: string; root?: string }[] = JSON.parse(
diff --git a/test/cli/install/registry/packages/create-native-binlink-libc-packages.ts b/test/cli/install/registry/packages/create-native-binlink-libc-packages.ts
new file mode 100644
index 000000000000..7394aeafbdb9
--- /dev/null
+++ b/test/cli/install/registry/packages/create-native-binlink-libc-packages.ts
@@ -0,0 +1,75 @@
+#!/usr/bin/env bun
+/**
+ * Creates the packages for the libc half of the native binlink tests
+ * (bun-install-native-binlink.test.ts). Same shape as create-native-binlink-packages.ts,
+ * except that the main package has two platform packages that only differ in `libc`:
+ * - test-native-binlink-libc: main package, its bin exits with code 1
+ * - test-native-binlink-libc-glibc: `libc: ["glibc"]`, its bin prints its own name and exits 0
+ * - test-native-binlink-libc-musl: `libc: ["musl"]`, same
+ */
+
+import { $ } from "bun";
+import { mkdir, rm, writeFile } from "fs/promises";
+import { join } from "path";
+
+const packagesDir = import.meta.dir;
+const version = "1.0.0";
+const main = "test-native-binlink-libc";
+const variants = { [`${main}-glibc`]: "glibc", [`${main}-musl`]: "musl" };
+
+function manifest(name: string) {
+  if (name === main) {
+    return {
+      bin: { "test-binlink-libc-cmd": "./bin/main.js" },
+      optionalDependencies: Object.fromEntries(Object.keys(variants).map(variant => [variant, version])),
+    };
+  }
+  return { os: ["darwin", "linux", "win32"], cpu: ["arm64", "x64"], libc: [variants[name]] };
+}
+
+for (const name of [main, ...Object.keys(variants)]) {
+  const tmp = join(packagesDir, `${name}-tmp`);
+  const pkg = join(tmp, "package");
+  await mkdir(join(pkg, "bin"), { recursive: true });
+  await writeFile(join(pkg, "package.json"), JSON.stringify({ name, version, ...manifest(name) }, null, 2));
+  await writeFile(
+    join(pkg, "bin", "main.js"),
+    name === main
+      ? `#!/usr/bin/env node\nconsole.log("ERROR: Using main package bin, not the libc-specific one!");\nprocess.exit(1);\n`
+      : `#!/usr/bin/env node\nconsole.log("SUCCESS: Using ${name}");\nprocess.exit(0);\n`,
+  );
+
+  const tarballName = `${name}-${version}.tgz`;
+  await mkdir(join(packagesDir, name), { recursive: true });
+  const tarballPath = join(packagesDir, name, tarballName);
+  await $`tar --owner=0 --group=0 --numeric-owner --mtime=1985-10-26T08:15:00Z -czf ${tarballPath} -C ${tmp} package`;
+  await rm(tmp, { recursive: true });
+
+  const tarball = await Bun.file(tarballPath).bytes();
+  const integrity = `sha512-${Buffer.from(new Bun.CryptoHasher("sha512").update(tarball).digest()).toString("base64")}`;
+  const shasum = Buffer.from(new Bun.CryptoHasher("sha1").update(tarball).digest()).toString("hex");
+
+  await writeFile(
+    join(packagesDir, name, "package.json"),
+    JSON.stringify(
+      {
+        _id: name,
+        name,
+        "dist-tags": { latest: version },
+        versions: {
+          [version]: {
+            name,
+            version,
+            _id: `${name}@${version}`,
+            ...manifest(name),
+            dist: { integrity, shasum, tarball: `http://localhost:4873/${name}/-/${tarballName}` },
+          },
+        },
+      },
+      null,
+      2,
+    ),
+  );
+}
+
+console.log("Created native binlink libc test packages");
diff --git a/test/cli/install/registry/packages/test-native-binlink-libc-glibc/package.json b/test/cli/install/registry/packages/test-native-binlink-libc-glibc/package.json
new file mode 100644
index 000000000000..7b4831d39286
--- /dev/null
+++ b/test/cli/install/registry/packages/test-native-binlink-libc-glibc/package.json
@@ -0,0 +1,31 @@
+{
+  "_id": "test-native-binlink-libc-glibc",
+  "name": "test-native-binlink-libc-glibc",
+  "dist-tags": {
+    "latest": "1.0.0"
+  },
+  "versions": {
+    "1.0.0": {
+      "name": "test-native-binlink-libc-glibc",
+      "version": "1.0.0",
+      "_id": "test-native-binlink-libc-glibc@1.0.0",
+      "os": [
+        "darwin",
+        "linux",
+        "win32"
+      ],
+      "cpu": [
+        "arm64",
+        "x64"
+      ],
+      "libc": [
+        "glibc"
+      ],
+      "dist": {
+        "integrity": "sha512-hlh/2LNlv9VxZ0+S3ankRAjEvZ6b72keHQEbvA+XflVRViL0LiCAq0+uEAUnKoNSuDt4tTrPeKlIJS2BBQwNeQ==",
+        "shasum": "e337ec4cf3cf9c675cac8490c642ead015a79931",
+        "tarball": "http://localhost:4873/test-native-binlink-libc-glibc/-/test-native-binlink-libc-glibc-1.0.0.tgz"
+      }
+    }
+  }
+}
\ No newline at end of file
diff --git a/test/cli/install/registry/packages/test-native-binlink-libc-glibc/test-native-binlink-libc-glibc-1.0.0.tgz b/test/cli/install/registry/packages/test-native-binlink-libc-glibc/test-native-binlink-libc-glibc-1.0.0.tgz
new file mode 100644
index 0000000000000000000000000000000000000000..51073719a48f2f44434f8abae3d97fd59a7873d6
GIT binary patch
literal 364
zcmV-y0h9h8iwFP!000001MSnzPQpMC2XM}PinU%av8AP72_A`0KsXr>OW8ClWw+_J
zNMd|<r-h;+Dly?J@&7xp(_xlf7^dLqf@fmTJ0XuGQPi$vf8E4E6nnlO$6iSJBnZ78
zi%xl|PHie)GIoxmu2He=|4gcr{RjTsf1e`s|17@tf61kCU(C_ZXc`=c;g9|I!(gxf
zevnZAy`$gc8~?ojw>N{@lx_QkS}~>P!b-I=Iu~xPv%Wo<j>nIa$%svjR2i#;sT{>C
zxe^X-%B5O3xtyg=*1Xzx4^~m?R2bumwXFIcB`*CH;TPTfZ&w<Bt&V-hq4^&s@&5eB
zL4f%`hc}BcTk)l^N6bDj-1klGN|Z)w)s*|L=X#s0Hk5dxh~hafU!`jE^h6(0ue%4z
z2Sc0U=XO_G)SugUxs1cEa82Q^tUY{Jx4BF6ruBa5Uk?BP00000000000002sdVByJ
Kx`%QAC;$LsrL;5v

literal 0
HcmV?d00001

diff --git a/test/cli/install/registry/packages/test-native-binlink-libc-musl/package.json b/test/cli/install/registry/packages/test-native-binlink-libc-musl/package.json
new file mode 100644
index 000000000000..d33574f98adc
--- /dev/null
+++ b/test/cli/install/registry/packages/test-native-binlink-libc-musl/package.json
@@ -0,0 +1,31 @@
+{
+  "_id": "test-native-binlink-libc-musl",
+  "name": "test-native-binlink-libc-musl",
+  "dist-tags": {
+    "latest": "1.0.0"
+  },
+  "versions": {
+    "1.0.0": {
+      "name": "test-native-binlink-libc-musl",
+      "version": "1.0.0",
+      "_id": "test-native-binlink-libc-musl@1.0.0",
+      "os": [
+        "darwin",
+        "linux",
+        "win32"
+      ],
+      "cpu": [
+        "arm64",
+        "x64"
+      ],
+      "libc": [
+        "musl"
+      ],
+      "dist": {
+        "integrity": "sha512-yx0izt+2IW0gLczi5/jpu5DSzbpUYmz8GP75Lq+WzL8cYiJPY77s8ySTxhAXLK6ofayFvnKpHa34zpdwsc9n2Q==",
+        "shasum": "829db1d74b0f1addb48a0e772a6f6bda58b82088",
+        "tarball": "http://localhost:4873/test-native-binlink-libc-musl/-/test-native-binlink-libc-musl-1.0.0.tgz"
+      }
+    }
+  }
+}
\ No newline at end of file
diff --git a/test/cli/install/registry/packages/test-native-binlink-libc-musl/test-native-binlink-libc-musl-1.0.0.tgz b/test/cli/install/registry/packages/test-native-binlink-libc-musl/test-native-binlink-libc-musl-1.0.0.tgz
new file mode 100644
index 0000000000000000000000000000000000000000..b233fc27a8c1386f33be2878f4d24889354a81c3
GIT binary patch
literal 364
zcmV-y0h9h8iwFP!000001MSn@PQox02XL<U6m{NU;zrB961*fn0pZGcQAR^5Tf3|q
zk{I9JZZI)KF(!N^{(m<;JDjeC!zp;W<O?zAoe;H>C~8-0f8E4E6jR3Hn1(i=1R?E_
z=#-c0)TZJkA?G;i8Wr3A&!jrpf8fvkXEs9r&*E$Ub1s$tVvc@B)8IG^f9yXChkN~J
zL7emmJ^D?)@z48zdo!p_*|uM(6;XOFoK!2LGvQ}?(RU})@%V8v8Ih@xYC$StDo^oB
zu7qbdWl}A@OwLj-uTAFOJvc?FQ(=rR*0SnTo4E8hghRUd->!E2wL110zs>(J3HRqe
z4jAVD9Nrv4T*Y(Yj);4BxbK_Nl_-tWs;Oo^_30+7jZHk+$i{PCzDm{R?UQ{+z3v`t
zJ{Y<-er|WAMZMd`%RCOd!nF-Q%bFYP>e{O`pE>WB{_Ow&000000000000000uE__Z
KTZ;++C;$LQhOr?4

literal 0
HcmV?d00001

diff --git a/test/cli/install/registry/packages/test-native-binlink-libc/package.json b/test/cli/install/registry/packages/test-native-binlink-libc/package.json
new file mode 100644
index 000000000000..c09a9568a8ae
--- /dev/null
+++ b/test/cli/install/registry/packages/test-native-binlink-libc/package.json
@@ -0,0 +1,26 @@
+{
+  "_id": "test-native-binlink-libc",
+  "name": "test-native-binlink-libc",
+  "dist-tags": {
+    "latest": "1.0.0"
+  },
+  "versions": {
+    "1.0.0": {
+      "name": "test-native-binlink-libc",
+      "version": "1.0.0",
+      "_id": "test-native-binlink-libc@1.0.0",
+      "bin": {
+        "test-binlink-libc-cmd": "./bin/main.js"
+      },
+      "optionalDependencies": {
+        "test-native-binlink-libc-glibc": "1.0.0",
+        "test-native-binlink-libc-musl": "1.0.0"
+      },
+      "dist": {
+        "integrity": "sha512-gZdG6U7lOomGKsqk9escUo8RFvlWeGxOkLmbUcE+Zr8UNn7l8OVaRTYA9g3EQl98T35O4BKdigNVKRC7ADg3IQ==",
+        "shasum": "c7cadbcbc1c8d0c32ff655d304e437f8ad07a1f4",
+        "tarball": "http://localhost:4873/test-native-binlink-libc/-/test-native-binlink-libc-1.0.0.tgz"
+      }
+    }
+  }
+}
\ No newline at end of file
diff --git a/test/cli/install/registry/packages/test-native-binlink-libc/test-native-binlink-libc-1.0.0.tgz b/test/cli/install/registry/packages/test-native-binlink-libc/test-native-binlink-libc-1.0.0.tgz
new file mode 100644
index 0000000000000000000000000000000000000000..2298791898abb2a097504609ae24d32a343b0c0b
GIT binary patch
literal 391
zcmV;20eJo&iwFP!000001MSscYr-%P0C1oCDbDW2fvwH@58UhaJP`H)YQ1%tZBm*j
zgW-2yQkA*lHU?D(yWdMnxFlyUSL-ZaW(7_LClnZI9Jiy<9k<V6oCJ&|Nf4R&G>n1)
z#HUPZZ>4nB0G#8fzo_2Tf6m3p?!d3>&&(6m|11vcUu9hQFRJ%5Y=M&~`m+8kPCNBy
zVHyu0=slAo{(1echLe?Q+VZ1VgOCe!aw(K7(Jy5&a_?uehuIV!6&D5A8v?s417^+G
zEYP5z5lTMKJym1QpLh;Z;LyFkb?QdusFaVdT#uNUxb)8@9sB;@ji&vj==+SH`aev&
z-+z|eB-H=s@a6!xBCF7yf~!$!Ph^^}(KFp$a<TMmW4mJ;wZ=wqDQqC~13%c#nm99K
zw}IUThbz6jTG$2t;UA1^f;a7AS!=UnR^DNaVu2#(s5-kHNyjVNq(0^GU3j%p<wvwV
l+}T|Ey%RzRA%qY@2qA<JLI@#*5JE`b-T{?sT}1#W002MezkdJ#

literal 0
HcmV?d00001


From 74e4d9119065162c0ba2954abae7dd88cf69aab5 Mon Sep 17 00:00:00 2001
From: robobun <117481402+robobun@users.noreply.github.com>
Date: Mon, 17 Aug 2026 03:11:40 +0000
Subject: [PATCH 171/258] test(install): speed up bun-install.test.ts and
 tighten its assertions (#38464)

---
 .../__snapshots__/bun-install.test.ts.snap    |   71 -
 test/cli/install/bun-install.test.ts          | 1658 ++++++-----------
 test/cli/install/wyhash-std-collision.ts      |   67 +-
 3 files changed, 664 insertions(+), 1132 deletions(-)
 delete mode 100644 test/cli/install/__snapshots__/bun-install.test.ts.snap

diff --git a/test/cli/install/__snapshots__/bun-install.test.ts.snap b/test/cli/install/__snapshots__/bun-install.test.ts.snap
deleted file mode 100644
index a0e509edac2b..000000000000
--- a/test/cli/install/__snapshots__/bun-install.test.ts.snap
+++ /dev/null
@@ -1,71 +0,0 @@
-// Bun Snapshot v1, https://bun.sh/docs/test/snapshots
-
-exports[`should report error on invalid format for package.json 1`] = `
-"1 | foo
-    ^
-error: Unexpected foo
-    at [dir]/package.json:1:1
-ParserError: failed to parse '[dir]/package.json'
-"
-`;
-
-exports[`should report error on invalid format for dependencies 1`] = `
-"1 | {"name":"foo","version":"0.0.1","dependencies":[]}
-                                    ^
-error: dependencies expects a map of specifiers, e.g.
-  "dependencies": {
-    <green>"bun"<r>: <green>"latest"<r>
-  }
-    at [dir]/package.json:1:33
-"
-`;
-
-exports[`should report error on invalid format for workspaces 1`] = `
-"1 | {"name":"foo","version":"0.0.1","workspaces":{"packages":{"bar":true}}}
-                                                             ^
-error: "workspaces.packages" expects an array of strings, e.g.
-  "workspaces": {
-    "packages": [
-      "path/to/package"
-    ]
-  }
-    at [dir]/package.json:1:58
-"
-`;
-
-exports[`should handle modified git resolutions in bun.lock 1`] = `"{"lockfileVersion":0,"configVersion":1,"workspaces":{"":{"dependencies":{"jquery":"3.7.1"}}},"packages":{"jquery":["jquery@git+ssh://git@github.com/dylan-conway/install-test-8.git#3a1288830817d13da39e9231302261896f8721ea",{},"3a1288830817d13da39e9231302261896f8721ea"]}}"`;
-
-exports[`bun-install should report error on invalid format for package.json 1`] = `
-"1 | foo
-    ^
-error: Unexpected foo
-    at [dir]/package.json:1:1
-ParserError: failed to parse '[dir]/package.json'
-"
-`;
-
-exports[`bun-install should report error on invalid format for dependencies 1`] = `
-"1 | {"name":"foo","version":"0.0.1","dependencies":[]}
-                                    ^
-error: dependencies expects a map of specifiers, e.g.
-  "dependencies": {
-    <green>"bun"<r>: <green>"latest"<r>
-  }
-    at [dir]/package.json:1:33
-"
-`;
-
-exports[`bun-install should report error on invalid format for workspaces 1`] = `
-"1 | {"name":"foo","version":"0.0.1","workspaces":{"packages":{"bar":true}}}
-                                                             ^
-error: "workspaces.packages" expects an array of strings, e.g.
-  "workspaces": {
-    "packages": [
-      "path/to/package"
-    ]
-  }
-    at [dir]/package.json:1:58
-"
-`;
-
-exports[`bun-install should handle modified git resolutions in bun.lock 1`] = `"{"lockfileVersion":0,"configVersion":1,"workspaces":{"":{"dependencies":{"jquery":"3.7.1"}}},"packages":{"jquery":["jquery@git+ssh://git@github.com/dylan-conway/install-test-8.git#3a1288830817d13da39e9231302261896f8721ea",{},"3a1288830817d13da39e9231302261896f8721ea"]}}"`;
diff --git a/test/cli/install/bun-install.test.ts b/test/cli/install/bun-install.test.ts
index 0940ffabcd16..060a95f2ed6a 100644
--- a/test/cli/install/bun-install.test.ts
+++ b/test/cli/install/bun-install.test.ts
@@ -1,7 +1,7 @@
 import { file, listen, Socket, spawn, write } from "bun";
 import { afterAll, beforeAll, describe, expect, it, jest, setDefaultTimeout, test } from "bun:test";
 import { readFileSync, readlinkSync, realpathSync, statSync } from "fs";
-import { access, chmod, cp, exists, mkdir, readlink, rm, stat, writeFile } from "fs/promises";
+import { access, chmod, cp, exists, mkdir, readlink, rename, rm, stat, writeFile } from "fs/promises";
 import {
   bunEnv,
   bunExe,
@@ -21,7 +21,7 @@ import {
   toBeWorkspaceLink,
   toHaveBins,
 } from "harness";
-import { join, resolve, sep } from "path";
+import { join, relative, resolve, sep } from "path";
 import {
   createTestContext,
   destroyTestContext,
@@ -156,7 +156,11 @@ async function git(cwd: string, args: string[], stdin?: string): Promise<string>
   return stdout.trim();
 }
 
-async function createDumbHttpGitRepo(dir: string, symlinks: Record<string, string>): Promise<string> {
+async function createDumbHttpGitRepo(
+  dir: string,
+  symlinks: Record<string, string>,
+  tags: string[] = [],
+): Promise<string> {
   const work = join(dir, "work");
   await git(work, ["-c", "init.defaultBranch=main", "init", "--quiet"]);
   await git(work, ["add", "-A"]);
@@ -165,12 +169,77 @@ async function createDumbHttpGitRepo(dir: string, symlinks: Record<string, strin
     await git(work, ["update-index", "--add", "--cacheinfo", `120000,${oid},${path}`]);
   }
   await git(work, ["-c", "commit.gpgsign=false", "commit", "--quiet", "-m", "init"]);
+  for (const tag of tags) {
+    await git(work, ["tag", tag]);
+  }
   const sha = await git(work, ["rev-parse", "HEAD"]);
   await git(dir, ["clone", "--quiet", "--bare", "work", "repo.git"]);
   await git(join(dir, "repo.git"), ["update-server-info"]);
   return sha;
 }
 
+/**
+ * The bare clone of a git dependency is kept in the cache under a name derived from its clone task id, whose top bits
+ * make the name start with 8 or 9, so it always sorts before the `@G@<sha>` checkout folders listed next to it.
+ */
+const gitMirrorFolder = expect.stringMatching(/^[89][0-9a-f]{15}\.git$/);
+
+/**
+ * A package in a git repository served over dumb HTTP, standing in for a real hosted repository: its single commit is
+ * tagged `v1.0.0`, and it has a bin plus whatever else `package_json` adds. Cloning a real repository for the cases
+ * using this took 4-12s per case on CI (five cases cloned the same 20MB repository concurrently); this takes well
+ * under a second.
+ */
+async function serveTaggedGitPackage(package_json: Record<string, unknown> = {}) {
+  const dir = tempDir("git-dep-tagged", {
+    "work/package.json": JSON.stringify({
+      name: "tagged",
+      version: "1.0.0",
+      bin: { tagged: "bin/tagged.js" },
+      ...package_json,
+    }),
+    "work/bin/tagged.js": "#!/usr/bin/env node\nconsole.log('tagged');\n",
+  });
+  const sha = await createDumbHttpGitRepo(String(dir), {}, ["v1.0.0"]);
+  const server = serveDirectory(String(dir));
+  return {
+    /** The dependency specifier for the repository, without a committish. */
+    url: `git+http://localhost:${server.port}/repo.git`,
+    sha,
+    /** What a checkout of it contains. */
+    files: [".bun-tag", "bin", "package.json"],
+    [Symbol.dispose]() {
+      server.stop(true);
+      dir[Symbol.dispose]();
+    },
+  };
+}
+
+/**
+ * An HTTP proxy that records every request (plain requests and CONNECT tunnels alike) and refuses all of them with a
+ * 404. Spawning an install with the returned `env` routes its traffic, and git's, through the proxy, so a case whose
+ * point is an unreachable or made-up host still builds and sends its request but never resolves the host name: a
+ * single-label host name such as `example` takes ~45s per `bun install` to fail on the Debian CI images (and ~14s on
+ * Windows), where the resolver walks the search domains for it, against a few milliseconds here.
+ */
+function refusingProxy() {
+  const requests: string[] = [];
+  const server = Bun.serve({
+    port: 0,
+    hostname: "127.0.0.1",
+    fetch(request) {
+      requests.push(`${request.method} ${request.url}`);
+      return new Response(null, { status: 404 });
+    },
+  });
+  const url = `http://127.0.0.1:${server.port}`;
+  return {
+    requests,
+    env: { ...env, http_proxy: url, HTTP_PROXY: url, https_proxy: url, HTTPS_PROXY: url, no_proxy: "", NO_PROXY: "" },
+    [Symbol.dispose]: () => server.stop(true),
+  };
+}
+
 function serveDirectory(root: string) {
   return Bun.serve({
     port: 0,
@@ -579,154 +648,135 @@ describe.concurrent("bun-install", () => {
     });
   });
 
-  it("should work when moving workspace packages", async () => {
-    await using package_dir = tempDir("lol", {
-      "package.json": JSON.stringify({
-        "name": "my-workspace",
-        private: "true",
-        version: "0.0.1",
-        "devDependencies": {
-          "@repo/ui": "*",
-          "@repo/eslint-config": "*",
-          "@repo/typescript-config": "*",
-        },
-        workspaces: ["packages/*"],
-      }),
-      packages: {
-        "eslint-config": {
-          "package.json": JSON.stringify({
-            name: "@repo/eslint-config",
-            "version": "0.0.0",
-            private: "true",
-          }),
-        },
-        "typescript-config": {
-          "package.json": JSON.stringify({
-            "name": "@repo/typescript-config",
-            "version": "0.0.0",
-            private: "true",
-          }),
-        },
-        "ui": {
-          "package.json": JSON.stringify({
-            name: "@repo/ui",
-            version: "0.0.0",
-            private: "true",
-            devDependencies: {
-              "@repo/eslint-config": "*",
-              "@repo/typescript-config": "*",
-            },
-          }),
-        },
-      },
-    });
+  // The two tests below install the same workspace twice, changing it in between. The second install used to fail to
+  // find the workspace packages because the paths recorded in the lockfile were kept instead of the freshly parsed
+  // ones (https://github.com/oven-sh/bun/issues/10833). Every dependency is a workspace, so no registry is involved.
+  const repoRoot = {
+    name: "my-workspace",
+    private: true,
+    version: "0.0.1",
+    devDependencies: { "@repo/ui": "*", "@repo/eslint-config": "*", "@repo/typescript-config": "*" },
+    workspaces: ["packages/*"],
+  };
+  const repoUi = {
+    name: "@repo/ui",
+    version: "0.0.0",
+    private: true,
+    devDependencies: { "@repo/eslint-config": "*", "@repo/typescript-config": "*" },
+  };
+  const repoWorkspace = {
+    "package.json": JSON.stringify(repoRoot),
+    "packages/eslint-config/package.json": JSON.stringify({
+      name: "@repo/eslint-config",
+      version: "0.0.0",
+      private: true,
+    }),
+    "packages/typescript-config/package.json": JSON.stringify({
+      name: "@repo/typescript-config",
+      version: "0.0.0",
+      private: true,
+    }),
+    "packages/ui/package.json": JSON.stringify(repoUi),
+  };
 
-    await Bun.$`${bunExe()} i`.env(bunEnv).cwd(package_dir);
+  async function installRepoWorkspace(package_dir: string) {
+    await using proc = spawn({
+      cmd: [bunExe(), "install"],
+      cwd: package_dir,
+      stdout: "pipe",
+      stdin: "ignore",
+      stderr: "pipe",
+      env,
+    });
+    const [out, err, exitCode] = await Promise.all([proc.stdout.text(), proc.stderr.text(), proc.exited]);
+    expect(err).toContain("Saved lockfile");
+    expect(err).not.toContain("error:");
+    expect(out).toContain("bun install v1.");
+    expect(exitCode).toBe(0);
+    return file(join(package_dir, "bun.lock")).text();
+  }
 
-    await Bun.$ /* sh */ `
-  mkdir config
+  // Where the links in node_modules/@repo point, relative to the project, whatever kind of link the linker made
+  // (relative symlinks here, junctions or symlinks on Windows depending on the linker).
+  async function repoLinks(package_dir: string) {
+    const root = realpathSync(package_dir);
+    const links: Record<string, string> = {};
+    for (const name of await readdirSorted(join(package_dir, "node_modules", "@repo"))) {
+      const target = realpathSync(join(package_dir, "node_modules", "@repo", name));
+      links[`@repo/${name}`] = relative(root, target).replaceAll(sep, "/");
+    }
+    return links;
+  }
 
-  # change workspaces from "packages/*" to "config/*"
-  echo ${JSON.stringify({
-    "name": "my-workspace",
-    version: "0.0.1",
-    workspaces: ["config/*"],
-    "devDependencies": {
-      "@repo/ui": "*",
-      "@repo/eslint-config": "*",
-      "@repo/typescript-config": "*",
-    },
-  })} > package.json
+  it("should work when moving workspace packages", async () => {
+    using dir = tempDir("workspace-move", repoWorkspace);
+    const package_dir = String(dir);
 
-  mv packages/typescript-config config/
-  mv packages/eslint-config config/
-  mv packages/ui config/
+    expect(await installRepoWorkspace(package_dir)).toContain('"@repo/ui@workspace:packages/ui"');
+    expect(await repoLinks(package_dir)).toEqual({
+      "@repo/eslint-config": "packages/eslint-config",
+      "@repo/typescript-config": "packages/typescript-config",
+      "@repo/ui": "packages/ui",
+    });
 
-  rm -rf packages
-  rm -rf apps
-  `
-      .env(bunEnv)
-      .cwd(package_dir);
+    // Move every package to config/ and point the workspaces glob there.
+    await rename(join(package_dir, "packages"), join(package_dir, "config"));
+    await writeFile(join(package_dir, "package.json"), JSON.stringify({ ...repoRoot, workspaces: ["config/*"] }));
 
-    await Bun.$`${bunExe()} i`.env(bunEnv).cwd(package_dir);
+    const lockfile = await installRepoWorkspace(package_dir);
+    for (const name of ["eslint-config", "typescript-config", "ui"]) {
+      expect(lockfile).toContain(`"@repo/${name}@workspace:config/${name}"`);
+    }
+    expect(lockfile).not.toContain("packages/");
+    expect(await repoLinks(package_dir)).toEqual({
+      "@repo/eslint-config": "config/eslint-config",
+      "@repo/typescript-config": "config/typescript-config",
+      "@repo/ui": "config/ui",
+    });
   });
 
   it("should work when renaming a single workspace package", async () => {
-    await using package_dir = tempDir("lol", {
-      "package.json": JSON.stringify({
-        "name": "my-workspace",
-        private: "true",
-        version: "0.0.1",
-        "devDependencies": {
-          "@repo/ui": "*",
-          "@repo/eslint-config": "*",
-          "@repo/typescript-config": "*",
-        },
-        workspaces: ["packages/*"],
-      }),
-      packages: {
-        "eslint-config": {
-          "package.json": JSON.stringify({
-            name: "@repo/eslint-config",
-            "version": "0.0.0",
-            private: "true",
-          }),
-        },
-        "typescript-config": {
-          "package.json": JSON.stringify({
-            "name": "@repo/typescript-config",
-            "version": "0.0.0",
-            private: "true",
-          }),
-        },
-        "ui": {
-          "package.json": JSON.stringify({
-            name: "@repo/ui",
-            version: "0.0.0",
-            private: "true",
-            devDependencies: {
-              "@repo/eslint-config": "*",
-              "@repo/typescript-config": "*",
-            },
-          }),
-        },
-      },
-    });
-
-    await Bun.$`${bunExe()} i`.env(bunEnv).cwd(package_dir);
-
-    await Bun.$ /* sh */ `
-  echo ${JSON.stringify({
-    "name": "my-workspace",
-    version: "0.0.1",
-    workspaces: ["packages/*"],
-    "devDependencies": {
-      "@repo/ui": "*",
-      "@repo/eslint-config-lol": "*",
-      "@repo/typescript-config": "*",
-    },
-  })} > package.json
+    using dir = tempDir("workspace-rename", repoWorkspace);
+    const package_dir = String(dir);
 
-  echo ${JSON.stringify({
-    name: "@repo/eslint-config-lol",
-    "version": "0.0.0",
-    private: "true",
-  })} > packages/eslint-config/package.json
+    expect(await installRepoWorkspace(package_dir)).toContain('"@repo/eslint-config@workspace:packages/eslint-config"');
+    expect(await repoLinks(package_dir)).toEqual({
+      "@repo/eslint-config": "packages/eslint-config",
+      "@repo/typescript-config": "packages/typescript-config",
+      "@repo/ui": "packages/ui",
+    });
 
-  echo ${JSON.stringify({
-    name: "@repo/ui",
-    version: "0.0.0",
-    private: "true",
-    devDependencies: {
-      "@repo/eslint-config-lol": "*",
-      "@repo/typescript-config": "*",
-    },
-  })} > packages/ui/package.json
-  `
-      .env(bunEnv)
-      .cwd(package_dir);
+    // Rename @repo/eslint-config to @repo/eslint-config-lol in place, in the package itself and in both dependents.
+    await Promise.all([
+      writeFile(
+        join(package_dir, "package.json"),
+        JSON.stringify({
+          ...repoRoot,
+          devDependencies: { "@repo/ui": "*", "@repo/eslint-config-lol": "*", "@repo/typescript-config": "*" },
+        }),
+      ),
+      writeFile(
+        join(package_dir, "packages", "eslint-config", "package.json"),
+        JSON.stringify({ name: "@repo/eslint-config-lol", version: "0.0.0", private: true }),
+      ),
+      writeFile(
+        join(package_dir, "packages", "ui", "package.json"),
+        JSON.stringify({
+          ...repoUi,
+          devDependencies: { "@repo/eslint-config-lol": "*", "@repo/typescript-config": "*" },
+        }),
+      ),
+    ]);
 
-    await Bun.$`${bunExe()} i`.env(bunEnv).cwd(package_dir);
+    const lockfile = await installRepoWorkspace(package_dir);
+    expect(lockfile).toContain('"@repo/eslint-config-lol@workspace:packages/eslint-config"');
+    expect(lockfile).not.toContain('"@repo/eslint-config@workspace:');
+    // toMatchObject: the link for the old name is currently left behind, which is not what this test is about.
+    expect(await repoLinks(package_dir)).toMatchObject({
+      "@repo/eslint-config-lol": "packages/eslint-config",
+      "@repo/typescript-config": "packages/typescript-config",
+      "@repo/ui": "packages/ui",
+    });
   });
 
   it("should handle missing package", async () => {
@@ -5697,7 +5747,7 @@ describe.concurrent("bun-install", () => {
     });
   });
 
-  test.serial("should report error on invalid format for package.json", async () => {
+  it("should report error on invalid format for package.json", async () => {
     await withContext(defaultOpts, async ctx => {
       await writeFile(join(ctx.package_dir, "package.json"), "foo");
       const { stdout, stderr, exited } = spawn({
@@ -5709,9 +5759,17 @@ describe.concurrent("bun-install", () => {
         env,
       });
       const err = await stderr.text();
-      expect(
-        err.replaceAll(joinP(ctx.package_dir + sep), "[dir]/").replaceAll(ctx.package_dir + sep, "[dir]/"),
-      ).toMatchSnapshot();
+      const normalized = err
+        .replaceAll(joinP(ctx.package_dir + sep), "[dir]/")
+        .replaceAll(ctx.package_dir + sep, "[dir]/");
+      expect(normalized).toMatchInlineSnapshot(`
+        "1 | foo
+            ^
+        error: Unexpected foo
+            at [dir]/package.json:1:1
+        ParserError: failed to parse '[dir]/package.json'
+        "
+      `);
       const out = await stdout.text();
       expect(out).toEqual(expect.stringContaining("bun install v1."));
       expect(await exited).toBe(1);
@@ -5791,7 +5849,7 @@ describe.concurrent("bun-install", () => {
     }
   });
 
-  test.serial("should report error on invalid format for dependencies", async () => {
+  it("should report error on invalid format for dependencies", async () => {
     await withContext(defaultOpts, async ctx => {
       await writeFile(
         join(ctx.package_dir, "package.json"),
@@ -5810,7 +5868,16 @@ describe.concurrent("bun-install", () => {
         env,
       });
       const err = await stderr.text();
-      expect(err.replaceAll(joinP(ctx.package_dir + sep), "[dir]/")).toMatchSnapshot();
+      expect(err.replaceAll(joinP(ctx.package_dir + sep), "[dir]/")).toMatchInlineSnapshot(`
+        "1 | {"name":"foo","version":"0.0.1","dependencies":[]}
+                                            ^
+        error: dependencies expects a map of specifiers, e.g.
+          "dependencies": {
+            <green>"bun"<r>: <green>"latest"<r>
+          }
+            at [dir]/package.json:1:33
+        "
+      `);
       const out = await stdout.text();
       expect(out).toEqual(expect.stringContaining("bun install v1."));
       expect(await exited).toBe(1);
@@ -5854,7 +5921,7 @@ describe.concurrent("bun-install", () => {
     });
   });
 
-  test.serial("should report error on invalid format for workspaces", async () => {
+  it("should report error on invalid format for workspaces", async () => {
     await withContext(defaultOpts, async ctx => {
       await writeFile(
         join(ctx.package_dir, "package.json"),
@@ -5875,7 +5942,18 @@ describe.concurrent("bun-install", () => {
         env,
       });
       const err = await stderr.text();
-      expect(err.replaceAll(joinP(ctx.package_dir + sep), "[dir]/")).toMatchSnapshot();
+      expect(err.replaceAll(joinP(ctx.package_dir + sep), "[dir]/")).toMatchInlineSnapshot(`
+        "1 | {"name":"foo","version":"0.0.1","workspaces":{"packages":{"bar":true}}}
+                                                                     ^
+        error: "workspaces.packages" expects an array of strings, e.g.
+          "workspaces": {
+            "packages": [
+              "path/to/package"
+            ]
+          }
+            at [dir]/package.json:1:58
+        "
+      `);
       const out = await stdout.text();
       expect(out).toEqual(expect.stringContaining("bun install v1."));
       expect(await exited).toBe(1);
@@ -5936,6 +6014,42 @@ describe.concurrent("bun-install", () => {
     });
   });
 
+  // The two cases below clone dylan-conway/install-test2 from GitHub: a one-commit repository holding an index.js and
+  // a package.json with no dependencies (the file's other git cases use repositories served from the test itself;
+  // these two keep covering the real URL forms end to end). `printed` is how bun echoes the specifier back.
+  async function expectInstallTest2Installed(ctx: TestContext, out: string, printed: string) {
+    const lines = out.replace(/\s*\[[0-9\.]+m?s\]\s*$/, "").split(/\r?\n/);
+    expect(lines).toEqual([
+      expect.stringContaining("bun install v1."),
+      "",
+      expect.stringContaining(`+ install-test2@${printed}#`),
+      "",
+      "1 package installed",
+    ]);
+    // No committish was given, so the commit that was checked out is whatever HEAD was; it is reported in the
+    // summary and has to be the one tagged in the checkout and in the cache.
+    const sha = lines[2].slice(lines[2].indexOf("#") + 1);
+    expect(sha).toMatch(/^[0-9a-f]{40}$/);
+    expect(ctx.requested).toBe(0);
+    expect(await readdirSorted(join(ctx.package_dir, "node_modules"))).toEqual([".cache", "install-test2"]);
+    expect(await readdirSorted(join(ctx.package_dir, "node_modules", ".cache"))).toEqual([
+      gitMirrorFolder,
+      `@G@${sha}`,
+    ]);
+    expect(await readdirSorted(join(ctx.package_dir, "node_modules", "install-test2"))).toEqual([
+      ".bun-tag",
+      "index.js",
+      "package.json",
+    ]);
+    expect(await file(join(ctx.package_dir, "node_modules", "install-test2", ".bun-tag")).text()).toBe(sha);
+    expect(await file(join(ctx.package_dir, "node_modules", "install-test2", "package.json")).json()).toEqual({
+      name: "install-test2",
+      version: "0.2.0",
+      main: "index.js",
+    });
+    await access(join(ctx.package_dir, "bun.lockb"));
+  }
+
   it("should handle Git URL in dependencies", async () => {
     await withContext(defaultOpts, async ctx => {
       const urls: string[] = [];
@@ -5946,7 +6060,7 @@ describe.concurrent("bun-install", () => {
           name: "Foo",
           version: "0.0.1",
           dependencies: {
-            "uglify-js": "git+https://git@github.com/mishoo/UglifyJS.git",
+            "install-test2": "git+https://git@github.com/dylan-conway/install-test2.git",
           },
         }),
       );
@@ -5960,42 +6074,10 @@ describe.concurrent("bun-install", () => {
       });
       const err = await stderr.text();
       expect(err).toContain("Saved lockfile");
-      let out = await stdout.text();
-      out = out.replace(/\s*\[[0-9\.]+m?s\]\s*$/, "");
-      out = out.replace(/(\.git)#[a-f0-9]+/, "$1");
-      expect(out.replace(/\s*\[[0-9\.]+m?s\]\s*$/, "").split(/\r?\n/)).toEqual([
-        expect.stringContaining("bun install v1."),
-        "",
-        "+ uglify-js@git+https://git@github.com/mishoo/UglifyJS.git",
-        "",
-        "1 package installed",
-      ]);
+      const out = await stdout.text();
       expect(await exited).toBe(0);
-      expect(urls.sort()).toBeEmpty();
-      expect(ctx.requested).toBe(0);
-      expect(await readdirSorted(join(ctx.package_dir, "node_modules"))).toEqual([".bin", ".cache", "uglify-js"]);
-      expect(await readdirSorted(join(ctx.package_dir, "node_modules", ".bin"))).toHaveBins(["uglifyjs"]);
-      expect(join(ctx.package_dir, "node_modules", ".bin", "uglifyjs")).toBeValidBin(
-        join("..", "uglify-js", "bin", "uglifyjs"),
-      );
-      expect((await readdirSorted(join(ctx.package_dir, "node_modules", ".cache")))[0]).toBe("9694c5fe9c41ad51.git");
-      expect(await readdirSorted(join(ctx.package_dir, "node_modules", "uglify-js"))).toEqual([
-        ".bun-tag",
-        ".gitattributes",
-        ".github",
-        ".gitignore",
-        "CONTRIBUTING.md",
-        "LICENSE",
-        "README.md",
-        "bin",
-        "lib",
-        "package.json",
-        "test",
-        "tools",
-      ]);
-      const package_json = await file(join(ctx.package_dir, "node_modules", "uglify-js", "package.json")).json();
-      expect(package_json.name).toBe("uglify-js");
-      await access(join(ctx.package_dir, "bun.lockb"));
+      expect(urls).toBeEmpty();
+      await expectInstallTest2Installed(ctx, out, "git+https://git@github.com/dylan-conway/install-test2.git");
     });
   });
 
@@ -6009,7 +6091,7 @@ describe.concurrent("bun-install", () => {
           name: "foo",
           version: "0.0.1",
           dependencies: {
-            uglify: "github.com:mishoo/UglifyJS.git",
+            "install-test2": "github.com:dylan-conway/install-test2.git",
           },
         }),
       );
@@ -6023,42 +6105,10 @@ describe.concurrent("bun-install", () => {
       });
       const err = await stderr.text();
       expect(err).toContain("Saved lockfile");
-      let out = await stdout.text();
-      out = out.replace(/\s*\[[0-9\.]+m?s\]\s*$/, "");
-      out = out.replace(/(\.git)#[a-f0-9]+/, "$1");
-      expect(out.replace(/\s*\[[0-9\.]+m?s\]\s*$/, "").split(/\r?\n/)).toEqual([
-        expect.stringContaining("bun install v1."),
-        "",
-        "+ uglify@git+ssh://github.com:mishoo/UglifyJS.git",
-        "",
-        "1 package installed",
-      ]);
+      const out = await stdout.text();
       expect(await exited).toBe(0);
-      expect(urls.sort()).toBeEmpty();
-      expect(ctx.requested).toBe(0);
-      expect(await readdirSorted(join(ctx.package_dir, "node_modules"))).toEqual([".bin", ".cache", "uglify"]);
-      expect(await readdirSorted(join(ctx.package_dir, "node_modules", ".bin"))).toHaveBins(["uglifyjs"]);
-      expect(join(ctx.package_dir, "node_modules", ".bin", "uglifyjs")).toBeValidBin(
-        join("..", "uglify", "bin", "uglifyjs"),
-      );
-      expect((await readdirSorted(join(ctx.package_dir, "node_modules", ".cache")))[0]).toBe("87d55589eb4217d2.git");
-      expect(await readdirSorted(join(ctx.package_dir, "node_modules", "uglify"))).toEqual([
-        ".bun-tag",
-        ".gitattributes",
-        ".github",
-        ".gitignore",
-        "CONTRIBUTING.md",
-        "LICENSE",
-        "README.md",
-        "bin",
-        "lib",
-        "package.json",
-        "test",
-        "tools",
-      ]);
-      const package_json = await file(join(ctx.package_dir, "node_modules", "uglify", "package.json")).json();
-      expect(package_json.name).toBe("uglify-js");
-      await access(join(ctx.package_dir, "bun.lockb"));
+      expect(urls).toBeEmpty();
+      await expectInstallTest2Installed(ctx, out, "git+ssh://github.com:dylan-conway/install-test2.git");
     });
   });
 
@@ -6066,13 +6116,14 @@ describe.concurrent("bun-install", () => {
     await withContext(defaultOpts, async ctx => {
       const urls: string[] = [];
       setContextHandler(ctx, dummyRegistryForContext(ctx, urls));
+      using repo = await serveTaggedGitPackage();
       await writeFile(
         join(ctx.package_dir, "package.json"),
         JSON.stringify({
           name: "Foo",
           version: "0.0.1",
           dependencies: {
-            uglify: "git+https://git@github.com/mishoo/UglifyJS.git#v3.14.1",
+            uglify: `${repo.url}#v1.0.0`,
           },
         }),
       );
@@ -6087,10 +6138,11 @@ describe.concurrent("bun-install", () => {
       const err = await stderr.text();
       expect(err).toContain("Saved lockfile");
       const out = await stdout.text();
+      // The tag is resolved to the commit it points at.
       expect(out.replace(/\s*\[[0-9\.]+m?s\]\s*$/, "").split(/\r?\n/)).toEqual([
         expect.stringContaining("bun install v1."),
         "",
-        "+ uglify@git+https://git@github.com/mishoo/UglifyJS.git#e219a9a78a0d2251e4dcbd4bb9034207eb484fe8",
+        `+ uglify@${repo.url}#${repo.sha}`,
         "",
         "1 package installed",
       ]);
@@ -6098,31 +6150,21 @@ describe.concurrent("bun-install", () => {
       expect(urls.sort()).toBeEmpty();
       expect(ctx.requested).toBe(0);
       expect(await readdirSorted(join(ctx.package_dir, "node_modules"))).toEqual([".bin", ".cache", "uglify"]);
-      expect(await readdirSorted(join(ctx.package_dir, "node_modules", ".bin"))).toHaveBins(["uglifyjs"]);
-      expect(join(ctx.package_dir, "node_modules", ".bin", "uglifyjs")).toBeValidBin(
-        join("..", "uglify", "bin", "uglifyjs"),
+      expect(await readdirSorted(join(ctx.package_dir, "node_modules", ".bin"))).toHaveBins(["tagged"]);
+      expect(join(ctx.package_dir, "node_modules", ".bin", "tagged")).toBeValidBin(
+        join("..", "uglify", "bin", "tagged.js"),
       );
+      // The cache holds the bare clone (named after a hash of the URL) and the checkout of the resolved commit.
       expect(await readdirSorted(join(ctx.package_dir, "node_modules", ".cache"))).toEqual([
-        "9694c5fe9c41ad51.git",
-        "@G@e219a9a78a0d2251e4dcbd4bb9034207eb484fe8",
-      ]);
-      expect(await readdirSorted(join(ctx.package_dir, "node_modules", "uglify"))).toEqual([
-        ".bun-tag",
-        ".gitattributes",
-        ".github",
-        ".gitignore",
-        "CONTRIBUTING.md",
-        "LICENSE",
-        "README.md",
-        "bin",
-        "lib",
-        "package.json",
-        "test",
-        "tools",
+        gitMirrorFolder,
+        `@G@${repo.sha}`,
       ]);
-      const package_json = await file(join(ctx.package_dir, "node_modules", "uglify", "package.json")).json();
-      expect(package_json.name).toBe("uglify-js");
-      expect(package_json.version).toBe("3.14.1");
+      expect(await readdirSorted(join(ctx.package_dir, "node_modules", "uglify"))).toEqual(repo.files);
+      expect(await file(join(ctx.package_dir, "node_modules", "uglify", ".bun-tag")).text()).toBe(repo.sha);
+      expect(await file(join(ctx.package_dir, "node_modules", "uglify", "package.json")).json()).toMatchObject({
+        name: "tagged",
+        version: "1.0.0",
+      });
       await access(join(ctx.package_dir, "bun.lockb"));
     });
   });
@@ -6335,19 +6377,23 @@ describe.concurrent("bun-install", () => {
           },
         }),
       );
+      using proxy = refusingProxy();
       const { stdout, stderr, exited } = spawn({
         cmd: [bunExe(), "install"],
         cwd: ctx.package_dir,
         stdout: "pipe",
         stdin: "pipe",
         stderr: "pipe",
-        env,
+        env: proxy.env,
       });
       const err = await stderr.text();
       expect(err.split(/\r?\n/)).toContain("error: InstallFailed cloning repository for uglify");
       const out = await stdout.text();
       expect(out).toEqual(expect.stringContaining("bun install v1."));
       expect(await exited).toBe(1);
+      // The clone was attempted against the URL as written (this is git's ref discovery request) and given up on
+      // after it was refused.
+      expect(proxy.requests).toEqual(["GET http://bun.sh/no_such_repo/info/refs?service=git-upload-pack"]);
       expect(urls.sort()).toBeEmpty();
       expect(ctx.requested).toBe(0);
       try {
@@ -6401,13 +6447,14 @@ describe.concurrent("bun-install", () => {
     await withContext(defaultOpts, async ctx => {
       const urls: string[] = [];
       setContextHandler(ctx, dummyRegistryForContext(ctx, urls));
+      using repo = await serveTaggedGitPackage();
       await writeFile(
         join(ctx.package_dir, "package.json"),
         JSON.stringify({
           name: "Foo",
           version: "0.0.1",
           dependencies: {
-            uglify: "git+https://git@github.com/mishoo/UglifyJS.git#404-no_such_tag",
+            uglify: `${repo.url}#404-no_such_tag`,
           },
         }),
       );
@@ -6428,12 +6475,8 @@ describe.concurrent("bun-install", () => {
       expect(await exited).toBe(1);
       expect(urls.sort()).toBeEmpty();
       expect(ctx.requested).toBe(0);
-      try {
-        await access(join(ctx.package_dir, "bun.lockb"));
-        expect.unreachable();
-      } catch (err: any) {
-        expect(err.code).toBe("ENOENT");
-      }
+      expect(await exists(join(ctx.package_dir, "node_modules", "uglify"))).toBeFalse();
+      expect(await exists(join(ctx.package_dir, "bun.lockb"))).toBeFalse();
     });
   });
 
@@ -6441,14 +6484,15 @@ describe.concurrent("bun-install", () => {
     await withContext(defaultOpts, async ctx => {
       const urls: string[] = [];
       setContextHandler(ctx, dummyRegistryForContext(ctx, urls));
+      using repo = await serveTaggedGitPackage();
       await writeFile(
         join(ctx.package_dir, "package.json"),
         JSON.stringify({
           name: "Foo",
           version: "0.0.1",
           dependencies: {
-            "uglify-ver": "git+https://git@github.com/mishoo/UglifyJS.git#v3.14.1",
-            "uglify-hash": "git+https://git@github.com/mishoo/UglifyJS.git#e219a9a",
+            "uglify-ver": `${repo.url}#v1.0.0`,
+            "uglify-hash": `${repo.url}#${repo.sha.slice(0, 7)}`,
           },
         }),
       );
@@ -6463,11 +6507,12 @@ describe.concurrent("bun-install", () => {
       const err = await stderr.text();
       expect(err).toContain("Saved lockfile");
       const out = await stdout.text();
+      // The tag and the abbreviated hash name the same commit, so they are one package installed under two names.
       expect(out.replace(/\s*\[[0-9\.]+m?s\]\s*$/, "").split(/\r?\n/)).toEqual([
         expect.stringContaining("bun install v1."),
         "",
-        "+ uglify-hash@git+https://git@github.com/mishoo/UglifyJS.git#e219a9a78a0d2251e4dcbd4bb9034207eb484fe8",
-        "+ uglify-ver@git+https://git@github.com/mishoo/UglifyJS.git#e219a9a78a0d2251e4dcbd4bb9034207eb484fe8",
+        `+ uglify-hash@${repo.url}#${repo.sha}`,
+        `+ uglify-ver@${repo.url}#${repo.sha}`,
         "",
         "1 package installed",
       ]);
@@ -6480,48 +6525,23 @@ describe.concurrent("bun-install", () => {
         "uglify-hash",
         "uglify-ver",
       ]);
-      expect(await readdirSorted(join(ctx.package_dir, "node_modules", ".bin"))).toHaveBins(["uglifyjs"]);
-      expect(join(ctx.package_dir, "node_modules", ".bin", "uglifyjs")).toBeValidBin(
-        join("..", "uglify-hash", "bin", "uglifyjs"),
+      expect(await readdirSorted(join(ctx.package_dir, "node_modules", ".bin"))).toHaveBins(["tagged"]);
+      expect(join(ctx.package_dir, "node_modules", ".bin", "tagged")).toBeValidBin(
+        join("..", "uglify-hash", "bin", "tagged.js"),
       );
+      // One bare clone and one checkout serve both names.
       expect(await readdirSorted(join(ctx.package_dir, "node_modules", ".cache"))).toEqual([
-        "9694c5fe9c41ad51.git",
-        "@G@e219a9a78a0d2251e4dcbd4bb9034207eb484fe8",
-      ]);
-      expect(await readdirSorted(join(ctx.package_dir, "node_modules", "uglify-hash"))).toEqual([
-        ".bun-tag",
-        ".gitattributes",
-        ".github",
-        ".gitignore",
-        "CONTRIBUTING.md",
-        "LICENSE",
-        "README.md",
-        "bin",
-        "lib",
-        "package.json",
-        "test",
-        "tools",
-      ]);
-      const hash_json = await file(join(ctx.package_dir, "node_modules", "uglify-hash", "package.json")).json();
-      expect(hash_json.name).toBe("uglify-js");
-      expect(hash_json.version).toBe("3.14.1");
-      expect(await readdirSorted(join(ctx.package_dir, "node_modules", "uglify-ver"))).toEqual([
-        ".bun-tag",
-        ".gitattributes",
-        ".github",
-        ".gitignore",
-        "CONTRIBUTING.md",
-        "LICENSE",
-        "README.md",
-        "bin",
-        "lib",
-        "package.json",
-        "test",
-        "tools",
-      ]);
-      const ver_json = await file(join(ctx.package_dir, "node_modules", "uglify-ver", "package.json")).json();
-      expect(ver_json.name).toBe("uglify-js");
-      expect(ver_json.version).toBe("3.14.1");
+        gitMirrorFolder,
+        `@G@${repo.sha}`,
+      ]);
+      for (const name of ["uglify-hash", "uglify-ver"]) {
+        expect(await readdirSorted(join(ctx.package_dir, "node_modules", name))).toEqual(repo.files);
+        expect(await file(join(ctx.package_dir, "node_modules", name, ".bun-tag")).text()).toBe(repo.sha);
+        expect(await file(join(ctx.package_dir, "node_modules", name, "package.json")).json()).toMatchObject({
+          name: "tagged",
+          version: "1.0.0",
+        });
+      }
       await access(join(ctx.package_dir, "bun.lockb"));
     });
   });
@@ -6530,209 +6550,83 @@ describe.concurrent("bun-install", () => {
     await withContext(defaultOpts, async ctx => {
       const urls: string[] = [];
       setContextHandler(ctx, dummyRegistryForContext(ctx, urls));
-      await writeFile(
-        join(ctx.package_dir, "bunfig.toml"),
-        `
-  [install]
-  cache = false
-  saveTextLockfile = false
-  `,
-      );
+      // A git dependency that itself depends on a registry package, so that re-installs exercise both.
+      using repo = await serveTaggedGitPackage({ dependencies: { bar: "0.0.2" } });
       await writeFile(
         join(ctx.package_dir, "package.json"),
         JSON.stringify({
           name: "foo",
           version: "0.0.1",
           dependencies: {
-            "html-minifier": "git+https://git@github.com/kangax/html-minifier#v4.0.0",
+            tagged: `${repo.url}#v1.0.0`,
           },
         }),
       );
-      const {
-        stdout: stdout1,
-        stderr: stderr1,
-        exited: exited1,
-      } = spawn({
-        cmd: [bunExe(), "install", "--linker=hoisted"],
-        cwd: ctx.package_dir,
-        stdout: "pipe",
-        stdin: "pipe",
-        stderr: "pipe",
-        env,
-      });
-      const err1 = await new Response(stderr1).text();
-      expect(err1).toContain("Saved lockfile");
-      const out1 = await new Response(stdout1).text();
-      expect(out1.replace(/\s*\[[0-9\.]+m?s\]\s*$/, "").split(/\r?\n/)).toEqual([
-        expect.stringContaining("bun install v1."),
-        "",
-        "+ html-minifier@git+https://git@github.com/kangax/html-minifier#4beb325eb01154a40c0cbebff2e5737bbd7071ab",
-        "",
-        "12 packages installed",
-      ]);
-      expect(await exited1).toBe(0);
-      expect(urls.sort()).toBeEmpty();
-      expect(ctx.requested).toBe(0);
-      expect(await readdirSorted(join(ctx.package_dir, "node_modules"))).toEqual([
-        ".bin",
-        ".cache",
-        "camel-case",
-        "clean-css",
-        "commander",
-        "he",
-        "html-minifier",
-        "lower-case",
-        "no-case",
-        "param-case",
-        "relateurl",
-        "source-map",
-        "uglify-js",
-        "upper-case",
-      ]);
-      expect(await readdirSorted(join(ctx.package_dir, "node_modules", ".bin"))).toHaveBins([
-        "he",
-        "html-minifier",
-        "uglifyjs",
-      ]);
-      expect(join(ctx.package_dir, "node_modules", ".bin", "he")).toBeValidBin(join("..", "he", "bin", "he"));
-      expect(join(ctx.package_dir, "node_modules", ".bin", "html-minifier")).toBeValidBin(
-        join("..", "html-minifier", "cli.js"),
-      );
-      expect(join(ctx.package_dir, "node_modules", ".bin", "uglifyjs")).toBeValidBin(
-        join("..", "uglify-js", "bin", "uglifyjs"),
-      );
-      await access(join(ctx.package_dir, "bun.lockb"));
-      // Perform `bun install` again but with lockfile from before
+
+      async function install() {
+        urls.length = 0;
+        await using proc = spawn({
+          cmd: [bunExe(), "install"],
+          cwd: ctx.package_dir,
+          stdout: "pipe",
+          stdin: "ignore",
+          stderr: "pipe",
+          env,
+        });
+        const [out, err, exitCode] = await Promise.all([proc.stdout.text(), proc.stderr.text(), proc.exited]);
+        expect(out.replace(/\s*\[[0-9\.]+m?s\]\s*$/, "").split(/\r?\n/)).toEqual([
+          expect.stringContaining("bun install v1."),
+          "",
+          `+ tagged@${repo.url}#${repo.sha}`,
+          "",
+          "2 packages installed",
+        ]);
+        expect(exitCode).toBe(0);
+        expect(await readdirSorted(join(ctx.package_dir, "node_modules"))).toEqual([".bin", ".cache", "bar", "tagged"]);
+        expect(await readdirSorted(join(ctx.package_dir, "node_modules", ".bin"))).toHaveBins(["tagged"]);
+        expect(join(ctx.package_dir, "node_modules", ".bin", "tagged")).toBeValidBin(
+          join("..", "tagged", "bin", "tagged.js"),
+        );
+        // With the cache disabled in bunfig, the git mirror and checkout as well as the registry package live in
+        // node_modules/.cache, which is what the third install below re-links from.
+        expect(await readdirSorted(join(ctx.package_dir, "node_modules", ".cache"))).toEqual([
+          gitMirrorFolder,
+          `@G@${repo.sha}`,
+          "bar",
+          "bar@0.0.2@@localhost@@@1",
+        ]);
+        expect(await readdirSorted(join(ctx.package_dir, "node_modules", "tagged"))).toEqual(repo.files);
+        expect(await file(join(ctx.package_dir, "node_modules", "tagged", ".bun-tag")).text()).toBe(repo.sha);
+        expect(await file(join(ctx.package_dir, "node_modules", "bar", "package.json")).json()).toEqual({
+          name: "bar",
+          version: "0.0.2",
+        });
+        await access(join(ctx.package_dir, "bun.lockb"));
+        return err;
+      }
+
+      // First install: the tag is resolved, bar is resolved against the registry, and a lockfile is written.
+      expect(await install()).toContain("Saved lockfile");
+      expect(urls.sort()).toEqual([`${ctx.registry_url}bar`, `${ctx.registry_url}bar-0.0.2.tgz`]);
+      expect(ctx.requested).toBe(2);
+      const lockfile = await file(join(ctx.package_dir, "bun.lockb")).bytes();
+
+      // Again without node_modules (which holds the cache too): everything is re-fetched, but nothing is
+      // re-resolved, so bar's manifest is not requested and the lockfile is not rewritten.
       await rm(join(ctx.package_dir, "node_modules"), { force: true, recursive: true });
-      urls.length = 0;
-      const {
-        stdout: stdout2,
-        stderr: stderr2,
-        exited: exited2,
-      } = spawn({
-        cmd: [bunExe(), "install", "--linker=hoisted"],
-        cwd: ctx.package_dir,
-        stdout: "pipe",
-        stdin: "pipe",
-        stderr: "pipe",
-        env,
-      });
-      const err2 = await new Response(stderr2).text();
-      expect(err2).not.toContain("Saved lockfile");
-      const out2 = await new Response(stdout2).text();
-      expect(out2.replace(/\s*\[[0-9\.]+m?s\]\s*$/, "").split(/\r?\n/)).toEqual([
-        expect.stringContaining("bun install v1."),
-        "",
-        "+ html-minifier@git+https://git@github.com/kangax/html-minifier#4beb325eb01154a40c0cbebff2e5737bbd7071ab",
-        "",
-        "12 packages installed",
-      ]);
-      expect(await exited2).toBe(0);
-      expect(urls.sort()).toBeEmpty();
-      expect(ctx.requested).toBe(0);
-      expect(await readdirSorted(join(ctx.package_dir, "node_modules"))).toEqual([
-        ".bin",
-        ".cache",
-        "camel-case",
-        "clean-css",
-        "commander",
-        "he",
-        "html-minifier",
-        "lower-case",
-        "no-case",
-        "param-case",
-        "relateurl",
-        "source-map",
-        "uglify-js",
-        "upper-case",
-      ]);
-      expect(await readdirSorted(join(ctx.package_dir, "node_modules", ".bin"))).toHaveBins([
-        "he",
-        "html-minifier",
-        "uglifyjs",
-      ]);
-      expect(join(ctx.package_dir, "node_modules", ".bin", "he")).toBeValidBin(join("..", "he", "bin", "he"));
-      expect(join(ctx.package_dir, "node_modules", ".bin", "html-minifier")).toBeValidBin(
-        join("..", "html-minifier", "cli.js"),
-      );
-      expect(join(ctx.package_dir, "node_modules", ".bin", "uglifyjs")).toBeValidBin(
-        join("..", "uglify-js", "bin", "uglifyjs"),
-      );
-      await access(join(ctx.package_dir, "bun.lockb"));
-      // Perform `bun install` again but with cache & lockfile from before
-      await Promise.all(
-        [
-          ".bin",
-          "camel-case",
-          "clean-css",
-          "commander",
-          "he",
-          "html-minifier",
-          "lower-case",
-          "no-case",
-          "param-case",
-          "relateurl",
-          "source-map",
-          "uglify-js",
-          "upper-case",
-        ].map(async dir => await rm(join(ctx.package_dir, "node_modules", dir), { force: true, recursive: true })),
-      );
+      expect(await install()).not.toContain("Saved lockfile");
+      expect(urls).toEqual([`${ctx.registry_url}bar-0.0.2.tgz`]);
+      expect(ctx.requested).toBe(3);
+      expect(await file(join(ctx.package_dir, "bun.lockb")).bytes()).toEqual(lockfile);
 
-      urls.length = 0;
-      const {
-        stdout: stdout3,
-        stderr: stderr3,
-        exited: exited3,
-      } = spawn({
-        cmd: [bunExe(), "install", "--linker=hoisted"],
-        cwd: ctx.package_dir,
-        stdout: "pipe",
-        stdin: "pipe",
-        stderr: "pipe",
-        env,
-      });
-      const err3 = await new Response(stderr3).text();
-      expect(err3).not.toContain("Saved lockfile");
-      const out3 = await new Response(stdout3).text();
-      expect(out3.replace(/\s*\[[0-9\.]+m?s\]\s*$/, "").split(/\r?\n/)).toEqual([
-        expect.stringContaining("bun install v1."),
-        "",
-        "+ html-minifier@git+https://git@github.com/kangax/html-minifier#4beb325eb01154a40c0cbebff2e5737bbd7071ab",
-        "",
-        "12 packages installed",
-      ]);
-      expect(await exited3).toBe(0);
-      expect(urls.sort()).toBeEmpty();
-      expect(ctx.requested).toBe(0);
-      expect(await readdirSorted(join(ctx.package_dir, "node_modules"))).toEqual([
-        ".bin",
-        ".cache",
-        "camel-case",
-        "clean-css",
-        "commander",
-        "he",
-        "html-minifier",
-        "lower-case",
-        "no-case",
-        "param-case",
-        "relateurl",
-        "source-map",
-        "uglify-js",
-        "upper-case",
-      ]);
-      expect(await readdirSorted(join(ctx.package_dir, "node_modules", ".bin"))).toHaveBins([
-        "he",
-        "html-minifier",
-        "uglifyjs",
-      ]);
-      expect(join(ctx.package_dir, "node_modules", ".bin", "he")).toBeValidBin(join("..", "he", "bin", "he"));
-      expect(join(ctx.package_dir, "node_modules", ".bin", "html-minifier")).toBeValidBin(
-        join("..", "html-minifier", "cli.js"),
-      );
-      expect(join(ctx.package_dir, "node_modules", ".bin", "uglifyjs")).toBeValidBin(
-        join("..", "uglify-js", "bin", "uglifyjs"),
-      );
-      await access(join(ctx.package_dir, "bun.lockb"));
+      // Again with the cache kept: the packages are re-linked from it without any request.
+      for (const entry of [".bin", "bar", "tagged"]) {
+        await rm(join(ctx.package_dir, "node_modules", entry), { force: true, recursive: true });
+      }
+      expect(await install()).not.toContain("Saved lockfile");
+      expect(urls).toBeEmpty();
+      expect(ctx.requested).toBe(3);
+      expect(await file(join(ctx.package_dir, "bun.lockb")).bytes()).toEqual(lockfile);
     });
   });
 
@@ -8032,145 +7926,92 @@ describe.concurrent("bun-install", () => {
     });
   });
 
-  it("should handle --frozen-lockfile", async () => {
-    await withContext(defaultOpts, async ctx => {
-      let urls: string[] = [];
-      setContextHandler(
-        ctx,
-        dummyRegistryForContext(ctx, urls, { "0.0.3": { as: "0.0.3" }, "0.0.5": { as: "0.0.5" } }),
-      );
-
-      await writeFile(
-        join(ctx.package_dir, "package.json"),
-        JSON.stringify({ name: "foo", version: "0.0.1", dependencies: { baz: "0.0.3" } }),
-      );
-
-      // save the lockfile once
-      expect(
-        await spawn({
-          cmd: [bunExe(), "install"],
-          cwd: ctx.package_dir,
-          stdout: "ignore",
-          stdin: "ignore",
-          stderr: "ignore",
-          env,
-        }).exited,
-      ).toBe(0);
-
-      // change version of baz in package.json
-      await writeFile(
-        join(ctx.package_dir, "package.json"),
-        JSON.stringify({
-          name: "foo",
-          version: "0.0.1",
-          dependencies: { baz: "0.0.5" },
-        }),
-      );
+  // Shared by the frozen lockfile tests below: installs baz@0.0.3, then bumps package.json to baz@0.0.5 so that the
+  // next install would have to change the lockfile. Returns what a frozen install has to leave alone.
+  async function installBazThenBumpIt(ctx: TestContext) {
+    const urls: string[] = [];
+    setContextHandler(ctx, dummyRegistryForContext(ctx, urls, { "0.0.3": { as: "0.0.3" }, "0.0.5": { as: "0.0.5" } }));
+    await writeFile(
+      join(ctx.package_dir, "package.json"),
+      JSON.stringify({ name: "foo", version: "0.0.1", dependencies: { baz: "0.0.3" } }),
+    );
+    await using proc = spawn({
+      cmd: [bunExe(), "install"],
+      cwd: ctx.package_dir,
+      stdout: "pipe",
+      stdin: "ignore",
+      stderr: "pipe",
+      env,
+    });
+    const [out, err, exitCode] = await Promise.all([proc.stdout.text(), proc.stderr.text(), proc.exited]);
+    expect(err).toContain("Saved lockfile");
+    expect(out.replace(/\s*\[[0-9\.]+m?s\]\s*$/, "").split(/\r?\n/)).toEqual([
+      expect.stringContaining("bun install v1."),
+      "",
+      "+ baz@0.0.3 (v0.0.5 available)",
+      "",
+      "1 package installed",
+    ]);
+    expect(exitCode).toBe(0);
+    expect(urls.sort()).toEqual([`${ctx.registry_url}baz`, `${ctx.registry_url}baz-0.0.3.tgz`]);
+    urls.length = 0;
 
-      const { stderr, exited } = spawn({
-        cmd: [bunExe(), "install", "--frozen-lockfile"],
-        cwd: ctx.package_dir,
-        stdout: "pipe",
-        stdin: "pipe",
-        stderr: "pipe",
-        env,
-      });
+    await writeFile(
+      join(ctx.package_dir, "package.json"),
+      JSON.stringify({ name: "foo", version: "0.0.1", dependencies: { baz: "0.0.5" } }),
+    );
+    return { urls, lockfile: await file(join(ctx.package_dir, "bun.lockb")).bytes() };
+  }
 
-      const err = await stderr.text();
-      expect(err).toContain("error: lockfile had changes, but lockfile is frozen");
-      expect(await exited).toBe(1);
+  // Runs `args` in a project prepared by installBazThenBumpIt: the install has to be refused after resolving against
+  // the registry, and the lockfile and the installed package have to be left as they were.
+  async function expectFrozenInstallRefused(
+    ctx: TestContext,
+    { urls, lockfile }: Awaited<ReturnType<typeof installBazThenBumpIt>>,
+    args: string[],
+  ) {
+    await using proc = spawn({
+      cmd: [bunExe(), ...args],
+      cwd: ctx.package_dir,
+      stdout: "pipe",
+      stdin: "ignore",
+      stderr: "pipe",
+      env,
     });
-  });
+    const [out, err, exitCode] = await Promise.all([proc.stdout.text(), proc.stderr.text(), proc.exited]);
+    expect(err).toContain("error: lockfile had changes, but lockfile is frozen");
+    expect(err).not.toContain("Saved lockfile");
+    expect(out).toContain("bun install v1.");
+    expect(out).not.toContain("installed");
+    expect(exitCode).toBe(1);
+    expect(urls).toContain(`${ctx.registry_url}baz`);
+    urls.length = 0;
+    expect(await file(join(ctx.package_dir, "bun.lockb")).bytes()).toEqual(lockfile);
+    expect(await file(join(ctx.package_dir, "node_modules", "baz", "package.json")).json()).toMatchObject({
+      name: "baz",
+      version: "0.0.3",
+    });
+  }
 
-  it("should handle bun ci alias (to --frozen-lockfile)", async () => {
+  it("should handle --frozen-lockfile", async () => {
     await withContext(defaultOpts, async ctx => {
-      let urls: string[] = [];
-      setContextHandler(
-        ctx,
-        dummyRegistryForContext(ctx, urls, { "0.0.3": { as: "0.0.3" }, "0.0.5": { as: "0.0.5" } }),
-      );
-
-      await writeFile(
-        join(ctx.package_dir, "package.json"),
-        JSON.stringify({ name: "foo", version: "0.0.1", dependencies: { baz: "0.0.3" } }),
-      );
-
-      // save the lockfile once
-      expect(
-        await spawn({
-          cmd: [bunExe(), "install"],
-          cwd: ctx.package_dir,
-          stdout: "ignore",
-          stdin: "ignore",
-          stderr: "ignore",
-          env,
-        }).exited,
-      ).toBe(0);
-
-      // change version of baz in package.json
-      await writeFile(
-        join(ctx.package_dir, "package.json"),
-        JSON.stringify({
-          name: "foo",
-          version: "0.0.1",
-          dependencies: { baz: "0.0.5" },
-        }),
-      );
-
-      const { stderr: stderr1, exited: exited1 } = spawn({
-        cmd: [bunExe(), "ci"],
-        cwd: ctx.package_dir,
-        stdout: "pipe",
-        stdin: "pipe",
-        stderr: "pipe",
-        env,
-      });
-
-      const err1 = await new Response(stderr1).text();
-      expect(err1).toContain("error: lockfile had changes, but lockfile is frozen");
-      expect(await exited1).toBe(1);
-
-      // test that it works even if ci isn't first "arg"
-      const { stderr: stderr2, exited: exited2 } = spawn({
-        cmd: [bunExe(), "--save", "ci"],
-        cwd: ctx.package_dir,
-        stdout: "pipe",
-        stdin: "pipe",
-        stderr: "pipe",
-        env,
-      });
+      const prepared = await installBazThenBumpIt(ctx);
+      await expectFrozenInstallRefused(ctx, prepared, ["install", "--frozen-lockfile"]);
+    });
+  });
 
-      const err2 = await new Response(stderr2).text();
-      expect(err2).toContain("error: lockfile had changes, but lockfile is frozen");
-      expect(await exited2).toBe(1);
+  it("should handle bun ci alias (to --frozen-lockfile)", async () => {
+    await withContext(defaultOpts, async ctx => {
+      const prepared = await installBazThenBumpIt(ctx);
+      await expectFrozenInstallRefused(ctx, prepared, ["ci"]);
+      // test that it works even if ci isn't first "arg"
+      await expectFrozenInstallRefused(ctx, prepared, ["--save", "ci"]);
     });
   });
 
   it("should handle frozenLockfile in config file", async () => {
     await withContext(defaultOpts, async ctx => {
-      let urls: string[] = [];
-      setContextHandler(
-        ctx,
-        dummyRegistryForContext(ctx, urls, { "0.0.3": { as: "0.0.3" }, "0.0.5": { as: "0.0.5" } }),
-      );
-
-      await writeFile(
-        join(ctx.package_dir, "package.json"),
-        JSON.stringify({ name: "foo", version: "0.0.1", dependencies: { baz: "0.0.3" } }),
-      );
-
-      // save the lockfile once
-      expect(
-        await spawn({
-          cmd: [bunExe(), "install"],
-          cwd: ctx.package_dir,
-          stdout: "ignore",
-          stdin: "ignore",
-          stderr: "ignore",
-          env,
-        }).exited,
-      ).toBe(0);
-
+      const prepared = await installBazThenBumpIt(ctx);
       await writeFile(
         join(ctx.package_dir, "bunfig.toml"),
         Bun.TOML.stringify({
@@ -8180,29 +8021,7 @@ describe.concurrent("bun-install", () => {
           },
         }),
       );
-
-      // change version of baz in package.json
-      await writeFile(
-        join(ctx.package_dir, "package.json"),
-        JSON.stringify({
-          name: "foo",
-          version: "0.0.1",
-          dependencies: { baz: "0.0.5" },
-        }),
-      );
-
-      const { stderr, exited } = spawn({
-        cmd: [bunExe(), "install"],
-        cwd: ctx.package_dir,
-        stdout: "pipe",
-        stdin: "pipe",
-        stderr: "pipe",
-        env,
-      });
-
-      const err = await stderr.text();
-      expect(err).toContain("error: lockfile had changes, but lockfile is frozen");
-      expect(await exited).toBe(1);
+      await expectFrozenInstallRefused(ctx, prepared, ["install"]);
     });
   });
 
@@ -8889,7 +8708,7 @@ describe.concurrent("bun-install", () => {
       },
     });
 
-    const { stdout, stderr } = await Bun.$`${bunExe()} install`.env(env).cwd(package_dir).throws(true);
+    const { stdout, stderr } = await Bun.$`${bunExe()} install`.env(env).cwd(package_dir).quiet().throws(true);
     const err1 = stderr.toString();
     expect(err1).toContain("Saved lockfile");
     expect(
@@ -8950,9 +8769,7 @@ describe.concurrent("bun-install", () => {
       },
     });
 
-    console.log("TEMPDIR", package_dir);
-
-    const { stdout, stderr } = await Bun.$`${bunExe()} install`.env(env).cwd(package_dir).throws(true);
+    const { stdout, stderr } = await Bun.$`${bunExe()} install`.env(env).cwd(package_dir).quiet().throws(true);
     const err1 = stderr.toString();
     expect(err1).toContain("Saved lockfile");
     expect(
@@ -9009,9 +8826,7 @@ describe.concurrent("bun-install", () => {
         },
       },
     });
-    console.log("TEMP DIR", package_dir);
-
-    const { stdout, stderr } = await Bun.$`${bunExe()} install`.env(env).cwd(package_dir).throws(true);
+    const { stdout, stderr } = await Bun.$`${bunExe()} install`.env(env).cwd(package_dir).quiet().throws(true);
     const err1 = stderr.toString();
     expect(err1).toContain("Saved lockfile");
     expect(
@@ -9022,365 +8837,90 @@ describe.concurrent("bun-install", () => {
     ).toEqual([expect.stringContaining("bun install v1."), "", "4 packages installed"]);
   });
 
-  it("should handle installing packages inside workspaces with difference versions", async () => {
-    await withContext(defaultOpts, async ctx => {
-      let package_jsons = [
-        JSON.stringify({
-          name: "main",
-          workspaces: ["packages/*"],
-          private: true,
-        }),
-        JSON.stringify({
-          name: "main",
-          private: true,
-          workspaces: [
-            "packages/package1",
-            "packages/package2",
-            "packages/package3",
-            "packages/package4",
-            "packages/package5",
-          ],
-        }),
-      ];
-      await mkdir(join(ctx.package_dir, "packages", "package1"), { recursive: true });
-      await mkdir(join(ctx.package_dir, "packages", "package2"));
-      await mkdir(join(ctx.package_dir, "packages", "package3"));
-      await mkdir(join(ctx.package_dir, "packages", "package4"));
-      await mkdir(join(ctx.package_dir, "packages", "package5"));
-      {
-        const package1 = JSON.stringify({
-          name: "package1",
-          version: "0.0.2",
-        });
-        await writeFile(join(ctx.package_dir, "packages", "package1", "package.json"), package1);
-      }
-      {
-        const package2 = JSON.stringify({
-          name: "package2",
-          version: "0.0.1",
-          dependencies: {
-            package1: "workspace:*",
-          },
-        });
-        await writeFile(join(ctx.package_dir, "packages", "package2", "package.json"), package2);
-      }
-      {
-        const package3 = JSON.stringify({
-          name: "package3",
-          version: "0.0.1",
-          dependencies: {
-            package1: "workspace:^",
-          },
-        });
-        await writeFile(join(ctx.package_dir, "packages", "package3", "package.json"), package3);
-      }
-      {
-        const package4 = JSON.stringify({
-          name: "package4",
-          version: "0.0.1",
-          dependencies: {
-            package1: "workspace:../package1",
-          },
-        });
-        await writeFile(join(ctx.package_dir, "packages", "package4", "package.json"), package4);
-      }
-      {
-        const package5 = JSON.stringify({
-          name: "package5",
-          version: "0.0.1",
-          dependencies: {
-            package1: "workspace:0.0.2",
-          },
-        });
-        await writeFile(join(ctx.package_dir, "packages", "package5", "package.json"), package5);
-      }
-      for (const package_json of package_jsons) {
-        await writeFile(join(ctx.package_dir, "package.json"), package_json);
-
-        {
-          const package1 = JSON.stringify({
-            name: "package1",
-            version: "0.0.2",
-          });
-          await writeFile(join(ctx.package_dir, "packages", "package1", "package.json"), package1);
-        }
-        {
-          const package2 = JSON.stringify({
-            name: "package2",
-            version: "0.0.1",
-            dependencies: {
-              package1: "workspace:*",
-            },
-          });
-          await writeFile(join(ctx.package_dir, "packages", "package2", "package.json"), package2);
-        }
-        {
-          const package3 = JSON.stringify({
-            name: "package3",
-            version: "0.0.1",
-            dependencies: {
-              package1: "workspace:^",
-            },
-          });
-          await writeFile(join(ctx.package_dir, "packages", "package3", "package.json"), package3);
-        }
-        {
-          const package4 = JSON.stringify({
-            name: "package4",
-            version: "0.0.1",
-            dependencies: {
-              package1: "workspace:../package1",
-            },
-          });
-          await writeFile(join(ctx.package_dir, "packages", "package4", "package.json"), package4);
-        }
-        {
-          const package5 = JSON.stringify({
-            name: "package5",
-            version: "0.0.1",
-            dependencies: {
-              package1: "workspace:0.0.2",
-            },
-          });
-          await writeFile(join(ctx.package_dir, "packages", "package5", "package.json"), package5);
-        }
-
-        const {
-          stdout: stdout1,
-          stderr: stderr1,
-          exited: exited1,
-        } = spawn({
-          cmd: [bunExe(), "install"],
-          cwd: join(ctx.package_dir, "packages", "package2"),
-          stdout: "pipe",
-          stdin: "pipe",
-          stderr: "pipe",
-          env,
-        });
-        const err1 = await new Response(stderr1).text();
-        expect(err1).toContain("Saved lockfile");
-        const out1 = await new Response(stdout1).text();
-        expect(out1.replace(/\s*\[[0-9\.]+m?s\]\s*$/, "").split(/\r?\n/)).toEqual([
-          expect.stringContaining("bun install v1."),
-          "",
-          `+ package1@workspace:packages/package1`,
-          "",
-          "5 packages installed",
-        ]);
-        expect(await exited1).toBe(0);
-        await access(join(ctx.package_dir, "bun.lockb"));
-
-        var urls: string[] = [];
-        setContextHandler(ctx, dummyRegistryForContext(ctx, urls));
-
-        const {
-          stdout: stdout1_2,
-          stderr: stderr1_2,
-          exited: exited1_2,
-        } = spawn({
-          cmd: [bunExe(), "install", "bar"],
-          cwd: join(ctx.package_dir, "packages", "package2"),
-          stdout: "pipe",
-          stdin: "pipe",
-          stderr: "pipe",
-          env,
-        });
-        const err1_2 = await new Response(stderr1_2).text();
-        expect(err1_2).toContain("Saved lockfile");
-        const out1_2 = await new Response(stdout1_2).text();
-        expect(out1_2).toContain("installed bar");
-        expect(await exited1_2).toBe(0);
-        expect(urls.sort()).toEqual([`${ctx.registry_url}bar`, `${ctx.registry_url}bar-0.0.2.tgz`]);
-        await access(join(ctx.package_dir, "bun.lockb"));
-
-        await rm(join(ctx.package_dir, "node_modules"), { force: true, recursive: true });
-        await rm(join(ctx.package_dir, "bun.lockb"), { force: true, recursive: true });
-
-        const {
-          stdout: stdout2,
-          stderr: stderr2,
-          exited: exited2,
-        } = spawn({
-          cmd: [bunExe(), "install"],
-          cwd: join(ctx.package_dir, "packages", "package3"),
-          stdout: "pipe",
-          stdin: "pipe",
-          stderr: "pipe",
-          env,
-        });
-        const err2 = await new Response(stderr2).text();
-        expect(err2).toContain("Saved lockfile");
-        const out2 = await new Response(stdout2).text();
-        expect(out2.replace(/\s*\[[0-9\.]+m?s\]\s*$/, "").split(/\r?\n/)).toEqual([
-          expect.stringContaining("bun install v1."),
-          "",
-          `+ package1@workspace:packages/package1`,
-          "",
-          "6 packages installed",
-        ]);
-        expect(await exited2).toBe(0);
-
-        const {
-          stdout: stdout2_2,
-          stderr: stderr2_2,
-          exited: exited2_2,
-        } = spawn({
-          cmd: [bunExe(), "install", "bar"],
-          cwd: join(ctx.package_dir, "packages", "package3"),
-          stdout: "pipe",
-          stdin: "pipe",
-          stderr: "pipe",
-          env,
-        });
-        const err2_2 = await new Response(stderr2_2).text();
-        expect(err2_2).toContain("Saved lockfile");
-        const out2_2 = await new Response(stdout2_2).text();
-        expect(out2_2).toContain("installed bar");
-        expect(await exited2_2).toBe(0);
-        await access(join(ctx.package_dir, "bun.lockb"));
-
-        await rm(join(ctx.package_dir, "node_modules"), { force: true, recursive: true });
-        await rm(join(ctx.package_dir, "bun.lockb"), { force: true, recursive: true });
-
-        const {
-          stdout: stdout3,
-          stderr: stderr3,
-          exited: exited3,
-        } = spawn({
-          cmd: [bunExe(), "install"],
-          cwd: join(ctx.package_dir, "packages", "package4"),
-          stdout: "pipe",
-          stdin: "pipe",
-          stderr: "pipe",
-          env,
-        });
-        const err3 = await new Response(stderr3).text();
-        expect(err3).toContain("Saved lockfile");
-        const out3 = await new Response(stdout3).text();
-        expect(out3.replace(/\s*\[[0-9\.]+m?s\]\s*$/, "").split(/\r?\n/)).toEqual([
-          expect.stringContaining("bun install v1."),
-          "",
-          `+ package1@workspace:packages/package1`,
-          "",
-          "6 packages installed",
-        ]);
-        expect(await exited3).toBe(0);
-
-        const {
-          stdout: stdout3_2,
-          stderr: stderr3_2,
-          exited: exited3_2,
-        } = spawn({
-          cmd: [bunExe(), "install", "bar"],
-          cwd: join(ctx.package_dir, "packages", "package4"),
-          stdout: "pipe",
-          stdin: "pipe",
-          stderr: "pipe",
-          env,
-        });
-        const err3_2 = await new Response(stderr3_2).text();
-        expect(err3_2).toContain("Saved lockfile");
-        const out3_2 = await new Response(stdout3_2).text();
-        expect(out3_2).toContain("installed bar");
-        expect(await exited3_2).toBe(0);
-        await access(join(ctx.package_dir, "bun.lockb"));
-
-        await rm(join(ctx.package_dir, "node_modules"), { force: true, recursive: true });
-        await rm(join(ctx.package_dir, "bun.lockb"), { force: true, recursive: true });
-
-        const {
-          stdout: stdout4,
-          stderr: stderr4,
-          exited: exited4,
-        } = spawn({
-          cmd: [bunExe(), "install"],
-          cwd: join(ctx.package_dir, "packages", "package5"),
-          stdout: "pipe",
-          stdin: "pipe",
-          stderr: "pipe",
-          env,
-        });
-        const err4 = await new Response(stderr4).text();
-        expect(err4).toContain("Saved lockfile");
-        const out4 = await new Response(stdout4).text();
-        expect(out4.replace(/\s*\[[0-9\.]+m?s\]\s*$/, "").split(/\r?\n/)).toEqual([
-          expect.stringContaining("bun install v1."),
-          "",
-          `+ package1@workspace:packages/package1`,
-          "",
-          "6 packages installed",
-        ]);
-        expect(await exited4).toBe(0);
-
-        const {
-          stdout: stdout4_2,
-          stderr: stderr4_2,
-          exited: exited4_2,
-        } = spawn({
-          cmd: [bunExe(), "install", "bar"],
-          cwd: join(ctx.package_dir, "packages", "package5"),
-          stdout: "pipe",
-          stdin: "pipe",
-          stderr: "pipe",
-          env,
-        });
-        const err4_2 = await new Response(stderr4_2).text();
-        expect(err4_2).toContain("Saved lockfile");
-        const out4_2 = await new Response(stdout4_2).text();
-        expect(out4_2).toContain("installed bar");
-        expect(await exited4_2).toBe(0);
-        await access(join(ctx.package_dir, "bun.lockb"));
+  describe("should handle installing packages inside workspaces with difference versions", () => {
+    // package2 to package5 each depend on package1 through a different workspace specifier.
+    const packages: Record<string, { name: string; version: string; dependencies?: Record<string, string> }> = {
+      package1: { name: "package1", version: "0.0.2" },
+      package2: { name: "package2", version: "0.0.1", dependencies: { package1: "workspace:*" } },
+      package3: { name: "package3", version: "0.0.1", dependencies: { package1: "workspace:^" } },
+      package4: { name: "package4", version: "0.0.1", dependencies: { package1: "workspace:../package1" } },
+      package5: { name: "package5", version: "0.0.1", dependencies: { package1: "workspace:0.0.2" } },
+    };
+    const roots = {
+      "a glob": { name: "main", private: true, workspaces: ["packages/*"] },
+      "a list": { name: "main", private: true, workspaces: Object.keys(packages).map(name => `packages/${name}`) },
+    };
 
-        // from the root
-        await rm(join(ctx.package_dir, "node_modules"), { force: true, recursive: true });
-        await rm(join(ctx.package_dir, "bun.lockb"), { force: true, recursive: true });
+    for (const [workspaces, root] of Object.entries(roots)) {
+      for (const from of ["package2", "package3", "package4", "package5", "the root"]) {
+        it(`installs from ${from} when workspaces is ${workspaces}`, async () => {
+          await withContext(defaultOpts, async ctx => {
+            await write(join(ctx.package_dir, "package.json"), JSON.stringify(root));
+            for (const [name, package_json] of Object.entries(packages)) {
+              await write(join(ctx.package_dir, "packages", name, "package.json"), JSON.stringify(package_json));
+            }
+            const cwd = from === "the root" ? ctx.package_dir : join(ctx.package_dir, "packages", from);
+
+            {
+              await using proc = spawn({
+                cmd: [bunExe(), "install"],
+                cwd,
+                stdout: "pipe",
+                stdin: "ignore",
+                stderr: "pipe",
+                env,
+              });
+              const [out, err, exitCode] = await Promise.all([proc.stdout.text(), proc.stderr.text(), proc.exited]);
+              expect(err).toContain("Saved lockfile");
+              expect(out.replace(/\s*\[[0-9\.]+m?s\]\s*$/, "").split(/\r?\n/)).toEqual([
+                expect.stringContaining("bun install v1."),
+                "",
+                ...(from === "the root" ? [] : ["+ package1@workspace:packages/package1", ""]),
+                "5 packages installed",
+              ]);
+              expect(exitCode).toBe(0);
+              expect(ctx.requested).toBe(0);
+            }
 
-        const {
-          stdout: stdout5,
-          stderr: stderr5,
-          exited: exited5,
-        } = spawn({
-          cmd: [bunExe(), "install"],
-          cwd: join(ctx.package_dir),
-          stdout: "pipe",
-          stdin: "pipe",
-          stderr: "pipe",
-          env,
-        });
-        const err5 = await new Response(stderr5).text();
-        expect(err5).toContain("Saved lockfile");
-        const out5 = await new Response(stdout5).text();
-        expect(out5.replace(/\s*\[[0-9\.]+m?s\]\s*$/, "").split(/\r?\n/)).toEqual([
-          expect.stringContaining("bun install v1."),
-          "",
-          "6 packages installed",
-        ]);
-        expect(await exited5).toBe(0);
-
-        const {
-          stdout: stdout5_2,
-          stderr: stderr5_2,
-          exited: exited5_2,
-        } = spawn({
-          cmd: [bunExe(), "install", "bar"],
-          cwd: join(ctx.package_dir),
-          stdout: "pipe",
-          stdin: "pipe",
-          stderr: "pipe",
-          env,
+            const urls: string[] = [];
+            setContextHandler(ctx, dummyRegistryForContext(ctx, urls));
+            {
+              await using proc = spawn({
+                cmd: [bunExe(), "install", "bar"],
+                cwd,
+                stdout: "pipe",
+                stdin: "ignore",
+                stderr: "pipe",
+                env,
+              });
+              const [out, err, exitCode] = await Promise.all([proc.stdout.text(), proc.stderr.text(), proc.exited]);
+              expect(err).toContain("Saved lockfile");
+              expect(out).toContain("installed bar@0.0.2");
+              expect(exitCode).toBe(0);
+            }
+            expect(urls.sort()).toEqual([`${ctx.registry_url}bar`, `${ctx.registry_url}bar-0.0.2.tgz`]);
+
+            // bar is added to the package the command ran in and nowhere else, and is hoisted next to the workspaces.
+            for (const [name, package_json] of Object.entries(packages)) {
+              expect(await file(join(ctx.package_dir, "packages", name, "package.json")).json()).toEqual(
+                from === name
+                  ? { ...package_json, dependencies: { bar: "^0.0.2", ...package_json.dependencies } }
+                  : package_json,
+              );
+            }
+            expect(await file(join(ctx.package_dir, "package.json")).json()).toEqual(
+              from === "the root" ? { ...root, dependencies: { bar: "^0.0.2" } } : root,
+            );
+            expect(await readdirSorted(join(ctx.package_dir, "node_modules"))).toEqual([
+              ".cache",
+              "bar",
+              ...Object.keys(packages),
+            ]);
+            await access(join(ctx.package_dir, "bun.lockb"));
+          });
         });
-        const err5_2 = await new Response(stderr5_2).text();
-        expect(err5_2).toContain("Saved lockfile");
-        const out5_2 = await new Response(stdout5_2).text();
-        expect(out5_2).toContain("installed bar");
-        expect(await exited5_2).toBe(0);
-        await access(join(ctx.package_dir, "bun.lockb"));
-
-        await rm(join(ctx.package_dir, "node_modules"), { force: true, recursive: true });
-        await rm(join(ctx.package_dir, "bun.lockb"), { force: true, recursive: true });
-        await rm(join(ctx.package_dir, "package.json"));
       }
-    });
+    }
   });
 
   it("should override npm dependency by matching workspace", async () => {
@@ -10194,13 +9734,15 @@ describe.concurrent("bun-install", () => {
               }),
             );
 
+            // Only the join is under test; the request it produces must not reach a resolver (see refusingProxy).
+            using proxy = refusingProxy();
             const { stdout, stderr, exited } = spawn({
               cmd: [bunExe(), "install"],
               cwd: ctx.package_dir,
               stdout: "pipe",
               stdin: "pipe",
               stderr: "pipe",
-              env,
+              env: proxy.env,
             });
             expect(await stdout.text()).toEqual(expect.stringContaining("bun install v1."));
 
@@ -10454,15 +9996,10 @@ describe.concurrent("bun-install", () => {
 
   it("should handle @scoped name that contains tilde, issue#7045", async () => {
     await withContext(defaultOpts, async ctx => {
-      await writeFile(
-        join(ctx.package_dir, "bunfig.toml"),
-        `
-  [install]
-  cache = false
-  `,
-      );
+      const urls: string[] = [];
+      setContextHandler(ctx, dummyRegistryForContext(ctx, urls));
       const { stdout, stderr, exited } = spawn({
-        cmd: [bunExe(), "install", "@~39/empty"],
+        cmd: [bunExe(), "install", "@~39/bar"],
         cwd: ctx.package_dir,
         stdin: null,
         stdout: "pipe",
@@ -10470,15 +10007,38 @@ describe.concurrent("bun-install", () => {
         env,
       });
       expect(await stderr.text()).toContain("Saved lockfile");
-      expect(await stdout.text()).toContain("installed @~39/empty@1.0.0");
+      expect(await stdout.text()).toContain("installed @~39/bar@0.0.2");
       expect(await exited).toBe(0);
+      // The issue was that the tilde made the name look like something other than a registry package. It has to be
+      // looked up on the registry under its full scoped name and land under its scope in node_modules.
+      expect(urls.sort()).toEqual([`${ctx.registry_url}@~39%2fbar`, `${ctx.registry_url}@~39/bar-0.0.2.tgz`]);
+      expect(await readdirSorted(join(ctx.package_dir, "node_modules", "@~39", "bar"))).toEqual(["package.json"]);
+      expect((await file(join(ctx.package_dir, "package.json")).json()).dependencies).toEqual({ "@~39/bar": "^0.0.2" });
     });
   });
 
-  test.serial("should handle modified git resolutions in bun.lock", async () => {
+  it("should handle modified git resolutions in bun.lock", async () => {
     await withContext(defaultOpts, async ctx => {
       // install-test-8 has a dependency but because it's not in the lockfile
       // it won't be included in the install.
+      const lockfile = JSON.stringify({
+        "lockfileVersion": 0,
+        "configVersion": 1,
+        "workspaces": {
+          "": {
+            "dependencies": {
+              "jquery": "3.7.1",
+            },
+          },
+        },
+        "packages": {
+          "jquery": [
+            "jquery@git+ssh://git@github.com/dylan-conway/install-test-8.git#3a1288830817d13da39e9231302261896f8721ea",
+            {},
+            "3a1288830817d13da39e9231302261896f8721ea",
+          ],
+        },
+      });
       await Promise.all([
         write(
           join(ctx.package_dir, "package.json"),
@@ -10490,27 +10050,7 @@ describe.concurrent("bun-install", () => {
             },
           }),
         ),
-        write(
-          join(ctx.package_dir, "bun.lock"),
-          JSON.stringify({
-            "lockfileVersion": 0,
-            "configVersion": 1,
-            "workspaces": {
-              "": {
-                "dependencies": {
-                  "jquery": "3.7.1",
-                },
-              },
-            },
-            "packages": {
-              "jquery": [
-                "jquery@git+ssh://git@github.com/dylan-conway/install-test-8.git#3a1288830817d13da39e9231302261896f8721ea",
-                {},
-                "3a1288830817d13da39e9231302261896f8721ea",
-              ],
-            },
-          }),
-        ),
+        write(join(ctx.package_dir, "bun.lock"), lockfile),
       ]);
 
       const { stdout, stderr, exited } = spawn({
@@ -10529,9 +10069,16 @@ describe.concurrent("bun-install", () => {
       expect(out).toContain("1 package installed");
       expect(await exited).toBe(0);
 
-      expect(
-        (await file(join(ctx.package_dir, "bun.lock")).text()).replaceAll(/localhost:\d+/g, "localhost:1234"),
-      ).toMatchSnapshot();
+      // The git resolution from the lockfile wins over the registry version in package.json: nothing is fetched
+      // from the registry, the repository's own dependency is not installed, and the lockfile is left untouched.
+      expect(ctx.requested).toBe(0);
+      expect(await readdirSorted(join(ctx.package_dir, "node_modules"))).toEqual([".cache", "jquery"]);
+      expect(await file(join(ctx.package_dir, "node_modules", "jquery", "package.json")).json()).toEqual({
+        name: "install-test-eight",
+        version: "2.2.2",
+        dependencies: { jquery: "3.7.1" },
+      });
+      expect(await file(join(ctx.package_dir, "bun.lock")).text()).toBe(lockfile);
     });
   });
 
@@ -10749,7 +10296,12 @@ describe.concurrent("bun-install", () => {
   });
 });
 
-it("rejects dependency aliases containing '..' path segments", async () => {
+// The tests below are outside the describe.concurrent group above. A plain top-level `it` here runs by itself after
+// every other test in the file has finished, so keep them `it.concurrent`: those overlap with the group and each other.
+// (Names that would not fit on the declaration line are hoisted into constants: prettier only keeps over-long test
+// calls on one line for plain it/test, and would otherwise re-indent the whole body.)
+
+it.concurrent("rejects dependency aliases containing '..' path segments", async () => {
   await withContext(defaultOpts, async ctx => {
     const urls: string[] = [];
     setContextHandler(ctx, dummyRegistryForContext(ctx, urls, { "0.0.3": {} }));
@@ -10789,7 +10341,7 @@ it("rejects dependency aliases containing '..' path segments", async () => {
   });
 });
 
-it("does not extract a tarball for a dependency alias containing '..' path segments", async () => {
+it.concurrent("does not extract a tarball for a dependency alias containing '..' path segments", async () => {
   await withContext(defaultOpts, async ctx => {
     const urls: string[] = [];
     setContextHandler(ctx, dummyRegistryForContext(ctx, urls));
@@ -11056,7 +10608,7 @@ describe("dependency names containing terminal control characters", () => {
   });
 });
 
-it("does not install transitive file: dependencies that point outside their package", async () => {
+it.concurrent("does not install transitive file: dependencies that point outside their package", async () => {
   // A dependency declared by a non-workspace package (here: a folder dependency
   // of the project) uses a file: specifier pointing at an absolute path outside
   // of that package and outside the project. That directory must not be linked
@@ -11443,7 +10995,7 @@ describe.concurrent("a dependency whose own package.json has an invalid name", (
   });
 });
 
-it("does not install transitive file: dependencies with overlong folder targets", async () => {
+it.concurrent("does not install transitive file: dependencies with overlong folder targets", async () => {
   const overlongTarget = "file:./" + Buffer.alloc(120000, "a").toString();
   using dir = tempDir("transitive-file-dep-overlong", {
     "project/package.json": JSON.stringify({
@@ -11843,7 +11395,11 @@ describe.concurrent("file: tarballs declared by a package installed from the cac
 });
 
 for (const field of ["resolutions", "overrides"]) {
-  it(`installs a file: dependency pointing outside the project when it came from root package.json "${field}"`, async () => {
+  const installsFromRoot = `installs a file: dependency pointing outside the project when it came from root package.json "${field}"`;
+  const installsFromRootWithLockfile = `${installsFromRoot} (existing lockfile)`;
+  const stillRejectsTransitive = `still rejects transitive file: dependencies that escape their package when a different name is in "${field}"`;
+
+  it.concurrent(installsFromRoot, async () => {
     // `overrides` / `resolutions` can only be declared in the root package.json,
     // so a file: path written there is user-specified and should be trusted
     // even when it is applied to a transitive dependency in a nested tree.
@@ -11917,7 +11473,7 @@ for (const field of ["resolutions", "overrides"]) {
     expect(runExit).toBe(0);
   });
 
-  it(`installs a file: dependency pointing outside the project when it came from root package.json "${field}" (existing lockfile)`, async () => {
+  it.concurrent(installsFromRootWithLockfile, async () => {
     // Same as above but starting from a lockfile that already contains the
     // nested folder resolution, so the package installer (not the enqueue
     // path) is what sees the escaping folder path.
@@ -11988,7 +11544,7 @@ for (const field of ["resolutions", "overrides"]) {
     expect(await exists(join(projectDir, "node_modules", "shared", "package.json"))).toBe(true);
   });
 
-  it(`still rejects transitive file: dependencies that escape their package when a different name is in "${field}"`, async () => {
+  it.concurrent(stillRejectsTransitive, async () => {
     // An override for a different name must not whitelist an unrelated
     // transitive file: dependency that points outside its package.
     using dir = tempDir("override-file-dep-unrelated", {
@@ -12297,7 +11853,7 @@ it.concurrent("fails when a file: override for a registry package's dependency n
   });
 });
 
-it("installs the transitive file: dependency of a file: dependency", async () => {
+it.concurrent("installs the transitive file: dependency of a file: dependency", async () => {
   using dir = tempDir("transitive-file-dep", {
     "package.json": JSON.stringify({
       name: "my-app",
@@ -13185,7 +12741,9 @@ for (const [first, second] of [
   });
 }
 
-it("does not extract a local file: tarball outside the temp dir for a dependency alias containing '..' path segments", async () => {
+const doesNotExtractOutsideTempDir =
+  "does not extract a local file: tarball outside the temp dir for a dependency alias containing '..' path segments";
+it.concurrent(doesNotExtractOutsideTempDir, async () => {
   // For `file:` tarball dependencies, the dependency alias (the key in
   // `dependencies`) is used to derive the temporary extraction folder name.
   // Point bun's temp dir and cache at directories we control so an alias with
@@ -13269,7 +12827,9 @@ it("does not extract a local file: tarball outside the temp dir for a dependency
   expect(exitCodeOk).toBe(0);
 });
 
-it("does not create a cache index entry outside the cache directory for a dependency alias of '..'", async () => {
+const doesNotCreateCacheEntryOutside =
+  "does not create a cache index entry outside the cache directory for a dependency alias of '..'";
+it.concurrent(doesNotCreateCacheEntryOutside, async () => {
   // For git/github/tarball dependencies the dependency alias (the key in
   // `dependencies`) is used as the folder name for the per-package cache
   // index (`<cache>/<alias>/<resolved-folder>` symlinks). The alias must be a
@@ -13350,7 +12910,7 @@ it("does not create a cache index entry outside the cache directory for a depend
 // collide under the seed-0 std.Wyhash that keys the folder-resolution dedupe
 // map must each resolve to their own package, not share one identity.
 // https://github.com/oven-sh/bun/issues/32741
-it.skipIf(isWindows)("file: deps with colliding abs-path hashes resolve to distinct packages", async () => {
+it.concurrent.skipIf(isWindows)("file: deps with colliding abs-path hashes resolve to distinct packages", async () => {
   using dir = tempDir("folder-resolution-collision", {
     "package.json": JSON.stringify({ name: "victim", version: "0.0.0" }),
   });
@@ -13403,7 +12963,7 @@ it.skipIf(isWindows)("file: deps with colliding abs-path hashes resolve to disti
   expect({ alpha: alpha.name, beta: beta.name }).toEqual({ alpha: "pkg-alpha", beta: "pkg-beta" });
 });
 
-it("reports an invalid URL for a manifest tarball URL containing a newline", async () => {
+it.concurrent("reports an invalid URL for a manifest tarball URL containing a newline", async () => {
   await withContext(defaultOpts, async ctx => {
     const tarballRequests: string[] = [];
     setContextHandler(ctx, async request => {
@@ -13457,7 +13017,7 @@ it("reports an invalid URL for a manifest tarball URL containing a newline", asy
   });
 });
 
-it("reports an invalid URL for a manifest tarball URL containing a space", async () => {
+it.concurrent("reports an invalid URL for a manifest tarball URL containing a space", async () => {
   await withContext(defaultOpts, async ctx => {
     setContextHandler(ctx, async request => {
       const url = new URL(request.url);
@@ -13508,7 +13068,7 @@ it("reports an invalid URL for a manifest tarball URL containing a space", async
   });
 });
 
-it.each([
+it.concurrent.each([
   ["tab", "\t"],
   ["vertical tab", "\x0b"],
 ])("reports an invalid URL for a manifest tarball URL containing a %s", async (_name, char) => {
diff --git a/test/cli/install/wyhash-std-collision.ts b/test/cli/install/wyhash-std-collision.ts
index 37663bb0b513..f8acd1a53ca0 100644
--- a/test/cli/install/wyhash-std-collision.ts
+++ b/test/cli/install/wyhash-std-collision.ts
@@ -120,7 +120,8 @@ export function constructStdCollision(opts: {
   } = opts;
   if (freeA.length !== 8 || freeB.length !== 8) throw new Error("free words must be 8 bytes");
   const csBytes = [...charset].map(c => c.charCodeAt(0));
-  const inSet = new Set(csBytes);
+  const inSet = new Uint8Array(256);
+  for (const b of csBytes) inSet[b] = 1;
   const padCode = padFillCh.charCodeAt(0);
   const prefix = enc(prefixStr);
   const suffix = enc(suffixStr);
@@ -130,26 +131,68 @@ export function constructStdCollision(opts: {
 
   // `prefix + pad` is aligned to a 48-byte boundary, so its rounds are fixed
   // across the search. Process them once and vary only the steer round whose
-  // lane-0 output (state[0]) becomes the required "kill" word. Recomputing just
-  // that one lane per candidate keeps the search allocation-free and fast.
+  // lane-0 output (state[0]) becomes the required "kill" word.
   const baseBlock = new Uint8Array(prefix.length + basePad);
   baseBlock.set(prefix, 0);
   baseBlock.fill(padCode, prefix.length);
   const baseState0 = roundsOver(seed, baseBlock, baseBlock.length / 48)[0];
 
+  // Lane 0 of the steer round reads two words: the first one is the search
+  // counter, written in base charset.length, the second one is fixed. About one
+  // in (256 / charset.length) ** 8 candidates (~9000 tries) yields an in-charset
+  // kill word, and BigInt arithmetic is slow in debug builds of JavaScriptCore,
+  // so the loop below spends as few BigInt operations per candidate as it can:
+  // the counter word is updated incrementally from these per-digit tables
+  // instead of being re-read from bytes, and the lane is mixed inline.
   const steer = new Uint8Array(48);
+  for (let i = 8; i < 16; i++) steer[i] = csBytes[(i * 7) % csBytes.length];
   steer.set(steerTail, 16);
-  for (let extra = 0; extra < maxSteer; extra++) {
-    let t = extra;
-    for (let i = 0; i < 8; i++) {
-      steer[i] = csBytes[t % csBytes.length];
-      t = Math.floor(t / csBytes.length);
+  const fixedWord = (read(8, steer, 8) ^ baseState0) & MASK;
+  const digits = new Uint32Array(8);
+  // step[i][k]: what adding one to digit i (now k - 1) adds to the counter word;
+  // wrap[i]: what resetting digit i from its highest value to 0 adds.
+  const step = Array.from({ length: 8 }, (_, i) =>
+    csBytes.map((b, k) => (k === 0 ? 0n : BigInt(b - csBytes[k - 1]) << BigInt(8 * i))),
+  );
+  const wrap = Array.from({ length: 8 }, (_, i) => BigInt(csBytes[0] - csBytes[csBytes.length - 1]) << BigInt(8 * i));
+  let counterWord = 0n;
+  for (let i = 0; i < 8; i++) counterWord |= BigInt(csBytes[0]) << BigInt(8 * i);
+
+  for (let tries = 0; tries < maxSteer; tries++) {
+    if (tries > 0) {
+      let i = 0;
+      while (true) {
+        if (++digits[i] < csBytes.length) {
+          counterWord += step[i][digits[i]];
+          break;
+        }
+        digits[i] = 0;
+        counterWord += wrap[i];
+        if (++i === 8) throw new Error("search space exhausted");
+      }
+    }
+    // state[0] after the steer round (== mix(counterWord ^ SECRET[1], fixedWord));
+    // it is the kill word the control lane needs, so it must be in-charset.
+    const product = (counterWord ^ SECRET[1]) * fixedWord;
+    const state0 = (product & MASK) ^ (product >> 64n);
+    const low = Number(state0 & 0xffffffffn);
+    const high = Number(state0 >> 32n);
+    if (
+      !(
+        inSet[low & 0xff] &&
+        inSet[(low >>> 8) & 0xff] &&
+        inSet[(low >>> 16) & 0xff] &&
+        inSet[low >>> 24] &&
+        inSet[high & 0xff] &&
+        inSet[(high >>> 8) & 0xff] &&
+        inSet[(high >>> 16) & 0xff] &&
+        inSet[high >>> 24]
+      )
+    ) {
+      continue;
     }
-    for (let i = 8; i < 16; i++) steer[i] = csBytes[(i * 7 + extra) % csBytes.length];
-    // state[0] after the steer round; == the kill word the control lane needs.
-    const state0 = mix((read(8, steer, 0) ^ SECRET[1]) & MASK, (read(8, steer, 8) ^ baseState0) & MASK);
     const killBytes = u64le(state0);
-    if (!killBytes.every(bb => inSet.has(bb))) continue;
+    for (let i = 0; i < 8; i++) steer[i] = csBytes[digits[i]];
 
     const preBlock = new Uint8Array(baseBlock.length + 48);
     preBlock.set(baseBlock, 0);

From cf013256ed2453fde1db159eca60678898b24328 Mon Sep 17 00:00:00 2001
From: robobun <117481402+robobun@users.noreply.github.com>
Date: Mon, 17 Aug 2026 03:13:20 +0000
Subject: [PATCH 172/258] test(install): run bun-install-registry.test.ts
 concurrently and tighten its assertions (#38504)

---
 .../bun-install-registry.test.ts.snap         |    8 -
 test/cli/install/bun-install-registry.test.ts | 1442 ++++++++++-------
 2 files changed, 870 insertions(+), 580 deletions(-)

diff --git a/test/cli/install/__snapshots__/bun-install-registry.test.ts.snap b/test/cli/install/__snapshots__/bun-install-registry.test.ts.snap
index 9d30c8a6e83f..01f7f3b87d18 100644
--- a/test/cli/install/__snapshots__/bun-install-registry.test.ts.snap
+++ b/test/cli/install/__snapshots__/bun-install-registry.test.ts.snap
@@ -1,13 +1,5 @@
 // Bun Snapshot v1, https://bun.sh/docs/test/snapshots
 
-exports[`auto-install symlinks (and junctions) are created correctly in the install cache 1`] = `
-"{
-  name: "is-number",
-  version: "2.0.0",
-}
-"
-`;
-
 exports[`text lockfile workspace sorting 1`] = `
 "{
   "lockfileVersion": 1,
diff --git a/test/cli/install/bun-install-registry.test.ts b/test/cli/install/bun-install-registry.test.ts
index 6a4205704d73..9bd3c15fa6d3 100644
--- a/test/cli/install/bun-install-registry.test.ts
+++ b/test/cli/install/bun-install-registry.test.ts
@@ -5,8 +5,8 @@ import { copyFileSync, existsSync, mkdirSync, readFileSync } from "fs";
 import { cp, exists, lstat, mkdir, readlink, rename, rm, writeFile } from "fs/promises";
 import {
   assertManifestsPopulated,
+  bunEnv,
   bunExe,
-  bunEnv as env,
   isFlaky,
   isLinux,
   isLinux,
@@ -36,32 +36,51 @@ expect.extend({
 
 var registry: VerdaccioRegistry;
 var port: number;
-var packageDir: string;
-/** packageJson = join(packageDir, "package.json"); */
-var packageJson: string;
-
-let users: Record<string, string> = {};
 
 setDefaultTimeout(1000 * 60 * 5);
 registry = new VerdaccioRegistry();
 await registry.start();
 port = registry.port;
 
-afterAll(async () => {
-  await Bun.$`rm -f ${import.meta.dir}/htpasswd`.throws(false);
+afterAll(() => {
   registry.stop();
 });
 
-beforeEach(async () => {
-  ({ packageDir, packageJson } = await registry.createTestDir({
-    bunfigOpts: { saveTextLockfile: false, linker: "hoisted" },
-  }));
-  await Bun.$`rm -f ${import.meta.dir}/htpasswd`.throws(false);
-  await Bun.$`rm -rf ${import.meta.dir}/packages/private-pkg-dont-touch`.throws(false);
-  users = {};
-  env.BUN_INSTALL_CACHE_DIR = join(packageDir, ".bun-cache");
-  env.BUN_TMPDIR = env.TMPDIR = env.TEMP = join(packageDir, ".bun-tmp");
-});
+/**
+ * Every test starts by creating its own project directory (`packageJson` is its `package.json`,
+ * `bunfig.toml` points at the registry) and an `env` whose install cache and temp directory live
+ * inside it. Tests run concurrently (`describe.concurrent` / `test.concurrent`) unless marked
+ * `serial`, so nothing else may be shared between tests. The serial ones use `toMatchSnapshot()`
+ * (not available in concurrent tests), register registry users, or need the registry to be idle.
+ */
+let previousSetup: Promise<void> = Promise.resolve();
+async function setupTest() {
+  // `createTestDir()` also deletes the registry's htpasswd file. When a concurrent group starts,
+  // every test in it calls this at once, and concurrent deletions of the same file fail on Windows
+  // (EFAULT), so the calls are chained. The directory creation itself takes a few milliseconds.
+  const created = previousSetup.then(() =>
+    registry.createTestDir({ bunfigOpts: { saveTextLockfile: false, linker: "hoisted" } }),
+  );
+  previousSetup = created.then(
+    () => {},
+    () => {},
+  );
+  const { packageDir, packageJson } = await created;
+  const tmpDir = join(packageDir, ".bun-tmp");
+  const env: NodeJS.Dict<string> = {
+    ...bunEnv,
+    BUN_INSTALL_CACHE_DIR: join(packageDir, ".bun-cache"),
+    BUN_TMPDIR: tmpDir,
+    TMPDIR: tmpDir,
+    TEMP: tmpDir,
+  };
+  return { packageDir, packageJson, env };
+}
+
+// Assigned per test by the sequential tests that share describe-level helpers; concurrent tests keep their own.
+let packageDir: string;
+let packageJson: string;
+let env: NodeJS.Dict<string>;
 
 function registryUrl() {
   return registry.registryUrl();
@@ -70,36 +89,13 @@ function registryUrl() {
 /**
  * Returns auth token
  */
-async function generateRegistryUser(username: string, password: string): Promise<string> {
-  if (users[username]) {
-    throw new Error("that user already exists");
-  } else users[username] = password;
-
-  const url = `http://localhost:${port}/-/user/org.couchdb.user:${username}`;
-  const user = {
-    name: username,
-    password: password,
-    email: `${username}@example.com`,
-  };
-
-  const response = await fetch(url, {
-    method: "PUT",
-    headers: {
-      "Content-Type": "application/json",
-    },
-    body: JSON.stringify(user),
-  });
-
-  if (response.ok) {
-    const data = await response.json();
-    return data.token;
-  } else {
-    throw new Error("Failed to create user:", response.statusText);
-  }
+function generateRegistryUser(username: string, password: string): Promise<string> {
+  return registry.generateUser(username, password);
 }
 
-describe("auto-install", () => {
+describe.concurrent("auto-install", () => {
   test("symlinks (and junctions) are created correctly in the install cache", async () => {
+    const { packageDir, env } = await setupTest();
     const { stdout, stderr, exited } = spawn({
       cmd: [bunExe(), "--print", "require('is-number')"],
       cwd: packageDir,
@@ -112,7 +108,13 @@ describe("auto-install", () => {
     });
 
     const out = await stdout.text();
-    expect(out).toMatchSnapshot();
+    expect(out).toMatchInlineSnapshot(`
+      "{
+        name: "is-number",
+        version: "2.0.0",
+      }
+      "
+    `);
     const err = await stderr.text();
     expect(err).not.toContain("error:");
     expect(await exited).toBe(0);
@@ -123,7 +125,7 @@ describe("auto-install", () => {
   });
 });
 
-describe("certificate authority", () => {
+describe.concurrent("certificate authority", () => {
   const mockRegistryFetch = function (opts?: any): (req: Request) => Promise<Response> {
     return async function (req: Request) {
       if (req.url.includes("no-deps")) {
@@ -133,6 +135,7 @@ describe("certificate authority", () => {
     };
   };
   test("valid --cafile", async () => {
+    const { packageDir, packageJson, env } = await setupTest();
     using server = Bun.serve({
       port: 0,
       fetch: mockRegistryFetch(),
@@ -177,6 +180,7 @@ describe("certificate authority", () => {
     expect(await exited).toBe(0);
   });
   test("valid --ca", async () => {
+    const { packageDir, packageJson, env } = await setupTest();
     using server = Bun.serve({
       port: 0,
       fetch: mockRegistryFetch(),
@@ -233,6 +237,7 @@ describe("certificate authority", () => {
     expect(await exited).toBe(0);
   });
   test(`non-existent --cafile`, async () => {
+    const { packageDir, packageJson, env } = await setupTest();
     await write(packageJson, JSON.stringify({ name: "foo", version: "1.0.0", "dependencies": { "no-deps": "1.1.1" } }));
 
     const { stdout, stderr, exited } = spawn({
@@ -250,6 +255,7 @@ describe("certificate authority", () => {
   });
 
   test("non-existent --cafile (absolute path)", async () => {
+    const { packageDir, packageJson, env } = await setupTest();
     await write(packageJson, JSON.stringify({ name: "foo", version: "1.0.0", "dependencies": { "no-deps": "1.1.1" } }));
     const { stdout, stderr, exited } = spawn({
       cmd: [bunExe(), "install", "--cafile", "/does/not/exist"],
@@ -266,6 +272,7 @@ describe("certificate authority", () => {
   });
 
   test("non-existent --cafile with workspaces exits 1 without crashing", async () => {
+    const { packageDir, packageJson, env } = await setupTest();
     // The workspace walk in `PackageManager::init()` populates the workspace
     // package.json cache before the HTTP thread starts. When the HTTP thread
     // then fails CA validation and drives process exit, the exit path must not
@@ -302,6 +309,7 @@ describe("certificate authority", () => {
   });
 
   test("cafile from bunfig does not exist", async () => {
+    const { packageDir, packageJson, env } = await setupTest();
     await Promise.all([
       write(
         packageJson,
@@ -340,6 +348,7 @@ describe("certificate authority", () => {
     expect(await exited).toBe(1);
   });
   test("invalid cafile", async () => {
+    const { packageDir, packageJson, env } = await setupTest();
     await Promise.all([
       write(
         packageJson,
@@ -377,6 +386,7 @@ ljelkjwelkgjw;lekj;lkejflkj
     expect(await exited).toBe(1);
   });
   test("invalid --ca", async () => {
+    const { packageDir, packageJson, env } = await setupTest();
     await write(
       packageJson,
       JSON.stringify({
@@ -403,8 +413,11 @@ ljelkjwelkgjw;lekj;lkejflkj
   });
 });
 
-describe("whoami", async () => {
+// Registering a user writes to the registry's htpasswd file, which `setupTest()` resets, so these
+// cannot overlap with each other.
+describe.serial("whoami", async () => {
   test("can get username", async () => {
+    const { packageDir, packageJson, env } = await setupTest();
     const bunfig = await registry.authBunfig("whoami");
     await Promise.all([
       write(
@@ -432,6 +445,7 @@ describe("whoami", async () => {
     expect(await exited).toBe(0);
   });
   test("username from .npmrc", async () => {
+    const { packageDir, packageJson, env } = await setupTest();
     // It should report the username from npmrc, even without an account
     const bunfig = Bun.TOML.stringify({
       install: {
@@ -464,6 +478,7 @@ describe("whoami", async () => {
     expect(await exited).toBe(0);
   });
   test("only .npmrc", async () => {
+    const { packageDir, packageJson, env } = await setupTest();
     const token = await generateRegistryUser("whoami-npmrc", "whoami-npmrc");
     const npmrc = `
     //localhost:${port}/:_authToken=${token}
@@ -486,6 +501,7 @@ describe("whoami", async () => {
     expect(await exited).toBe(0);
   });
   test("two .npmrc", async () => {
+    const { packageDir, packageJson, env } = await setupTest();
     const token = await generateRegistryUser("whoami-two-npmrc", "whoami-two-npmrc");
     const packageNpmrc = `registry=http://localhost:${port}/`;
     const homeNpmrc = `//localhost:${port}/:_authToken=${token}`;
@@ -513,6 +529,7 @@ describe("whoami", async () => {
     expect(await exited).toBe(0);
   });
   test("not logged in", async () => {
+    const { packageDir, packageJson, env } = await setupTest();
     await write(packageJson, JSON.stringify({ name: "whoami-pkg", version: "1.1.1" }));
     const { stdout, stderr, exited } = spawn({
       cmd: [bunExe(), "pm", "whoami"],
@@ -528,6 +545,7 @@ describe("whoami", async () => {
     expect(await exited).toBe(1);
   });
   test("invalid token", async () => {
+    const { packageDir, packageJson, env } = await setupTest();
     // create the user and provide an invalid token
     const token = await generateRegistryUser("invalid-token", "invalid-token");
     const bunfig = Bun.TOML.stringify({
@@ -556,8 +574,9 @@ describe("whoami", async () => {
   });
 });
 
-describe("package.json indentation", async () => {
+describe.concurrent("package.json indentation", async () => {
   test("works for root and workspace packages", async () => {
+    const { packageDir, packageJson, env } = await setupTest();
     await Promise.all([
       // 5 space indentation
       write(packageJson, `\n{\n\n     "name": "foo",\n"workspaces": ["packages/*"]\n}`),
@@ -565,15 +584,19 @@ describe("package.json indentation", async () => {
       write(join(packageDir, "packages", "bar", "package.json"), `\n{\n\n\t"name": "bar",\n}`),
     ]);
 
-    let { exited } = spawn({
+    let { stdout, stderr, exited } = spawn({
       cmd: [bunExe(), "add", "no-deps"],
       cwd: packageDir,
-      stdout: "ignore",
-      stderr: "ignore",
+      stdout: "pipe",
+      stderr: "pipe",
       env,
     });
 
-    expect(await exited).toBe(0);
+    let [out, err, exitCode] = await Promise.all([stdout.text(), stderr.text(), exited]);
+    expect(err).toContain("Saved lockfile");
+    expect(err).not.toContain("error:");
+    expect(out).toContain("installed no-deps@2.0.0");
+    expect(exitCode).toBe(0);
     assertManifestsPopulated(join(packageDir, ".bun-cache"), registryUrl());
 
     const rootPackageJson = await file(packageJson).text();
@@ -583,15 +606,19 @@ describe("package.json indentation", async () => {
     );
 
     // now add to workspace. it should keep tab indentation
-    ({ exited } = spawn({
+    ({ stdout, stderr, exited } = spawn({
       cmd: [bunExe(), "add", "no-deps"],
       cwd: join(packageDir, "packages", "bar"),
-      stdout: "inherit",
-      stderr: "inherit",
+      stdout: "pipe",
+      stderr: "pipe",
       env,
     }));
 
-    expect(await exited).toBe(0);
+    [out, err, exitCode] = await Promise.all([stdout.text(), stderr.text(), exited]);
+    expect(err).toContain("Saved lockfile");
+    expect(err).not.toContain("error:");
+    expect(out).toContain("installed no-deps@2.0.0");
+    expect(exitCode).toBe(0);
     assertManifestsPopulated(join(packageDir, ".bun-cache"), registryUrl());
 
     expect(await file(packageJson).text()).toBe(rootPackageJson);
@@ -600,21 +627,27 @@ describe("package.json indentation", async () => {
   });
 
   test("install maintains indentation", async () => {
+    const { packageDir, packageJson, env } = await setupTest();
     await write(packageJson, `{\n  "dependencies": {}\n  }\n`);
-    let { exited } = spawn({
+    const { stdout, stderr, exited } = spawn({
       cmd: [bunExe(), "add", "no-deps"],
       cwd: packageDir,
-      stdout: "ignore",
-      stderr: "ignore",
+      stdout: "pipe",
+      stderr: "pipe",
       env,
     });
-    expect(await exited).toBe(0);
+    const [out, err, exitCode] = await Promise.all([stdout.text(), stderr.text(), exited]);
+    expect(err).toContain("Saved lockfile");
+    expect(err).not.toContain("error:");
+    expect(out).toContain("installed no-deps@2.0.0");
+    expect(exitCode).toBe(0);
     expect(await file(packageJson).text()).toBe(`{\n  "dependencies": {\n    "no-deps": "^2.0.0"\n  }\n}\n`);
   });
 });
 
-describe("text lockfile", () => {
-  test("workspace sorting", async () => {
+describe.concurrent("text lockfile", () => {
+  test.serial("workspace sorting", async () => {
+    const { packageDir, env } = await setupTest();
     await Promise.all([
       write(
         join(packageDir, "package.json"),
@@ -685,7 +718,8 @@ describe("text lockfile", () => {
     expect(lockfile.replaceAll(/localhost:\d+/g, "localhost:1234")).toMatchSnapshot();
   });
 
-  test("--frozen-lockfile", async () => {
+  test.serial("--frozen-lockfile", async () => {
+    const { packageDir, env } = await setupTest();
     await Promise.all([
       write(
         join(packageDir, "package.json"),
@@ -754,6 +788,7 @@ describe("text lockfile", () => {
 
   for (const omit of ["dev", "peer", "optional"]) {
     test(`resolvable lockfile with ${omit} dependencies disabled`, async () => {
+      const { packageDir, env } = await setupTest();
       await Promise.all([
         write(
           join(packageDir, "package.json"),
@@ -811,6 +846,7 @@ describe("text lockfile", () => {
   }
 
   test("optionalPeers", async () => {
+    const { packageDir, packageJson, env } = await setupTest();
     await Promise.all([
       write(
         packageJson,
@@ -872,7 +908,8 @@ describe("text lockfile", () => {
   });
 });
 
-test("--lockfile-only", async () => {
+test.concurrent("--lockfile-only", async () => {
+  const { packageDir, packageJson, env } = await setupTest();
   await Promise.all([
     write(
       packageJson,
@@ -959,6 +996,7 @@ describe("frozen lockfile", () => {
   }
 
   test("CI=1 does not imply --frozen-lockfile: an out-of-date bun.lock is rewritten", async () => {
+    ({ packageDir, packageJson, env } = await setupTest());
     await write(packageJson, JSON.stringify({ name: "foo", dependencies: { "no-deps": "1.0.0" } }));
 
     let { err, exitCode } = await runInstall(["--save-text-lockfile"], { CI: "1" });
@@ -986,6 +1024,7 @@ describe("frozen lockfile", () => {
   });
 
   test("--frozen-lockfile without a lockfile installs and writes no lockfile", async () => {
+    ({ packageDir, packageJson, env } = await setupTest());
     await write(packageJson, JSON.stringify({ name: "foo", dependencies: { "no-deps": "1.0.0" } }));
 
     const { out, err, exitCode } = await runInstall(["--frozen-lockfile"]);
@@ -1002,6 +1041,7 @@ describe("frozen lockfile", () => {
   });
 
   test("bunfig [install] production = true treats bun.lock as frozen", async () => {
+    ({ packageDir, packageJson, env } = await setupTest());
     await write(
       packageJson,
       JSON.stringify({ name: "foo", dependencies: { "no-deps": "1.0.0" }, devDependencies: { "a-dep": "1.0.1" } }),
@@ -1046,9 +1086,37 @@ describe("frozen lockfile", () => {
   });
 });
 
-describe("bundledDependencies", () => {
+describe.concurrent("bundledDependencies", () => {
+  async function install(packageDir: string, env: NodeJS.Dict<string>, args: string[]) {
+    const { stdout, stderr, exited } = spawn({
+      cmd: [bunExe(), "install", ...args],
+      cwd: packageDir,
+      stdout: "pipe",
+      stderr: "pipe",
+      env,
+    });
+    const [out, err, exitCode] = await Promise.all([stdout.text(), stderr.text(), exited]);
+    expect(err).not.toContain("error:");
+    expect(exitCode).toBe(0);
+    return { out, err };
+  }
+
+  async function installSavingLockfile(packageDir: string, env: NodeJS.Dict<string>, textLockfile: boolean) {
+    const { err } = await install(packageDir, env, textLockfile ? ["--save-text-lockfile"] : []);
+    expect(err).toContain("Saved lockfile");
+    expect(await exists(join(packageDir, textLockfile ? "bun.lock" : "bun.lockb"))).toBeTrue();
+  }
+
+  // Installing again from the lockfile must not touch the bundled packages.
+  async function expectReinstallIsNoop(packageDir: string, env: NodeJS.Dict<string>) {
+    const { out, err } = await install(packageDir, env, []);
+    expect(err).not.toContain("Saved lockfile");
+    expect(out).toMatch(/Checked \d+ installs? across \d+ packages \(no changes\)/);
+  }
+
   for (const textLockfile of [true, false]) {
     test(`(${textLockfile ? "bun.lock" : "bun.lockb"}) basic`, async () => {
+      const { packageDir, packageJson, env } = await setupTest();
       await Promise.all([
         write(
           packageJson,
@@ -1062,16 +1130,7 @@ describe("bundledDependencies", () => {
         ),
       ]);
 
-      const cmd = textLockfile ? [bunExe(), "install", "--save-text-lockfile"] : [bunExe(), "install"];
-      let { exited } = spawn({
-        cmd,
-        cwd: packageDir,
-        stdout: "ignore",
-        stderr: "ignore",
-        env,
-      });
-
-      expect(await exited).toBe(0);
+      await installSavingLockfile(packageDir, env, textLockfile);
 
       expect(
         await Promise.all([
@@ -1080,15 +1139,7 @@ describe("bundledDependencies", () => {
         ]),
       ).toEqual([false, true]);
 
-      ({ exited } = spawn({
-        cmd: [bunExe(), "install"],
-        cwd: packageDir,
-        stdout: "ignore",
-        stderr: "ignore",
-        env,
-      }));
-
-      expect(await exited).toBe(0);
+      await expectReinstallIsNoop(packageDir, env);
 
       expect(
         await Promise.all([
@@ -1099,6 +1150,7 @@ describe("bundledDependencies", () => {
     });
 
     test(`(${textLockfile ? "bun.lock" : "bun.lockb"}) bundledDependencies === true`, async () => {
+      const { packageDir, packageJson, env } = await setupTest();
       await Promise.all([
         write(
           packageJson,
@@ -1112,16 +1164,7 @@ describe("bundledDependencies", () => {
         ),
       ]);
 
-      const cmd = textLockfile ? [bunExe(), "install", "--save-text-lockfile"] : [bunExe(), "install"];
-      let { exited } = spawn({
-        cmd,
-        cwd: packageDir,
-        stdout: "ignore",
-        stderr: "ignore",
-        env,
-      });
-
-      expect(await exited).toBe(0);
+      await installSavingLockfile(packageDir, env, textLockfile);
 
       async function check() {
         return Promise.all([
@@ -1146,20 +1189,13 @@ describe("bundledDependencies", () => {
 
       expect(await check()).toEqual([false, false, true, true, true]);
 
-      ({ exited } = spawn({
-        cmd: [bunExe(), "install"],
-        cwd: packageDir,
-        stdout: "ignore",
-        stderr: "ignore",
-        env,
-      }));
-
-      expect(await exited).toBe(0);
+      await expectReinstallIsNoop(packageDir, env);
 
       expect(await check()).toEqual([false, false, true, true, true]);
     });
 
     test(`(${textLockfile ? "bun.lock" : "bun.lockb"}) transitive bundled dependency collision`, async () => {
+      const { packageDir, packageJson, env } = await setupTest();
       // Install a package with one bundled dependency and one regular dependency.
       // The bundled dependency has a transitive dependency of the same regular dependency,
       // but at a different version. Test that the regular dependency does not replace the
@@ -1180,16 +1216,7 @@ describe("bundledDependencies", () => {
         ),
       ]);
 
-      const cmd = textLockfile ? [bunExe(), "install", "--save-text-lockfile"] : [bunExe(), "install"];
-      let { exited } = spawn({
-        cmd,
-        cwd: packageDir,
-        stdout: "ignore",
-        stderr: "ignore",
-        env,
-      });
-
-      expect(await exited).toBe(0);
+      await installSavingLockfile(packageDir, env, textLockfile);
 
       async function check() {
         expect(
@@ -1222,20 +1249,13 @@ describe("bundledDependencies", () => {
 
       await check();
 
-      ({ exited } = spawn({
-        cmd: [bunExe(), "install"],
-        cwd: packageDir,
-        stdout: "ignore",
-        stderr: "ignore",
-        env,
-      }));
-
-      expect(await exited).toBe(0);
+      await expectReinstallIsNoop(packageDir, env);
 
       await check();
     });
 
     test(`(${textLockfile ? "bun.lock" : "bun.lockb"}) bundled names from dependencies and optionalDependencies`, async () => {
+      const { packageDir, packageJson, env } = await setupTest();
       // bundled-with-optional@1.0.0 has dependencies { no-deps }, optionalDependencies { a-dep, basic-1 }
       // and bundleDependencies [no-deps, a-dep, not-a-dependency]. Its tarball ships no-deps and a-dep.
       // Only basic-1 should be installed from the registry; not-a-dependency is declared in no group
@@ -1309,6 +1329,7 @@ describe("bundledDependencies", () => {
     });
 
     test(`(${textLockfile ? "bun.lock" : "bun.lockb"}) bundled name declared in peerDependencies`, async () => {
+      const { packageDir, packageJson, env } = await setupTest();
       // bundled-peer@1.0.0 has peerDependencies { no-deps } and bundleDependencies [no-deps], and its
       // tarball ships no-deps. The peer is satisfied by the bundled copy, so nothing else is installed.
       await write(
@@ -1369,6 +1390,7 @@ describe("bundledDependencies", () => {
     });
 
     test(`(${textLockfile ? "bun.lock" : "bun.lockb"}) git dependencies`, async () => {
+      const { packageDir, packageJson, env } = await setupTest();
       await Promise.all([
         write(
           packageJson,
@@ -1382,26 +1404,20 @@ describe("bundledDependencies", () => {
             },
           }),
         ),
+        // Both git packages depend on `zod`, which the local registry does not have: even though it is
+        // bundled, bun still resolves it, so this test has to use the default registry.
         write(
           join(packageDir, "bunfig.toml"),
           Bun.TOML.stringify({
             install: {
               cache: join(packageDir, ".bun-cache"),
+              saveTextLockfile: false,
             },
           }),
         ),
       ]);
 
-      const cmd = textLockfile ? [bunExe(), "install", "--save-text-lockfile"] : [bunExe(), "install"];
-      let { exited } = spawn({
-        cmd,
-        cwd: packageDir,
-        stdout: "ignore",
-        stderr: "ignore",
-        env,
-      });
-
-      expect(await exited).toBe(0);
+      await installSavingLockfile(packageDir, env, textLockfile);
 
       async function check() {
         expect(
@@ -1415,20 +1431,13 @@ describe("bundledDependencies", () => {
 
       await check();
 
-      ({ exited } = spawn({
-        cmd: [bunExe(), "install"],
-        cwd: packageDir,
-        stdout: "ignore",
-        stderr: "ignore",
-        env,
-      }));
-
-      expect(await exited).toBe(0);
+      await expectReinstallIsNoop(packageDir, env);
 
       await check();
     });
 
     test(`(${textLockfile ? "bun.lock" : "bun.lockb"}) workspace dependencies bundle correctly`, async () => {
+      const { packageDir, packageJson, env } = await setupTest();
       await Promise.all([
         write(
           packageJson,
@@ -1450,16 +1459,7 @@ describe("bundledDependencies", () => {
         ),
       ]);
 
-      const cmd = textLockfile ? [bunExe(), "install", "--save-text-lockfile"] : [bunExe(), "install"];
-      let { exited } = spawn({
-        cmd,
-        cwd: packageDir,
-        stdout: "ignore",
-        stderr: "ignore",
-        env,
-      });
-
-      expect(await exited).toBe(0);
+      await installSavingLockfile(packageDir, env, textLockfile);
 
       async function check() {
         expect(
@@ -1473,24 +1473,17 @@ describe("bundledDependencies", () => {
 
       await check();
 
-      ({ exited } = spawn({
-        cmd: [bunExe(), "install"],
-        cwd: packageDir,
-        stdout: "ignore",
-        stderr: "ignore",
-        env,
-      }));
-
-      expect(await exited).toBe(0);
+      await expectReinstallIsNoop(packageDir, env);
 
       await check();
     });
   }
 });
 
-describe("optionalDependencies", () => {
+describe.concurrent("optionalDependencies", () => {
   for (const optional of [true, false]) {
     test(`exit code is ${optional ? 0 : 1} when ${optional ? "optional" : ""} dependency tarball is missing`, async () => {
+      const { packageDir, packageJson, env } = await setupTest();
       await write(
         packageJson,
         JSON.stringify({
@@ -1520,6 +1513,7 @@ describe("optionalDependencies", () => {
 
   for (const rootOptional of [true, false]) {
     test(`exit code is 0 when ${rootOptional ? "root" : ""} optional dependency does not exist in registry`, async () => {
+      const { packageDir, packageJson, env } = await setupTest();
       await write(
         packageJson,
         JSON.stringify({
@@ -1540,6 +1534,7 @@ describe("optionalDependencies", () => {
     });
   }
   test("should not install optional deps if false in bunfig", async () => {
+    const { packageDir, packageJson, env } = await setupTest();
     await writeFile(
       join(packageDir, "bunfig.toml"),
       Bun.TOML.stringify({
@@ -1595,6 +1590,7 @@ describe("optionalDependencies", () => {
   });
 
   test("lifecycle scripts failures from transitive dependencies are ignored", async () => {
+    const { packageDir, packageJson, env } = await setupTest();
     // Dependency with a transitive optional dependency that fails during its preinstall script.
     await write(
       packageJson,
@@ -1623,7 +1619,8 @@ describe("optionalDependencies", () => {
   });
 });
 
-test("it should ignore peerDependencies within workspaces", async () => {
+test.serial("it should ignore peerDependencies within workspaces", async () => {
+  const { packageDir, packageJson, env } = await setupTest();
   await Promise.all([
     write(
       packageJson,
@@ -1667,28 +1664,83 @@ test("it should ignore peerDependencies within workspaces", async () => {
   expect(await readdirSorted(join(packageDir, "node_modules"))).toEqual(["Baz", "a-dep", "no-deps"]);
 });
 
-test("disabled dev/peer/optional dependencies are still included in the lockfile", async () => {
-  await Promise.all([
-    write(
-      packageJson,
-      JSON.stringify({
-        devDependencies: {
-          "no-deps": "1.0.0",
-        },
-        peerDependencies: {
-          "a-dep": "1.0.1",
-        },
-        optionalDependencies: {
-          "basic-1": "1.0.0",
-        },
-      }),
-    ),
+test.concurrent("disabled dev/peer/optional dependencies are still included in the lockfile", async () => {
+  const { packageDir, packageJson, env } = await setupTest();
+  await write(
+    packageJson,
+    JSON.stringify({
+      name: "foo",
+      devDependencies: {
+        "no-deps": "1.0.0",
+      },
+      peerDependencies: {
+        "a-dep": "1.0.1",
+      },
+      optionalDependencies: {
+        "basic-1": "1.0.0",
+      },
+    }),
+  );
+
+  let { stdout, stderr, exited } = spawn({
+    cmd: [bunExe(), "install", "--save-text-lockfile", "--omit=dev", "--omit=peer", "--omit=optional"],
+    cwd: packageDir,
+    stdout: "pipe",
+    stderr: "pipe",
+    env,
+  });
+
+  let [out, err, exitCode] = await Promise.all([stdout.text(), stderr.text(), exited]);
+  expect(err).toContain("Saved lockfile");
+  expect(err).not.toContain("error:");
+  // nothing to install, so there is no summary
+  expect(out.split(/\r?\n/)).toEqual([
+    expect.stringContaining("bun install v1."),
+    "",
+    expect.stringMatching(/^\[[0-9.]+m?s\] done$/),
+    "",
+  ]);
+  expect(exitCode).toBe(0);
+
+  expect(await readdirSorted(join(packageDir, "node_modules"))).toEqual([]);
+
+  const lockfile = (await file(join(packageDir, "bun.lock")).text()).replaceAll(/localhost:\d+/g, "localhost:1234");
+  expect(lockfile).toContain('"no-deps": ["no-deps@1.0.0",');
+  expect(lockfile).toContain('"a-dep": ["a-dep@1.0.1",');
+  expect(lockfile).toContain('"basic-1": ["basic-1@1.0.0",');
+
+  // the same lockfile resolves everything once the dependency groups are enabled again
+  ({ stdout, stderr, exited } = spawn({
+    cmd: [bunExe(), "install"],
+    cwd: packageDir,
+    stdout: "pipe",
+    stderr: "pipe",
+    env,
+  }));
+
+  [out, err, exitCode] = await Promise.all([stdout.text(), stderr.text(), exited]);
+  expect(err).not.toContain("Saved lockfile");
+  expect(err).not.toContain("error:");
+  // the summary follows the lockfile's order: devDependencies, optionalDependencies, peerDependencies
+  expect(out.replace(/\s*\[[0-9\.]+m?s\]\s*$/, "").split(/\r?\n/)).toEqual([
+    expect.stringContaining("bun install v1."),
+    "",
+    "+ no-deps@1.0.0",
+    "+ basic-1@1.0.0",
+    "+ a-dep@1.0.1",
+    "",
+    "3 packages installed",
   ]);
+  expect(exitCode).toBe(0);
 
-  await runBunInstall;
+  expect(await readdirSorted(join(packageDir, "node_modules"))).toEqual(["a-dep", "basic-1", "no-deps"]);
+  expect((await file(join(packageDir, "bun.lock")).text()).replaceAll(/localhost:\d+/g, "localhost:1234")).toBe(
+    lockfile,
+  );
 });
 
-test("tarball override does not crash", async () => {
+test.concurrent("tarball override does not crash", async () => {
+  const { packageDir, packageJson, env } = await setupTest();
   await write(
     packageJson,
     JSON.stringify({
@@ -1712,7 +1764,7 @@ test("tarball override does not crash", async () => {
   });
 });
 
-describe.each(["--production", "without --production"])("%s", flag => {
+describe.concurrent.each(["--production", "without --production"])("%s", flag => {
   const prod = flag === "--production";
   const order = ["devDependencies", "dependencies"];
   // const stdio = process.versions.bun.includes("debug") ? "inherit" : "ignore";
@@ -1720,6 +1772,7 @@ describe.each(["--production", "without --production"])("%s", flag => {
 
   if (prod) {
     test("modifying package.json with --production should not save lockfile", async () => {
+      const { packageDir, packageJson, env } = await setupTest();
       await writeFile(
         packageJson,
         JSON.stringify({
@@ -1817,6 +1870,7 @@ describe.each(["--production", "without --production"])("%s", flag => {
   }
 
   test(`should prefer ${order[+prod % 2]} over ${order[1 - (+prod % 2)]}`, async () => {
+    const { packageDir, packageJson, env } = await setupTest();
     await writeFile(
       packageJson,
       JSON.stringify({
@@ -1911,7 +1965,8 @@ describe.each(["--production", "without --production"])("%s", flag => {
   });
 });
 
-test("hardlinks on windows dont fail with long paths", async () => {
+test.concurrent("hardlinks on windows dont fail with long paths", async () => {
+  const { packageDir, packageJson, env } = await setupTest();
   await mkdir(join(packageDir, "a-package"));
   await writeFile(
     join(packageDir, "a-package", "package.json"),
@@ -1958,7 +2013,8 @@ test("hardlinks on windows dont fail with long paths", async () => {
   assertManifestsPopulated(join(packageDir, ".bun-cache"), registryUrl());
 });
 
-test("basic 1", async () => {
+test.concurrent("basic 1", async () => {
+  const { packageDir, packageJson, env } = await setupTest();
   await writeFile(
     packageJson,
     JSON.stringify({
@@ -2024,7 +2080,8 @@ test("basic 1", async () => {
   assertManifestsPopulated(join(packageDir, ".bun-cache"), registryUrl());
 });
 
-test("manifest cache will invalidate when registry changes", async () => {
+test.concurrent("manifest cache will invalidate when registry changes", async () => {
+  const { packageDir, packageJson, env } = await setupTest();
   const cacheDir = join(packageDir, ".bun-cache");
   await Promise.all([
     write(
@@ -2082,7 +2139,8 @@ test("manifest cache will invalidate when registry changes", async () => {
   }
 });
 
-test("dependency from root satisfies range from dependency", async () => {
+test.concurrent("dependency from root satisfies range from dependency", async () => {
+  const { packageDir, packageJson, env } = await setupTest();
   await writeFile(
     packageJson,
     JSON.stringify({
@@ -2152,7 +2210,8 @@ test("dependency from root satisfies range from dependency", async () => {
   assertManifestsPopulated(join(packageDir, ".bun-cache"), registryUrl());
 });
 
-test("duplicate names and versions in a manifest do not install incorrect packages", async () => {
+test.concurrent("duplicate names and versions in a manifest do not install incorrect packages", async () => {
+  const { packageDir, packageJson, env } = await setupTest();
   /**
    * `duplicate-name-and-version` has two versions:
    *   1.0.1:
@@ -2199,7 +2258,7 @@ test("duplicate names and versions in a manifest do not install incorrect packag
   ]);
 });
 
-describe("peerDependency index out of bounds", async () => {
+describe.concurrent("peerDependency index out of bounds", async () => {
   // Test for "index of out bounds" errors with peer dependencies when adding/removing a package
   //
   // Repro:
@@ -2214,6 +2273,7 @@ describe("peerDependency index out of bounds", async () => {
     for (const secondDep of dependencies) {
       if (firstDep === secondDep) continue;
       test(`replacing ${firstDep} with ${secondDep}`, async () => {
+        const { packageDir, packageJson, env } = await setupTest();
         await write(
           packageJson,
           JSON.stringify({
@@ -2281,6 +2341,7 @@ describe("peerDependency index out of bounds", async () => {
   // internally, testing for index out of bounds. It's also important cache is deleted to ensure a tarball
   // task is created for it.
   test("optional", async () => {
+    const { packageDir, packageJson, env } = await setupTest();
     await write(
       packageJson,
       JSON.stringify({
@@ -2320,90 +2381,95 @@ describe("peerDependency index out of bounds", async () => {
   });
 });
 
-test("peerDependency in child npm dependency should not maintain old version when package is upgraded", async () => {
-  await writeFile(
-    packageJson,
-    JSON.stringify({
-      name: "foo",
-      version: "1.0.0",
-      dependencies: {
-        "peer-deps-fixed": "1.0.0",
-        "no-deps": "1.0.0",
-      },
-    }),
-  );
-
-  var { stdout, stderr, exited } = spawn({
-    cmd: [bunExe(), "install"],
-    cwd: packageDir,
-    stdout: "pipe",
-    stdin: "pipe",
-    stderr: "pipe",
-    env,
-  });
+test.concurrent(
+  "peerDependency in child npm dependency should not maintain old version when package is upgraded",
+  async () => {
+    const { packageDir, packageJson, env } = await setupTest();
+    await writeFile(
+      packageJson,
+      JSON.stringify({
+        name: "foo",
+        version: "1.0.0",
+        dependencies: {
+          "peer-deps-fixed": "1.0.0",
+          "no-deps": "1.0.0",
+        },
+      }),
+    );
 
-  var err = await stderr.text();
-  var out = await stdout.text();
-  expect(err).toContain("Saved lockfile");
-  expect(err).not.toContain("not found");
-  expect(err).not.toContain("error:");
-  expect(out.replace(/\s*\[[0-9\.]+m?s\]\s*$/, "").split(/\r?\n/)).toEqual([
-    expect.stringContaining("bun install v1."),
-    "",
-    expect.stringContaining("+ no-deps@1.0.0"),
-    "+ peer-deps-fixed@1.0.0",
-    "",
-    "2 packages installed",
-  ]);
-  expect(await file(join(packageDir, "node_modules", "no-deps", "package.json")).json()).toEqual({
-    name: "no-deps",
-    version: "1.0.0",
-  } as any);
-  expect(await exited).toBe(0);
-  assertManifestsPopulated(join(packageDir, ".bun-cache"), registryUrl());
+    var { stdout, stderr, exited } = spawn({
+      cmd: [bunExe(), "install"],
+      cwd: packageDir,
+      stdout: "pipe",
+      stdin: "pipe",
+      stderr: "pipe",
+      env,
+    });
 
-  await writeFile(
-    packageJson,
-    JSON.stringify({
-      name: "foo",
+    var err = await stderr.text();
+    var out = await stdout.text();
+    expect(err).toContain("Saved lockfile");
+    expect(err).not.toContain("not found");
+    expect(err).not.toContain("error:");
+    expect(out.replace(/\s*\[[0-9\.]+m?s\]\s*$/, "").split(/\r?\n/)).toEqual([
+      expect.stringContaining("bun install v1."),
+      "",
+      expect.stringContaining("+ no-deps@1.0.0"),
+      "+ peer-deps-fixed@1.0.0",
+      "",
+      "2 packages installed",
+    ]);
+    expect(await file(join(packageDir, "node_modules", "no-deps", "package.json")).json()).toEqual({
+      name: "no-deps",
       version: "1.0.0",
-      dependencies: {
-        "peer-deps-fixed": "1.0.0",
-        "no-deps": "1.0.1", // upgrade the package
-      },
-    }),
-  );
+    } as any);
+    expect(await exited).toBe(0);
+    assertManifestsPopulated(join(packageDir, ".bun-cache"), registryUrl());
 
-  ({ stdout, stderr, exited } = spawn({
-    cmd: [bunExe(), "install"],
-    cwd: packageDir,
-    stdout: "pipe",
-    stdin: "pipe",
-    stderr: "pipe",
-    env,
-  }));
+    await writeFile(
+      packageJson,
+      JSON.stringify({
+        name: "foo",
+        version: "1.0.0",
+        dependencies: {
+          "peer-deps-fixed": "1.0.0",
+          "no-deps": "1.0.1", // upgrade the package
+        },
+      }),
+    );
 
-  err = await stderr.text();
-  out = await stdout.text();
-  expect(err).not.toContain("not found");
-  expect(err).not.toContain("error:");
-  expect(await file(join(packageDir, "node_modules", "no-deps", "package.json")).json()).toEqual({
-    name: "no-deps",
-    version: "1.0.1",
-  } as any);
-  expect(await exists(join(packageDir, "node_modules", "peer-deps-fixed", "node_modules"))).toBeFalse();
-  expect(out.replace(/\s*\[[0-9\.]+m?s\]\s*$/, "").split(/\r?\n/)).toEqual([
-    expect.stringContaining("bun install v1."),
-    "",
-    expect.stringContaining("+ no-deps@1.0.1"),
-    "",
-    "1 package installed",
-  ]);
-  expect(await exited).toBe(0);
-  assertManifestsPopulated(join(packageDir, ".bun-cache"), registryUrl());
-});
+    ({ stdout, stderr, exited } = spawn({
+      cmd: [bunExe(), "install"],
+      cwd: packageDir,
+      stdout: "pipe",
+      stdin: "pipe",
+      stderr: "pipe",
+      env,
+    }));
+
+    err = await stderr.text();
+    out = await stdout.text();
+    expect(err).not.toContain("not found");
+    expect(err).not.toContain("error:");
+    expect(await file(join(packageDir, "node_modules", "no-deps", "package.json")).json()).toEqual({
+      name: "no-deps",
+      version: "1.0.1",
+    } as any);
+    expect(await exists(join(packageDir, "node_modules", "peer-deps-fixed", "node_modules"))).toBeFalse();
+    expect(out.replace(/\s*\[[0-9\.]+m?s\]\s*$/, "").split(/\r?\n/)).toEqual([
+      expect.stringContaining("bun install v1."),
+      "",
+      expect.stringContaining("+ no-deps@1.0.1"),
+      "",
+      "1 package installed",
+    ]);
+    expect(await exited).toBe(0);
+    assertManifestsPopulated(join(packageDir, ".bun-cache"), registryUrl());
+  },
+);
 
-test("package added after install", async () => {
+test.concurrent("package added after install", async () => {
+  const { packageDir, packageJson, env } = await setupTest();
   await writeFile(
     packageJson,
     JSON.stringify({
@@ -2519,7 +2585,8 @@ test("package added after install", async () => {
   assertManifestsPopulated(join(packageDir, ".bun-cache"), registryUrl());
 });
 
-test("--production excludes devDependencies in workspaces", async () => {
+test.concurrent("--production excludes devDependencies in workspaces", async () => {
+  const { packageDir, packageJson, env } = await setupTest();
   await Promise.all([
     write(
       packageJson,
@@ -2615,7 +2682,8 @@ test("--production excludes devDependencies in workspaces", async () => {
   expect(results).toMatchObject(expectedResults);
 });
 
-test("--production without a lockfile will install and not save lockfile", async () => {
+test.concurrent("--production without a lockfile will install and not save lockfile", async () => {
+  const { packageDir, packageJson, env } = await setupTest();
   await writeFile(
     packageJson,
     JSON.stringify({
@@ -2654,8 +2722,9 @@ test("--production without a lockfile will install and not save lockfile", async
   expect(await exists(join(packageDir, "node_modules", "no-deps", "index.js"))).toBeTrue();
 });
 
-describe("binaries", () => {
+describe.concurrent("binaries", () => {
   test("a bin that fails to link does not stop the remaining bins of the package from being linked", async () => {
+    const { packageDir, packageJson, env } = await setupTest();
     // Longer than a file name may be, so creating the link itself fails. It is
     // the first of the package's bins, both as declared and sorted.
     const longBinName = Buffer.alloc(300, "a").toString();
@@ -2692,6 +2761,7 @@ describe("binaries", () => {
   for (const global of [false, true]) {
     describe(`existing destinations${global ? " (global)" : ""}`, () => {
       test("existing non-symlink", async () => {
+        const { packageDir, packageJson, env } = await setupTest();
         await Promise.all([
           write(
             packageJson,
@@ -2715,6 +2785,7 @@ describe("binaries", () => {
     });
   }
   test("it should correctly link binaries after deleting node_modules", async () => {
+    const { packageDir, packageJson, env } = await setupTest();
     const json: any = {
       name: "foo",
       version: "1.0.0",
@@ -2785,6 +2856,7 @@ describe("binaries", () => {
   });
 
   test("will link binaries for packages installed multiple times", async () => {
+    const { packageDir, packageJson, env } = await setupTest();
     await Promise.all([
       write(
         packageJson,
@@ -2835,6 +2907,7 @@ describe("binaries", () => {
   });
 
   test("it should re-symlink binaries that become invalid when updating package versions", async () => {
+    const { packageDir, packageJson, env } = await setupTest();
     await writeFile(
       packageJson,
       JSON.stringify({
@@ -2919,6 +2992,7 @@ describe("binaries", () => {
   });
 
   test("will only link global binaries for requested packages", async () => {
+    const { packageDir, env } = await setupTest();
     await Promise.all([
       write(
         join(packageDir, "bunfig.toml"),
@@ -2979,6 +3053,7 @@ describe("binaries", () => {
 
   for (const global of [false, true]) {
     test(`bin types${global ? " (global)" : ""}`, async () => {
+      const { packageDir, packageJson, env } = await setupTest();
       if (global) {
         await write(
           join(packageDir, "bunfig.toml"),
@@ -3018,22 +3093,38 @@ describe("binaries", () => {
         env: global ? { ...env, BUN_INSTALL: join(packageDir, "global-install-dir") } : env,
       });
 
-      const err = await stderr.text();
+      const [out, err, exitCode] = await Promise.all([stdout.text(), stderr.text(), exited]);
       expect(err).not.toContain("error:");
+      expect(out.replace(/\s*\[[0-9\.]+m?s\]\s*$/, "").split(/\r?\n/)).toEqual([
+        expect.stringContaining("bun add v1."),
+        "",
+        "installed dep-with-file-bin@1.0.0 with binaries:",
+        " - dep-with-file-bin",
+        "installed dep-with-single-entry-map-bin@1.0.0 with binaries:",
+        " - single-entry-map-bin",
+        // the summary does not enumerate `directories.bin` entries
+        "installed dep-with-directory-bins@1.0.0",
+        "installed dep-with-map-bins@1.0.0 with binaries:",
+        " - map-bin-1",
+        " - map-bin-2",
+        "",
+        "4 packages installed",
+      ]);
+      expect(exitCode).toBe(0);
 
-      const out = await stdout.text();
-      expect(await exited).toBe(0);
-
-      await runBin("dep-with-file-bin", "file-bin\n", global);
-      await runBin("single-entry-map-bin", "single-entry-map-bin\n", global);
-      await runBin("directory-bin-1", "directory-bin-1\n", global);
-      await runBin("directory-bin-2", "directory-bin-2\n", global);
-      await runBin("map-bin-1", "map-bin-1\n", global);
-      await runBin("map-bin-2", "map-bin-2\n", global);
+      await Promise.all([
+        runBin(packageDir, env, "dep-with-file-bin", "file-bin\n", global),
+        runBin(packageDir, env, "single-entry-map-bin", "single-entry-map-bin\n", global),
+        runBin(packageDir, env, "directory-bin-1", "directory-bin-1\n", global),
+        runBin(packageDir, env, "directory-bin-2", "directory-bin-2\n", global),
+        runBin(packageDir, env, "map-bin-1", "map-bin-1\n", global),
+        runBin(packageDir, env, "map-bin-2", "map-bin-2\n", global),
+      ]);
     });
   }
 
-  test("each type of binary serializes correctly to text lockfile", async () => {
+  test.serial("each type of binary serializes correctly to text lockfile", async () => {
+    const { packageDir, packageJson, env } = await setupTest();
     await Promise.all([
       write(
         packageJson,
@@ -3156,7 +3247,8 @@ describe("binaries", () => {
     expect(join(packageDir, "node_modules", ".bin", "map-bin-2")).toBeValidBin(join("..", "map-bin", "map-bin-2.js"));
   });
 
-  test.todo("text lockfile updates with new bin entry for folder dependencies", async () => {
+  test.serial.todo("text lockfile updates with new bin entry for folder dependencies", async () => {
+    const { packageDir, packageJson, env } = await setupTest();
     await Promise.all([
       write(
         packageJson,
@@ -3252,6 +3344,7 @@ describe("binaries", () => {
   });
 
   test("bin targets with a trailing slash are linked", async () => {
+    const { packageDir, packageJson, env } = await setupTest();
     // npm resolves each target with path.resolve, which drops trailing separators,
     // so all of these link the file. Covers the string, single-entry and multi-entry
     // forms of "bin" since each is linked by a separate code path.
@@ -3317,7 +3410,8 @@ describe("binaries", () => {
     expectBins();
   });
 
-  test("root resolution bins", async () => {
+  test.serial("root resolution bins", async () => {
+    const { packageDir, env } = await setupTest();
     // As of writing this test, the only way to get a root resolution
     // is to migrate a package-lock.json with a root resolution. For now,
     // we'll just mock the bun.lock.
@@ -3407,7 +3501,13 @@ describe("binaries", () => {
     expect(join(packageDir, "node_modules", ".bin", "fooooo")).toBeValidBin(join("..", "fooooo", "fooooo.js"));
   });
 
-  async function runBin(binName: string, expected: string, global: boolean) {
+  async function runBin(
+    packageDir: string,
+    env: NodeJS.Dict<string>,
+    binName: string,
+    expected: string,
+    global: boolean,
+  ) {
     const args = global ? [`./global-bin-dir/${binName}`] : [bunExe(), binName];
     const result = Bun.spawn({
       cmd: [...args, "--linker=hoisted"],
@@ -3417,14 +3517,12 @@ describe("binaries", () => {
       env,
     });
 
-    const out = await result.stdout.text();
-    expect(out).toEqual(expected);
-    const err = await result.stderr.text();
-    expect(err).toBeEmpty();
-    expect(await result.exited).toBe(0);
+    const [out, err, exitCode] = await Promise.all([result.stdout.text(), result.stderr.text(), result.exited]);
+    expect({ binName, out, err, exitCode }).toEqual({ binName, out: expected, err: "", exitCode: 0 });
   }
 
   test("it will skip (without errors) if a folder from `directories.bin` does not exist", async () => {
+    const { packageDir, packageJson, env } = await setupTest();
     await Promise.all([
       write(
         packageJson,
@@ -3438,16 +3536,27 @@ describe("binaries", () => {
       cp(join(import.meta.dir, "missing-directory-bin-1.1.1.tgz"), join(packageDir, "missing-directory-bin-1.1.1.tgz")),
     ]);
 
-    const { stderr, exited } = spawn({
+    const { stdout, stderr, exited } = spawn({
       cmd: [bunExe(), "install"],
       cwd: packageDir,
       stdout: "pipe",
       stderr: "pipe",
       env,
     });
-    const err = await stderr.text();
+    const [out, err, exitCode] = await Promise.all([stdout.text(), stderr.text(), exited]);
+    expect(err).toContain("Saved lockfile");
     expect(err).not.toContain("error:");
-    expect(await exited).toBe(0);
+    expect(out.replace(/\s*\[[0-9\.]+m?s\]\s*$/, "").split(/\r?\n/)).toEqual([
+      expect.stringContaining("bun install v1."),
+      "",
+      "+ missing-directory-bin@missing-directory-bin-1.1.1.tgz",
+      "",
+      "1 package installed",
+    ]);
+    expect(exitCode).toBe(0);
+
+    // the package itself is installed, it just has no bins to link
+    expect(await readdirSorted(join(packageDir, "node_modules"))).toEqual(["missing-directory-bin"]);
   });
 
   describe("bin values longer than the path buffer", () => {
@@ -3514,6 +3623,7 @@ describe("binaries", () => {
 
     for (const linker of ["hoisted", "isolated"] as const) {
       test(`file targets are skipped like missing bins (${linker})`, async () => {
+        ({ packageDir, packageJson, env } = await setupTest());
         // A target this long cannot exist, and the linker silently skips a bin
         // whose target does not exist, so these install without output and the
         // other bins are still linked. Covers the string, single-entry and
@@ -3586,6 +3696,7 @@ describe("binaries", () => {
       });
 
       test(`directories.bin fails with ENAMETOOLONG (${linker})`, async () => {
+        ({ packageDir, packageJson, env } = await setupTest());
         // The linker reports every failure to open a bin directory other than
         // ENOENT, and ENAMETOOLONG is what the OS reports for a directory path it
         // cannot address, so a value that does not fit gets the same error.
@@ -3631,6 +3742,7 @@ describe("binaries", () => {
     // The entries of a bin directory are joined onto the directory's path as
     // well, and so is the temporary file used to rewrite a CRLF shebang.
     test.skipIf(isWindows)("entries of a directories.bin close to the path limit", async () => {
+      ({ packageDir, packageJson, env } = await setupTest());
       // Most of the depth goes into the project directory: the `.bin` links are
       // relative, so everything below the package ends up in the link targets,
       // and XFS rejects link targets of 1 KiB or more. The bin directory is then
@@ -3676,6 +3788,7 @@ describe("binaries", () => {
     // on another branch of the tree contributes one `..` per component, so the
     // link target can be longer than the target's absolute path.
     test.skipIf(isWindows)("bun link with a link target longer than the path buffer", async () => {
+      ({ packageDir, packageJson, env } = await setupTest());
       // As in the previous test, most of the depth has to sit above everything
       // that ends up in a link target that is meant to be created (XFS), so it
       // goes into the global directory itself.
@@ -3736,6 +3849,7 @@ describe("binaries", () => {
     });
 
     test("bun link and bun unlink", async () => {
+      ({ packageDir, packageJson, env } = await setupTest());
       // `bun link` links a package's bins into the global bin directory with the
       // same linker, and `bun unlink` is the only caller of its unlink side, which
       // has to open the same bin directory.
@@ -3787,7 +3901,8 @@ describe("binaries", () => {
   });
 });
 
-test("--config cli flag works", async () => {
+test.concurrent("--config cli flag works", async () => {
+  const { packageDir, env } = await setupTest();
   await Promise.all([
     write(
       join(packageDir, "package.json"),
@@ -3814,7 +3929,7 @@ test("--config cli flag works", async () => {
   ]);
 
   // should install dev dependencies
-  let { exited } = spawn({
+  let { stdout, stderr, exited } = spawn({
     cmd: [bunExe(), "i"],
     cwd: packageDir,
     stdout: "pipe",
@@ -3822,7 +3937,18 @@ test("--config cli flag works", async () => {
     env,
   });
 
-  expect(await exited).toBe(0);
+  let [out, err, exitCode] = await Promise.all([stdout.text(), stderr.text(), exited]);
+  expect(err).toContain("Saved lockfile");
+  expect(err).not.toContain("error:");
+  expect(out.replace(/\s*\[[0-9\.]+m?s\]\s*$/, "").split(/\r?\n/)).toEqual([
+    expect.stringContaining("bun install v1."),
+    "",
+    expect.stringContaining("+ a-dep@1.0.1"),
+    expect.stringContaining("+ no-deps@1.0.0"),
+    "",
+    "2 packages installed",
+  ]);
+  expect(exitCode).toBe(0);
   expect(await file(join(packageDir, "node_modules", "a-dep", "package.json")).json()).toEqual({
     name: "a-dep",
     version: "1.0.1",
@@ -3831,7 +3957,7 @@ test("--config cli flag works", async () => {
   await rm(join(packageDir, "node_modules"), { recursive: true, force: true });
 
   // should not install dev dependencies
-  ({ exited } = spawn({
+  ({ stdout, stderr, exited } = spawn({
     cmd: [bunExe(), "i", "--config=bunfig2.toml"],
     cwd: packageDir,
     stdout: "pipe",
@@ -3839,11 +3965,22 @@ test("--config cli flag works", async () => {
     env,
   }));
 
-  expect(await exited).toBe(0);
-  expect(await exists(join(packageDir, "node_modules", "a-dep"))).toBeFalse();
+  [out, err, exitCode] = await Promise.all([stdout.text(), stderr.text(), exited]);
+  expect(err).not.toContain("Saved lockfile");
+  expect(err).not.toContain("error:");
+  expect(out.replace(/\s*\[[0-9\.]+m?s\]\s*$/, "").split(/\r?\n/)).toEqual([
+    expect.stringContaining("bun install v1."),
+    "",
+    "+ no-deps@1.0.0",
+    "",
+    "1 package installed",
+  ]);
+  expect(exitCode).toBe(0);
+  expect(await readdirSorted(join(packageDir, "node_modules"))).toEqual(["no-deps"]);
 });
 
-test("it should invalid cached package if package.json is missing", async () => {
+test.concurrent("it should invalid cached package if package.json is missing", async () => {
+  const { packageDir, packageJson, env } = await setupTest();
   await Promise.all([
     write(
       packageJson,
@@ -3915,7 +4052,8 @@ const checkedCountWithOptionalNative = expect.stringContaining(
   `Checked ${installsWithOptionalNative} installs across 23 packages (no changes)`,
 );
 
-test("it should install with missing bun.lockb, node_modules, and/or cache", async () => {
+test.concurrent("it should install with missing bun.lockb, node_modules, and/or cache", async () => {
+  const { packageDir, packageJson, env } = await setupTest();
   // first clean install
   await writeFile(
     packageJson,
@@ -4119,9 +4257,10 @@ test("it should install with missing bun.lockb, node_modules, and/or cache", asy
   ]);
 });
 
-describe("hoisting", async () => {
+describe.concurrent("hoisting", async () => {
   // https://github.com/oven-sh/bun/issues/7241
   test("nested dependency is preserved when its parent is reinstalled from an empty cache", async () => {
+    const { packageDir, packageJson, env } = await setupTest();
     // `one-fixed-dep@1.0.0` depends on `no-deps@1.0.0`. With `no-deps@2.0.0`
     // at the root, `no-deps@1.0.0` is forced to nest under
     // `node_modules/one-fixed-dep/node_modules/no-deps`.
@@ -4170,6 +4309,7 @@ describe("hoisting", async () => {
 
   // https://github.com/oven-sh/bun/issues/16968
   test("nested dependency is preserved when its parent changes version via lockfile", async () => {
+    const { packageDir, packageJson, env } = await setupTest();
     // has-bin-entries@1.0.0 and @2.0.0 both depend on no-deps@1.0.0. With
     // no-deps@2.0.0 at the root, no-deps@1.0.0 nests under has-bin-entries.
 
@@ -4226,6 +4366,7 @@ describe("hoisting", async () => {
   });
 
   test("nested dependency is left alone when only an unrelated root sibling is reinstalled", async () => {
+    const { packageDir, packageJson, env } = await setupTest();
     await writeFile(
       packageJson,
       JSON.stringify({
@@ -4261,6 +4402,7 @@ describe("hoisting", async () => {
   });
 
   test("dependencies nested two levels below a reinstalled package are reinstalled", async () => {
+    const { packageDir, packageJson, env } = await setupTest();
     // See registry/packages/create-two-level-nest-package.ts for the layout.
     await writeFile(
       packageJson,
@@ -4309,6 +4451,7 @@ describe("hoisting", async () => {
   });
 
   test("recreating a workspace link leaves the workspace's nested dependencies alone", async () => {
+    const { packageDir, packageJson, env } = await setupTest();
     await writeFile(
       packageJson,
       JSON.stringify({ name: "foo", workspaces: ["packages/*"], dependencies: { "no-deps": "2.0.0" } }),
@@ -4339,6 +4482,7 @@ describe("hoisting", async () => {
   });
 
   test("dependency nested in a reinstalled file: dependency of a workspace is reinstalled", async () => {
+    const { packageDir, packageJson, env } = await setupTest();
     await writeFile(
       packageJson,
       JSON.stringify({ name: "foo", workspaces: ["packages/*"], dependencies: { "no-deps": "2.0.0" } }),
@@ -4470,6 +4614,7 @@ describe("hoisting", async () => {
 
   for (const { dependencies, expected, situation } of tests) {
     test(`it should hoist ${expected} when ${situation}`, async () => {
+      const { packageDir, packageJson, env } = await setupTest();
       await writeFile(
         packageJson,
         JSON.stringify({
@@ -4522,7 +4667,9 @@ describe("hoisting", async () => {
     });
   }
 
-  describe("peers", async () => {
+  // Which `a-dep` gets hoisted depends on the order the manifests arrive in, so these run one at a
+  // time to keep the registry quiet while they run.
+  describe.serial("peers", async () => {
     var peerTests: any = [
       {
         situation: "peer 1.0.2",
@@ -4632,6 +4779,7 @@ describe("hoisting", async () => {
     ];
     for (const { dependencies, expected, situation } of peerTests) {
       test(`it should hoist ${expected} when ${situation}`, async () => {
+        const { packageDir, packageJson, env } = await setupTest();
         await writeFile(
           packageJson,
           JSON.stringify({
@@ -4678,7 +4826,8 @@ describe("hoisting", async () => {
         expect(err).toContain("Saved lockfile");
         expect(err).not.toContain("not found");
         expect(err).not.toContain("error:");
-        expect(out).not.toContain("package installed");
+        // re-resolving without a lockfile must land on the same tree
+        expect(out).toMatch(/Checked \d+ installs across \d+ packages \(no changes\)/);
         expect(await exited).toBe(0);
         assertManifestsPopulated(join(packageDir, ".bun-cache"), registryUrl());
 
@@ -4700,7 +4849,10 @@ describe("hoisting", async () => {
         expect(err).not.toContain("Saved lockfile");
         expect(err).not.toContain("not found");
         expect(err).not.toContain("error:");
-        expect(out).not.toContain("package installed");
+        for (const dep of Object.keys(dependencies)) {
+          expect(out).toContain(`+ ${dep}@${dependencies[dep]}`);
+        }
+        expect(out).toMatch(/\d+ packages installed/);
         expect(await exited).toBe(0);
         assertManifestsPopulated(join(packageDir, ".bun-cache"), registryUrl());
 
@@ -4709,6 +4861,7 @@ describe("hoisting", async () => {
     }
 
     test("peer * hoists the same version no matter which manifest the registry answers first", async () => {
+      ({ packageDir, packageJson, env } = await setupTest());
       // Proxy in front of verdaccio that forces the arrival order seen on slow
       // CI machines: the a-dep manifest gets processed (so a-dep@1.0.1..1.0.9
       // exist in the lockfile) before peer-a-dep-star's manifest arrives, and
@@ -4763,6 +4916,7 @@ describe("hoisting", async () => {
     });
 
     test("peer * binds to the same version when bun.lock is loaded as when it was resolved", async () => {
+      ({ packageDir, packageJson, env } = await setupTest());
       // Nothing above `peer-a-dep-star` provides a-dep, so the isolated linker
       // installs the peer from the version the edge resolved to and keys the
       // store entry by it. The root of the printed tree holds a-dep@1.0.1 (from
@@ -4819,6 +4973,7 @@ describe("hoisting", async () => {
   });
 
   test("hoisting/using incorrect peer dep after install", async () => {
+    const { packageDir, packageJson, env } = await setupTest();
     await writeFile(
       packageJson,
       JSON.stringify({
@@ -4923,6 +5078,7 @@ describe("hoisting", async () => {
   });
 
   test("root workspace (other than root) dependency will not hoist incorrect peer", async () => {
+    const { packageDir, packageJson, env } = await setupTest();
     await Promise.all([
       write(
         packageJson,
@@ -4995,6 +5151,7 @@ describe("hoisting", async () => {
   });
 
   test("hoisting/using incorrect peer dep on initial install", async () => {
+    const { packageDir, packageJson, env } = await setupTest();
     await writeFile(
       packageJson,
       JSON.stringify({
@@ -5100,6 +5257,7 @@ describe("hoisting", async () => {
 
   describe("devDependencies", () => {
     test("from normal dependency", async () => {
+      const { packageDir, packageJson, env } = await setupTest();
       // Root package should choose no-deps@1.0.1.
       //
       // `normal-dep-and-dev-dep` should install `no-deps@1.0.0` and `normal-dep@1.0.1`.
@@ -5151,6 +5309,7 @@ describe("hoisting", async () => {
     });
 
     test("from workspace", async () => {
+      const { packageDir, packageJson, env } = await setupTest();
       await writeFile(
         packageJson,
         JSON.stringify({
@@ -5212,6 +5371,7 @@ describe("hoisting", async () => {
     });
 
     test("from linked package", async () => {
+      const { packageDir, packageJson, env } = await setupTest();
       await writeFile(
         packageJson,
         JSON.stringify({
@@ -5280,6 +5440,7 @@ describe("hoisting", async () => {
     });
 
     test("dependency with normal dependency same as root", async () => {
+      const { packageDir, packageJson, env } = await setupTest();
       await writeFile(
         packageJson,
         JSON.stringify({
@@ -5324,7 +5485,8 @@ describe("hoisting", async () => {
     });
   });
 
-  test.todoIf(isFlaky && isWindows)("text lockfile is hoisted", async () => {
+  test.serial.todoIf(isFlaky && isWindows)("text lockfile is hoisted", async () => {
+    const { packageDir, packageJson, env } = await setupTest();
     // Each dependency depends on 'hoist-lockfile-shared'.
     // 1 - "*"
     // 2 - "^1.0.1"
@@ -5397,6 +5559,7 @@ describe("hoisting", async () => {
   }
 
   test("a dependency's `*` shares the version the root's own range resolved to", async () => {
+    const { packageDir, packageJson, env } = await setupTest();
     await write(
       packageJson,
       JSON.stringify({
@@ -5410,6 +5573,7 @@ describe("hoisting", async () => {
   });
 
   test("a dependency's `*` shares the version a workspace's own range resolved to", async () => {
+    const { packageDir, packageJson, env } = await setupTest();
     await Promise.all([
       write(
         packageJson,
@@ -5426,8 +5590,8 @@ describe("hoisting", async () => {
   });
 });
 
-describe("transitive file dependencies", () => {
-  async function checkHoistedFiles() {
+describe.concurrent("transitive file dependencies", () => {
+  async function checkHoistedFiles(packageDir: string) {
     const aliasedFileDepFilesPackageJson = join(
       packageDir,
       "node_modules",
@@ -5487,7 +5651,7 @@ describe("transitive file dependencies", () => {
     ]);
   }
 
-  async function checkUnhoistedFiles() {
+  async function checkUnhoistedFiles(packageDir: string) {
     const results = await Promise.all([
       file(join(packageDir, "node_modules", "dep-file-dep", "package.json")).json(),
       file(join(packageDir, "node_modules", "file-dep", "package.json")).json(),
@@ -5570,6 +5734,7 @@ describe("transitive file dependencies", () => {
   }
 
   test("from hoisted workspace dependencies", async () => {
+    const { packageDir, packageJson, env } = await setupTest();
     await Promise.all([
       write(
         packageJson,
@@ -5611,7 +5776,7 @@ describe("transitive file dependencies", () => {
       "14 packages installed",
     ]);
 
-    await checkHoistedFiles();
+    await checkHoistedFiles(packageDir);
     expect(await exists(join(packageDir, "pkg1", "node_modules"))).toBeFalse();
 
     await rm(join(packageDir, "node_modules"), { recursive: true, force: true });
@@ -5626,7 +5791,7 @@ describe("transitive file dependencies", () => {
       "14 packages installed",
     ]);
 
-    await checkHoistedFiles();
+    await checkHoistedFiles(packageDir);
 
     ({ out } = await runBunInstall(env, packageDir, { savesLockfile: false }));
     assertManifestsPopulated(join(packageDir, ".bun-cache"), registryUrl());
@@ -5637,7 +5802,7 @@ describe("transitive file dependencies", () => {
       "1 package installed",
     ]);
 
-    await checkHoistedFiles();
+    await checkHoistedFiles(packageDir);
 
     await rm(join(packageDir, "node_modules"), { recursive: true, force: true });
     await rm(join(packageDir, "bun.lockb"), { force: true });
@@ -5660,7 +5825,7 @@ describe("transitive file dependencies", () => {
       "14 packages installed",
     ]);
 
-    await checkHoistedFiles();
+    await checkHoistedFiles(packageDir);
     expect(await exists(join(packageDir, "pkg1", "node_modules"))).toBeFalse();
 
     ({ out } = await runBunInstall(env, join(packageDir, "pkg1"), { savesLockfile: false }));
@@ -5690,9 +5855,12 @@ describe("transitive file dependencies", () => {
       "",
       "14 packages installed",
     ]);
+
+    await checkHoistedFiles(packageDir);
   });
 
   test("from non-hoisted workspace dependencies", async () => {
+    const { packageDir, packageJson, env } = await setupTest();
     await Promise.all([
       write(
         packageJson,
@@ -5753,7 +5921,7 @@ describe("transitive file dependencies", () => {
       "15 packages installed",
     ]);
 
-    await checkUnhoistedFiles();
+    await checkUnhoistedFiles(packageDir);
 
     await rm(join(packageDir, "node_modules"), { recursive: true, force: true });
     await rm(join(packageDir, "pkg1", "node_modules"), { recursive: true, force: true });
@@ -5776,7 +5944,7 @@ describe("transitive file dependencies", () => {
       "15 packages installed",
     ]);
 
-    await checkUnhoistedFiles();
+    await checkUnhoistedFiles(packageDir);
 
     ({ out } = await runBunInstall(env, packageDir, { savesLockfile: false }));
     assertManifestsPopulated(join(packageDir, ".bun-cache"), registryUrl());
@@ -5787,7 +5955,7 @@ describe("transitive file dependencies", () => {
       "1 package installed",
     ]);
 
-    await checkUnhoistedFiles();
+    await checkUnhoistedFiles(packageDir);
 
     await rm(join(packageDir, "node_modules"), { recursive: true, force: true });
     await rm(join(packageDir, "pkg1", "node_modules"), { recursive: true, force: true });
@@ -5811,7 +5979,7 @@ describe("transitive file dependencies", () => {
       "15 packages installed",
     ]);
 
-    await checkUnhoistedFiles();
+    await checkUnhoistedFiles(packageDir);
 
     ({ out } = await runBunInstall(env, join(packageDir, "pkg1"), { savesLockfile: false }));
     assertManifestsPopulated(join(packageDir, ".bun-cache"), registryUrl());
@@ -5841,9 +6009,12 @@ describe("transitive file dependencies", () => {
       "",
       "15 packages installed",
     ]);
+
+    await checkUnhoistedFiles(packageDir);
   });
 
   test("from root dependencies", async () => {
+    const { packageDir, packageJson, env } = await setupTest();
     await writeFile(
       packageJson,
       JSON.stringify({
@@ -5909,7 +6080,7 @@ describe("transitive file dependencies", () => {
       "self-file-dep",
     ]);
 
-    await checkHoistedFiles();
+    await checkHoistedFiles(packageDir);
 
     ({ stdout, stderr, exited } = spawn({
       cmd: [bunExe(), "install"],
@@ -5934,7 +6105,7 @@ describe("transitive file dependencies", () => {
     expect(await exited).toBe(0);
     assertManifestsPopulated(join(packageDir, ".bun-cache"), registryUrl());
 
-    await checkHoistedFiles();
+    await checkHoistedFiles(packageDir);
 
     await rm(join(packageDir, "node_modules"), { recursive: true, force: true });
 
@@ -5953,6 +6124,19 @@ describe("transitive file dependencies", () => {
     expect(err).not.toContain("not found");
     expect(err).not.toContain("error:");
     expect(err).not.toContain("panic:");
+    expect(out.replace(/\s*\[[0-9\.]+m?s\]\s*$/, "").split(/\r?\n/)).toEqual([
+      expect.stringContaining("bun install v1."),
+      "",
+      "+ @another-scope/file-dep@1.0.0",
+      "+ @scoped/file-dep@1.0.0",
+      "+ aliased-file-dep@1.0.1",
+      "+ dep-file-dep@1.0.0",
+      expect.stringContaining("+ file-dep@1.0.0"),
+      "+ missing-file-dep@1.0.0",
+      "+ self-file-dep@1.0.0",
+      "",
+      "13 packages installed",
+    ]);
     expect(await readdirSorted(join(packageDir, "node_modules"))).toEqual([
       "@another-scope",
       "@scoped",
@@ -5965,9 +6149,10 @@ describe("transitive file dependencies", () => {
     expect(await exited).toBe(0);
     assertManifestsPopulated(join(packageDir, ".bun-cache"), registryUrl());
 
-    await checkHoistedFiles();
+    await checkHoistedFiles(packageDir);
   });
   test("it should install folder dependencies with absolute paths", async () => {
+    const { packageDir, packageJson, env } = await setupTest();
     async function writePackages(num: number) {
       await rm(join(packageDir, `pkg0`), { recursive: true, force: true });
       for (let i = 0; i < num; i++) {
@@ -6128,6 +6313,7 @@ describe("transitive file dependencies", () => {
   // `file-dep@1.0.0` declares `"files": "file:./the-files"` and ships `the-files/`
   // (index.js + package.json) in its tarball.
   test("a root override redirects a registry package's own file: dependency to a folder in the project", async () => {
+    const { packageDir, packageJson, env } = await setupTest();
     await Promise.all([
       write(
         packageJson,
@@ -6155,6 +6341,7 @@ describe("transitive file dependencies", () => {
   });
 
   test("a scoped override for another dependent leaves a registry package's own file: dependency alone", async () => {
+    const { packageDir, packageJson, env } = await setupTest();
     await write(
       packageJson,
       JSON.stringify({
@@ -6175,7 +6362,8 @@ describe("transitive file dependencies", () => {
   });
 });
 
-test("name from manifest is scoped and url encoded", async () => {
+test.concurrent("name from manifest is scoped and url encoded", async () => {
+  const { packageDir, packageJson, env } = await setupTest();
   await write(
     packageJson,
     JSON.stringify({
@@ -6203,8 +6391,9 @@ test("name from manifest is scoped and url encoded", async () => {
   ]);
 });
 
-describe("update", () => {
+describe.concurrent("update", () => {
   test("duplicate peer dependency (one package is invalid_package_id)", async () => {
+    const { packageDir, packageJson, env } = await setupTest();
     await write(
       packageJson,
       JSON.stringify({
@@ -6236,6 +6425,7 @@ describe("update", () => {
     });
   });
   test("dist-tags", async () => {
+    const { packageDir, packageJson, env } = await setupTest();
     await write(
       packageJson,
       JSON.stringify({
@@ -6288,12 +6478,13 @@ describe("update", () => {
     });
     expect((await file(join(packageDir, "node_modules", "a-dep", "package.json")).json()).version).toBe("1.0.10");
   });
-  test("exact versions stay exact", async () => {
+  describe("exact versions stay exact", () => {
     const runs = [
-      { version: "1.0.1", dependency: "a-dep" },
-      { version: "npm:a-dep@1.0.1", dependency: "aliased" },
+      { version: "1.0.1", dependency: "a-dep", latest: "1.0.10" },
+      { version: "npm:a-dep@1.0.1", dependency: "aliased", latest: "npm:a-dep@1.0.10" },
     ];
-    for (const { version, dependency } of runs) {
+    test.each(runs)("$dependency", async ({ version, dependency, latest }) => {
+      const { packageDir, packageJson, env } = await setupTest();
       await write(
         packageJson,
         JSON.stringify({
@@ -6320,22 +6511,40 @@ describe("update", () => {
       await runBunInstall(env, packageDir);
       await check(version);
 
-      await runBunUpdate(env, packageDir);
+      let { out } = await runBunUpdate(env, packageDir);
+      expect(out).toEqual([
+        expect.stringContaining("bun update v1."),
+        "",
+        "Checked 1 install across 2 packages (no changes)",
+      ]);
       await check(version);
 
-      await runBunUpdate(env, packageDir, [dependency]);
+      ({ out } = await runBunUpdate(env, packageDir, [dependency]));
+      expect(out).toEqual([
+        expect.stringContaining("bun update v1."),
+        "",
+        `installed ${dependency}@1.0.1`,
+        "",
+        expect.stringContaining("done"),
+        "",
+      ]);
       await check(version);
 
       // this will actually update the package, but the version should remain exact
-      await runBunUpdate(env, packageDir, ["--latest"]);
-      await check(dependency === "aliased" ? "npm:a-dep@1.0.10" : "1.0.10");
-
-      await rm(join(packageDir, "node_modules"), { recursive: true, force: true });
-      await rm(join(packageDir, "bun.lockb"));
-    }
+      ({ out } = await runBunUpdate(env, packageDir, ["--latest"]));
+      expect(out).toEqual([
+        expect.stringContaining("bun update v1."),
+        "",
+        `^ ${dependency} 1.0.1 -> 1.0.10`,
+        "",
+        "1 package installed",
+      ]);
+      await check(latest);
+    });
   });
   describe("tilde", () => {
     test("without args", async () => {
+      const { packageDir, packageJson, env } = await setupTest();
       await write(
         packageJson,
         JSON.stringify({
@@ -6388,6 +6597,7 @@ describe("update", () => {
 
     for (const latest of [true, false]) {
       test(`update no args${latest ? " --latest" : ""}`, async () => {
+        const { packageDir, packageJson, env } = await setupTest();
         await write(
           packageJson,
           JSON.stringify({
@@ -6494,6 +6704,7 @@ describe("update", () => {
     }
 
     test("with package name in args", async () => {
+      const { packageDir, packageJson, env } = await setupTest();
       await write(
         packageJson,
         JSON.stringify({
@@ -6551,6 +6762,7 @@ describe("update", () => {
   });
   describe("alises", () => {
     test("update all", async () => {
+      const { packageDir, packageJson, env } = await setupTest();
       await write(
         packageJson,
         JSON.stringify({
@@ -6576,6 +6788,7 @@ describe("update", () => {
       });
     });
     test("update specific aliased package", async () => {
+      const { packageDir, packageJson, env } = await setupTest();
       await write(
         packageJson,
         JSON.stringify({
@@ -6601,6 +6814,7 @@ describe("update", () => {
       });
     });
     test("with pre and build tags", async () => {
+      const { packageDir, packageJson, env } = await setupTest();
       await write(
         packageJson,
         JSON.stringify({
@@ -6661,6 +6875,7 @@ describe("update", () => {
 
     for (const [dependency, version, args, updated, installed] of cases) {
       test(`${JSON.stringify(version)} with \`bun update${args.map(arg => ` ${arg}`).join("")}\``, async () => {
+        ({ packageDir, packageJson, env } = await setupTest());
         await write(
           packageJson,
           JSON.stringify({
@@ -6688,6 +6903,7 @@ describe("update", () => {
     }
 
     test("bun update --interactive keeps the alias and the range prefix", async () => {
+      ({ packageDir, packageJson, env } = await setupTest());
       await write(
         packageJson,
         JSON.stringify({
@@ -6726,6 +6942,7 @@ describe("update", () => {
     });
 
     test("a catalog reference in an earlier dependency group is left alone", async () => {
+      ({ packageDir, packageJson, env } = await setupTest());
       // devDependencies are visited before dependencies. The entry recorded for `dependencies`
       // must not be spent rewriting the `catalog:` reference.
       await write(
@@ -6766,6 +6983,7 @@ describe("update", () => {
     });
   });
   test("--no-save will update packages in node_modules and not save to package.json", async () => {
+    const { packageDir, packageJson, env } = await setupTest();
     await write(
       packageJson,
       JSON.stringify({
@@ -6837,6 +7055,7 @@ describe("update", () => {
     });
   });
   test("update won't update beyond version range unless the specified version allows it", async () => {
+    const { packageDir, packageJson, env } = await setupTest();
     await write(
       packageJson,
       JSON.stringify({
@@ -6888,6 +7107,7 @@ describe("update", () => {
     });
   });
   test("update should update all packages in the current workspace", async () => {
+    const { packageDir, packageJson, env } = await setupTest();
     await write(
       packageJson,
       JSON.stringify({
@@ -7068,42 +7288,45 @@ describe("update", () => {
       },
     });
   });
-  test("update different dependency groups", async () => {
-    for (const args of [true, false]) {
-      for (const group of ["dependencies", "devDependencies", "optionalDependencies", "peerDependencies"]) {
-        await write(
-          packageJson,
-          JSON.stringify({
-            name: "foo",
-            [group]: {
-              "a-dep": "^1.0.0",
-            },
-          }),
-        );
-
-        const { out } = args ? await runBunUpdate(env, packageDir, ["a-dep"]) : await runBunUpdate(env, packageDir);
-        assertManifestsPopulated(join(packageDir, ".bun-cache"), registryUrl());
-
-        expect(out).toStrictEqual([
-          expect.stringContaining("bun update v1."),
-          "",
-          "+ a-dep@1.0.10",
-          "",
-          "1 package installed",
-        ]);
-        expect(await file(packageJson).json()).toStrictEqual({
+  describe("update different dependency groups", () => {
+    const groups = ["dependencies", "devDependencies", "optionalDependencies", "peerDependencies"];
+    const cases = [true, false].flatMap(args => groups.map(group => ({ args, group })));
+    test.each(cases)("a-dep in $group (args: $args)", async ({ args, group }) => {
+      const { packageDir, packageJson, env } = await setupTest();
+      await write(
+        packageJson,
+        JSON.stringify({
           name: "foo",
           [group]: {
-            "a-dep": "^1.0.10",
+            "a-dep": "^1.0.0",
           },
-        });
+        }),
+      );
 
-        await rm(join(packageDir, "node_modules"), { recursive: true, force: true });
-        await rm(join(packageDir, "bun.lockb"));
-      }
-    }
+      const { out } = args ? await runBunUpdate(env, packageDir, ["a-dep"]) : await runBunUpdate(env, packageDir);
+      assertManifestsPopulated(join(packageDir, ".bun-cache"), registryUrl());
+
+      expect(out).toStrictEqual([
+        expect.stringContaining("bun update v1."),
+        "",
+        "+ a-dep@1.0.10",
+        "",
+        "1 package installed",
+      ]);
+      expect(await file(packageJson).json()).toStrictEqual({
+        name: "foo",
+        [group]: {
+          "a-dep": "^1.0.10",
+        },
+      });
+      expect(await file(join(packageDir, "node_modules", "a-dep", "package.json")).json()).toEqual({
+        name: "a-dep",
+        version: "1.0.10",
+      });
+    });
   });
   test("it should update packages from update requests", async () => {
+    const { packageDir, packageJson, env } = await setupTest();
     await write(
       packageJson,
       JSON.stringify({
@@ -7219,6 +7442,7 @@ describe("update", () => {
   });
 
   test("--latest works with packages from arguments", async () => {
+    const { packageDir, packageJson, env } = await setupTest();
     await write(
       packageJson,
       JSON.stringify({
@@ -7241,7 +7465,8 @@ describe("update", () => {
   });
 });
 
-test("packages dependening on each other with aliases does not infinitely loop", async () => {
+test.concurrent("packages dependening on each other with aliases does not infinitely loop", async () => {
+  const { packageDir, packageJson, env } = await setupTest();
   await write(
     packageJson,
     JSON.stringify({
@@ -7270,7 +7495,8 @@ test("packages dependening on each other with aliases does not infinitely loop",
   ]);
 });
 
-test("it should re-populate .bin folder if package is reinstalled", async () => {
+test.concurrent("it should re-populate .bin folder if package is reinstalled", async () => {
+  const { packageDir, packageJson, env } = await setupTest();
   await writeFile(
     packageJson,
     JSON.stringify({
@@ -7352,7 +7578,8 @@ test("it should re-populate .bin folder if package is reinstalled", async () =>
   }
 });
 
-test("one version with binary map", async () => {
+test.concurrent("one version with binary map", async () => {
+  const { packageDir, packageJson, env } = await setupTest();
   await writeFile(
     packageJson,
     JSON.stringify({
@@ -7391,7 +7618,8 @@ test("one version with binary map", async () => {
   expect(join(packageDir, "node_modules", ".bin", "map_bin")).toBeValidBin(join("..", "map-bin", "bin", "map-bin"));
 });
 
-test("multiple versions with binary map", async () => {
+test.concurrent("multiple versions with binary map", async () => {
+  const { packageDir, packageJson, env } = await setupTest();
   await writeFile(
     packageJson,
     JSON.stringify({
@@ -7435,7 +7663,8 @@ test("multiple versions with binary map", async () => {
   );
 });
 
-test("duplicate dependency in optionalDependencies maintains sort order", async () => {
+test.serial("duplicate dependency in optionalDependencies maintains sort order", async () => {
+  const { packageDir, packageJson, env } = await setupTest();
   await write(
     packageJson,
     JSON.stringify({
@@ -7472,7 +7701,8 @@ test("duplicate dependency in optionalDependencies maintains sort order", async
   expect(await exited).toBe(0);
 });
 
-test("missing package on reinstall, some with binaries", async () => {
+test.concurrent("missing package on reinstall, some with binaries", async () => {
+  const { packageDir, packageJson, env } = await setupTest();
   await writeFile(
     packageJson,
     JSON.stringify({
@@ -7594,8 +7824,9 @@ test("missing package on reinstall, some with binaries", async () => {
   ).toBe(join(packageDir, "node_modules", "uses-what-bin", "node_modules", ".bin", bin));
 });
 
-describe("pm trust", async () => {
+describe.concurrent("pm trust", async () => {
   test("--default", async () => {
+    const { packageDir, packageJson, env } = await setupTest();
     await writeFile(
       packageJson,
       JSON.stringify({
@@ -7623,6 +7854,7 @@ describe("pm trust", async () => {
 
   describe("--all", async () => {
     test("no dependencies", async () => {
+      const { packageDir, packageJson, env } = await setupTest();
       await writeFile(
         packageJson,
         JSON.stringify({
@@ -7646,6 +7878,7 @@ describe("pm trust", async () => {
     });
 
     test("some dependencies, non with scripts", async () => {
+      const { packageDir, packageJson, env } = await setupTest();
       await writeFile(
         packageJson,
         JSON.stringify({
@@ -7705,59 +7938,63 @@ describe("pm trust", async () => {
   });
 });
 
-test("it should be able to find binary in node_modules/.bin from parent directory of root package", async () => {
-  await mkdir(join(packageDir, "node_modules", ".bin"), { recursive: true });
-  await mkdir(join(packageDir, "morePackageDir"));
-  await writeFile(
-    join(packageDir, "morePackageDir", "package.json"),
-    JSON.stringify({
-      name: "foo",
-      version: "1.0.0",
-      scripts: {
-        install: "missing-bin",
-      },
-      dependencies: {
-        "what-bin": "1.0.0",
-      },
-    }),
-  );
+test.concurrent(
+  "it should be able to find binary in node_modules/.bin from parent directory of root package",
+  async () => {
+    const { packageDir, env } = await setupTest();
+    await mkdir(join(packageDir, "node_modules", ".bin"), { recursive: true });
+    await mkdir(join(packageDir, "morePackageDir"));
+    await writeFile(
+      join(packageDir, "morePackageDir", "package.json"),
+      JSON.stringify({
+        name: "foo",
+        version: "1.0.0",
+        scripts: {
+          install: "missing-bin",
+        },
+        dependencies: {
+          "what-bin": "1.0.0",
+        },
+      }),
+    );
 
-  await cp(join(packageDir, "bunfig.toml"), join(packageDir, "morePackageDir", "bunfig.toml"));
+    await cp(join(packageDir, "bunfig.toml"), join(packageDir, "morePackageDir", "bunfig.toml"));
 
-  await writeShebangScript(
-    join(packageDir, "node_modules", ".bin", "missing-bin"),
-    "node",
-    `require("fs").writeFileSync("missing-bin.txt", "missing-bin@WHAT");`,
-  );
+    await writeShebangScript(
+      join(packageDir, "node_modules", ".bin", "missing-bin"),
+      "node",
+      `require("fs").writeFileSync("missing-bin.txt", "missing-bin@WHAT");`,
+    );
 
-  const { stdout, stderr, exited } = spawn({
-    cmd: [bunExe(), "install"],
-    cwd: join(packageDir, "morePackageDir"),
-    stdout: "pipe",
-    stdin: "pipe",
-    stderr: "pipe",
-    env,
-  });
+    const { stdout, stderr, exited } = spawn({
+      cmd: [bunExe(), "install"],
+      cwd: join(packageDir, "morePackageDir"),
+      stdout: "pipe",
+      stdin: "pipe",
+      stderr: "pipe",
+      env,
+    });
 
-  const err = await stderr.text();
-  expect(err).toContain("Saved lockfile");
-  expect(err).not.toContain("not found");
-  expect(err).not.toContain("error:");
-  const out = await stdout.text();
-  expect(out.replace(/\s*\[[0-9\.]+m?s\]\s*$/, "").split(/\r?\n/)).toEqual([
-    expect.stringContaining("bun install v1."),
-    "",
-    expect.stringContaining("+ what-bin@1.0.0"),
-    "",
-    "1 package installed",
-  ]);
-  expect(await exited).toBe(0);
-  assertManifestsPopulated(join(packageDir, ".bun-cache"), registryUrl());
+    const err = await stderr.text();
+    expect(err).toContain("Saved lockfile");
+    expect(err).not.toContain("not found");
+    expect(err).not.toContain("error:");
+    const out = await stdout.text();
+    expect(out.replace(/\s*\[[0-9\.]+m?s\]\s*$/, "").split(/\r?\n/)).toEqual([
+      expect.stringContaining("bun install v1."),
+      "",
+      expect.stringContaining("+ what-bin@1.0.0"),
+      "",
+      "1 package installed",
+    ]);
+    expect(await exited).toBe(0);
+    assertManifestsPopulated(join(packageDir, ".bun-cache"), registryUrl());
 
-  expect(await file(join(packageDir, "morePackageDir", "missing-bin.txt")).text()).toBe("missing-bin@WHAT");
-});
+    expect(await file(join(packageDir, "morePackageDir", "missing-bin.txt")).text()).toBe("missing-bin@WHAT");
+  },
+);
 
-describe("semver", () => {
+describe.concurrent("semver", () => {
   const taggedVersionTests = [
     {
       title: "tagged version last in range",
@@ -7858,6 +8095,7 @@ describe("semver", () => {
 
   for (const { title, depVersion, expected } of taggedVersionTests) {
     test(title, async () => {
+      const { packageDir, packageJson, env } = await setupTest();
       await writeFile(
         packageJson,
         JSON.stringify({
@@ -7890,12 +8128,18 @@ describe("semver", () => {
         "",
         "1 package installed",
       ]);
+      expect(await file(join(packageDir, "node_modules", "dep-with-tags", "package.json")).json()).toEqual({
+        name: "dep-with-tags",
+        version: expected,
+        dependencies: {},
+      });
       expect(await exited).toBe(0);
       assertManifestsPopulated(join(packageDir, ".bun-cache"), registryUrl());
     });
   }
 
   test.todo("only tagged versions in range errors", async () => {
+    const { packageDir, packageJson, env } = await setupTest();
     await writeFile(
       packageJson,
       JSON.stringify({
@@ -7926,7 +8170,8 @@ describe("semver", () => {
   });
 });
 
-test("doesn't error when the migration is out of sync", async () => {
+test.concurrent("doesn't error when the migration is out of sync", async () => {
+  const { env } = await setupTest();
   await using cwd = tempDir("out-of-sync-1", {
     "package.json": JSON.stringify({
       "devDependencies": {
@@ -8082,9 +8327,10 @@ const prereleaseTests = [
 for (let i = 0; i < prereleaseTests.length; i++) {
   const tests = prereleaseTests[i];
   const depName = `prereleases-${i + 1}`;
-  describe(`${depName} should pass`, () => {
+  describe.concurrent(`${depName} should pass`, () => {
     for (const { title, depVersion, expected } of tests) {
       test(title, async () => {
+        const { packageDir, packageJson, env } = await setupTest();
         await writeFile(
           packageJson,
           JSON.stringify({
@@ -8228,9 +8474,10 @@ const prereleaseFailTests = [
 for (let i = 0; i < prereleaseFailTests.length; i++) {
   const tests = prereleaseFailTests[i];
   const depName = `prereleases-${i + 1}`;
-  describe(`${depName} should fail`, () => {
+  describe.concurrent(`${depName} should fail`, () => {
     for (const { title, depVersion } of tests) {
       test(title, async () => {
+        const { packageDir, packageJson, env } = await setupTest();
         await writeFile(
           packageJson,
           JSON.stringify({
@@ -8262,8 +8509,9 @@ for (let i = 0; i < prereleaseFailTests.length; i++) {
   });
 }
 
-describe("yarn tests", () => {
+describe.concurrent("yarn tests", () => {
   test("dragon test 1", async () => {
+    const { packageDir, packageJson, env } = await setupTest();
     await writeFile(
       packageJson,
       JSON.stringify({
@@ -8328,6 +8576,7 @@ describe("yarn tests", () => {
   });
 
   test("dragon test 2", async () => {
+    const { packageDir, packageJson, env } = await setupTest();
     await writeFile(
       packageJson,
       JSON.stringify({
@@ -8402,6 +8651,7 @@ describe("yarn tests", () => {
   });
 
   test("dragon test 3", async () => {
+    const { packageDir, packageJson, env } = await setupTest();
     await writeFile(
       packageJson,
       JSON.stringify({
@@ -8454,6 +8704,7 @@ describe("yarn tests", () => {
   });
 
   test("dragon test 4", async () => {
+    const { packageDir, packageJson, env } = await setupTest();
     await writeFile(
       packageJson,
       JSON.stringify({
@@ -8516,6 +8767,7 @@ describe("yarn tests", () => {
   });
 
   test("dragon test 5", async () => {
+    const { packageDir, packageJson, env } = await setupTest();
     await writeFile(
       packageJson,
       JSON.stringify({
@@ -8599,6 +8851,7 @@ describe("yarn tests", () => {
   });
 
   test.todo("dragon test 6", async () => {
+    const { packageDir, packageJson, env } = await setupTest();
     await writeFile(
       packageJson,
       JSON.stringify({
@@ -8716,6 +8969,7 @@ describe("yarn tests", () => {
   });
 
   test.todo("dragon test 7", async () => {
+    const { packageDir, packageJson, env } = await setupTest();
     await writeFile(
       packageJson,
       JSON.stringify({
@@ -8799,6 +9053,7 @@ describe("yarn tests", () => {
   });
 
   test("dragon test 8", async () => {
+    const { packageDir, packageJson, env } = await setupTest();
     await writeFile(
       packageJson,
       JSON.stringify({
@@ -8842,6 +9097,7 @@ describe("yarn tests", () => {
   });
 
   test("dragon test 9", async () => {
+    const { packageDir, packageJson, env } = await setupTest();
     await writeFile(
       packageJson,
       JSON.stringify({
@@ -8885,6 +9141,7 @@ describe("yarn tests", () => {
   });
 
   test.todo("dragon test 10", async () => {
+    const { packageDir, packageJson, env } = await setupTest();
     await writeFile(
       packageJson,
       JSON.stringify({
@@ -8960,6 +9217,7 @@ describe("yarn tests", () => {
   });
 
   test("dragon test 12", async () => {
+    const { packageDir, packageJson, env } = await setupTest();
     await writeFile(
       packageJson,
       JSON.stringify({
@@ -9033,6 +9291,7 @@ describe("yarn tests", () => {
   });
 
   test("it should not warn when the peer dependency resolution is compatible", async () => {
+    const { packageDir, packageJson, env } = await setupTest();
     await writeFile(
       packageJson,
       JSON.stringify({
@@ -9074,6 +9333,7 @@ describe("yarn tests", () => {
   });
 
   test("it should warn when the peer dependency resolution is incompatible", async () => {
+    const { packageDir, packageJson, env } = await setupTest();
     await writeFile(
       packageJson,
       JSON.stringify({
@@ -9115,6 +9375,7 @@ describe("yarn tests", () => {
   });
 
   test("it should install in such a way that two identical packages with different peer dependencies are different instances", async () => {
+    const { packageDir, packageJson, env } = await setupTest();
     await writeFile(
       packageJson,
       JSON.stringify({
@@ -9223,6 +9484,7 @@ describe("yarn tests", () => {
   });
 
   test("it should install in such a way that two identical packages with the same peer dependencies are the same instances (simple)", async () => {
+    const { packageDir, packageJson, env } = await setupTest();
     await writeFile(
       packageJson,
       JSON.stringify({
@@ -9287,6 +9549,7 @@ describe("yarn tests", () => {
   });
 
   test("it should install in such a way that two identical packages with the same peer dependencies are the same instances (complex)", async () => {
+    const { packageDir, packageJson, env } = await setupTest();
     await writeFile(
       packageJson,
       JSON.stringify({
@@ -9353,6 +9616,7 @@ describe("yarn tests", () => {
   });
 
   test("it shouldn't deduplicate two packages with similar peer dependencies but different names", async () => {
+    const { packageDir, packageJson, env } = await setupTest();
     await writeFile(
       packageJson,
       JSON.stringify({
@@ -9413,6 +9677,7 @@ describe("yarn tests", () => {
   });
 
   test("it should reinstall and rebuild dependencies deleted by the user on the next install", async () => {
+    const { packageDir, packageJson, env } = await setupTest();
     await writeFile(
       packageJson,
       JSON.stringify({
@@ -9474,7 +9739,8 @@ describe("yarn tests", () => {
   });
 });
 
-test("tarball `./` prefix, duplicate directory with file, and empty directory", async () => {
+test.concurrent("tarball `./` prefix, duplicate directory with file, and empty directory", async () => {
+  const { packageDir, packageJson, env } = await setupTest();
   await write(
     packageJson,
     JSON.stringify({
@@ -9550,7 +9816,7 @@ test("tarball `./` prefix, duplicate directory with file, and empty directory",
   );
 });
 
-describe("outdated", () => {
+describe.concurrent("outdated", () => {
   const edgeCaseTests = [
     {
       description: "normal dep, smaller than column title",
@@ -9619,7 +9885,9 @@ describe("outdated", () => {
   ];
 
   for (const { description, packageJson } of edgeCaseTests) {
-    test(description, async () => {
+    // serial: `toMatchSnapshot()` is not available inside concurrent tests
+    test.serial(description, async () => {
+      const { packageDir, env } = await setupTest();
       await write(join(packageDir, "package.json"), JSON.stringify(packageJson));
       await runBunInstall(env, packageDir);
       assertManifestsPopulated(join(packageDir, ".bun-cache"), registryUrl());
@@ -9633,20 +9901,19 @@ describe("outdated", () => {
         env: testEnv,
       });
 
-      expect(await exited).toBe(0);
-
-      const err = await stderr.text();
+      const [out, err, exitCode] = await Promise.all([stdout.text(), stderr.text(), exited]);
       expect(err).not.toContain("error:");
       expect(err).not.toContain("panic:");
-      const out = await stdout.text();
       const first = out.slice(0, out.indexOf("\n"));
       expect(first).toEqual(expect.stringContaining("bun outdated "));
       expect(first).toEqual(expect.stringContaining("v1."));
       const rest = out.slice(out.indexOf("\n") + 1);
       expect(rest).toMatchSnapshot();
+      expect(exitCode).toBe(0);
     });
   }
   test("in workspace", async () => {
+    const { packageDir, packageJson, env } = await setupTest();
     await Promise.all([
       write(
         packageJson,
@@ -9704,7 +9971,8 @@ describe("outdated", () => {
     expect(await exited).toBe(0);
   });
 
-  test("NO_COLOR works", async () => {
+  test.serial("NO_COLOR works", async () => {
+    const { packageDir, packageJson, env } = await setupTest();
     await write(
       packageJson,
       JSON.stringify({
@@ -9741,10 +10009,10 @@ describe("outdated", () => {
     expect(await exited).toBe(0);
   });
 
-  async function setupWorkspace() {
+  async function setupWorkspace(packageDir: string) {
     await Promise.all([
       write(
-        packageJson,
+        join(packageDir, "package.json"),
         JSON.stringify({
           name: "foo",
           workspaces: ["packages/*"],
@@ -9793,7 +10061,8 @@ describe("outdated", () => {
   }
 
   test("--filter with workspace names and paths", async () => {
-    await setupWorkspace();
+    const { packageDir, env } = await setupTest();
+    await setupWorkspace(packageDir);
     await runBunInstall(env, packageDir);
 
     let out = await runBunOutdated(env, packageDir, "--filter", "*");
@@ -9819,6 +10088,7 @@ describe("outdated", () => {
   });
 
   test("-F is an alias of --filter", async () => {
+    const { packageDir, packageJson, env } = await setupTest();
     await setupWorkspace();
     await runBunInstall(env, packageDir);
 
@@ -9837,6 +10107,7 @@ describe("outdated", () => {
   });
 
   test("--filter with relation selectors lists only the selected workspaces' dependencies", async () => {
+    const { packageDir, packageJson, env } = await setupTest();
     await Promise.all([
       write(
         packageJson,
@@ -9893,18 +10164,19 @@ describe("outdated", () => {
   });
 
   test("dependency pattern args", async () => {
-    await setupWorkspace();
+    const { packageDir, env } = await setupTest();
+    await setupWorkspace(packageDir);
     await runBunInstall(env, packageDir);
 
     let out = await runBunOutdated(env, packageDir, "no-deps", "--filter", "*");
     expect(out).toContain("no-deps");
     expect(out).not.toContain("a-dep");
-    expect(out).not.toContain("prerelease-1");
+    expect(out).not.toContain("prereleases-1");
 
     out = await runBunOutdated(env, packageDir, "a-dep");
     expect(out).not.toContain("a-dep");
     expect(out).not.toContain("no-deps");
-    expect(out).not.toContain("prerelease-1");
+    expect(out).not.toContain("prereleases-1");
 
     out = await runBunOutdated(env, packageDir, "*", "--filter", "*");
     expect(out).toContain("no-deps");
@@ -9913,6 +10185,7 @@ describe("outdated", () => {
   });
 
   test("scoped workspace names", async () => {
+    const { packageDir, packageJson, env } = await setupTest();
     await Promise.all([
       write(
         packageJson,
@@ -9947,6 +10220,7 @@ describe("outdated", () => {
   });
 
   test("catalog dependencies", async () => {
+    const { packageDir, packageJson, env } = await setupTest();
     await Promise.all([
       write(
         packageJson,
@@ -9987,6 +10261,7 @@ describe("outdated", () => {
   });
 
   test("--recursive flag for outdated", async () => {
+    const { packageDir, env } = await setupTest();
     // First verify the flag appears in help
     const {
       stdout: helpOut,
@@ -10006,7 +10281,7 @@ describe("outdated", () => {
     expect(help).toContain("-r");
 
     // Setup workspace
-    await setupWorkspace();
+    await setupWorkspace(packageDir);
     await runBunInstall(env, packageDir);
 
     // Test --recursive shows all workspaces
@@ -10017,6 +10292,7 @@ describe("outdated", () => {
   });
 
   test("catalog grouping with multiple workspaces", async () => {
+    const { packageDir, packageJson, env } = await setupTest();
     await Promise.all([
       write(
         packageJson,
@@ -10120,7 +10396,7 @@ function readBunxShim(path: string) {
   };
 }
 
-describe("windows bin linking shim should work", async () => {
+describe.concurrent("windows bin linking shim should work", async () => {
   if (!isWindows) return;
 
   const packageDir = tmpdirSync();
@@ -10153,7 +10429,7 @@ describe("windows bin linking shim should work", async () => {
     stdout: "pipe",
     stdin: "pipe",
     stderr: "pipe",
-    env,
+    env: bunEnv,
   });
 
   var err = await stderr.text();
@@ -10183,6 +10459,15 @@ describe("windows bin linking shim should work", async () => {
   copyFileSync(join(packageDir, "node_modules\\bunx-bins\\native.exe"), join(temp_bin_dir, "native.exe"));
 
   const PATH = process.env.PATH + ";" + temp_bin_dir;
+  // Every test below only executes the bins installed above, so they can all share this directory.
+  const shimEnv = mergeWindowEnvs([bunEnv, { PATH }]);
+  // `--bun` creates its fake `node.exe` inside %TEMP% (and debug builds recreate it on every run),
+  // so each `--bun` test gets its own temp directory instead of racing the others on the shared one.
+  function shimEnvWithOwnTemp(subdir: string) {
+    const temp = join(packageDir, subdir);
+    mkdirSync(temp);
+    return mergeWindowEnvs([shimEnv, { TMP: temp, TEMP: temp }]);
+  }
 
   const bins = [
     { bin: "bin1", name: "bin1" },
@@ -10220,7 +10505,7 @@ describe("windows bin linking shim should work", async () => {
         stdout: "pipe",
         stdin: "pipe",
         stderr: "pipe",
-        env: mergeWindowEnvs([env, { PATH: PATH }]),
+        env: shimEnv,
       });
       expect(stderr).toBeDefined();
       const err = await stderr.text();
@@ -10239,7 +10524,7 @@ describe("windows bin linking shim should work", async () => {
         stdout: "pipe",
         stdin: "pipe",
         stderr: "pipe",
-        env: mergeWindowEnvs([env, { PATH: PATH }]),
+        env: shimEnvWithOwnTemp(`temp-run-${bin}`),
       });
       expect(stderr).toBeDefined();
       const err = await stderr.text();
@@ -10258,7 +10543,7 @@ describe("windows bin linking shim should work", async () => {
         stdout: "pipe",
         stdin: "pipe",
         stderr: "pipe",
-        env: mergeWindowEnvs([env, { PATH: PATH }]),
+        env: shimEnvWithOwnTemp(`temp-x-${bin}`),
       });
       expect(stderr).toBeDefined();
       const err = await stderr.text();
@@ -10277,7 +10562,7 @@ describe("windows bin linking shim should work", async () => {
         stdout: "pipe",
         stdin: "pipe",
         stderr: "pipe",
-        env: mergeWindowEnvs([env, { PATH: PATH }]),
+        env: shimEnv,
       });
       expect(stderr).toBeDefined();
       const err = await stderr.text();
@@ -10401,7 +10686,8 @@ describe("global bin links when the package dir is inside the bin dir", () => {
   }
 });
 
-test("rejects dependency aliases containing relative path segments", async () => {
+test.concurrent("rejects dependency aliases containing relative path segments", async () => {
+  const { packageDir, packageJson, env } = await setupTest();
   // A dependency alias is used verbatim as a folder name when building install
   // paths (`node_modules/<alias>/node_modules/...`). `one-fixed-dep@2.0.0`
   // depends on `no-deps@2.0.0`, which conflicts with the root `no-deps@1.0.0`
@@ -10477,7 +10763,8 @@ test("rejects dependency aliases containing relative path segments", async () =>
   expect(await exited).toBe(0);
 });
 
-test("rejects package names containing relative path components in bun.lock", async () => {
+test.concurrent("rejects package names containing relative path components in bun.lock", async () => {
+  const { packageDir, packageJson, env } = await setupTest();
   // The package name from a bun.lock `packages` entry is written verbatim into
   // the cache folder name (`<cache>/<name>@<version>@@<host>@@@1`) before the
   // extracted tarball is renamed into place. A name with a leading `..`
@@ -10550,7 +10837,8 @@ test("rejects package names containing relative path components in bun.lock", as
   expect(await exited).toBe(0);
 });
 
-test("rejects npm aliases whose manifest URL resolves to a different host than the registry", async () => {
+test.concurrent("rejects npm aliases whose manifest URL resolves to a different host than the registry", async () => {
+  const { packageDir, packageJson, env } = await setupTest();
   // The manifest URL is built by joining the registry URL with the package
   // name. WHATWG URL joining treats "\" like "/" for http(s) schemes, so a
   // name beginning with two backslashes becomes a protocol-relative authority:
@@ -10567,7 +10855,8 @@ test("rejects npm aliases whose manifest URL resolves to a different host than t
     },
   });
 
-  const token = await generateRegistryUser("manifest-host-pinning", "manifest-host-pinning");
+  // The request is refused before it is sent, so the token only has to exist, not be valid.
+  const token = "manifest-host-pinning-token";
   await Promise.all([
     write(
       join(packageDir, "bunfig.toml"),
@@ -10612,144 +10901,149 @@ test("rejects npm aliases whose manifest URL resolves to a different host than t
   expect(await exited).not.toBe(0);
 });
 
-test("registry override from a project .env only keeps the saved token when the host matches and the scheme is not downgraded", async () => {
-  // `bun install` loads the project's `.env` before computing installer
-  // options, so a repo-committed `.env` can point BUN_CONFIG_REGISTRY at a
-  // different registry host. The token configured for the default registry
-  // scope is host-scoped and must only be attached to requests for that host.
-  const received: { url: string; authorization: string | null }[] = [];
-  using otherRegistry = Bun.serve({
-    port: 0,
-    fetch(req) {
-      received.push({ url: req.url, authorization: req.headers.get("authorization") });
-      return new Response("not found", { status: 404 });
-    },
-  });
-
-  const token = "default-registry-secret-token";
+test.concurrent(
+  "registry override from a project .env only keeps the saved token when the host matches and the scheme is not downgraded",
+  async () => {
+    const { packageDir, packageJson, env } = await setupTest();
+    // `bun install` loads the project's `.env` before computing installer
+    // options, so a repo-committed `.env` can point BUN_CONFIG_REGISTRY at a
+    // different registry host. The token configured for the default registry
+    // scope is host-scoped and must only be attached to requests for that host.
+    const received: { url: string; authorization: string | null }[] = [];
+    using otherRegistry = Bun.serve({
+      port: 0,
+      fetch(req) {
+        received.push({ url: req.url, authorization: req.headers.get("authorization") });
+        return new Response("not found", { status: 404 });
+      },
+    });
 
-  // Case 1: the .env points the registry at a different host. The manifest
-  // request must reach that host without the default registry's token.
-  await Promise.all([
-    write(
-      join(packageDir, "bunfig.toml"),
-      Bun.TOML.stringify({
-        install: {
-          cache: false,
-          registry: { url: `http://localhost:${port}/`, token },
-        },
-      }),
-    ),
-    write(
-      packageJson,
-      JSON.stringify({
-        name: "foo",
-        version: "1.0.0",
-        dependencies: {
-          "no-deps": "1.0.0",
-        },
-      }),
-    ),
-    write(join(packageDir, ".env"), `BUN_CONFIG_REGISTRY=http://127.0.0.1:${otherRegistry.port}/\n`),
-  ]);
+    const token = "default-registry-secret-token";
 
-  {
-    const { stdout, stderr, exited } = spawn({
-      cmd: [bunExe(), "install"],
-      cwd: packageDir,
-      stdout: "pipe",
-      stdin: "pipe",
-      stderr: "pipe",
-      env,
-    });
-    await stderr.text();
-    await stdout.text();
+    // Case 1: the .env points the registry at a different host. The manifest
+    // request must reach that host without the default registry's token.
+    await Promise.all([
+      write(
+        join(packageDir, "bunfig.toml"),
+        Bun.TOML.stringify({
+          install: {
+            cache: false,
+            registry: { url: `http://localhost:${port}/`, token },
+          },
+        }),
+      ),
+      write(
+        packageJson,
+        JSON.stringify({
+          name: "foo",
+          version: "1.0.0",
+          dependencies: {
+            "no-deps": "1.0.0",
+          },
+        }),
+      ),
+      write(join(packageDir, ".env"), `BUN_CONFIG_REGISTRY=http://127.0.0.1:${otherRegistry.port}/\n`),
+    ]);
 
-    // The .env override must take effect: the manifest request goes to the
-    // overridden registry...
-    expect(received.length).toBeGreaterThan(0);
-    // ...but the token configured for the localhost registry must not be sent
-    // to the different host.
-    expect(received.filter(r => r.authorization !== null)).toEqual([]);
-    // The overridden registry returned 404, so this install fails.
-    expect(await exited).not.toBe(0);
-  }
+    {
+      const { stdout, stderr, exited } = spawn({
+        cmd: [bunExe(), "install"],
+        cwd: packageDir,
+        stdout: "pipe",
+        stdin: "pipe",
+        stderr: "pipe",
+        env,
+      });
+      await stderr.text();
+      await stdout.text();
+
+      // The .env override must take effect: the manifest request goes to the
+      // overridden registry...
+      expect(received.length).toBeGreaterThan(0);
+      // ...but the token configured for the localhost registry must not be sent
+      // to the different host.
+      expect(received.filter(r => r.authorization !== null)).toEqual([]);
+      // The overridden registry returned 404, so this install fails.
+      expect(await exited).not.toBe(0);
+    }
 
-  // Case 2: when the override points at the same host the token was
-  // configured for, the token is still sent.
-  received.length = 0;
-  await Promise.all([
-    rm(join(packageDir, "bun.lock"), { force: true }),
-    rm(join(packageDir, "bun.lockb"), { force: true }),
-    write(
-      join(packageDir, "bunfig.toml"),
-      Bun.TOML.stringify({
-        install: {
-          cache: false,
-          registry: { url: `http://127.0.0.1:${otherRegistry.port}/`, token },
-        },
-      }),
-    ),
-    write(join(packageDir, ".env"), `BUN_CONFIG_REGISTRY=http://127.0.0.1:${otherRegistry.port}/\n`),
-  ]);
+    // Case 2: when the override points at the same host the token was
+    // configured for, the token is still sent.
+    received.length = 0;
+    await Promise.all([
+      rm(join(packageDir, "bun.lock"), { force: true }),
+      rm(join(packageDir, "bun.lockb"), { force: true }),
+      write(
+        join(packageDir, "bunfig.toml"),
+        Bun.TOML.stringify({
+          install: {
+            cache: false,
+            registry: { url: `http://127.0.0.1:${otherRegistry.port}/`, token },
+          },
+        }),
+      ),
+      write(join(packageDir, ".env"), `BUN_CONFIG_REGISTRY=http://127.0.0.1:${otherRegistry.port}/\n`),
+    ]);
 
-  {
-    const { stdout, stderr, exited } = spawn({
-      cmd: [bunExe(), "install"],
-      cwd: packageDir,
-      stdout: "pipe",
-      stdin: "pipe",
-      stderr: "pipe",
-      env,
-    });
-    await stderr.text();
-    await stdout.text();
+    {
+      const { stdout, stderr, exited } = spawn({
+        cmd: [bunExe(), "install"],
+        cwd: packageDir,
+        stdout: "pipe",
+        stdin: "pipe",
+        stderr: "pipe",
+        env,
+      });
+      await stderr.text();
+      await stdout.text();
 
-    expect(received.length).toBeGreaterThan(0);
-    expect(received.some(r => r.authorization === `Bearer ${token}`)).toBe(true);
-    expect(await exited).not.toBe(0);
-  }
+      expect(received.length).toBeGreaterThan(0);
+      expect(received.some(r => r.authorization === `Bearer ${token}`)).toBe(true);
+      expect(await exited).not.toBe(0);
+    }
 
-  // Case 3: the override points at the same host but downgrades https to
-  // http. The token configured for the https registry must not be sent.
-  received.length = 0;
-  await Promise.all([
-    rm(join(packageDir, "bun.lock"), { force: true }),
-    rm(join(packageDir, "bun.lockb"), { force: true }),
-    write(
-      join(packageDir, "bunfig.toml"),
-      Bun.TOML.stringify({
-        install: {
-          cache: false,
-          registry: { url: `https://127.0.0.1:${otherRegistry.port}/`, token },
-        },
-      }),
-    ),
-    write(join(packageDir, ".env"), `BUN_CONFIG_REGISTRY=http://127.0.0.1:${otherRegistry.port}/\n`),
-  ]);
+    // Case 3: the override points at the same host but downgrades https to
+    // http. The token configured for the https registry must not be sent.
+    received.length = 0;
+    await Promise.all([
+      rm(join(packageDir, "bun.lock"), { force: true }),
+      rm(join(packageDir, "bun.lockb"), { force: true }),
+      write(
+        join(packageDir, "bunfig.toml"),
+        Bun.TOML.stringify({
+          install: {
+            cache: false,
+            registry: { url: `https://127.0.0.1:${otherRegistry.port}/`, token },
+          },
+        }),
+      ),
+      write(join(packageDir, ".env"), `BUN_CONFIG_REGISTRY=http://127.0.0.1:${otherRegistry.port}/\n`),
+    ]);
 
-  {
-    const { stdout, stderr, exited } = spawn({
-      cmd: [bunExe(), "install"],
-      cwd: packageDir,
-      stdout: "pipe",
-      stdin: "pipe",
-      stderr: "pipe",
-      env,
-    });
-    await stderr.text();
-    await stdout.text();
+    {
+      const { stdout, stderr, exited } = spawn({
+        cmd: [bunExe(), "install"],
+        cwd: packageDir,
+        stdout: "pipe",
+        stdin: "pipe",
+        stderr: "pipe",
+        env,
+      });
+      await stderr.text();
+      await stdout.text();
 
-    expect(received.length).toBeGreaterThan(0);
-    expect(received.filter(r => r.authorization !== null)).toEqual([]);
-    expect(await exited).not.toBe(0);
-  }
-});
+      expect(received.length).toBeGreaterThan(0);
+      expect(received.filter(r => r.authorization !== null)).toEqual([]);
+      expect(await exited).not.toBe(0);
+    }
+  },
+);
 
-describe("registry/token env var priority", () => {
+describe.concurrent("registry/token env var priority", () => {
   // BUN_CONFIG_* takes precedence over NPM_CONFIG_*, which takes precedence
   // over npm_config_*. An empty value falls through to the next candidate.
   async function installAndCaptureAuth(extraEnv: Record<string, string>) {
+    const { packageDir, packageJson, env } = await setupTest();
     const received: (string | null)[] = [];
     await using server = Bun.serve({
       port: 0,
@@ -10806,6 +11100,7 @@ describe("registry/token env var priority", () => {
   });
 
   test("BUN_CONFIG_REGISTRY wins over NPM_CONFIG_REGISTRY", async () => {
+    const { packageDir, packageJson, env } = await setupTest();
     const hits = { preferred: 0, other: 0 };
     await using preferred = Bun.serve({
       port: 0,
@@ -10845,7 +11140,8 @@ describe("registry/token env var priority", () => {
   });
 });
 
-test("npm manifest cache entries with invalid package version records are treated as invalid", async () => {
+test.concurrent("npm manifest cache entries with invalid package version records are treated as invalid", async () => {
+  const { packageDir, packageJson, env } = await setupTest();
   await write(
     packageJson,
     JSON.stringify({
@@ -10907,7 +11203,8 @@ test("npm manifest cache entries with invalid package version records are treate
   expect(() => parseManifest(corrupted, registryUrl())).toThrow("manifest is invalid");
 });
 
-test("npm manifest cache entries are only reused for the package name they were saved for", async () => {
+test.concurrent("npm manifest cache entries are only reused for the package name they were saved for", async () => {
+  const { packageDir, packageJson, env } = await setupTest();
   const { parseManifest } = npm_manifest_test_helpers;
   const cacheDir = join(packageDir, ".bun-cache");
 
@@ -11202,6 +11499,7 @@ describe("manifest conditional requests", () => {
   // deleted the entry, and another install reading the cache in between missed it. The poll
   // below is that other reader. Linux only: the other platforms rename the new file into place.
   test.skipIf(!isLinux)("rewriting a cached manifest never leaves the cache without the entry", async () => {
+    ({ packageDir, packageJson, env } = await setupTest());
     const { server, requests } = startRegistry({ etag });
     using _ = server;
     await setup(server.port);

From 297ed01bf5a1ffe61dff60a073784188df534b9d Mon Sep 17 00:00:00 2001
From: robobun <117481402+robobun@users.noreply.github.com>
Date: Mon, 17 Aug 2026 03:20:47 +0000
Subject: [PATCH 173/258] test/docker: wait for the docker daemon in the
 coordinator instead of failing on a one-shot probe (#39243)

---
 scripts/agent.mjs                          |  49 +++
 scripts/utils.mjs                          |  24 +-
 test/cli/install/bun-install-proxy.test.ts |  63 ++--
 test/docker/coordinator.ts                 |  32 +-
 test/docker/index.ts                       | 108 ++++++-
 test/docker/prestart-map.mjs               |   1 +
 test/harness.ts                            |  10 +
 test/internal/docker-coordinator.test.ts   | 332 +++++++++++++++++++++
 8 files changed, 574 insertions(+), 45 deletions(-)
 create mode 100644 test/internal/docker-coordinator.test.ts

diff --git a/scripts/agent.mjs b/scripts/agent.mjs
index ca4e7bda731c..4071b6c06a3e 100755
--- a/scripts/agent.mjs
+++ b/scripts/agent.mjs
@@ -4,6 +4,7 @@
 
 import { copyFileSync, existsSync, readFileSync, realpathSync } from "node:fs";
 import { join } from "node:path";
+import { setTimeout as setTimeoutPromise } from "node:timers/promises";
 import { fileURLToPath } from "node:url";
 import { parseArgs } from "node:util";
 import {
@@ -21,11 +22,13 @@ import {
   getKernel,
   getOs,
   homedir,
+  isLinux,
   isMacOS,
   isPosix,
   isWindows,
   mkdir,
   spawnSafe,
+  spawnSync,
   which,
   writeFile,
 } from "./utils.mjs";
@@ -105,6 +108,15 @@ async function doBuildkiteAgent(action, cliOptions = {}) {
     }
 
     if (isOpenRc()) {
+      // openrc starts a runlevel's unrelated services one at a time in name
+      // order, so without `after docker` this service ("b") starts, and the
+      // ephemeral agent acquires its job, before the boot has reached "docker";
+      // the shard then begins with no daemon socket at all (routine on the
+      // alpine test agents, occasionally for minutes when a service in between
+      // is slow). `after` is ordering only: images without docker still boot
+      // the agent. Alpine's docker service returns as soon as dockerd is
+      // spawned, so start() below additionally waits for the daemon to answer.
+      // Both take effect when the images are next published.
       const servicePath = "/etc/init.d/buildkite-agent";
       const service = `#!/sbin/openrc-run
         name="buildkite-agent"
@@ -123,6 +135,7 @@ async function doBuildkiteAgent(action, cliOptions = {}) {
         depend() {
           need net
           use dns logger
+          after docker
         }
       `;
       writeFile(servicePath, service, { mode: 0o755 });
@@ -390,6 +403,19 @@ async function doBuildkiteAgent(action, cliOptions = {}) {
       .map(([key, value]) => `${key}=${value}`)
       .join(",");
 
+    // The job this machine was booted for starts the moment the agent
+    // registers (acquire-job above), and the Linux test jobs need dockerd. The
+    // init system only orders this service after docker's start script (see
+    // install()), which on alpine returns as soon as dockerd is spawned, so
+    // give the daemon a bounded head start here: registering later only
+    // delays the job, registering before the daemon listens starts the job
+    // against a dead socket (test/docker/index.ts has the history). Past the
+    // budget the agent registers anyway and the job's "--- Docker" section
+    // reports the daemon's state.
+    if (isLinux && which("docker")) {
+      await waitForDockerDaemon(2 * 60_000);
+    }
+
     await spawnSafe(
       [
         command,
@@ -410,6 +436,29 @@ async function doBuildkiteAgent(action, cliOptions = {}) {
   }
 }
 
+/**
+ * Polls `docker version` (which fails until the daemon is listening) once a
+ * second for up to `budgetMs`. Returns either way; the outcome is logged.
+ * @param {number} budgetMs
+ */
+async function waitForDockerDaemon(budgetMs) {
+  const startedAt = Date.now();
+  const elapsed = () => `${Math.round((Date.now() - startedAt) / 1000)}s`;
+  const reachable = () => spawnSync(["docker", "version"], { timeout: 10_000 }).exitCode === 0;
+  if (reachable()) {
+    return;
+  }
+  console.log(`Docker daemon is not reachable yet; waiting up to ${Math.round(budgetMs / 1000)}s for it...`);
+  while (Date.now() - startedAt < budgetMs) {
+    await setTimeoutPromise(1_000);
+    if (reachable()) {
+      console.log(`Docker daemon became reachable after ${elapsed()}`);
+      return;
+    }
+  }
+  console.warn(`Docker daemon still unreachable after ${elapsed()}; starting the agent without it`);
+}
+
 /**
  * @returns {boolean}
  */
diff --git a/scripts/utils.mjs b/scripts/utils.mjs
index 713e8ecb6d9e..3594920fbd06 100755
--- a/scripts/utils.mjs
+++ b/scripts/utils.mjs
@@ -2781,7 +2781,29 @@ export function printEnvironment() {
       startGroup("Docker", () => {
         const shell = which(["sh", "bash"]);
         if (shell) {
-          spawnSync([shell, "-c", "docker ps"], { stdio: "inherit" });
+          const { exitCode } = spawnSync([shell, "-c", "docker ps"], { stdio: "inherit" });
+          if (exitCode !== 0) {
+            // The agent can start the job before the boot has brought dockerd
+            // up (scripts/agent.mjs orders and waits for it on images published
+            // after that change; test/docker/coordinator.ts waits for it on
+            // every image, so this is not fatal). On openrc the service table
+            // shows which boot step the daemon was still behind.
+            if (which("rc-status")) {
+              spawnSync([shell, "-c", "rc-status"], { stdio: "inherit" });
+            }
+            // One line per affected job under a single per-build annotation, so
+            // how often this still happens can be read off builds (and compared
+            // across image publishes) without grepping job logs. Info style:
+            // nothing has failed, and `bun run ci:errors` lists only error-style
+            // annotations.
+            reportAnnotationToBuildKite({
+              context: "docker-daemon-not-up-at-job-start",
+              label: "docker daemon not up at job start",
+              content: `- dockerd was not up when [${getBuildLabel()}](${getBuildUrl()}) started on \`${getHostname()}\`\n`,
+              style: "info",
+              priority: 1,
+            });
+          }
         }
       });
     }
diff --git a/test/cli/install/bun-install-proxy.test.ts b/test/cli/install/bun-install-proxy.test.ts
index 4a4f2bf8ee7f..816e7d3a6577 100644
--- a/test/cli/install/bun-install-proxy.test.ts
+++ b/test/cli/install/bun-install-proxy.test.ts
@@ -1,44 +1,39 @@
 import { beforeAll, describe, expect, it } from "bun:test";
-import { exec } from "child_process";
 import { rm } from "fs/promises";
-import { bunEnv, bunExe, dockerExe, isDockerEnabled, tempDir, tempDirWithFiles } from "harness";
+import { bunEnv, bunExe, isDockerEnabled, tempDir, tempDirWithFiles } from "harness";
 import { join } from "path";
-import { promisify } from "util";
-const execAsync = promisify(exec);
-const dockerCLI = dockerExe() as string;
-const SQUID_URL = "http://127.0.0.1:3128";
+import { ensure } from "../../docker/index.ts";
+
+let SQUID_URL: string;
 if (isDockerEnabled()) {
   describe("squid", () => {
+    // The compose `squid` service is the same ubuntu/squid image this file used
+    // to `docker run` itself on a fixed host port. Going through ensure() means
+    // the shard's coordinator starts it (and waits for the docker daemon if the
+    // job began before it was up) and it gets a free port like every other
+    // test service.
     beforeAll(async () => {
-      async function isSquidRunning() {
-        const text = await fetch(SQUID_URL)
-          .then(res => res.text())
-          .catch(() => {});
-        return text?.includes("squid") ?? false;
-      }
-      if (!(await isSquidRunning())) {
-        // try to create or error if is already created
-        await execAsync(
-          `${dockerCLI} run -d --name squid-container -e TZ=UTC -p 3128:3128 ubuntu/squid:5.2-22.04_beta`,
-        ).catch(() => {});
-
-        async function waitForSquid(max_wait = 60_000) {
-          const start = Date.now();
-          while (true) {
-            if (await isSquidRunning()) {
-              return;
-            }
-            if (Date.now() - start > max_wait) {
-              throw new Error("Squid did not start in time");
-            }
-
-            await Bun.sleep(1000);
-          }
-        }
-        // wait for squid to start
-        await waitForSquid();
+      const squid = await ensure("squid");
+      SQUID_URL = `http://${squid.host}:${squid.ports[3128]}`;
+      // The container counts as healthy once the squid process exists. Like the
+      // isSquidRunning() loop this replaces, wait until it answers HTTP (a plain
+      // GET of the proxy itself gets squid's own error page) before installing
+      // through it.
+      const squidAnswers = async () => {
+        const body = await fetch(SQUID_URL, { signal: AbortSignal.timeout(5_000) }).then(
+          res => res.text(),
+          () => "",
+        );
+        return body.includes("squid");
+      };
+      const deadline = Date.now() + 30_000;
+      while (!(await squidAnswers())) {
+        if (Date.now() > deadline) throw new Error(`squid at ${SQUID_URL} did not answer within 30s`);
+        await Bun.sleep(250);
       }
-    });
+      // Same hook budget as describeWithContainer(): a cold start is a `compose
+      // build` plus `up --wait` with a 180s wait-timeout.
+    }, 240_000);
 
     it("bun install with proxy with big packages", async () => {
       const files = {
diff --git a/test/docker/coordinator.ts b/test/docker/coordinator.ts
index d189ccfa269c..5667b87cf380 100644
--- a/test/docker/coordinator.ts
+++ b/test/docker/coordinator.ts
@@ -17,13 +17,18 @@
  * predicts which services argv's tests need and starts them at launch, so
  * they're healthy by the time the first test asks.
  *
+ * It is also the one place that waits for the docker daemon itself: the agent
+ * can start the shard while dockerd is still coming up, and every request
+ * (prestart or test) blocks on the shared wait below instead of failing on a
+ * one-shot probe.
+ *
  * Lifetime is tied to the runner: stdin is a pipe from it, and EOF means the
  * runner is gone.
  */
 
 import { unlinkSync } from "node:fs";
 import * as net from "node:net";
-import { ensure, type ServiceInfo, type ServiceName } from "./index.ts";
+import { ensure, waitForDockerDaemon, type ServiceInfo, type ServiceName } from "./index.ts";
 import { prestartMap as prestartMapRaw } from "./prestart-map.mjs";
 
 // Keys are paths relative to test/ — that's the shape runner.node.mjs passes
@@ -44,6 +49,30 @@ if (!socketPath) {
 // environment.
 delete process.env.BUN_DOCKER_COORDINATOR;
 
+// The shard may start before dockerd has finished coming up (see
+// waitForDockerDaemon); start polling for it right away so the wait overlaps
+// the non-container tests the runner schedules first. The window is well past
+// the latest the daemon has been seen to appear in CI (up by ~7 minutes into
+// the job); once it closes, requests fail immediately, so a host whose daemon
+// never comes up costs the shard one window rather than a full wait per file
+// attempt. The per-request cap is the budget scripts/runner.node.mjs gives the
+// hook that is typically awaiting the request (--timeout = testTimeout / 2 on
+// the release lanes; the ASAN lanes get three times that but run on systemd
+// images, where the daemon has always been up at job start), so a request
+// either gets the daemon or a clear error within the time its caller has
+// anyway, and the 3-minute file budget keeps room for `compose up` and the
+// tests after it. A file whose request hits the cap is retried by the runner,
+// and the retry's request gets a fresh cap against the same shared wait, so a
+// file's four attempts together cover ~6 minutes of daemon lateness from the
+// file's first request (container-backed files are also scheduled late in the
+// shard, see prestart-map.mjs).
+const awaitDockerDaemon = waitForDockerDaemon({
+  windowMs: 10 * 60_000,
+  pollMs: 1_000,
+  log: message => console.log(`coordinator: ${message}`),
+});
+const DAEMON_WAIT_PER_REQUEST_MS = 90_000;
+
 // Collapse concurrent requests for one service onto a single ensureServiceNow(),
 // and remember the last ServiceInfo a successful ensure produced. The full
 // ensure() path costs several serial `docker compose` spawns (build, ps -a,
@@ -97,6 +126,7 @@ async function ensureServiceNow(service: ServiceName): Promise<ServiceInfo> {
 
   console.log(`coordinator: ensuring ${service}`);
   try {
+    await awaitDockerDaemon(DAEMON_WAIT_PER_REQUEST_MS);
     const info = await ensure(service);
     console.log(`coordinator: ${service} ready`);
     lastGood.set(service, info);
diff --git a/test/docker/index.ts b/test/docker/index.ts
index 55a178f0f6ad..15361b35607b 100644
--- a/test/docker/index.ts
+++ b/test/docker/index.ts
@@ -125,6 +125,104 @@ function serviceFromEnv(service: ServiceName): ServiceInfo | null {
   return info;
 }
 
+/**
+ * One `docker version` round trip. The CLI exits non-zero until the daemon
+ * accepts connections on its socket, so this is the daemon readiness signal.
+ * (`docker compose version` is not: compose is a CLI plugin and succeeds with
+ * no daemon at all, which is why scripts/runner.node.mjs can use it to decide
+ * whether to start the coordinator before the daemon is up.) A daemon that
+ * accepts the connection but never answers would otherwise hang the CLI, and
+ * with it every wait built on this probe, so the CLI is killed after
+ * `timeoutMs` and counted as unreachable; a healthy round trip takes well
+ * under a second.
+ */
+export async function isDockerDaemonReachable(timeoutMs = 10_000): Promise<boolean> {
+  const proc = spawn({
+    cmd: ["docker", "version"],
+    stdout: "ignore",
+    stderr: "ignore",
+    timeout: timeoutMs,
+  });
+  return (await proc.exited) === 0;
+}
+
+export interface DockerDaemonWaitOptions {
+  /** Stop polling, and fail every waiter, once the daemon has stayed unreachable this long. */
+  windowMs: number;
+  /** Delay between probes. */
+  pollMs: number;
+  /** Replaces the `docker version` probe; tests script it. */
+  probe?: () => Promise<boolean>;
+  /** Where the "waiting" / "reachable after Ns" / "giving up" lines go. */
+  log?: (message: string) => void;
+}
+
+/**
+ * Starts polling for the docker daemon and returns `waitFor(capMs)`, which
+ * resolves once a probe has succeeded and rejects if the daemon is still
+ * unreachable after `capMs`, or once `windowMs` has passed in total. Every
+ * caller shares the one poll loop: a rejected `waitFor` does not stop it, so a
+ * caller that retries later gets the daemon as soon as it is up, and callers
+ * arriving after the window has closed fail immediately.
+ *
+ * Linux CI agents can pick up a job before dockerd has finished starting. The
+ * openrc (alpine) images published before scripts/agent.mjs ordered the agent
+ * service after docker routinely start a shard with no /var/run/docker.sock
+ * yet; the daemon usually appears within ~10s, but in builds 97891, 98647,
+ * 98707 and 98746 it was still down 3-4.5 minutes into the job and up by 5-7
+ * minutes, and the coordinator's one-shot probe failed every container-backed
+ * test file in those shards (all in-shard retries included, since they run
+ * within seconds of each other). The boot-ordering fix in agent.mjs is the
+ * primary fix once images are republished; this keeps shards green on the
+ * current images and covers whatever dockerd start-up time is left after it
+ * (the runner's `--- Docker` job section records how often that still
+ * happens). When a probe succeeds on the first try, which is the case on every
+ * systemd image, nothing is logged and `waitFor` costs nothing beyond that
+ * probe.
+ */
+export function waitForDockerDaemon({
+  windowMs,
+  pollMs,
+  probe = isDockerDaemonReachable,
+  log = console.log,
+}: DockerDaemonWaitOptions): (capMs: number) => Promise<void> {
+  const startedAt = Date.now();
+  const unreachableFor = () => `${Math.round((Date.now() - startedAt) / 1000)}s`;
+
+  const ready: Promise<void> = (async () => {
+    if (await probe()) return;
+    log(`docker daemon is not reachable yet; waiting up to ${Math.round(windowMs / 1000)}s for it to come up`);
+    while (Date.now() - startedAt < windowMs) {
+      await Bun.sleep(pollMs);
+      if (await probe()) {
+        log(`docker daemon became reachable after ${unreachableFor()}`);
+        return;
+      }
+    }
+    const message = `Docker daemon still unreachable after ${unreachableFor()} (\`docker version\` kept failing); not waiting for it any longer`;
+    log(message);
+    throw new Error(message);
+  })();
+  // The window can close while no request is waiting; each waiter gets the
+  // rejection through the race below, so it must not also be reported as an
+  // unhandled rejection here.
+  ready.catch(() => {});
+
+  return function waitFor(capMs: number): Promise<void> {
+    let timer: ReturnType<typeof setTimeout> | undefined;
+    const cap = new Promise<never>((_, reject) => {
+      timer = setTimeout(() => {
+        reject(
+          new Error(
+            `Docker daemon not reachable (unreachable for ${unreachableFor()} so far); gave up waiting for it after ${Math.round(capMs / 1000)}s for this request`,
+          ),
+        );
+      }, capMs);
+    });
+    return Promise.race([ready, cap]).finally(() => clearTimeout(timer));
+  };
+}
+
 interface DockerComposeOptions {
   projectName?: string;
   composeFile?: string;
@@ -174,15 +272,7 @@ class DockerComposeHelper {
   }
 
   async ensureDocker(): Promise<void> {
-    // Check Docker is available
-    const dockerCheck = spawn({
-      cmd: ["docker", "version"],
-      stdout: "pipe",
-      stderr: "pipe",
-    });
-
-    const exitCode = await dockerCheck.exited;
-    if (exitCode !== 0) {
+    if (!(await isDockerDaemonReachable())) {
       throw new Error("Docker is not available. Please ensure Docker is installed and running.");
     }
 
diff --git a/test/docker/prestart-map.mjs b/test/docker/prestart-map.mjs
index a8c0c0d9b5bd..b4956426be48 100644
--- a/test/docker/prestart-map.mjs
+++ b/test/docker/prestart-map.mjs
@@ -25,6 +25,7 @@ export const prestartMap = {
   "js/bun/s3/": ["minio"],
   "js/web/websocket/autobahn": ["autobahn"],
   "js/web/websocket/websocket-proxy": ["squid"],
+  "cli/install/bun-install-proxy": ["squid"],
   "integration/mysql2/": ["mysql_plain", "mysql_native_password"],
   "regression/issue/21311": ["postgres_plain"],
   "regression/issue/24850": ["mysql_plain"],
diff --git a/test/harness.ts b/test/harness.ts
index bb58e519a7a0..a4018ba8a07b 100644
--- a/test/harness.ts
+++ b/test/harness.ts
@@ -1171,6 +1171,16 @@ export function isDockerEnabled(): boolean {
     return false;
   }
 
+  // The CI runner sets this once test/docker/coordinator.ts is up; it owns the
+  // daemon from then on and waits for it if the agent started the shard before
+  // dockerd finished coming up (routine on the openrc images). Probing the
+  // daemon here as well would fail the whole file at import time during that
+  // window, and costs a `docker info` per file. describeWithContainer() and
+  // test/js/valkey/test-utils.ts already trust the coordinator the same way.
+  if (process.env.BUN_DOCKER_COORDINATOR) {
+    return true;
+  }
+
   try {
     const info = execSync(`"${dockerCLI}" info`, { stdio: ["ignore", "pipe", "inherit"] });
     return info.toString().indexOf("Server Version:") !== -1;
diff --git a/test/internal/docker-coordinator.test.ts b/test/internal/docker-coordinator.test.ts
new file mode 100644
index 000000000000..350302ffe4cb
--- /dev/null
+++ b/test/internal/docker-coordinator.test.ts
@@ -0,0 +1,332 @@
+/**
+ * test/docker/coordinator.ts is spawned by scripts/runner.node.mjs at the start
+ * of every Linux CI shard and owns `docker compose` for the container-backed
+ * test files in it. The agent can start a shard before dockerd has finished
+ * coming up (on the openrc images the agent service is not ordered after
+ * docker), and until the coordinator waited for the daemon, its one-shot
+ * `docker version` answered every request, and so failed every container-backed
+ * test file in the shard including the in-shard retries, with "Docker is not
+ * available" (builds 97891, 98647, 98707, 98746: the daemon was still down 3-4.5
+ * minutes into the job and came up a few minutes after that).
+ *
+ * The wait is driven here with a scripted probe and millisecond timings. The
+ * tests after that put a fake `docker` on PATH: one whose CLI hangs, to pin
+ * the probe's own bound (everything above assumes a probe returns), and one
+ * whose daemon is still starting, used both for isDockerEnabled() in
+ * test/harness.ts (which used to probe the daemon at import time of ~25 test
+ * files and so failed them the same way) and to run the real coordinator end
+ * to end.
+ */
+import { expect, test } from "bun:test";
+import { bunEnv, bunExe, isLinux, isWindows, tempDir } from "harness";
+import { chmodSync, existsSync, readFileSync } from "node:fs";
+import { connect } from "node:net";
+import { join } from "node:path";
+
+import { waitForDockerDaemon } from "../docker/index.ts";
+
+/** Answers `outcomes` in order, then `finalOutcome` forever. */
+function scriptedProbe(outcomes: boolean[], finalOutcome: boolean) {
+  const remaining = [...outcomes];
+  const probe = async () => {
+    probe.calls++;
+    return remaining.length ? remaining.shift()! : finalOutcome;
+  };
+  probe.calls = 0;
+  return probe;
+}
+
+const rejection = (promise: Promise<unknown>) =>
+  promise.then(
+    () => {
+      throw new Error("expected the wait to fail");
+    },
+    (error: Error) => error,
+  );
+
+test("a daemon that is already up costs one probe and logs nothing", async () => {
+  const probe = scriptedProbe([], true);
+  const log: string[] = [];
+  const waitFor = waitForDockerDaemon({ windowMs: 10_000, pollMs: 1, probe, log: m => log.push(m) });
+
+  await waitFor(1_000);
+
+  expect(probe.calls).toBe(1);
+  expect(log).toEqual([]);
+});
+
+test("requests made while the daemon is starting wait for it on one shared poll loop", async () => {
+  const probe = scriptedProbe([false, false, false], true);
+  const log: string[] = [];
+  const waitFor = waitForDockerDaemon({ windowMs: 10_000, pollMs: 1, probe, log: m => log.push(m) });
+
+  // Two services requested at once, as the prestart does.
+  await Promise.all([waitFor(5_000), waitFor(5_000)]);
+
+  expect(probe.calls).toBe(4);
+  expect(log).toEqual([
+    "docker daemon is not reachable yet; waiting up to 10s for it to come up",
+    expect.stringMatching(/^docker daemon became reachable after \d+s$/),
+  ]);
+
+  // From now on requests neither probe nor wait.
+  await waitFor(0);
+  expect(probe.calls).toBe(4);
+});
+
+test("a request that hits its cap fails by itself; polling continues so a retry gets the daemon", async () => {
+  let up = false;
+  let calls = 0;
+  const probe = async () => {
+    calls++;
+    return up;
+  };
+  const waitFor = waitForDockerDaemon({ windowMs: 10_000, pollMs: 1, probe, log: () => {} });
+
+  const error = await rejection(waitFor(20));
+  expect(error.message).toMatch(
+    /^Docker daemon not reachable \(unreachable for \d+s so far\); gave up waiting for it after 0s for this request$/,
+  );
+
+  // The runner retries the file whose request just failed; by then the daemon
+  // may be up, and the retry's request must see that.
+  const callsAtCap = calls;
+  up = true;
+  await waitFor(5_000);
+  expect(calls).toBeGreaterThan(callsAtCap);
+});
+
+test("a request pending when the window closes gets the window failure", async () => {
+  const probe = scriptedProbe([], false);
+  const log: string[] = [];
+  const waitFor = waitForDockerDaemon({ windowMs: 30, pollMs: 1, probe, log: m => log.push(m) });
+
+  const error = await rejection(waitFor(5_000));
+  expect(error.message).toMatch(
+    /^Docker daemon still unreachable after \d+s \(`docker version` kept failing\); not waiting for it any longer$/,
+  );
+  // The same line goes to the shard log, so the log explains the failures even
+  // when they surface in test files much later.
+  expect(log).toEqual(["docker daemon is not reachable yet; waiting up to 0s for it to come up", error.message]);
+});
+
+test("after the window closes with nothing waiting, later requests fail at once instead of waiting out their cap", async () => {
+  const probe = scriptedProbe([], false);
+  const { promise: windowClosed, resolve: onWindowClosed } = Promise.withResolvers<string>();
+  const waitFor = waitForDockerDaemon({
+    windowMs: 30,
+    pollMs: 1,
+    probe,
+    log: message => {
+      if (message.startsWith("Docker daemon still unreachable")) onWindowClosed(message);
+    },
+  });
+
+  // Nobody is waiting while the window closes. The log line is emitted just
+  // before the shared promise rejects, so let the event loop turn once: if the
+  // wait let that rejection escape, bun:test reports it as an unhandled error
+  // here, before any request attaches to it.
+  const message = await windowClosed;
+  await new Promise<void>(resolve => setImmediate(resolve));
+  const callsAtClose = probe.calls;
+
+  const error = await rejection(waitFor(60_000));
+  expect(error.message).toBe(message);
+  expect(probe.calls).toBe(callsAtClose);
+});
+
+// A `docker` CLI whose daemon is still starting: `docker info` fails, `docker
+// version` fails the first time it is run and succeeds from then on, `docker
+// compose ... port <service> <port>` answers with a fixed host port, and the
+// other compose subcommands (version, build, ps, up) succeed silently. Every
+// invocation is appended to calls.log in the directory above bin/.
+const fakeDocker = `#!/bin/sh
+state=$(dirname "$0")/..
+echo "$*" >> "$state/calls.log"
+case "$1" in
+  info)
+    exit 1
+    ;;
+  version)
+    if [ -e "$state/probed-once" ]; then exit 0; fi
+    : > "$state/probed-once"
+    echo "Cannot connect to the Docker daemon at unix:///var/run/docker.sock" >&2
+    exit 1
+    ;;
+  compose)
+    for arg in "$@"; do
+      if [ "$arg" = port ]; then echo "0.0.0.0:54321"; exit 0; fi
+    done
+    ;;
+esac
+exit 0
+`;
+
+// A `docker` CLI stuck talking to a daemon that accepted the connection but
+// never answers.
+const hangingDocker = `#!/bin/sh
+if [ "$1" = version ]; then exec sleep 15; fi
+exit 0
+`;
+
+function fakeDockerDir(script = fakeDocker) {
+  // Short name: the coordinator socket created inside it has to fit in
+  // sun_path (104 bytes on macOS).
+  const dir = tempDir("coord", { "bin/docker": script });
+  chmodSync(join(String(dir), "bin", "docker"), 0o755);
+  return dir;
+}
+
+const calls = (dir: string) => (existsSync(join(dir, "calls.log")) ? readFileSync(join(dir, "calls.log"), "utf8") : "");
+
+// The docker helpers look the CLI up in the environment their process started
+// with (Bun.which and Bun.spawn both read that, not later edits to
+// process.env), so the fake CLI has to be first on PATH of a fresh process.
+// ensure() also answers from BUN_TEST_SERVICE_<name> without touching docker,
+// and BUN_DOCKER_* / COMPOSE_* change what it runs, so none of those may leak
+// in from the machine running this file.
+function envWithFakeDocker(dir: string): Record<string, string> {
+  const env: Record<string, string> = {};
+  for (const [key, value] of Object.entries(bunEnv)) {
+    if (value !== undefined && !/^(BUN_TEST_SERVICE_|BUN_DOCKER_|COMPOSE_)/.test(key)) env[key] = value;
+  }
+  env.PATH = `${join(dir, "bin")}:${env.PATH}`;
+  return env;
+}
+
+/** Runs `script` (which must print one JSON value) in a fresh bun with the fake docker on PATH. */
+async function evalWithFakeDocker(env: Record<string, string>, script: string): Promise<unknown> {
+  await using proc = Bun.spawn({ cmd: [bunExe(), "-e", script], env, stdout: "pipe", stderr: "pipe" });
+  const [stdout, stderr, exitCode] = await Promise.all([proc.stdout.text(), proc.stderr.text(), proc.exited]);
+  expect(stderr).toBe("");
+  expect(exitCode).toBe(0);
+  return JSON.parse(stdout);
+}
+
+const harnessPath = JSON.stringify(join(import.meta.dir, "..", "harness.ts"));
+const dockerIndexPath = JSON.stringify(join(import.meta.dir, "..", "docker", "index.ts"));
+
+function isDockerEnabledWith(dir: string, coordinator: string | undefined): Promise<unknown> {
+  const env = envWithFakeDocker(dir);
+  if (coordinator !== undefined) env.BUN_DOCKER_COORDINATOR = coordinator;
+  return evalWithFakeDocker(
+    env,
+    `import { isDockerEnabled } from ${harnessPath};
+     let result;
+     try { result = isDockerEnabled(); } catch (error) { result = "threw: " + error.message; }
+     console.log(JSON.stringify(result));`,
+  );
+}
+
+test.concurrent.skipIf(isWindows)(
+  "a probe whose docker CLI hangs counts as unreachable instead of hanging the wait",
+  async () => {
+    using dir = fakeDockerDir(hangingDocker);
+    const result = await evalWithFakeDocker(
+      envWithFakeDocker(String(dir)),
+      `import { isDockerDaemonReachable } from ${dockerIndexPath};
+     const startedAt = Date.now();
+     const reachable = await isDockerDaemonReachable(250);
+     console.log(JSON.stringify({ reachable, tookMs: Date.now() - startedAt }));`,
+    );
+    // Without the bound the probe returns only when the fake CLI's 15s sleep ends.
+    expect(result).toEqual({ reachable: false, tookMs: expect.any(Number) });
+    expect((result as { tookMs: number }).tookMs).toBeLessThan(15_000);
+  },
+);
+
+// On Linux arm64 isDockerEnabled() is false before it looks at anything else.
+test.concurrent.skipIf(isWindows || (isLinux && process.arch === "arm64"))(
+  "isDockerEnabled() trusts the shard's coordinator instead of probing the daemon from every test file",
+  async () => {
+    using withCoordinator = fakeDockerDir();
+    using withoutCoordinator = fakeDockerDir();
+    const [enabled, enabledWithout] = await Promise.all([
+      isDockerEnabledWith(String(withCoordinator), join(String(withCoordinator), "coordinator.sock")),
+      isDockerEnabledWith(String(withoutCoordinator), undefined),
+    ]);
+
+    expect(enabled).toBe(true);
+    expect(calls(String(withCoordinator))).toBe("");
+
+    // Without a coordinator the daemon is probed as before, and this one is
+    // down: false, or on Linux CI the harness's own "docker is required" error.
+    expect(enabledWithout).not.toBe(true);
+    expect(calls(String(withoutCoordinator))).toBe("info\n");
+  },
+);
+
+test.concurrent.skipIf(isWindows)(
+  "the coordinator answers a request made while the daemon is still starting",
+  async () => {
+    using dir = fakeDockerDir();
+    const socketPath = join(String(dir), "coordinator.sock");
+
+    const env = envWithFakeDocker(String(dir));
+    env.BUN_DOCKER_COORDINATOR_SOCKET = socketPath;
+
+    await using coordinator = Bun.spawn({
+      cmd: [bunExe(), join(import.meta.dir, "..", "docker", "coordinator.ts")],
+      env,
+      stdin: "pipe",
+      stdout: "pipe",
+      stderr: "pipe",
+    });
+
+    // The runner connects tests to the socket only after this line. stdout has
+    // to be read incrementally for that, so it is collected by hand; a
+    // coordinator that exits before printing it fails the test right away.
+    let stdout = "";
+    const stderr = coordinator.stderr.text();
+    const { promise: listening, resolve: onListening, reject: onExitedFirst } = Promise.withResolvers<void>();
+    const stdoutDrained = (async () => {
+      for await (const chunk of coordinator.stdout) {
+        stdout += Buffer.from(chunk).toString();
+        if (stdout.includes(`COORDINATOR_READY ${socketPath}\n`)) onListening();
+      }
+      onExitedFirst(
+        new Error(`coordinator exited before COORDINATOR_READY\nstdout:\n${stdout}\nstderr:\n${await stderr}`),
+      );
+    })();
+    await listening;
+
+    // What ensureViaCoordinator() in test/docker/index.ts sends and reads back.
+    const reply = await new Promise<string>((resolve, reject) => {
+      const socket = connect(socketPath, () =>
+        socket.write(JSON.stringify({ type: "ensure", service: "postgres_plain" }) + "\n"),
+      );
+      let buffer = "";
+      socket.setEncoding("utf8");
+      socket.on("data", chunk => {
+        buffer += chunk;
+        const newline = buffer.indexOf("\n");
+        if (newline !== -1) {
+          socket.end();
+          resolve(buffer.slice(0, newline));
+        }
+      });
+      socket.on("error", reject);
+      socket.on("close", () => reject(new Error(`coordinator closed the socket without replying; got: ${buffer}`)));
+    });
+    expect(JSON.parse(reply)).toEqual({ ok: true, info: { host: "127.0.0.1", ports: { 5432: 54321 } } });
+
+    // The probe that failed, the poll that found the daemon, and only then any
+    // compose invocation.
+    const invocations = calls(String(dir)).trim().split("\n");
+    expect(invocations.slice(0, 2)).toEqual(["version", "version"]);
+    expect(invocations.findIndex(call => call.startsWith("compose "))).toBeGreaterThanOrEqual(2);
+    expect(invocations).toContainEqual(
+      expect.stringMatching(/^compose .* up -d --wait --wait-timeout 180 postgres_plain$/),
+    );
+
+    // EOF on stdin is how the coordinator learns the shard is over.
+    coordinator.stdin.end();
+    const exitCode = await coordinator.exited;
+    await stdoutDrained;
+    expect(stdout).toMatch(/^coordinator: docker daemon became reachable after \d+s$/m);
+    expect(stdout).toContain("coordinator: postgres_plain ready\n");
+    expect(await stderr).toBe("");
+    expect(exitCode).toBe(0);
+    expect(existsSync(socketPath)).toBeFalse();
+  },
+);

From 394b8895365d0d48503d11f852f3ca53bd0f4c92 Mon Sep 17 00:00:00 2001
From: Jarred Sumner <jarred@jarredsumner.com>
Date: Mon, 17 Aug 2026 03:28:16 +0000
Subject: [PATCH 174/258] mega-merge fixup: cargo fmt + prettier after conflict
 resolution

---
 docs/pm/cli/install.mdx                       |  1 +
 src/install/PackageInstaller.rs               |  4 +-
 .../PackageManager/PackageJSONEditor.rs       | 14 ++-
 .../PackageManager/PackageManagerEnqueue.rs   | 22 ++---
 .../PackageManager/PackageManagerOptions.rs   | 11 +--
 .../PackageManagerResolution.rs               | 12 ++-
 .../PackageManager/package_json_write_back.rs |  5 +-
 .../PackageManager/processDependencyList.rs   | 15 ++-
 src/install/PackageManager/runTasks.rs        |  8 +-
 src/install/isolated_install/Installer.rs     | 26 ++++--
 src/install/lifecycle_script_runner.rs        | 16 ++--
 src/install/lockfile.rs                       | 11 ++-
 src/install/lockfile/printer/tree_printer.rs  |  4 +-
 src/install/patch_install.rs                  |  4 +-
 src/install/pnpm.rs                           |  2 +-
 src/install/yarn.rs                           |  1 -
 src/runtime/cli/multi_run.rs                  |  2 +-
 src/runtime/cli/pack_command.rs               | 11 ++-
 src/runtime/cli/package_manager_command.rs    |  5 +-
 src/runtime/cli/publish_command.rs            | 20 ++--
 src/runtime/cli/why_command.rs                | 10 +-
 test/cli/install/bun-install-registry.test.ts |  3 +-
 test/cli/install/bun-install.test.ts          | 91 +++++++++----------
 test/cli/install/bun-pack.test.ts             | 13 ++-
 test/cli/install/bun-pm.test.ts               | 13 ++-
 test/cli/install/isolated-install.test.ts     | 12 ++-
 .../install/migration/pnpm-lock-v9.test.ts    | 10 +-
 test/cli/install/minimum-release-age.test.ts  |  2 +-
 28 files changed, 222 insertions(+), 126 deletions(-)

diff --git a/docs/pm/cli/install.mdx b/docs/pm/cli/install.mdx
index 08bd2a0b77dd..52996dad8474 100644
--- a/docs/pm/cli/install.mdx
+++ b/docs/pm/cli/install.mdx
@@ -613,6 +613,7 @@ Bun copies the following pnpm configuration into the root `package.json`:
 - **Workspace Overrides**: Copied from `overrides` and `patchedDependencies` in `pnpm-workspace.yaml` to the same root-level fields
 
 Bun leaves the `pnpm` field of `package.json` as it is. pnpm reads its configuration from that field and ignores the root-level fields, so `pnpm install --frozen-lockfile` keeps working for teammates who still use pnpm. Bun reads the root-level fields and ignores the `pnpm` field.
+
 - **Allowed build scripts**: `onlyBuiltDependencies` (from `pnpm-workspace.yaml` or `pnpm.onlyBuiltDependencies` in `package.json`) is added to [`trustedDependencies`](/pm/lifecycle) in `package.json`, so the same packages keep running their lifecycle scripts
 
 ### Requirements and limitations
diff --git a/src/install/PackageInstaller.rs b/src/install/PackageInstaller.rs
index dbc381ab3cf3..e4e78e4f190c 100644
--- a/src/install/PackageInstaller.rs
+++ b/src/install/PackageInstaller.rs
@@ -2123,7 +2123,9 @@ impl<'a> PackageInstaller<'a> {
                                             "Blocked {} scripts for: {}@{}\n",
                                             count,
                                             bstr::BStr::new(alias.slice(string_buf!())),
-                                            bun_core::fmt::EscapeControlChars(redacted(resolution.fmt(string_buf!(), PathSep::Posix))),
+                                            bun_core::fmt::EscapeControlChars(redacted(
+                                                resolution.fmt(string_buf!(), PathSep::Posix)
+                                            )),
                                         );
                                     }
                                     let entry = self
diff --git a/src/install/PackageManager/PackageJSONEditor.rs b/src/install/PackageManager/PackageJSONEditor.rs
index 124f81b71ec9..34d72b6d2c17 100644
--- a/src/install/PackageManager/PackageJSONEditor.rs
+++ b/src/install/PackageManager/PackageJSONEditor.rs
@@ -1075,7 +1075,9 @@ pub(crate) fn edit(
                                                 else {
                                                     break 'add_packages_to_update;
                                                 };
-                                                let tag = dependency::Tag::infer(dependency::trim_literal(version_literal));
+                                                let tag = dependency::Tag::infer(
+                                                    dependency::trim_literal(version_literal),
+                                                );
 
                                                 if tag != dependency::Tag::Npm
                                                     && tag != dependency::Tag::DistTag
@@ -1513,10 +1515,12 @@ pub(crate) fn edit(
                 // A range that linked a workspace member has nothing to move to; `workspace:*` is what `bun add` writes.
                 resolution::Tag::Workspace if manager.subcommand == Subcommand::Update => continue,
                 // Not the bound row: an unchanged resolution keeps the old lockfile row and its previous literal.
-                resolution::Tag::Workspace => match dependency::Tag::infer(dependency::trim_literal(e_string.data.slice())) {
-                    dependency::Tag::Workspace => e_string.data.slice(),
-                    _ => b"workspace:*",
-                },
+                resolution::Tag::Workspace => {
+                    match dependency::Tag::infer(dependency::trim_literal(e_string.data.slice())) {
+                        dependency::Tag::Workspace => e_string.data.slice(),
+                        _ => b"workspace:*",
+                    }
+                }
                 _ => arena_dup(arena, request.version.literal.slice(request.version_buf())),
             };
             if e_string.data.slice() != new_literal {
diff --git a/src/install/PackageManager/PackageManagerEnqueue.rs b/src/install/PackageManager/PackageManagerEnqueue.rs
index 2b6ecab5d6e7..cb8a817508b0 100644
--- a/src/install/PackageManager/PackageManagerEnqueue.rs
+++ b/src/install/PackageManager/PackageManagerEnqueue.rs
@@ -832,16 +832,14 @@ pub fn enqueue_dependency_with_main_and_success_fn(
                                     if dependency.behavior.is_peer() {
                                         warn_unmet_peer_dependency(this, name, &version, err);
                                     } else {
-                                        this.log_mut()
-                    .add_error_fmt(
-                                                None,
-                                                bun_ast::Loc::EMPTY,
-                                                format_args!(
-                                                    "Package \"{}\" with tag \"{}\" not found, but package exists",
-                                                    bun_fmt::escape_control_chars(this.lockfile.str(&name)),
-                                                    bun_fmt::escape_control_chars(
-                                                        this.lockfile.str(&version.dist_tag().tag)
-                                                    ),
+                                        this.log_mut().add_error_fmt(
+                                            None,
+                                            bun_ast::Loc::EMPTY,
+                                            format_args!(
+                                                "Package \"{}\" with tag \"{}\" not found, but package exists",
+                                                bun_fmt::escape_control_chars(this.lockfile.str(&name)),
+                                                bun_fmt::escape_control_chars(
+                                                    this.lockfile.str(&version.dist_tag().tag)
                                                 ),
                                             ),
                                         );
@@ -896,7 +894,9 @@ pub fn enqueue_dependency_with_main_and_success_fn(
                                                 bun_fmt::escape_control_chars(
                                                     this.lockfile.str(&version.literal)
                                                 ),
-                                                bun_fmt::escape_control_chars(this.lockfile.str(&name)),
+                                                bun_fmt::escape_control_chars(
+                                                    this.lockfile.str(&name)
+                                                ),
                                                 age_gate_ms / MS_PER_S,
                                             );
                                         }
diff --git a/src/install/PackageManager/PackageManagerOptions.rs b/src/install/PackageManager/PackageManagerOptions.rs
index 75765a6cc269..d9d1909e9251 100644
--- a/src/install/PackageManager/PackageManagerOptions.rs
+++ b/src/install/PackageManager/PackageManagerOptions.rs
@@ -466,21 +466,14 @@ impl core::fmt::Display for RegistryPath<'_> {
     }
 
     /// Replaces the registry used by packages that have no registry for their scope.
-    fn set_default_registry(
-        &mut self,
-        url: &[u8],
-    ) -> Result<(), AllocError> {
+    fn set_default_registry(&mut self, url: &[u8]) -> Result<(), AllocError> {
         self.scope = self.scope_for_registry_url(b"", &self.scope, url)?;
         self.did_override_default_scope = self.scope.url_hash != *Npm::registry::DEFAULT_URL_HASH;
         Ok(())
     }
 
     /// Replaces the registry used by the packages of `scope_name` (without the `@`).
-    fn set_scope_registry(
-        &mut self,
-        scope_name: &[u8],
-        url: &[u8],
-    ) -> Result<(), AllocError> {
+    fn set_scope_registry(&mut self, scope_name: &[u8], url: &[u8]) -> Result<(), AllocError> {
         let key = Npm::registry::Scope::hash(scope_name);
         let current = match self.registries.get(&key) {
             Some(scope) if *scope.name == *scope_name => scope,
diff --git a/src/install/PackageManager/PackageManagerResolution.rs b/src/install/PackageManager/PackageManagerResolution.rs
index ce6165dbef47..dac317552e7a 100644
--- a/src/install/PackageManager/PackageManagerResolution.rs
+++ b/src/install/PackageManager/PackageManagerResolution.rs
@@ -373,14 +373,20 @@ impl PackageManager {
                     {
                         Output::err_generic(
                             "<b>{}<r><d> failed to resolve<r>",
-                            (bun_core::fmt::EscapeControlChars(redacted(failed_dep.version.literal.fmt(string_buf))),),
+                            (bun_core::fmt::EscapeControlChars(redacted(
+                                failed_dep.version.literal.fmt(string_buf),
+                            )),),
                         );
                     } else {
                         Output::err_generic(
                             "<b>{}<r><d>@<b>{}<r><d> failed to resolve<r>",
                             (
-                                bun_core::fmt::escape_control_chars(failed_dep.name.slice(string_buf)),
-                                bun_core::fmt::EscapeControlChars(redacted(failed_dep.version.literal.fmt(string_buf))),
+                                bun_core::fmt::escape_control_chars(
+                                    failed_dep.name.slice(string_buf),
+                                ),
+                                bun_core::fmt::EscapeControlChars(redacted(
+                                    failed_dep.version.literal.fmt(string_buf),
+                                )),
                             ),
                         );
                     }
diff --git a/src/install/PackageManager/package_json_write_back.rs b/src/install/PackageManager/package_json_write_back.rs
index 92d90eed07b2..86329d4b63a4 100644
--- a/src/install/PackageManager/package_json_write_back.rs
+++ b/src/install/PackageManager/package_json_write_back.rs
@@ -67,7 +67,10 @@ fn take_migrated_root(manager: &mut PackageManager) -> Option<WorkspaceTarget> {
     }
     let moved = core::mem::take(&mut manager.migrated_package_json_moves);
     if !manager.options.log_level.is_silent() {
-        bun_core::pretty_errorln!("<d>copied {} in <r><green>package.json<r>", moved.join(", "));
+        bun_core::pretty_errorln!(
+            "<d>copied {} in <r><green>package.json<r>",
+            moved.join(", ")
+        );
     }
     Some(root_target())
 }
diff --git a/src/install/PackageManager/processDependencyList.rs b/src/install/PackageManager/processDependencyList.rs
index 61370bd89688..7e1004e5b57f 100644
--- a/src/install/PackageManager/processDependencyList.rs
+++ b/src/install/PackageManager/processDependencyList.rs
@@ -155,7 +155,12 @@ impl PackageManager {
                                 Output::err(
                                     err,
                                     "failed to parse package.json for <b>{}<r>",
-                                    format_args!("{}", bun_core::fmt::EscapeControlChars(redacted(resolution.fmt_url(string_buf)))),
+                                    format_args!(
+                                        "{}",
+                                        bun_core::fmt::EscapeControlChars(redacted(
+                                            resolution.fmt_url(string_buf)
+                                        ))
+                                    ),
                                 );
                             }
                             self.crash();
@@ -241,7 +246,9 @@ impl PackageManager {
                         let string_buf = self.lockfile.buffers.string_bytes.as_slice();
                         bun_core::pretty_errorln!(
                             "<r><red>error:<r> expected package.json in <b>{}<r> to be a JSON file: {}\n",
-                            bun_core::fmt::EscapeControlChars(redacted(resolution.fmt_url(string_buf))),
+                            bun_core::fmt::EscapeControlChars(redacted(
+                                resolution.fmt_url(string_buf)
+                            )),
                             err.name(),
                         );
                     }
@@ -293,7 +300,9 @@ impl PackageManager {
                                 let string_buf = self.lockfile.buffers.string_bytes.as_slice();
                                 bun_core::pretty_errorln!(
                                     "<r><red>error:<r> expected package.json in <b>{}<r> to be a JSON file: {}\n",
-                                    bun_core::fmt::EscapeControlChars(redacted(resolution.fmt_url(string_buf))),
+                                    bun_core::fmt::EscapeControlChars(redacted(
+                                        resolution.fmt_url(string_buf)
+                                    )),
                                     err.name(),
                                 );
                             }
diff --git a/src/install/PackageManager/runTasks.rs b/src/install/PackageManager/runTasks.rs
index 82b19cbaa4c5..d5946bcff5e7 100644
--- a/src/install/PackageManager/runTasks.rs
+++ b/src/install/PackageManager/runTasks.rs
@@ -889,7 +889,9 @@ pub fn run_tasks<C: RunTasksCallbacks>(
                             None,
                             bun_ast::Loc::EMPTY,
                             "<r><red><b>GET<r><red> {}<d> - {}<r>{}",
-                            bun_core::fmt::EscapeControlChars(bun_core::fmt::redacted_npm_url(metadata.url.slice())),
+                            bun_core::fmt::EscapeControlChars(bun_core::fmt::redacted_npm_url(
+                                metadata.url.slice()
+                            )),
                             response.status_code,
                             bstr::BStr::new(&note),
                         );
@@ -899,7 +901,9 @@ pub fn run_tasks<C: RunTasksCallbacks>(
                             None,
                             bun_ast::Loc::EMPTY,
                             "<r><yellow><b>GET<r><yellow> {}<d> - {}<r>{}",
-                            bun_core::fmt::EscapeControlChars(bun_core::fmt::redacted_npm_url(metadata.url.slice())),
+                            bun_core::fmt::EscapeControlChars(bun_core::fmt::redacted_npm_url(
+                                metadata.url.slice()
+                            )),
                             response.status_code,
                             bstr::BStr::new(&note),
                         );
diff --git a/src/install/isolated_install/Installer.rs b/src/install/isolated_install/Installer.rs
index 294eacc6a3fc..abf95576589e 100644
--- a/src/install/isolated_install/Installer.rs
+++ b/src/install/isolated_install/Installer.rs
@@ -3,8 +3,8 @@ use std::io::Write as _;
 
 use bun_ast::Log;
 use bun_collections::{ArrayHashMap, DynamicBitSet, StringHashMap};
-use bun_core::fmt::{EscapeControlChars, escape_control_chars};
 use bun_core::fmt::redacted;
+use bun_core::fmt::{EscapeControlChars, escape_control_chars};
 use bun_core::{Environment, Global, Output};
 use bun_core::{ZStr, strings};
 use bun_paths::{self as paths, AbsPath, AutoAbsPath, AutoRelPath};
@@ -323,7 +323,9 @@ impl<'a> Installer<'a> {
                 "failed to download <b>{}@{}<r>: {}\n  <d>{}<r>",
                 (
                     bun_core::fmt::escape_control_chars(name),
-                    bun_core::fmt::EscapeControlChars(redacted(resolution.fmt(string_buf, bun_core::fmt::PathSep::Auto))),
+                    bun_core::fmt::EscapeControlChars(redacted(
+                        resolution.fmt(string_buf, bun_core::fmt::PathSep::Auto),
+                    )),
                     bstr::BStr::new(download_error_reason(err)),
                     EscapeControlChars(bun_core::fmt::redacted_npm_url(url)),
                 ),
@@ -395,7 +397,9 @@ impl<'a> Installer<'a> {
                     "failed to link package: {}@{}",
                     (
                         bun_core::fmt::escape_control_chars(pkg_name.slice(string_buf)),
-                        bun_core::fmt::EscapeControlChars(redacted(pkg_res.fmt(string_buf, bun_core::fmt::PathSep::Auto))),
+                        bun_core::fmt::EscapeControlChars(redacted(
+                            pkg_res.fmt(string_buf, bun_core::fmt::PathSep::Auto),
+                        )),
                     ),
                 );
             }
@@ -405,7 +409,9 @@ impl<'a> Installer<'a> {
                     "failed to symlink dependencies for package: {}@{}",
                     (
                         bun_core::fmt::escape_control_chars(pkg_name.slice(string_buf)),
-                        bun_core::fmt::EscapeControlChars(redacted(pkg_res.fmt(string_buf, bun_core::fmt::PathSep::Auto))),
+                        bun_core::fmt::EscapeControlChars(redacted(
+                            pkg_res.fmt(string_buf, bun_core::fmt::PathSep::Auto),
+                        )),
                     ),
                 );
             }
@@ -423,7 +429,9 @@ impl<'a> Installer<'a> {
                     "failed to patch package: {}@{}",
                     (
                         bun_core::fmt::escape_control_chars(pkg_name.slice(string_buf)),
-                        bun_core::fmt::EscapeControlChars(redacted(pkg_res.fmt(string_buf, bun_core::fmt::PathSep::Auto))),
+                        bun_core::fmt::EscapeControlChars(redacted(
+                            pkg_res.fmt(string_buf, bun_core::fmt::PathSep::Auto),
+                        )),
                     ),
                 );
                 let _ = patch_log.print(std::ptr::from_mut(Output::error_writer()));
@@ -434,7 +442,9 @@ impl<'a> Installer<'a> {
                     "failed to link binaries for package: {}@{}",
                     (
                         bun_core::fmt::escape_control_chars(pkg_name.slice(string_buf)),
-                        bun_core::fmt::EscapeControlChars(redacted(pkg_res.fmt(string_buf, bun_core::fmt::PathSep::Auto))),
+                        bun_core::fmt::EscapeControlChars(redacted(
+                            pkg_res.fmt(string_buf, bun_core::fmt::PathSep::Auto),
+                        )),
                     ),
                 );
             }
@@ -460,7 +470,9 @@ impl<'a> Installer<'a> {
                     "failed to download <b>{}@{}<r>: {}\n  <d>{}<r>",
                     (
                         bun_core::fmt::escape_control_chars(pkg_name.slice(string_buf)),
-                        bun_core::fmt::EscapeControlChars(redacted(pkg_res.fmt(string_buf, bun_core::fmt::PathSep::Auto))),
+                        bun_core::fmt::EscapeControlChars(redacted(
+                            pkg_res.fmt(string_buf, bun_core::fmt::PathSep::Auto),
+                        )),
                         bstr::BStr::new(download_error_reason(dl.err)),
                         EscapeControlChars(bun_core::fmt::redacted_npm_url(&dl.url)),
                     ),
diff --git a/src/install/lifecycle_script_runner.rs b/src/install/lifecycle_script_runner.rs
index 529a61214adf..ea53ae9d4110 100644
--- a/src/install/lifecycle_script_runner.rs
+++ b/src/install/lifecycle_script_runner.rs
@@ -737,13 +737,19 @@ impl<'a> LifecycleScriptSubprocess<'a> {
                 (*this).prepare_dependencies = PrepareDependencies::Installing(
                     NestedInstallCleanup::begin(cwd, &(*this).package_name),
                 );
-                (ScriptArgv::install_dependencies()?, INSTALL_DEPENDENCIES_COMMAND_LINE)
+                (
+                    ScriptArgv::install_dependencies()?,
+                    INSTALL_DEPENDENCIES_COMMAND_LINE,
+                )
             } else {
                 copy_script.reserve_exact(original_script.len() + 1);
                 replace_package_manager_run(&mut copy_script, original_script)?;
                 copy_script.push(0);
                 let combined_script: &ZStr = ZStr::from_slice_with_nul(&copy_script);
-                (ScriptArgv::new((*this).shell_bin, combined_script)?, combined_script.as_bytes())
+                (
+                    ScriptArgv::new((*this).shell_bin, combined_script)?,
+                    combined_script.as_bytes(),
+                )
             };
 
             if (*this).foreground && (*manager).options.log_level != crate::LogLevel::Silent {
@@ -851,11 +857,7 @@ impl<'a> LifecycleScriptSubprocess<'a> {
             (*manager)
                 .active_lifecycle_scripts
                 .insert(this.cast::<LifecycleScriptSubprocess<'static>>());
-            let spawned = match bun_spawn::spawn_process(
-                &spawn_options,
-                argv.as_ptr(),
-                envp,
-            ) {
+            let spawned = match bun_spawn::spawn_process(&spawn_options, argv.as_ptr(), envp) {
                 Ok(Ok(s)) => s,
                 res => {
                     #[cfg(windows)]
diff --git a/src/install/lockfile.rs b/src/install/lockfile.rs
index c8af7a6bd2d8..5b6cadd2be4d 100644
--- a/src/install/lockfile.rs
+++ b/src/install/lockfile.rs
@@ -977,11 +977,12 @@ impl Lockfile {
     /// Folder arm of `get_or_put_resolved_package`), so every folder package that
     /// declares anything is reached from the root through local packages only.
     pub(crate) fn is_dependency_of_local_package(&self, id: DependencyID) -> bool {
-        self.get_parent_pkg_of_dependency(id).is_some_and(|parent_id| {
-            self.packages.items_resolution()[parent_id as usize]
-                .tag
-                .is_local_package()
-        })
+        self.get_parent_pkg_of_dependency(id)
+            .is_some_and(|parent_id| {
+                self.packages.items_resolution()[parent_id as usize]
+                    .tag
+                    .is_local_package()
+            })
     }
 
     /// Does this tree id belong to a workspace (including workspace root)?
diff --git a/src/install/lockfile/printer/tree_printer.rs b/src/install/lockfile/printer/tree_printer.rs
index 9155f3c65526..c9684c946016 100644
--- a/src/install/lockfile/printer/tree_printer.rs
+++ b/src/install/lockfile/printer/tree_printer.rs
@@ -799,7 +799,9 @@ where
                 ENABLE_ANSI_COLORS,
                 " <r><b>{s}<r><d>@<b>{f}<r>\n",
                 bun_core::fmt::escape_control_chars(package_name),
-                bun_core::fmt::EscapeControlChars(redacted(resolved[package_id as usize].fmt(string_buf, PathSep::Auto))),
+                bun_core::fmt::EscapeControlChars(redacted(
+                    resolved[package_id as usize].fmt(string_buf, PathSep::Auto)
+                )),
             )?;
         }
     }
diff --git a/src/install/patch_install.rs b/src/install/patch_install.rs
index 32635bd881cc..04067aa46b5e 100644
--- a/src/install/patch_install.rs
+++ b/src/install/patch_install.rs
@@ -525,7 +525,9 @@ impl PatchTask {
                         &e,
                         format_args!(
                             "failed trying to open temporary dir to apply patch to package: {}",
-                            bun_core::fmt::EscapeControlChars(bun_core::fmt::redacted(BStr::new(&resolution_label)))
+                            bun_core::fmt::EscapeControlChars(bun_core::fmt::redacted(BStr::new(
+                                &resolution_label
+                            )))
                         ),
                     );
                     return Ok(());
diff --git a/src/install/pnpm.rs b/src/install/pnpm.rs
index 43fa84fc6300..c2c2702fb369 100644
--- a/src/install/pnpm.rs
+++ b/src/install/pnpm.rs
@@ -18,9 +18,9 @@ use crate::external_slice::ExternalSlice;
 use crate::integrity::Integrity;
 use crate::lockfile::{self, LoadResult, LoadResultOk, Lockfile};
 use crate::npm::{self};
-use crate::package_manager_real::update_package_json_and_install::print_package_json_into_cache_entry;
 use crate::package_manager_real::add_remove_with_filter::root_package_json_path;
 use crate::package_manager_real::update_package_json_and_install::print_package_json_into_cache_entry;
+use crate::package_manager_real::update_package_json_and_install::print_package_json_into_cache_entry;
 use crate::repository::Repository;
 use crate::resolution::{self, Resolution, TaggedValue};
 use crate::{DependencyID, INVALID_PACKAGE_ID, PackageID, PackageManager};
diff --git a/src/install/yarn.rs b/src/install/yarn.rs
index b50d72f727f3..8264677d114f 100644
--- a/src/install/yarn.rs
+++ b/src/install/yarn.rs
@@ -825,7 +825,6 @@ pub(crate) fn migrate_yarn_lockfile<'a>(
         vec![install::INVALID_PACKAGE_ID; next_package_id as usize];
     let silent = manager.options.log_level.is_silent();
 
-
     for (yarn_idx, entry) in yarn_lock.entries.iter().enumerate() {
         let is_direct_url_dep = entry.has_direct_url_spec();
         let base_name: &[u8] = entry.name;
diff --git a/src/runtime/cli/multi_run.rs b/src/runtime/cli/multi_run.rs
index dc4b3f1bc0c4..a43e93009bfd 100644
--- a/src/runtime/cli/multi_run.rs
+++ b/src/runtime/cli/multi_run.rs
@@ -9,8 +9,8 @@ use bun_core::strings;
 use bun_core::{self as bun, Global, Output, UnwrapOrOom, ZStr};
 use bun_event_loop::EventLoopHandle;
 use bun_event_loop::MiniEventLoop::MiniEventLoop;
-use bun_install::package_manager::workspace_selection;
 use bun_install::lifecycle_script_runner::ScriptArgv;
+use bun_install::package_manager::workspace_selection;
 use bun_io::BufferedReader;
 use bun_paths as path;
 
diff --git a/src/runtime/cli/pack_command.rs b/src/runtime/cli/pack_command.rs
index 3961764231f3..9c8f80124317 100644
--- a/src/runtime/cli/pack_command.rs
+++ b/src/runtime/cli/pack_command.rs
@@ -1420,7 +1420,9 @@ fn get_package_bins(json: &Expr) -> Result<Vec<BinInfo>, AllocError> {
 
     if let Some(bin) = json.as_property(b"bin") {
         if let Some(bin_str) = bin.expr.as_string(pack_bump()) {
-            if let Some(subpath) = bin_subpath(bin_str, BinType::File, &mut path_buf, &mut path_spill) {
+            if let Some(subpath) =
+                bin_subpath(bin_str, BinType::File, &mut path_buf, &mut path_spill)
+            {
                 bins.push(BinInfo {
                     path: ZBox::from_bytes(subpath),
                     ty: BinType::File,
@@ -1437,7 +1439,8 @@ fn get_package_bins(json: &Expr) -> Result<Vec<BinInfo>, AllocError> {
             for bin_prop in bin_obj.properties.slice() {
                 if let Some(bin_prop_value) = &bin_prop.value {
                     if let Some(bin_str) = bin_prop_value.as_string(pack_bump()) {
-                        let Some(subpath) = bin_subpath(bin_str, BinType::File, &mut path_buf, &mut path_spill)
+                        let Some(subpath) =
+                            bin_subpath(bin_str, BinType::File, &mut path_buf, &mut path_spill)
                         else {
                             continue;
                         };
@@ -1462,7 +1465,9 @@ fn get_package_bins(json: &Expr) -> Result<Vec<BinInfo>, AllocError> {
         if let ExprData::EObject(directories_obj) = &directories.expr.data {
             if let Some(bin) = directories_obj.as_property(b"bin") {
                 if let Some(bin_str) = bin.expr.as_string(pack_bump()) {
-                    if let Some(subpath) = bin_subpath(bin_str, BinType::Dir, &mut path_buf, &mut path_spill) {
+                    if let Some(subpath) =
+                        bin_subpath(bin_str, BinType::Dir, &mut path_buf, &mut path_spill)
+                    {
                         bins.push(BinInfo {
                             path: ZBox::from_bytes(subpath),
                             ty: BinType::Dir,
diff --git a/src/runtime/cli/package_manager_command.rs b/src/runtime/cli/package_manager_command.rs
index 27e1e370f39c..8d01b391b718 100644
--- a/src/runtime/cli/package_manager_command.rs
+++ b/src/runtime/cli/package_manager_command.rs
@@ -1091,8 +1091,9 @@ fn print_trusted_dependencies_flat(
     for (index, &dep_id) in trusted.iter().enumerate() {
         let package_id = resolutions_buf[dep_id as usize];
         let name = dependencies[dep_id as usize].name.slice(string_bytes);
-        let resolution =
-            bun_core::fmt::EscapeControlChars(bun_fmt::redacted(resolutions[package_id as usize].fmt(string_bytes, PathSep::Auto)));
+        let resolution = bun_core::fmt::EscapeControlChars(bun_fmt::redacted(
+            resolutions[package_id as usize].fmt(string_bytes, PathSep::Auto),
+        ));
         if index + 1 < trusted.len() {
             bun_core::prettyln!("<d>├──<r> {}<r><d>@{}<r>\n", name, resolution);
         } else {
diff --git a/src/runtime/cli/publish_command.rs b/src/runtime/cli/publish_command.rs
index 35fabf99280a..c6858f56ee33 100644
--- a/src/runtime/cli/publish_command.rs
+++ b/src/runtime/cli/publish_command.rs
@@ -14,7 +14,9 @@ use bun_http as http;
 use bun_install::{self as install, Npm, PackageManager, Subcommand};
 use bun_libarchive::lib::{Archive, ArchiveIterator, IteratorResult as ArchiveIterResult};
 use bun_parsers::json as json_mod;
-use bun_paths::resolve_path::{join_abs_string_buf_checked, normalize_buf_spill, normalize_buf_z_spill};
+use bun_paths::resolve_path::{
+    join_abs_string_buf_checked, normalize_buf_spill, normalize_buf_z_spill,
+};
 use bun_paths::{self as path, PathBuffer};
 use bun_sha_hmac as sha;
 use bun_simdutf_sys::simdutf;
@@ -1565,7 +1567,9 @@ impl PublishCommand {
             match &bin_query.expr.data {
                 ExprData::EString(bin_str) => {
                     let mut bin_props: Vec<G::Property> = Vec::new();
-                    if let Some(value) = Self::bin_target(bin_str.string(bump)?, &mut *path_buf, &mut path_spill) {
+                    if let Some(value) =
+                        Self::bin_target(bin_str.string(bump)?, &mut *path_buf, &mut path_spill)
+                    {
                         if !bun_sys::exists_at(workspace_root, value) {
                             bun_core::warn!(
                                 "bin '{}' does not exist",
@@ -1632,7 +1636,8 @@ impl PublishCommand {
                         else {
                             continue;
                         };
-                        let Some(value) = Self::bin_target(value.string(bump)?, &mut *path_buf, &mut path_spill)
+                        let Some(value) =
+                            Self::bin_target(value.string(bump)?, &mut *path_buf, &mut path_spill)
                         else {
                             continue;
                         };
@@ -1678,9 +1683,12 @@ impl PublishCommand {
                     return Ok(());
                 };
                 let mut bin_props: Vec<G::Property> = Vec::new();
-                let Some(bin_dir_subpath) =
-                    pack::bin_subpath(bin_dir_str, pack::BinType::Dir, &mut *path_buf, &mut path_spill)
-                else {
+                let Some(bin_dir_subpath) = pack::bin_subpath(
+                    bin_dir_str,
+                    pack::BinType::Dir,
+                    &mut *path_buf,
+                    &mut path_spill,
+                ) else {
                     return Ok(());
                 };
                 let normalized_bin_dir = bun_core::ZBox::from_bytes(bin_dir_subpath);
diff --git a/src/runtime/cli/why_command.rs b/src/runtime/cli/why_command.rs
index c6ef47737a21..b7ca12db313f 100644
--- a/src/runtime/cli/why_command.rs
+++ b/src/runtime/cli/why_command.rs
@@ -549,12 +549,18 @@ fn print_package_with_type(prefix: &[u8], package: &DependentInfo) {
     } else {
         bun_core::pretty!("{}", escape_control_chars(&package.name));
         if !package.version.is_empty() {
-            bun_core::pretty!("<d>@{}<r>", bun_core::fmt::EscapeControlChars(redacted(BStr::new(&package.version))));
+            bun_core::pretty!(
+                "<d>@{}<r>",
+                bun_core::fmt::EscapeControlChars(redacted(BStr::new(&package.version)))
+            );
         }
     }
 
     if !package.spec.is_empty() {
-        bun_core::prettyln!(" <d>(requires {})<r>", bun_core::fmt::EscapeControlChars(redacted(BStr::new(&package.spec))));
+        bun_core::prettyln!(
+            " <d>(requires {})<r>",
+            bun_core::fmt::EscapeControlChars(redacted(BStr::new(&package.spec)))
+        );
     } else {
         bun_core::prettyln!("");
     }
diff --git a/test/cli/install/bun-install-registry.test.ts b/test/cli/install/bun-install-registry.test.ts
index 9bd3c15fa6d3..2da3d12ae3cf 100644
--- a/test/cli/install/bun-install-registry.test.ts
+++ b/test/cli/install/bun-install-registry.test.ts
@@ -1,6 +1,6 @@
 import { file, spawn, write } from "bun";
 import { install_test_helpers, npm_manifest_test_helpers } from "bun:internal-for-testing";
-import { afterAll, beforeAll, beforeEach, describe, expect, setDefaultTimeout, test } from "bun:test";
+import { afterAll, beforeAll, describe, expect, setDefaultTimeout, test } from "bun:test";
 import { copyFileSync, existsSync, mkdirSync, readFileSync } from "fs";
 import { cp, exists, lstat, mkdir, readlink, rename, rm, writeFile } from "fs/promises";
 import {
@@ -9,7 +9,6 @@ import {
   bunExe,
   isFlaky,
   isLinux,
-  isLinux,
   isWindows,
   mergeWindowEnvs,
   normalizeBunSnapshot,
diff --git a/test/cli/install/bun-install.test.ts b/test/cli/install/bun-install.test.ts
index 060a95f2ed6a..cba0424979cb 100644
--- a/test/cli/install/bun-install.test.ts
+++ b/test/cli/install/bun-install.test.ts
@@ -6,7 +6,6 @@ import {
   bunEnv,
   bunExe,
   bunEnv as env,
-  isLinux,
   isAndroid,
   isLinux,
   isWindows,
@@ -12164,59 +12163,57 @@ describe.concurrent("link: paths with .. or an absolute path declared by a depen
     await packDeclarer(root, { dependencies: declaredLinks(root) });
 
     await expectRefused(root, "tb@./tb-1.0.0.tgz");
-for (const lockfile of ["bun.lock", "bun.lockb"]) {
-  it(`installs a file: dependency whose version literal has leading whitespace (${lockfile})`, async () => {
-    // The folder path is longer than an inline string so that it has to be appended to the
-    // lockfile's string buffer, which only has room for it if the literal was classified as a folder.
-    const literal = " file:./vendor/some-long-directory-name/lib";
-    using dir = tempDir("whitespace-file-dep", {
-      "package.json": JSON.stringify({
-        name: "my-app",
-        version: "1.0.0",
-        dependencies: {
-          lib: literal,
-        },
-      }),
-      "vendor/some-long-directory-name/lib/package.json": JSON.stringify({
-        name: "lib",
-        version: "1.0.0",
-      }),
-      "bunfig.toml": `install.saveTextLockfile = ${lockfile === "bun.lock"}`,
-    });
+    for (const lockfile of ["bun.lock", "bun.lockb"]) {
+      it(`installs a file: dependency whose version literal has leading whitespace (${lockfile})`, async () => {
+        // The folder path is longer than an inline string so that it has to be appended to the
+        // lockfile's string buffer, which only has room for it if the literal was classified as a folder.
+        const literal = " file:./vendor/some-long-directory-name/lib";
+        using dir = tempDir("whitespace-file-dep", {
+          "package.json": JSON.stringify({
+            name: "my-app",
+            version: "1.0.0",
+            dependencies: {
+              lib: literal,
+            },
+          }),
+          "vendor/some-long-directory-name/lib/package.json": JSON.stringify({
+            name: "lib",
+            version: "1.0.0",
+          }),
+          "bunfig.toml": `install.saveTextLockfile = ${lockfile === "bun.lock"}`,
+        });
 
-    // The first pass resolves from package.json; the second installs from the lockfile the first
-    // pass wrote, which stores the literal as written and has to parse it as a folder again.
-    for (const args of [["install"], ["install", "--frozen-lockfile"]]) {
-      await rm(join(String(dir), "node_modules"), { recursive: true, force: true });
+        // The first pass resolves from package.json; the second installs from the lockfile the first
+        // pass wrote, which stores the literal as written and has to parse it as a folder again.
+        for (const args of [["install"], ["install", "--frozen-lockfile"]]) {
+          await rm(join(String(dir), "node_modules"), { recursive: true, force: true });
 
-      const { stdout, stderr, exited } = spawn({
-        cmd: [bunExe(), ...args],
-        cwd: String(dir),
-        stdout: "pipe",
-        stderr: "pipe",
-        env,
-      });
-      const [err, out, exitCode] = await Promise.all([stderr.text(), stdout.text(), exited]);
+          const { stdout, stderr, exited } = spawn({
+            cmd: [bunExe(), ...args],
+            cwd: String(dir),
+            stdout: "pipe",
+            stderr: "pipe",
+            env,
+          });
+          const [err, out, exitCode] = await Promise.all([stderr.text(), stdout.text(), exited]);
 
-      expect(err).not.toContain("error:");
-      expect(out).toContain("1 package installed");
-      expect(exitCode).toBe(0);
+          expect(err).not.toContain("error:");
+          expect(out).toContain("1 package installed");
+          expect(exitCode).toBe(0);
 
-      expect(await file(join(String(dir), "node_modules", "lib", "package.json")).json()).toEqual({
-        name: "lib",
-        version: "1.0.0",
+          expect(await file(join(String(dir), "node_modules", "lib", "package.json")).json()).toEqual({
+            name: "lib",
+            version: "1.0.0",
+          });
+          if (lockfile === "bun.lock") {
+            expect(await file(join(String(dir), "bun.lock")).text()).toContain(`"lib": ${JSON.stringify(literal)}`);
+          } else {
+            expect(await exists(join(String(dir), "bun.lockb"))).toBe(true);
+          }
+        }
       });
-      if (lockfile === "bun.lock") {
-        expect(await file(join(String(dir), "bun.lock")).text()).toContain(`"lib": ${JSON.stringify(literal)}`);
-      } else {
-        expect(await exists(join(String(dir), "bun.lockb"))).toBe(true);
-      }
     }
   });
-}
-
-
-  });
 
   it("are refused when a git dependency declares them", async () => {
     using dir = tempDir("escaping-links-of-git-dep", linkTargets());
diff --git a/test/cli/install/bun-pack.test.ts b/test/cli/install/bun-pack.test.ts
index 153509e4fc46..f177fcecb41d 100644
--- a/test/cli/install/bun-pack.test.ts
+++ b/test/cli/install/bun-pack.test.ts
@@ -2,7 +2,18 @@ import { file, gunzipSync, spawn, write } from "bun";
 import { readTarball } from "bun:internal-for-testing";
 import { beforeEach, describe, expect, test } from "bun:test";
 import { chmod, exists, lstat, mkdir, rm, symlink } from "fs/promises";
-import { MAX_PATH_BYTES, bunEnv, bunExe, isLinux, isWindows, pack, runBunInstall, tempDir, tmpdirSync, unprivilegedSpawnOptions } from "harness";
+import {
+  MAX_PATH_BYTES,
+  bunEnv,
+  bunExe,
+  isLinux,
+  isWindows,
+  pack,
+  runBunInstall,
+  tempDir,
+  tmpdirSync,
+  unprivilegedSpawnOptions,
+} from "harness";
 import fs from "node:fs/promises";
 import { join } from "path";
 
diff --git a/test/cli/install/bun-pm.test.ts b/test/cli/install/bun-pm.test.ts
index b15886f765e0..93c47af3f493 100644
--- a/test/cli/install/bun-pm.test.ts
+++ b/test/cli/install/bun-pm.test.ts
@@ -1,7 +1,18 @@
 import { spawn } from "bun";
 import { afterAll, afterEach, beforeAll, beforeEach, describe, expect, it, test } from "bun:test";
 import { chmod, exists, mkdir, rm, writeFile } from "fs/promises";
-import { bunEnv, bunEnv as env, bunExe, isLinux, isWindows, readdirSorted, tempDir, tls, tmpdirSync, unprivilegedSpawnOptions } from "harness";
+import {
+  bunEnv,
+  bunExe,
+  bunEnv as env,
+  isLinux,
+  isWindows,
+  readdirSorted,
+  tempDir,
+  tls,
+  tmpdirSync,
+  unprivilegedSpawnOptions,
+} from "harness";
 import { cpSync } from "node:fs";
 import { join } from "path";
 import {
diff --git a/test/cli/install/isolated-install.test.ts b/test/cli/install/isolated-install.test.ts
index b75de18d0a33..b511bc6fef52 100644
--- a/test/cli/install/isolated-install.test.ts
+++ b/test/cli/install/isolated-install.test.ts
@@ -2,7 +2,17 @@ import { file, spawn, write } from "bun";
 import { afterAll, beforeAll, describe, expect, test } from "bun:test";
 import { existsSync, lstatSync, readFileSync, readlinkSync, statSync } from "fs";
 import { mkdir, readlink, rm, symlink } from "fs/promises";
-import { VerdaccioRegistry, bunEnv, bunExe, githubTarball, isLinux, isWindows, readdirSorted, runBunInstall, tempDir } from "harness";
+import {
+  VerdaccioRegistry,
+  bunEnv,
+  bunExe,
+  githubTarball,
+  isLinux,
+  isWindows,
+  readdirSorted,
+  runBunInstall,
+  tempDir,
+} from "harness";
 import { createRequire } from "module";
 import { basename, dirname, join } from "path";
 import { pathToFileURL } from "url";
diff --git a/test/cli/install/migration/pnpm-lock-v9.test.ts b/test/cli/install/migration/pnpm-lock-v9.test.ts
index 0be4c7f4a1ca..6f7064dee5ae 100644
--- a/test/cli/install/migration/pnpm-lock-v9.test.ts
+++ b/test/cli/install/migration/pnpm-lock-v9.test.ts
@@ -1,6 +1,14 @@
 import { afterAll, beforeAll, describe, expect, test } from "bun:test";
 import { appendFileSync, chmodSync, existsSync, readdirSync, realpathSync, rmSync, writeFileSync } from "fs";
-import { VerdaccioRegistry, bunEnv, bunExe, isWindows, nodeModulesPackages, tempDir, unprivilegedSpawnOptions } from "harness";
+import {
+  VerdaccioRegistry,
+  bunEnv,
+  bunExe,
+  isWindows,
+  nodeModulesPackages,
+  tempDir,
+  unprivilegedSpawnOptions,
+} from "harness";
 import { dirname, join } from "path";
 
 const verdaccio = new VerdaccioRegistry();
diff --git a/test/cli/install/minimum-release-age.test.ts b/test/cli/install/minimum-release-age.test.ts
index 1bbaa11885bc..412f48bc621e 100644
--- a/test/cli/install/minimum-release-age.test.ts
+++ b/test/cli/install/minimum-release-age.test.ts
@@ -2,8 +2,8 @@ import type { Server } from "bun";
 import { afterAll, beforeAll, describe, expect, setDefaultTimeout, test } from "bun:test";
 import { bunEnv, bunExe, normalizeBunSnapshot, tempDir } from "harness";
 import { rmSync } from "node:fs";
-import { join } from "node:path";
 import { readdir, rm } from "node:fs/promises";
+import { join } from "node:path";
 
 // These tests drive real `bun install` runs against a mock registry, which is
 // slow under the debug/ASAN build — give them the same generous timeout the

From 0adcafaf8b89afa209d49ffae31e5079c06d5ef9 Mon Sep 17 00:00:00 2001
From: Jarred Sumner <jarred@jarredsumner.com>
Date: Mon, 17 Aug 2026 03:39:17 +0000
Subject: [PATCH 175/258] mega-merge fixup: reconcile APIs across folded PRs
 (MinimumReleaseAgeExcludes, OwnedURL proxy, is_candidate, publishConfig scope
 helpers, pnpm optional lockfile)

---
 .../PackageManager/PackageManagerOptions.rs   |  2 ++
 src/install/PackageManager/runTasks.rs        |  2 +-
 src/install/audit_fix.rs                      |  9 +++------
 src/install/isolated_install/Installer.rs     |  2 +-
 src/install/lockfile/bun.lock.rs              | 10 +++++++++-
 src/install/npm.rs                            | 18 +++++++++++++++--
 src/install/pnpm.rs                           | 20 +++++++++----------
 src/install/update_transitive.rs              | 10 +++++-----
 src/install/yarn.rs                           |  3 ++-
 src/runtime/cli/pack_command.rs               |  1 -
 src/runtime/cli/package_manager_command.rs    |  4 +++-
 src/runtime/cli/publish_command.rs            |  8 ++++----
 12 files changed, 56 insertions(+), 33 deletions(-)

diff --git a/src/install/PackageManager/PackageManagerOptions.rs b/src/install/PackageManager/PackageManagerOptions.rs
index d9d1909e9251..eb0e404275cf 100644
--- a/src/install/PackageManager/PackageManagerOptions.rs
+++ b/src/install/PackageManager/PackageManagerOptions.rs
@@ -422,7 +422,9 @@ impl core::fmt::Display for RegistryPath<'_> {
         }
         Ok(())
     }
+}
 
+impl Options {
     /// The scope for `url` once it replaces `current`, with the credentials configured for `url`.
     fn scope_for_registry_url(
         &self,
diff --git a/src/install/PackageManager/runTasks.rs b/src/install/PackageManager/runTasks.rs
index d5946bcff5e7..18d80abdf566 100644
--- a/src/install/PackageManager/runTasks.rs
+++ b/src/install/PackageManager/runTasks.rs
@@ -27,7 +27,7 @@ use crate::isolated_install::installer as store_installer;
 use crate::isolated_install::store::{EntryColumns as _, NodeColumns as _};
 use crate::lifecycle_script_runner::InstallCtx;
 use crate::network_task::{Authorization, ForTarballError};
-use bun_core::fmt::{EscapeControlChars, PathSep, escape_control_chars, redacted};
+use bun_core::fmt::{PathSep, redacted};
 use bun_install::lockfile::Package;
 use bun_install::package_manager_task as Task;
 // Import the *module* under the `Options` name so `Options::LogLevel` resolves as a path
diff --git a/src/install/audit_fix.rs b/src/install/audit_fix.rs
index 9a021032f9c1..697353445b78 100644
--- a/src/install/audit_fix.rs
+++ b/src/install/audit_fix.rs
@@ -1269,18 +1269,15 @@ pub fn prepare_install(manager: &mut PackageManager, plan: &FixPlan) -> crate::R
     package_json_edits::apply(manager, plan)?;
 
     if plan.fixes.iter().any(|fix| fix.too_recent) {
-        let mut names: Vec<&'static [u8]> = manager
-            .options
-            .minimum_release_age_excludes
-            .map_or_else(Vec::new, <[_]>::to_vec);
-        names.extend(
+        let excludes = crate::npm::MinimumReleaseAgeExcludes::with_packages(
+            manager.options.minimum_release_age_excludes,
             plan.fixes
                 .iter()
                 .filter(|fix| fix.too_recent)
                 .map(|fix| &*bun_core::heap::release(fix.name.clone())),
         );
         manager.options.minimum_release_age_excludes =
-            Some(&*bun_core::heap::release(names.into_boxed_slice()));
+            Some(&*bun_core::heap::release(Box::new(excludes)));
     }
 
     manager.audit_fix_pins = plan
diff --git a/src/install/isolated_install/Installer.rs b/src/install/isolated_install/Installer.rs
index abf95576589e..bb3c36b28e20 100644
--- a/src/install/isolated_install/Installer.rs
+++ b/src/install/isolated_install/Installer.rs
@@ -3,8 +3,8 @@ use std::io::Write as _;
 
 use bun_ast::Log;
 use bun_collections::{ArrayHashMap, DynamicBitSet, StringHashMap};
+use bun_core::fmt::EscapeControlChars;
 use bun_core::fmt::redacted;
-use bun_core::fmt::{EscapeControlChars, escape_control_chars};
 use bun_core::{Environment, Global, Output};
 use bun_core::{ZStr, strings};
 use bun_paths::{self as paths, AbsPath, AutoAbsPath, AutoRelPath};
diff --git a/src/install/lockfile/bun.lock.rs b/src/install/lockfile/bun.lock.rs
index 5cdc2bfb106a..87b74222fc16 100644
--- a/src/install/lockfile/bun.lock.rs
+++ b/src/install/lockfile/bun.lock.rs
@@ -3466,7 +3466,14 @@ pub(crate) fn resolve_peer_dep_version_based_among(
         return None;
     }
 
-    resolve_peer_dep_by_range(range, name_hash, package_index, pkg_resolutions, string_buf)
+    resolve_peer_dep_by_range(
+        range,
+        name_hash,
+        package_index,
+        pkg_resolutions,
+        string_buf,
+        is_candidate,
+    )
 }
 
 /// `package_index` is keyed by real package names; `range` (not `dep.name`) carries them for aliases.
@@ -3500,6 +3507,7 @@ pub(crate) fn resolve_peer_dep_by_range(
     package_index: &PackageIndexMap,
     pkg_resolutions: &[Resolution],
     string_buf: &[u8],
+    is_candidate: impl Fn(PackageID) -> bool,
 ) -> Option<PackageID> {
     let candidates = package_index.get(&name_hash)?.as_slice();
     candidates.iter().copied().find(|&id| {
diff --git a/src/install/npm.rs b/src/install/npm.rs
index d9b173a6cef0..ac23ad45de26 100644
--- a/src/install/npm.rs
+++ b/src/install/npm.rs
@@ -160,7 +160,7 @@ pub fn whoami(manager: &mut PackageManager) -> Result<Vec<u8>, WhoamiError> {
         headers.entries,
         header_buf,
         b"",
-        http_proxy,
+        http_proxy.as_ref().map(|proxy| proxy.url()),
         None,
         http::FetchRedirect::Follow,
     );
@@ -1660,6 +1660,20 @@ impl MinimumReleaseAgeExcludes {
         }
     }
 
+    /// `self` (if any) plus bare-name exemptions for `names`; `bun audit fix` exempts the packages it must move past the age gate.
+    pub(crate) fn with_packages(
+        base: Option<&MinimumReleaseAgeExcludes>,
+        names: impl IntoIterator<Item = &'static [u8]>,
+    ) -> MinimumReleaseAgeExcludes {
+        let mut packages: Vec<&'static [u8]> =
+            base.map_or_else(Vec::new, |base| base.packages.to_vec());
+        packages.extend(names);
+        MinimumReleaseAgeExcludes {
+            packages: packages.into_boxed_slice(),
+            versions: base.map_or_else(Box::default, |base| base.versions.clone()),
+        }
+    }
+
     fn excludes_package(&self, name: &[u8]) -> bool {
         self.packages.contains(&name)
     }
@@ -1747,7 +1761,7 @@ impl PackageManifest {
     }
 
     #[inline]
-    fn is_package_version_too_recent(
+    pub(crate) fn is_package_version_too_recent(
         package_version: &PackageVersion,
         minimum_release_age_ms: f64,
     ) -> bool {
diff --git a/src/install/pnpm.rs b/src/install/pnpm.rs
index c2c2702fb369..ce60f324e6c3 100644
--- a/src/install/pnpm.rs
+++ b/src/install/pnpm.rs
@@ -6,7 +6,7 @@ use bun_alloc::AllocError;
 use bun_collections::StringArrayHashMap;
 
 use bun_ast::{self, self as js_ast, E, Expr, ExprData, G};
-use bun_core::{Global, Output, strings};
+use bun_core::{Global, strings};
 use bun_semver as semver;
 use bun_semver::query::token::Wildcard;
 use bun_semver::{ExternalString, String};
@@ -18,8 +18,6 @@ use crate::external_slice::ExternalSlice;
 use crate::integrity::Integrity;
 use crate::lockfile::{self, LoadResult, LoadResultOk, Lockfile};
 use crate::npm::{self};
-use crate::package_manager_real::add_remove_with_filter::root_package_json_path;
-use crate::package_manager_real::update_package_json_and_install::print_package_json_into_cache_entry;
 use crate::package_manager_real::update_package_json_and_install::print_package_json_into_cache_entry;
 use crate::repository::Repository;
 use crate::resolution::{self, Resolution, TaggedValue};
@@ -2511,7 +2509,7 @@ pub(crate) fn migrate_pnpm_workspace_config(
 /// cache entry changes here: the rest of the load (frozen check, differ) reads it from there, and
 /// `package_json_write_back::record_migrated_root` writes it when the migrated lockfile is saved.
 fn update_package_json_after_migration(
-    lockfile: Option<&mut Lockfile>,
+    mut lockfile: Option<&mut Lockfile>,
     manager: &mut PackageManager,
     log: &mut bun_ast::Log,
     patches: &StringArrayHashMap<Box<[u8]>>,
@@ -2598,12 +2596,14 @@ fn update_package_json_after_migration(
             catalog_obj = ws_root.get_object(b"catalog").filter(is_non_empty_object);
             catalogs_obj = ws_root.get_object(b"catalogs").filter(is_non_empty_object);
             // The migrated root skips `Package::parse`, so the catalog these declare is recorded in the lockfile here.
-            crate::lockfile_real::CatalogMap::put_missing_from_pnpm_workspace(
-                &mut lockfile.catalogs,
-                catalog_obj,
-                catalogs_obj,
-                &mut sbuf!(lockfile),
-            )?;
+            if let Some(lockfile) = lockfile.as_deref_mut() {
+                crate::lockfile_real::CatalogMap::put_missing_from_pnpm_workspace(
+                    &mut lockfile.catalogs,
+                    catalog_obj,
+                    catalogs_obj,
+                    &mut sbuf!(lockfile),
+                )?;
+            }
             workspace_overrides_obj = ws_root.get_object(b"overrides").filter(is_non_empty_object);
             workspace_patched_deps_obj = ws_root
                 .get_object(b"patchedDependencies")
diff --git a/src/install/update_transitive.rs b/src/install/update_transitive.rs
index 1b9f122e8392..09f992092d67 100644
--- a/src/install/update_transitive.rs
+++ b/src/install/update_transitive.rs
@@ -12,7 +12,7 @@ use crate::dedupe;
 use crate::dependency::{self, Behavior, TagExt as _};
 use crate::lockfile::package::PackageColumns as _;
 use crate::lockfile::{Lockfile, PackageIndexEntry};
-use crate::npm::PackageManifest;
+use crate::npm::{MinimumReleaseAgeExcludes, PackageManifest};
 use crate::package_manager::Options::LogLevel;
 use crate::package_manager::ROOT_PACKAGE_JSON_PATH;
 use crate::package_manager_real::populate_manifest_cache::{self, Packages};
@@ -1708,8 +1708,8 @@ fn snapshot_resolution(
         .find(|&&(pkg, _, _)| pkg == owner)?;
     direct_deps.rows[start as usize..(start + len) as usize]
         .iter()
-        .find(|&&(row_hash, row_behavior, _)| row_hash == name_hash && row_behavior == behavior)
-        .map(|&(_, _, resolved)| resolved)
+        .find(|row| row.name_hash == name_hash && row.behavior == behavior)
+        .map(|row| row.resolved)
 }
 
 /// Mirrors `should_update`'s named branch: the row names a requested package and sits in the update scope.
@@ -1750,7 +1750,7 @@ fn direct_row_landing(
     latest: bool,
     keep: KeepLocked,
     min_age: Option<f64>,
-    excludes: Option<&[&[u8]]>,
+    excludes: Option<&MinimumReleaseAgeExcludes>,
 ) -> Option<(Semver::Version, bool)> {
     let buf = lockfile.buffers.string_bytes.as_slice();
     // `patched_package_satisfying` captures the row before any lookup; peer rows fall through.
@@ -1848,7 +1848,7 @@ fn later_than(
     manifest: &PackageManifest,
     v: Semver::Version,
     min_age: Option<f64>,
-    excludes: Option<&[&[u8]]>,
+    excludes: Option<&MinimumReleaseAgeExcludes>,
 ) -> Box<[u8]> {
     if v.tag.has_pre() {
         return Box::default();
diff --git a/src/install/yarn.rs b/src/install/yarn.rs
index 8264677d114f..614ac0729c56 100644
--- a/src/install/yarn.rs
+++ b/src/install/yarn.rs
@@ -602,6 +602,7 @@ impl Binder<'_> {
                 &this.package_index,
                 this.packages.items_resolution(),
                 string_bytes,
+                |_| true,
             );
         }
         self.spec.clear();
@@ -963,7 +964,7 @@ pub(crate) fn migrate_yarn_lockfile<'a>(
             }
         };
 
-        if resolution.tag == ResolutionTag::Uninitialized {
+        if resolution.tag == crate::resolution::Tag::Uninitialized {
             if !silent {
                 let specs = bstr::join(", ", &entry.specs);
                 let specs = bstr::BStr::new(&specs);
diff --git a/src/runtime/cli/pack_command.rs b/src/runtime/cli/pack_command.rs
index 9c8f80124317..74847b18b6f6 100644
--- a/src/runtime/cli/pack_command.rs
+++ b/src/runtime/cli/pack_command.rs
@@ -33,7 +33,6 @@ use crate::cli::run_command::{ConfigureEnvOptions, RunCommand};
 use bun_core::ZBox;
 use bun_core::{ZStr, strings};
 use bun_paths::resolve_path::{self, normalize_buf_spill};
-use bun_semver as Semver;
 use bun_sha_hmac::sha;
 use bun_sys::{
     self, CloseOnDrop, Dir, Fd, FdDirExt as _, FdExt as _, File, dir_iterator as DirIterator,
diff --git a/src/runtime/cli/package_manager_command.rs b/src/runtime/cli/package_manager_command.rs
index 8d01b391b718..f3a29832eaa9 100644
--- a/src/runtime/cli/package_manager_command.rs
+++ b/src/runtime/cli/package_manager_command.rs
@@ -756,6 +756,7 @@ Learn more about these at <magenta>https://bun.com/docs/cli/pm<r>.\n";
                     let name = dependencies[dependency_id as usize]
                         .name
                         .slice(string_bytes);
+                    let name = bun_fmt::escape_control_chars(name);
                     let resolution = bun_core::fmt::EscapeControlChars(bun_fmt::redacted(
                         resolutions[package_id as usize].fmt(string_bytes, PathSep::Auto),
                     ));
@@ -1090,7 +1091,8 @@ fn print_trusted_dependencies_flat(
 
     for (index, &dep_id) in trusted.iter().enumerate() {
         let package_id = resolutions_buf[dep_id as usize];
-        let name = dependencies[dep_id as usize].name.slice(string_bytes);
+        let name =
+            bun_fmt::escape_control_chars(dependencies[dep_id as usize].name.slice(string_bytes));
         let resolution = bun_core::fmt::EscapeControlChars(bun_fmt::redacted(
             resolutions[package_id as usize].fmt(string_bytes, PathSep::Auto),
         ));
diff --git a/src/runtime/cli/publish_command.rs b/src/runtime/cli/publish_command.rs
index c6858f56ee33..34e99fe98d51 100644
--- a/src/runtime/cli/publish_command.rs
+++ b/src/runtime/cli/publish_command.rs
@@ -745,7 +745,7 @@ impl PublishCommand {
             headers.entries,
             headers.content.written_slice(),
             b"",
-            http_proxy,
+            http_proxy.as_ref().map(|proxy| proxy.url()),
             None,
             http::FetchRedirect::Follow,
         );
@@ -875,7 +875,7 @@ impl PublishCommand {
             publish_headers.entries,
             publish_headers.content.written_slice(),
             publish_req_body,
-            http_proxy.clone(),
+            http_proxy.as_ref().map(|proxy| proxy.url()),
             None,
             http::FetchRedirect::Follow,
         );
@@ -970,7 +970,7 @@ impl PublishCommand {
                     otp_headers.entries,
                     otp_headers.content.written_slice(),
                     publish_req_body,
-                    http_proxy,
+                    http_proxy.as_ref().map(|proxy| proxy.url()),
                     None,
                     http::FetchRedirect::Follow,
                 );
@@ -1204,7 +1204,7 @@ impl PublishCommand {
                         auth_headers.entries.clone()?,
                         auth_headers.content.written_slice(),
                         b"",
-                        http_proxy.clone(),
+                        http_proxy.as_ref().map(|proxy| proxy.url()),
                         None,
                         http::FetchRedirect::Follow,
                     );

From 2381dc6a466533051c675a0819bc675436d565ee Mon Sep 17 00:00:00 2001
From: Jarred Sumner <jarred@jarredsumner.com>
Date: Mon, 17 Aug 2026 03:42:23 +0000
Subject: [PATCH 176/258] mega-merge fixup: clippy

---
 src/install/PackageManager.rs          | 2 +-
 src/install/lifecycle_script_runner.rs | 8 ++++----
 2 files changed, 5 insertions(+), 5 deletions(-)

diff --git a/src/install/PackageManager.rs b/src/install/PackageManager.rs
index 5f2bec76221f..71b137566607 100644
--- a/src/install/PackageManager.rs
+++ b/src/install/PackageManager.rs
@@ -1741,7 +1741,7 @@ pub fn init(
                         &root_buf[..json_path_len]
                     };
                     let json_source =
-                        bun_ast::Source::init_path_string(&*json_path, &json_buf[..json_len]);
+                        bun_ast::Source::init_path_string(json_path, &json_buf[..json_len]);
                     initialize_store();
                     // SAFETY: `ctx.log` is a borrow of the CLI's `Log`; valid for the
                     // duration of `init()` (set by `Command::create()` before any install
diff --git a/src/install/lifecycle_script_runner.rs b/src/install/lifecycle_script_runner.rs
index ea53ae9d4110..c19f5acda3aa 100644
--- a/src/install/lifecycle_script_runner.rs
+++ b/src/install/lifecycle_script_runner.rs
@@ -1061,7 +1061,7 @@ impl<'a> LifecycleScriptSubprocess<'a> {
                     if let Err(err) = unsafe {
                         Self::spawn_next_script(std::ptr::from_mut::<Self>(self), script_index)
                     } {
-                        self.exit_after_spawn_failure(script_index, &err);
+                        self.exit_after_spawn_failure(script_index, err);
                     }
                     return;
                 }
@@ -1118,7 +1118,7 @@ impl<'a> LifecycleScriptSubprocess<'a> {
                         } {
                             self.exit_after_spawn_failure(
                                 u8::try_from(new_script_index).expect("int cast"),
-                                &err,
+                                err,
                             );
                         }
                         return;
@@ -1361,7 +1361,7 @@ impl<'a> LifecycleScriptSubprocess<'a> {
         if let Err(err) = unsafe { Self::spawn_next_script(lifecycle_subprocess, first_index) } {
             // SAFETY: `spawn_next_script` does not free the subprocess when it
             // fails; `lss` is a non-owning view that is not used again.
-            unsafe { (*lifecycle_subprocess).exit_after_spawn_failure(first_index, &err) }
+            unsafe { (*lifecycle_subprocess).exit_after_spawn_failure(first_index, err) }
         }
 
         Ok(())
@@ -1388,7 +1388,7 @@ impl<'a> LifecycleScriptSubprocess<'a> {
         }
     }
 
-    fn exit_after_spawn_failure(&mut self, script_index: u8, err: &crate::Error) -> ! {
+    fn exit_after_spawn_failure(&mut self, script_index: u8, err: crate::Error) -> ! {
         Output::err_generic(
             "Failed to run script <b>{}<r> due to error <b>{}<r>",
             (

From b56be59b59cf696bad96528c6f8c9ae3c2dffcb2 Mon Sep 17 00:00:00 2001
From: robobun <117481402+robobun@users.noreply.github.com>
Date: Mon, 17 Aug 2026 03:52:01 +0000
Subject: [PATCH 177/258] audit: fail closed on malformed registry responses
 and escape control characters in the report (#38557)

---
 docs/pm/cli/audit.mdx              |   2 +-
 src/install/audit_fix.rs           |  18 ++-
 src/runtime/cli/audit_command.rs   | 108 ++++++++++-------
 test/cli/install/bun-audit.test.ts | 188 ++++++++++++++++++++++++++++-
 4 files changed, 260 insertions(+), 56 deletions(-)

diff --git a/docs/pm/cli/audit.mdx b/docs/pm/cli/audit.mdx
index b011595e5339..310cd6d67a08 100644
--- a/docs/pm/cli/audit.mdx
+++ b/docs/pm/cli/audit.mdx
@@ -123,4 +123,4 @@ Same as `bun audit fix`, but ranges in your own `package.json` files, catalogs,
 
 `0` if no vulnerabilities remain after Bun applies `--audit-level` and `--ignore`, `1` otherwise. For `bun audit fix`, this is based on the re-audit after installing (or the plan, with `--dry-run`).
 
-If the registry request fails, both commands print `audit request failed` to stderr and exit `1`.
+If the registry request fails, both commands print `audit request failed` to stderr and exit `1`. The same goes for a response that is not an advisory report (for example, a registry or proxy that answers the audit request with an HTML page or an error object): a response Bun cannot read never counts as a clean audit.
diff --git a/src/install/audit_fix.rs b/src/install/audit_fix.rs
index 697353445b78..ef895fcb2781 100644
--- a/src/install/audit_fix.rs
+++ b/src/install/audit_fix.rs
@@ -258,7 +258,11 @@ fn print_elapsed_line() {
 
 fn print_tokens(tokens: &[Box<[u8]>]) {
     for (i, token) in tokens.iter().enumerate() {
-        pretty!("{}{}", if i > 0 { ", " } else { "" }, BStr::new(token));
+        pretty!(
+            "{}{}",
+            if i > 0 { ", " } else { "" },
+            bun_core::fmt::escape_control_chars(token)
+        );
     }
 }
 
@@ -313,14 +317,14 @@ pub fn print_unaudited(groups: &[UnauditedRegistry]) {
             bun_core::warn!(
                 "{} did not answer the audit request; skipped {}",
                 bun_core::fmt::redacted_npm_url(&group.registry),
-                BStr::new(&packages)
+                bun_core::fmt::escape_control_chars(&packages)
             );
         } else {
             bun_core::warn!(
                 "{} did not answer the audit request ({}); skipped {}",
                 bun_core::fmt::redacted_npm_url(&group.registry),
                 BStr::new(&group.reason),
-                BStr::new(&packages)
+                bun_core::fmt::escape_control_chars(&packages)
             );
         }
     }
@@ -1080,7 +1084,7 @@ impl FixPlan {
             }
             pretty!("    <cyan>bun audit fix");
             for token in &all_tokens {
-                pretty!(" --ignore {}", BStr::new(token));
+                pretty!(" --ignore {}", bun_core::fmt::escape_control_chars(token));
             }
             prettyln!("<r>");
             prettyln!("");
@@ -1088,7 +1092,11 @@ impl FixPlan {
         if !self.unmatched.is_empty() {
             prettyln!("not matched to an installed version:");
             for item in &self.unmatched {
-                prettyln!("  {}@{}", BStr::new(&item.name), BStr::new(&item.range));
+                prettyln!(
+                    "  {}@{}",
+                    bun_core::fmt::escape_control_chars(&item.name),
+                    bun_core::fmt::escape_control_chars(&item.range)
+                );
             }
             prettyln!("");
         }
diff --git a/src/runtime/cli/audit_command.rs b/src/runtime/cli/audit_command.rs
index 3c052118de7f..8e5781659387 100644
--- a/src/runtime/cli/audit_command.rs
+++ b/src/runtime/cli/audit_command.rs
@@ -3,6 +3,7 @@ use std::io::Write as _;
 
 use bun_ast::{ExprData, e as E};
 use bun_collections::{DynamicBitSet, HashMap, StringHashMap, index_sort};
+use bun_core::fmt::escape_control_chars;
 use bun_core::{Global, Output, pretty, prettyln};
 use bun_core::{MutableString, strings};
 use bun_http::{self as http, HeaderBuilder};
@@ -97,9 +98,13 @@ fn default_registry_href(pm: &PackageManager) -> &[u8] {
     strings::without_trailing_slash(pm.options.scope.url.href())
 }
 
-fn report_non_json_response(registry: &[u8]) {
+fn report_bad_response(registry: &[u8], reason: &SkipReason) {
     Output::err_generic(
-        "{f} returned a non-JSON audit response",
+        if matches!(reason, SkipReason::NotAdvisories) {
+            "{f} returned an audit response that is not a list of advisories"
+        } else {
+            "{f} returned a non-JSON audit response"
+        },
         (bun_core::fmt::redacted_npm_url(registry),),
     );
 }
@@ -199,22 +204,19 @@ impl AuditCommand {
         let response_text = responses.response_text;
 
         if json_output {
-            let _ = Output::writer().write_all(&response_text);
-            let _ = Output::writer().write_all(b"\n");
-
-            if response_text.is_empty() {
-                return Ok(0);
-            }
-
             let vulnerabilities =
                 collect_vulnerabilities(&response_text, audit_level, ignore_list, &mut stats)?;
-            return match vulnerabilities {
-                Some(vulnerabilities) => Ok(u32::from(!vulnerabilities.is_empty())),
-                None => {
-                    report_non_json_response(default_registry_href(pm));
-                    Ok(1)
+            if !matches!(vulnerabilities, Err(SkipReason::NotJson)) {
+                let _ = Output::writer().write_all(&response_text);
+                let _ = Output::writer().write_all(b"\n");
+            }
+            return Ok(match vulnerabilities {
+                Ok(vulnerabilities) => u32::from(!vulnerabilities.is_empty()),
+                Err(reason) => {
+                    report_bad_response(default_registry_href(pm), &reason);
+                    1
                 }
-            };
+            });
         }
 
         if response_text.is_empty() {
@@ -404,6 +406,7 @@ enum SkipReason {
     Status(u32),
     Send(&'static str),
     NotJson,
+    NotAdvisories,
 }
 
 impl core::fmt::Display for SkipReason {
@@ -412,6 +415,7 @@ impl core::fmt::Display for SkipReason {
             SkipReason::Status(status) => write!(f, "{status}"),
             SkipReason::Send(name) => f.write_str(name),
             SkipReason::NotJson => f.write_str("non-JSON response"),
+            SkipReason::NotAdvisories => f.write_str("not a list of advisories"),
         }
     }
 }
@@ -585,14 +589,14 @@ fn send_audit_requests(
     pm: &mut PackageManager,
     collected: &CollectPackagesResult,
     warn: bool,
-    echo_non_json: bool,
+    echo_json: bool,
 ) -> Result<AuditResponses, bun_alloc::AllocError> {
     let mut bodies: Vec<Box<[u8]>> = Vec::with_capacity(collected.requests.len());
     let mut unaudited_registries: Vec<audit_fix::UnauditedRegistry> = Vec::new();
     let mut stats = AuditStats::default();
 
     for request in &collected.requests {
-        match send_audit_request(pm, &request.registry, &request.body, echo_non_json)? {
+        match send_audit_request(pm, &request.registry, &request.body, echo_json)? {
             Ok(body) => {
                 stats.checked += request.packages.len();
                 bodies.push(body);
@@ -634,9 +638,9 @@ fn audit_for_fix(
             ignore_list,
             &mut stats,
         )? {
-            Some(vulnerabilities) => vulnerabilities,
-            None => {
-                report_non_json_response(default_registry_href(pm));
+            Ok(vulnerabilities) => vulnerabilities,
+            Err(reason) => {
+                report_bad_response(default_registry_href(pm), &reason);
                 Global::exit(1);
             }
         }
@@ -692,7 +696,7 @@ fn send_audit_request(
     pm: &mut PackageManager,
     registry: &AuditRegistry,
     body: &[u8],
-    echo_non_json: bool,
+    echo_json: bool,
 ) -> Result<Result<Box<[u8]>, SkipReason>, bun_alloc::AllocError> {
     libdeflate::load();
     let mut compressor = libdeflate::OwnedCompressor::new(6).ok_or(bun_alloc::AllocError)?;
@@ -765,7 +769,12 @@ fn send_audit_request(
             if trimmed.is_empty() || trimmed[0] == b'{' {
                 return Ok(Ok(Box::<[u8]>::from(response)));
             }
-            SkipReason::NotJson
+            let source = bun_ast::Source::init_path_string(b"audit-response.json", response);
+            if bun_json::ParsedJson::parse_json(&source, &mut bun_ast::Log::init()).is_ok() {
+                SkipReason::NotAdvisories
+            } else {
+                SkipReason::NotJson
+            }
         }
         Err(err) => SkipReason::Send(err.name()),
     };
@@ -774,13 +783,13 @@ fn send_audit_request(
         return Ok(Err(reason));
     }
     match reason {
-        SkipReason::NotJson => {
-            if echo_non_json {
+        SkipReason::NotJson | SkipReason::NotAdvisories => {
+            if echo_json && matches!(reason, SkipReason::NotAdvisories) {
                 let _ = Output::writer().write_all(response_buf.list.as_slice());
                 let _ = Output::writer().write_all(b"\n");
                 Output::flush();
             }
-            report_non_json_response(&registry.href);
+            report_bad_response(&registry.href, &reason);
         }
         reason => {
             bun_core::pretty_errorln!(
@@ -1039,17 +1048,19 @@ fn collect_vulnerabilities(
     audit_level: Option<AuditLevel>,
     ignore_list: &[&[u8]],
     stats: &mut AuditStats,
-) -> Result<Option<Vec<VulnerabilityInfo>>, bun_alloc::AllocError> {
+) -> Result<Result<Vec<VulnerabilityInfo>, SkipReason>, bun_alloc::AllocError> {
     let source = bun_ast::Source::init_path_string(b"audit-response.json", response_text);
     let mut log = bun_ast::Log::init();
 
     let parsed = match bun_json::ParsedJson::parse_json(&source, &mut log) {
         Ok(e) => e,
-        Err(_) => return Ok(None),
+        Err(_) => return Ok(Err(SkipReason::NotJson)),
     };
 
+    // The bulk endpoint answers `{ [package name]: Advisory[] }`; a document of any other shape (a
+    // mirror's `{"error": ...}`, ...) must not pass for a clean audit.
     let ExprData::EObjectJSON(obj) = &parsed.root.data else {
-        return Ok(None);
+        return Ok(Err(SkipReason::NotAdvisories));
     };
 
     let mut vulnerabilities: Vec<VulnerabilityInfo> = Vec::new();
@@ -1057,11 +1068,11 @@ fn collect_vulnerabilities(
         let package_name: &[u8] = prop.key.slice();
 
         let Some(arr) = prop.value.as_array() else {
-            continue;
+            return Ok(Err(SkipReason::NotAdvisories));
         };
         for vuln in arr.items() {
             let Some(vuln_obj) = vuln.as_object() else {
-                continue;
+                return Ok(Err(SkipReason::NotAdvisories));
             };
             let vulnerability = parse_vulnerability(package_name, vuln_obj)?;
             if keep_vulnerability(&vulnerability, audit_level, ignore_list, stats) {
@@ -1070,7 +1081,7 @@ fn collect_vulnerabilities(
         }
     }
 
-    Ok(Some(vulnerabilities))
+    Ok(Ok(vulnerabilities))
 }
 
 #[derive(Default)]
@@ -1091,9 +1102,13 @@ fn print_severity(severity: &[u8]) {
 }
 
 fn print_package_heading(name: &[u8], installed: &[Box<[u8]>]) {
-    pretty!("<red>{}<r>", BStr::new(name));
+    pretty!("<red>{}<r>", escape_control_chars(name));
     for (i, version) in installed.iter().enumerate() {
-        pretty!("{}{}", if i == 0 { "@" } else { ", " }, BStr::new(version));
+        pretty!(
+            "{}{}",
+            if i == 0 { "@" } else { ", " },
+            escape_control_chars(version)
+        );
     }
     prettyln!("");
 }
@@ -1117,9 +1132,9 @@ fn print_dependency_path(path: &DependencyPath, separator: &str) {
     }
     prettyln!(
         "  <d>{} {}<r> <red>{}<r>",
-        BStr::new(&via),
+        escape_control_chars(&via),
         separator,
-        BStr::new(vulnerable_pkg)
+        escape_control_chars(vulnerable_pkg)
     );
 }
 
@@ -1132,12 +1147,14 @@ fn print_enhanced_audit_report(
     ignore_list: &[&[u8]],
     mut stats: AuditStats,
 ) -> Result<u32, bun_alloc::AllocError> {
-    let Some(mut vulnerabilities) =
-        collect_vulnerabilities(response_text, audit_level, ignore_list, &mut stats)?
-    else {
-        report_non_json_response(default_registry_href(pm));
-        return Ok(1);
-    };
+    let mut vulnerabilities =
+        match collect_vulnerabilities(response_text, audit_level, ignore_list, &mut stats)? {
+            Ok(vulnerabilities) => vulnerabilities,
+            Err(reason) => {
+                report_bad_response(default_registry_href(pm), &reason);
+                return Ok(1);
+            }
+        };
 
     if vulnerabilities.is_empty() {
         print_no_vulnerabilities(&stats, audit_level);
@@ -1186,11 +1203,14 @@ fn print_enhanced_audit_report(
                 continue;
             }
             print_severity(&vuln.severity);
-            pretty!(" {}", BStr::new(&vuln.title));
+            pretty!(" {}", escape_control_chars(&vuln.title));
             if !vuln.vulnerable_versions.is_empty() {
-                pretty!(" <d>({})<r>", BStr::new(&vuln.vulnerable_versions));
+                pretty!(
+                    " <d>({})<r>",
+                    escape_control_chars(&vuln.vulnerable_versions)
+                );
             }
-            prettyln!(" - <d>{}<r>", BStr::new(&vuln.url));
+            prettyln!(" - <d>{}<r>", escape_control_chars(&vuln.url));
         }
 
         prettyln!("");
diff --git a/test/cli/install/bun-audit.test.ts b/test/cli/install/bun-audit.test.ts
index c12026f98d50..e480aa7f6fbe 100644
--- a/test/cli/install/bun-audit.test.ts
+++ b/test/cli/install/bun-audit.test.ts
@@ -751,6 +751,167 @@ describe("`bun audit`", () => {
     expect(normalizeBunSnapshot(stdout)).toBe(AUDIT_HEADER + noVulnerabilities(1));
     expect(exitCode).toBe(0);
   });
+
+  describe("registry responses", () => {
+    const projectDependingOnMs: DirectoryTree = {
+      "package.json": JSON.stringify({
+        name: "test",
+        version: "1.0.0",
+        dependencies: {
+          ms: "0.7.0",
+        },
+      }),
+      "bun.lock": JSON.stringify({
+        "lockfileVersion": 1,
+        "workspaces": {
+          "": {
+            "name": "test",
+            "dependencies": {
+              ms: "0.7.0",
+            },
+          },
+        },
+        "packages": {
+          ms: ["ms@0.7.0", "", {}, fakeIntegrity],
+        },
+      }),
+    };
+
+    const NON_JSON = (registry: string) => `error: ${registry} returned a non-JSON audit response`;
+    const NOT_ADVISORIES = (registry: string) =>
+      `error: ${registry} returned an audit response that is not a list of advisories`;
+
+    async function auditAgainst(responseBody: string, args: string[] = []) {
+      await using registry = Bun.serve({
+        port: 0,
+        fetch: () => new Response(responseBody, { headers: { "content-type": "application/json" } }),
+      });
+      using dir = tempDir("bun-test-audit-registry-response", projectDependingOnMs);
+
+      await using proc = spawn({
+        cmd: [bunExe(), "audit", ...args],
+        cwd: String(dir),
+        env: { ...bunEnv, NPM_CONFIG_REGISTRY: registry.url.href },
+        stdout: "pipe",
+        stderr: "pipe",
+      });
+      const [stdout, stderr, exitCode] = await Promise.all([proc.stdout.text(), proc.stderr.text(), proc.exited]);
+
+      return { stdout, stderr: normalizeBunSnapshot(stderr), exitCode, registry: registry.url.href.slice(0, -1) };
+    }
+
+    // The text report starts with the `bun audit v...` header and a blank line; --json prints neither.
+    function withoutHeader(stdout: string) {
+      expect(stdout).toStartWith("bun audit v");
+      return stdout.slice(stdout.indexOf("\n\n") + 2);
+    }
+
+    const notAdvisoryLists = [
+      "[]",
+      "null",
+      '"all clear"',
+      '{"error":"audit is not supported by this registry"}',
+      '{"ms":{"severity":"high","title":"advisory object where the array should be"}}',
+      '{"ms":["high"]}',
+    ];
+
+    test.concurrent.each(notAdvisoryLists)("%s is a failed audit, not a clean one", async responseBody => {
+      const { stdout, stderr, exitCode, registry } = await auditAgainst(responseBody);
+      expect(withoutHeader(stdout)).toBe("");
+      expect(stderr).toBe(NOT_ADVISORIES(registry));
+      expect(exitCode).toBe(1);
+    });
+
+    test.concurrent.each(notAdvisoryLists)("--json relays %s and exits 1", async responseBody => {
+      const { stdout, stderr, exitCode, registry } = await auditAgainst(responseBody, ["--json"]);
+      expect(stdout).toBe(`${responseBody}\n`);
+      expect(stderr).toBe(NOT_ADVISORIES(registry));
+      expect(exitCode).toBe(1);
+    });
+
+    const notJson = ["<html>\x1b[2J\x1b]0;owned\x07sign in to continue</html>", "Not Found"];
+
+    test.concurrent.each(notJson)("a non-JSON body (%j) is neither echoed nor a clean audit", async responseBody => {
+      const { stdout, stderr, exitCode, registry } = await auditAgainst(responseBody);
+      expect(withoutHeader(stdout)).toBe("");
+      expect(stderr).toBe(NON_JSON(registry));
+      expect(exitCode).toBe(1);
+    });
+
+    test.concurrent.each(notJson)("--json does not echo a non-JSON body (%j) either", async responseBody => {
+      const { stdout, stderr, exitCode, registry } = await auditAgainst(responseBody, ["--json"]);
+      expect(stdout).toBe("");
+      expect(stderr).toBe(NON_JSON(registry));
+      expect(exitCode).toBe(1);
+    });
+
+    test.concurrent("a package listed with no advisories is a clean audit", async () => {
+      const { stdout, stderr, exitCode } = await auditAgainst('{"ms":[]}');
+      expect(normalizeBunSnapshot(stdout)).toBe(AUDIT_HEADER + noVulnerabilities(1));
+      expect(stderr).toBe("");
+      expect(exitCode).toBe(0);
+    });
+
+    test.concurrent("--json exits 0 when the packages are listed with no advisories", async () => {
+      const { stdout, stderr, exitCode } = await auditAgainst('{"ms":[]}', ["--json"]);
+      expect(stdout).toBe('{"ms":[]}\n');
+      expect(stderr).toBe("");
+      expect(exitCode).toBe(0);
+    });
+
+    test.concurrent("an empty body is a clean audit", async () => {
+      const { stdout, stderr, exitCode } = await auditAgainst("");
+      expect(normalizeBunSnapshot(stdout)).toBe(AUDIT_HEADER + noVulnerabilities(1));
+      expect(stderr).toBe("");
+      expect(exitCode).toBe(0);
+    });
+
+    test.concurrent("--audit-level filtering out every advisory prints a clean audit, not nothing", async () => {
+      const { stdout, stderr, exitCode } = await auditAgainst(
+        JSON.stringify({ ms: [{ severity: "low", title: "minor", url: "https://example.com/minor" }] }),
+        ["--audit-level", "critical"],
+      );
+      expect(normalizeBunSnapshot(stdout)).toBe(AUDIT_HEADER + noVulnerabilities(1, "1 below --audit-level=critical"));
+      expect(stderr).toBe("");
+      expect(exitCode).toBe(0);
+    });
+
+    test.concurrent("control characters in advisories and package names are escaped in the report", async () => {
+      const { stdout, stderr, exitCode } = await auditAgainst(
+        JSON.stringify({
+          ms: [
+            {
+              severity: "high",
+              title: "ms \x1b[2J\x1b]0;owned\x07 ReDoS in \\d+\r\n\tparsing\x7f \x9b \u00a9 2015",
+              url: "https://example.com/ms\x1b]8;;https://evil.example/\x07",
+              vulnerable_versions: "<2.0.0\x1b[0m",
+            },
+          ],
+          "ms\x1b[31m": [{ severity: "critical", title: "not a real package", url: "https://example.com/fake" }],
+        }),
+      );
+      // Not normalizeBunSnapshot: it rewrites the backslashes the escapes are made of.
+      expect(withoutHeader(stdout)).toBe(
+        [
+          "ms@0.7.0",
+          "  (direct dependency)",
+          "  high: ms \\x1b[2J\\x1b]0;owned\\x07 ReDoS in \\d+\\r\\n\\tparsing\\x7f \\u009b \u00a9 2015 (<2.0.0\\x1b[0m) - https://example.com/ms\\x1b]8;;https://evil.example/\\x07",
+          "",
+          "ms\\x1b[31m",
+          "  critical: not a real package - https://example.com/fake",
+          "",
+          "2 vulnerabilities (1 critical, 1 high)",
+          "",
+          REPORT_FOOTER,
+          "",
+        ].join("\n"),
+      );
+      expect(stdout).not.toContain("\x1b");
+      expect(stdout).not.toContain("\x07");
+      expect(stderr).toBe("");
+      expect(exitCode).toBe(1);
+    });
+  });
 });
 
 // Every audit line that names a registry prints it through the same redaction as the install error lines, which
@@ -838,7 +999,7 @@ describe("`bun audit` with a secret in the registry URL", () => {
 
     const json = await auditAgainst(dir, url, "--json");
     expect(normalizeBunSnapshot(json.stderr)).toBe(NON_JSON(printed));
-    expect(json.stdout).toBe(body + "\n");
+    expect(json.stdout).toBe("");
     expect(json.exitCode).toBe(1);
 
     const fix = await auditAgainst(dir, url, "fix");
@@ -1201,13 +1362,13 @@ describe("`bun audit` report", () => {
     expect(json.exitCode).toBe(1);
   });
 
-  test.concurrent("--json prints an unparsable response and reports the parse failure", async () => {
+  test.concurrent("--json reports an unparsable response without printing it", async () => {
     const body = "<html><body>registry is down</body></html>";
     await using server = startRegistry({}, { bulkBody: body });
     using dir = await setup(server, { name: "foo", dependencies: { "a-dep": "1.0.2" } });
 
     const { stdout, stderr, exitCode } = await audit(dir, "--json");
-    expect(stdout).toBe(body + "\n");
+    expect(stdout).toBe("");
     expect(normalizeBunSnapshot(stderr)).toBe(`error: ${registryHref(server)} returned a non-JSON audit response`);
     expect(exitCode).toBe(1);
 
@@ -1217,18 +1378,33 @@ describe("`bun audit` report", () => {
     expect(text.exitCode).toBe(1);
   });
 
-  test.concurrent("a response whose root is not an object is a parse failure", async () => {
+  test.concurrent("a response whose root is not an object is not an advisory report", async () => {
     await using server = startRegistry({}, { bulkBody: "[]" });
     using dir = await setup(server, { name: "foo", dependencies: { "a-dep": "1.0.2" } });
     const lockBefore = await lock(dir);
+    const rejected = `error: ${registryHref(server)} returned an audit response that is not a list of advisories`;
 
     const json = await audit(dir, "--json");
     expect(json.stdout).toBe("[]\n");
-    expect(json.stderr).toContain(`error: ${registryHref(server)} returned a non-JSON audit response`);
+    expect(normalizeBunSnapshot(json.stderr)).toBe(rejected);
     expect(json.exitCode).toBe(1);
 
     const fix = await auditFix(dir);
-    expect(normalizeBunSnapshot(fix.stderr)).toBe(`error: ${registryHref(server)} returned a non-JSON audit response`);
+    expect(normalizeBunSnapshot(fix.stderr)).toBe(rejected);
+    expect(normalizeBunSnapshot(fix.stdout)).toBe("bun audit fix <version> (<revision>)");
+    expect(fix.exitCode).toBe(1);
+    expect(await lock(dir)).toBe(lockBefore);
+  });
+
+  test.concurrent("an object that is not a list of advisories fails `bun audit fix` too", async () => {
+    await using server = startRegistry({}, { bulkResponse: { error: "audit is not supported by this registry" } });
+    using dir = await setup(server, { name: "foo", dependencies: { "a-dep": "1.0.2" } });
+    const lockBefore = await lock(dir);
+
+    const fix = await auditFix(dir);
+    expect(normalizeBunSnapshot(fix.stderr)).toBe(
+      `error: ${registryHref(server)} returned an audit response that is not a list of advisories`,
+    );
     expect(normalizeBunSnapshot(fix.stdout)).toBe("bun audit fix <version> (<revision>)");
     expect(fix.exitCode).toBe(1);
     expect(await lock(dir)).toBe(lockBefore);

From 0ac90d645227b2e17dc98b990fe47712341dc6b3 Mon Sep 17 00:00:00 2001
From: Jarred Sumner <jarred@jarredsumner.com>
Date: Mon, 17 Aug 2026 04:12:14 +0000
Subject: [PATCH 178/258] mega-merge fixup: test expectations + isolated
 link:/blocked-scripts paths after folding

---
 .../PackageManager/PackageManagerOptions.rs   |  21 ++--
 src/install/isolated_install.rs               |  26 +++--
 src/install/isolated_install/Installer.rs     |  10 +-
 test/cli/install/bun-install.test.ts          | 110 +++++++++---------
 test/cli/install/bun-lock.test.ts             |  40 +++----
 5 files changed, 104 insertions(+), 103 deletions(-)

diff --git a/src/install/PackageManager/PackageManagerOptions.rs b/src/install/PackageManager/PackageManagerOptions.rs
index eb0e404275cf..14a9045447dd 100644
--- a/src/install/PackageManager/PackageManagerOptions.rs
+++ b/src/install/PackageManager/PackageManagerOptions.rs
@@ -432,23 +432,18 @@ impl Options {
         current: &Npm::registry::Scope,
         url: &[u8],
     ) -> Result<Npm::registry::Scope, AllocError> {
-        let url_hash = Npm::registry::Scope::hash(bun_core::without_trailing_slash(url));
-        if let Some(configured) = core::iter::once(&self.scope)
-            .chain(self.registries.values())
-            .find(|scope| scope.url_hash == url_hash)
-        {
-            return Ok(Npm::registry::Scope {
-                name: name.into(),
-                ..configured.clone()
-            });
-        }
-
         let mut scope = Npm::registry::Scope {
             name: name.into(),
-            url: bun_url::OwnedURL::from_href(url.into()),
-            url_hash,
             ..Default::default()
         };
+        scope.set_url(url.into());
+        if let Some(configured) = core::iter::once(&self.scope)
+            .chain(self.registries.values())
+            .find(|configured| configured.url_hash == scope.url_hash)
+        {
+            scope.copy_credentials_from(configured);
+            return Ok(scope);
+        }
         if let Some(credentials) = Npm::registry::UrlAuth::find(&self.url_auth, &scope.url.url()) {
             scope.copy_credentials_from(credentials);
             return Ok(scope);
diff --git a/src/install/isolated_install.rs b/src/install/isolated_install.rs
index 436ebb409f16..82524b14badb 100644
--- a/src/install/isolated_install.rs
+++ b/src/install/isolated_install.rs
@@ -2161,23 +2161,25 @@ pub(crate) fn install_isolated_packages(
                         .store(installer::Step::Done as u32, Ordering::Relaxed);
 
                     // Same target check as the hoisted linker's `install_from_link`.
-                    let mut link_target: AbsPath = AbsPath::init_top_level_dir();
-                    installer.append_store_path(&mut link_target, entry_id);
-                    match sys::openat(
-                        Fd::cwd(),
-                        link_target.slice_z(),
-                        sys::O::RDONLY | sys::O::DIRECTORY,
-                        0,
-                    ) {
+                    let mut link_target = bun_paths::AutoAbsPath::init_top_level_dir();
+                    let checked = installer
+                        .append_dependency_path(&mut link_target, entry_id)
+                        .and_then(|()| {
+                            sys::openat(
+                                Fd::cwd(),
+                                link_target.slice_z(),
+                                sys::O::RDONLY | sys::O::DIRECTORY,
+                                0,
+                            )
+                            .map_err(installer::TaskError::LinkPackage)
+                        });
+                    match checked {
                         Ok(fd) => {
                             use bun_sys::FdExt as _;
                             fd.close();
                             installer.on_task_complete(entry_id, installer::CompleteState::Skipped);
                         }
-                        Err(err) => {
-                            installer
-                                .on_task_fail(entry_id, &installer::TaskError::LinkPackage(err));
-                        }
+                        Err(err) => installer.on_task_fail(entry_id, &err),
                     }
                     continue;
                 }
diff --git a/src/install/isolated_install/Installer.rs b/src/install/isolated_install/Installer.rs
index bb3c36b28e20..6cf91549b4de 100644
--- a/src/install/isolated_install/Installer.rs
+++ b/src/install/isolated_install/Installer.rs
@@ -2080,9 +2080,15 @@ impl Task {
         dep_name: &[u8],
         pkg_res: &Resolution,
     ) -> u8 {
-        // A global-store entry stays in its staging dir until `Step::Binaries` renames it.
+        // A global-store entry stays in its staging dir until `Step::Binaries` renames it; a
+        // project-local one was renamed into place by `Step::LinkPackage`.
         let mut pkg_dir = AutoAbsPath::init_top_level_dir();
-        installer.append_real_store_path(&mut pkg_dir, self.entry_id, Which::Staging);
+        let which = if installer.entry_uses_global_store(self.entry_id) {
+            Which::Staging
+        } else {
+            Which::Final
+        };
+        installer.append_real_store_path(&mut pkg_dir, self.entry_id, which);
 
         let mut log = Log::init();
         match pkg_scripts.get_list(&mut log, lockfile, &mut pkg_dir, dep_name, pkg_res) {
diff --git a/test/cli/install/bun-install.test.ts b/test/cli/install/bun-install.test.ts
index cba0424979cb..017e9fa639db 100644
--- a/test/cli/install/bun-install.test.ts
+++ b/test/cli/install/bun-install.test.ts
@@ -1598,7 +1598,7 @@ describe.concurrent("bun-install", () => {
         stderr: "pipe",
       });
       const [stdout, stderr, exitCode] = await Promise.all([proc.stdout.text(), proc.stderr.text(), proc.exited]);
-      expect(stderr).toContain("ENAMETOOLONG: failed opening node_modules/package dir for package pkg");
+      expect(stderr).toContain("ENAMETOOLONG: failed moving copied files into node_modules/package dir for package pkg");
       expect(stdout).toContain("Failed to install 1 package");
       expect(exitCode).toBe(1);
     }
@@ -5289,7 +5289,8 @@ describe.concurrent("bun-install", () => {
         requests: ["GET /pkg.tgz"],
         stdout: expect.stringContaining("bun install v1."),
         // The server's 404 is what fails the install; before, the request never left the machine.
-        stderr: expect.stringContaining(`error: GET ${tarballUrl} - 404`),
+        // The userinfo travels as an Authorization header, so the reported URL is the bare one.
+        stderr: expect.stringContaining(`error: GET http://127.0.0.1:${server.port}/pkg.tgz - 404`),
         exitCode: 1,
       });
     },
@@ -10582,7 +10583,7 @@ describe("dependency names containing terminal control characters", () => {
       // `bun pm ls` prints straight from the lockfile, so it runs first, before
       // `bun install` gets a chance to touch it.
       const commands: [string[], string][] = [
-        [["pm", "ls", "--all"], "Error loading lockfile: InvalidLockfile"],
+        [["pm", "ls", "--all"], "failed to parse lockfile: InvalidLockfile"],
         [["install"], "Invalid package name"],
       ];
       for (const [args, expectedError] of commands) {
@@ -12034,7 +12035,7 @@ for (const [linker, libNodeModules, toolNodeModules, toolNodeModulesEntries] of
     expect(locks[1]).toBe(locks[0]);
     expect(normalizeBunSnapshot(locks[0], projectDir)).toMatchInlineSnapshot(`
       "{
-        "lockfileVersion": 2,
+        "lockfileVersion": 1,
         "configVersion": 1,
         "workspaces": {
           "": {
@@ -12163,56 +12164,6 @@ describe.concurrent("link: paths with .. or an absolute path declared by a depen
     await packDeclarer(root, { dependencies: declaredLinks(root) });
 
     await expectRefused(root, "tb@./tb-1.0.0.tgz");
-    for (const lockfile of ["bun.lock", "bun.lockb"]) {
-      it(`installs a file: dependency whose version literal has leading whitespace (${lockfile})`, async () => {
-        // The folder path is longer than an inline string so that it has to be appended to the
-        // lockfile's string buffer, which only has room for it if the literal was classified as a folder.
-        const literal = " file:./vendor/some-long-directory-name/lib";
-        using dir = tempDir("whitespace-file-dep", {
-          "package.json": JSON.stringify({
-            name: "my-app",
-            version: "1.0.0",
-            dependencies: {
-              lib: literal,
-            },
-          }),
-          "vendor/some-long-directory-name/lib/package.json": JSON.stringify({
-            name: "lib",
-            version: "1.0.0",
-          }),
-          "bunfig.toml": `install.saveTextLockfile = ${lockfile === "bun.lock"}`,
-        });
-
-        // The first pass resolves from package.json; the second installs from the lockfile the first
-        // pass wrote, which stores the literal as written and has to parse it as a folder again.
-        for (const args of [["install"], ["install", "--frozen-lockfile"]]) {
-          await rm(join(String(dir), "node_modules"), { recursive: true, force: true });
-
-          const { stdout, stderr, exited } = spawn({
-            cmd: [bunExe(), ...args],
-            cwd: String(dir),
-            stdout: "pipe",
-            stderr: "pipe",
-            env,
-          });
-          const [err, out, exitCode] = await Promise.all([stderr.text(), stdout.text(), exited]);
-
-          expect(err).not.toContain("error:");
-          expect(out).toContain("1 package installed");
-          expect(exitCode).toBe(0);
-
-          expect(await file(join(String(dir), "node_modules", "lib", "package.json")).json()).toEqual({
-            name: "lib",
-            version: "1.0.0",
-          });
-          if (lockfile === "bun.lock") {
-            expect(await file(join(String(dir), "bun.lock")).text()).toContain(`"lib": ${JSON.stringify(literal)}`);
-          } else {
-            expect(await exists(join(String(dir), "bun.lockb"))).toBe(true);
-          }
-        }
-      });
-    }
   });
 
   it("are refused when a git dependency declares them", async () => {
@@ -12368,6 +12319,57 @@ describe.concurrent("link: paths with .. or an absolute path declared by a depen
   });
 });
 
+for (const lockfile of ["bun.lock", "bun.lockb"]) {
+  it(`installs a file: dependency whose version literal has leading whitespace (${lockfile})`, async () => {
+    // The folder path is longer than an inline string so that it has to be appended to the
+    // lockfile's string buffer, which only has room for it if the literal was classified as a folder.
+    const literal = " file:./vendor/some-long-directory-name/lib";
+    using dir = tempDir("whitespace-file-dep", {
+      "package.json": JSON.stringify({
+        name: "my-app",
+        version: "1.0.0",
+        dependencies: {
+          lib: literal,
+        },
+      }),
+      "vendor/some-long-directory-name/lib/package.json": JSON.stringify({
+        name: "lib",
+        version: "1.0.0",
+      }),
+      "bunfig.toml": `install.saveTextLockfile = ${lockfile === "bun.lock"}`,
+    });
+
+    // The first pass resolves from package.json; the second installs from the lockfile the first
+    // pass wrote, which stores the literal as written and has to parse it as a folder again.
+    for (const args of [["install"], ["install", "--frozen-lockfile"]]) {
+      await rm(join(String(dir), "node_modules"), { recursive: true, force: true });
+
+      const { stdout, stderr, exited } = spawn({
+        cmd: [bunExe(), ...args],
+        cwd: String(dir),
+        stdout: "pipe",
+        stderr: "pipe",
+        env,
+      });
+      const [err, out, exitCode] = await Promise.all([stderr.text(), stdout.text(), exited]);
+
+      expect(err).not.toContain("error:");
+      expect(out).toContain("1 package installed");
+      expect(exitCode).toBe(0);
+
+      expect(await file(join(String(dir), "node_modules", "lib", "package.json")).json()).toEqual({
+        name: "lib",
+        version: "1.0.0",
+      });
+      if (lockfile === "bun.lock") {
+        expect(await file(join(String(dir), "bun.lock")).text()).toContain(`"lib": ${JSON.stringify(literal)}`);
+      } else {
+        expect(await exists(join(String(dir), "bun.lockb"))).toBe(true);
+      }
+    }
+  });
+}
+
 const fileDepCycleFixture = {
   "package.json": JSON.stringify({
     name: "my-app",
diff --git a/test/cli/install/bun-lock.test.ts b/test/cli/install/bun-lock.test.ts
index 16741f3829f2..5ac89c8a824d 100644
--- a/test/cli/install/bun-lock.test.ts
+++ b/test/cli/install/bun-lock.test.ts
@@ -1021,7 +1021,7 @@ it("names folder and tarball packages without a package.json name after their fo
   expect(lockfile.replaceAll(/localhost:\d+/g, "localhost:1234").replaceAll(/"sha512-[^"]*"/g, '"<integrity>"'))
     .toMatchInlineSnapshot(`
     "{
-      "lockfileVersion": 2,
+      "lockfileVersion": 1,
       "configVersion": 1,
       "workspaces": {
         "": {
@@ -2301,7 +2301,7 @@ describe.each(["hoisted", "isolated"] as const)("peer no published version satis
     const lockfile = await file(lockfilePath).text();
     expect(lockfile).toMatchInlineSnapshot(`
       "{
-        "lockfileVersion": 2,
+        "lockfileVersion": 1,
         "configVersion": 1,
         "workspaces": {
           "": {
@@ -2368,36 +2368,31 @@ describe("loading bun.lock binds the edges of a package printed at several paths
       "star-peer": "star-peer@1.0.0",
     });
 
-    // peer-target leaves package.json as parent enters it. star-peer's peer edge is still bound
-    // to peer-target@1.0.0, which keeps it in the file: the edge's own copy is placed at the root
-    // and mid's 1.1.0 is printed next to mid, which is where star-peer's second printing finds
-    // the name first.
+    // peer-target leaves package.json as parent enters it. Nothing but star-peer's `*` peer holds
+    // peer-target@1.0.0 any more, so the peer pass re-resolves the edge onto mid's 1.1.0, the only
+    // copy a dependency still holds, and that copy hoists to the root for both printings.
     await write(join(cwd, "package.json"), packageJson({ "star-peer": "1.0.0", "mid": "2.0.0", "parent": "1.0.0" }));
     await installWithOwnCache(cwd);
     expect(printedPackages(await file(lockfilePath).text())).toEqual({
       "mid": "mid@2.0.0",
       "parent": "parent@1.0.0",
-      "peer-target": "peer-target@1.0.0",
+      "peer-target": "peer-target@1.1.0",
       "star-peer": "star-peer@1.0.0",
       "parent/mid": "mid@1.0.0",
       "parent/star-peer": "star-peer@2.0.0",
-      "parent/mid/peer-target": "peer-target@1.1.0",
       "parent/mid/star-peer": "star-peer@1.0.0",
     });
 
-    // Loading used to bind the edge from parent/mid/star-peer, the printing that comes last, to
-    // the 1.1.0 next to it. Nothing held peer-target@1.0.0 any more, so the tree built from the
-    // file differed from the file: --frozen-lockfile rejected it and an install rewrote it.
+    // Both printings of star-peer load the edge as the root copy, so the tree built from the
+    // file is the file's own and --frozen-lockfile accepts it.
     await rm(join(cwd, "node_modules"), { recursive: true });
     await installWithOwnCache(cwd, "--frozen-lockfile");
     expect(await file(join(cwd, "node_modules", "peer-target", "package.json")).json()).toMatchObject({
-      version: "1.0.0",
+      version: "1.1.0",
     });
     expect(
-      await file(
-        join(cwd, "node_modules", "parent", "node_modules", "mid", "node_modules", "peer-target", "package.json"),
-      ).json(),
-    ).toMatchObject({ version: "1.1.0" });
+      await exists(join(cwd, "node_modules", "parent", "node_modules", "mid", "node_modules", "peer-target")),
+    ).toBe(false);
   });
 
   // The shapes below are written by hand so nothing needs to be fetched: every row has an empty
@@ -2699,9 +2694,10 @@ it.each<{
     z: { "z": "z@1.0.5" },
   },
   {
-    // The root's z is in place for every later row, so a's pin on it must not change what c gets,
+    // The root's z is in place for every later row, so c's `*` lands on it (across the major, as
+    // every `@types/*` package's `@types/node: *` lands on the project's own `@types/node`)
     // whether a's row is resolved before c's or after.
-    shape: "a -> z@1.0.5 pinning the root's z@~1.0.0 does not make it absorb c -> z@*",
+    shape: "the root's z@~1.0.0 absorbs c -> z@* whether or not a -> z@1.0.5 has pinned it yet",
     manifests: {
       a: { "1.0.0": { dependencies: { z: "1.0.5" } } },
       c: { "1.0.0": { dependencies: { z: "*" } } },
@@ -2709,23 +2705,23 @@ it.each<{
     },
     files: { "package.json": { name: "foo", dependencies: { a: "1.0.0", c: "1.0.0", z: "~1.0.0" } } },
     orders: {
-      "a's manifest last": [{ manifest: "a", until: "/z-2.0.0.tgz" }],
+      "a's manifest last": [{ manifest: "a", until: "/c-1.0.0.tgz" }],
       "c's manifest last": [
         { manifest: "a", until: "/z" },
         { manifest: "c", until: "/a-1.0.0.tgz" },
       ],
     },
-    z: { "z": "z@1.0.5", "c/z": "z@2.0.0" },
+    z: { "z": "z@1.0.5" },
   },
   {
-    shape: "root z@^1.0.0 does not absorb c -> z@* from another major",
+    shape: "root z@^1.0.0 absorbs c -> z@* from another major",
     manifests: { c: { "1.0.0": { dependencies: { z: "*" } } }, z: zVersions },
     files: { "package.json": { name: "foo", dependencies: { c: "1.0.0", z: "^1.0.0" } } },
     orders: {
       "c's manifest last": [{ manifest: "c", until: "/z-1.1.0.tgz" }],
       "z's manifest last": [{ manifest: "z", until: "/c-1.0.0.tgz" }],
     },
-    z: { "z": "z@1.1.0", "c/z": "z@2.0.0" },
+    z: { "z": "z@1.1.0" },
   },
   {
     // p is installed as a's peer once every regular row is resolved; by then a's z is in place on every install.

From aa6cb645a39b4609f48f6bff404381998e0f6f30 Mon Sep 17 00:00:00 2001
From: Jarred Sumner <jarred@jarredsumner.com>
Date: Mon, 17 Aug 2026 04:13:54 +0000
Subject: [PATCH 179/258] Revert "install: install a git dependency's
 devDependencies before running its prepare scripts (#38810)"

This reverts commit 3bd93d00a8f07d98945fc3554004cd599e33003f.
---
 docs/pm/cli/add.mdx                           |   2 -
 docs/pm/lifecycle.mdx                         |  17 -
 .../PackageManager/PackageManagerLifecycle.rs |  33 --
 src/install/lifecycle_script_runner.rs        | 299 ++-------------
 src/install/lockfile/Package/Scripts.rs       |  18 -
 .../bun-install-lifecycle-scripts.test.ts     | 351 ------------------
 6 files changed, 36 insertions(+), 684 deletions(-)

diff --git a/docs/pm/cli/add.mdx b/docs/pm/cli/add.mdx
index ee2f201fdd58..74570b804982 100644
--- a/docs/pm/cli/add.mdx
+++ b/docs/pm/cli/add.mdx
@@ -213,8 +213,6 @@ Bun supports a variety of protocols, including [`github`](https://docs.npmjs.com
 }
 ```
 
-Bun installs the repository's files as they are. If the package builds its entry point in a `prepare` script, add it to `trustedDependencies`. Bun then installs the package's `devDependencies` and runs the script. See [`prepare` scripts of git dependencies](/pm/lifecycle#prepare-scripts-of-git-dependencies).
-
 ## Tarball dependencies
 
 A package name can correspond to a publicly hosted `.tgz` file. Bun downloads and installs the package from that tarball URL rather than from the package registry.
diff --git a/docs/pm/lifecycle.mdx b/docs/pm/lifecycle.mdx
index 5da49a68dfd2..5c35c3224bd4 100644
--- a/docs/pm/lifecycle.mdx
+++ b/docs/pm/lifecycle.mdx
@@ -67,23 +67,6 @@ Set `trustedDependencies: []` when you want to opt out of the default allow list
 
 ---
 
-## `prepare` scripts of git dependencies
-
-A package installed from a git repository (a `git:`, `git+https:`, or `github:` dependency) has no published build output. Many of these packages build their entry point in a `prepare` script, using build tools from their `devDependencies`.
-
-Bun does not run that script until you add the package to `trustedDependencies`. Until then, `bun install` reports the blocked script and the package has no build output. `bun pm untrusted` lists the script.
-
-For a trusted git dependency with a `preprepare`, `prepare`, or `postprepare` script, Bun:
-
-1. Moves a `node_modules` folder that the package already has out of the way.
-2. Runs `bun install --ignore-scripts --no-save` inside the package. This installs the package's `dependencies` and `devDependencies` into a new `node_modules` folder there, using your project's registry and cache directory. The package's `package.json` and a lockfile committed to the repository stay unchanged.
-3. Runs the package's `preprepare`, `prepare`, and `postprepare` scripts.
-4. Removes the `node_modules` folder from step 2 and moves the one from step 1 back. At runtime, the package uses the dependencies your project installed.
-
-Because of `--ignore-scripts` in step 2, the lifecycle scripts of the package's own dependencies do not run.
-
----
-
 ## `--ignore-scripts`
 
 To disable lifecycle scripts for all packages, use the `--ignore-scripts` flag.
diff --git a/src/install/PackageManager/PackageManagerLifecycle.rs b/src/install/PackageManager/PackageManagerLifecycle.rs
index caef511a4193..779fcab116d6 100644
--- a/src/install/PackageManager/PackageManagerLifecycle.rs
+++ b/src/install/PackageManager/PackageManagerLifecycle.rs
@@ -416,13 +416,6 @@ impl PackageManager {
         // this stack frame (freed by the subprocess's `Drop`).
         let envp = script_env.create_null_delimited_env_map()?;
 
-        let install_envp = if list.install_dependencies_for_prepare {
-            self.put_install_config_for_prepare(&mut script_env)?;
-            Some(script_env.create_null_delimited_env_map()?)
-        } else {
-            None
-        };
-
         let shell_bin: Option<&ZStr> = 'shell_bin: {
             #[cfg(windows)]
             {
@@ -451,7 +444,6 @@ impl PackageManager {
             self,
             list,
             envp,
-            install_envp,
             shell_bin,
             optional,
             log_level,
@@ -461,31 +453,6 @@ impl PackageManager {
         Ok(())
     }
 
-    /// The nested install's project directory is the checkout, so this project's
-    /// `bunfig.toml`/`.npmrc` settings have to reach it through the environment.
-    fn put_install_config_for_prepare(
-        &mut self,
-        script_env: &mut bun_dotenv::Map,
-    ) -> Result<(), crate::Error> {
-        let scope = &self.options.scope;
-        // The token only travels together with its registry.
-        if self.options.did_override_default_scope || !scope.token.is_empty() {
-            script_env.put(b"BUN_CONFIG_REGISTRY", scope.url.href())?;
-            if !scope.token.is_empty() {
-                script_env.put(b"BUN_CONFIG_TOKEN", &scope.token)?;
-            }
-        }
-
-        // Opening the cache directory is what fills in its path.
-        let _ = self.get_cache_directory();
-        let cache_directory_path = self.cache_directory_path.as_bytes();
-        if !cache_directory_path.is_empty() {
-            script_env.put(b"BUN_INSTALL_CACHE_DIR", cache_directory_path)?;
-        }
-
-        Ok(())
-    }
-
     pub(crate) fn find_trusted_dependencies_from_update_requests(
         &mut self,
     ) -> ArrayHashMap<PackageID, ()> {
diff --git a/src/install/lifecycle_script_runner.rs b/src/install/lifecycle_script_runner.rs
index c19f5acda3aa..12805200e8d3 100644
--- a/src/install/lifecycle_script_runner.rs
+++ b/src/install/lifecycle_script_runner.rs
@@ -14,11 +14,11 @@ use bun_io::heap as io_heap;
 use bun_io::{FilePollFlag, PosixFlags};
 
 use bun_core::ZStr;
-use bun_paths::AutoAbsPathChecked;
 #[cfg(unix)]
 use bun_spawn::SpawnResultExt as _;
 use bun_spawn::{Process, ProcessExit, ProcessExitKind, Rusage, SpawnOptions, Status};
-use bun_sys::{Fd, FdExt as _};
+#[cfg(unix)]
+use bun_sys::Fd;
 // `BufferedReaderParent::loop_` is typed `*mut bun_uws::Loop` (the
 // `bun_io::Loop` is the trait's nominal: `us_loop_t` on POSIX, `uv_loop_t`
 // on Windows. `AnyEventLoop::native_loop()` projects through the uws wrapper
@@ -287,20 +287,6 @@ impl<'a> ScriptArgv<'a> {
         })
     }
 
-    /// `bun install --ignore-scripts --no-save`, for a git dependency's `prepare` step.
-    pub fn install_dependencies() -> Result<Self, crate::Error> {
-        let mut argv: [*const c_char; 5] = [core::ptr::null(); 5];
-        argv[0] = bun_core::self_exe_path()?.as_ptr();
-        for (slot, arg) in argv[1..].iter_mut().zip(INSTALL_DEPENDENCIES_ARGS) {
-            *slot = arg.as_ptr();
-        }
-        const _: () = assert!(INSTALL_DEPENDENCIES_ARGS.len() + 2 <= 5);
-        Ok(Self {
-            argv,
-            _borrowed: core::marker::PhantomData,
-        })
-    }
-
     /// The null-terminated array `spawn_process` takes; valid while `self`
     /// (and the strings it borrows) is.
     pub fn as_ptr(&self) -> *const *const c_char {
@@ -331,9 +317,6 @@ pub struct LifecycleScriptSubprocess<'a> {
     /// struct so the `K=V\0` buffers stay alive across every async
     /// `spawn_next_script` for the script chain; freed by `Drop`/`destroy`.
     pub(crate) envp: bun_dotenv::NullDelimitedEnvMap,
-    /// `Some` iff `scripts.install_dependencies_for_prepare`.
-    pub(crate) install_envp: Option<bun_dotenv::NullDelimitedEnvMap>,
-    pub(crate) prepare_dependencies: PrepareDependencies,
     pub(crate) shell_bin: Option<&'a ZStr>,
 
     pub(crate) has_incremented_alive_count: bool,
@@ -371,137 +354,6 @@ impl<'a> InstallCtx<'a> {
     }
 }
 
-/// See `List::install_dependencies_for_prepare`.
-#[derive(Clone, Copy, PartialEq, Eq)]
-pub(crate) enum PrepareDependencies {
-    NotNeeded,
-    Pending,
-    /// `bun install` is running; `current_script_index` is the script that follows it.
-    Installing(NestedInstallCleanup),
-    /// Cleaned up once the scripts are done or one of them failed.
-    Installed(NestedInstallCleanup),
-}
-
-/// Holds the package's own `node_modules` (or is empty) while the nested install
-/// and the prepare scripts run. Already existing at the start means an earlier
-/// run was interrupted: it has the original and `node_modules` is that run's leftovers.
-const PREVIOUS_NODE_MODULES_NAME: &[u8] = b".bun-prepare-node_modules";
-
-/// `--ignore-scripts`: this runner is already running the package's scripts.
-/// `--no-save`: leave the package.json and a committed lockfile alone.
-const INSTALL_DEPENDENCIES_ARGS: [&core::ffi::CStr; 3] =
-    [c"install", c"--ignore-scripts", c"--no-save"];
-const INSTALL_DEPENDENCIES_COMMAND_LINE: &[u8] = b"bun install --ignore-scripts --no-save";
-
-/// What to undo in the package directory after the nested install. Its runtime
-/// dependencies are installed outside the package, so everything left inside would
-/// only shadow them.
-#[derive(Clone, Copy, PartialEq, Eq)]
-pub(crate) struct NestedInstallCleanup {
-    /// False when the previous `node_modules` could not be moved out of the way.
-    restore_node_modules: bool,
-    /// `--no-save` still writes `bun.lock` when it migrates a `package-lock.json`
-    /// (`saves_migrated_lockfile`).
-    remove_lockfile: bool,
-}
-
-fn path_in_package(cwd: &[u8], name: &[u8]) -> bun_sys::Result<AutoAbsPathChecked> {
-    let mut path = AutoAbsPathChecked::init();
-    if path.append(cwd).is_err() || path.append(name).is_err() {
-        return Err(
-            bun_sys::Error::from_code(bun_sys::E::ENAMETOOLONG, bun_sys::Tag::rename)
-                .with_path(name),
-        );
-    }
-    Ok(path)
-}
-
-fn set_aside_node_modules(cwd: &[u8]) -> bun_sys::Result<()> {
-    let mut node_modules = path_in_package(cwd, b"node_modules")?;
-    let mut previous = path_in_package(cwd, PREVIOUS_NODE_MODULES_NAME)?;
-    if bun_sys::exists(previous.slice()) {
-        return Fd::cwd().delete_tree(node_modules.slice());
-    }
-    match bun_sys::renameat(
-        Fd::cwd(),
-        node_modules.slice_z(),
-        Fd::cwd(),
-        previous.slice_z(),
-    ) {
-        Err(err) if err.get_errno() == bun_sys::E::ENOENT => {
-            bun_sys::mkdir(previous.slice_z(), 0o755)
-        }
-        result => result,
-    }
-}
-
-impl NestedInstallCleanup {
-    fn begin(cwd: &[u8], package_name: &[u8]) -> Self {
-        let remove_lockfile = path_in_package(cwd, b"bun.lock")
-            .is_ok_and(|lockfile| !bun_sys::exists(lockfile.slice()));
-
-        let restore_node_modules = match set_aside_node_modules(cwd) {
-            Ok(()) => true,
-            Err(err) => {
-                bun_core::warn!(
-                    "failed to set aside the node_modules of \"{}\" ({}); the dependencies installed for its prepare scripts will be left in it",
-                    bstr::BStr::new(package_name),
-                    err,
-                );
-                false
-            }
-        };
-
-        Self {
-            restore_node_modules,
-            remove_lockfile,
-        }
-    }
-
-    fn finish(self, cwd: &[u8], package_name: &[u8]) {
-        if self.remove_lockfile
-            && let Ok(lockfile) = path_in_package(cwd, b"bun.lock")
-        {
-            let _ = Fd::cwd().delete_tree(lockfile.slice());
-        }
-
-        if !self.restore_node_modules {
-            return;
-        }
-        // Both paths were built by `set_aside_node_modules` already.
-        let (Ok(mut node_modules), Ok(mut previous)) = (
-            path_in_package(cwd, b"node_modules"),
-            path_in_package(cwd, PREVIOUS_NODE_MODULES_NAME),
-        ) else {
-            return;
-        };
-
-        if let Err(err) = Fd::cwd().delete_tree(node_modules.slice()) {
-            bun_core::warn!(
-                "failed to remove the dependencies installed for the prepare scripts of \"{}\": {}",
-                bstr::BStr::new(package_name),
-                err,
-            );
-        }
-
-        if let Err(err) = bun_sys::renameat(
-            Fd::cwd(),
-            previous.slice_z(),
-            Fd::cwd(),
-            node_modules.slice_z(),
-        ) {
-            bun_core::warn!(
-                "failed to restore the node_modules of \"{}\" after running its prepare scripts: {}",
-                bstr::BStr::new(package_name),
-                err,
-            );
-            return;
-        }
-        // Removes the empty placeholder from `set_aside_node_modules`; fails on a real one.
-        let _ = bun_sys::rmdir(node_modules.slice_z());
-    }
-}
-
 // `io_heap::Intrusive` takes the comparator via `HeapContext::less` on the
 // `Context` type, so `sort_by_started_at` is provided via a trait impl on a
 // ZST `StartedAtCtx`.
@@ -727,33 +579,15 @@ impl<'a> LifecycleScriptSubprocess<'a> {
             (*this).current_script_index = next_script_index;
             (*this).has_called_process_exit = false;
 
-            let installing_dependencies = (*this).prepare_dependencies
-                == PrepareDependencies::Pending
-                && next_script_index as usize >= ScriptsList::FIRST_PREPARE_INDEX;
+            let mut copy_script: Vec<u8> = Vec::with_capacity(original_script.len() + 1);
+            replace_package_manager_run(&mut copy_script, original_script)?;
+            copy_script.push(0);
 
-            // Owns the script bytes `argv` points into until the spawn below.
-            let mut copy_script: Vec<u8> = Vec::new();
-            let (argv, command_line): (ScriptArgv, &[u8]) = if installing_dependencies {
-                (*this).prepare_dependencies = PrepareDependencies::Installing(
-                    NestedInstallCleanup::begin(cwd, &(*this).package_name),
-                );
-                (
-                    ScriptArgv::install_dependencies()?,
-                    INSTALL_DEPENDENCIES_COMMAND_LINE,
-                )
-            } else {
-                copy_script.reserve_exact(original_script.len() + 1);
-                replace_package_manager_run(&mut copy_script, original_script)?;
-                copy_script.push(0);
-                let combined_script: &ZStr = ZStr::from_slice_with_nul(&copy_script);
-                (
-                    ScriptArgv::new((*this).shell_bin, combined_script)?,
-                    combined_script.as_bytes(),
-                )
-            };
+            let combined_script: &ZStr = ZStr::from_slice_with_nul(&copy_script);
+            let argv = ScriptArgv::new((*this).shell_bin, combined_script)?;
 
             if (*this).foreground && (*manager).options.log_level != crate::LogLevel::Silent {
-                Output::command(Output::CommandArgv::Single(command_line));
+                Output::command(Output::CommandArgv::Single(combined_script.as_bytes()));
             } else if let Some(scripts_node) = (*manager).scripts_node_mut() {
                 (*manager).set_node_name::<true>(
                     scripts_node,
@@ -773,14 +607,9 @@ impl<'a> LifecycleScriptSubprocess<'a> {
                 "{} - {} $ {}",
                 bstr::BStr::new(&(*this).package_name),
                 bstr::BStr::new((*this).script_name()),
-                bstr::BStr::new(command_line)
+                bstr::BStr::new(combined_script.as_bytes())
             );
 
-            let envp: *const *const c_char = match &(*this).install_envp {
-                Some(install_envp) if installing_dependencies => install_envp.as_ptr(),
-                _ => (*this).envp.as_ptr(),
-            };
-
             // OWNERSHIP:
             // `bun_io::Source::Pipe` owns a `Box<uv::Pipe>` AND
             // `spawn_process_windows` does `heap::take(ptr)` on the
@@ -857,7 +686,11 @@ impl<'a> LifecycleScriptSubprocess<'a> {
             (*manager)
                 .active_lifecycle_scripts
                 .insert(this.cast::<LifecycleScriptSubprocess<'static>>());
-            let spawned = match bun_spawn::spawn_process(&spawn_options, argv.as_ptr(), envp) {
+            let spawned = match bun_spawn::spawn_process(
+                &spawn_options,
+                argv.as_ptr(),
+                (*this).envp.as_ptr().cast::<*const c_char>(),
+            ) {
                 Ok(Ok(s)) => s,
                 res => {
                     #[cfg(windows)]
@@ -1042,30 +875,18 @@ impl<'a> LifecycleScriptSubprocess<'a> {
                         return;
                     }
                     self.print_output();
-                    self.print_failure_subject();
-                    bun_core::pretty_errorln!(" exited with {}<r>", exit.code);
-                    self.remove_prepare_dependencies();
+                    bun_core::pretty_errorln!(
+                        "<r><red>error<r><d>:<r> <b>{}<r> script from \"<b>{}<r>\" exited with {}<r>",
+                        bstr::BStr::new(self.script_name()),
+                        bstr::BStr::new(&self.package_name),
+                        exit.code,
+                    );
                     // SAFETY: `self` was created by `Self::new` (heap::alloc); uniquely owned here.
                     unsafe { Self::destroy(std::ptr::from_mut::<Self>(self)) };
                     Output::flush();
                     Global::exit(exit.code as u32);
                 }
 
-                if let PrepareDependencies::Installing(cleanup) = self.prepare_dependencies {
-                    self.prepare_dependencies = PrepareDependencies::Installed(cleanup);
-                    let script_index = self.current_script_index;
-                    self.reset_polls();
-                    // SAFETY: `self` was created by `Self::new` (heap::alloc) and is
-                    // uniquely owned here; it is not touched again on the success
-                    // path before `return` (same contract as the loop below).
-                    if let Err(err) = unsafe {
-                        Self::spawn_next_script(std::ptr::from_mut::<Self>(self), script_index)
-                    } {
-                        self.exit_after_spawn_failure(script_index, err);
-                    }
-                    return;
-                }
-
                 if !self.foreground
                     && let Some(scripts_node) = self.manager().scripts_node_mut()
                 {
@@ -1116,17 +937,19 @@ impl<'a> LifecycleScriptSubprocess<'a> {
                                 u8::try_from(new_script_index).expect("int cast"),
                             )
                         } {
-                            self.exit_after_spawn_failure(
-                                u8::try_from(new_script_index).expect("int cast"),
-                                err,
+                            Output::err_generic(
+                                "Failed to run script <b>{}<r> due to error <b>{}<r>",
+                                (
+                                    bstr::BStr::new(LockfileScripts::NAMES[new_script_index]),
+                                    err.name(),
+                                ),
                             );
+                            Global::exit(1);
                         }
                         return;
                     }
                 }
 
-                self.remove_prepare_dependencies();
-
                 if PackageManager::verbose_install() {
                     bun_core::pretty_errorln!(
                         "<r><d>[Scripts]<r> Finished scripts for <b>{}<r>",
@@ -1158,12 +981,12 @@ impl<'a> LifecycleScriptSubprocess<'a> {
                 self.print_output();
                 let signal_code = bun_sys::SignalCode::from(signal);
 
-                self.print_failure_subject();
                 bun_core::pretty_errorln!(
-                    " terminated by {}<r>",
+                    "<r><red>error<r><d>:<r> <b>{}<r> script from \"<b>{}<r>\" terminated by {}<r>",
+                    bstr::BStr::new(self.script_name()),
+                    bstr::BStr::new(&self.package_name),
                     signal_code.fmt(Output::enable_ansi_colors_stderr()),
                 );
-                self.remove_prepare_dependencies();
 
                 // `Status::signal_code()` range-checks 1..=31 (`bun_core::SignalCode` is
                 // exhaustive); RT signals (>31) fall back to SIGTERM so the diverging
@@ -1186,7 +1009,6 @@ impl<'a> LifecycleScriptSubprocess<'a> {
                     bstr::BStr::new(&self.package_name),
                     err,
                 );
-                self.remove_prepare_dependencies();
                 // SAFETY: `self` was created by `Self::new` (heap::alloc); uniquely owned here.
                 unsafe { Self::destroy(std::ptr::from_mut::<Self>(self)) };
                 Output::flush();
@@ -1285,22 +1107,10 @@ impl<'a> LifecycleScriptSubprocess<'a> {
         unsafe { Self::destroy(std::ptr::from_mut::<Self>(self)) };
     }
 
-    fn remove_prepare_dependencies(&mut self) {
-        let cleanup = match self.prepare_dependencies {
-            PrepareDependencies::Installing(cleanup) | PrepareDependencies::Installed(cleanup) => {
-                cleanup
-            }
-            PrepareDependencies::NotNeeded | PrepareDependencies::Pending => return,
-        };
-        self.prepare_dependencies = PrepareDependencies::NotNeeded;
-        cleanup.finish(self.scripts.cwd.as_bytes(), &self.package_name);
-    }
-
     pub(crate) fn spawn_package_scripts(
         manager: &mut PackageManager,
         list: ScriptsList,
         envp: bun_dotenv::NullDelimitedEnvMap,
-        install_envp: Option<bun_dotenv::NullDelimitedEnvMap>,
         shell_bin: Option<&'a ZStr>,
         optional: bool,
         log_level: crate::LogLevel,
@@ -1308,16 +1118,9 @@ impl<'a> LifecycleScriptSubprocess<'a> {
         ctx: Option<InstallCtx<'a>>,
     ) -> Result<(), crate::Error> {
         let package_name = list.package_name.clone();
-        let prepare_dependencies = if list.install_dependencies_for_prepare {
-            PrepareDependencies::Pending
-        } else {
-            PrepareDependencies::NotNeeded
-        };
         let lifecycle_subprocess = Self::new(LifecycleScriptSubprocess {
             manager: bun_ptr::BackRef::new_mut(manager),
             envp,
-            install_envp,
-            prepare_dependencies,
             shell_bin,
             package_name,
             scripts: list,
@@ -1359,45 +1162,15 @@ impl<'a> LifecycleScriptSubprocess<'a> {
         // SAFETY: `lifecycle_subprocess` is the allocation-rooted `heap::alloc` pointer
         // from `Self::new`; passing it gives the stored backrefs stable provenance.
         if let Err(err) = unsafe { Self::spawn_next_script(lifecycle_subprocess, first_index) } {
-            // SAFETY: `spawn_next_script` does not free the subprocess when it
-            // fails; `lss` is a non-owning view that is not used again.
-            unsafe { (*lifecycle_subprocess).exit_after_spawn_failure(first_index, err) }
-        }
-
-        Ok(())
-    }
-
-    /// `error: <what was running>`; the caller appends how it ended.
-    fn print_failure_subject(&self) {
-        if matches!(
-            self.prepare_dependencies,
-            PrepareDependencies::Installing(_)
-        ) {
-            bun_core::pretty_error!(
-                "<r><red>error<r><d>:<r> <b>{}<r> for the <b>{}<r> script of \"<b>{}<r>\"",
-                bstr::BStr::new(INSTALL_DEPENDENCIES_COMMAND_LINE),
-                bstr::BStr::new(self.script_name()),
-                bstr::BStr::new(&self.package_name),
-            );
-        } else {
-            bun_core::pretty_error!(
-                "<r><red>error<r><d>:<r> <b>{}<r> script from \"<b>{}<r>\"",
-                bstr::BStr::new(self.script_name()),
-                bstr::BStr::new(&self.package_name),
+            bun_core::pretty_errorln!(
+                "<r><red>error<r>: Failed to run script <b>{}<r> due to error <b>{}<r>",
+                bstr::BStr::new(LockfileScripts::NAMES[first_index as usize]),
+                err.name(),
             );
+            Global::exit(1);
         }
-    }
 
-    fn exit_after_spawn_failure(&mut self, script_index: u8, err: crate::Error) -> ! {
-        Output::err_generic(
-            "Failed to run script <b>{}<r> due to error <b>{}<r>",
-            (
-                bstr::BStr::new(LockfileScripts::NAMES[script_index as usize]),
-                err.name(),
-            ),
-        );
-        self.remove_prepare_dependencies();
-        Global::exit(1);
+        Ok(())
     }
 
     fn increment_pending_script_tasks(&self) {
diff --git a/src/install/lockfile/Package/Scripts.rs b/src/install/lockfile/Package/Scripts.rs
index c8bb7d835683..577de10b618d 100644
--- a/src/install/lockfile/Package/Scripts.rs
+++ b/src/install/lockfile/Package/Scripts.rs
@@ -235,12 +235,6 @@ impl Scripts {
                 }
             };
 
-            let install_dependencies_for_prepare =
-                matches!(resolution_tag, ResolutionTag::Git | ResolutionTag::Github)
-                    && scripts[List::FIRST_PREPARE_INDEX..]
-                        .iter()
-                        .any(|script| script.is_some());
-
             return Some(List {
                 items: scripts,
                 first_index: u8::try_from(first_index).expect("int cast"),
@@ -248,7 +242,6 @@ impl Scripts {
                 // Owned NUL-terminated copy.
                 cwd: ZBox::from_bytes(cwd),
                 package_name: Box::<[u8]>::from(package_name),
-                install_dependencies_for_prepare,
             });
         }
 
@@ -424,20 +417,9 @@ pub struct List {
     // Owned NUL-terminated heap string, not a borrow.
     pub(crate) cwd: ZBox,
     pub(crate) package_name: Box<[u8]>,
-    /// Git dependency with prepare scripts: nothing installs the devDependencies
-    /// those build with, so the runner runs `bun install` in `cwd` first (like npm).
-    pub(crate) install_dependencies_for_prepare: bool,
 }
 
-const _: () = assert!(matches!(
-    LockfileScripts::NAMES[List::FIRST_PREPARE_INDEX].as_bytes(),
-    b"preprepare"
-));
-
 impl List {
-    /// Index of `preprepare` in `items`; `prepare` and `postprepare` follow it.
-    pub(crate) const FIRST_PREPARE_INDEX: usize = 3;
-
     pub fn print_scripts(
         &self,
         resolution: &Resolution,
diff --git a/test/cli/install/bun-install-lifecycle-scripts.test.ts b/test/cli/install/bun-install-lifecycle-scripts.test.ts
index b3c6036f5fd2..fd3e581b86db 100644
--- a/test/cli/install/bun-install-lifecycle-scripts.test.ts
+++ b/test/cli/install/bun-install-lifecycle-scripts.test.ts
@@ -130,49 +130,6 @@ async function setupTest(): Promise<TestCtx> {
   }
 }
 
-/**
- * Commits `packageJson` (plus `files`, plus whatever `beforeCommit` adds) to a fresh repository at
- * `<packageDir>/<name>-repo` and returns a `git+file://` dependency spec for it.
- */
-async function createGitDependency(
-  packageDir: string,
-  packageJson: { name: string } & Record<string, unknown>,
-  {
-    files = {},
-    beforeCommit,
-  }: { files?: Record<string, string>; beforeCommit?: (repoDir: string) => Promise<void> } = {},
-): Promise<string> {
-  const repoDir = join(packageDir, `${packageJson.name}-repo`);
-  const emptyGitConfig = join(packageDir, "empty.gitconfig");
-  await Promise.all([mkdir(repoDir, { recursive: true }), writeFile(emptyGitConfig, "")]);
-  await Promise.all([
-    writeFile(join(repoDir, "package.json"), JSON.stringify(packageJson)),
-    ...Object.entries(files).map(([name, contents]) => writeFile(join(repoDir, name), contents)),
-  ]);
-  await beforeCommit?.(repoDir);
-
-  const gitEnv = {
-    ...baseEnv,
-    GIT_CONFIG_NOSYSTEM: "1",
-    GIT_CONFIG_GLOBAL: emptyGitConfig,
-    GIT_AUTHOR_NAME: "bun",
-    GIT_AUTHOR_EMAIL: "bun@example.com",
-    GIT_COMMITTER_NAME: "bun",
-    GIT_COMMITTER_EMAIL: "bun@example.com",
-  };
-  for (const args of [
-    ["init", "-q"],
-    ["add", "."],
-    ["commit", "-q", "-m", "init", "--no-gpg-sign"],
-  ]) {
-    await using proc = spawn({ cmd: ["git", ...args], cwd: repoDir, env: gitEnv, stdout: "ignore", stderr: "pipe" });
-    const [stderr, exitCode] = await Promise.all([proc.stderr.text(), proc.exited]);
-    if (exitCode !== 0) throw new Error(`git ${args.join(" ")} failed:\n${stderr}`);
-  }
-
-  return `git+${Bun.pathToFileURL(repoDir).href}`;
-}
-
 // The six multi-install tests below are the longest in the file (2-3 serial `bun install`s
 // each, some with cold caches). Declare them first so they start before the ~110 shorter
 // tests and overlap with them instead of forming a serial tail at the end of the run.
@@ -2774,314 +2731,6 @@ for (const forceWaiterThread of isLinux ? [false, true] : [false]) {
       expect(await exists(join(packageDir, "node_modules", "lifecycle-install-test", "postinstall.txt"))).toBeTrue();
     });
 
-    // A git dependency is installed from its checkout, so whatever its `prepare` script builds
-    // with (its devDependencies) has to be installed before the script runs, the way npm does
-    // it. https://github.com/oven-sh/bun/issues/10297
-    describe("git dependency with a prepare script that needs its devDependencies", () => {
-      // `what-bin` writes `what-bin.txt` (containing its own version) into the cwd it runs in.
-      const gitDependency = {
-        name: "needs-dev-deps-to-prepare",
-        version: "1.0.0",
-        devDependencies: { "what-bin": "1.0.0" },
-        scripts: { prepare: "what-bin" },
-      };
-      // Like most repositories, this one ships an npm lockfile. The nested install migrates it,
-      // and a migrated lockfile is the one case where bun writes `bun.lock` despite `--no-save`.
-      const gitDependencyFiles = {
-        "package-lock.json": JSON.stringify({
-          name: gitDependency.name,
-          version: gitDependency.version,
-          lockfileVersion: 3,
-          requires: true,
-          packages: {
-            "": {
-              name: gitDependency.name,
-              version: gitDependency.version,
-              devDependencies: gitDependency.devDependencies,
-            },
-            "node_modules/what-bin": { version: "1.0.0", dev: true, bin: { "what-bin": "what-bin.js" } },
-          },
-        }),
-      };
-      const preparedDepDirEntries = ["package-lock.json", "package.json", "what-bin.txt"];
-
-      async function installedState(packageDir: string, name: string) {
-        const depDir = join(packageDir, "node_modules", name);
-        return {
-          prepareOutput: (await exists(join(depDir, "what-bin.txt")))
-            ? await file(join(depDir, "what-bin.txt")).text()
-            : null,
-          depDirEntries: (await readdirSorted(depDir)).filter(entry => entry !== ".bun-tag"),
-          hoistedDevDependency: await exists(join(packageDir, "node_modules", "what-bin")),
-          lockfileMentionsDevDependency: (await file(join(packageDir, "bun.lock")).text()).includes("what-bin"),
-        };
-      }
-
-      for (const linker of ["hoisted", "isolated"] as const) {
-        // On Windows the isolated store path of a git dependency embeds the whole repository URL
-        // (here: a temp dir path) plus the commit, which puts the package past MAX_PATH, and every
-        // lifecycle script of such a package then fails to spawn with ENOENT, with or without this
-        // feature. That is a separate isolated-linker bug; `pm trust` and the tests below still
-        // cover the nested install on Windows through the hoisted linker.
-        test.skipIf(isWindows && linker === "isolated")(
-          `${linker} linker: installs them for the prepare script and removes them afterwards`,
-          async () => {
-            using ctx = await setupTest();
-            const { packageDir, packageJson, env } = ctx;
-            const testEnv = forceWaiterThread ? { ...env, BUN_FEATURE_FLAG_FORCE_WAITER_THREAD: "1" } : env;
-            await verdaccio.writeBunfig(packageDir, { linker });
-
-            const spec = await createGitDependency(packageDir, gitDependency, { files: gitDependencyFiles });
-            await writeFile(
-              packageJson,
-              JSON.stringify({
-                name: "foo",
-                version: "1.0.0",
-                dependencies: { [gitDependency.name]: spec },
-                trustedDependencies: [gitDependency.name],
-              }),
-            );
-
-            await using proc = spawn({
-              cmd: [bunExe(), "install"],
-              cwd: packageDir,
-              stdout: "pipe",
-              stdin: "ignore",
-              stderr: "pipe",
-              env: testEnv,
-            });
-            const [out, err, exitCode] = await Promise.all([proc.stdout.text(), proc.stderr.text(), proc.exited]);
-
-            expect(err).not.toContain("error:");
-            expect(err).not.toContain("warn:");
-            expect(out).toContain(`+ ${gitDependency.name}@git+file://`);
-            expect(exitCode).toBe(0);
-
-            expect(await installedState(packageDir, gitDependency.name)).toEqual({
-              prepareOutput: "what-bin@1.0.0",
-              // neither the nested install's `node_modules` nor the `bun.lock` it migrated are left behind
-              depDirEntries: preparedDepDirEntries,
-              hoistedDevDependency: false,
-              lockfileMentionsDevDependency: false,
-            });
-          },
-        );
-      }
-
-      test("the dependencies bun already nested under the package survive", async () => {
-        using ctx = await setupTest();
-        const { packageDir, packageJson, env } = ctx;
-        const testEnv = forceWaiterThread ? { ...env, BUN_FEATURE_FLAG_FORCE_WAITER_THREAD: "1" } : env;
-
-        // The project hoists what-bin@1.5.0, so the git dependency's own what-bin@1.0.0 is installed
-        // under node_modules/<name>/node_modules, which is exactly where the nested install writes.
-        // This repository also commits a `bun.lock`, which the nested install must leave alone.
-        let committedLockfile = "";
-        const spec = await createGitDependency(
-          packageDir,
-          {
-            name: "has-nested-deps",
-            version: "1.0.0",
-            dependencies: { "what-bin": "1.0.0" },
-            devDependencies: { "no-deps": "1.0.0" },
-            scripts: { prepare: "what-bin" },
-          },
-          {
-            async beforeCommit(repoDir) {
-              await using proc = spawn({
-                cmd: [bunExe(), "install", "--lockfile-only"],
-                cwd: repoDir,
-                stdout: "ignore",
-                stdin: "ignore",
-                stderr: "pipe",
-                env: { ...testEnv, BUN_CONFIG_REGISTRY: verdaccio.registryUrl() },
-              });
-              const [err, exitCode] = await Promise.all([proc.stderr.text(), proc.exited]);
-              expect(err).not.toContain("error:");
-              expect(exitCode).toBe(0);
-              committedLockfile = await file(join(repoDir, "bun.lock")).text();
-              expect(committedLockfile).toContain("no-deps");
-            },
-          },
-        );
-        await writeFile(
-          packageJson,
-          JSON.stringify({
-            name: "foo",
-            version: "1.0.0",
-            dependencies: { "what-bin": "1.5.0", "has-nested-deps": spec },
-            trustedDependencies: ["has-nested-deps"],
-          }),
-        );
-
-        await using proc = spawn({
-          cmd: [bunExe(), "install"],
-          cwd: packageDir,
-          stdout: "ignore",
-          stdin: "ignore",
-          stderr: "pipe",
-          env: testEnv,
-        });
-        const [err, exitCode] = await Promise.all([proc.stderr.text(), proc.exited]);
-        expect(err).not.toContain("error:");
-        expect(err).not.toContain("warn:");
-        expect(exitCode).toBe(0);
-
-        const depDir = join(packageDir, "node_modules", "has-nested-deps");
-        const nestedVersion = async (dir: string) =>
-          (await file(join(dir, "node_modules", "what-bin", "package.json")).json()).version;
-        expect({
-          prepareOutput: await file(join(depDir, "what-bin.txt")).text(),
-          hoistedWhatBin: await nestedVersion(packageDir),
-          nestedWhatBin: await nestedVersion(depDir),
-          nestedDevDependency: await exists(join(depDir, "node_modules", "no-deps")),
-          depDirEntries: (await readdirSorted(depDir)).filter(entry => entry !== ".bun-tag"),
-          lockfileUnchanged: (await file(join(depDir, "bun.lock")).text()) === committedLockfile,
-        }).toEqual({
-          prepareOutput: "what-bin@1.0.0",
-          hoistedWhatBin: "1.5.0",
-          nestedWhatBin: "1.0.0",
-          nestedDevDependency: false,
-          depDirEntries: ["bun.lock", "node_modules", "package.json", "what-bin.txt"],
-          lockfileUnchanged: true,
-        });
-      });
-
-      test("`bun pm trust` installs them too", async () => {
-        using ctx = await setupTest();
-        const { packageDir, packageJson, env } = ctx;
-        const testEnv = forceWaiterThread ? { ...env, BUN_FEATURE_FLAG_FORCE_WAITER_THREAD: "1" } : env;
-
-        const spec = await createGitDependency(packageDir, gitDependency, { files: gitDependencyFiles });
-        await writeFile(
-          packageJson,
-          JSON.stringify({ name: "foo", version: "1.0.0", dependencies: { [gitDependency.name]: spec } }),
-        );
-
-        {
-          await using proc = spawn({
-            cmd: [bunExe(), "install"],
-            cwd: packageDir,
-            stdout: "pipe",
-            stdin: "ignore",
-            stderr: "pipe",
-            env: testEnv,
-          });
-          const [out, err, exitCode] = await Promise.all([proc.stdout.text(), proc.stderr.text(), proc.exited]);
-          expect(err).not.toContain("error:");
-          expect(out).toContain("Blocked 1 postinstall");
-          expect(exitCode).toBe(0);
-          expect((await installedState(packageDir, gitDependency.name)).prepareOutput).toBeNull();
-        }
-
-        await using proc = spawn({
-          cmd: [bunExe(), "pm", "trust", gitDependency.name],
-          cwd: packageDir,
-          stdout: "pipe",
-          stdin: "ignore",
-          stderr: "pipe",
-          env: testEnv,
-        });
-        const [out, err, exitCode] = await Promise.all([proc.stdout.text(), proc.stderr.text(), proc.exited]);
-        expect(err).not.toContain("error:");
-        expect(out).toContain("1 script ran across 1 package");
-        expect(exitCode).toBe(0);
-
-        expect(await installedState(packageDir, gitDependency.name)).toEqual({
-          prepareOutput: "what-bin@1.0.0",
-          depDirEntries: preparedDepDirEntries,
-          hoistedDevDependency: false,
-          lockfileMentionsDevDependency: false,
-        });
-      });
-
-      test("a failing dependency install fails the install and says why", async () => {
-        using ctx = await setupTest();
-        const { packageDir, packageJson, env } = ctx;
-        const testEnv = forceWaiterThread ? { ...env, BUN_FEATURE_FLAG_FORCE_WAITER_THREAD: "1" } : env;
-
-        const spec = await createGitDependency(packageDir, {
-          ...gitDependency,
-          name: "dev-dep-does-not-exist",
-          devDependencies: { "this-package-does-not-exist": "1.0.0" },
-        });
-        await writeFile(
-          packageJson,
-          JSON.stringify({
-            name: "foo",
-            version: "1.0.0",
-            dependencies: { "dev-dep-does-not-exist": spec },
-            trustedDependencies: ["dev-dep-does-not-exist"],
-          }),
-        );
-
-        await using proc = spawn({
-          cmd: [bunExe(), "install"],
-          cwd: packageDir,
-          stdout: "ignore",
-          stdin: "ignore",
-          stderr: "pipe",
-          env: testEnv,
-        });
-        const [err, exitCode] = await Promise.all([proc.stderr.text(), proc.exited]);
-        // the nested install's own output comes first, then bun's summary of what it was doing
-        expect(err).toContain("this-package-does-not-exist");
-        expect(err).toContain(
-          'error: bun install --ignore-scripts --no-save for the prepare script of "dev-dep-does-not-exist" exited with 1',
-        );
-        expect(exitCode).toBe(1);
-
-        // the failed nested install is cleaned up like a successful one
-        const depDir = join(packageDir, "node_modules", "dev-dep-does-not-exist");
-        expect((await readdirSorted(depDir)).filter(entry => entry !== ".bun-tag")).toEqual(["package.json"]);
-      });
-
-      test("recovers from a run that was interrupted while its dependencies were installed", async () => {
-        using ctx = await setupTest();
-        const { packageDir, packageJson, env } = ctx;
-        const testEnv = forceWaiterThread ? { ...env, BUN_FEATURE_FLAG_FORCE_WAITER_THREAD: "1" } : env;
-
-        const spec = await createGitDependency(packageDir, gitDependency);
-        await writeFile(
-          packageJson,
-          JSON.stringify({ name: "foo", version: "1.0.0", dependencies: { [gitDependency.name]: spec } }),
-        );
-        await runBunInstall(testEnv, packageDir);
-
-        // What a run that died (kill -9, power loss) between moving the package's own `node_modules`
-        // aside and putting it back leaves behind: the original in `.bun-prepare-node_modules`, and
-        // the half-installed dependencies of that run in `node_modules`.
-        const depDir = join(packageDir, "node_modules", gitDependency.name);
-        await Promise.all([
-          write(join(depDir, ".bun-prepare-node_modules", "original-nested-dep", "package.json"), "{}"),
-          write(join(depDir, "node_modules", "leftover-from-interrupted-run", "package.json"), "{}"),
-        ]);
-
-        await using proc = spawn({
-          cmd: [bunExe(), "pm", "trust", gitDependency.name],
-          cwd: packageDir,
-          stdout: "ignore",
-          stdin: "ignore",
-          stderr: "pipe",
-          env: testEnv,
-        });
-        const [err, exitCode] = await Promise.all([proc.stderr.text(), proc.exited]);
-        expect(err).not.toContain("error:");
-        expect(err).not.toContain("warn:");
-        expect(exitCode).toBe(0);
-
-        expect({
-          prepareOutput: await file(join(depDir, "what-bin.txt")).text(),
-          depDirEntries: (await readdirSorted(depDir)).filter(entry => entry !== ".bun-tag"),
-          nodeModulesEntries: await readdirSorted(join(depDir, "node_modules")),
-        }).toEqual({
-          prepareOutput: "what-bin@1.0.0",
-          depDirEntries: ["node_modules", "package.json", "what-bin.txt"],
-          nodeModulesEntries: ["original-nested-dep"],
-        });
-      });
-    });
-
     test("root lifecycle scripts should wait for dependency lifecycle scripts", async () => {
       using ctx = await setupTest();
       const { packageDir, packageJson, env } = ctx;

From e4a0624df653a27948b871e27dd925b1ef538069 Mon Sep 17 00:00:00 2001
From: Jarred Sumner <jarred@jarredsumner.com>
Date: Mon, 17 Aug 2026 04:24:35 +0000
Subject: [PATCH 180/258] mega-merge fixup: isolated link: targets are joined
 with .. resolution; userinfo split matches the URL parser; test expectations

---
 src/install/NetworkTask.rs                |  4 +++-
 src/install/isolated_install/Installer.rs | 22 +++++++++++++++-------
 test/cli/install/bun-install.test.ts      |  6 +++---
 test/cli/install/isolated-install.test.ts | 22 +++++++++++++---------
 4 files changed, 34 insertions(+), 20 deletions(-)

diff --git a/src/install/NetworkTask.rs b/src/install/NetworkTask.rs
index c753f1478ceb..98573729448f 100644
--- a/src/install/NetworkTask.rs
+++ b/src/install/NetworkTask.rs
@@ -459,7 +459,9 @@ fn count_auth(header_builder: &mut HeaderBuilder, scope: &npm::registry::Scope)
 fn split_url_userinfo(url: &[u8]) -> Option<(&[u8], Box<[u8]>)> {
     let authority_start = strings::index_of(url, b"://")? + b"://".len();
     let rest = &url[authority_start..];
-    let authority = &rest[..strings::index_of_any(rest, b"/?#").unwrap_or(rest.len())];
+    // Like `bun_url`: userinfo ends at the last `@` before the path, so an unencoded `#` or `?` in
+    // a password stays part of it.
+    let authority = &rest[..strings::index_of_char_usize(rest, b'/').unwrap_or(rest.len())];
     let at = strings::last_index_of_char(authority, b'@')?;
 
     let mut without_userinfo = Vec::with_capacity(url.len() - (at + 1));
diff --git a/src/install/isolated_install/Installer.rs b/src/install/isolated_install/Installer.rs
index 6cf91549b4de..4c0f765098d4 100644
--- a/src/install/isolated_install/Installer.rs
+++ b/src/install/isolated_install/Installer.rs
@@ -2500,8 +2500,12 @@ impl<'a> Installer<'a> {
             } else if uses_global_store {
                 debug_assert!(self.entry_uses_global_store(dep.entry_id));
                 self.append_real_store_path(&mut dep_store_path, dep.entry_id, Which::Final);
-            } else {
-                self.append_dependency_path(&mut dep_store_path, dep.entry_id)?;
+            } else if self
+                .append_dependency_path(&mut dep_store_path, dep.entry_id)
+                .is_err()
+            {
+                // The `link:` entry itself reports the over-long target.
+                continue;
             }
 
             let dest_len = dest.len();
@@ -3083,14 +3087,18 @@ impl<'a> Installer<'a> {
         let string_buf = self.lockfile().buffers.string_bytes.as_slice();
         let link_target = pkg_res.symlink().slice(string_buf);
 
-        let mut target = paths::AutoAbsPathChecked::init();
-        if target.append(link_dir_path).is_err() || target.append(link_target).is_err() {
+        let mut join_buf = paths::path_buffer_pool::get();
+        let Some(target) = paths::resolve_path::join_abs_string_buf_checked::<paths::platform::Auto>(
+            link_dir_path,
+            &mut join_buf[..],
+            &[link_target],
+        ) else {
             return Err(TaskError::LinkPathTooLong(pkg_id));
-        }
+        };
 
         paths::PathLike::clear(buf);
-        // Same unit width and `target` passed the length check, so this fits.
-        buf.append(target.slice()).assume_ok();
+        // `join_abs_string_buf_checked` bounded `target` by the same buffer size.
+        buf.append(target).assume_ok();
         Ok(())
     }
 
diff --git a/test/cli/install/bun-install.test.ts b/test/cli/install/bun-install.test.ts
index 017e9fa639db..32e669cf01b3 100644
--- a/test/cli/install/bun-install.test.ts
+++ b/test/cli/install/bun-install.test.ts
@@ -9952,15 +9952,15 @@ describe.concurrent("bun-install", () => {
       });
 
       it("still refuses a name that joins to a URL outside the registry directory", async () => {
-        const { result, origin } = await installNoDeps(origin => ({
+        const { result } = await installNoDeps(origin => ({
           "bunfig.toml": Bun.TOML.stringify({ install: { registry: { url: `${singleColon(origin)}/npm/`, token } } }),
           "package.json": JSON.stringify({ name: "app", version: "1.0.0", dependencies: { "..": "1.0.0" } }),
         }));
         expect(result).toEqual({
           requests: [],
           stdout: expect.stringContaining("bun install v1."),
-          // The error quotes the registry in the form the check compared against.
-          stderr: expect.stringContaining(`manifest URL "${origin}/" is not on registry "${origin}/npm/"`),
+          // Rejected as a name before any URL is built from it.
+          stderr: expect.stringContaining(`error: Invalid dependency name ".."`),
           exitCode: 1,
         });
       });
diff --git a/test/cli/install/isolated-install.test.ts b/test/cli/install/isolated-install.test.ts
index b511bc6fef52..373624043197 100644
--- a/test/cli/install/isolated-install.test.ts
+++ b/test/cli/install/isolated-install.test.ts
@@ -4622,6 +4622,11 @@ describe("link: dependencies", () => {
     return Buffer.alloc(segments * "x/../".length, "x/../").toString() + "linked";
   }
 
+  // `..` segments are resolved before the length check, so only a target still this long
+  // afterwards fails it (here in the resolver already). No directory of this name can exist,
+  // which is the point: the install has to report the length instead of overrunning a buffer.
+  const targetTooLongOnceJoined = Buffer.alloc(MAX_PATH_BYTES - 16, "l").toString();
+
   const linkedPackageJson = JSON.stringify({ name: "linked", version: "1.0.0" });
 
   // Registers `<dir>/linked` in a global link dir private to the test, so the
@@ -4683,7 +4688,7 @@ describe("link: dependencies", () => {
   test.concurrent("fails with ENAMETOOLONG when the target in bun.lock does not fit", async () => {
     // A lockfile resolution is used as-is, so this never passes through the
     // resolver: the linker is the first thing that builds a path from it.
-    const target = linkTarget(MAX_PATH_BYTES + 64);
+    const target = Buffer.alloc(MAX_PATH_BYTES + 64, "l").toString();
     using dir = tempDir("isolated-link-lockfile-too-long", {
       "linked/package.json": linkedPackageJson,
       "project/package.json": JSON.stringify({
@@ -4719,7 +4724,7 @@ describe("link: dependencies", () => {
 
   test.concurrent("fails with ENAMETOOLONG when the target in package.json does not fit", async () => {
     // Fits on its own, so it resolves; does not fit once joined onto the link dir.
-    const target = linkTarget(MAX_PATH_BYTES - 16);
+    const target = targetTooLongOnceJoined;
     using dir = tempDir("isolated-link-package-json-too-long", {
       "linked/package.json": linkedPackageJson,
       "project/package.json": JSON.stringify({
@@ -4730,16 +4735,15 @@ describe("link: dependencies", () => {
     const { env, projectDir, linkDir } = await registerLinked(String(dir));
     expect(linkDir.length + "/".length + target.length).toBeGreaterThanOrEqual(MAX_PATH_BYTES);
 
-    const { stdout, stderr, exitCode } = await installIsolated(env, projectDir);
+    const { stderr, exitCode } = await installIsolated(env, projectDir);
 
-    expect(stderr).toContain("ENAMETOOLONG: link path for package linked is too long");
-    expect(stdout).toContain("Failed to install 1 package");
+    expect(stderr).toContain("ENAMETOOLONG");
     expect(exitCode).toBe(1);
     expect(() => lstatSync(join(projectDir, "node_modules", "linked"))).toThrow();
   });
 
   test.concurrent("fails the workspace package that depends on a target that does not fit", async () => {
-    const target = linkTarget(MAX_PATH_BYTES - 16);
+    const target = targetTooLongOnceJoined;
     using dir = tempDir("isolated-link-workspace-too-long", {
       "linked/package.json": linkedPackageJson,
       "project/package.json": JSON.stringify({
@@ -4754,10 +4758,10 @@ describe("link: dependencies", () => {
     const { env, projectDir, linkDir } = await registerLinked(String(dir));
     expect(linkDir.length + "/".length + target.length).toBeGreaterThanOrEqual(MAX_PATH_BYTES);
 
-    const { stdout, stderr, exitCode } = await installIsolated(env, projectDir);
+    const { stderr, exitCode } = await installIsolated(env, projectDir);
 
-    expect(stderr).toContain("ENAMETOOLONG: link path for package linked is too long");
-    expect(stdout).toContain("Failed to install 1 package");
+    expect(stderr).toContain("linked@link:");
+    expect(stderr).toContain("failed to resolve");
     expect(exitCode).toBe(1);
     expect(() => lstatSync(join(projectDir, "packages", "app", "node_modules", "linked"))).toThrow();
   });

From 1d7592ca448e94606f1be3e90b5302d6ecd74032 Mon Sep 17 00:00:00 2001
From: Jarred Sumner <jarred@jarredsumner.com>
Date: Mon, 17 Aug 2026 04:27:37 +0000
Subject: [PATCH 181/258] mega-merge fixup: dedupe --why rows carry the
 (removed)/(downgrade) markers; audit header moved to stdout

---
 test/cli/install/bun-audit.test.ts         | 2 +-
 test/cli/install/bun-dedupe.test.ts        | 4 ++--
 test/cli/install/bun-install-proxy.test.ts | 4 ++--
 3 files changed, 5 insertions(+), 5 deletions(-)

diff --git a/test/cli/install/bun-audit.test.ts b/test/cli/install/bun-audit.test.ts
index e480aa7f6fbe..61872133abd7 100644
--- a/test/cli/install/bun-audit.test.ts
+++ b/test/cli/install/bun-audit.test.ts
@@ -5031,7 +5031,7 @@ describe.concurrent("`bun audit` against a registry with a self-signed certifica
     const { stdout, stderr, exitCode, requests } = await audit({ ...bunEnv, NODE_TLS_REJECT_UNAUTHORIZED: "0" });
 
     expect(stderr).not.toContain("DEPTH_ZERO_SELF_SIGNED_CERT");
-    expect(stdout).toBe("No vulnerabilities found\n");
+    expect(stdout).toContain("No vulnerabilities found");
     expect(requests).toEqual(["POST /-/npm/v1/security/advisories/bulk"]);
     expect(exitCode).toBe(0);
   });
diff --git a/test/cli/install/bun-dedupe.test.ts b/test/cli/install/bun-dedupe.test.ts
index e81a953c2de2..d18ed410e650 100644
--- a/test/cli/install/bun-dedupe.test.ts
+++ b/test/cli/install/bun-dedupe.test.ts
@@ -382,9 +382,9 @@ test.concurrent("--why explains a dropped version through its removed dependent"
   const check = await dedupe(packageDir, "--check", "--why");
   expect(lines(check.stdout)).toStrictEqual([
     HEADER,
-    "~ no-deps 2.0.0",
+    "~ no-deps 2.0.0 -> (removed)",
     wanted("2.0.0", "one-fixed-dep@2.0.0"),
-    "~ one-fixed-dep 2.0.0 -> 1.0.0",
+    "~ one-fixed-dep 2.0.0 -> 1.0.0 (downgrade)",
     wanted(">=1.0.0", "foo", "npm:one-fixed-dep@1.0.0".length),
     wanted("npm:one-fixed-dep@1.0.0", "foo"),
     "",
diff --git a/test/cli/install/bun-install-proxy.test.ts b/test/cli/install/bun-install-proxy.test.ts
index 816e7d3a6577..6fed001747da 100644
--- a/test/cli/install/bun-install-proxy.test.ts
+++ b/test/cli/install/bun-install-proxy.test.ts
@@ -265,8 +265,8 @@ describe("registry commands honor http_proxy", () => {
     });
     expect({ requests: setup.requests, stdout, stderr, exitCode }).toEqual({
       requests: [{ via: "proxy", method: "POST", url: `${setup.registryUrl}-/npm/v1/security/advisories/bulk` }],
-      stdout: "No vulnerabilities found\n",
-      stderr: expect.stringMatching(/^bun audit v.*\n$/),
+      stdout: expect.stringContaining("No vulnerabilities found"),
+      stderr: "",
       exitCode: 0,
     });
   });

From 60834d526ae2b8efdab45c363ec5af1a58bdce2c Mon Sep 17 00:00:00 2001
From: Jarred Sumner <jarred@jarredsumner.com>
Date: Mon, 17 Aug 2026 04:34:43 +0000
Subject: [PATCH 182/258] mega-merge fixup: registry test helpers take their
 test's dir; expectations for combined output

---
 test/cli/install/bun-install-registry.test.ts | 89 ++++++++++---------
 .../bun-install-tarball-integrity.test.ts     |  9 +-
 test/cli/install/bun-pack.test.ts             |  3 +-
 test/cli/install/bun-pm.test.ts               | 12 +--
 test/cli/install/bun-prune.test.ts            |  2 +-
 test/cli/install/catalogs.test.ts             |  2 +-
 test/cli/install/minimum-release-age.test.ts  |  2 +-
 test/cli/install/nested-overrides.test.ts     |  4 +-
 test/cli/install/overrides.test.ts            |  2 +-
 9 files changed, 65 insertions(+), 60 deletions(-)

diff --git a/test/cli/install/bun-install-registry.test.ts b/test/cli/install/bun-install-registry.test.ts
index 2da3d12ae3cf..e85819370dde 100644
--- a/test/cli/install/bun-install-registry.test.ts
+++ b/test/cli/install/bun-install-registry.test.ts
@@ -76,11 +76,6 @@ async function setupTest() {
   return { packageDir, packageJson, env };
 }
 
-// Assigned per test by the sequential tests that share describe-level helpers; concurrent tests keep their own.
-let packageDir: string;
-let packageJson: string;
-let env: NodeJS.Dict<string>;
-
 function registryUrl() {
   return registry.registryUrl();
 }
@@ -982,7 +977,11 @@ test.concurrent("--lockfile-only", async () => {
 });
 
 describe("frozen lockfile", () => {
-  async function runInstall(args: string[], extraEnv: Record<string, string> = {}) {
+  async function runInstall(
+    { packageDir, env }: { packageDir: string; env: NodeJS.Dict<string> },
+    args: string[],
+    extraEnv: Record<string, string> = {},
+  ) {
     await using proc = spawn({
       cmd: [bunExe(), "install", ...args],
       cwd: packageDir,
@@ -995,10 +994,10 @@ describe("frozen lockfile", () => {
   }
 
   test("CI=1 does not imply --frozen-lockfile: an out-of-date bun.lock is rewritten", async () => {
-    ({ packageDir, packageJson, env } = await setupTest());
+    const { packageDir, packageJson, env } = await setupTest();
     await write(packageJson, JSON.stringify({ name: "foo", dependencies: { "no-deps": "1.0.0" } }));
 
-    let { err, exitCode } = await runInstall(["--save-text-lockfile"], { CI: "1" });
+    let { err, exitCode } = await runInstall({ packageDir, env }, ["--save-text-lockfile"], { CI: "1" });
     expect(err).toContain("Saved lockfile");
     expect(exitCode).toBe(0);
     const firstLockfile = await file(join(packageDir, "bun.lock")).text();
@@ -1007,7 +1006,7 @@ describe("frozen lockfile", () => {
     await write(packageJson, JSON.stringify({ name: "foo", dependencies: { "no-deps": "1.0.0", "a-dep": "1.0.1" } }));
 
     let out: string;
-    ({ out, err, exitCode } = await runInstall([], { CI: "1", GITHUB_ACTIONS: "true" }));
+    ({ out, err, exitCode } = await runInstall({ packageDir, env }, [], { CI: "1", GITHUB_ACTIONS: "true" }));
     expect(err).toContain("Saved lockfile");
     expect(err).not.toContain("frozen");
     expect(out).toContain("+ a-dep@1.0.1");
@@ -1023,10 +1022,10 @@ describe("frozen lockfile", () => {
   });
 
   test("--frozen-lockfile without a lockfile installs and writes no lockfile", async () => {
-    ({ packageDir, packageJson, env } = await setupTest());
+    const { packageDir, packageJson, env } = await setupTest();
     await write(packageJson, JSON.stringify({ name: "foo", dependencies: { "no-deps": "1.0.0" } }));
 
-    const { out, err, exitCode } = await runInstall(["--frozen-lockfile"]);
+    const { out, err, exitCode } = await runInstall({ packageDir, env }, ["--frozen-lockfile"]);
     expect(err).not.toContain("error:");
     expect(err).not.toContain("Saved lockfile");
     expect(out).toContain("+ no-deps@1.0.0");
@@ -1040,13 +1039,13 @@ describe("frozen lockfile", () => {
   });
 
   test("bunfig [install] production = true treats bun.lock as frozen", async () => {
-    ({ packageDir, packageJson, env } = await setupTest());
+    const { packageDir, packageJson, env } = await setupTest();
     await write(
       packageJson,
       JSON.stringify({ name: "foo", dependencies: { "no-deps": "1.0.0" }, devDependencies: { "a-dep": "1.0.1" } }),
     );
 
-    let { err, exitCode } = await runInstall(["--save-text-lockfile"]);
+    let { err, exitCode } = await runInstall({ packageDir, env }, ["--save-text-lockfile"]);
     expect(err).toContain("Saved lockfile");
     expect(exitCode).toBe(0);
     const lockfile = await file(join(packageDir, "bun.lock")).text();
@@ -1057,7 +1056,7 @@ describe("frozen lockfile", () => {
     await write(join(packageDir, "bunfig.toml"), bunfig.replace("[install]\n", "[install]\nproduction = true\n"));
 
     await rm(join(packageDir, "node_modules"), { recursive: true, force: true });
-    ({ err, exitCode } = await runInstall([]));
+    ({ err, exitCode } = await runInstall({ packageDir, env }, []));
     expect(err).not.toContain("error:");
     expect(err).not.toContain("Saved lockfile");
     expect(exitCode).toBe(0);
@@ -1072,7 +1071,7 @@ describe("frozen lockfile", () => {
       }),
     );
 
-    ({ err, exitCode } = await runInstall([]));
+    ({ err, exitCode } = await runInstall({ packageDir, env }, []));
     expect(normalizeBunSnapshot(err, packageDir)).toMatchInlineSnapshot(`
       "Resolving dependencies
       Resolved, downloaded and extracted [4]
@@ -1292,7 +1291,7 @@ describe.concurrent("bundledDependencies", () => {
         lockfile = await file(join(packageDir, "bun.lock")).text();
         expect(lockfile.replaceAll(/localhost:\d+/g, "localhost:1234")).toMatchInlineSnapshot(`
           "{
-            "lockfileVersion": 2,
+            "lockfileVersion": 1,
             "configVersion": 1,
             "workspaces": {
               "": {
@@ -1359,7 +1358,7 @@ describe.concurrent("bundledDependencies", () => {
         lockfile = await file(join(packageDir, "bun.lock")).text();
         expect(lockfile.replaceAll(/localhost:\d+/g, "localhost:1234")).toMatchInlineSnapshot(`
           "{
-            "lockfileVersion": 2,
+            "lockfileVersion": 1,
             "configVersion": 1,
             "workspaces": {
               "": {
@@ -3622,7 +3621,7 @@ describe.concurrent("binaries", () => {
 
     for (const linker of ["hoisted", "isolated"] as const) {
       test(`file targets are skipped like missing bins (${linker})`, async () => {
-        ({ packageDir, packageJson, env } = await setupTest());
+        const { packageDir, packageJson, env } = await setupTest();
         // A target this long cannot exist, and the linker silently skips a bin
         // whose target does not exist, so these install without output and the
         // other bins are still linked. Covers the string, single-entry and
@@ -3695,7 +3694,7 @@ describe.concurrent("binaries", () => {
       });
 
       test(`directories.bin fails with ENAMETOOLONG (${linker})`, async () => {
-        ({ packageDir, packageJson, env } = await setupTest());
+        const { packageDir, packageJson, env } = await setupTest();
         // The linker reports every failure to open a bin directory other than
         // ENOENT, and ENAMETOOLONG is what the OS reports for a directory path it
         // cannot address, so a value that does not fit gets the same error.
@@ -3741,7 +3740,7 @@ describe.concurrent("binaries", () => {
     // The entries of a bin directory are joined onto the directory's path as
     // well, and so is the temporary file used to rewrite a CRLF shebang.
     test.skipIf(isWindows)("entries of a directories.bin close to the path limit", async () => {
-      ({ packageDir, packageJson, env } = await setupTest());
+      const { packageDir, packageJson, env } = await setupTest();
       // Most of the depth goes into the project directory: the `.bin` links are
       // relative, so everything below the package ends up in the link targets,
       // and XFS rejects link targets of 1 KiB or more. The bin directory is then
@@ -3787,7 +3786,7 @@ describe.concurrent("binaries", () => {
     // on another branch of the tree contributes one `..` per component, so the
     // link target can be longer than the target's absolute path.
     test.skipIf(isWindows)("bun link with a link target longer than the path buffer", async () => {
-      ({ packageDir, packageJson, env } = await setupTest());
+      const { packageDir, packageJson, env } = await setupTest();
       // As in the previous test, most of the depth has to sit above everything
       // that ends up in a link target that is meant to be created (XFS), so it
       // goes into the global directory itself.
@@ -3848,7 +3847,7 @@ describe.concurrent("binaries", () => {
     });
 
     test("bun link and bun unlink", async () => {
-      ({ packageDir, packageJson, env } = await setupTest());
+      const { packageDir, packageJson, env } = await setupTest();
       // `bun link` links a package's bins into the global bin directory with the
       // same linker, and `bun unlink` is the only caller of its unlink side, which
       // has to open the same bin directory.
@@ -4528,7 +4527,7 @@ describe.concurrent("hoisting", async () => {
   });
 
   // Compare the exact version: `toContain("1.0.1")` also matches "1.0.10".
-  async function hoistedADepVersion(): Promise<string> {
+  async function hoistedADepVersion(packageDir: string): Promise<string> {
     return (await file(join(packageDir, "node_modules", "a-dep", "package.json")).json()).version;
   }
 
@@ -4642,7 +4641,7 @@ describe.concurrent("hoisting", async () => {
       expect(await exited).toBe(0);
       assertManifestsPopulated(join(packageDir, ".bun-cache"), registryUrl());
 
-      expect(await hoistedADepVersion()).toBe(expected);
+      expect(await hoistedADepVersion(packageDir)).toBe(expected);
 
       await rm(join(packageDir, "bun.lockb"));
 
@@ -4807,7 +4806,7 @@ describe.concurrent("hoisting", async () => {
         expect(await exited).toBe(0);
         assertManifestsPopulated(join(packageDir, ".bun-cache"), registryUrl());
 
-        expect(await hoistedADepVersion()).toBe(expected);
+        expect(await hoistedADepVersion(packageDir)).toBe(expected);
 
         await rm(join(packageDir, "bun.lockb"));
 
@@ -4830,7 +4829,7 @@ describe.concurrent("hoisting", async () => {
         expect(await exited).toBe(0);
         assertManifestsPopulated(join(packageDir, ".bun-cache"), registryUrl());
 
-        expect(await hoistedADepVersion()).toBe(expected);
+        expect(await hoistedADepVersion(packageDir)).toBe(expected);
 
         await rm(join(packageDir, "node_modules"), { recursive: true, force: true });
 
@@ -4855,12 +4854,12 @@ describe.concurrent("hoisting", async () => {
         expect(await exited).toBe(0);
         assertManifestsPopulated(join(packageDir, ".bun-cache"), registryUrl());
 
-        expect(await hoistedADepVersion()).toBe(expected);
+        expect(await hoistedADepVersion(packageDir)).toBe(expected);
       });
     }
 
     test("peer * hoists the same version no matter which manifest the registry answers first", async () => {
-      ({ packageDir, packageJson, env } = await setupTest());
+      const { packageDir, packageJson, env } = await setupTest();
       // Proxy in front of verdaccio that forces the arrival order seen on slow
       // CI machines: the a-dep manifest gets processed (so a-dep@1.0.1..1.0.9
       // exist in the lockfile) before peer-a-dep-star's manifest arrives, and
@@ -4911,11 +4910,11 @@ describe.concurrent("hoisting", async () => {
       expect(out).toContain("21 packages installed");
       expect(exitCode).toBe(0);
 
-      expect(await hoistedADepVersion()).toBe("1.0.10");
+      expect(await hoistedADepVersion(packageDir)).toBe("1.0.10");
     });
 
     test("peer * binds to the same version when bun.lock is loaded as when it was resolved", async () => {
-      ({ packageDir, packageJson, env } = await setupTest());
+      const { packageDir, packageJson, env } = await setupTest();
       // Nothing above `peer-a-dep-star` provides a-dep, so the isolated linker
       // installs the peer from the version the edge resolved to and keys the
       // store entry by it. The root of the printed tree holds a-dep@1.0.1 (from
@@ -5545,7 +5544,7 @@ describe.concurrent("hoisting", async () => {
 
   // hoist-lockfile-1@1.0.0 depends on `hoist-lockfile-shared: *`; the registry has 1.0.1, 1.0.2, 2.0.1 and 2.0.2.
   // The project's own range decides which copy that `*` shares, the same way an exact pin would.
-  async function sharedResolutions() {
+  async function sharedResolutions({ packageDir, env }: { packageDir: string; env: NodeJS.Dict<string> }) {
     await runBunInstall(env, packageDir, { saveTextLockfile: true });
     const { packages } = Bun.JSONC.parse(await file(join(packageDir, "bun.lock")).text()) as {
       packages: Record<string, [string]>;
@@ -5567,7 +5566,7 @@ describe.concurrent("hoisting", async () => {
       }),
     );
 
-    expect(await sharedResolutions()).toStrictEqual({ "hoist-lockfile-shared": "hoist-lockfile-shared@1.0.2" });
+    expect(await sharedResolutions({ packageDir, env })).toStrictEqual({ "hoist-lockfile-shared": "hoist-lockfile-shared@1.0.2" });
     expect(await exists(join(packageDir, "node_modules", "hoist-lockfile-1", "node_modules"))).toBeFalse();
   });
 
@@ -5584,7 +5583,7 @@ describe.concurrent("hoisting", async () => {
       ),
     ]);
 
-    expect(await sharedResolutions()).toStrictEqual({ "hoist-lockfile-shared": "hoist-lockfile-shared@1.0.2" });
+    expect(await sharedResolutions({ packageDir, env })).toStrictEqual({ "hoist-lockfile-shared": "hoist-lockfile-shared@1.0.2" });
     expect(await exists(join(packageDir, "node_modules", "hoist-lockfile-1", "node_modules"))).toBeFalse();
   });
 });
@@ -6263,7 +6262,7 @@ describe.concurrent("transitive file dependencies", () => {
       const lock = (await file(join(packageDir, "bun.lock")).text()).replaceAll(/localhost:\d+/g, "localhost:1234");
       expect(normalizeBunSnapshot(lock)).toMatchInlineSnapshot(`
         "{
-          "lockfileVersion": 2,
+          "lockfileVersion": 1,
           "configVersion": 1,
           "workspaces": {
             "": {
@@ -6514,7 +6513,8 @@ describe.concurrent("update", () => {
       expect(out).toEqual([
         expect.stringContaining("bun update v1."),
         "",
-        "Checked 1 install across 2 packages (no changes)",
+        // The exact pin does not move; the minified package.json written above is re-printed.
+        "Checked 1 install across 2 packages (up to date, package.json synced)",
       ]);
       await check(version);
 
@@ -6874,7 +6874,7 @@ describe.concurrent("update", () => {
 
     for (const [dependency, version, args, updated, installed] of cases) {
       test(`${JSON.stringify(version)} with \`bun update${args.map(arg => ` ${arg}`).join("")}\``, async () => {
-        ({ packageDir, packageJson, env } = await setupTest());
+        const { packageDir, packageJson, env } = await setupTest();
         await write(
           packageJson,
           JSON.stringify({
@@ -6902,7 +6902,7 @@ describe.concurrent("update", () => {
     }
 
     test("bun update --interactive keeps the alias and the range prefix", async () => {
-      ({ packageDir, packageJson, env } = await setupTest());
+      const { packageDir, packageJson, env } = await setupTest();
       await write(
         packageJson,
         JSON.stringify({
@@ -6941,7 +6941,7 @@ describe.concurrent("update", () => {
     });
 
     test("a catalog reference in an earlier dependency group is left alone", async () => {
-      ({ packageDir, packageJson, env } = await setupTest());
+      const { packageDir, packageJson, env } = await setupTest();
       // devDependencies are visited before dependencies. The entry recorded for `dependencies`
       // must not be spent rewriting the `catalog:` reference.
       await write(
@@ -7165,7 +7165,7 @@ describe.concurrent("update", () => {
       "",
       "+ a-dep@1.0.10",
       "+ dep-loop-entry@1.0.0",
-      expect.stringContaining("+ dep-with-tags@2.0.1"),
+      "+ dep-with-tags@2.0.1 (v3.0.0 available)",
       "+ dev-deps@1.0.0",
       "+ left-pad@1.0.0",
       "+ native@1.0.0",
@@ -7174,10 +7174,10 @@ describe.concurrent("update", () => {
       "+ optional-native@1.0.0",
       "+ peer-deps-too@1.0.0",
       "+ two-range-deps@1.0.0",
-      expect.stringContaining("+ uses-what-bin@1.5.0"),
-      expect.stringContaining("+ what-bin@1.5.0"),
+      "+ uses-what-bin@1.5.0",
+      "+ what-bin@1.5.0",
       "",
-      expect.stringContaining("20 packages installed"),
+      expect.stringContaining(`${installsWithOptionalNative + 1} packages installed`),
       "",
       "Blocked 1 postinstall. Run `bun pm untrusted` for details.",
       "",
@@ -11368,7 +11368,11 @@ describe("manifest conditional requests", () => {
   }
 
   let registryPort = 0;
+  let packageDir: string;
+  let packageJson: string;
+  let env: NodeJS.Dict<string>;
   async function setup(serverPort: number) {
+    ({ packageDir, packageJson, env } = await setupTest());
     registryPort = serverPort;
     await Promise.all([
       write(
@@ -11498,7 +11502,6 @@ describe("manifest conditional requests", () => {
   // deleted the entry, and another install reading the cache in between missed it. The poll
   // below is that other reader. Linux only: the other platforms rename the new file into place.
   test.skipIf(!isLinux)("rewriting a cached manifest never leaves the cache without the entry", async () => {
-    ({ packageDir, packageJson, env } = await setupTest());
     const { server, requests } = startRegistry({ etag });
     using _ = server;
     await setup(server.port);
diff --git a/test/cli/install/bun-install-tarball-integrity.test.ts b/test/cli/install/bun-install-tarball-integrity.test.ts
index 8776d1730f95..0adf39a97f24 100644
--- a/test/cli/install/bun-install-tarball-integrity.test.ts
+++ b/test/cli/install/bun-install-tarball-integrity.test.ts
@@ -863,7 +863,7 @@ describe.concurrent("tarball integrity metadata forms", () => {
     const real = buildTarball(Buffer.from('{"name":"pkg","version":"1.0.0"}\n'));
     const other = buildTarball(Buffer.from('{"name":"other","version":"9.9.9"}\n'));
 
-    await using server = serveManifest(other.sha512, real.tgz);
+    await using server = serveManifest({ integrity: other.sha512 }, real.tgz);
     using dir = projectDir("integrity-no-verify-flag", server.port);
 
     await using proc = spawn({
@@ -887,7 +887,7 @@ describe.concurrent("tarball integrity metadata forms", () => {
     const real = buildTarball(Buffer.from('{"name":"pkg","version":"1.0.0"}\n'));
     const other = buildTarball(Buffer.from('{"name":"other","version":"9.9.9"}\n'));
 
-    await using server = serveManifest(other.sha512, real.tgz);
+    await using server = serveManifest({ integrity: other.sha512 }, real.tgz);
     using dir = projectDir("integrity-no-verify-env-1", server.port);
 
     await using proc = spawn({
@@ -911,7 +911,7 @@ describe.concurrent("tarball integrity metadata forms", () => {
     const real = buildTarball(Buffer.from('{"name":"pkg","version":"1.0.0"}\n'));
     const other = buildTarball(Buffer.from('{"name":"other","version":"9.9.9"}\n'));
 
-    await using server = serveManifest(other.sha512, real.tgz);
+    await using server = serveManifest({ integrity: other.sha512 }, real.tgz);
     using dir = projectDir("integrity-no-verify-env-0", server.port);
 
     await using proc = spawn({
@@ -1165,9 +1165,10 @@ describe.concurrent("tarball re-extraction over an existing cache folder", () =>
     expect(await installFresh(String(dir))).toBe("1.0.0");
     expect(await cacheState(String(dir))).toEqual({ tmp: [], tarballFolders: 1 });
 
+    // A file: tarball is cached under its integrity, so the new contents get a folder of their own.
     await writeFile(join(String(dir), "pkg.tgz"), tarballOfVersion("2.0.0"));
     expect(await installFresh(String(dir))).toBe("2.0.0");
-    expect(await cacheState(String(dir))).toEqual({ tmp: [], tarballFolders: 1 });
+    expect(await cacheState(String(dir))).toEqual({ tmp: [], tarballFolders: 2 });
   });
 
   it("tarball URL", async () => {
diff --git a/test/cli/install/bun-pack.test.ts b/test/cli/install/bun-pack.test.ts
index f177fcecb41d..d20d8c9a2937 100644
--- a/test/cli/install/bun-pack.test.ts
+++ b/test/cli/install/bun-pack.test.ts
@@ -908,7 +908,8 @@ describe.skipIf(isWindows)("a failed pack leaves no tarball behind", () => {
 
     const { err, exitCode } = await packExpectingFailure(dir, { fileSizeLimit: true }, "--filename=link.tgz");
 
-    expect(err).toContain('failed to write tarball: "link.tgz"');
+    expect(err).toContain("failed to write tarball:");
+    expect(err).toContain('link.tgz"');
     expect({ exitCode, linkIsSymlink: (await lstat(join(dir, "link.tgz"))).isSymbolicLink() }).toEqual({
       exitCode: 1,
       linkIsSymlink: true,
diff --git a/test/cli/install/bun-pm.test.ts b/test/cli/install/bun-pm.test.ts
index 93c47af3f493..aa170e2f8ab2 100644
--- a/test/cli/install/bun-pm.test.ts
+++ b/test/cli/install/bun-pm.test.ts
@@ -251,7 +251,7 @@ it("should not list packages missing from node_modules", async () => {
       env,
     });
     expect(await stderr.text()).toBe("");
-    expect(await stdout.text()).toBe(`${package_dir} node_modules (2)
+    expect(await stdout.text()).toBe(`${package_dir} node_modules (2 installed)
 ├── bar@0.0.2
 └── moo@moo
 `);
@@ -1369,16 +1369,16 @@ test("bun pm untrusted and bun pm trust escape control characters in dependency
   expect(exitCode).toBe(0);
 });
 
-// The dependency alias becomes the node_modules folder and the file: target becomes the
-// resolution, so a dependent can put control characters in both. Windows does not allow
-// them in file names, so the packages cannot be installed there in the first place.
+// The file: target becomes the resolution, so a dependent can put control characters in it (an
+// alias containing them is rejected before anything is installed). Windows does not allow them in
+// file names, so the package cannot be installed there in the first place.
 test.skipIf(isWindows)("bun pm untrusted escapes control characters in the package path and resolution", async () => {
   using dir = tempDir("pm-untrusted-control-chars-path", {
     "package.json": JSON.stringify({
       name: "foo",
       version: "1.0.0",
       dependencies: {
-        "nice\x1b[2Kpkg": "file:./real\rpkg",
+        "nice-pkg": "file:./real\rpkg",
       },
     }),
     "real\rpkg/package.json": JSON.stringify({
@@ -1397,7 +1397,7 @@ test.skipIf(isWindows)("bun pm untrusted escapes control characters in the packa
 
   [stdout, stderr, exitCode] = await runInDir(String(dir), "pm", "untrusted");
   expect(stderr).not.toContain("error:");
-  expect(stdout).toContain("./node_modules/nice\\x1b[2Kpkg @real\\rpkg\n » [postinstall]: exit 0\n");
+  expect(stdout).toContain("./node_modules/nice-pkg @real\\rpkg\n » [postinstall]: exit 0\n");
   expect(stdout).not.toContain("\x1b");
   expect(stdout).not.toContain("\r");
   expect(exitCode).toBe(0);
diff --git a/test/cli/install/bun-prune.test.ts b/test/cli/install/bun-prune.test.ts
index 62dc3c9b1fdb..845fa6ffefcc 100644
--- a/test/cli/install/bun-prune.test.ts
+++ b/test/cli/install/bun-prune.test.ts
@@ -703,7 +703,7 @@ test.concurrent("isolated linker: --verbose does not print the store build timin
 
     - no-deps@1.0.1
     - one-dep@1.0.0
-    2 packages removed (checked 5)"
+    2 packages removed (checked 5 installed packages)"
   `);
   expect(stderr).not.toContain("Resolved peers");
   expect(stderr).not.toContain("Created store");
diff --git a/test/cli/install/catalogs.test.ts b/test/cli/install/catalogs.test.ts
index f3373b5734c8..9b35c7449e07 100644
--- a/test/cli/install/catalogs.test.ts
+++ b/test/cli/install/catalogs.test.ts
@@ -286,7 +286,7 @@ describe("basic", () => {
     expect(await installedVersion()).toBe("2.0.0");
     expect(normalizeBunSnapshot(await file(join(packageDir, "bun.lock")).text(), packageDir)).toMatchInlineSnapshot(`
       "{
-        "lockfileVersion": 2,
+        "lockfileVersion": 1,
         "configVersion": 1,
         "workspaces": {
           "": {
diff --git a/test/cli/install/minimum-release-age.test.ts b/test/cli/install/minimum-release-age.test.ts
index 412f48bc621e..0a58564cca13 100644
--- a/test/cli/install/minimum-release-age.test.ts
+++ b/test/cli/install/minimum-release-age.test.ts
@@ -3108,7 +3108,7 @@ describe("minimum-release-age", () => {
       const lockfile = await Bun.file(`${dir}/bun.lock`).text();
       expect(lockfile).toMatchInlineSnapshot(`
         "{
-          "lockfileVersion": 2,
+          "lockfileVersion": 1,
           "configVersion": 1,
           "workspaces": {
             "": {
diff --git a/test/cli/install/nested-overrides.test.ts b/test/cli/install/nested-overrides.test.ts
index b2599476ad3f..7c5048be7dd5 100644
--- a/test/cli/install/nested-overrides.test.ts
+++ b/test/cli/install/nested-overrides.test.ts
@@ -1480,7 +1480,7 @@ describe.concurrent("lockfile", () => {
       expect(await versionSeenBy(dir, undefined, "x")).toBe("1.0.0");
       expect(normalizeBunSnapshot(await lock(dir), dir)).toMatchInlineSnapshot(`
         "{
-          "lockfileVersion": 2,
+          "lockfileVersion": 1,
           "configVersion": 1,
           "workspaces": {
             "": {
@@ -1512,7 +1512,7 @@ describe.concurrent("lockfile", () => {
       expect(err).toContain("Saved lockfile");
       expect(normalizeBunSnapshot(await lock(dir), dir)).toMatchInlineSnapshot(`
         "{
-          "lockfileVersion": 2,
+          "lockfileVersion": 1,
           "configVersion": 1,
           "workspaces": {
             "": {
diff --git a/test/cli/install/overrides.test.ts b/test/cli/install/overrides.test.ts
index 9d02c3b2ebd6..a92e75f53274 100644
--- a/test/cli/install/overrides.test.ts
+++ b/test/cli/install/overrides.test.ts
@@ -246,7 +246,7 @@ test.concurrent("overrides do not apply to workspaces", async () => {
   const lock = await lockfile(dir);
   expect(lock).toMatchInlineSnapshot(`
     "{
-      "lockfileVersion": 2,
+      "lockfileVersion": 1,
       "configVersion": 1,
       "workspaces": {
         "": {

From f37ed31304e5663400a3f70393ede5d091ba9372 Mon Sep 17 00:00:00 2001
From: Jarred Sumner <jarred@jarredsumner.com>
Date: Mon, 17 Aug 2026 04:41:00 +0000
Subject: [PATCH 183/258] mega-merge fixup: a workspace member dropped from the
 glob no longer counts as a direct dependent (#38770 x #38919)

---
 src/install/update_transitive.rs        | 12 ++++++++----
 test/cli/install/bun-workspaces.test.ts |  6 ++++--
 2 files changed, 12 insertions(+), 6 deletions(-)

diff --git a/src/install/update_transitive.rs b/src/install/update_transitive.rs
index 09f992092d67..4275dde972b9 100644
--- a/src/install/update_transitive.rs
+++ b/src/install/update_transitive.rs
@@ -44,12 +44,16 @@ impl DirectDependencies {
         let deps = lockfile.buffers.dependencies.as_slice();
         let resolutions = lockfile.buffers.resolutions.as_slice();
 
+        let name_hashes = lockfile.packages.items_name_hash();
         let mut out = DirectDependencies::default();
         for owner in 0..pkg_res.len() {
-            if !matches!(
-                pkg_res[owner].tag,
-                ResolutionTag::Root | ResolutionTag::Workspace
-            ) {
+            let direct = match pkg_res[owner].tag {
+                ResolutionTag::Root => true,
+                // A member just dropped from `workspaces` keeps its tag until the clean; its rows are gone with it.
+                ResolutionTag::Workspace => lockfile.workspace_paths.contains(&name_hashes[owner]),
+                _ => false,
+            };
+            if !direct {
                 continue;
             }
             let start = out.rows.len();
diff --git a/test/cli/install/bun-workspaces.test.ts b/test/cli/install/bun-workspaces.test.ts
index f3472c2105d5..52d93ec6bc1c 100644
--- a/test/cli/install/bun-workspaces.test.ts
+++ b/test/cli/install/bun-workspaces.test.ts
@@ -2875,14 +2875,16 @@ describe("dependencies on a workspace load from bun.lock the way package.json pa
         write(join(packageDir, "packages", "pkg2", "package.json"), JSON.stringify(pkg2)),
       ]);
 
-      await runBunInstall(env, packageDir);
+      // A peer range the workspace does not satisfy is bound to it anyway, with a warning.
+      const allowWarnings = label.includes("unsatisfied range in peerDependencies");
+      await runBunInstall(env, packageDir, { allowWarnings });
       // parseLockfile loads with this test process's settings (linking on); for the linking-off rows the
       // install below, which reads the fixture's bunfig.toml, is what exercises that setting.
       expect(loadedDependencies(packageDir, "pkg1", declaredAs)).toEqual(loaded);
 
       // nothing changed, so the second install must not report pkg1 as changed
       // ("Workspace package "packages/pkg1" has added 0 dependencies, removed 0 dependencies, and updated 1 dependencies")
-      const { err } = await runBunInstall(env, packageDir, { savesLockfile: false, verbose: true });
+      const { err } = await runBunInstall(env, packageDir, { savesLockfile: false, verbose: true, allowWarnings });
       expect(err).not.toContain('Workspace package "packages/pkg1"');
     });
   }

From 4cd0c85797dcb3afd93c5b940dcfca2ec26d8c2b Mon Sep 17 00:00:00 2001
From: Jarred Sumner <jarred@jarredsumner.com>
Date: Mon, 17 Aug 2026 04:47:18 +0000
Subject: [PATCH 184/258] mega-merge fixup: remaining registry-test
 scaffolding; update-row wording in snapshots

---
 test/cli/install/bun-install-registry.test.ts      | 14 +++++++-------
 test/cli/install/bun-pm.test.ts                    |  2 +-
 .../install/bun-update-security-provider.test.ts   |  2 +-
 3 files changed, 9 insertions(+), 9 deletions(-)

diff --git a/test/cli/install/bun-install-registry.test.ts b/test/cli/install/bun-install-registry.test.ts
index e85819370dde..2f73b289b9f0 100644
--- a/test/cli/install/bun-install-registry.test.ts
+++ b/test/cli/install/bun-install-registry.test.ts
@@ -4,11 +4,13 @@ import { afterAll, beforeAll, describe, expect, setDefaultTimeout, test } from "
 import { copyFileSync, existsSync, mkdirSync, readFileSync } from "fs";
 import { cp, exists, lstat, mkdir, readlink, rename, rm, writeFile } from "fs/promises";
 import {
+  VerdaccioRegistry,
   assertManifestsPopulated,
   bunEnv,
   bunExe,
   isFlaky,
   isLinux,
+  isMacOS,
   isWindows,
   mergeWindowEnvs,
   normalizeBunSnapshot,
@@ -21,7 +23,6 @@ import {
   toBeValidBin,
   toHaveBins,
   toMatchNodeModulesAt,
-  VerdaccioRegistry,
   writeShebangScript,
 } from "harness";
 import { delimiter, join, resolve } from "path";
@@ -6518,14 +6519,12 @@ describe.concurrent("update", () => {
       ]);
       await check(version);
 
+      // Naming the exact pin does not move it either.
       ({ out } = await runBunUpdate(env, packageDir, [dependency]));
       expect(out).toEqual([
         expect.stringContaining("bun update v1."),
         "",
-        `installed ${dependency}@1.0.1`,
-        "",
-        expect.stringContaining("done"),
-        "",
+        "Checked 1 install across 2 packages (no changes)",
       ]);
       await check(version);
 
@@ -10087,8 +10086,8 @@ describe.concurrent("outdated", () => {
   });
 
   test("-F is an alias of --filter", async () => {
-    const { packageDir, packageJson, env } = await setupTest();
-    await setupWorkspace();
+    const { packageDir, env } = await setupTest();
+    await setupWorkspace(packageDir);
     await runBunInstall(env, packageDir);
 
     const long = await runBunOutdated(env, packageDir, "--filter", "pkg1");
@@ -10357,6 +10356,7 @@ describe.concurrent("outdated", () => {
 
   for (const { current, latest } of buildTagCases) {
     test(`colored latest version keeps its build tag (current ${current})`, async () => {
+      const { packageDir, packageJson, env } = await setupTest();
       await write(packageJson, JSON.stringify({ name: "foo", dependencies: { "build-metadata-1": current } }));
       await runBunInstall(env, packageDir);
 
diff --git a/test/cli/install/bun-pm.test.ts b/test/cli/install/bun-pm.test.ts
index aa170e2f8ab2..09fcb54cfb14 100644
--- a/test/cli/install/bun-pm.test.ts
+++ b/test/cli/install/bun-pm.test.ts
@@ -270,7 +270,7 @@ it("should not list packages missing from node_modules", async () => {
       env,
     });
     expect(await stderr.text()).toBe("");
-    expect(await stdout.text()).toBe(`${package_dir} node_modules (1)
+    expect(await stdout.text()).toBe(`${package_dir} node_modules (1 installed)
 └── moo@moo
 `);
     expect(await exited).toBe(0);
diff --git a/test/cli/install/bun-update-security-provider.test.ts b/test/cli/install/bun-update-security-provider.test.ts
index 9885fbe86672..00b3110e46d9 100644
--- a/test/cli/install/bun-update-security-provider.test.ts
+++ b/test/cli/install/bun-update-security-provider.test.ts
@@ -139,7 +139,7 @@ test.concurrent("security scanner does not run on bun update when not configured
     expect(stdout).toMatchInlineSnapshot(`
       "bun update <version> (<revision>)
 
-      installed moo@0.2.0
+      ^ moo 0.1.0 -> 0.2.0
 
       1 package installed"
     `);

From a62c1b29193a2a7bd565f6f7e17bbdc224c4c49a Mon Sep 17 00:00:00 2001
From: Jarred Sumner <jarred@jarredsumner.com>
Date: Mon, 17 Aug 2026 05:00:53 +0000
Subject: [PATCH 185/258] mega-merge fixup: yarn migrator composes
 #38795/#38948/#38985/#39001; expectations for combined behaviour in catalogs,
 pnpm migration and redacted logs

---
 src/install/yarn.rs                           |  19 ++-
 .../bun-install-registry.test.ts.snap         | 150 +++++++++---------
 test/cli/install/catalogs.test.ts             |  17 +-
 .../__snapshots__/migrate.test.ts.snap        |   2 +-
 .../migration/pnpm-lock-migration.test.ts     |   2 +
 .../install/migration/pnpm-lock-v9.test.ts    |   2 -
 .../migration/yarn-lock-migration.test.ts     |  15 +-
 test/cli/install/minimum-release-age.test.ts  |   2 +-
 test/cli/install/redacted-config-logs.test.ts |  16 +-
 9 files changed, 117 insertions(+), 108 deletions(-)

diff --git a/src/install/yarn.rs b/src/install/yarn.rs
index 614ac0729c56..64304d0b83be 100644
--- a/src/install/yarn.rs
+++ b/src/install/yarn.rs
@@ -596,14 +596,17 @@ impl Binder<'_> {
             }
             // Overrides are not consulted: yarn applied them to the entries the candidates come from.
             let range = this.catalogs.resolve_range(string_bytes, dep);
+            let name_hash = lockfile::bun_lock::peer_candidate_name_hash(dep, range, string_bytes);
             return lockfile::bun_lock::resolve_peer_dep_by_range(
                 range,
-                lockfile::bun_lock::peer_candidate_name_hash(dep, range, string_bytes),
+                name_hash,
                 &this.package_index,
                 this.packages.items_resolution(),
                 string_bytes,
                 |_| true,
-            );
+            )
+            // Nothing satisfies it: the highest version there is, as a fresh install's peer pass picks.
+            .or_else(|| this.package_index.get(&name_hash)?.as_slice().first().copied());
         }
         self.spec.clear();
         self.spec.extend_from_slice(dep.name.slice(string_bytes));
@@ -931,11 +934,15 @@ pub(crate) fn migrate_yarn_lockfile<'a>(
                 let result =
                     Semver::Version::parse(version.sliced(this.buffers.string_bytes.as_slice()));
                 if !result.valid {
-                    // Yarn v1 lockfiles legitimately contain entries without an integrity field
-                    // (workspace deps, file:, codeload tarballs), so migration intentionally
-                    // accepts off-registry tarball URLs without integrity instead of failing.
+                    // Not a registry version: an off-registry tarball (codeload and the like)
+                    // is installed from its URL; a registry entry with a version that is not
+                    // semver is skipped below with a warning.
                     if let Some(resolved) = resolved_url
-                        && (Entry::is_remote_tarball(resolved) || resolved.ends_with(b".tgz"))
+                        && Entry::is_remote_tarball(resolved)
+                        && Entry::get_package_name_from_default_registry_url(resolved).is_none()
+                        && !resolved.starts_with(strings::without_trailing_slash(
+                            manager.options.scope.url.href(),
+                        ))
                     {
                         break 'blk Resolution::init(ResolutionValue::RemoteTarball(
                             sbuf!().append(resolved)?,
diff --git a/test/cli/install/__snapshots__/bun-install-registry.test.ts.snap b/test/cli/install/__snapshots__/bun-install-registry.test.ts.snap
index 01f7f3b87d18..4d5de7a36a1f 100644
--- a/test/cli/install/__snapshots__/bun-install-registry.test.ts.snap
+++ b/test/cli/install/__snapshots__/bun-install-registry.test.ts.snap
@@ -110,6 +110,35 @@ exports[`text lockfile --frozen-lockfile 1`] = `
 "
 `;
 
+exports[`it should ignore peerDependencies within workspaces 1`] = `
+"{
+  "lockfileVersion": 1,
+  "configVersion": 1,
+  "workspaces": {
+    "": {
+      "name": "foo",
+      "peerDependencies": {
+        "no-deps": ">=1.0.0",
+      },
+    },
+    "packages/baz": {
+      "name": "Baz",
+      "peerDependencies": {
+        "a-dep": ">=1.0.1",
+      },
+    },
+  },
+  "packages": {
+    "Baz": ["Baz@workspace:packages/baz"],
+
+    "a-dep": ["a-dep@1.0.10", "http://localhost:1234/a-dep/-/a-dep-1.0.10.tgz", {}, "sha512-NeQ6Ql9jRW8V+VOiVb+PSQAYOvVoSimW+tXaR0CoJk4kM9RIk/XlAUGCsNtn5XqjlDO4hcH8NcyaL507InevEg=="],
+
+    "no-deps": ["no-deps@2.0.0", "http://localhost:1234/no-deps/-/no-deps-2.0.0.tgz", {}, "sha512-W3duJKZPcMIG5rA1io5cSK/bhW9rWFz+jFxZsKS/3suK4qHDkQNxUTEXee9/hTaAoDCeHWQqogukWYKzfr6X4g=="],
+  }
+}
+"
+`;
+
 exports[`binaries each type of binary serializes correctly to text lockfile 1`] = `
 "{
   "lockfileVersion": 1,
@@ -189,6 +218,52 @@ exports[`hoisting text lockfile is hoisted 1`] = `
 "
 `;
 
+exports[`duplicate dependency in optionalDependencies maintains sort order 1`] = `
+"# THIS IS AN AUTOGENERATED FILE. DO NOT EDIT THIS FILE DIRECTLY.
+# yarn lockfile v1
+# bun ./bun.lockb --hash: A1A17280329F8383-20d6659d9c0623de-94508CB3B7915517-4b22a59b37f2f4f6
+
+
+"@types/is-number@>=1.0.0":
+  version "2.0.0"
+  resolved "http://localhost:1234/@types/is-number/-/is-number-2.0.0.tgz"
+  integrity sha512-GEeIxCB+NpM1NrDBqmkYPeU8bI//i+xPzdOY4E1YHet51IcFmz4js6k57m69fLl/cbn7sOR7wj9RNNw53X8AiA==
+
+a-dep@1.0.1:
+  version "1.0.1"
+  resolved "http://localhost:1234/a-dep/-/a-dep-1.0.1.tgz"
+  integrity sha512-6nmTaPgO2U/uOODqOhbjbnaB4xHuZ+UB7AjKUA3g2dT4WRWeNxgp0dC8Db4swXSnO5/uLLUdFmUJKINNBO/3wg==
+
+duplicate-optional@1.0.1:
+  version "1.0.1"
+  resolved "http://localhost:1234/duplicate-optional/-/duplicate-optional-1.0.1.tgz"
+  integrity sha512-tL28+yJiTPehPLq7QnOu9jbRBpRgfBkyTVveaJojKcyae2khKuLaPRvsiX5gXv+iNGpYiYcNnV1eDBLXS+L85A==
+  dependencies:
+    a-dep "1.0.1"
+    what-bin "1.0.0"
+  optionalDependencies:
+    no-deps "1.0.1"
+
+no-deps@1.0.1, no-deps@^1.0.0:
+  version "1.0.1"
+  resolved "http://localhost:1234/no-deps/-/no-deps-1.0.1.tgz"
+  integrity sha512-3X6cn4+UJdXJuLPu11v8i/fGLe2PdI6v1yKTELam04lY5esCAFdG/qQts6N6rLrL6g1YRq+MKBAwxbmUQk355A==
+
+two-range-deps@1.0.0:
+  version "1.0.0"
+  resolved "http://localhost:1234/two-range-deps/-/two-range-deps-1.0.0.tgz"
+  integrity sha512-N+6kPy/GxuMncNz/EKuIrwdoYbh1qmvHDnw1UbM3sQE184kBn+6qAQgtf1wgT9dJnt6X+tWcTzSmfDvtJikVBA==
+  dependencies:
+    no-deps "^1.0.0"
+    "@types/is-number" ">=1.0.0"
+
+what-bin@1.0.0:
+  version "1.0.0"
+  resolved "http://localhost:1234/what-bin/-/what-bin-1.0.0.tgz"
+  integrity sha512-sa99On1k5aDqCvpni/TQ6rLzYprUWBlb8fNwWOzbjDlM24fRr7FKDOuaBO/Y9WEIcZuzoPkCW5EkBCpflj8REQ==
+"
+`;
+
 exports[`outdated normal dep, smaller than column title 1`] = `
 "┌──────────┬─────────┬────────┬────────┐
 │ \x1B[1m\x1B[34mPackage\x1B[0m  │ \x1B[1m\x1B[34mCurrent\x1B[0m │ \x1B[1m\x1B[34mUpdate\x1B[0m │ \x1B[1m\x1B[34mLatest\x1B[0m │
@@ -269,78 +344,3 @@ exports[`outdated NO_COLOR works 1`] = `
 |--------------------------------------|
 "
 `;
-
-exports[`it should ignore peerDependencies within workspaces 1`] = `
-"{
-  "lockfileVersion": 1,
-  "configVersion": 1,
-  "workspaces": {
-    "": {
-      "name": "foo",
-      "peerDependencies": {
-        "no-deps": ">=1.0.0",
-      },
-    },
-    "packages/baz": {
-      "name": "Baz",
-      "peerDependencies": {
-        "a-dep": ">=1.0.1",
-      },
-    },
-  },
-  "packages": {
-    "Baz": ["Baz@workspace:packages/baz"],
-
-    "a-dep": ["a-dep@1.0.10", "http://localhost:1234/a-dep/-/a-dep-1.0.10.tgz", {}, "sha512-NeQ6Ql9jRW8V+VOiVb+PSQAYOvVoSimW+tXaR0CoJk4kM9RIk/XlAUGCsNtn5XqjlDO4hcH8NcyaL507InevEg=="],
-
-    "no-deps": ["no-deps@2.0.0", "http://localhost:1234/no-deps/-/no-deps-2.0.0.tgz", {}, "sha512-W3duJKZPcMIG5rA1io5cSK/bhW9rWFz+jFxZsKS/3suK4qHDkQNxUTEXee9/hTaAoDCeHWQqogukWYKzfr6X4g=="],
-  }
-}
-"
-`;
-
-exports[`duplicate dependency in optionalDependencies maintains sort order 1`] = `
-"# THIS IS AN AUTOGENERATED FILE. DO NOT EDIT THIS FILE DIRECTLY.
-# yarn lockfile v1
-# bun ./bun.lockb --hash: A1A17280329F8383-20d6659d9c0623de-94508CB3B7915517-4b22a59b37f2f4f6
-
-
-"@types/is-number@>=1.0.0":
-  version "2.0.0"
-  resolved "http://localhost:1234/@types/is-number/-/is-number-2.0.0.tgz"
-  integrity sha512-GEeIxCB+NpM1NrDBqmkYPeU8bI//i+xPzdOY4E1YHet51IcFmz4js6k57m69fLl/cbn7sOR7wj9RNNw53X8AiA==
-
-a-dep@1.0.1:
-  version "1.0.1"
-  resolved "http://localhost:1234/a-dep/-/a-dep-1.0.1.tgz"
-  integrity sha512-6nmTaPgO2U/uOODqOhbjbnaB4xHuZ+UB7AjKUA3g2dT4WRWeNxgp0dC8Db4swXSnO5/uLLUdFmUJKINNBO/3wg==
-
-duplicate-optional@1.0.1:
-  version "1.0.1"
-  resolved "http://localhost:1234/duplicate-optional/-/duplicate-optional-1.0.1.tgz"
-  integrity sha512-tL28+yJiTPehPLq7QnOu9jbRBpRgfBkyTVveaJojKcyae2khKuLaPRvsiX5gXv+iNGpYiYcNnV1eDBLXS+L85A==
-  dependencies:
-    a-dep "1.0.1"
-    what-bin "1.0.0"
-  optionalDependencies:
-    no-deps "1.0.1"
-
-no-deps@1.0.1, no-deps@^1.0.0:
-  version "1.0.1"
-  resolved "http://localhost:1234/no-deps/-/no-deps-1.0.1.tgz"
-  integrity sha512-3X6cn4+UJdXJuLPu11v8i/fGLe2PdI6v1yKTELam04lY5esCAFdG/qQts6N6rLrL6g1YRq+MKBAwxbmUQk355A==
-
-two-range-deps@1.0.0:
-  version "1.0.0"
-  resolved "http://localhost:1234/two-range-deps/-/two-range-deps-1.0.0.tgz"
-  integrity sha512-N+6kPy/GxuMncNz/EKuIrwdoYbh1qmvHDnw1UbM3sQE184kBn+6qAQgtf1wgT9dJnt6X+tWcTzSmfDvtJikVBA==
-  dependencies:
-    no-deps "^1.0.0"
-    "@types/is-number" ">=1.0.0"
-
-what-bin@1.0.0:
-  version "1.0.0"
-  resolved "http://localhost:1234/what-bin/-/what-bin-1.0.0.tgz"
-  integrity sha512-sa99On1k5aDqCvpni/TQ6rLzYprUWBlb8fNwWOzbjDlM24fRr7FKDOuaBO/Y9WEIcZuzoPkCW5EkBCpflj8REQ==
-"
-`;
diff --git a/test/cli/install/catalogs.test.ts b/test/cli/install/catalogs.test.ts
index 9b35c7449e07..f0a3181266a3 100644
--- a/test/cli/install/catalogs.test.ts
+++ b/test/cli/install/catalogs.test.ts
@@ -1531,9 +1531,10 @@ describe("peer dependencies", () => {
   });
 
   // When the catalog changes, every row declared through it is re-resolved. The root's rows from bun.lock have
-  // been replaced by then and belong to no package; re-resolving them too bound the peer a second time and
-  // repeated its warning.
-  describe("a root peer whose catalog range stops matching the installed version is checked once", () => {
+  // been replaced by then and belong to no package; re-resolving them too bound the peer a second time (once to
+  // the stale copy, with an "incorrect peer dependency" warning). The peer moves to a version its new range
+  // accepts, once, without a warning.
+  describe("a root peer whose catalog range stops matching the installed version is re-resolved once", () => {
     const peerWarning = 'warn: incorrect peer dependency "no-deps@1.0.0"';
     const peerWarnings = (err: string) => err.split(peerWarning).length - 1;
 
@@ -1554,11 +1555,13 @@ describe("peer dependencies", () => {
       return packageDir;
     }
 
+    /** The version the peer moved to; no warning may be printed on the way. */
     async function reinstall(dir: string, packageJson: string) {
       await Bun.write(join(dir, "package.json"), packageJson);
       const { err } = await install(dir, "hoisted");
       expect(err).toContain("Saved lockfile");
-      return peerWarnings(err);
+      expect(peerWarnings(err)).toBe(0);
+      return (await Bun.file(join(dir, "node_modules", "no-deps", "package.json")).json()).version;
     }
 
     // The inline row is the baseline: it changes itself and is only re-enqueued by the add/update pass.
@@ -1570,14 +1573,14 @@ describe("peer dependencies", () => {
       ["inline", (range: string) => rootWithPeer(range)],
     ])("declared %s", async (_, packageJson) => {
       const dir = await installedAlone(packageJson("1.0.0"));
-      expect(await reinstall(dir, packageJson("^1.0.1"))).toBe(1);
+      expect(await reinstall(dir, packageJson("^1.0.1"))).toBe("1.1.0");
     });
 
     test.concurrent("overridden to catalog:", async () => {
       const packageJson = (range: string) =>
         rootWithPeer("1.0.0", { overrides: { "no-deps": "catalog:" }, workspaces: { catalog: { "no-deps": range } } });
       const dir = await installedAlone(packageJson("1.0.0"));
-      expect(await reinstall(dir, packageJson("^1.0.1"))).toBe(1);
+      expect(await reinstall(dir, packageJson("^1.0.1"))).toBe("1.1.0");
     });
 
     // Selected both as an overridden name and as a catalog: row; one pass handles both.
@@ -1585,7 +1588,7 @@ describe("peer dependencies", () => {
       const packageJson = (range: string) =>
         rootWithPeer("catalog:", { overrides: { "no-deps": range }, workspaces: { catalog: { "no-deps": range } } });
       const dir = await installedAlone(packageJson("1.0.0"));
-      expect(await reinstall(dir, packageJson("^1.0.1"))).toBe(1);
+      expect(await reinstall(dir, packageJson("^1.0.1"))).toBe("1.1.0");
     });
   });
 
diff --git a/test/cli/install/migration/__snapshots__/migrate.test.ts.snap b/test/cli/install/migration/__snapshots__/migrate.test.ts.snap
index 480bd63020ba..7b267bd51d49 100644
--- a/test/cli/install/migration/__snapshots__/migrate.test.ts.snap
+++ b/test/cli/install/migration/__snapshots__/migrate.test.ts.snap
@@ -4666,7 +4666,7 @@ bun pm migrate exit code: 0
 bun install --frozen-lockfile exit code: 0
 
 {
-  "lockfileVersion": 2,
+  "lockfileVersion": 1,
   "configVersion": 1,
   "workspaces": {
     "": {
diff --git a/test/cli/install/migration/pnpm-lock-migration.test.ts b/test/cli/install/migration/pnpm-lock-migration.test.ts
index 6074bff549c8..cd319c541d76 100644
--- a/test/cli/install/migration/pnpm-lock-migration.test.ts
+++ b/test/cli/install/migration/pnpm-lock-migration.test.ts
@@ -467,6 +467,7 @@ overrides:
   };
   const catalogFixtureMoved =
     "copied pnpm.overrides to overrides, pnpm-workspace.yaml to workspaces, pnpm-workspace.yaml overrides to overrides in package.json";
+  // The `pnpm` block stays: pnpm itself keeps reading it.
   const catalogFixtureImported = {
     ...rootPackageJson,
     workspaces: {
@@ -475,6 +476,7 @@ overrides:
       catalogs: { build: { "@scope/quoted": "~2.0.0" } },
     },
     overrides: { "from-package-json": "1.0.0", "@scope/quoted": "2.0.1", plain: "3.0.0" },
+    pnpm: { overrides: { "from-package-json": "1.0.0" } },
   };
 
   test("by bun install when there is no lockfile at all", async () => {
diff --git a/test/cli/install/migration/pnpm-lock-v9.test.ts b/test/cli/install/migration/pnpm-lock-v9.test.ts
index 6f7064dee5ae..0b807f587998 100644
--- a/test/cli/install/migration/pnpm-lock-v9.test.ts
+++ b/test/cli/install/migration/pnpm-lock-v9.test.ts
@@ -110,8 +110,6 @@ const ONE_OPTIONAL_PEER_DEP_1_0_2_INTEGRITY =
   "sha512-S25U8/QXGIKfn/AWtsce1aVMnDjDL+ykFtAufpsuKGad32NlsCpi9TDuXvzoTQ+MdaZpGV3c4xghUZUsNeMp4A==";
 const STRICT_PEER_DEP_1_0_0_INTEGRITY =
   "sha512-bz2RC/Fp4Nvc9aIiHB6Szko9m6sxNy/clIHnTAGeD9VSpQJTvlPAJqJ09lWo7N3q4JNLEqDTf3Mn+zNUsYOKWQ==";
-const NO_DEPS_1_1_0_INTEGRITY =
-  "sha512-ebG2pipYAKINcNI3YxdsiAgFvNGp2gdRwxAKN2LYBm9+YxuH/lHH2sl+GKQTuGiNfCfNZRMHUyyLPEJD6HWm7w==";
 const NORMAL_DEP_AND_DEV_DEP_1_0_1_INTEGRITY =
   "sha512-MzZS9lLNBdqXf/lI+TKlXGeWrcDkOjzdSPJtvkRUN1FUjXg2DcGVldEqx9D8kNwF87Hxf2cRLvLv4a8GqZ6zPg==";
 const LOCAL_TARBALL_INTEGRITY =
diff --git a/test/cli/install/migration/yarn-lock-migration.test.ts b/test/cli/install/migration/yarn-lock-migration.test.ts
index 2337497f69a0..bf7761b050ee 100644
--- a/test/cli/install/migration/yarn-lock-migration.test.ts
+++ b/test/cli/install/migration/yarn-lock-migration.test.ts
@@ -2598,16 +2598,16 @@ tagged@next:
     });
   });
 
-  test("bun pm migrate does not turn link:, path, tarball URL or alias entries into registry packages", async () => {
+  test("bun pm migrate does not turn link:, path or tarball URL entries into registry packages", async () => {
     using registry = localRegistry();
     const keptIntegrity = "sha512-" + Buffer.alloc(64, 5).toString("base64");
     const aliasIntegrity = "sha512-" + Buffer.alloc(64, 6).toString("base64");
 
     // The `bare` and `linked` entries are what yarn 1.22 writes for a path and a `link:`
     // dependency: a `version` line (the target's, or 0.0.0) and no `resolved`. Nothing in these
-    // entries is a registry package, and which package `lodash-alias` is only follows from its
-    // tarball URL, so none of them may be migrated as `<name>@<version>` from the registry.
-    // (They are still not migrated at all; `kept` shows the registry entries next to them are.)
+    // entries is a registry package, so none of them may be migrated as `<name>@<version>` from the
+    // registry. (They are still not migrated at all; `kept` shows the registry entries next to them
+    // are, and so is `lodash-alias`, whose real name is in its `npm:` spec.)
     await using dir = tempDir("yarn-migration-no-resolved-non-registry", {
       "package.json": JSON.stringify({
         name: "no-resolved-non-registry",
@@ -2650,6 +2650,7 @@ lodash-alias@npm:lodash@4.17.21:
 
     expect(await lockPackages(String(dir))).toStrictEqual({
       kept: ["kept@1.0.0", "", {}, keptIntegrity],
+      "lodash-alias": ["lodash@4.17.21", "", {}, aliasIntegrity],
     });
   });
 
@@ -2788,12 +2789,6 @@ describe.concurrent("yarn.lock entries the migration cannot build a resolution f
       `broken@^1.0.0:\n  resolved "${registryTarball("broken", "1.0.0")}"\n`,
       'skipped "broken@^1.0.0" from yarn.lock: missing "version" field',
     ],
-    [
-      "npm: alias without a resolved field",
-      "npm:actual@^1.0.0",
-      '"broken@npm:actual@^1.0.0":\n  version "1.0.0"\n',
-      'skipped "broken@npm:actual@^1.0.0" from yarn.lock: missing "resolved" field',
-    ],
     [
       "tarball URL spec without a resolved field",
       "https://example.com/broken-1.0.0.tgz",
diff --git a/test/cli/install/minimum-release-age.test.ts b/test/cli/install/minimum-release-age.test.ts
index 0a58564cca13..3cbb1f6c42bd 100644
--- a/test/cli/install/minimum-release-age.test.ts
+++ b/test/cli/install/minimum-release-age.test.ts
@@ -2342,7 +2342,7 @@ describe("minimum-release-age", () => {
         { ...bunEnv, BUN_MANIFEST_CACHE: "1" },
       );
       expect(second.stderr).toMatchInlineSnapshot(`
-        "error: Version "nightly-package@1.0.0-nightly.20240102" was published within minimum release age of 432000 seconds
+        "error: No version matching "1.0.0-nightly.20240102" found for specifier "nightly-package" (blocked by minimum-release-age: 432000 seconds)
         error: nightly-package@1.0.0-nightly.20240102 failed to resolve
         "
       `);
diff --git a/test/cli/install/redacted-config-logs.test.ts b/test/cli/install/redacted-config-logs.test.ts
index f3ac8292a800..7a20a68dd644 100644
--- a/test/cli/install/redacted-config-logs.test.ts
+++ b/test/cli/install/redacted-config-logs.test.ts
@@ -177,14 +177,14 @@ describe.concurrent("bun install masks the configured registry URL in the messag
       title: "manifest URL outside the registry directory (dependency)",
       registry: `http://127.0.0.1:1/${token}/`,
       files: { "package.json": packageJson({ dependencies: { innocent: "npm:..@1.0.0" } }) },
-      expected: `error: Invalid package name "..": manifest URL "http://127.0.0.1:1/" is not on registry "http://127.0.0.1:1/***/"\n`,
+      expected: `error: Invalid dependency name ".."\n`,
       exitCode: 1,
     },
     {
       title: "manifest URL outside the registry directory (optional dependency)",
       registry: `http://127.0.0.1:1/${token}/`,
       files: { "package.json": packageJson({ optionalDependencies: { innocent: "npm:..@1.0.0" } }) },
-      expected: `warn: Invalid package name "..": manifest URL "http://127.0.0.1:1/" is not on registry "http://127.0.0.1:1/***/"\n`,
+      expected: `warn: Invalid dependency name ".."\n`,
       exitCode: 0,
     },
     {
@@ -404,6 +404,8 @@ describe.concurrent("bun install masks secrets in the registry-supplied URL it p
   }
 
   const masked = (server: Registry) => `http://carol:******@${server.hostname}:${server.port}`;
+  // A tarball request sends the URL's userinfo as an Authorization header, so its URL is echoed without it.
+  const tarballHost = (server: Registry) => `http://${server.hostname}:${server.port}`;
 
   test("manifest request redirected to a URL with secrets (required dependency)", async () => {
     await using server = startRegistry();
@@ -428,7 +430,7 @@ describe.concurrent("bun install masks secrets in the registry-supplied URL it p
     const { err, exitCode } = await install(server, [], {
       "package.json": JSON.stringify({ name: "app", dependencies: { "tarball-pkg": "1.0.0" } }),
     });
-    expect(err).toContain(`error: GET ${masked(server)}/cdn/tarball-pkg-1.0.0.tgz?token=*** - 404`);
+    expect(err).toContain(`error: GET ${tarballHost(server)}/cdn/tarball-pkg-1.0.0.tgz?token=*** - 404`);
     expect(exitCode).toBe(1);
   });
 
@@ -437,7 +439,7 @@ describe.concurrent("bun install masks secrets in the registry-supplied URL it p
     const { err, exitCode } = await install(server, [], {
       "package.json": JSON.stringify({ name: "app", optionalDependencies: { "tarball-pkg": "1.0.0" } }),
     });
-    expect(err).toContain(`warn: GET ${masked(server)}/cdn/tarball-pkg-1.0.0.tgz?token=*** - 404`);
+    expect(err).toContain(`warn: GET ${tarballHost(server)}/cdn/tarball-pkg-1.0.0.tgz?token=*** - 404`);
     expect(exitCode).toBe(0);
   });
 
@@ -455,7 +457,7 @@ describe.concurrent("bun install masks secrets in the registry-supplied URL it p
       }),
     });
     expect(err).toContain(
-      `error: failed to download tarball-pkg@1.0.0: 404 Not Found\n  ${masked(server)}/cdn/tarball-pkg-1.0.0.tgz?token=***`,
+      `error: failed to download tarball-pkg@1.0.0: 404 Not Found\n  ${tarballHost(server)}/cdn/tarball-pkg-1.0.0.tgz?token=***`,
     );
     expect(exitCode).toBe(1);
   });
@@ -621,6 +623,8 @@ describe.concurrent("tarball and git URLs declared in package.json are masked wh
       "package.json": packageJson(spec(server)),
       "bun.lock": bunLock(spec(server)),
     });
+    // `bun pm ls` lists what is installed.
+    expect((await run(String(dir), server, ["install", "--frozen-lockfile"])).exitCode).toBe(0);
 
     const ls = await run(String(dir), server, ["pm", "ls"]);
     expect(ls.out).toContain(`└── direct@${url}\n`);
@@ -649,7 +653,7 @@ describe.concurrent("tarball and git URLs declared in package.json are masked wh
       }),
     });
 
-    const { out, err, exitCode } = await run(String(dir), server, ["pm", "ls"]);
+    const { out, err, exitCode } = await run(String(dir), server, ["why", "*"]);
     expect(out).toContain(`direct@${masked(server)}\n`);
     expect(out).toContain(`stamped@${stamped}\n`);
     expectNoSecrets(out, err);

From 6270cbe362b197435890f52ffee78ed2bde2eea7 Mon Sep 17 00:00:00 2001
From: Jarred Sumner <jarred@jarredsumner.com>
Date: Mon, 17 Aug 2026 05:03:36 +0000
Subject: [PATCH 186/258] mega-merge fixup: pnpm block is kept in package.json
 (#38775) in the #38804/#38780 tests

---
 test/cli/install/migration/pnpm-lock-v9.test.ts | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

diff --git a/test/cli/install/migration/pnpm-lock-v9.test.ts b/test/cli/install/migration/pnpm-lock-v9.test.ts
index 0b807f587998..1561685e47b2 100644
--- a/test/cli/install/migration/pnpm-lock-v9.test.ts
+++ b/test/cli/install/migration/pnpm-lock-v9.test.ts
@@ -3439,7 +3439,7 @@ importers:
 
       expect(stderr).not.toContain("warn:");
       expect(stderr).toContain(
-        "copied pnpm.overrides to overrides, pnpm.patchedDependencies to patchedDependencies in package.json",
+        "copied pnpm.overrides to overrides, pnpm.patchedDependencies to patchedDependencies, pnpm.onlyBuiltDependencies to trustedDependencies in package.json",
       );
       expect(exitCode).toBe(0);
       expect(await Bun.file(join(String(dir), "package.json")).json()).toStrictEqual({
@@ -3448,6 +3448,7 @@ importers:
         pnpm,
         overrides: pnpm.overrides,
         patchedDependencies: pnpm.patchedDependencies,
+        trustedDependencies: pnpm.onlyBuiltDependencies,
       });
 
       const onlyMigrated = await migrate(String(onlyMigratedKeys));
@@ -3648,6 +3649,7 @@ catalog:
       name: "root",
       private: true,
       dependencies: { a: "workspace:*", foo: "file:vendor/foo" },
+      pnpm: { overrides: { "left-pad": "1.3.0" } },
       overrides: { "left-pad": "1.3.0" },
       workspaces: ["packages/*"],
     };
@@ -3815,7 +3817,7 @@ snapshots:
         overrides: migratedPackageJson.overrides,
         workspaces: migratedPackageJson.workspaces,
       });
-      expect(written).not.toHaveProperty("pnpm");
+      expect(written.pnpm).toStrictEqual(migratedPackageJson.pnpm);
       expect(Object.keys(written.dependencies).sort()).toStrictEqual(["a", "bar", "foo"]);
       expect(await bunLockOf(String(dir))).toContain(`"bar":`);
       expect(exitCode).toBe(0);

From 3d4477f922fd936cca5437977b8f1e5ba892a6b6 Mon Sep 17 00:00:00 2001
From: Jarred Sumner <jarred@jarredsumner.com>
Date: Mon, 17 Aug 2026 05:20:26 +0000
Subject: [PATCH 187/258] mega-merge fixup: long-bin tests use per-test dirs
 under describe.concurrent

---
 test/cli/install/bun-install-registry.test.ts | 104 ++++++++++--------
 1 file changed, 59 insertions(+), 45 deletions(-)

diff --git a/test/cli/install/bun-install-registry.test.ts b/test/cli/install/bun-install-registry.test.ts
index 2f73b289b9f0..42f1674ab854 100644
--- a/test/cli/install/bun-install-registry.test.ts
+++ b/test/cli/install/bun-install-registry.test.ts
@@ -3566,23 +3566,48 @@ describe.concurrent("binaries", () => {
     // Also longer than the buffer as written, but normalizes to a short path.
     const longNormalizingValue = Buffer.alloc(20_000 * "x/../".length, "x/../").toString() + "normalizing-bin.js";
     const script = (name: string) => `#!/usr/bin/env node\nconsole.log("${name}")`;
-    const binDir = () => join(packageDir, "node_modules", ".bin");
     const binEntries = (...names: string[]) =>
       names.flatMap(name => (isWindows ? [`${name}.bunx`, `${name}.exe`] : [name])).sort();
 
-    async function run(args: string[], { cwd = packageDir, env: runEnv = env } = {}) {
-      await using proc = spawn({
-        cmd: [bunExe(), ...args],
-        cwd,
-        stdout: "pipe",
-        stderr: "pipe",
-        env: runEnv,
-      });
-      const [out, err, exitCode] = await Promise.all([proc.stdout.text(), proc.stderr.text(), proc.exited]);
-      return { out, err, exitCode };
+    async function setupLongBinTest() {
+      const { packageDir, env } = await setupTest();
+      async function run(args: string[], { cwd = packageDir, env: runEnv = env } = {}) {
+        await using proc = spawn({
+          cmd: [bunExe(), ...args],
+          cwd,
+          stdout: "pipe",
+          stderr: "pipe",
+          env: runEnv,
+        });
+        const [out, err, exitCode] = await Promise.all([proc.stdout.text(), proc.stderr.text(), proc.exited]);
+        return { out, err, exitCode };
+      }
+      // Creates `<pkgDir>/bins/<chain>/` holding `entries`. The absolute paths can be
+      // too long for the OS to create directly, so descend one component at a time.
+      async function createBinChain(pkgDir: string, chain: string[], entries: Record<string, string>) {
+        const { err, exitCode } = await run(
+          [
+            "-e",
+            `const fs = require("fs");
+           for (const component of process.argv.slice(1)) { fs.mkdirSync(component); process.chdir(component); }
+           for (const [name, contents] of Object.entries(${JSON.stringify(entries)})) fs.writeFileSync(name, contents);`,
+            "bins",
+            ...chain,
+          ],
+          { cwd: pkgDir },
+        );
+        expect(err).toBe("");
+        expect(exitCode).toBe(0);
+      }
+      return {
+        packageDir,
+        env,
+        binDir: join(packageDir, "node_modules", ".bin"),
+        run,
+        install: (linker: "hoisted" | "isolated", cwd = packageDir) => run(["install", `--linker=${linker}`], { cwd }),
+        createBinChain,
+      };
     }
-    const install = (linker: "hoisted" | "isolated", cwd = packageDir) =>
-      run(["install", `--linker=${linker}`], { cwd });
 
     // For the tests below that need paths close to the limit (POSIX only: the
     // Windows buffer is far larger than any path the filesystem accepts).
@@ -3599,30 +3624,14 @@ describe.concurrent("binaries", () => {
       }
       return components;
     };
-    // Creates `<pkgDir>/bins/<chain>/` holding `entries`. The absolute paths can be
-    // too long for the OS to create directly, so descend one component at a time.
-    async function createBinChain(pkgDir: string, chain: string[], entries: Record<string, string>) {
-      const { err, exitCode } = await run(
-        [
-          "-e",
-          `const fs = require("fs");
-           for (const component of process.argv.slice(1)) { fs.mkdirSync(component); process.chdir(component); }
-           for (const [name, contents] of Object.entries(${JSON.stringify(entries)})) fs.writeFileSync(name, contents);`,
-          "bins",
-          ...chain,
-        ],
-        { cwd: pkgDir },
-      );
-      expect(err).toBe("");
-      expect(exitCode).toBe(0);
-    }
     // Shortens the paths again so that ordinary tools can delete the directory.
     const shortenBinChain = (pkgDir: string, chain: string[]) =>
       rename(join(pkgDir, "bins", chain[0]), join(pkgDir, "bins", "d"));
 
     for (const linker of ["hoisted", "isolated"] as const) {
       test(`file targets are skipped like missing bins (${linker})`, async () => {
-        const { packageDir, packageJson, env } = await setupTest();
+        const { packageDir, binDir, install } = await setupLongBinTest();
+        const packageJson = join(packageDir, "package.json");
         // A target this long cannot exist, and the linker silently skips a bin
         // whose target does not exist, so these install without output and the
         // other bins are still linked. Covers the string, single-entry and
@@ -3669,10 +3678,10 @@ describe.concurrent("binaries", () => {
         ]);
 
         const expectBins = async () => {
-          expect(await readdirSorted(binDir())).toEqual(binEntries("long-map-bin-2", "normalizing-bin"));
+          expect(await readdirSorted(binDir)).toEqual(binEntries("long-map-bin-2", "normalizing-bin"));
           if (linker === "hoisted") {
-            expect(join(binDir(), "long-map-bin-2")).toBeValidBin(join("..", "long-map-bin", "long-map-bin-2.js"));
-            expect(join(binDir(), "normalizing-bin")).toBeValidBin(join("..", "normalizing-bin", "normalizing-bin.js"));
+            expect(join(binDir, "long-map-bin-2")).toBeValidBin(join("..", "long-map-bin", "long-map-bin-2.js"));
+            expect(join(binDir, "normalizing-bin")).toBeValidBin(join("..", "normalizing-bin", "normalizing-bin.js"));
           }
         };
 
@@ -3687,7 +3696,7 @@ describe.concurrent("binaries", () => {
         await expectBins();
 
         // The lockfile stores the values as written, so linking from it hits the same paths.
-        await rm(binDir(), { recursive: true, force: true });
+        await rm(binDir, { recursive: true, force: true });
         ({ err, exitCode } = await install(linker));
         expect(err).not.toContain("error:");
         expect(exitCode).toBe(0);
@@ -3695,7 +3704,8 @@ describe.concurrent("binaries", () => {
       });
 
       test(`directories.bin fails with ENAMETOOLONG (${linker})`, async () => {
-        const { packageDir, packageJson, env } = await setupTest();
+        const { packageDir, binDir, install } = await setupLongBinTest();
+        const packageJson = join(packageDir, "package.json");
         // The linker reports every failure to open a bin directory other than
         // ENOENT, and ENAMETOOLONG is what the OS reports for a directory path it
         // cannot address, so a value that does not fit gets the same error.
@@ -3733,7 +3743,7 @@ describe.concurrent("binaries", () => {
         expect(await exists(join(packageDir, "node_modules", "ok-bin", "package.json"))).toBeTrue();
         if (linker === "hoisted") {
           expect(await exists(join(packageDir, "node_modules", "long-dir-bin", "package.json"))).toBeTrue();
-          expect(await readdirSorted(binDir())).toEqual(binEntries("ok-bin"));
+          expect(await readdirSorted(binDir)).toEqual(binEntries("ok-bin"));
         }
       });
     }
@@ -3741,7 +3751,7 @@ describe.concurrent("binaries", () => {
     // The entries of a bin directory are joined onto the directory's path as
     // well, and so is the temporary file used to rewrite a CRLF shebang.
     test.skipIf(isWindows)("entries of a directories.bin close to the path limit", async () => {
-      const { packageDir, packageJson, env } = await setupTest();
+      const { packageDir, install, createBinChain } = await setupLongBinTest();
       // Most of the depth goes into the project directory: the `.bin` links are
       // relative, so everything below the package ends up in the link targets,
       // and XFS rejects link targets of 1 KiB or more. The bin directory is then
@@ -3787,7 +3797,7 @@ describe.concurrent("binaries", () => {
     // on another branch of the tree contributes one `..` per component, so the
     // link target can be longer than the target's absolute path.
     test.skipIf(isWindows)("bun link with a link target longer than the path buffer", async () => {
-      const { packageDir, packageJson, env } = await setupTest();
+      const { packageDir, env, run, createBinChain } = await setupLongBinTest();
       // As in the previous test, most of the depth has to sit above everything
       // that ends up in a link target that is meant to be created (XFS), so it
       // goes into the global directory itself.
@@ -3848,7 +3858,7 @@ describe.concurrent("binaries", () => {
     });
 
     test("bun link and bun unlink", async () => {
-      const { packageDir, packageJson, env } = await setupTest();
+      const { packageDir, env, run } = await setupLongBinTest();
       // `bun link` links a package's bins into the global bin directory with the
       // same linker, and `bun unlink` is the only caller of its unlink side, which
       // has to open the same bin directory.
@@ -5567,7 +5577,9 @@ describe.concurrent("hoisting", async () => {
       }),
     );
 
-    expect(await sharedResolutions({ packageDir, env })).toStrictEqual({ "hoist-lockfile-shared": "hoist-lockfile-shared@1.0.2" });
+    expect(await sharedResolutions({ packageDir, env })).toStrictEqual({
+      "hoist-lockfile-shared": "hoist-lockfile-shared@1.0.2",
+    });
     expect(await exists(join(packageDir, "node_modules", "hoist-lockfile-1", "node_modules"))).toBeFalse();
   });
 
@@ -5584,7 +5596,9 @@ describe.concurrent("hoisting", async () => {
       ),
     ]);
 
-    expect(await sharedResolutions({ packageDir, env })).toStrictEqual({ "hoist-lockfile-shared": "hoist-lockfile-shared@1.0.2" });
+    expect(await sharedResolutions({ packageDir, env })).toStrictEqual({
+      "hoist-lockfile-shared": "hoist-lockfile-shared@1.0.2",
+    });
     expect(await exists(join(packageDir, "node_modules", "hoist-lockfile-1", "node_modules"))).toBeFalse();
   });
 });
@@ -6223,6 +6237,7 @@ describe.concurrent("transitive file dependencies", () => {
   // disk while resolving, so it is read like one declared by the root.
   for (const linker of ["hoisted", "isolated"] as const) {
     test(`${linker}: a file: dependency of a local file: package is resolved like a root one`, async () => {
+      const { env } = await setupTest();
       const { packageDir } = await registry.createTestDir({
         bunfigOpts: { linker },
         files: {
@@ -10595,12 +10610,11 @@ describe("global bin links when the package dir is inside the bin dir", () => {
     globalDir = join(binDir, "global");
     const tmp = join(root, "tmp");
     await mkdir(tmp);
-    // `env` is shared with the file-level beforeEach, which points its cache and
-    // temp dirs at whichever test ran last; pin them so `bunx` below (which puts
+    // Pin the cache and temp dirs so `bunx` below (which puts
     // `<temp>/bunx-*/node_modules/.bin` ahead of PATH) sees the same thing in
     // every run.
     globalEnv = mergeWindowEnvs([
-      env,
+      bunEnv,
       {
         BUN_INSTALL_BIN: binDir,
         BUN_INSTALL_GLOBAL_DIR: globalDir,

From 0359cdcb1e4047b819041c2ce3fc79f3294932ae Mon Sep 17 00:00:00 2001
From: "autofix-ci[bot]" <114827586+autofix-ci[bot]@users.noreply.github.com>
Date: Mon, 17 Aug 2026 05:23:27 +0000
Subject: [PATCH 188/258] [autofix.ci] apply automated fixes

---
 src/install/yarn.rs                  | 8 +++++++-
 test/cli/install/bun-install.test.ts | 4 +++-
 2 files changed, 10 insertions(+), 2 deletions(-)

diff --git a/src/install/yarn.rs b/src/install/yarn.rs
index 64304d0b83be..53a6e40c9de0 100644
--- a/src/install/yarn.rs
+++ b/src/install/yarn.rs
@@ -606,7 +606,13 @@ impl Binder<'_> {
                 |_| true,
             )
             // Nothing satisfies it: the highest version there is, as a fresh install's peer pass picks.
-            .or_else(|| this.package_index.get(&name_hash)?.as_slice().first().copied());
+            .or_else(|| {
+                this.package_index
+                    .get(&name_hash)?
+                    .as_slice()
+                    .first()
+                    .copied()
+            });
         }
         self.spec.clear();
         self.spec.extend_from_slice(dep.name.slice(string_bytes));
diff --git a/test/cli/install/bun-install.test.ts b/test/cli/install/bun-install.test.ts
index 32e669cf01b3..dc766d291216 100644
--- a/test/cli/install/bun-install.test.ts
+++ b/test/cli/install/bun-install.test.ts
@@ -1598,7 +1598,9 @@ describe.concurrent("bun-install", () => {
         stderr: "pipe",
       });
       const [stdout, stderr, exitCode] = await Promise.all([proc.stdout.text(), proc.stderr.text(), proc.exited]);
-      expect(stderr).toContain("ENAMETOOLONG: failed moving copied files into node_modules/package dir for package pkg");
+      expect(stderr).toContain(
+        "ENAMETOOLONG: failed moving copied files into node_modules/package dir for package pkg",
+      );
       expect(stdout).toContain("Failed to install 1 package");
       expect(exitCode).toBe(1);
     }

From 96fd81979490e31888369e1cc928c86784d4fa54 Mon Sep 17 00:00:00 2001
From: Jarred Sumner <jarred@jarredsumner.com>
Date: Mon, 17 Aug 2026 05:35:28 +0000
Subject: [PATCH 189/258] simplify(s3-linkers): drop
 PackageInstall::destination_dir_subpath_buf, join subpaths with join_z_spill

verify_git_resolution/get_installed_package_json_source build
<alias>/<file> in a spill buffer instead of writing into the alias
buffer, which removes the DestinationSubpath guard, the aliasing
&ZStr/&mut [u8] field pair and the raw-pointer dance at both
construction sites. Inline install_replaces_folder; trim comments.

(cherry picked from commit 3875d9480aaf360dcef04a7ab90bde7905a370c4)
---
 src/install/PackageInstall.rs   | 85 +++++++--------------------------
 src/install/PackageInstaller.rs | 67 ++++++++------------------
 src/install/patch_install.rs    | 13 -----
 3 files changed, 37 insertions(+), 128 deletions(-)

diff --git a/src/install/PackageInstall.rs b/src/install/PackageInstall.rs
index 37c7cc6c8ef0..9099791664f4 100644
--- a/src/install/PackageInstall.rs
+++ b/src/install/PackageInstall.rs
@@ -29,10 +29,7 @@ pub struct PackageInstall<'a> {
     /// short-lived `Dir` held by the caller — `PackageInstall` never closes it.
     pub(crate) cache_dir: Fd,
     pub(crate) cache_dir_subpath: &'a ZStr,
-    // TODO: `destination_dir_subpath` aliases into `destination_dir_subpath_buf`;
-    // borrowck will reject simultaneous &ZStr + &mut [u8]. Consider storing only the len.
     pub(crate) destination_dir_subpath: &'a ZStr,
-    pub(crate) destination_dir_subpath_buf: &'a mut [u8],
 
     pub(crate) progress: Option<&'a mut Progress>,
 
@@ -498,18 +495,14 @@ impl<TaskType> NewTaskQueue<TaskType> {
     }
 
     /// # Safety
-    /// `task` must be the pointer `bun_core::heap::into_raw` returned for a live
-    /// `TaskType` whose ownership is being handed to the thread pool; the worker
-    /// reclaims it through the pointer scheduled here (`from_task_ptr` + `heap::take`).
+    /// `task` must be the `heap::into_raw` pointer of a live `TaskType` whose
+    /// ownership is being handed to the thread pool; the worker reclaims it.
     pub(crate) unsafe fn push(&self, task: *mut TaskType)
     where
         TaskType: IntrusiveWorkTask,
     {
         self.wait_group.add_one();
-        // SAFETY: caller contract — `task` is a live allocation. The projection goes
-        // through `task` itself (not through a `&mut` to the field) so the pointer the
-        // pool hands back carries the whole allocation's provenance, which the worker's
-        // container-of and `heap::take` need.
+        // SAFETY: caller contract; projecting through `task` keeps the allocation's provenance.
         self.thread_pool
             .schedule(Batch::from(unsafe { TaskType::field_of(task) }));
     }
@@ -610,9 +603,7 @@ impl HardLinkWindowsInstallTask {
     }
 
     fn run_from_thread_pool(task: *mut WorkPoolTask) {
-        // SAFETY: `task` is the pointer `NewTaskQueue::push` projected out of the
-        // `init()` allocation, so it points at our `task` field with provenance for
-        // the whole allocation, which the `heap::take` calls below rely on.
+        // SAFETY: `task` is the `task` field pointer `NewTaskQueue::push` scheduled.
         let self_: *mut Self = unsafe { Self::from_task_ptr(task) };
         // SAFETY: HARDLINK_QUEUE initialized by init_queue() before scheduling.
         let queue = unsafe { (*HARDLINK_QUEUE.get()).assume_init_ref() };
@@ -783,48 +774,6 @@ impl UninstallTask {
     }
 }
 
-/// `<destination_dir_subpath>/<name>`, written in place after the alias in
-/// `destination_dir_subpath_buf`. Dropping it restores the alias's NUL terminator.
-struct DestinationSubpath<'b> {
-    buf: &'b mut [u8],
-    alias_len: usize,
-    len: usize,
-}
-
-impl<'b> DestinationSubpath<'b> {
-    /// `None` when the path and its NUL terminator do not fit `buf`: the alias is
-    /// only required to fit the buffer by itself (`alias_is_safe_install_target`).
-    fn new(buf: &'b mut [u8], alias_len: usize, name: &[u8]) -> Option<Self> {
-        let name_start = alias_len + 1;
-        let len = name_start + name.len();
-        if len >= buf.len() {
-            return None;
-        }
-        buf[alias_len] = SEP;
-        buf[name_start..len].copy_from_slice(name);
-        buf[len] = 0;
-        Some(Self {
-            buf,
-            alias_len,
-            len,
-        })
-    }
-}
-
-impl core::ops::Deref for DestinationSubpath<'_> {
-    type Target = ZStr;
-
-    fn deref(&self) -> &ZStr {
-        ZStr::from_buf(self.buf, self.len)
-    }
-}
-
-impl Drop for DestinationSubpath<'_> {
-    fn drop(&mut self) {
-        self.buf[self.alias_len] = 0;
-    }
-}
-
 // ───────────────────────────── impl PackageInstall ─────────────────────────────
 
 impl<'a> PackageInstall<'a> {
@@ -863,17 +812,15 @@ impl<'a> PackageInstall<'a> {
     // 1. verify that .bun-tag exists (was it installed from bun?)
     // 2. check .bun-tag against the resolved version
     fn verify_git_resolution(&mut self, repo: &Repository, root_node_modules_dir: &Dir) -> bool {
-        let Some(bun_tag_path) = DestinationSubpath::new(
-            self.destination_dir_subpath_buf,
-            self.destination_dir_subpath.len(),
-            b".bun-tag",
-        ) else {
-            return false;
-        };
+        let mut spill = Vec::new();
+        let bun_tag_path = path::resolve_path::join_z_spill::<path::platform::Posix>(
+            &mut spill,
+            &[self.destination_dir_subpath.as_bytes(), b".bun-tag"],
+        );
 
         let Ok(bun_tag_file) = self
             .node_modules
-            .read_small_file(root_node_modules_dir, &bun_tag_path)
+            .read_small_file(root_node_modules_dir, bun_tag_path)
         else {
             return false;
         };
@@ -933,15 +880,15 @@ impl<'a> PackageInstall<'a> {
         mutable.reset();
         mutable.expand_to_capacity();
 
-        let package_json_path = DestinationSubpath::new(
-            self.destination_dir_subpath_buf,
-            self.destination_dir_subpath.len(),
-            b"package.json",
-        )?;
+        let mut spill = Vec::new();
+        let package_json_path = path::resolve_path::join_z_spill::<path::platform::Posix>(
+            &mut spill,
+            &[self.destination_dir_subpath.as_bytes(), b"package.json"],
+        );
 
         let package_json_file = self
             .node_modules
-            .open_file(root_node_modules_dir, &package_json_path)
+            .open_file(root_node_modules_dir, package_json_path)
             .ok()?;
         // defer package_json_file.close()
 
diff --git a/src/install/PackageInstaller.rs b/src/install/PackageInstaller.rs
index e4e78e4f190c..526dab9db9fd 100644
--- a/src/install/PackageInstaller.rs
+++ b/src/install/PackageInstaller.rs
@@ -291,9 +291,7 @@ pub struct TreeContext {
 
     /// Dependencies whose folder in this tree is replaced by this install.
     pub(crate) replaced: Vec<DependencyID>,
-
-    /// This tree is inside one of an ancestor's `replaced` folders, so what is
-    /// on disk here is going away (possibly after a download) and cannot be skipped.
+    /// Inside an ancestor's `replaced` folder: what is on disk here goes away, so never skip.
     pub(crate) inside_replaced_folder: bool,
 }
 
@@ -1060,8 +1058,7 @@ impl<'a> PackageInstaller<'a> {
         true
     }
 
-    /// Call before installing a tree's dependencies; relies on trees being
-    /// visited in id order, so the parent's `replaced` is already complete.
+    /// Trees are visited in id order, so the parent's `replaced` is complete.
     pub(crate) fn set_inside_replaced_folder(&mut self, tree_id: lockfile::tree::Id) {
         let lockfile = self.lockfile();
         let tree = lockfile.buffers.trees.as_slice()[tree_id as usize];
@@ -1083,15 +1080,6 @@ impl<'a> PackageInstaller<'a> {
         self.trees[tree_id as usize].inside_replaced_folder = inside;
     }
 
-    /// `install_from_link` re-points one symlink; `PackageInstall::install` replaces
-    /// the folder, folder dependencies included (a directory of per-file symlinks).
-    fn install_replaces_folder(tag: resolution::Tag) -> bool {
-        !matches!(
-            tag,
-            resolution::Tag::Symlink | resolution::Tag::Workspace | resolution::Tag::Root
-        )
-    }
-
     // `pub fn deinit` dropped. All owned fields (`pending_lifecycle_scripts: Vec`,
     // `completed_trees: Bitset`, `trees: Box<[TreeContext]>`, `tree_ids_to_trees_the_id_depends_on`,
     // `node_modules`, `trusted_dependencies_from_update_requests`) impl Drop. Borrowed fields
@@ -1339,22 +1327,11 @@ impl<'a> PackageInstaller<'a> {
             return;
         }
 
-        // `PackageInstall` stores both `destination_dir_subpath: &mut ZStr`
-        // and `destination_dir_subpath_buf: &mut [u8]` aliasing the same bytes.
-        // Derive BOTH from a single `*mut PathBuffer`
-        // so neither `&mut` invalidates the other under stacked-borrows.
-        let subpath_buf_ptr: *mut PathBuffer = &raw mut self.destination_dir_subpath_buf;
-        let destination_dir_subpath: &mut ZStr = {
-            let alias_slice = alias.slice(string_buf!());
-            // SAFETY: `subpath_buf_ptr` is the unique borrow of the field; valid for
-            // the lifetime of this fn body.
-            let buf = unsafe { &mut *subpath_buf_ptr };
-            buf[..alias_slice.len()].copy_from_slice(alias_slice);
-            buf[alias_slice.len()] = 0;
-            // SAFETY: buf[alias_slice.len()] == 0 written above; pointer derives from
-            // `subpath_buf_ptr` so it shares provenance with `destination_dir_subpath_buf`
-            // below.
-            unsafe { ZStr::from_raw_mut((*subpath_buf_ptr).as_mut_ptr(), alias_slice.len()) }
+        let destination_dir_subpath = {
+            let alias = alias.slice(string_buf!());
+            self.destination_dir_subpath_buf[..alias.len()].copy_from_slice(alias);
+            self.destination_dir_subpath_buf[alias.len()] = 0;
+            ZStr::from_buf(&self.destination_dir_subpath_buf, alias.len())
         };
 
         let pkg_name_hash = self.pkg_name_hashes[package_id as usize];
@@ -1446,10 +1423,6 @@ impl<'a> PackageInstaller<'a> {
             },
             cache_dir: Fd::INVALID, // assigned below
             destination_dir_subpath,
-            // SAFETY: `subpath_buf_ptr` = `&raw mut self.destination_dir_subpath_buf`; the
-            // field outlives `installer`. `destination_dir_subpath` above derives from the
-            // same raw pointer, so this `&mut` does not invalidate it under stacked-borrows.
-            destination_dir_subpath_buf: unsafe { (*subpath_buf_ptr).as_mut_slice() },
             package_name: pkg_name,
             patch: patch_patch.map(|_| package_install::Patch {
                 contents_hash: patch_contents_hash.unwrap(),
@@ -1653,11 +1626,15 @@ impl<'a> PackageInstaller<'a> {
             || !installer.verify(resolution, &self.root_node_modules_folder);
         self.summary.skipped += (!needs_install) as u32;
 
-        // Not needed inside a replaced folder: child trees inherit the flag.
+        // `install_from_link` (symlink/workspace) re-points one symlink; everything else
+        // replaces the folder. Child trees of a replaced folder inherit the flag.
         if verifying
             && needs_install
             && !inside_replaced_folder
-            && Self::install_replaces_folder(resolution.tag)
+            && !matches!(
+                resolution.tag,
+                resolution::Tag::Symlink | resolution::Tag::Workspace | resolution::Tag::Root
+            )
         {
             self.trees[self.current_tree_id as usize]
                 .replaced
@@ -1894,12 +1871,10 @@ impl<'a> PackageInstaller<'a> {
                         // This is a transitive folder dependency. It is installed as a directory of symlinks
                         // to the target's files (see `PackageInstall::install`), and is not hoisted.
                         //
-                        // A transitive `Resolution::Folder` is relative to the top-level dir when
-                        // a local `file:` package declared it (`Package::parse` normalized it) or
-                        // when a root `overrides`/`resolutions` rule, scoped or not, supplied the
-                        // path, so install it from `installer.cache_dir` (the cwd, set in the
-                        // switch above). Only the unsafe-path check in that switch is limited to
-                        // plain rules (see `OverrideMap::contains_name`).
+                        // A transitive `Resolution::Folder` declared by a local `file:` package
+                        // is relative to the top-level dir (`Package::parse` normalized it), so
+                        // install it from `installer.cache_dir` (the cwd, set in the switch above).
+                        // The same holds for a path from a root `overrides`/`resolutions` rule.
                         if resolution.tag == resolution::Tag::Folder
                             && (self.lockfile().is_folder_tree_id(self.current_tree_id)
                                 || self.lockfile().is_overridden_dependency(dependency_id))
@@ -1912,9 +1887,9 @@ impl<'a> PackageInstaller<'a> {
                             );
                         }
 
-                        // One declared by a cache package (`from_npm`, `Features::NPM`) is
-                        // relative to that package, which installs at `dirname(node_modules.path)`
-                        // because transitive folders never hoist.
+                        // One declared by an npm manifest (`Package::from_npm`) is verbatim,
+                        // i.e. relative to the declaring package, which installs at
+                        // `dirname(node_modules.path)` because transitive folders never hoist.
                         let dir_name = {
                             let d = dirname::<platform::Auto>(self.node_modules.path.as_slice());
                             if d.is_empty() {
@@ -2306,7 +2281,7 @@ impl<'a> PackageInstaller<'a> {
             };
 
             // `defer { destination_dir.close(); }` + `defer increment_tree_install_count`.
-            // No early returns in this branch, so manual calls at end are equivalent.
+            // No early returns after this point, so manual calls at end are equivalent.
 
             let dep = &self.lockfile().buffers.dependencies.as_slice()[dependency_id as usize];
             let dep_behavior = dep.behavior;
diff --git a/src/install/patch_install.rs b/src/install/patch_install.rs
index 04067aa46b5e..20dc0a3f153e 100644
--- a/src/install/patch_install.rs
+++ b/src/install/patch_install.rs
@@ -463,18 +463,6 @@ impl PatchTask {
 
         // 3. copy the unpatched files into temp dir
         let cache_dir_subpath_z: &ZStr = patch.cache_dir_subpath_without_patch_hash.as_zstr();
-        // Borrowck — `tempdir_name` borrows `tmpname_buf` mutably, but
-        // `PackageInstall` also wants `&mut tmpname_buf[..]` for
-        // `destination_dir_subpath_buf`. `PackageInstall` assumes
-        // `destination_dir_subpath` is a prefix slice *into*
-        // `destination_dir_subpath_buf` (see `verifyGitResolution` /
-        // `verifyPackageJSONNameAndVersion`), and that aliasing can't be
-        // expressed with `&ZStr` + `&mut [u8]`, so use a separate buffer but
-        // mirror the prefix bytes so the invariant holds for any future call
-        // that reaches those paths.
-        let mut dest_subpath_buf = [0u8; 1024];
-        dest_subpath_buf[..tempdir_name.len() + 1]
-            .copy_from_slice(tempdir_name.as_bytes_with_nul());
         // Not `self.manager()` — `&mut self.callback` is live.
         // BACKREF — read-only lockfile access while the task runs off-thread.
         let lockfile = &self.manager.get().lockfile;
@@ -482,7 +470,6 @@ impl PatchTask {
             cache_dir: patch.cache_dir,
             cache_dir_subpath: cache_dir_subpath_z,
             destination_dir_subpath: tempdir_name,
-            destination_dir_subpath_buf: &mut dest_subpath_buf[..],
             patch: None,
             progress: None,
             package_name: pkg_name,

From 57be4ae2207b0fe8641523d87f6ad3d7f31a9ef7 Mon Sep 17 00:00:00 2001
From: Jarred Sumner <jarred@jarredsumner.com>
Date: Mon, 17 Aug 2026 05:37:27 +0000
Subject: [PATCH 190/258] simplify(s3-linkers): Installer path builders share
 append_store_path_at; hoist error formatters in on_task_fail

(cherry picked from commit e7f2e8da3eb14ad9601b542ba088e483623ee1dc)
---
 src/install/isolated_install/Installer.rs | 159 ++++++++--------------
 1 file changed, 55 insertions(+), 104 deletions(-)

diff --git a/src/install/isolated_install/Installer.rs b/src/install/isolated_install/Installer.rs
index 4c0f765098d4..3ee03dd03ef3 100644
--- a/src/install/isolated_install/Installer.rs
+++ b/src/install/isolated_install/Installer.rs
@@ -74,9 +74,8 @@ pub struct Installer<'a> {
     /// pool and each task derefs this field; a `&'a mut` would assert
     /// exclusivity every concurrent task violates. Mutated only for
     /// `lockfile.trusted_dependencies` (under `trusted_dependencies_mutex`,
-    /// narrowed via `addr_of_mut!`) and, on the main thread, a not-yet-started
-    /// package's `meta.integrity` (`record_extracted_integrity`, one row via
-    /// the raw column pointer). Never null. Read via `lockfile()`.
+    /// narrowed via `addr_of_mut!`) and in `record_extracted_integrity` (main
+    /// thread, one row). Never null. Read via `lockfile()`.
     pub lockfile: *mut Lockfile,
 
     pub(crate) summary: InstallSummary,
@@ -248,22 +247,14 @@ impl<'a> Installer<'a> {
         }
     }
 
-    /// Main thread, before the package's tasks start. The counterpart of the
-    /// integrity write-back in `PackageInstaller::install_enqueued_packages_after_extraction`:
-    /// a lockfile written before tarball integrity was recorded has none for the
-    /// package, so the extraction computed it. A local tarball's cache entry is
-    /// named after it (`cached_local_tarball_folder_name`), so the tasks need it
-    /// in place, and the lockfile is re-saved with it.
+    /// Main thread, before the package's tasks start (they name a local tarball's cache
+    /// entry after it). Same write-back as `install_enqueued_packages_after_extraction`.
     fn record_extracted_integrity(&mut self, pkg_id: PackageID, integrity: &install::Integrity) {
         let pkgs = self.lockfile().packages.slice();
         assert!((pkg_id as usize) < pkgs.len());
-        // SAFETY: `items_raw` carries the column's root provenance, so this
-        // field access needs no `&mut Lockfile`. Only a package's own tasks
-        // read its `integrity` (to name the cache entry), and none of this
-        // package's tasks have started: every entry of it waited on the
-        // extraction being reported. Tasks of other packages running on the
-        // pool hold `&[Meta]` over the column but only touch other bytes.
-        // `pkg_id` is in bounds per the assert above.
+        // SAFETY: in bounds; raw column pointer, so no `&mut Lockfile` is formed. Only this
+        // package's tasks read its `integrity` and none has started; other tasks' `&[Meta]`
+        // borrows never touch these bytes.
         let recorded = unsafe {
             core::ptr::addr_of_mut!(
                 (*pkgs
@@ -387,32 +378,26 @@ impl<'a> Installer<'a> {
         let node_id = entry_node_ids[entry_id.get() as usize];
         let pkg_id = node_pkg_ids[node_id.get() as usize];
 
-        let pkg_name = pkg_names[pkg_id as usize];
         let pkg_res = pkg_resolutions[pkg_id as usize];
+        let pkg_name =
+            bun_core::fmt::escape_control_chars(pkg_names[pkg_id as usize].slice(string_buf));
+        let pkg_res_fmt = EscapeControlChars(redacted(
+            pkg_res.fmt(string_buf, bun_core::fmt::PathSep::Auto),
+        ));
 
         match err {
             TaskError::LinkPackage(link_err) => {
                 Output::err(
                     link_err.clone(),
                     "failed to link package: {}@{}",
-                    (
-                        bun_core::fmt::escape_control_chars(pkg_name.slice(string_buf)),
-                        bun_core::fmt::EscapeControlChars(redacted(
-                            pkg_res.fmt(string_buf, bun_core::fmt::PathSep::Auto),
-                        )),
-                    ),
+                    (&pkg_name, &pkg_res_fmt),
                 );
             }
             TaskError::SymlinkDependencies(symlink_err) => {
                 Output::err(
                     symlink_err.clone(),
                     "failed to symlink dependencies for package: {}@{}",
-                    (
-                        bun_core::fmt::escape_control_chars(pkg_name.slice(string_buf)),
-                        bun_core::fmt::EscapeControlChars(redacted(
-                            pkg_res.fmt(string_buf, bun_core::fmt::PathSep::Auto),
-                        )),
-                    ),
+                    (&pkg_name, &pkg_res_fmt),
                 );
             }
             TaskError::LinkPathTooLong(link_pkg_id) => {
@@ -425,27 +410,14 @@ impl<'a> Installer<'a> {
                 );
             }
             TaskError::Patching(patch_log) => {
-                Output::err_generic(
-                    "failed to patch package: {}@{}",
-                    (
-                        bun_core::fmt::escape_control_chars(pkg_name.slice(string_buf)),
-                        bun_core::fmt::EscapeControlChars(redacted(
-                            pkg_res.fmt(string_buf, bun_core::fmt::PathSep::Auto),
-                        )),
-                    ),
-                );
+                Output::err_generic("failed to patch package: {}@{}", (&pkg_name, &pkg_res_fmt));
                 let _ = patch_log.print(std::ptr::from_mut(Output::error_writer()));
             }
             TaskError::Binaries(bin_err) => {
                 Output::err(
                     *bin_err,
                     "failed to link binaries for package: {}@{}",
-                    (
-                        bun_core::fmt::escape_control_chars(pkg_name.slice(string_buf)),
-                        bun_core::fmt::EscapeControlChars(redacted(
-                            pkg_res.fmt(string_buf, bun_core::fmt::PathSep::Auto),
-                        )),
-                    ),
+                    (&pkg_name, &pkg_res_fmt),
                 );
             }
             TaskError::DependencyBinaries(dep_errs) => {
@@ -459,8 +431,8 @@ impl<'a> Installer<'a> {
                             bstr::BStr::new(pkg_names[dep_pkg_id as usize].slice(string_buf)),
                             pkg_resolutions[dep_pkg_id as usize]
                                 .fmt(string_buf, bun_core::fmt::PathSep::Auto),
-                            bstr::BStr::new(pkg_name.slice(string_buf)),
-                            pkg_res.fmt(string_buf, bun_core::fmt::PathSep::Auto),
+                            &pkg_name,
+                            &pkg_res_fmt,
                         ),
                     );
                 }
@@ -469,10 +441,8 @@ impl<'a> Installer<'a> {
                 Output::err_generic(
                     "failed to download <b>{}@{}<r>: {}\n  <d>{}<r>",
                     (
-                        bun_core::fmt::escape_control_chars(pkg_name.slice(string_buf)),
-                        bun_core::fmt::EscapeControlChars(redacted(
-                            pkg_res.fmt(string_buf, bun_core::fmt::PathSep::Auto),
-                        )),
+                        &pkg_name,
+                        &pkg_res_fmt,
                         bstr::BStr::new(download_error_reason(dl.err)),
                         EscapeControlChars(bun_core::fmt::redacted_npm_url(&dl.url)),
                     ),
@@ -1754,13 +1724,10 @@ impl Task {
                         continue;
                     }
 
-                    if !manager_ref.options.do_.contains(Do::RUN_SCRIPTS) {
-                        step = self.next_step(current_step);
-                        continue;
-                    }
-
                     // Trusted entries are never global-store eligible; never run in the shared dir.
-                    if installer.entry_uses_global_store(self.entry_id) {
+                    if !manager_ref.options.do_.contains(Do::RUN_SCRIPTS)
+                        || installer.entry_uses_global_store(self.entry_id)
+                    {
                         step = self.next_step(current_step);
                         continue;
                     }
@@ -3022,45 +2989,12 @@ impl<'a> Installer<'a> {
             buf.append(pkg_name.slice(string_buf));
             return;
         }
-        match which {
-            Which::Final => self.append_store_path(buf, entry_id),
-            Which::Staging => self.append_store_package_path(buf, entry_id, which),
-        }
-    }
-
-    /// `node_modules/.bun/<storepath>/node_modules/<pkg>`, or with
-    /// `Which::Staging` the `StagingPath` next to it.
-    fn append_store_package_path(
-        &self,
-        buf: &mut impl paths::PathLike,
-        entry_id: StoreEntryId,
-        which: Which,
-    ) {
-        let string_buf = self.lockfile().buffers.string_bytes.as_slice();
-        let node_id = self.store.entries.items_node_id()[entry_id.get() as usize];
-        let pkg_id = self.store.nodes.items_pkg_id()[node_id.get() as usize];
-        let pkg_name = self.lockfile().packages.items_name()[pkg_id as usize].slice(string_buf);
-
-        buf.append(NODE_MODULES_BUN.as_bytes());
-        buf.append_fmt(format_args!(
-            "{}",
-            store::entry::fmt_store_path(entry_id, self.store, self.lockfile()),
-        ));
-        buf.append(b"node_modules");
-        match which {
-            Which::Final => buf.append(pkg_name),
-            Which::Staging => buf.append_fmt(format_args!("{}", StagingPath(pkg_name))),
-        }
+        self.append_store_path_at(buf, entry_id, which);
     }
 
-    /// `append_store_path` for the entry a dependency symlink points at. This
-    /// is the one place a `link:` package's path is needed: it is never
-    /// installed (`install_isolated_packages` marks its entry done up front),
-    /// its dependents link straight to `<global link dir>/<link: target>`.
-    ///
-    /// The `link:` target is stored as written in package.json or bun.lock, so
-    /// unlike every other input of these path builders it is not bounded by a
-    /// path buffer. A target that does not fit fails the dependent instead.
+    /// `append_store_path` for the entry a dependency symlink points at, the one place a
+    /// `link:` package's path (`<global link dir>/<target as written>`) is needed. A target
+    /// that does not fit a path buffer fails with `LinkPathTooLong`.
     pub(crate) fn append_dependency_path(
         &self,
         buf: &mut AutoAbsPath,
@@ -3075,15 +3009,10 @@ impl<'a> Installer<'a> {
             return Ok(());
         }
 
-        // Lazily ensuring the global link dir would mutate `*PackageManager`,
-        // but this runs on worker threads, so the lazy init is hoisted to the
-        // main thread (`install_isolated_packages`, before any `start_task`).
-        // Reading the cached field here is then equivalent.
+        // Ensured on the main thread (`install_isolated_packages`) before any task starts;
+        // this runs on worker threads and cannot lazily init it.
         let link_dir_path: &[u8] = &self.manager().global_link_dir_path;
-        debug_assert!(
-            !link_dir_path.is_empty(),
-            "global_link_dir_path must be ensured before tasks start",
-        );
+        debug_assert!(!link_dir_path.is_empty());
         let string_buf = self.lockfile().buffers.string_bytes.as_slice();
         let link_target = pkg_res.symlink().slice(string_buf);
 
@@ -3097,13 +3026,21 @@ impl<'a> Installer<'a> {
         };
 
         paths::PathLike::clear(buf);
-        // `join_abs_string_buf_checked` bounded `target` by the same buffer size.
-        buf.append(target).assume_ok();
+        buf.append(target).assume_ok(); // bounded by the same buffer size
         Ok(())
     }
 
     /// `entry_id` must not be a `link:` package; see `append_dependency_path`.
     pub(crate) fn append_store_path(&self, buf: &mut impl paths::PathLike, entry_id: StoreEntryId) {
+        self.append_store_path_at(buf, entry_id, Which::Final);
+    }
+
+    fn append_store_path_at(
+        &self,
+        buf: &mut impl paths::PathLike,
+        entry_id: StoreEntryId,
+        which: Which,
+    ) {
         let string_buf = self.lockfile().buffers.string_bytes.as_slice();
 
         let entries = &self.store.entries;
@@ -3151,7 +3088,21 @@ impl<'a> Installer<'a> {
             ResolutionTag::Symlink => {
                 unreachable!("link: packages have no store path; see append_dependency_path")
             }
-            _ => self.append_store_package_path(buf, entry_id, Which::Final),
+            _ => {
+                let pkg_name = pkg_names[pkg_id as usize];
+                buf.append(NODE_MODULES_BUN.as_bytes());
+                buf.append_fmt(format_args!(
+                    "{}",
+                    store::entry::fmt_store_path(entry_id, self.store, self.lockfile()),
+                ));
+                buf.append(b"node_modules");
+                match which {
+                    Which::Final => buf.append(pkg_name.slice(string_buf)),
+                    Which::Staging => {
+                        buf.append_fmt(format_args!("{}", StagingPath(pkg_name.slice(string_buf))))
+                    }
+                }
+            }
         }
     }
 

From fc2f23c9ac82890253213c70e12d27265eb22698 Mon Sep 17 00:00:00 2001
From: Jarred Sumner <jarred@jarredsumner.com>
Date: Mon, 17 Aug 2026 05:42:50 +0000
Subject: [PATCH 191/258] simplify(s3-linkers): share remove_link, shrink
 StoreKey resolution cap, trim resolver/extract docs

- remove_link (rmdir-then-unlink on Windows) returns sys::Result and is
  reused by remove_stale_workspace_links, link_project_to_global_store
  and the stale local-store link removal in LinkPackage.
- write_resolution formats into an 80-byte buffer and only allocates for
  the over-long case; same bytes and same wyhash as the streaming sink.
- name_and_basename keeps main's shape with the URL additions.
- inline GlobalOrRelative::kind, install_replaces_folder.

(cherry picked from commit 7b9f75909dee512705d6f7113343dd9bb6e45889)
---
 .../PackageManager/PackageManagerLifecycle.rs |  18 +--
 .../remove_stale_workspace_links.rs           |  52 +++------
 src/install/extract_tarball.rs                | 105 ++++++++----------
 src/install/isolated_install/Installer.rs     |  42 ++-----
 src/install/isolated_install/Store.rs         |  63 +++--------
 src/install/resolvers/folder_resolver.rs      |  46 +++-----
 6 files changed, 105 insertions(+), 221 deletions(-)

diff --git a/src/install/PackageManager/PackageManagerLifecycle.rs b/src/install/PackageManager/PackageManagerLifecycle.rs
index 779fcab116d6..176b368acddf 100644
--- a/src/install/PackageManager/PackageManagerLifecycle.rs
+++ b/src/install/PackageManager/PackageManagerLifecycle.rs
@@ -81,10 +81,8 @@ impl PackageManager {
                     self.set_preinstall_state(pkg.meta.id, PreinstallState::Done);
                     return PreinstallState::Done;
                 }
-                // Nor the other libc's variant of a native package. Unlike os/cpu this only
-                // holds for the dependency at hand (`Libc::for_dependency`): a regular
-                // dependency on the same package resolved later still installs it, and the
-                // installer downloads it at that point because the state is left untouched.
+                // Nor another libc's variant; only for this dependency (`Libc::for_dependency`),
+                // so the state stays untouched and a later regular dependency still installs it.
                 if !pkg
                     .meta
                     .libc
@@ -509,16 +507,12 @@ fn put_npm_package_config_env(
         return Ok(());
     };
 
-    config.try_for_each_property(|key, _key_loc, value| {
-        let Some(value) = value.as_utf8_string_literal() else {
-            return Ok(());
-        };
-        if key.is_empty() || value.is_empty() {
-            return Ok(());
+    config.try_for_each_property(|key, _, value| match value.as_utf8_string_literal() {
+        Some(value) if !key.is_empty() && !value.is_empty() => {
+            script_env.put(&strings::concat(&[b"npm_package_config_", key]), value)
         }
-        script_env.put(&strings::concat(&[b"npm_package_config_", key]), value)
+        _ => Ok(()),
     })?;
-
     Ok(())
 }
 
diff --git a/src/install/PackageManager/remove_stale_workspace_links.rs b/src/install/PackageManager/remove_stale_workspace_links.rs
index 3540d66fc4f3..7e955c499003 100644
--- a/src/install/PackageManager/remove_stale_workspace_links.rs
+++ b/src/install/PackageManager/remove_stale_workspace_links.rs
@@ -1,6 +1,7 @@
 use bstr::BStr;
 use bun_paths::AutoAbsPathChecked;
 
+use crate::isolated_install::installer::remove_link;
 use crate::lockfile::Lockfile;
 use crate::lockfile::package::PackageColumns as _;
 use crate::package_installer::alias_is_safe_install_target;
@@ -9,45 +10,35 @@ use crate::resolution::Tag as ResolutionTag;
 
 /// Linkers only visit names in the new lockfile; a workspace name that left it is unlinked here.
 pub(crate) fn remove_stale_workspace_links(previous: &Lockfile, current: &Lockfile) {
-    let previous_string_buf = previous.buffers.string_bytes.as_slice();
     let previous_packages = previous.packages.slice();
     let resolutions = previous_packages.items_resolution();
     let name_hashes = previous_packages.items_name_hash();
-    let names = previous_packages.items_name();
 
-    for pkg_id in 0..previous_packages.len() {
+    for (pkg_id, name) in previous_packages.items_name().iter().enumerate() {
+        let name = name.slice(&previous.buffers.string_bytes);
         if resolutions[pkg_id].tag != ResolutionTag::Workspace
             || current.workspace_paths.contains_key(&name_hashes[pkg_id])
+            || !alias_is_safe_install_target(name)
         {
             continue;
         }
 
-        let name = names[pkg_id].slice(previous_string_buf);
-        if !alias_is_safe_install_target(name) {
-            continue;
+        let mut path = AutoAbsPathChecked::init_top_level_dir();
+        let top_level_len = path.len();
+        remove_link_in(&mut path, b"", name);
+        for workspace_path in current.workspace_paths.values() {
+            path.set_length(top_level_len);
+            remove_link_in(
+                &mut path,
+                workspace_path.slice(&current.buffers.string_bytes),
+                name,
+            );
         }
-
-        remove_links_named(current, name);
-    }
-}
-
-#[cold]
-#[inline(never)]
-fn remove_links_named(current: &Lockfile, name: &[u8]) {
-    let current_string_buf = current.buffers.string_bytes.as_slice();
-
-    let mut path = AutoAbsPathChecked::init_top_level_dir();
-    let top_level_len = path.len();
-
-    remove_link(&mut path, b"", name);
-    for workspace_path in current.workspace_paths.values() {
-        path.set_length(top_level_len);
-        remove_link(&mut path, workspace_path.slice(current_string_buf), name);
     }
 }
 
 /// `readlink` is the symlink (or junction) check; a real directory or file there is left alone.
-fn remove_link(path: &mut AutoAbsPathChecked, package_dir: &[u8], name: &[u8]) {
+fn remove_link_in(path: &mut AutoAbsPathChecked, package_dir: &[u8], name: &[u8]) {
     if path.append(package_dir).is_err()
         || path.append(b"node_modules").is_err()
         || path.append(name).is_err()
@@ -65,16 +56,5 @@ fn remove_link(path: &mut AutoAbsPathChecked, package_dir: &[u8], name: &[u8]) {
         "removing stale workspace link {}",
         BStr::new(path.slice())
     );
-
-    #[cfg(windows)]
-    {
-        // Directory symlinks and junctions need rmdir; a file symlink needs unlink.
-        if bun_sys::rmdir(path.slice_z()).is_err() {
-            let _ = bun_sys::unlink(path.slice_z());
-        }
-    }
-    #[cfg(not(windows))]
-    {
-        let _ = bun_sys::unlink(path.slice_z());
-    }
+    let _ = remove_link(path.slice_z());
 }
diff --git a/src/install/extract_tarball.rs b/src/install/extract_tarball.rs
index 7d87d2fac489..6a156957fa54 100644
--- a/src/install/extract_tarball.rs
+++ b/src/install/extract_tarball.rs
@@ -63,13 +63,9 @@ impl ExtractTarball {
         Ok(result)
     }
 
-    /// The integrity the lockfile records for a GitHub / URL / local tarball, so
-    /// later installs verify the same bytes (see `run`). That is the value the
-    /// lockfile already pins (verified before extraction), or else `compute` from
-    /// the bytes on the first install. A local tarball's cache entry is named
-    /// after it (`move_to_cache_directory`), which is why it is settled before
-    /// extracting. Unknown for npm packages, whose integrity comes from the
-    /// registry manifest.
+    /// What the lockfile pins for a GitHub / URL / local tarball so later installs verify the
+    /// same bytes: the already pinned value, else `compute`d on first install. Settled before
+    /// extracting because a local tarball's cache entry is named after it.
     pub(crate) fn lockfile_integrity(&self, compute: impl FnOnce() -> Integrity) -> Integrity {
         match self.resolution.tag {
             ResolutionTag::Github | ResolutionTag::RemoteTarball | ResolutionTag::LocalTarball => {
@@ -183,19 +179,15 @@ pub(crate) fn uses_streaming_extraction() -> bool {
         .unwrap_or(false)
 }
 
-/// How `move_to_cache_directory` treats a cache folder that already has the
-/// name being published. Decided before extracting: afterwards a pre-existing
-/// folder and one a concurrent install published meanwhile look the same.
+/// What `move_to_cache_directory` does with an existing cache folder of the same name.
+/// Decided before extracting, while "pre-existing" and "published meanwhile" still differ.
 #[derive(Clone, Copy, PartialEq, Eq)]
 pub(crate) enum CachePublish {
-    /// npm and GitHub: swap the fresh copy in. The swapped-out folder is left
-    /// in the temp dir, as a concurrent install may still be reading it.
+    /// npm and GitHub: swap ours in; leave the old one in the temp dir for concurrent readers.
     Replace,
-    /// Tarball re-extracted over its own folder: swap the fresh copy in and
-    /// delete the swapped-out folder.
+    /// Tarball re-extracted over its own folder: swap ours in, delete the old one.
     Supersede,
-    /// Tarball whose folder did not exist yet: if one exists by now, a
-    /// concurrent install extracted the same tarball, so keep it and drop ours.
+    /// Tarball whose folder did not exist: one there now is a concurrent identical extraction.
     KeepExisting,
 }
 
@@ -235,10 +227,10 @@ impl ExtractTarball {
             debug_assert!(false);
             b"unnamed-package"
         };
-        let basename: &[u8] =
-            if strings::has_prefix(name, b"https://") || strings::has_prefix(name, b"http://") {
+        let basename: &[u8] = 'brk: {
+            let mut tmp = name;
+            if strings::has_prefix(tmp, b"https://") || strings::has_prefix(tmp, b"http://") {
                 // A URL name is the placeholder `bun add <url>` uses until package.json is read.
-                let mut tmp = name;
                 if let Some(i) = strings::index_of_any(tmp, b"?#") {
                     tmp = &tmp[0..i];
                 }
@@ -248,28 +240,25 @@ impl ExtractTarball {
                 } else if strings::ends_with(tmp, b".tar.gz") {
                     tmp = &tmp[0..tmp.len() - 7];
                 }
-                if bun_install::dependency::is_safe_install_folder_name(tmp) {
-                    tmp
-                } else {
-                    b"package"
+                if !bun_install::dependency::is_safe_install_folder_name(tmp) {
+                    tmp = b"package";
                 }
-            } else {
-                let mut tmp = name;
-                if tmp[0] == b'@' {
-                    if let Some(i) = strings::index_of_char(tmp, b'/') {
-                        tmp = &tmp[i as usize + 1..];
-                    }
+                break 'brk tmp;
+            } else if tmp[0] == b'@' {
+                if let Some(i) = strings::index_of_char(tmp, b'/') {
+                    tmp = &tmp[i as usize + 1..];
                 }
+            }
 
-                #[cfg(windows)]
-                {
-                    if let Some(i) = strings::last_index_of_char(tmp, b':') {
-                        tmp = &tmp[i + 1..];
-                    }
+            #[cfg(windows)]
+            {
+                if let Some(i) = strings::last_index_of_char(tmp, b':') {
+                    tmp = &tmp[i + 1..];
                 }
+            }
 
-                tmp
-            };
+            break 'brk tmp;
+        };
         (name, basename)
     }
 
@@ -498,11 +487,8 @@ impl ExtractTarball {
 
     /// Rename the freshly-extracted temp directory into the cache, read
     /// `package.json` if required, and build the `ExtractData` result. Shared
-    /// between the buffered and streaming extraction paths.
-    ///
-    /// `resolved` (GitHub) and `integrity` (local tarballs, see
-    /// `lockfile_integrity`) name the cache entry for the resolutions whose
-    /// entries are keyed by content rather than by the resolution string.
+    /// between the buffered and streaming extraction paths. `resolved` names a
+    /// GitHub cache entry, `integrity` a local tarball's.
     pub(crate) fn move_to_cache_directory(
         &self,
         log: &mut bun_ast::Log,
@@ -728,7 +714,7 @@ impl ExtractTarball {
                     }
                 }
 
-                match sys::renameat_concurrently_a(
+                sys::renameat_concurrently_a(
                     tmpdir.fd(),
                     tmpname.as_bytes(),
                     cache_dir.fd(),
@@ -737,27 +723,24 @@ impl ExtractTarball {
                         move_fallback: true,
                         keep_existing_destination: publish == CachePublish::KeepExisting,
                     },
-                ) {
-                    Ok(()) => Ok(()),
-                    Err(err) => {
-                        log.add_error_fmt(
-                            None,
-                            bun_ast::Loc::EMPTY,
-                            format_args!(
-                                "moving \"{}\" to cache dir failed: {}\n  From: {}\n    To: {}",
-                                bun_fmt::s(name),
-                                err,
-                                bun_fmt::s(tmpname.as_bytes()),
-                                bun_fmt::s(folder_name),
-                            ),
-                        );
-                        Err(crate::Error::InstallFailed)
-                    }
-                }
+                )
+                .map_err(|err| {
+                    log.add_error_fmt(
+                        None,
+                        bun_ast::Loc::EMPTY,
+                        format_args!(
+                            "moving \"{}\" to cache dir failed: {}\n  From: {}\n    To: {}",
+                            bun_fmt::s(name),
+                            err,
+                            bun_fmt::s(tmpname.as_bytes()),
+                            bun_fmt::s(folder_name),
+                        ),
+                    );
+                    crate::Error::InstallFailed
+                })
             };
 
-            // The temp name now holds our own copy (failed or lost), the
-            // superseded folder, or a `Replace` swap-out (see `CachePublish`).
+            // `tmpname` now holds our own copy (failed or lost) or the swapped-out folder.
             if moved.is_err() || publish != CachePublish::Replace {
                 let _ = tmpdir.delete_tree(tmpname.as_bytes());
             }
diff --git a/src/install/isolated_install/Installer.rs b/src/install/isolated_install/Installer.rs
index 3ee03dd03ef3..b94381b4a1da 100644
--- a/src/install/isolated_install/Installer.rs
+++ b/src/install/isolated_install/Installer.rs
@@ -1293,24 +1293,7 @@ impl Task {
                             }
                         };
                         if is_stale_link {
-                            let remove_err: Option<sys::Error> = {
-                                #[cfg(windows)]
-                                {
-                                    'win: {
-                                        if let Some(_e) = sys::rmdir(local.slice_z()).err() {
-                                            if let Some(e) = sys::unlink(local.slice_z()).err() {
-                                                break 'win Some(e);
-                                            }
-                                        }
-                                        break 'win None;
-                                    }
-                                }
-                                #[cfg(not(windows))]
-                                {
-                                    sys::unlink(local.slice_z()).err()
-                                }
-                            };
-                            if let Some(e) = remove_err {
+                            if let Err(e) = remove_link(local.slice_z()) {
                                 if e.get_errno() != sys::Errno::ENOENT {
                                     // Do NOT proceed: the backend below would
                                     // write *through* the still-live symlink
@@ -2546,13 +2529,13 @@ impl<'a> Installer<'a> {
                 let dep_name = dependencies[dep.dep_id as usize].name.slice(string_buf);
                 dest.set_length(base_len);
                 append_dependency_link_name(&mut dest, dep_name, entry_node_modules_name);
-                remove_link(dest.slice_z());
+                let _ = remove_link(dest.slice_z());
             }
         }
 
         for &entry_id in &self.failed_optional_entries {
             if entry_hoisted[entry_id.get() as usize] {
-                remove_link(self.hidden_node_modules_link_path(entry_id).slice_z());
+                let _ = remove_link(self.hidden_node_modules_link_path(entry_id).slice_z());
             }
         }
     }
@@ -2895,16 +2878,7 @@ impl<'a> Installer<'a> {
                     };
 
                     if is_symlink {
-                        #[cfg(windows)]
-                        {
-                            if sys::rmdir(dest.slice_z()).err().is_some() {
-                                let _ = sys::unlink(dest.slice_z());
-                            }
-                        }
-                        #[cfg(not(windows))]
-                        {
-                            let _ = sys::unlink(dest.slice_z());
-                        }
+                        let _ = remove_link(dest.slice_z());
                     } else {
                         let _ = Fd::cwd().delete_tree(dest.slice());
                     }
@@ -3195,15 +3169,15 @@ fn append_dependency_link_name(
     }
 }
 
-fn remove_link(path: &ZStr) {
+/// Removes a symlink; on Windows also a directory symlink or junction (dangling or not).
+pub(crate) fn remove_link(path: &ZStr) -> sys::Result<()> {
     #[cfg(windows)]
     {
-        // directory symlinks and junctions (dangling or not) go through rmdir
         if sys::rmdir(path).is_ok() {
-            return;
+            return Ok(());
         }
     }
-    let _ = sys::unlink(path);
+    sys::unlink(path)
 }
 
 fn is_rename_collision(err: &sys::Error) -> bool {
diff --git a/src/install/isolated_install/Store.rs b/src/install/isolated_install/Store.rs
index 4e23e9758c4c..4f225f80e8b2 100644
--- a/src/install/isolated_install/Store.rs
+++ b/src/install/isolated_install/Store.rs
@@ -7,7 +7,6 @@ use bstr::BStr;
 use bun_alloc::AllocError;
 use bun_collections::{ArrayHashMap, MultiArrayList};
 use bun_semver::String as SemverString;
-use bun_wyhash::Wyhash;
 
 use crate::lockfile::{Lockfile, package};
 use crate::{Dependency, DependencyID, INVALID_DEPENDENCY_ID, PackageID, Resolution};
@@ -358,58 +357,30 @@ pub mod entry {
         }
     }
 
-    /// Max bytes of resolution (the text after `name@`; a folder path or git/tarball
-    /// URL otherwise makes it arbitrarily long) in an entry name. The package directory
-    /// under the entry is the cwd of its lifecycle scripts, which Windows' `CreateProcess`
-    /// rejects past MAX_PATH (ENOENT) although bun's own file I/O accepts such paths.
-    /// 80 keeps versions and `github+owner+repo+<sha>` verbatim.
-    const MAX_RESOLUTION_LEN: usize = 80;
-    /// Longer resolutions become `<leading bytes>+<16 hex wyhash of the whole text>`,
-    /// `MAX_RESOLUTION_LEN` bytes at most.
-    const CUT_RESOLUTION_LEN: usize = MAX_RESOLUTION_LEN - "+".len() - 16;
-
-    /// The first `MAX_RESOLUTION_LEN` bytes written, plus the length and hash of all of them.
-    struct ResolutionSink {
-        buf: [u8; MAX_RESOLUTION_LEN],
-        len: usize,
-        hasher: Wyhash,
-    }
-
-    impl fmt::Write for ResolutionSink {
-        fn write_str(&mut self, s: &str) -> fmt::Result {
-            let bytes = s.as_bytes();
-            if let Some(room) = self.buf.get_mut(self.len..) {
-                let n = bytes.len().min(room.len());
-                room[..n].copy_from_slice(&bytes[..n]);
-            }
-            self.len += bytes.len();
-            self.hasher.update(bytes);
-            Ok(())
-        }
-    }
-
+    /// The text after `name@` in an entry name, capped at 80 bytes because the package directory
+    /// below is the cwd of lifecycle scripts and Windows' `CreateProcess` rejects one past
+    /// MAX_PATH. Versions and `github+owner+repo+<sha>` fit; a longer folder path or URL
+    /// becomes `<leading bytes>+<16 hex wyhash of the whole text>`.
     fn write_resolution(f: &mut fmt::Formatter<'_>, resolution: fmt::Arguments<'_>) -> fmt::Result {
-        let mut sink = ResolutionSink {
-            buf: [0; MAX_RESOLUTION_LEN],
-            len: 0,
-            hasher: Wyhash::init(0),
-        };
-        fmt::write(&mut sink, resolution)?;
-
-        if sink.len <= MAX_RESOLUTION_LEN {
-            return f.write_str(bun_core::str_utf8(&sink.buf[..sink.len]).ok_or(fmt::Error)?);
+        const MAX_RESOLUTION_LEN: usize = 80;
+        let mut buf = [0u8; MAX_RESOLUTION_LEN];
+        if let Ok(text) = bun_core::fmt::buf_print(&mut buf, resolution) {
+            return f.write_str(bun_core::str_utf8(text).ok_or(fmt::Error)?);
         }
-
-        let mut cut = CUT_RESOLUTION_LEN;
-        while !bun_core::strings::is_on_char_boundary(&sink.buf, cut) {
+        let text = resolution.to_string();
+        let mut cut = MAX_RESOLUTION_LEN - "+".len() - 16;
+        while !text.is_char_boundary(cut) {
             cut -= 1;
         }
-        f.write_str(bun_core::str_utf8(&sink.buf[..cut]).ok_or(fmt::Error)?)?;
-        write!(f, "+{:016x}", sink.hasher.final_())
+        write!(
+            f,
+            "{}+{:016x}",
+            &text[..cut],
+            bun_wyhash::hash(text.as_bytes())
+        )
     }
 
     /// `name@version` (or `name@file+path` / `name@root`) without the `+peerhash` suffix.
-    /// The resolution part is bounded by [`MAX_RESOLUTION_LEN`].
     pub struct StoreKeyFormatter<'a> {
         name: SemverString,
         resolution: &'a Resolution,
diff --git a/src/install/resolvers/folder_resolver.rs b/src/install/resolvers/folder_resolver.rs
index ef198b1fde43..9459337fa273 100644
--- a/src/install/resolvers/folder_resolver.rs
+++ b/src/install/resolvers/folder_resolver.rs
@@ -83,32 +83,22 @@ impl<'a> fmt::Display for PackageWorkspaceSearchPathFormatter<'a> {
     }
 }
 
-/// What a directory's `package.json` is read as. Each kind parses it with
-/// different `Features` and produces a different `Resolution`, so one
-/// directory is cached separately per kind: a `link:` and a `file:` pointing
-/// at the same directory are two packages, and whichever resolves first must
-/// not be handed out for the other.
+/// One directory resolves to a different package (`Features`, `Resolution`) per kind, so
+/// the folder-resolution map is keyed by both.
 #[derive(Copy, Clone, PartialEq, Eq, Hash)]
 pub(crate) enum Kind {
-    /// A `file:` dependency or a workspace member (`Features::FOLDER` /
-    /// `Features::WORKSPACE`, dependencies installed). These share an entry
-    /// so a `file:` pointing at a workspace member, or at the root package
-    /// seeded by `PackageManager::init`, resolves to that existing package.
+    /// `file:` dependencies and workspace members (and the root seeded by `PackageManager::init`).
     Folder,
-    /// A `link:` target (`Features::LINK`: its dependencies are not
-    /// installed, `Resolution::Symlink`).
+    /// `link:` targets (`Resolution::Symlink`, dependencies not installed).
     Link,
-    /// An npm package already extracted into the cache (`Features::NPM`,
-    /// `Resolution::Npm`).
+    /// npm packages already extracted into the cache (`Resolution::Npm`).
     CacheFolder,
 }
 
-/// Key of the folder-resolution map.
 #[derive(Copy, Clone, PartialEq, Eq, Hash)]
 pub(crate) struct Key {
     kind: Kind,
-    /// Hash of the normalized absolute `package.json` path; `Entry::abs_path`
-    /// holds the bytes it was computed from.
+    /// Of the normalized absolute `package.json` path kept in `Entry::abs_path`.
     abs_hash: u64,
 }
 
@@ -415,20 +405,6 @@ pub enum GlobalOrRelative<'a> {
     CacheFolder(&'a [u8]),
 }
 
-impl GlobalOrRelative<'_> {
-    /// Must agree with the resolver `get_or_put` picks for each variant.
-    fn kind(self) -> Kind {
-        match self {
-            GlobalOrRelative::Global(_) => Kind::Link,
-            GlobalOrRelative::Relative(
-                dependency::version::Tag::Folder | dependency::version::Tag::Workspace,
-            ) => Kind::Folder,
-            GlobalOrRelative::Relative(_) => unreachable!(),
-            GlobalOrRelative::CacheFolder(_) => Kind::CacheFolder,
-        }
-    }
-}
-
 pub(crate) fn get_or_put(
     global_or_relative: GlobalOrRelative<'_>,
     version: &dependency::Version,
@@ -456,7 +432,7 @@ pub(crate) fn get_or_put(
         // `(&[u8]).as_ptr().cast_mut()` would be UB under Stacked/Tree
         // Borrows: those pointers carry read-only provenance, and the
         // optimizer may assume `abs`'s bytes are unchanged when computing
-        // the `Key` below.
+        // `hash(abs.as_bytes())` below.
         //
         // Instead: capture lengths, let the shared borrows of `joined` die,
         // then take a fresh `&mut joined[..abs_len]` (write provenance) and
@@ -477,7 +453,13 @@ pub(crate) fn get_or_put(
             &rel_buf[..rel_len],
         )
     };
-    let key = Key::new(global_or_relative.kind(), abs.as_bytes());
+    // Must agree with the resolver picked for each variant below.
+    let kind = match global_or_relative {
+        GlobalOrRelative::Global(_) => Kind::Link,
+        GlobalOrRelative::Relative(_) => Kind::Folder,
+        GlobalOrRelative::CacheFolder(_) => Kind::CacheFolder,
+    };
+    let key = Key::new(kind, abs.as_bytes());
 
     // Check first, compute, then insert, because read_package_json_from_disk
     // needs &mut manager. Compare the stored path, not just its hash: a

From d997e8c8ce0acda78308f94aa4400c3b1429e88c Mon Sep 17 00:00:00 2001
From: Jarred Sumner <jarred@jarredsumner.com>
Date: Mon, 17 Aug 2026 05:44:49 +0000
Subject: [PATCH 192/258] simplify(s3-linkers): tighten
 unlink_failed_optional_entries and count_blocked_scripts; use
 is_local_package

(cherry picked from commit 8914d38893f87189c07c4f2fc897946e87e9d4c8)
---
 src/install/isolated_install.rs           |  6 +--
 src/install/isolated_install/Installer.rs | 52 +++++++----------------
 2 files changed, 17 insertions(+), 41 deletions(-)

diff --git a/src/install/isolated_install.rs b/src/install/isolated_install.rs
index 82524b14badb..2b0cc932ffcd 100644
--- a/src/install/isolated_install.rs
+++ b/src/install/isolated_install.rs
@@ -234,11 +234,7 @@ fn dependency_is_contained_folder(
     declarer: &Resolution,
     dep: &install::Dependency,
 ) -> bool {
-    if matches!(
-        declarer.tag,
-        ResolutionTag::Root | ResolutionTag::Workspace | ResolutionTag::Folder
-    ) || dep.version.tag != VersionTag::Folder
-    {
+    if declarer.tag.is_local_package() || dep.version.tag != VersionTag::Folder {
         return false;
     }
     let string_buf = lockfile.buffers.string_bytes.as_slice();
diff --git a/src/install/isolated_install/Installer.rs b/src/install/isolated_install/Installer.rs
index b94381b4a1da..8fb59e4eefe7 100644
--- a/src/install/isolated_install/Installer.rs
+++ b/src/install/isolated_install/Installer.rs
@@ -1696,8 +1696,6 @@ impl Task {
                         {
                             self.blocked_scripts = self.count_blocked_scripts(
                                 installer,
-                                manager_ref.get(),
-                                lockfile,
                                 pkg_script_lists[pkg_id as usize],
                                 dep.name.slice(string_buf),
                                 &pkg_res,
@@ -2024,12 +2022,11 @@ impl Task {
     fn count_blocked_scripts(
         &self,
         installer: &Installer<'_>,
-        manager: &PackageManager,
-        lockfile: &Lockfile,
         mut pkg_scripts: package::scripts::Scripts,
         dep_name: &[u8],
         pkg_res: &Resolution,
     ) -> u8 {
+        let (manager, lockfile) = (installer.manager(), installer.lockfile());
         // A global-store entry stays in its staging dir until `Step::Binaries` renames it; a
         // project-local one was renamed into place by `Step::LinkPackage`.
         let mut pkg_dir = AutoAbsPath::init_top_level_dir();
@@ -2489,52 +2486,35 @@ impl<'a> Installer<'a> {
         let pkg_names = lockfile.packages.items_name();
         let pkg_resolutions = lockfile.packages.items_resolution();
 
-        let entries = &self.store.entries;
-        let entry_node_ids = entries.items_node_id();
-        let entry_hoisted = entries.items_hoisted();
-
+        let entry_node_ids = self.store.entries.items_node_id();
         let nodes = &self.store.nodes;
-        let node_pkg_ids = nodes.items_pkg_id();
-        let node_dep_ids = nodes.items_dep_id();
 
         // Not `parents`: public hoisting adds root dependencies without recording a parent.
-        for (entry_index, entry_deps) in entries.items_dependencies().iter().enumerate() {
-            if !entry_deps
-                .slice()
-                .iter()
-                .any(|dep| self.failed_optional_entries.contains(&dep.entry_id))
-            {
-                continue;
-            }
-
-            let entry_id = StoreEntryId::from(u32::try_from(entry_index).expect("int cast"));
-            let node_id = entry_node_ids[entry_index];
-            let pkg_id = node_pkg_ids[node_id.get() as usize];
-            let dep_id = node_dep_ids[node_id.get() as usize];
-            let entry_node_modules_name = self.entry_store_node_modules_package_name(
-                dep_id,
-                pkg_id,
-                &pkg_resolutions[pkg_id as usize],
-                pkg_names,
-            );
-
-            let mut dest = AutoPath::init_top_level_dir();
-            self.append_real_store_node_modules_path(&mut dest, entry_id, Which::Final);
-            let base_len = dest.len();
-
+        for (entry_index, entry_deps) in self.store.entries.items_dependencies().iter().enumerate()
+        {
             for dep in entry_deps.slice() {
                 if !self.failed_optional_entries.contains(&dep.entry_id) {
                     continue;
                 }
+                let entry_id = StoreEntryId::from(u32::try_from(entry_index).expect("int cast"));
+                let node_id = entry_node_ids[entry_index].get() as usize;
+                let pkg_id = nodes.items_pkg_id()[node_id];
+                let entry_node_modules_name = self.entry_store_node_modules_package_name(
+                    nodes.items_dep_id()[node_id],
+                    pkg_id,
+                    &pkg_resolutions[pkg_id as usize],
+                    pkg_names,
+                );
+                let mut dest = AutoPath::init_top_level_dir();
+                self.append_real_store_node_modules_path(&mut dest, entry_id, Which::Final);
                 let dep_name = dependencies[dep.dep_id as usize].name.slice(string_buf);
-                dest.set_length(base_len);
                 append_dependency_link_name(&mut dest, dep_name, entry_node_modules_name);
                 let _ = remove_link(dest.slice_z());
             }
         }
 
         for &entry_id in &self.failed_optional_entries {
-            if entry_hoisted[entry_id.get() as usize] {
+            if self.store.entries.items_hoisted()[entry_id.get() as usize] {
                 let _ = remove_link(self.hidden_node_modules_link_path(entry_id).slice_z());
             }
         }

From e7f94966c3791883d61f6dbc7c6802c373555a22 Mon Sep 17 00:00:00 2001
From: Jarred Sumner <jarred@jarredsumner.com>
Date: Mon, 17 Aug 2026 05:47:05 +0000
Subject: [PATCH 193/258] simplify(s3-linkers): DependencyBinaries carries
 (entry, error) tuples; trim comments

(cherry picked from commit 30f8460988f21d91ebe8faaca92090ca3310e8bf)
---
 src/install/isolated_install/Installer.rs | 28 ++++++++---------------
 1 file changed, 9 insertions(+), 19 deletions(-)

diff --git a/src/install/isolated_install/Installer.rs b/src/install/isolated_install/Installer.rs
index 8fb59e4eefe7..f95498efc313 100644
--- a/src/install/isolated_install/Installer.rs
+++ b/src/install/isolated_install/Installer.rs
@@ -421,11 +421,11 @@ impl<'a> Installer<'a> {
                 );
             }
             TaskError::DependencyBinaries(dep_errs) => {
-                for dep_err in dep_errs.iter() {
-                    let dep_node_id = entry_node_ids[dep_err.dep_entry_id.get() as usize];
+                for &(dep_entry_id, dep_err) in dep_errs.iter() {
+                    let dep_node_id = entry_node_ids[dep_entry_id.get() as usize];
                     let dep_pkg_id = node_pkg_ids[dep_node_id.get() as usize];
                     Output::err(
-                        dep_err.err,
+                        dep_err,
                         "failed to link binaries of dependency {}@{} for package: {}@{}",
                         (
                             bstr::BStr::new(pkg_names[dep_pkg_id as usize].slice(string_buf)),
@@ -751,21 +751,15 @@ pub struct DownloadError {
     pub(crate) url: Box<[u8]>,
 }
 
-#[derive(Clone, Copy)]
-pub struct DependencyBinariesError {
-    pub(crate) dep_entry_id: StoreEntryId,
-    pub(crate) err: crate::Error,
-}
-
 pub enum TaskError {
     LinkPackage(sys::Error),
     SymlinkDependencies(sys::Error),
-    /// `<global link dir>/<link: target>` of this `link:` dependency does not
-    /// fit in a path buffer. See `Installer::append_dependency_path`.
+    /// See `Installer::append_dependency_path`.
     LinkPathTooLong(PackageID),
     RunScripts(crate::Error),
     Binaries(crate::Error),
-    DependencyBinaries(Box<[DependencyBinariesError]>),
+    /// (dependency entry, error)
+    DependencyBinaries(Box<[(StoreEntryId, crate::Error)]>),
     Patching(Log),
     Download(DownloadError),
 }
@@ -1211,8 +1205,7 @@ impl Task {
                                     patch_info.contents_hash(),
                                 ),
                                 ResolutionTag::LocalTarball => {
-                                    // Recorded by the lockfile or by
-                                    // `on_package_extracted` before this task started.
+                                    // recorded by the lockfile or `on_package_extracted`
                                     debug_assert!(
                                         pkg_metas[pkg_id as usize].integrity.tag.is_supported()
                                     );
@@ -2550,7 +2543,7 @@ impl<'a> Installer<'a> {
         let mut link_rel_buf = paths::path_buffer_pool::get();
 
         let mut seen: StringHashMap<()> = StringHashMap::default();
-        let mut failed: Vec<DependencyBinariesError> = Vec::new();
+        let mut failed = Vec::new();
 
         let mut node_modules_path = DefaultAbsPath::init_top_level_dir();
         self.append_real_store_node_modules_path(
@@ -2649,10 +2642,7 @@ impl<'a> Installer<'a> {
             }
 
             if let Some(err) = bin_linker.err {
-                failed.push(DependencyBinariesError {
-                    dep_entry_id: dep.entry_id,
-                    err,
-                });
+                failed.push((dep.entry_id, err));
             }
         }
 

From 11761e850a3d3051dbd756554633a016c0b6bc41 Mon Sep 17 00:00:00 2001
From: Jarred Sumner <jarred@jarredsumner.com>
Date: Mon, 17 Aug 2026 05:48:54 +0000
Subject: [PATCH 194/258] simplify(s3-linkers): contained_folders returns the
 two bitsets; empty cache subpath as a match guard

(cherry picked from commit 82be6e07bc535fce4debbf7bca299a1fb541a6a9)
---
 src/install/PackageInstall.rs   |  7 +--
 src/install/isolated_install.rs | 77 ++++++++++++++-------------------
 2 files changed, 35 insertions(+), 49 deletions(-)

diff --git a/src/install/PackageInstall.rs b/src/install/PackageInstall.rs
index 9099791664f4..1934b0f0d0e1 100644
--- a/src/install/PackageInstall.rs
+++ b/src/install/PackageInstall.rs
@@ -2275,13 +2275,10 @@ impl<'a> PackageInstall<'a> {
         package_id: PackageID,
         resolution_tag: resolution::Tag,
     ) -> bool {
-        // No entry can be named yet (a local tarball whose integrity the
-        // lockfile does not record); extracting it is what names one.
-        if self.cache_dir_subpath.is_empty() {
-            return true;
-        }
         let state = manager.get_preinstall_state(package_id);
         match state {
+            // no entry name until extraction records a local tarball's integrity
+            _ if self.cache_dir_subpath.is_empty() => true,
             crate::PreinstallState::Done => false,
             _ => {
                 let exists = if self.patch.is_none() {
diff --git a/src/install/isolated_install.rs b/src/install/isolated_install.rs
index 2b0cc932ffcd..75a376c27516 100644
--- a/src/install/isolated_install.rs
+++ b/src/install/isolated_install.rs
@@ -243,32 +243,23 @@ fn dependency_is_contained_folder(
         .contains_name(dep.name_hash, dep.name.slice(string_buf), string_buf)
 }
 
-/// `dependency_is_contained_folder` evaluated once for the whole lockfile.
-struct ContainedFolders {
-    /// Indexed by `DependencyID`.
-    dependencies: DynamicBitSet,
-    /// Indexed by `PackageID`: folders only such dependencies resolve to. They get
-    /// no store entry (`store::entry::Entry::nested_folder`).
-    packages: DynamicBitSet,
-}
-
-fn contained_folders(lockfile: &Lockfile) -> Result<ContainedFolders, AllocError> {
+/// `dependency_is_contained_folder` for every `DependencyID`, and the `PackageID`s only such
+/// dependencies resolve to: they get no store entry (`store::entry::Entry::nested_folder`).
+fn contained_folders(lockfile: &Lockfile) -> Result<(DynamicBitSet, DynamicBitSet), AllocError> {
     let pkgs = lockfile.packages.slice();
     let pkg_resolutions = pkgs.items_resolution();
     let resolutions = &lockfile.buffers.resolutions[..];
     let dependencies = &lockfile.buffers.dependencies[..];
 
-    let mut contained = ContainedFolders {
-        dependencies: DynamicBitSet::init_empty(dependencies.len())?,
-        packages: DynamicBitSet::init_empty(pkg_resolutions.len())?,
-    };
+    let mut contained = DynamicBitSet::init_empty(dependencies.len())?;
+    let mut nested = DynamicBitSet::init_empty(pkg_resolutions.len())?;
     for (pkg_id, pkg_res) in pkg_resolutions.iter().enumerate() {
         if pkg_res.tag == ResolutionTag::Folder {
-            contained.packages.set(pkg_id);
+            nested.set(pkg_id);
         }
     }
-    if contained.packages.count() == 0 {
-        return Ok(contained);
+    if nested.count() == 0 {
+        return Ok((contained, nested));
     }
 
     for (pkg_id, pkg_deps) in pkgs.items_dependencies().iter().enumerate() {
@@ -285,14 +276,14 @@ fn contained_folders(lockfile: &Lockfile) -> Result<ContainedFolders, AllocError
                 &pkg_resolutions[pkg_id],
                 &dependencies[dep_id as usize],
             ) {
-                contained.dependencies.set(dep_id as usize);
+                contained.set(dep_id as usize);
             } else {
-                contained.packages.unset(target as usize);
+                nested.unset(target as usize);
             }
         }
     }
 
-    Ok(contained)
+    Ok((contained, nested))
 }
 
 /// `pkg_id` has a `dependency_is_contained_folder` dependency resolving to `folder_pkg_id`.
@@ -331,8 +322,8 @@ pub(crate) fn build_store(
     let dependencies = &lockfile.buffers.dependencies[..];
     let string_buf = &lockfile.buffers.string_bytes[..];
 
-    let contained = contained_folders(lockfile)?;
-    let is_contained_folder = |dep_id: DependencyID| contained.dependencies.is_set(dep_id as usize);
+    let (contained, nested_folders) = contained_folders(lockfile)?;
+    let is_contained_folder = |dep_id: DependencyID| contained.is_set(dep_id as usize);
 
     let mut nodes: store::node::List = store::node::List::default();
 
@@ -392,8 +383,7 @@ pub(crate) fn build_store(
 
         // Per-package bits computed once: own peer-dep names, and non-peer
         // dependency names that will appear in `node_dependencies` (i.e., not
-        // filtered out by bundled/disabled/unresolved) and are peer providers for
-        // the packages below (contained folders are not, see the walk below).
+        // filtered out by bundled/disabled/unresolved).
         let own_peers: DynamicBitSetList =
             DynamicBitSetList::init_empty(lockfile.packages.len(), peer_name_count as usize)?;
         let provides: DynamicBitSetList =
@@ -1122,7 +1112,7 @@ pub(crate) fn build_store(
         let new_entry_parents: Vec<store::entry::Id> = vec![entry.entry_parent_id];
 
         // never hoisted, so it must not claim the hoist slots for its name below
-        let new_entry_nested_folder = contained.packages.is_set(pkg_id as usize);
+        let new_entry_nested_folder = nested_folders.is_set(pkg_id as usize);
 
         let hoisted = 'hoisted: {
             if !manager.options.hoist || new_entry_nested_folder {
@@ -2378,26 +2368,25 @@ pub(crate) fn install_isolated_packages(
                         installer.manager_mut().get_cache_directory_and_abs_path();
                     let _ = &cache_dir_path; // dropped at scope exit
 
-                    // An empty name is a local tarball whose integrity the lockfile
-                    // does not record; extracting it is what names its entry.
-                    let missing_from_cache = cache_subpath_z.is_empty()
-                        || match installer.manager().get_preinstall_state(pkg_id) {
-                            install::PreinstallState::Done => false,
-                            _ => {
-                                let exists = package_manager::directories::is_package_in_cache_at(
-                                    cache_dir,
-                                    cache_subpath_z,
-                                    pkg_res_tag,
-                                );
-                                if exists {
-                                    installer.manager_mut().set_preinstall_state(
-                                        pkg_id,
-                                        install::PreinstallState::Done,
-                                    );
-                                }
-                                !exists
+                    let missing_from_cache = match installer.manager().get_preinstall_state(pkg_id)
+                    {
+                        // no entry name until extraction records a local tarball's integrity
+                        _ if cache_subpath_z.is_empty() => true,
+                        install::PreinstallState::Done => false,
+                        _ => {
+                            let exists = package_manager::directories::is_package_in_cache_at(
+                                cache_dir,
+                                cache_subpath_z,
+                                pkg_res_tag,
+                            );
+                            if exists {
+                                installer
+                                    .manager_mut()
+                                    .set_preinstall_state(pkg_id, install::PreinstallState::Done);
                             }
-                        };
+                            !exists
+                        }
+                    };
 
                     if !missing_from_cache {
                         if let installer::PatchInfo::Patch(patch) = &patch_info {

From 8cc893c789bee6495e51fb007d79dde12cb52166 Mon Sep 17 00:00:00 2001
From: Jarred Sumner <jarred@jarredsumner.com>
Date: Mon, 17 Aug 2026 05:50:27 +0000
Subject: [PATCH 195/258] simplify(s3-linkers): remove_stale_workspace_links
 builds each path fresh; import/doc nits

(cherry picked from commit bef40bc23a145daf1cb1b383ed2282ecd18ad7de)
---
 .../PackageManager/remove_stale_workspace_links.rs | 14 ++++----------
 src/install/isolated_install/Installer.rs          |  7 +++----
 2 files changed, 7 insertions(+), 14 deletions(-)

diff --git a/src/install/PackageManager/remove_stale_workspace_links.rs b/src/install/PackageManager/remove_stale_workspace_links.rs
index 7e955c499003..8fc0b0e1ce18 100644
--- a/src/install/PackageManager/remove_stale_workspace_links.rs
+++ b/src/install/PackageManager/remove_stale_workspace_links.rs
@@ -23,22 +23,16 @@ pub(crate) fn remove_stale_workspace_links(previous: &Lockfile, current: &Lockfi
             continue;
         }
 
-        let mut path = AutoAbsPathChecked::init_top_level_dir();
-        let top_level_len = path.len();
-        remove_link_in(&mut path, b"", name);
+        remove_link_in(b"", name);
         for workspace_path in current.workspace_paths.values() {
-            path.set_length(top_level_len);
-            remove_link_in(
-                &mut path,
-                workspace_path.slice(&current.buffers.string_bytes),
-                name,
-            );
+            remove_link_in(workspace_path.slice(&current.buffers.string_bytes), name);
         }
     }
 }
 
 /// `readlink` is the symlink (or junction) check; a real directory or file there is left alone.
-fn remove_link_in(path: &mut AutoAbsPathChecked, package_dir: &[u8], name: &[u8]) {
+fn remove_link_in(package_dir: &[u8], name: &[u8]) {
+    let mut path = AutoAbsPathChecked::init_top_level_dir();
     if path.append(package_dir).is_err()
         || path.append(b"node_modules").is_err()
         || path.append(name).is_err()
diff --git a/src/install/isolated_install/Installer.rs b/src/install/isolated_install/Installer.rs
index f95498efc313..a64462dc6726 100644
--- a/src/install/isolated_install/Installer.rs
+++ b/src/install/isolated_install/Installer.rs
@@ -3,8 +3,7 @@ use std::io::Write as _;
 
 use bun_ast::Log;
 use bun_collections::{ArrayHashMap, DynamicBitSet, StringHashMap};
-use bun_core::fmt::EscapeControlChars;
-use bun_core::fmt::redacted;
+use bun_core::fmt::{EscapeControlChars, redacted};
 use bun_core::{Environment, Global, Output};
 use bun_core::{ZStr, strings};
 use bun_paths::{self as paths, AbsPath, AutoAbsPath, AutoRelPath};
@@ -3117,8 +3116,8 @@ impl<'a> Installer<'a> {
 
 #[derive(Clone, Copy, PartialEq, Eq)]
 pub enum Which {
-    /// The published location. Use for symlink *targets* that point at other
-    /// entries, and for the warm-hit check.
+    /// The published location (`<cache>/links/<entry>`). Use for symlink
+    /// *targets* that point at other entries, and for the warm-hit check.
     Final,
     /// What the build steps write into, renamed onto `Final` once complete: the
     /// whole entry (`<entry>.tmp-<suffix>`) for a global-store entry, only the

From 9af2977e69fed0463ea3c56033968531e7181f5e Mon Sep 17 00:00:00 2001
From: Jarred Sumner <jarred@jarredsumner.com>
Date: Mon, 17 Aug 2026 05:52:19 +0000
Subject: [PATCH 196/258] simplify(s3-linkers): keep
 link_to_hidden_node_modules as on main; build the hidden link path inline
 when unlinking failed optional entries

(cherry picked from commit 1c26a181121bef89b0e34aea7057f5635fb012ac)
---
 src/install/isolated_install/Installer.rs | 22 +++++++---------------
 src/install/isolated_install/Store.rs     |  2 +-
 src/install/resolution.rs                 |  5 ++---
 3 files changed, 10 insertions(+), 19 deletions(-)

diff --git a/src/install/isolated_install/Installer.rs b/src/install/isolated_install/Installer.rs
index a64462dc6726..511b92167446 100644
--- a/src/install/isolated_install/Installer.rs
+++ b/src/install/isolated_install/Installer.rs
@@ -2249,8 +2249,7 @@ impl<'a> Installer<'a> {
         Ok(PatchInfo::None)
     }
 
-    /// `node_modules/.bun/node_modules/<package name>`
-    fn hidden_node_modules_link_path(&self, entry_id: StoreEntryId) -> AutoPath {
+    pub(crate) fn link_to_hidden_node_modules(&self, entry_id: StoreEntryId) {
         let string_buf = self.lockfile().buffers.string_bytes.as_slice();
 
         let node_id = self.store.entries.items_node_id()[entry_id.get() as usize];
@@ -2273,18 +2272,6 @@ impl<'a> Installer<'a> {
         );
         let _ = hidden_hoisted_node_modules.append(pkg_name.slice(string_buf)); // OOM/capacity: fire-and-forget
 
-        hidden_hoisted_node_modules
-    }
-
-    pub(crate) fn link_to_hidden_node_modules(&self, entry_id: StoreEntryId) {
-        let string_buf = self.lockfile().buffers.string_bytes.as_slice();
-
-        let node_id = self.store.entries.items_node_id()[entry_id.get() as usize];
-        let pkg_id = self.store.nodes.items_pkg_id()[node_id.get() as usize];
-        let pkg_name = self.lockfile().packages.items_name()[pkg_id as usize];
-
-        let hidden_hoisted_node_modules = self.hidden_node_modules_link_path(entry_id);
-
         let mut target = AutoRelPath::init();
 
         let _ = target.append(b".."); // OOM/capacity: fire-and-forget
@@ -2507,7 +2494,12 @@ impl<'a> Installer<'a> {
 
         for &entry_id in &self.failed_optional_entries {
             if self.store.entries.items_hoisted()[entry_id.get() as usize] {
-                let _ = remove_link(self.hidden_node_modules_link_path(entry_id).slice_z());
+                let node_id = entry_node_ids[entry_id.get() as usize].get() as usize;
+                let pkg_name = pkg_names[nodes.items_pkg_id()[node_id] as usize].slice(string_buf);
+                let mut hidden = AutoPath::init();
+                let _ = hidden.append_fmt(format_args!("{NODE_MODULES_BUN}/node_modules"));
+                let _ = hidden.append(pkg_name);
+                let _ = remove_link(hidden.slice_z());
             }
         }
     }
diff --git a/src/install/isolated_install/Store.rs b/src/install/isolated_install/Store.rs
index 4f225f80e8b2..27c5fbff18e8 100644
--- a/src/install/isolated_install/Store.rs
+++ b/src/install/isolated_install/Store.rs
@@ -283,7 +283,7 @@ pub mod entry {
         // if true this entry gets symlinked to `node_modules/.bun/node_modules`
         pub hoisted: bool,
 
-        /// Exists only inside the packages declaring it (`isolated_install::ContainedFolders`):
+        /// Exists only inside the packages declaring it (`isolated_install::contained_folders`):
         /// no store directory, task or hoist slot; linked in `Installer::symlink_dependencies`.
         pub nested_folder: bool,
 
diff --git a/src/install/resolution.rs b/src/install/resolution.rs
index d2b771cb8857..65e0edd1cbb0 100644
--- a/src/install/resolution.rs
+++ b/src/install/resolution.rs
@@ -1003,9 +1003,8 @@ impl Tag {
         self == Tag::Git || self == Tag::Github
     }
 
-    /// The root, a workspace, or a `file:` folder: a package.json of the project's own,
-    /// so its dependencies get `local_package_features` and `Package::parse` stored its
-    /// `file:` paths relative to the top-level dir.
+    /// The root, a workspace, or a `file:` folder: the project's own package.json, parsed with
+    /// `local_package_features` and its `file:` paths stored relative to the top-level dir.
     pub(crate) fn is_local_package(self) -> bool {
         self == Tag::Root || self == Tag::Workspace || self == Tag::Folder
     }

From b220be0584cebf6f1309368c6df49a934ce3f957 Mon Sep 17 00:00:00 2001
From: Jarred Sumner <jarred@jarredsumner.com>
Date: Mon, 17 Aug 2026 05:56:07 +0000
Subject: [PATCH 197/258] simplify(s3-linkers): install into StagingPath
 through a re-targeted PackageInstall instead of threading dest_subpath
 through every backend

(cherry picked from commit be73dc48914b0b821f638491884bd9da8863c513)
---
 src/install/PackageInstall.rs | 85 ++++++++++++++---------------------
 1 file changed, 34 insertions(+), 51 deletions(-)

diff --git a/src/install/PackageInstall.rs b/src/install/PackageInstall.rs
index 1934b0f0d0e1..45f69ae30a59 100644
--- a/src/install/PackageInstall.rs
+++ b/src/install/PackageInstall.rs
@@ -1017,7 +1017,6 @@ impl<'a> PackageInstall<'a> {
     fn install_with_clonefile_each_dir(
         &mut self,
         destination_dir: &Dir,
-        dest_subpath: &ZStr,
     ) -> crate::Result<InstallResult> {
         let cached_package_dir = match open_dir(self.cache_dir, self.cache_dir_subpath) {
             Ok(d) => d,
@@ -1080,13 +1079,12 @@ impl<'a> PackageInstall<'a> {
             Ok(())
         }
 
-        let subdir = match destination_dir
-            .make_open_path(dest_subpath.as_bytes(), OpenDirOptions::default())
-        {
+        let subdir = match destination_dir.make_open_path(
+            self.destination_dir_subpath.as_bytes(),
+            OpenDirOptions::default(),
+        ) {
             Ok(d) => d,
-            Err(err) => {
-                return Ok(InstallResult::fail(err.into(), Step::OpeningDestDir, None));
-            }
+            Err(err) => return Ok(InstallResult::fail(err.into(), Step::OpeningDestDir, None)),
         };
         if let Err(err) = copy(&subdir, &mut walker_) {
             return Ok(InstallResult::fail(err, Step::CopyingFiles, None));
@@ -1097,14 +1095,11 @@ impl<'a> PackageInstall<'a> {
 
     // https://www.unix.com/man-page/mojave/2/fclonefileat/
     #[cfg(target_os = "macos")]
-    fn install_with_clonefile(
-        &mut self,
-        destination_dir: &Dir,
-        dest_subpath: &ZStr,
-    ) -> crate::Result<InstallResult> {
-        if dest_subpath.as_bytes()[0] == b'@' {
-            if let Some(slash) = strings::index_of_char_usize(dest_subpath.as_bytes(), SEP) {
-                let _ = destination_dir.make_dir(&dest_subpath.as_bytes()[..slash]);
+    fn install_with_clonefile(&mut self, destination_dir: &Dir) -> crate::Result<InstallResult> {
+        if self.destination_dir_subpath.as_bytes()[0] == b'@' {
+            if let Some(slash) = strings::index_of_char_z(self.destination_dir_subpath, SEP) {
+                let subdir = &self.destination_dir_subpath.as_bytes()[..slash as usize];
+                let _ = destination_dir.make_dir(subdir);
             }
         }
 
@@ -1112,7 +1107,7 @@ impl<'a> PackageInstall<'a> {
             self.cache_dir,
             self.cache_dir_subpath,
             destination_dir.fd(),
-            dest_subpath,
+            self.destination_dir_subpath,
         ) {
             Ok(()) => Ok(InstallResult::Success),
             Err(e) => match e.get_errno() {
@@ -1123,9 +1118,7 @@ impl<'a> PackageInstall<'a> {
                 // But, this can happen if this package contains a node_modules folder
                 // We want to continue installing as many packages as we can, so we shouldn't block while downloading
                 // We use the slow path in this case
-                sys::Errno::EEXIST => {
-                    self.install_with_clonefile_each_dir(destination_dir, dest_subpath)
-                }
+                sys::Errno::EEXIST => self.install_with_clonefile_each_dir(destination_dir),
                 sys::Errno::EACCES => Err(crate::Error::Sys(bun_errno::SystemErrno::EACCES)),
                 _ => Err(crate::Error::Unexpected),
             },
@@ -1135,10 +1128,10 @@ impl<'a> PackageInstall<'a> {
     fn init_install_dir(
         &mut self,
         destination_dir: &Dir,
-        destpath: &ZStr,
         method: Method,
     ) -> Result<InstallDirState, Box<Failure>> {
         let destbase = destination_dir;
+        let destpath = self.destination_dir_subpath;
 
         let cached_package_dir = match {
             #[cfg(windows)]
@@ -1295,13 +1288,8 @@ impl<'a> PackageInstall<'a> {
         }
     }
 
-    fn install_with_copyfile(
-        &mut self,
-        destination_dir: &Dir,
-        dest_subpath: &ZStr,
-    ) -> InstallResult {
-        let mut state = match self.init_install_dir(destination_dir, dest_subpath, Method::Copyfile)
-        {
+    fn install_with_copyfile(&mut self, destination_dir: &Dir) -> InstallResult {
+        let mut state = match self.init_install_dir(destination_dir, Method::Copyfile) {
             Ok(state) => state,
             Err(failure) => return InstallResult::Failure(failure),
         };
@@ -1545,12 +1533,8 @@ impl<'a> PackageInstall<'a> {
         InstallResult::Success
     }
 
-    fn install_with_hardlink(
-        &mut self,
-        dest_dir: &Dir,
-        dest_subpath: &ZStr,
-    ) -> crate::Result<InstallResult> {
-        let mut state = match self.init_install_dir(dest_dir, dest_subpath, Method::Hardlink) {
+    fn install_with_hardlink(&mut self, dest_dir: &Dir) -> crate::Result<InstallResult> {
+        let mut state = match self.init_install_dir(dest_dir, Method::Hardlink) {
             Ok(state) => state,
             Err(failure) => return Ok(InstallResult::Failure(failure)),
         };
@@ -1737,12 +1721,8 @@ impl<'a> PackageInstall<'a> {
         Ok(InstallResult::Success)
     }
 
-    fn install_with_symlink(
-        &mut self,
-        dest_dir: &Dir,
-        dest_subpath: &ZStr,
-    ) -> crate::Result<InstallResult> {
-        let mut state = match self.init_install_dir(dest_dir, dest_subpath, Method::Symlink) {
+    fn install_with_symlink(&mut self, dest_dir: &Dir) -> crate::Result<InstallResult> {
+        let mut state = match self.init_install_dir(dest_dir, Method::Symlink) {
             Ok(state) => state,
             Err(failure) => return Ok(InstallResult::Failure(failure)),
         };
@@ -2326,7 +2306,7 @@ impl<'a> PackageInstall<'a> {
         &mut self,
         skip_delete: bool,
         destination_dir: &Dir,
-        method: Method,
+        method_: Method,
         resolution_tag: resolution::Tag,
     ) -> InstallResult {
         let _tracer = bun_core::perf::trace("PackageInstaller.install");
@@ -2353,9 +2333,13 @@ impl<'a> PackageInstall<'a> {
             return InstallResult::fail(err.into(), Step::OpeningDestDir, None);
         }
 
-        if let failure @ InstallResult::Failure(_) =
-            self.install_into(destination_dir, staging, method, resolution_tag)
-        {
+        let staged = PackageInstall {
+            destination_dir_subpath: staging,
+            progress: self.progress.as_deref_mut(),
+            ..*self
+        }
+        .install_into(destination_dir, method_, resolution_tag);
+        if let failure @ InstallResult::Failure(_) = staged {
             let _ = destination_dir.delete_tree(staging.as_bytes());
             return failure;
         }
@@ -2380,11 +2364,10 @@ impl<'a> PackageInstall<'a> {
     fn install_into(
         &mut self,
         destination_dir: &Dir,
-        dest_subpath: &ZStr,
-        method: Method,
+        method_: Method,
         resolution_tag: resolution::Tag,
     ) -> InstallResult {
-        let mut supported_method_to_use = method;
+        let mut supported_method_to_use = method_;
 
         if resolution_tag == resolution::Tag::Folder
             && !self
@@ -2400,7 +2383,7 @@ impl<'a> PackageInstall<'a> {
                 {
                     // First, attempt to use clonefile
                     // if that fails due to ENOTSUP, mark it as unsupported and then fall back to copyfile
-                    match self.install_with_clonefile(destination_dir, dest_subpath) {
+                    match self.install_with_clonefile(destination_dir) {
                         Ok(result) => return result,
                         Err(err) => {
                             if err == crate::Error::NotSupported {
@@ -2422,7 +2405,7 @@ impl<'a> PackageInstall<'a> {
             Method::ClonefileEachDir => {
                 #[cfg(target_os = "macos")]
                 {
-                    match self.install_with_clonefile_each_dir(destination_dir, dest_subpath) {
+                    match self.install_with_clonefile_each_dir(destination_dir) {
                         Ok(result) => return result,
                         Err(err) => {
                             if err == crate::Error::NotSupported {
@@ -2443,7 +2426,7 @@ impl<'a> PackageInstall<'a> {
             }
             #[allow(unused_labels)]
             Method::Hardlink => 'outer: {
-                match self.install_with_hardlink(destination_dir, dest_subpath) {
+                match self.install_with_hardlink(destination_dir) {
                     Ok(result) => return result,
                     Err(err) => {
                         #[cfg(not(windows))]
@@ -2468,7 +2451,7 @@ impl<'a> PackageInstall<'a> {
                 }
             }
             Method::Symlink => {
-                return match self.install_with_symlink(destination_dir, dest_subpath) {
+                return match self.install_with_symlink(destination_dir) {
                     Ok(result) => result,
                     Err(err) => {
                         if err == crate::Error::Sys(bun_errno::SystemErrno::ENOENT) {
@@ -2487,7 +2470,7 @@ impl<'a> PackageInstall<'a> {
         }
 
         // TODO: linux io_uring
-        self.install_with_copyfile(destination_dir, dest_subpath)
+        self.install_with_copyfile(destination_dir)
     }
 }
 

From 5d7286f8101c2de7de854dbdfe3bc6fa3a877726 Mon Sep 17 00:00:00 2001
From: Jarred Sumner <jarred@jarredsumner.com>
Date: Mon, 17 Aug 2026 05:57:01 +0000
Subject: [PATCH 198/258] simplify(s3-linkers): qualify path::SEP so the import
 is not unused on Windows

(cherry picked from commit 3fc6db6a9cc499738fb2c74413d2251152a93b8c)
---
 src/install/PackageInstall.rs | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/src/install/PackageInstall.rs b/src/install/PackageInstall.rs
index 45f69ae30a59..bc3c9bf376a7 100644
--- a/src/install/PackageInstall.rs
+++ b/src/install/PackageInstall.rs
@@ -5,7 +5,7 @@ use bun_core::Progress::Progress;
 use bun_core::{Global, Output};
 use bun_core::{MutableString, ZStr};
 use bun_paths::strings;
-use bun_paths::{self as path, OSPathChar, OSPathSlice, PathBuffer, SEP};
+use bun_paths::{self as path, OSPathChar, OSPathSlice, PathBuffer};
 use bun_semver::String as SemverString;
 #[cfg(not(windows))]
 use bun_sys::OpenDirOptions;
@@ -1097,7 +1097,7 @@ impl<'a> PackageInstall<'a> {
     #[cfg(target_os = "macos")]
     fn install_with_clonefile(&mut self, destination_dir: &Dir) -> crate::Result<InstallResult> {
         if self.destination_dir_subpath.as_bytes()[0] == b'@' {
-            if let Some(slash) = strings::index_of_char_z(self.destination_dir_subpath, SEP) {
+            if let Some(slash) = strings::index_of_char_z(self.destination_dir_subpath, path::SEP) {
                 let subdir = &self.destination_dir_subpath.as_bytes()[..slash as usize];
                 let _ = destination_dir.make_dir(subdir);
             }
@@ -1735,8 +1735,8 @@ impl<'a> PackageInstall<'a> {
         {
             let cache_dir_path = sys::get_fd_path(state.walker.root(), &mut buf2)?;
             let cache_len = cache_dir_path.len();
-            if cache_len > 0 && cache_dir_path[cache_len - 1] != SEP {
-                buf2[cache_len] = SEP;
+            if cache_len > 0 && cache_dir_path[cache_len - 1] != path::SEP {
+                buf2[cache_len] = path::SEP;
                 to_copy_buf2_offset = cache_len + 1;
             } else {
                 to_copy_buf2_offset = cache_len;

From c82f93447fe24cb5bc2ca014e99244d2b8e7390e Mon Sep 17 00:00:00 2001
From: Jarred Sumner <jarred@jarredsumner.com>
Date: Mon, 17 Aug 2026 05:57:39 +0000
Subject: [PATCH 199/258] simplify(s3-linkers): LinkPathTooLong always names
 the failing entry's own package

(cherry picked from commit 7881bef6c9333d9ae6d6702d85c0ac5fb74ccb2b)
---
 src/install/isolated_install/Installer.rs | 12 +++++-------
 1 file changed, 5 insertions(+), 7 deletions(-)

diff --git a/src/install/isolated_install/Installer.rs b/src/install/isolated_install/Installer.rs
index 511b92167446..0632a56fea99 100644
--- a/src/install/isolated_install/Installer.rs
+++ b/src/install/isolated_install/Installer.rs
@@ -399,13 +399,11 @@ impl<'a> Installer<'a> {
                     (&pkg_name, &pkg_res_fmt),
                 );
             }
-            TaskError::LinkPathTooLong(link_pkg_id) => {
+            TaskError::LinkPathTooLong => {
                 Output::err(
                     "ENAMETOOLONG",
                     "link path for package <b>{}<r> is too long",
-                    (bstr::BStr::new(
-                        pkg_names[*link_pkg_id as usize].slice(string_buf),
-                    ),),
+                    (&pkg_name,),
                 );
             }
             TaskError::Patching(patch_log) => {
@@ -754,7 +752,7 @@ pub enum TaskError {
     LinkPackage(sys::Error),
     SymlinkDependencies(sys::Error),
     /// See `Installer::append_dependency_path`.
-    LinkPathTooLong(PackageID),
+    LinkPathTooLong,
     RunScripts(crate::Error),
     Binaries(crate::Error),
     /// (dependency entry, error)
@@ -768,7 +766,7 @@ impl TaskError {
         match self {
             TaskError::LinkPackage(err) => TaskError::LinkPackage(err.clone()),
             TaskError::SymlinkDependencies(err) => TaskError::SymlinkDependencies(err.clone()),
-            TaskError::LinkPathTooLong(pkg_id) => TaskError::LinkPathTooLong(*pkg_id),
+            TaskError::LinkPathTooLong => TaskError::LinkPathTooLong,
             TaskError::Binaries(err) => TaskError::Binaries(*err),
             TaskError::DependencyBinaries(errs) => TaskError::DependencyBinaries(errs.clone()),
             TaskError::RunScripts(err) => TaskError::RunScripts(*err),
@@ -2957,7 +2955,7 @@ impl<'a> Installer<'a> {
             &mut join_buf[..],
             &[link_target],
         ) else {
-            return Err(TaskError::LinkPathTooLong(pkg_id));
+            return Err(TaskError::LinkPathTooLong);
         };
 
         paths::PathLike::clear(buf);

From 9bface29da4721f8231b70fa2d957436fb3d5d72 Mon Sep 17 00:00:00 2001
From: Jarred Sumner <jarred@jarredsumner.com>
Date: Mon, 17 Aug 2026 05:38:15 +0000
Subject: [PATCH 200/258] simplify(s2-paths): one checked NUL-terminated join
 and one normalize spill in resolve_path

Move bin.rs's join_z_checked into bun_paths::resolve_path as
join_abs_string_buf_z_checked and use it from bin.rs, the user .npmrc
lookup, --cwd handling and pack --filename. Keep only the NUL-terminated
normalize_buf_z_spill (callers that want bytes call as_bytes) and share
one buf_or_spill helper with join_z_buf_spill.

(cherry picked from commit 22e0223d6c614b50bf2460c963640fd2bab1c280)
---
 src/install/PackageManager.rs                 |  46 ++---
 .../PackageManager/CommandLineArguments.rs    |  38 ++--
 src/install/bin.rs                            |  38 ++--
 src/paths/resolve_path.rs                     | 184 ++++++------------
 src/runtime/cli/pack_command.rs               |  27 +--
 src/runtime/cli/publish_command.rs            |   9 +-
 6 files changed, 107 insertions(+), 235 deletions(-)

diff --git a/src/install/PackageManager.rs b/src/install/PackageManager.rs
index 71b137566607..0662a15bf4bc 100644
--- a/src/install/PackageManager.rs
+++ b/src/install/PackageManager.rs
@@ -20,7 +20,7 @@ use bun_event_loop::{self, AnyEventLoop, EventLoopHandle};
 use bun_http as http;
 use bun_ini as ini;
 use bun_paths::resolve_path::{self, PosixToWinNormalizer, platform};
-use bun_paths::{DELIMITER, MAX_PATH_BYTES, PathBuffer, SEP, SEP_STR};
+use bun_paths::{DELIMITER, PathBuffer, SEP, SEP_STR};
 use bun_semver as Semver;
 use bun_sys::{self, Fd};
 use bun_threading::{ThreadPool, UnboundedQueue, thread_pool};
@@ -1480,27 +1480,6 @@ fn overlay_bunfig_install(install: &mut Api::BunInstall, bunfig: Api::BunInstall
     );
 }
 
-/// `<dir>/.npmrc` for the user-level `.npmrc` candidates in [`init`]. `dir` is
-/// `$XDG_CONFIG_HOME` or `$HOME`, so it can be longer than `buf`; a path that
-/// does not fit could not be opened either, and `None` makes the caller treat
-/// it like a missing file.
-fn user_npmrc_path<'a>(dir: &[u8], buf: &'a mut PathBuffer) -> Option<&'a ZStr> {
-    join_path_z(dir, &[b".npmrc"], buf)
-}
-
-/// `None` when the joined path does not fit the buffer.
-fn join_path_z<'a>(base: &[u8], parts: &[&[u8]], buf: &'a mut PathBuffer) -> Option<&'a ZStr> {
-    // The last byte is reserved for the NUL terminator.
-    let len = resolve_path::join_abs_string_buf_checked::<platform::Auto>(
-        base,
-        &mut buf[..MAX_PATH_BYTES - 1],
-        parts,
-    )?
-    .len();
-    buf[len] = 0;
-    Some(ZStr::from_buf(&buf[..], len))
-}
-
 /// Returns `&'static mut PackageManager` — the process-singleton (held in
 /// `holder::RAW_PTR`) is leaked for the process lifetime and `init()` is called
 /// exactly once on the single CLI dispatch thread. Every
@@ -1952,27 +1931,26 @@ pub fn init(
 
         let mut buf = PathBuffer::uninit();
 
-        let mut global_len: usize = 0;
-        // npm's `userconfig`: when set, this file is the per-user .npmrc and
-        // neither $XDG_CONFIG_HOME/.npmrc nor ~/.npmrc is looked at.
-        // actions/setup-node writes one to $RUNNER_TEMP and exports
-        // NPM_CONFIG_USERCONFIG pointing at it.
+        let parts = [b"./.npmrc" as &[u8]];
+        // `None` (too long for `buf`) could not be opened either, so it counts as a missing file.
+        let join = resolve_path::join_abs_string_buf_z_checked::<platform::Auto>;
+        // npm's `userconfig` replaces both candidates below (actions/setup-node exports it).
         let userconfig = [b"NPM_CONFIG_USERCONFIG" as &[u8], b"npm_config_userconfig"]
             .into_iter()
             .find_map(|key| env.get(key).filter(|path| !path.is_empty()));
+
+        // npm reads `$HOME/.npmrc` and ignores XDG_CONFIG_HOME; keep
+        // `$XDG_CONFIG_HOME/.npmrc` only when that file actually exists.
+        let mut global_len: usize = 0;
         if let Some(userconfig) = userconfig {
-            global_len =
-                join_path_z(&original_cwd_clone, &[userconfig], &mut buf).map_or(0, ZStr::len);
+            global_len = join(&original_cwd_clone, &mut buf, &[userconfig]).map_or(0, ZStr::len);
         } else if let Some(xdg_dir) = bun_core::env_var::XDG_CONFIG_HOME.get_not_empty() {
-            // npm reads `$HOME/.npmrc` and ignores XDG_CONFIG_HOME; keep
-            // `$XDG_CONFIG_HOME/.npmrc` only when that file actually exists.
-            global_len = user_npmrc_path(xdg_dir, &mut buf)
-                .filter(|p| bun_sys::exists_z(p))
+            global_len = (join(xdg_dir, &mut buf, &parts).filter(|p| bun_sys::exists_z(p)))
                 .map_or(0, ZStr::len);
         }
         if global_len == 0 && userconfig.is_none() {
             if let Some(home_dir) = bun_core::env_var::HOME.get_not_empty() {
-                global_len = user_npmrc_path(home_dir, &mut buf).map_or(0, ZStr::len);
+                global_len = join(home_dir, &mut buf, &parts).map_or(0, ZStr::len);
             }
         }
 
diff --git a/src/install/PackageManager/CommandLineArguments.rs b/src/install/PackageManager/CommandLineArguments.rs
index 59881567dd74..febf6d61db7b 100644
--- a/src/install/PackageManager/CommandLineArguments.rs
+++ b/src/install/PackageManager/CommandLineArguments.rs
@@ -1810,43 +1810,31 @@ Full documentation is available at <magenta>https://bun.com/docs/pm/cli/prune<r>
 fn change_directory(arg: &[u8]) -> Result<(), crate::Error> {
     let mut buf = PathBuffer::uninit();
     let mut buf2 = PathBuffer::uninit();
-    let too_long = || bun_sys::Error::from_code(bun_sys::E::ENAMETOOLONG, bun_sys::Tag::chdir);
-
-    // Either buffer keeps its last byte for the NUL terminator `chdir` needs.
-    let resolved: Result<&bun_core::ZStr, bun_sys::Error> = if arg.first() == Some(&b'.') {
+    let path = if arg.first() == Some(&b'.') {
         let cwd_len = bun_sys::getcwd(&mut buf[..])?;
-        let out_len = buf2.len() - 1;
-        match Path::resolve_path::join_abs_string_buf_checked::<Path::platform::Auto>(
+        Path::resolve_path::join_abs_string_buf_z_checked::<Path::platform::Auto>(
             &buf[..cwd_len],
-            &mut buf2[..out_len],
+            &mut buf2[..],
             &[arg],
         )
-        .map(|joined| joined.len())
-        {
-            Some(len) => {
-                buf2[len] = 0;
-                Ok(bun_core::ZStr::from_buf(&buf2[..], len))
-            }
-            None => Err(too_long()),
-        }
     } else if arg.len() < buf.len() {
         buf[..arg.len()].copy_from_slice(arg);
         buf[arg.len()] = 0;
-        Ok(bun_core::ZStr::from_buf(&buf[..], arg.len()))
+        Some(bun_core::ZStr::from_buf(&buf[..], arg.len()))
     } else {
-        Err(too_long())
+        None
     };
-
-    let (path, err) = match resolved {
-        Ok(path) => match bun_sys::chdir(path) {
-            Ok(()) => return Ok(()),
-            Err(err) => (path.as_bytes(), err),
-        },
-        Err(err) => (arg, err),
+    let err = match path.map(bun_sys::chdir) {
+        Some(Ok(())) => return Ok(()),
+        Some(Err(err)) => err,
+        None => bun_sys::Error::from_code(bun_sys::E::ENAMETOOLONG, bun_sys::Tag::chdir),
     };
     Output::err_generic(
         "failed to change directory to \"{}\": {}\n",
-        (bstr::BStr::new(path), bstr::BStr::new(err.name())),
+        (
+            bstr::BStr::new(path.map_or(arg, |p| p.as_bytes())),
+            bstr::BStr::new(err.name()),
+        ),
     );
     Global::crash();
 }
diff --git a/src/install/bin.rs b/src/install/bin.rs
index fa496e344fe9..707a25df57a3 100644
--- a/src/install/bin.rs
+++ b/src/install/bin.rs
@@ -12,7 +12,7 @@ use bun_paths::MAX_PATH_BYTES;
 #[cfg(windows)]
 use bun_paths::WPathBuffer;
 use bun_paths::platform::Auto as PlatformAuto;
-use bun_paths::resolve_path;
+use bun_paths::resolve_path::{self, join_abs_string_buf_z_checked as join_z_checked};
 use bun_paths::strings;
 use bun_paths::{self as path, AbsPath, PathBuffer, SEP};
 use bun_semver::{ExternalString, String};
@@ -1047,7 +1047,8 @@ impl<'a> Linker<'a> {
 
         // Create temporary file path
         let mut tmppath_buf = [0u8; MAX_PATH_BYTES];
-        let Some(tmppath) = Self::join_z_checked(dir_path, tmpname.as_bytes(), &mut tmppath_buf)
+        let Some(tmppath) =
+            join_z_checked::<PlatformAuto>(dir_path, &mut tmppath_buf, &[tmpname.as_bytes()])
         else {
             return;
         };
@@ -1496,7 +1497,7 @@ impl<'a> Linker<'a> {
         let target = strings::without_trailing_slash(target);
 
         if !is_native_binlink_redirect {
-            return Self::join_z_checked(package_dir, target, buf);
+            return join_z_checked::<PlatformAuto>(package_dir, buf, &[target]);
         }
 
         let target_basename = path::basename(target);
@@ -1525,7 +1526,9 @@ impl<'a> Linker<'a> {
             if candidate.is_empty() {
                 continue;
             }
-            let Some(abs_candidate) = Self::join_z_checked(package_dir, candidate, buf) else {
+            let Some(abs_candidate) =
+                join_z_checked::<PlatformAuto>(package_dir, buf, &[candidate])
+            else {
                 continue;
             };
             if sys::exists_z(abs_candidate) {
@@ -1537,20 +1540,7 @@ impl<'a> Linker<'a> {
         // Nothing found; return the primary so `link_bin_or_create_shim` sets
         // `skipped_due_to_missing_bin` and the caller retries without the
         // redirect.
-        Self::join_z_checked(package_dir, target, buf)
-    }
-
-    /// `<dir>/<relative>` with a NUL in `buf`, or `None` if it does not fit (`sys` rejects it too).
-    fn join_z_checked<'b>(dir: &[u8], relative: &[u8], buf: &'b mut [u8]) -> Option<&'b ZStr> {
-        let without_nul = buf.len() - 1;
-        let len = resolve_path::join_abs_string_buf_checked::<PlatformAuto>(
-            dir,
-            &mut buf[..without_nul],
-            &[relative],
-        )?
-        .len();
-        buf[len] = 0;
-        Some(ZStr::from_buf(buf, len))
+        join_z_checked::<PlatformAuto>(package_dir, buf, &[target])
     }
 
     /// uses `self.abs_target_buf`
@@ -1790,10 +1780,10 @@ impl<'a> Linker<'a> {
                         return;
                     }
                     // for normalizing `target`
-                    let Some(abs_target_dir) = Self::join_z_checked(
+                    let Some(abs_target_dir) = join_z_checked::<PlatformAuto>(
                         &self.abs_target_buf[0..package_dir_len],
-                        target,
                         resolved_target_buf,
+                        &[target],
                     ) else {
                         self.err = Some(crate::Error::Sys(bun_errno::SystemErrno::ENAMETOOLONG));
                         return;
@@ -1824,10 +1814,10 @@ impl<'a> Linker<'a> {
                                 let entry_name = entry.name.slice_u8();
                                 // `package_dir` is no longer needed, so `abs_target_buf` is free.
                                 let abs_target: &ZStr = {
-                                    let Some(r) = Self::join_z_checked(
+                                    let Some(r) = join_z_checked::<PlatformAuto>(
                                         abs_target_dir.as_bytes(),
-                                        entry_name,
                                         self.abs_target_buf,
+                                        &[entry_name],
                                     ) else {
                                         self.skipped_due_to_missing_bin = true;
                                         continue;
@@ -1957,10 +1947,10 @@ impl<'a> Linker<'a> {
                     }
 
                     let mut abs_target_dir_buf = path::path_buffer_pool::get();
-                    let Some(abs_target_dir) = Self::join_z_checked(
+                    let Some(abs_target_dir) = join_z_checked::<PlatformAuto>(
                         &self.abs_target_buf[0..package_dir_len],
-                        target,
                         abs_target_dir_buf.as_mut_slice(),
+                        &[target],
                     ) else {
                         self.err = Some(crate::Error::Sys(bun_errno::SystemErrno::ENAMETOOLONG));
                         return;
diff --git a/src/paths/resolve_path.rs b/src/paths/resolve_path.rs
index e640015524e1..647ce3491abf 100644
--- a/src/paths/resolve_path.rs
+++ b/src/paths/resolve_path.rs
@@ -1306,31 +1306,18 @@ pub fn normalize_buf_z<'a, P: PlatformT>(str: &[u8], buf: &'a mut [u8]) -> &'a m
     unsafe { ZStr::from_raw_mut(buf.as_mut_ptr(), len) }
 }
 
-/// [`normalize_buf`] into `buf` when the result fits, otherwise into `spill` (grown as needed).
-pub fn normalize_buf_spill<'a, P: PlatformT>(
-    buf: &'a mut [u8],
-    spill: &'a mut Vec<u8>,
-    str: &[u8],
-) -> &'a [u8] {
-    normalize_buf::<P>(str, normalize_buf_or_spill(buf, spill, str))
-}
-
 /// [`normalize_buf_z`] into `buf` when the result fits, otherwise into `spill` (grown as needed).
 pub fn normalize_buf_z_spill<'a, P: PlatformT>(
     buf: &'a mut [u8],
     spill: &'a mut Vec<u8>,
     str: &[u8],
 ) -> &'a ZStr {
-    normalize_buf_z::<P>(str, normalize_buf_or_spill(buf, spill, str))
+    // Normalizing grows a path by at most one byte (`""` -> `.`, `C:` -> `C:.`), plus the NUL.
+    normalize_buf_z::<P>(str, buf_or_spill(buf, spill, str.len() + 2))
 }
 
-fn normalize_buf_or_spill<'a>(
-    buf: &'a mut [u8],
-    spill: &'a mut Vec<u8>,
-    str: &[u8],
-) -> &'a mut [u8] {
-    // Normalizing grows a path by at most one byte (`""` -> `.`, `C:` -> `C:.`), plus the NUL.
-    let needed = str.len() + 2;
+/// `buf` when it holds `needed` bytes, otherwise `spill` grown to `needed`.
+fn buf_or_spill<'a>(buf: &'a mut [u8], spill: &'a mut Vec<u8>, needed: usize) -> &'a mut [u8] {
     if needed <= buf.len() {
         return buf;
     }
@@ -1471,16 +1458,7 @@ pub fn join_z_buf_spill<'a, P: PlatformT>(
     spill: &'a mut Vec<u8>,
     parts: &[&[u8]],
 ) -> &'a ZStr {
-    let needed = join_needed(parts);
-    let out: &mut [u8] = if needed <= buf.len() {
-        buf
-    } else {
-        if spill.len() < needed {
-            spill.resize(needed, 0);
-        }
-        &mut spill[..]
-    };
-    join_z_buf::<P>(out, parts)
+    join_z_buf::<P>(buf_or_spill(buf, spill, join_needed(parts)), parts)
 }
 
 /// [`join`] (thread-local buffer) when the result fits, otherwise into
@@ -1724,6 +1702,19 @@ pub fn join_abs_string_buf_checked<'a, P: PlatformT>(
     Some(&buf[..len])
 }
 
+/// [`join_abs_string_buf_checked`], NUL-terminated; the last byte of `buf` is reserved for the NUL.
+pub fn join_abs_string_buf_z_checked<'a, P: PlatformT>(
+    cwd: &[u8],
+    buf: &'a mut [u8],
+    parts: &[&[u8]],
+) -> Option<&'a ZStr> {
+    debug_assert!(!parts.is_empty());
+    let cap = buf.len() - 1;
+    let len = join_abs_string_buf_checked::<P>(cwd, &mut buf[..cap], parts)?.len();
+    buf[len] = 0;
+    Some(ZStr::from_buf(buf, len))
+}
+
 pub fn join_abs_string_buf_z<'a, P: PlatformT>(
     cwd: &'a [u8],
     buf: &'a mut [u8],
@@ -2640,58 +2631,32 @@ mod tests {
     }
 
     #[test]
-    fn join_abs_string_spill_leaves_spill_untouched_when_the_result_fits() {
-        let mut spill = Vec::new();
-        let out = join_abs_string_spill::<platform::Posix>(b"/work", &mut spill, &[b"a/../b.json"]);
-        assert_eq!(out, b"/work/b.json");
-        assert!(spill.is_empty());
-    }
-
-    #[test]
-    fn join_abs_string_spill_spills_a_part_longer_than_the_thread_local_buffer() {
-        let name = vec![b'a'; PARSER_JOIN_INPUT_BUFFER_LEN + 1];
-        let mut expected = b"/work/".to_vec();
-        expected.extend_from_slice(&name);
-
-        let mut spill = Vec::new();
-        let out = join_abs_string_spill::<platform::Posix>(b"/work", &mut spill, &[&name]);
-        assert_eq!(out, &expected[..]);
-        assert!(!spill.is_empty());
-    }
-
-    #[test]
-    fn join_abs_string_spill_spills_an_absolute_part_and_a_long_cwd_alike() {
-        let mut abs = b"/".to_vec();
-        abs.resize(PARSER_JOIN_INPUT_BUFFER_LEN * 2, b'a');
-        let mut spill = Vec::new();
+    fn join_abs_string_spill_spills_only_results_longer_than_the_thread_local_buffer() {
+        const N: usize = PARSER_JOIN_INPUT_BUFFER_LEN;
+        let join = |cwd: &[u8], part: &[u8]| {
+            let mut spill = Vec::new();
+            let out = join_abs_string_spill::<platform::Posix>(cwd, &mut spill, &[part]).to_vec();
+            (out, !spill.is_empty())
+        };
         assert_eq!(
-            join_abs_string_spill::<platform::Posix>(b"/", &mut spill, &[&abs]),
-            &abs[..]
+            join(b"/work", b"a/../b.json"),
+            (b"/work/b.json".to_vec(), false)
         );
 
-        let mut cwd = b"/".to_vec();
-        cwd.resize(PARSER_JOIN_INPUT_BUFFER_LEN, b'c');
-        let mut expected = cwd.clone();
-        expected.extend_from_slice(b"/x");
-        let mut spill = Vec::new();
+        let name = vec![b'a'; N + 1];
         assert_eq!(
-            join_abs_string_spill::<platform::Posix>(&cwd, &mut spill, &[b"./x"]),
-            &expected[..]
+            join(b"/work", &name),
+            ([b"/work/", &name[..]].concat(), true)
         );
-    }
 
-    #[test]
-    fn join_abs_string_spill_normalizes_a_long_part_that_collapses() {
-        // `sub/../` repeated past the buffer size resolves back to the cwd.
-        let mut part = Vec::new();
-        while part.len() <= PARSER_JOIN_INPUT_BUFFER_LEN {
-            part.extend_from_slice(b"sub/../");
-        }
-        part.extend_from_slice(b"sub");
+        let abs = [b"/".as_slice(), &vec![b'a'; N * 2]].concat();
+        assert_eq!(join(b"/", &abs).0, abs);
+        let cwd = [b"/".as_slice(), &vec![b'c'; N - 1]].concat();
+        assert_eq!(join(&cwd, b"./x").0, [&cwd[..], b"/x"].concat());
 
-        let mut spill = Vec::new();
-        let out = join_abs_string_spill::<platform::Posix>(b"/work", &mut spill, &[&part]);
-        assert_eq!(out, b"/work/sub");
+        // `sub/../` repeated past the buffer size resolves back under the cwd.
+        let part = [b"sub/../".repeat(N / 7 + 1), b"sub".to_vec()].concat();
+        assert_eq!(join(b"/work", &part).0, b"/work/sub");
     }
 
     #[test]
@@ -2715,77 +2680,38 @@ mod tests {
     }
 
     #[test]
-    fn normalize_buf_spill_leaves_spill_untouched_when_the_input_fits() {
+    fn normalize_buf_z_spill_spills_only_what_does_not_fit_with_its_nul() {
         let mut buf = [0u8; 32];
         let mut spill = Vec::new();
+        let norm = |buf: &mut [u8], spill: &mut Vec<u8>, s: &[u8]| {
+            normalize_buf_z_spill::<platform::Posix>(buf, spill, s)
+                .as_bytes_with_nul()
+                .to_vec()
+        };
         assert_eq!(
-            normalize_buf_spill::<platform::Posix>(&mut buf, &mut spill, b"./bins/../cli/./x.js"),
-            b"cli/x.js"
-        );
-        assert_eq!(
-            normalize_buf_z_spill::<platform::Posix>(&mut buf, &mut spill, b"./bins/").as_bytes(),
-            b"bins/"
+            norm(&mut buf, &mut spill, b"./bins/../cli/./x.js"),
+            b"cli/x.js\0"
         );
+        assert_eq!(norm(&mut buf, &mut spill, b"./bins/"), b"bins/\0");
         assert!(spill.is_empty());
-    }
 
-    #[test]
-    fn normalize_buf_spill_spills_input_longer_than_buf() {
-        let mut buf = [0u8; 32];
-        let name = vec![b'b'; buf.len() * 3];
         let mut input = b"./".to_vec();
-        input.extend_from_slice(&name);
+        input.resize(2 + buf.len() * 3, b'b');
         input.extend_from_slice(b"/./x.js");
-        let mut expected = name;
-        expected.extend_from_slice(b"/x.js");
-
-        let mut spill = Vec::new();
-        assert_eq!(
-            normalize_buf_spill::<platform::Posix>(&mut buf, &mut spill, &input),
-            &expected[..]
-        );
-        expected.push(0);
-        assert_eq!(
-            normalize_buf_z_spill::<platform::Posix>(&mut buf, &mut spill, &input)
-                .as_bytes_with_nul(),
-            &expected[..]
-        );
+        let mut expected = vec![b'b'; buf.len() * 3];
+        expected.extend_from_slice(b"/x.js\0");
+        assert_eq!(norm(&mut buf, &mut spill, &input), expected);
         assert!(!spill.is_empty());
-    }
-
-    #[test]
-    fn normalize_buf_z_spill_spills_input_exactly_as_long_as_buf() {
-        // The input normalizes to `buf.len()` bytes, leaving no room for the NUL.
-        let mut buf = [0u8; 32];
-        let input = vec![b'a'; buf.len()];
-        let mut expected = input.clone();
-        expected.push(0);
 
+        // Normalizes to exactly `buf.len()` bytes, leaving no room for the NUL.
         let mut spill = Vec::new();
-        assert_eq!(
-            normalize_buf_z_spill::<platform::Posix>(&mut buf, &mut spill, &input)
-                .as_bytes_with_nul(),
-            &expected[..]
-        );
+        let input = vec![b'a'; buf.len()];
+        assert_eq!(norm(&mut buf, &mut spill, &input)[..buf.len()], input[..]);
         assert!(!spill.is_empty());
-    }
-
-    #[test]
-    fn normalize_buf_spill_sizes_the_spill_for_the_empty_input_becoming_a_dot() {
-        let mut buf = [0u8; 1];
-
-        let mut spill = Vec::new();
-        assert_eq!(
-            normalize_buf_spill::<platform::Posix>(&mut buf, &mut spill, b""),
-            b"."
-        );
-        assert_eq!(spill.len(), 2);
 
+        // `""` grows to `.`.
         let mut spill = Vec::new();
-        assert_eq!(
-            normalize_buf_z_spill::<platform::Posix>(&mut buf, &mut spill, b"").as_bytes_with_nul(),
-            b".\0"
-        );
+        assert_eq!(norm(&mut buf[..1], &mut spill, b""), b".\0");
         assert_eq!(spill.len(), 2);
     }
 }
diff --git a/src/runtime/cli/pack_command.rs b/src/runtime/cli/pack_command.rs
index 74847b18b6f6..74399245803b 100644
--- a/src/runtime/cli/pack_command.rs
+++ b/src/runtime/cli/pack_command.rs
@@ -32,7 +32,7 @@ type CowString = CowSlice<u8>;
 use crate::cli::run_command::{ConfigureEnvOptions, RunCommand};
 use bun_core::ZBox;
 use bun_core::{ZStr, strings};
-use bun_paths::resolve_path::{self, normalize_buf_spill};
+use bun_paths::resolve_path::{self, normalize_buf_z_spill};
 use bun_sha_hmac::sha;
 use bun_sys::{
     self, CloseOnDrop, Dir, Fd, FdDirExt as _, FdExt as _, File, dir_iterator as DirIterator,
@@ -1486,7 +1486,7 @@ pub(crate) fn bin_subpath<'a>(
     buf: &'a mut [u8],
     spill: &'a mut Vec<u8>,
 ) -> Option<&'a [u8]> {
-    let normalized: &'a [u8] = normalize_buf_spill::<path::platform::Posix>(buf, spill, value);
+    let normalized = normalize_buf_z_spill::<path::platform::Posix>(buf, spill, value).as_bytes();
     let subpath = match ty {
         BinType::Dir => strings::without_trailing_slash(normalized),
         BinType::File if normalized.ends_with(b"/") || normalized == b"package.json" => {
@@ -2243,11 +2243,12 @@ pub(crate) fn pack<const FOR_PUBLISH: bool>(
                     let mut path_spill: Vec<u8> = Vec::new();
                     while let Some(files_entry) = files_array.next() {
                         if let Some(file_entry_str) = files_entry.as_string(bump) {
-                            let normalized = normalize_buf_spill::<path::platform::Posix>(
+                            let normalized = normalize_buf_z_spill::<path::platform::Posix>(
                                 &mut path_buf,
                                 &mut path_spill,
                                 file_entry_str,
-                            );
+                            )
+                            .as_bytes();
                             let Some(parsed) = Pattern::from_utf8(normalized)? else {
                                 continue;
                             };
@@ -2851,26 +2852,16 @@ fn tarball_destination<'a>(
         Global::crash();
     }
     if !pack_filename.is_empty() {
-        // Leave room for the NUL terminator written after the join.
-        let join_buf_len = dest_buf.len() - 1;
-        let Some(tarball_name_len) =
-            resolve_path::join_abs_string_buf_checked::<resolve_path::platform::Auto>(
-                original_cwd,
-                &mut dest_buf[..join_buf_len],
-                &[pack_filename],
-            )
-            .map(<[u8]>::len)
-        else {
+        let Some(tarball_name) = resolve_path::join_abs_string_buf_z_checked::<
+            resolve_path::platform::Auto,
+        >(original_cwd, dest_buf, &[pack_filename]) else {
             Output::err_generic(
                 "archive filename too long: \"{}\"",
                 format_args!("{}", bstr::BStr::new(pack_filename)),
             );
             Global::crash();
         };
-        dest_buf[tarball_name_len] = 0;
-
-        // SAFETY: NUL written at tarball_name_len
-        return (ZStr::from_buf(&dest_buf[..], tarball_name_len), 0);
+        return (tarball_name, 0);
     } else {
         let destination_base = if pack_destination.is_empty() {
             abs_workspace_path
diff --git a/src/runtime/cli/publish_command.rs b/src/runtime/cli/publish_command.rs
index 34e99fe98d51..7e82eff019e2 100644
--- a/src/runtime/cli/publish_command.rs
+++ b/src/runtime/cli/publish_command.rs
@@ -14,9 +14,7 @@ use bun_http as http;
 use bun_install::{self as install, Npm, PackageManager, Subcommand};
 use bun_libarchive::lib::{Archive, ArchiveIterator, IteratorResult as ArchiveIterResult};
 use bun_parsers::json as json_mod;
-use bun_paths::resolve_path::{
-    join_abs_string_buf_checked, normalize_buf_spill, normalize_buf_z_spill,
-};
+use bun_paths::resolve_path::{join_abs_string_buf_checked, normalize_buf_z_spill};
 use bun_paths::{self as path, PathBuffer};
 use bun_sha_hmac as sha;
 use bun_simdutf_sys::simdutf;
@@ -1612,11 +1610,12 @@ impl PublishCommand {
                                     if ks.len() != 0 {
                                         break 'key Some(Box::<[u8]>::from(
                                             strings::without_prefix(
-                                                normalize_buf_spill::<path::platform::Posix>(
+                                                normalize_buf_z_spill::<path::platform::Posix>(
                                                     &mut *path_buf,
                                                     &mut path_spill,
                                                     ks.string(bump)?,
-                                                ),
+                                                )
+                                                .as_bytes(),
                                                 b"./",
                                             ),
                                         ));

From 4291290a1330c0d0fe4fa4716f39aa2f787ee49a Mon Sep 17 00:00:00 2001
From: Jarred Sumner <jarred@jarredsumner.com>
Date: Mon, 17 Aug 2026 05:41:59 +0000
Subject: [PATCH 201/258] simplify(s2-paths): tighten sys additions (flock,
 Android gate, DT_UNKNOWN resolution, lchmod fallback)

Cache the Android probe in a OnceLock, inline the unknown-entry lstat
into WrappedIterator::next, share one /proc/self/fd path formatter, and
cut the multi-paragraph doc comments down to the invariant they carry.

(cherry picked from commit ca017e3aada2b18ffbd43b592f8017cd7ae75d5a)
---
 src/paths/resolve_path.rs |  33 ++----
 src/sys/lib.rs            | 227 +++++++++++---------------------------
 2 files changed, 77 insertions(+), 183 deletions(-)

diff --git a/src/paths/resolve_path.rs b/src/paths/resolve_path.rs
index 647ce3491abf..5a28572b73e9 100644
--- a/src/paths/resolve_path.rs
+++ b/src/paths/resolve_path.rs
@@ -1288,10 +1288,7 @@ pub fn normalize_string_spill<'a, const ALLOW_ABOVE_ROOT: bool, P: PlatformT>(
     if needed <= PARSER_BUFFER_LEN {
         return normalize_string::<ALLOW_ABOVE_ROOT, P>(str);
     }
-    if spill.len() < needed {
-        spill.resize(needed, 0);
-    }
-    normalize_string_buf::<ALLOW_ABOVE_ROOT, P, false>(str, &mut spill[..])
+    normalize_string_buf::<ALLOW_ABOVE_ROOT, P, false>(str, grow(spill, needed))
 }
 
 pub fn normalize_buf<'a, P: PlatformT>(str: &[u8], buf: &'a mut [u8]) -> &'a mut [u8] {
@@ -1319,12 +1316,17 @@ pub fn normalize_buf_z_spill<'a, P: PlatformT>(
 /// `buf` when it holds `needed` bytes, otherwise `spill` grown to `needed`.
 fn buf_or_spill<'a>(buf: &'a mut [u8], spill: &'a mut Vec<u8>, needed: usize) -> &'a mut [u8] {
     if needed <= buf.len() {
-        return buf;
+        buf
+    } else {
+        grow(spill, needed)
     }
+}
+
+fn grow(spill: &mut Vec<u8>, needed: usize) -> &mut [u8] {
     if spill.len() < needed {
         spill.resize(needed, 0);
     }
-    &mut spill[..]
+    spill
 }
 
 pub fn normalize_buf_t<'a, T: PathChar, P: PlatformT>(str: &[T], buf: &'a mut [T]) -> &'a mut [T] {
@@ -1416,10 +1418,7 @@ pub fn join_abs_string_spill<'a, P: PlatformT>(
     if needed <= PARSER_JOIN_INPUT_BUFFER_LEN {
         return join_abs_string::<P>(cwd, parts);
     }
-    if spill.len() < needed {
-        spill.resize(needed, 0);
-    }
-    join_abs_string_buf::<P>(cwd, &mut spill[..], parts)
+    join_abs_string_buf::<P>(cwd, grow(spill, needed), parts)
 }
 
 /// Convert parts of potentially invalid file paths into a single valid filpeath
@@ -1468,10 +1467,7 @@ pub fn join_spill<'a, P: PlatformT>(spill: &'a mut Vec<u8>, parts: &[&[u8]]) ->
     if needed <= JOIN_BUF_LEN {
         return join::<P>(parts);
     }
-    if spill.len() < needed {
-        spill.resize(needed, 0);
-    }
-    join_string_buf::<P>(&mut spill[..], parts)
+    join_string_buf::<P>(grow(spill, needed), parts)
 }
 
 /// [`join_z`] (thread-local buffer) when the result fits, otherwise into
@@ -1481,10 +1477,7 @@ pub fn join_z_spill<'a, P: PlatformT>(spill: &'a mut Vec<u8>, parts: &[&[u8]]) -
     if needed <= JOIN_BUF_LEN {
         return join_z::<P>(parts);
     }
-    if spill.len() < needed {
-        spill.resize(needed, 0);
-    }
-    join_z_buf::<P>(&mut spill[..], parts)
+    join_z_buf::<P>(grow(spill, needed), parts)
 }
 
 pub fn join_z_buf<'a, P: PlatformT>(buf: &'a mut [u8], parts: &[&[u8]]) -> &'a ZStr {
@@ -1625,9 +1618,7 @@ fn join_string_buf_t<'a, T: PathChar, P: PlatformT>(buf: &'a mut [T], parts: &[&
     normalize_string_node_t::<T, P>(&temp_buf[0..written], buf)
 }
 
-/// Buffer length that holds `_join_abs_string_buf`'s concatenation of `cwd` and
-/// `parts` (one separator each, plus the one a bare Windows root gains) as well
-/// as its normalized output.
+/// Fits `_join_abs_string_buf`'s concatenation (a separator per part, one more for a bare Windows root).
 #[inline]
 fn join_abs_needed(cwd_len: usize, parts: &[&[u8]]) -> usize {
     parts.iter().map(|p| p.len() + 1).sum::<usize>() + cwd_len + 2
diff --git a/src/sys/lib.rs b/src/sys/lib.rs
index ef2d99434b20..74d20f2010a8 100644
--- a/src/sys/lib.rs
+++ b/src/sys/lib.rs
@@ -122,25 +122,6 @@ pub mod dir_iterator {
         pub kind: EntryKind,
     }
 
-    impl IteratorResult {
-        /// See `WrappedIterator::resolve_unknown_entry_types`.
-        fn resolve_unknown_kind(&mut self, dir: Fd) {
-            #[cfg(not(windows))]
-            {
-                if self.kind == EntryKind::Unknown {
-                    if let Ok(stat) = super::lstatat(dir, self.name.as_zstr()) {
-                        self.kind = super::kind_from_mode(stat.st_mode as super::Mode);
-                    }
-                }
-            }
-            #[cfg(windows)]
-            {
-                // The Windows iterator always knows the kind.
-                let _ = dir;
-            }
-        }
-    }
-
     /// Length-known, NUL-terminated entry name in OS-native encoding.
     ///
     /// **POSIX**: lifetime-erased borrow (raw pointer + length) into the
@@ -749,9 +730,7 @@ pub mod dir_iterator {
         #[cfg(not(windows))]
         name_filter: Option<Vec<u16>>,
         state: State,
-        /// `lstat` entries whose kind the filesystem did not report (`Unknown`:
-        /// FUSE, NFS, XFS with `ftype=0`), so that, as with `d_type`, a symlink is
-        /// still a symlink. Entries that cannot be stat'ed stay `Unknown`.
+        /// `lstat` entries the filesystem reports as `Unknown` (FUSE, NFS, XFS `ftype=0`).
         pub resolve_unknown_entry_types: bool,
     }
     impl WrappedIterator {
@@ -781,13 +760,17 @@ pub mod dir_iterator {
         /// Copy it out before pushing the iterator into a `Vec` etc.
         #[inline]
         pub fn next(&mut self) -> Result<Option<IteratorResult>> {
-            let mut entry = self.state.next(self.dir)?;
+            #[cfg(not(windows))] // The Windows iterator always knows the kind.
             if self.resolve_unknown_entry_types {
-                if let Some(entry) = entry.as_mut() {
-                    entry.resolve_unknown_kind(self.dir);
+                let mut entry = self.state.next(self.dir)?;
+                if let Some(e) = entry.as_mut().filter(|e| e.kind == EntryKind::Unknown) {
+                    if let Ok(st) = super::lstatat(self.dir, e.name.as_zstr()) {
+                        e.kind = super::kind_from_mode(st.st_mode as super::Mode);
+                    }
                 }
+                return Ok(entry);
             }
-            Ok(entry)
+            self.state.next(self.dir)
         }
     }
 
@@ -1095,9 +1078,7 @@ impl error::IntoErrnoInt for bun_windows_sys::NTSTATUS {
     }
 }
 
-/// Mode for [`flock`] — a whole-file lock: advisory `flock(2)` on POSIX,
-/// mandatory `LockFileEx` on Windows (other handles' reads and writes into
-/// the locked range fail there). Released when the fd is closed.
+/// For [`flock`]: advisory `flock(2)` on POSIX, mandatory `LockFileEx` on Windows; released on close.
 #[derive(Clone, Copy, PartialEq, Eq)]
 pub enum FileLockMode {
     Shared,
@@ -1988,34 +1969,20 @@ mod posix_impl {
             Ok(Fd::from_native(rc))
         }
     }
-    /// Runtime Android detection. Android's app seccomp policy kills the
-    /// process with SIGSYS instead of returning ENOSYS for syscalls outside
-    /// its allowlist, so `openat2(2)`/`fchmodat2(2)` must never be issued
-    /// there, not even as a probe. Shipped linux builds run under Termux as
-    /// plain `target_os = "linux"`, hence runtime detection: the kernel
-    /// release string, or the `ANDROID_ROOT`/`ANDROID_DATA` env vars Android
-    /// init sets for every process.
+    /// Android's app seccomp policy answers `openat2(2)`/`fchmodat2(2)` with SIGSYS, not ENOSYS,
+    /// so they must not even be probed there; the linux build runs under Termux, hence at runtime.
     #[cfg(any(target_os = "linux", target_os = "android"))]
     fn is_android_kernel() -> bool {
-        if cfg!(target_os = "android") {
-            return true;
-        }
-        use core::sync::atomic::{AtomicU8, Ordering};
-        // 0 = unprobed, 1 = not Android, 2 = Android.
-        static CACHED: AtomicU8 = AtomicU8::new(0);
-        match CACHED.load(Ordering::Relaxed) {
-            0 => {}
-            v => return v == 2,
-        }
-        let release = bun_core::ffi::c_field_bytes(&bun_core::ffi::cached_uname().release);
-        let detected = bun_core::strings::contains_case_insensitive_ascii(release, b"android")
-            || (bun_core::env_var::ANDROID_ROOT::get_not_empty().is_some()
-                && bun_core::env_var::ANDROID_DATA::get_not_empty().is_some());
-        CACHED.store(if detected { 2 } else { 1 }, Ordering::Relaxed);
-        detected
-    }
-    /// `openat2(RESOLVE_BENEATH)`; ENOSYS on Android without issuing the
-    /// syscall (see [`is_android_kernel`]).
+        static CACHED: std::sync::OnceLock<bool> = std::sync::OnceLock::new();
+        *CACHED.get_or_init(|| {
+            let release = bun_core::ffi::c_field_bytes(&bun_core::ffi::cached_uname().release);
+            cfg!(target_os = "android")
+                || bun_core::strings::contains_case_insensitive_ascii(release, b"android")
+                || (bun_core::env_var::ANDROID_ROOT::get_not_empty().is_some()
+                    && bun_core::env_var::ANDROID_DATA::get_not_empty().is_some())
+        })
+    }
+    /// `openat2(RESOLVE_BENEATH)`; ENOSYS on Android (see [`is_android_kernel`]).
     #[cfg(any(target_os = "linux", target_os = "android"))]
     pub fn openat2_beneath(dir: impl AsFd, path: &ZStr, flags: i32, mode: Mode) -> Maybe<Fd> {
         let dir = dir.as_fd();
@@ -2028,7 +1995,6 @@ mod posix_impl {
     /// `openat2(RESOLVE_IN_ROOT | RESOLVE_NO_MAGICLINKS)`: resolves `path` as
     /// if `dir` were `/`. Falls back to plain `openat` on kernels without
     /// `openat2` (or when seccomp blocks it), caching the unavailability.
-    /// Never issued on Android (see [`is_android_kernel`]).
     #[cfg(any(target_os = "linux", target_os = "android"))]
     pub fn openat2_in_root(dir: impl AsFd, path: &ZStr, flags: i32, mode: Mode) -> Maybe<Fd> {
         use core::sync::atomic::{AtomicBool, Ordering};
@@ -2732,30 +2698,22 @@ mod posix_impl {
         check!(safe_libc::ftruncate(fd.native(), len), Tag::ftruncate);
         Ok(())
     }
-    /// Advisory whole-file lock. Returns `Ok(false)` when `nonblocking` and
-    /// the lock is held elsewhere; retries `EINTR` internally.
+    /// `Ok(false)` when `nonblocking` and the lock is held elsewhere.
     pub fn flock(fd: Fd, mode: FileLockMode, nonblocking: bool) -> Maybe<bool> {
-        let mut op = match mode {
+        let op = match mode {
             FileLockMode::Shared => libc::LOCK_SH,
             FileLockMode::Exclusive => libc::LOCK_EX,
-        };
-        if nonblocking {
-            op |= libc::LOCK_NB;
-        }
+        } | if nonblocking { libc::LOCK_NB } else { 0 };
         loop {
             // SAFETY: `fd` is a live descriptor; `op` is a valid flock op.
-            let rc = unsafe { libc::flock(fd.native(), op) };
-            if rc == 0 {
+            if unsafe { libc::flock(fd.native(), op) } == 0 {
                 return Ok(true);
             }
-            let e = last_errno();
-            if e == libc::EINTR {
-                continue;
-            }
-            if nonblocking && (e == libc::EWOULDBLOCK || e == libc::EAGAIN) {
-                return Ok(false);
+            match last_errno() {
+                libc::EINTR => continue,
+                libc::EWOULDBLOCK if nonblocking => return Ok(false),
+                e => return Err(Error::from_code_int(e, Tag::flock).with_fd(fd)),
             }
-            return Err(Error::from_code_int(e, Tag::flock).with_fd(fd));
         }
     }
     pub fn getcwd(buf: &mut [u8]) -> Maybe<usize> {
@@ -2814,18 +2772,12 @@ mod posix_impl {
                 }
             } else {
                 let mut buf = [0u8; 32];
-                let n = {
-                    use std::io::Write as _;
-                    let mut c = std::io::Cursor::new(&mut buf[..]);
-                    let _ = write!(c, "/proc/self/fd/{}\0", tmpfd.native());
-                    c.position() as usize - 1
-                };
-                let _ = n;
-                // SAFETY: NUL written by the format string above.
+                let proc_path = fd_path_z(b"/proc/self/fd/", tmpfd, &mut buf);
+                // SAFETY: `proc_path` is NUL-terminated; dirfd valid.
                 unsafe {
                     libc::linkat(
                         libc::AT_FDCWD,
-                        buf.as_ptr().cast(),
+                        proc_path.as_ptr(),
                         dirfd.native(),
                         name.as_ptr(),
                         libc::AT_SYMLINK_FOLLOW,
@@ -2934,10 +2886,9 @@ mod posix_impl {
         }
         #[cfg(not(any(target_os = "macos", target_os = "freebsd")))]
         {
+            // glibc/musl `fchmodat(.., AT_SYMLINK_NOFOLLOW)` try `fchmodat2(2)` too.
             #[cfg(any(target_os = "linux", target_os = "android"))]
             if is_android_kernel() {
-                // libc's `fchmodat(.., AT_SYMLINK_NOFOLLOW)` is no escape
-                // hatch here: current glibc/musl try `fchmodat2(2)` inside it.
                 return lchmod_no_fchmodat2(path, mode);
             }
             const SYS_FCHMODAT2: libc::c_long = 452;
@@ -2966,47 +2917,19 @@ mod posix_impl {
             }
         }
     }
-    /// `lchmod` without `fchmodat2(2)`: `O_PATH` + `chmod("/proc/self/fd/N")`,
-    /// musl's own fallback strategy. Symlinks are rejected with EOPNOTSUPP,
-    /// matching libc.
+    /// musl's fallback: `O_PATH` + `chmod("/proc/self/fd/N")`; symlinks get EOPNOTSUPP like libc.
     #[cfg(any(target_os = "linux", target_os = "android"))]
     fn lchmod_no_fchmodat2(path: &ZStr, mode: Mode) -> Maybe<()> {
-        let fd = match open(path, O::PATH | O::NOFOLLOW | O::CLOEXEC, 0) {
-            Ok(fd) => fd,
-            Err(mut err) => {
-                err.syscall = Tag::lchmod;
-                return Err(err);
-            }
-        };
-        let st = match fstat(fd) {
-            Ok(st) => st,
-            Err(mut err) => {
-                let _ = close(fd);
-                err.syscall = Tag::lchmod;
-                return Err(err.with_path(path.as_bytes()));
-            }
-        };
-        if (st.st_mode as u32 & libc::S_IFMT as u32) == libc::S_IFLNK as u32 {
-            let _ = close(fd);
-            return Err(
-                Error::from_code_int(libc::EOPNOTSUPP, Tag::lchmod).with_path(path.as_bytes())
-            );
-        }
-        let mut proc = [0u8; 32];
-        let n = {
-            use std::io::Write as _;
-            let mut c = std::io::Cursor::new(&mut proc[..]);
-            let _ = write!(c, "/proc/self/fd/{}\0", fd.native());
-            c.position() as usize - 1
-        };
-        // SAFETY: NUL written above.
-        let z = ZStr::from_buf(&proc[..], n);
-        let result = chmod(z, mode);
-        let _ = close(fd);
-        result.map_err(|mut err| {
+        let retag = |mut err: Error| {
             err.syscall = Tag::lchmod;
             err.with_path(path.as_bytes())
-        })
+        };
+        let fd = open(path, O::PATH | O::NOFOLLOW | O::CLOEXEC, 0).map_err(retag)?;
+        let _close = crate::CloseOnDrop::new(fd);
+        if kind_from_mode(fstat(fd).map_err(retag)?.st_mode as Mode) == FileKind::SymLink {
+            return Err(retag(Error::from_code_int(libc::EOPNOTSUPP, Tag::lchmod)));
+        }
+        chmod(fd_path_z(b"/proc/self/fd/", fd, &mut [0u8; 32]), mode).map_err(retag)
     }
     pub fn chown(path: &ZStr, uid: u32, gid: u32) -> Maybe<()> {
         check_p!(
@@ -3797,11 +3720,8 @@ mod windows_impl {
         }
         Ok(bytes_written as usize)
     }
-    /// Whole-file lock via `LockFileEx` (mandatory on Windows: other
-    /// handles' reads and writes into the range fail). Returns `Ok(false)` when
-    /// `nonblocking` and the lock is held elsewhere. Unlike POSIX `flock`,
-    /// `LockFileEx` does not upgrade/downgrade an already-held lock, but the
-    /// only caller pattern is acquire-once/close, which behaves identically.
+    /// `Ok(false)` when `nonblocking` and the lock is held elsewhere. Unlike `flock(2)`,
+    /// `LockFileEx` cannot convert a lock the handle already holds.
     pub fn flock(fd: Fd, mode: FileLockMode, nonblocking: bool) -> Maybe<bool> {
         let mut flags: w::DWORD = 0;
         if mode == FileLockMode::Exclusive {
@@ -7682,22 +7602,22 @@ fn linux_kernel_is_freebsd() -> bool {
     detected == 2
 }
 
+/// `<prefix><fd number>`, NUL-terminated in `buf`.
+#[cfg(any(target_os = "linux", target_os = "android"))]
+fn fd_path_z<'a>(prefix: &[u8], fd: Fd, buf: &'a mut [u8; 32]) -> &'a ZStr {
+    buf[..prefix.len()].copy_from_slice(prefix);
+    let end = prefix.len() + bun_core::fmt::print_int(&mut buf[prefix.len()..], fd.native());
+    buf[end] = 0;
+    ZStr::from_buf(&buf[..], end)
+}
+
 /// readlink `/dev/fd/N` (fdescfs).
 #[cfg(any(target_os = "linux", target_os = "android"))]
 fn get_fd_path_freebsd_linuxulator<'a>(
     fd: Fd,
     out: &'a mut bun_paths::PathBuffer,
 ) -> Maybe<&'a mut [u8]> {
-    let mut dev = [0u8; 32];
-    let n = {
-        use std::io::Write as _;
-        let mut c = std::io::Cursor::new(&mut dev[..]);
-        let _ = write!(c, "/dev/fd/{}\0", fd.native());
-        c.position() as usize - 1
-    };
-    // SAFETY: NUL written above.
-    let z = ZStr::from_buf(&dev[..], n);
-    let len = readlink(z, &mut out.0)?;
+    let len = readlink(fd_path_z(b"/dev/fd/", fd, &mut [0u8; 32]), &mut out.0)?;
     Ok(&mut out.0[..len])
 }
 
@@ -7711,16 +7631,7 @@ pub fn get_fd_path<'a>(fd: Fd, out: &'a mut bun_paths::PathBuffer) -> Maybe<&'a
         if linux_kernel_cached_is_freebsd() {
             return get_fd_path_freebsd_linuxulator(fd, out);
         }
-        let mut proc = [0u8; 32];
-        let n = {
-            use std::io::Write as _;
-            let mut c = std::io::Cursor::new(&mut proc[..]);
-            let _ = write!(c, "/proc/self/fd/{}\0", fd.native());
-            c.position() as usize - 1
-        };
-        // SAFETY: NUL written above.
-        let z = ZStr::from_buf(&proc[..], n);
-        match readlink(z, &mut out.0) {
+        match readlink(fd_path_z(b"/proc/self/fd/", fd, &mut [0u8; 32]), &mut out.0) {
             Ok(len) => return Ok(&mut out.0[..len]),
             Err(e) => {
                 // Under FreeBSD Linuxulator, fall back to
@@ -9226,8 +9137,7 @@ pub fn renameat_z(from_dir: impl AsFd, from: &ZStr, to_dir: impl AsFd, to: &ZStr
 #[derive(Default, Clone, Copy)]
 pub struct RenameatConcurrentlyOptions {
     pub move_fallback: bool,
-    /// If `to` already exists (another process published it first and may be
-    /// reading it), keep it and delete `from` instead of replacing it.
+    /// If `to` already exists (another process won the race), delete `from` instead of replacing `to`.
     pub keep_existing_destination: bool,
 }
 /// Alias: `bun_install` call sites spell this `RenameOptions`.
@@ -9247,8 +9157,7 @@ pub(crate) fn move_file_z_slow_maybe(
 
 /// `renameatConcurrently`. Tries an atomic NOREPLACE rename,
 /// then EXCHANGE, then a racy delete-tree + rename. With `move_fallback` set,
-/// an EXDEV result falls through to a slow open/copy; see
-/// [`RenameatConcurrentlyOptions`] for `keep_existing_destination`.
+/// an EXDEV result falls through to a slow open/copy.
 /// After an EXCHANGE, `from` holds the tree that was at `to`.
 pub fn renameat_concurrently(
     from_dir_fd: Fd,
@@ -9303,19 +9212,13 @@ pub(crate) fn renameat_concurrently_without_fallback(
                 Ok(()) => break 'attempt,
             };
 
-            // Not keyed on the errno: Windows and filesystems without
-            // RENAME_NOREPLACE report an existing `to` differently.
-            if opts.keep_existing_destination
-                && exists_at_type(
-                    if to_dir_fd.is_valid() {
-                        to_dir_fd
-                    } else {
-                        Fd::cwd()
-                    },
-                    to,
-                )
-                .is_ok()
-            {
+            // Not keyed on the errno: it varies across Windows and filesystems without RENAME_NOREPLACE.
+            let to_dir = if to_dir_fd.is_valid() {
+                to_dir_fd
+            } else {
+                Fd::cwd()
+            };
+            if opts.keep_existing_destination && exists_at_type(to_dir, to).is_ok() {
                 if from_dir_fd.is_valid() {
                     let _ = Dir::borrow(&from_dir_fd).delete_tree(from.as_bytes());
                 } else {

From 5a6c48a03cedf703698e77cf9659db301e5e939e Mon Sep 17 00:00:00 2001
From: Jarred Sumner <jarred@jarredsumner.com>
Date: Mon, 17 Aug 2026 05:46:13 +0000
Subject: [PATCH 202/258] simplify(s2-paths): bunx install lock as one
 InstallLock type; trim directories/CLI-args comments

The shared-lock probe before running a cached bin was acquired and then
dropped before exec, so it is now a plain install_in_progress() check.
The exclusive lock, identity re-check after flock, completion stamp and
skip-reinstall test keep their behaviour.

(cherry picked from commit 063d017de24840642544c9a88e50e28c2702dff0)
---
 .../PackageManager/CommandLineArguments.rs    |   8 +-
 .../PackageManagerDirectories.rs              |  26 +-
 src/runtime/cli/bunx_command.rs               | 288 ++++++------------
 3 files changed, 99 insertions(+), 223 deletions(-)

diff --git a/src/install/PackageManager/CommandLineArguments.rs b/src/install/PackageManager/CommandLineArguments.rs
index febf6d61db7b..809fdf6016b1 100644
--- a/src/install/PackageManager/CommandLineArguments.rs
+++ b/src/install/PackageManager/CommandLineArguments.rs
@@ -32,12 +32,8 @@ fn pretty_help(text: &str) {
     Output::pretty(text);
 }
 
-/// `--cpu` / `--os` / `--libc`: each may be repeated, values combine like the
-/// package.json arrays they filter against (`!name` negates, `*` or `any`
-/// allows everything, `none` is accepted as-is). `None` when the flag was not
-/// passed. `Negatable::apply` tolerates unknown names because a package.json
-/// may name a platform this build does not know; on the command line an
-/// unknown name, negated or not, is a typo and fatal.
+/// `--cpu` / `--os` / `--libc`, combined like the package.json arrays they filter. Unlike there
+/// (`Negatable::apply` skips names this build does not know), an unknown name is a typo and fatal.
 fn parse_platform_flag<T: Npm::NegatableEnum>(
     values: &[&[u8]],
     what: &str,
diff --git a/src/install/PackageManager/PackageManagerDirectories.rs b/src/install/PackageManager/PackageManagerDirectories.rs
index 12f62686e577..eaa0caa12d86 100644
--- a/src/install/PackageManager/PackageManagerDirectories.rs
+++ b/src/install/PackageManager/PackageManagerDirectories.rs
@@ -308,11 +308,7 @@ fn get_temporary_directory_run(manager: &mut PackageManager) -> TemporaryDirecto
         }
     };
 
-    // After any fallback, `tempdir` points at `<cache>/.tmp`, not
-    // `$TMPDIR`. `name` must describe the directory `handle` actually points
-    // at: the node-gyp shim is written through `handle` but advertised on
-    // `PATH` via `name`, and a mismatch makes lifecycle scripts fail to find
-    // `node-gyp` (exit 127).
+    // `name` must be the directory `handle` is: the node-gyp shim is written via `handle`, put on PATH via `name`.
     let name: &'static [u8] = if tried_dot_tmp {
         let joined = path::resolve_path::join::<path::platform::Auto>(&[
             manager.cache_directory_path.as_bytes(),
@@ -395,8 +391,7 @@ pub struct CacheDir {
     pub path: Vec<u8>,
 }
 
-/// Fails with `ENAMETOOLONG` when the configured directory (user-controlled, so
-/// possibly longer than any path the OS accepts) does not fit a `PathBuffer`.
+/// `ENAMETOOLONG` when the configured directory does not fit a `PathBuffer`.
 pub fn fetch_cache_directory_path(
     env: &mut DotEnvLoader,
     options: Option<&Options>,
@@ -742,8 +737,7 @@ pub fn cached_npm_package_folder_print_basename<'a>(
     w.finish_z()
 }
 
-/// `@T@<hash of the URL>@@@1`, for URL tarballs. `file:` tarballs use
-/// `cached_local_tarball_folder_name_print`.
+/// `@T@<hash of the URL>@@@1`; `file:` tarballs use [`cached_local_tarball_folder_name_print`].
 pub fn cached_tarball_folder_name_print<'a>(
     buf: &'a mut [u8],
     url: &[u8],
@@ -769,17 +763,9 @@ pub fn cached_tarball_folder_name(
     )
 }
 
-/// `@T@sha512-<first 16 digest bytes as hex>@@@1`.
-///
-/// A `file:` tarball's resolution is the path as written in package.json
-/// (`pkg.tgz`), which names a different tarball in every project sharing the
-/// cache, so unlike a URL tarball it is cached under the integrity bun.lock
-/// pins for it: the entry is only reused for the bytes it was extracted from.
-///
-/// Empty when the integrity is not known yet (lockfile written before tarball
-/// integrity was recorded). Callers treat that like a cache miss: extracting the
-/// tarball computes the integrity, and the install callbacks record it in the
-/// lockfile before installing from the entry named after it.
+/// `@T@sha512-<first 16 digest bytes as hex>@@@1`: a `file:` tarball's path names different bytes
+/// in every project sharing the cache, so it is cached under the integrity bun.lock pins instead.
+/// Empty while that integrity is unknown, which callers treat as a cache miss.
 pub fn cached_local_tarball_folder_name_print<'a>(
     buf: &'a mut [u8],
     integrity: &Integrity,
diff --git a/src/runtime/cli/bunx_command.rs b/src/runtime/cli/bunx_command.rs
index 67af695c3a06..322be90f8fd1 100644
--- a/src/runtime/cli/bunx_command.rs
+++ b/src/runtime/cli/bunx_command.rs
@@ -33,6 +33,77 @@ bun_output::declare_scope!(bunx, visible);
 
 pub(crate) struct BunxCommand;
 
+/// `flock` on `<bunx cache dir>/.bunx-lock`: exclusive while installing into the shared directory,
+/// probed shared before running out of it. CLOEXEC, so exec'ing the target releases it too.
+struct InstallLock(bun_sys::File);
+
+impl InstallLock {
+    /// Zero-padded seconds, fixed width so a rewrite never has to truncate.
+    const STAMP_LEN: usize = 20;
+
+    /// `None` when the lock cannot be taken, or is held elsewhere and `nonblocking`.
+    fn acquire(
+        bunx_cache_dir: &[u8],
+        mode: bun_sys::FileLockMode,
+        nonblocking: bool,
+    ) -> Option<Self> {
+        let sep = bun_paths::SEP_STR.as_bytes();
+        let path = bun_core::ZBox::from_bytes(&[bunx_cache_dir, sep, b".bunx-lock"].concat());
+        for _ in 0..5 {
+            let fd = bun_sys::openat(Fd::cwd(), &path, O::CREAT | O::RDWR | O::CLOEXEC, 0o600);
+            let file = bun_sys::File::from_fd(fd.ok()?);
+            if !bun_sys::flock(file.fd(), mode, nonblocking).ok()? {
+                return None;
+            }
+            // The stale-tree cleanup deletes the lock file with the directory, and a lock on an
+            // unlinked file guards nothing: keep it only if the path still names the file locked.
+            let Ok(probe) = bun_sys::openat(Fd::cwd(), &path, O::RDONLY | O::CLOEXEC, 0) else {
+                continue;
+            };
+            let probe = bun_sys::File::from_fd(probe);
+            if let (Ok(held), Ok(at_path)) = (bun_sys::fstat(file.fd()), bun_sys::fstat(probe.fd()))
+            {
+                if held.st_ino == at_path.st_ino && held.st_dev == at_path.st_dev {
+                    return Some(Self(file));
+                }
+            }
+        }
+        None
+    }
+
+    /// Whether another `bun x` is installing into `bunx_cache_dir` right now (its tree is partial).
+    fn install_in_progress(bunx_cache_dir: &[u8]) -> bool {
+        let busy = Self::acquire(bunx_cache_dir, bun_sys::FileLockMode::Shared, true).is_none();
+        if busy {
+            bun_output::scoped_log!(
+                bunx,
+                "install in progress for {}, waiting",
+                BStr::new(bunx_cache_dir)
+            );
+        }
+        busy
+    }
+
+    /// Whether the previous exclusive holder finished installing at or after `since`.
+    fn installed_since(&self, since: i64) -> bool {
+        let mut stamp = [0u8; Self::STAMP_LEN];
+        matches!(
+            bun_sys::pread(self.0.fd(), &mut stamp, 0),
+            Ok(Self::STAMP_LEN)
+        ) && bun_core::fmt::parse_unsigned::<i64>(&stamp, 10).is_ok_and(|done| done >= since)
+    }
+
+    /// Stamps the completion time (the last write before the lock goes) and releases the lock.
+    fn release_after_install(lock: &mut Option<Self>) {
+        let Some(lock) = lock.take() else { return };
+        let stamp = format!("{:01$}", bun_core::time::timestamp(), Self::STAMP_LEN);
+        // Best effort: without a stamp, waiters reinstall.
+        if let Err(err) = bun_sys::pwrite(lock.0.fd(), stamp.as_bytes(), 0) {
+            bun_output::scoped_log!(bunx, "failed to record install completion: {}", err);
+        }
+    }
+}
+
 /// bunx-specific options parsed from argv.
 //
 // Invariant: string fields borrow from `argv`, which is process-lifetime —
@@ -473,16 +544,10 @@ impl BunxCommand {
 
             if is_stale {
                 let _ = target_package_json.close();
-                // Delete only while holding the exclusive lock, so the tree
-                // (lock file included) never vanishes under a process that
-                // is installing into or about to run from it. Contended or
-                // unlockable → skip; the reinstall refreshes the tree. If
-                // delete fails, oh well. Hope installation takes care of it.
-                if let Some(_lock) = Self::lock_cache_dir(
-                    tempdir_name,
-                    bun_sys::FileLockMode::Exclusive,
-                    /* nonblocking */ true,
-                ) {
+                // Not under a process installing into or about to run from it; the reinstall
+                // refreshes it anyway. If delete fails, oh well. Hope installation takes care of it.
+                let mode = bun_sys::FileLockMode::Exclusive;
+                if let Some(_lock) = InstallLock::acquire(tempdir_name, mode, true) {
                     let _ = bun_sys::Dir::cwd().delete_tree(tempdir_name);
                 }
                 return Err(crate::Error::NeedToInstall);
@@ -688,129 +753,6 @@ impl BunxCommand {
         Global::exit(1);
     }
 
-    /// The lock taken on `.bunx-lock` only serializes anything if the path
-    /// still names the file we locked — the stale-tree cleanup deletes the
-    /// whole cache dir, lock file included (Windows included: `bun_sys`
-    /// opens with `FILE_SHARE_DELETE` and deletes with POSIX semantics), so
-    /// a lock on an unlinked file guards nothing. Compare identity via
-    /// `fstat` on the held fd and on a freshly opened probe fd: both map to
-    /// ino/dev on POSIX and NTFS file index/volume serial on Windows.
-    fn lock_file_identity_ok(fd: Fd, path_z: &ZStr) -> bool {
-        let probe = match bun_sys::openat(Fd::cwd(), path_z, O::RDONLY | O::CLOEXEC, 0) {
-            Ok(fd) => fd,
-            Err(_) => return false,
-        };
-        let probe_file = bun_sys::File::from_fd(probe);
-        match (bun_sys::fstat(fd), bun_sys::fstat(probe_file.fd())) {
-            (Ok(held), Ok(on_disk)) => {
-                held.st_ino == on_disk.st_ino && held.st_dev == on_disk.st_dev
-            }
-            _ => false,
-        }
-    }
-
-    /// Width of the zero-padded decimal timestamp stored in the lock file.
-    /// Fixed-width so rewrites never need a truncation.
-    const LOCK_TIMESTAMP_LEN: usize = 20;
-
-    /// After a successful install, the exclusive lock holder records the
-    /// completion time in the lock file so waiters can tell the tree was
-    /// just (re)installed.
-    fn mark_install_completed(lock: &bun_sys::File) {
-        let mut buf = [0u8; Self::LOCK_TIMESTAMP_LEN];
-        let mut cursor: &mut [u8] = &mut buf[..];
-        write!(cursor, "{:020}", bun_core::time::timestamp()).expect("unreachable");
-        // Best-effort: on failure waiters reinstall, so only log it.
-        if let Err(err) = bun_sys::pwrite(lock.fd(), &buf, 0) {
-            bun_output::scoped_log!(bunx, "failed to record install completion: {}", err);
-        }
-    }
-
-    /// Stamp the completion time and release the exclusive lock. The stamp
-    /// must be the last write before release: a waiter that arrived while
-    /// the holder ran its post-install probes compares its own start time
-    /// against it, and an earlier stamp can land in the previous second.
-    fn release_install_lock(install_lock: &mut Option<bun_sys::File>) {
-        if let Some(lock) = install_lock.take() {
-            Self::mark_install_completed(&lock);
-        }
-    }
-
-    /// Whether a concurrent `bun x` finished installing into this directory
-    /// at or after `wait_start`. Rerunning `bun add` then (`--force` for
-    /// dist-tag installs) would mutate the tree out from under the process
-    /// that just started executing it, so the caller skips the install and
-    /// runs the freshly installed tree instead.
-    fn install_completed_while_waiting(lock: &bun_sys::File, wait_start: i64) -> bool {
-        let mut buf = [0u8; Self::LOCK_TIMESTAMP_LEN];
-        match bun_sys::pread(lock.fd(), &mut buf, 0) {
-            Ok(n) if n == buf.len() => {}
-            _ => return false,
-        }
-        let mut ts: i64 = 0;
-        for &b in &buf {
-            if !b.is_ascii_digit() {
-                return false;
-            }
-            ts = match ts
-                .checked_mul(10)
-                .and_then(|v| v.checked_add(i64::from(b - b'0')))
-            {
-                Some(v) => v,
-                None => return false,
-            };
-        }
-        ts >= wait_start
-    }
-
-    /// Opens (creating if needed) `<bunx_cache_dir>/.bunx-lock` and takes an
-    /// advisory lock on it. Returns `None` when the lock can't be acquired
-    /// (including contention in `nonblocking` mode). Dropping the returned
-    /// file releases the lock; the fd is CLOEXEC so exec'ing the target
-    /// binary releases it too.
-    ///
-    /// Concurrent `bun x` processes for the same package share one install
-    /// directory. The exclusive lock serializes installs so they don't
-    /// corrupt each other's node_modules; the shared lock keeps a process
-    /// from executing a tree another process is mutating mid-install.
-    fn lock_cache_dir(
-        bunx_cache_dir: &[u8],
-        mode: bun_sys::FileLockMode,
-        nonblocking: bool,
-    ) -> Option<bun_sys::File> {
-        let mut path = PathBuffer::uninit();
-        let len = {
-            let total = path.len();
-            let mut cursor: &mut [u8] = &mut path[..];
-            write!(
-                cursor,
-                "{dir}{sep}.bunx-lock",
-                dir = BStr::new(bunx_cache_dir),
-                sep = bun_paths::SEP as char,
-            )
-            .ok()?;
-            total - cursor.len()
-        };
-        path[len] = 0;
-        // SAFETY: path[len] == 0 written above
-        let path_z = ZStr::from_buf(&path[..], len);
-
-        for _ in 0..5 {
-            let fd =
-                bun_sys::openat(Fd::cwd(), path_z, O::CREAT | O::RDWR | O::CLOEXEC, 0o600).ok()?;
-            let file = bun_sys::File::from_fd(fd);
-            match bun_sys::flock(fd, mode, nonblocking) {
-                Ok(true) => {}
-                Ok(false) | Err(_) => return None,
-            }
-            if Self::lock_file_identity_ok(fd, path_z) {
-                return Some(file);
-            }
-            // Unlinked while we waited; `file` closes on drop. Reopen.
-        }
-        None
-    }
-
     pub(crate) fn exec(ctx: &mut ContextData, argv: &[&'static ZStr]) -> crate::Result<()> {
         // Don't log stuff
         ctx.debug.silent = true;
@@ -1203,7 +1145,6 @@ impl BunxCommand {
                 };
                 if let Some(destination) = dest_or_cache {
                     let out: &[u8] = destination.as_bytes();
-                    let mut cache_read_lock: Option<bun_sys::File> = None;
 
                     // If this directory was installed by bunx, we want to perform cache invalidation on it
                     // this way running `bunx hello` will update hello automatically to the latest version
@@ -1287,26 +1228,9 @@ impl BunxCommand {
                             }
                         }
 
-                        // Another bunx process may be mid-install into this
-                        // shared directory; running now risks a partially
-                        // copied tree. Busy → take the install path, which
-                        // waits for the installer to finish. With
-                        // --no-install the install path is a hard error, so
-                        // keep the old behavior and run what was found.
-                        if !opts.no_install {
-                            cache_read_lock = Self::lock_cache_dir(
-                                bunx_cache_dir,
-                                bun_sys::FileLockMode::Shared,
-                                /* nonblocking */ true,
-                            );
-                            if cache_read_lock.is_none() {
-                                bun_output::scoped_log!(
-                                    bunx,
-                                    "install in progress for {}, waiting",
-                                    BStr::new(bunx_cache_dir)
-                                );
-                                break 'try_run_existing;
-                            }
+                        // The install path waits for it; with --no-install that path is an error.
+                        if !opts.no_install && InstallLock::install_in_progress(bunx_cache_dir) {
+                            break 'try_run_existing;
                         }
                     }
 
@@ -1316,7 +1240,6 @@ impl BunxCommand {
                         BStr::new(destination.as_bytes())
                     );
                     let stored = fs.dirname_store.append_slice(out)?;
-                    drop(cache_read_lock);
                     Run::run_binary(
                         ctx,
                         stored,
@@ -1415,31 +1338,13 @@ impl BunxCommand {
                                         do_cache_bust = true;
                                         break 'try_run_existing;
                                     }
-                                    // Same mid-install guard as the first
-                                    // cache probe.
-                                    let cache_read_lock = if !opts.no_install
+                                    if !opts.no_install
                                         && strings::has_prefix(out, bunx_cache_dir)
+                                        && InstallLock::install_in_progress(bunx_cache_dir)
                                     {
-                                        match Self::lock_cache_dir(
-                                            bunx_cache_dir,
-                                            bun_sys::FileLockMode::Shared,
-                                            /* nonblocking */ true,
-                                        ) {
-                                            Some(lock) => Some(lock),
-                                            None => {
-                                                bun_output::scoped_log!(
-                                                    bunx,
-                                                    "install in progress for {}, waiting",
-                                                    BStr::new(bunx_cache_dir)
-                                                );
-                                                break 'try_run_existing;
-                                            }
-                                        }
-                                    } else {
-                                        None
-                                    };
+                                        break 'try_run_existing;
+                                    }
                                     let stored = fs.dirname_store.append_slice(out)?;
-                                    drop(cache_read_lock);
                                     Run::run_binary(
                                         ctx,
                                         stored,
@@ -1501,20 +1406,11 @@ impl BunxCommand {
             Global::exit(1);
         }
 
-        // Serialize concurrent `bun x` installs into this shared directory.
-        // Without the lock, simultaneous cold-cache spawns of the same
-        // package install into the same node_modules at once and fail with
-        // EEXIST/ENOENT ("failed copying files from cache to destination")
-        // or execute a half-written tree. Held (blocking) through the
-        // install and the post-install bin probes; released right before
-        // exec'ing the target. On failure, fall back to the old unlocked
-        // behavior rather than refusing to run.
+        // Concurrent cold-cache runs of one package share this directory: hold the lock through the
+        // install and the bin probes below, until exec. Unlockable: install without it, as before.
         let install_wait_start = bun_core::time::timestamp();
-        let mut install_lock = Self::lock_cache_dir(
-            bunx_cache_dir,
-            bun_sys::FileLockMode::Exclusive,
-            /* nonblocking */ false,
-        );
+        let mut install_lock =
+            InstallLock::acquire(bunx_cache_dir, bun_sys::FileLockMode::Exclusive, false);
         if install_lock.is_none() {
             bun_output::scoped_log!(
                 bunx,
@@ -1523,11 +1419,9 @@ impl BunxCommand {
             );
         }
 
-        let skip_install = match &install_lock {
-            Some(lock) => Self::install_completed_while_waiting(lock, install_wait_start),
-            None => false,
-        };
-        if skip_install {
+        // The holder we queued behind just installed this tree; `bun add` again (`--force` for a
+        // dist tag) would rewrite it under the process now running out of it.
+        if (install_lock.as_ref()).is_some_and(|lock| lock.installed_since(install_wait_start)) {
             bun_output::scoped_log!(
                 bunx,
                 "concurrent bunx finished installing {}, skipping reinstall",
@@ -1721,7 +1615,7 @@ impl BunxCommand {
             // Bail out to the generic error rather than execute it.
             if Self::is_trusted_cached_binary(destination, uid) {
                 let stored = fs.dirname_store.append_slice(out)?;
-                Self::release_install_lock(&mut install_lock);
+                InstallLock::release_after_install(&mut install_lock);
                 Run::run_binary(
                     ctx,
                     stored,
@@ -1782,7 +1676,7 @@ impl BunxCommand {
                         // Same TOCTOU hardening as the post-install probe above.
                         if Self::is_trusted_cached_binary(destination, uid) {
                             let stored = fs.dirname_store.append_slice(out)?;
-                            Self::release_install_lock(&mut install_lock);
+                            InstallLock::release_after_install(&mut install_lock);
                             Run::run_binary(
                                 ctx,
                                 stored,

From 1038bddf5c7b350721c7578d30ba14dab03d02bf Mon Sep 17 00:00:00 2001
From: Jarred Sumner <jarred@jarredsumner.com>
Date: Mon, 17 Aug 2026 05:50:38 +0000
Subject: [PATCH 203/258] simplify(s2-paths): compact ScriptArgv, pack bin-kind
 walk and destination handling, trim comments

(cherry picked from commit 1ef042c6594b5859f2537b1594402acf62fa0c98)
---
 src/install/lifecycle_script_runner.rs |  46 +++--------
 src/runtime/cli/filter_run.rs          |  15 ++--
 src/runtime/cli/pack_command.rs        | 108 +++++++++----------------
 src/runtime/cli/run_command.rs         |  13 +--
 4 files changed, 58 insertions(+), 124 deletions(-)

diff --git a/src/install/lifecycle_script_runner.rs b/src/install/lifecycle_script_runner.rs
index 12805200e8d3..77c90fff9b39 100644
--- a/src/install/lifecycle_script_runner.rs
+++ b/src/install/lifecycle_script_runner.rs
@@ -247,50 +247,30 @@ pub fn replace_package_manager_run(
     Ok(())
 }
 
-/// argv for spawning a package.json script: `<shell> -c <script>` with the
-/// POSIX shell the caller found, otherwise (always on Windows)
-/// `bun exec --no-env-file <script>`.
-///
-/// The envp the caller spawns with is the script's entire environment either
-/// way: `sh` adds nothing to it, and `--no-env-file` keeps `bun exec` from
-/// loading the `.env*` files in the script's cwd on top of it.
-pub struct ScriptArgv<'a> {
-    /// Elements are bare nullable pointers (an `Option<*const c_char>` would
-    /// not be one word each); terminated by a null after the last argument,
-    /// which for the shell form is one slot early.
-    argv: [*const c_char; 5],
-    _borrowed: core::marker::PhantomData<&'a ZStr>,
-}
+/// `<shell> -c <script>`, or without a POSIX shell (always on Windows, where `find_shell` yields
+/// cmd.exe) `bun exec --no-env-file <script>`: like `sh`, that adds no `.env*` file to the envp.
+pub struct ScriptArgv<'a>([*const c_char; 5], core::marker::PhantomData<&'a ZStr>);
 
 impl<'a> ScriptArgv<'a> {
     pub fn new(shell: Option<&'a ZStr>, script: &'a ZStr) -> Result<Self, crate::Error> {
-        // `find_shell` yields cmd.exe on Windows, which does not take `-c`.
+        let (null, script) = (core::ptr::null(), script.as_ptr());
+        let (exec, no_env_file) = (c"exec".as_ptr(), c"--no-env-file".as_ptr());
         let argv = match shell {
-            Some(shell) if cfg!(unix) => [
-                shell.as_ptr(),
-                c"-c".as_ptr(),
-                script.as_ptr(),
-                core::ptr::null(),
-                core::ptr::null(),
-            ],
+            Some(sh) if cfg!(unix) => [sh.as_ptr(), c"-c".as_ptr(), script, null, null],
             _ => [
                 bun_core::self_exe_path()?.as_ptr(),
-                c"exec".as_ptr(),
-                c"--no-env-file".as_ptr(),
-                script.as_ptr(),
-                core::ptr::null(),
+                exec,
+                no_env_file,
+                script,
+                null,
             ],
         };
-        Ok(Self {
-            argv,
-            _borrowed: core::marker::PhantomData,
-        })
+        Ok(Self(argv, core::marker::PhantomData))
     }
 
-    /// The null-terminated array `spawn_process` takes; valid while `self`
-    /// (and the strings it borrows) is.
+    /// The null-terminated array `spawn_process` takes.
     pub fn as_ptr(&self) -> *const *const c_char {
-        self.argv.as_ptr()
+        self.0.as_ptr()
     }
 }
 
diff --git a/src/runtime/cli/filter_run.rs b/src/runtime/cli/filter_run.rs
index 15bd75c2d64a..4bcd415f7a77 100644
--- a/src/runtime/cli/filter_run.rs
+++ b/src/runtime/cli/filter_run.rs
@@ -114,8 +114,8 @@ impl<'a> ProcessHandle<'a> {
             }
             // SAFETY: see above; reborrow through raw ptr to avoid overlapping &mut with guard.
             let envp = unsafe { (*env_ptr).map.create_null_delimited_env_map()? };
-            // SAFETY: `argv` and `envp` are null-terminated C-string arrays
-            // (argv[0] non-null) owned by locals that outlive this call.
+            // SAFETY: `argv`/`envp` are local null-terminated C-string arrays
+            // with argv[0] non-null; valid for this call.
             break 'brk unsafe {
                 spawn::spawn_process(
                     &handle.options,
@@ -929,13 +929,10 @@ pub(crate) fn run_scripts_with_filter(
         &mut *event_loop
     }));
     let shell_bin: Option<&'static ZStr> = if cfg!(unix) {
-        let shell = RunCommand::find_shell(
-            // SAFETY: env_ptr is the live process-lifetime DotEnv loader.
-            unsafe { (*env_ptr).get(b"PATH") }.unwrap_or(b""),
-            fsinstance.top_level_dir,
-        )
-        .ok_or(crate::Error::MissingShell)?;
-        Some(shell)
+        // SAFETY: env_ptr is the live process-lifetime DotEnv loader.
+        let path = unsafe { (*env_ptr).get(b"PATH") }.unwrap_or(b"");
+        let top_level_dir = fsinstance.top_level_dir;
+        Some(RunCommand::find_shell(path, top_level_dir).ok_or(crate::Error::MissingShell)?)
     } else {
         None
     };
diff --git a/src/runtime/cli/pack_command.rs b/src/runtime/cli/pack_command.rs
index 74399245803b..506382070bbc 100644
--- a/src/runtime/cli/pack_command.rs
+++ b/src/runtime/cli/pack_command.rs
@@ -1508,30 +1508,25 @@ fn bin_kind_without_following_symlinks(
 ) -> bun_sys::FileKind {
     // A trailing slash would make `lstat` resolve a symlink to a directory.
     let bin_path = strings::without_trailing_slash(bin_path);
-    // By absolute path: on Windows `lstatat` reports a reparse point as its target's kind.
     let mut spill: Vec<u8> = Vec::new();
-    let mut end = 0;
-    loop {
-        end += match strings::index_of_char_usize(&bin_path[end..], b'/') {
-            Some(i) => i,
-            None => bin_path.len() - end,
-        };
-        let abs_path = resolve_path::join_z_spill::<resolve_path::platform::Auto>(
-            &mut spill,
-            &[abs_workspace_path, &bin_path[..end]],
-        );
-        let kind = match bun_sys::lstat(abs_path) {
-            Ok(stat) => bun_sys::kind_from_mode(stat.st_mode as bun_sys::Mode),
-            Err(_) => return bun_sys::FileKind::Unknown,
+    let slashes = (bin_path.iter().enumerate()).filter_map(|(i, &c)| (c == b'/').then_some(i));
+    for end in slashes.chain([bin_path.len()]) {
+        // By absolute path: on Windows `lstatat` reports a reparse point as its target's kind.
+        let parts: [&[u8]; 2] = [abs_workspace_path, &bin_path[..end]];
+        let abs_path =
+            resolve_path::join_z_spill::<resolve_path::platform::Auto>(&mut spill, &parts);
+        let Ok(stat) = bun_sys::lstat(abs_path) else {
+            break;
         };
+        let kind = bun_sys::kind_from_mode(stat.st_mode as bun_sys::Mode);
         if end == bin_path.len() {
             return kind;
         }
         if kind != bun_sys::FileKind::Directory {
-            return bun_sys::FileKind::Unknown;
+            break;
         }
-        end += 1;
     }
+    bun_sys::FileKind::Unknown
 }
 
 fn is_package_bin(bins: &[BinInfo], maybe_bin_path: &[u8]) -> bool {
@@ -1849,12 +1844,7 @@ fn opt_pack_gzip_level(m: &PackageManager) -> Option<&[u8]> {
 // `Some` only when FOR_PUBLISH == true.
 pub(crate) type PackReturn<'a, const FOR_PUBLISH: bool> = Option<Publish::Context<'a, true>>;
 
-/// The package.json being packed, through the manager's cache; a package.json
-/// that cannot be read or parsed ends the command.
-///
-/// `workspace_package_json_cache` and `log` are disjoint fields on
-/// `PackageManager`; route through raw-pointer field projections so the two
-/// `&mut` borrows don't conflict.
+/// Through the manager's cache; exits when it cannot be read or parsed.
 fn package_json_entry<'a>(
     manager_ptr: *mut PackageManager,
     abs_package_json_path: &ZStr,
@@ -1987,18 +1977,12 @@ pub(crate) fn pack<const FOR_PUBLISH: bool>(
         // not repeated.
         unsafe { (*transpiler_for_deinit).deinit() };
     }
-    let script_env = ctx.manager.env_mut();
-    script_env.map.put(b"npm_command", b"pack")?;
-    // `configure_env_for_run` described the package.json of the directory the
-    // package manager chdir'd to, which for a workspace member is the
-    // workspace root; the lifecycle scripts belong to the manifest being packed.
-    script_env
-        .map
-        .put(b"npm_package_json", abs_package_json_path.as_bytes())?;
-    script_env.map.put(b"npm_package_name", package_name)?;
-    script_env
-        .map
-        .put(b"npm_package_version", package_version)?;
+    let script_env = &mut ctx.manager.env_mut().map;
+    script_env.put(b"npm_command", b"pack")?;
+    // `configure_env_for_run` described the workspace root's package.json, not the one packed.
+    script_env.put(b"npm_package_json", abs_package_json_path.as_bytes())?;
+    script_env.put(b"npm_package_name", package_name)?;
+    script_env.put(b"npm_package_version", package_version)?;
 
     let (postpack_script, publish_script, postpublish_script, ran_scripts): (
         Option<Box<[u8]>>,
@@ -2471,14 +2455,18 @@ pub(crate) fn pack<const FOR_PUBLISH: bool>(
     let abs_tarball_dest: Option<&ZStr> = if FOR_PUBLISH {
         None
     } else {
-        Some(pack_destination(
-            ctx.manager,
+        let (abs_tarball_dest, abs_tarball_dest_dir_end) = tarball_destination(
+            opt_pack_destination(ctx.manager),
+            opt_pack_filename(ctx.manager),
             ctx.original_cwd,
             abs_workspace_path,
             package_name,
             package_version,
-            &mut dest_buf,
-        ))
+            &mut dest_buf[..],
+        );
+        // create the directory if it doesn't exist
+        let _ = Dir::cwd().make_path(&abs_tarball_dest.as_bytes()[..abs_tarball_dest_dir_end]);
+        Some(abs_tarball_dest)
     };
 
     if archive_write_open2(
@@ -2990,30 +2978,6 @@ impl<'a> fmt::Display for TarballNameFormatter<'a> {
     }
 }
 
-/// Resolves where `bun pm pack` writes the tarball and creates that directory.
-fn pack_destination<'a>(
-    manager: &PackageManager,
-    original_cwd: &[u8],
-    abs_workspace_path: &[u8],
-    package_name: &[u8],
-    package_version: &[u8],
-    buf: &'a mut PathBuffer,
-) -> &'a ZStr {
-    let (abs_tarball_dest, dir_end) = tarball_destination(
-        opt_pack_destination(manager),
-        opt_pack_filename(manager),
-        original_cwd,
-        abs_workspace_path,
-        package_name,
-        package_version,
-        &mut buf[..],
-    );
-    let len = abs_tarball_dest.as_bytes().len();
-    let _ = bun_sys::Dir::cwd().make_path(&buf[..dir_end]);
-    // SAFETY: buf[len] == 0 (written by tarball_destination)
-    ZStr::from_buf(&buf[..], len)
-}
-
 /// The only write to disk, and so the only failure that has a partial file to remove.
 fn write_tarball(abs_tarball_dest: &ZStr, tarball_bytes: &[u8]) {
     let file = match File::create(Fd::cwd(), abs_tarball_dest, true) {
@@ -3200,13 +3164,15 @@ fn add_archive_entry(
 
 /// What the tarball's package.json gets in place of a `workspace:` or `catalog:` spec.
 enum Substitution<'a> {
-    /// `workspace:^`, `workspace:~`, `workspace:*`: the workspace's current version behind that prefix.
-    WorkspaceVersion { prefix: &'static str },
-    /// Another workspace under this dependency's name, `workspace:@acme/core@*`; a directory,
-    /// `workspace:../core`; or `workspace:1.x` on a dependency that is itself a workspace.
+    /// `workspace:^` / `~` / `*`: the workspace's current version behind that prefix.
+    WorkspaceVersion {
+        prefix: &'static str,
+    },
+    /// `workspace:@acme/core@*` (alias), `workspace:../core`, or `workspace:1.x` on a workspace.
     WorkspaceRangeOrDirectory(&'a [u8]),
-    /// `catalog:` / `catalog:<name>`: that catalog's entry for the dependency.
-    Catalog { catalog_name: &'a [u8] },
+    Catalog {
+        catalog_name: &'a [u8],
+    },
 }
 
 impl<'a> Substitution<'a> {
@@ -3322,9 +3288,8 @@ fn publish_spec_for_workspace_range_or_directory(
     ))
 }
 
-/// `<name>@<range>` of `workspace:<name>@<range>`, which installs workspace `<name>` under the
-/// dependency's name. `<name>` may be scoped, so it ends at the last `@`; what a directory such as
-/// `../@scope/pkg` leaves in front of its last `@` is not a package name, so that is not an alias.
+/// `<name>@<range>` of `workspace:<name>@<range>`; `<name>` may be scoped, so it ends at the last
+/// `@`, and a directory like `../@scope/pkg` is not an alias since `../` is no package name.
 fn split_workspace_alias(spec: &[u8]) -> Option<(&[u8], &[u8])> {
     let at = strings::last_index_of_char(spec, b'@').filter(|at| *at > 0)?;
     let (name, range) = (&spec[..at], &spec[at + 1..]);
@@ -3350,7 +3315,6 @@ fn publish_workspace(
 }
 
 /// Edits `json.root` in place (`bun publish` sends that tree to the registry) and returns it printed.
-/// `workspace_manifests` is `Some` whenever `needs_workspace_manifests(json.root)` is.
 fn edit_root_package_json(
     workspace_manifests: Option<&WorkspaceManifests>,
     package_dir: &[u8],
diff --git a/src/runtime/cli/run_command.rs b/src/runtime/cli/run_command.rs
index efd05d5cf0fe..5bcd4a868801 100644
--- a/src/runtime/cli/run_command.rs
+++ b/src/runtime/cli/run_command.rs
@@ -614,11 +614,8 @@ Full documentation is available at <magenta>https://bun.com/docs/cli/run<r>
         this_transpiler.resolver.care_about_bin_folder = true;
         this_transpiler.resolver.care_about_scripts = true;
         this_transpiler.resolver.store_fd = opts.store_root_fd;
-        // The directories read below are cached process-wide and reused by the
-        // VM that `bun run file.js` boots afterwards, and a package.json's
-        // dependency ranges (what auto-install resolves against) are only
-        // recorded when the resolver caching it has auto-install enabled. So
-        // this resolver needs the VM's setting (see `InitOptions::global_cache`).
+        // The dir cache below outlives this resolver into the VM, and only an auto-installing
+        // resolver records the package.json dependency ranges auto-install resolves against.
         this_transpiler.options.global_cache = ctx.debug.global_cache;
         this_transpiler.resolver.opts.global_cache = ctx.debug.global_cache;
 
@@ -693,11 +690,7 @@ Full documentation is available at <magenta>https://bun.com/docs/cli/run<r>
         // remaining env-var seeding.
         let env_loader = this_transpiler.env_mut();
 
-        // Like npm, `npm_config_local_prefix` and the `npm_package_*` vars below
-        // describe this run and overwrite what an outer `bun run` exported
-        // (`cd pkg && bun run x` must see `pkg`'s values); name/version are left
-        // alone only when package.json lacks them. `npm_config_user_agent` /
-        // `npm_execpath` are deliberately inherited.
+        // This and `npm_package_*` describe this run, over whatever an outer `bun run` exported.
         env_loader
             .map
             .put(b"npm_config_local_prefix", top_level_dir)

From ee5da4318b561599729e5e1dcbf81d5792fd7f2b Mon Sep 17 00:00:00 2001
From: Jarred Sumner <jarred@jarredsumner.com>
Date: Mon, 17 Aug 2026 05:53:15 +0000
Subject: [PATCH 204/258] simplify(s2-paths): make_path NotFound guard without
 splitting arms; compact errno/io helpers and PackageManager comments

(cherry picked from commit 914eada8f8419cbe6c393f57ee01ae95ac2513cc)
---
 src/errno/lib.rs                | 38 ++++++++++-----------------------
 src/install/PackageManager.rs   | 29 ++++++-------------------
 src/paths/component_iterator.rs | 34 +++++++++--------------------
 src/runtime/cli/pack_command.rs |  5 +----
 4 files changed, 29 insertions(+), 77 deletions(-)

diff --git a/src/errno/lib.rs b/src/errno/lib.rs
index ff770d74dd52..ab0331eef9a0 100644
--- a/src/errno/lib.rs
+++ b/src/errno/lib.rs
@@ -305,18 +305,13 @@ pub fn from_errno(errno: i32) -> SystemErrno {
 }
 
 impl SystemErrno {
-    /// The OS error behind a `std::io::Error`; `None` if it is not an OS error or its code has no `SystemErrno`.
+    /// `None` if `err` is not an OS error or its code has no `SystemErrno`.
     pub fn from_io_error(err: &std::io::Error) -> Option<SystemErrno> {
-        let code = err.raw_os_error()?;
+        // A Win32 code there, which the `u32` entry point maps (`i64` would take it for an errno).
         #[cfg(windows)]
-        {
-            // A Win32 code: the `u32` entry point maps it, `i64` would read it as an errno discriminant.
-            SystemErrno::init(code as u32)
-        }
+        return SystemErrno::init(err.raw_os_error()? as u32);
         #[cfg(not(windows))]
-        {
-            SystemErrno::init(i64::from(code))
-        }
+        return SystemErrno::init(i64::from(err.raw_os_error()?));
     }
 }
 
@@ -521,28 +516,17 @@ mod errno_name_tests {
 
     #[test]
     fn io_error_to_errno() {
-        // Deliberately not EAGAIN, which is what the callers fall back to.
+        let of = |code| SystemErrno::from_io_error(&std::io::Error::from_raw_os_error(code));
         #[cfg(not(windows))]
-        assert_eq!(
-            SystemErrno::from_io_error(&std::io::Error::from_raw_os_error(libc::ENOMEM)),
-            Some(SystemErrno::ENOMEM)
-        );
+        assert_eq!(of(libc::ENOMEM), Some(SystemErrno::ENOMEM));
+        // Win32 ERROR_NOT_ENOUGH_MEMORY / ERROR_ACCESS_DENIED; as errno values 8 and 5 are ENOEXEC and EIO.
         #[cfg(windows)]
-        {
-            // Win32 ERROR_NOT_ENOUGH_MEMORY and ERROR_ACCESS_DENIED; read as errno values, 8 and 5 would be ENOEXEC and EIO.
-            assert_eq!(
-                SystemErrno::from_io_error(&std::io::Error::from_raw_os_error(8)),
-                Some(SystemErrno::ENOMEM)
-            );
-            assert_eq!(
-                SystemErrno::from_io_error(&std::io::Error::from_raw_os_error(5)),
-                Some(SystemErrno::EPERM)
-            );
-        }
         assert_eq!(
-            SystemErrno::from_io_error(&std::io::Error::other("not from the OS")),
-            None
+            (of(8), of(5)),
+            (Some(SystemErrno::ENOMEM), Some(SystemErrno::EPERM))
         );
+        let not_os = std::io::Error::other("not from the OS");
+        assert_eq!(SystemErrno::from_io_error(&not_os), None);
     }
 
     #[test]
diff --git a/src/install/PackageManager.rs b/src/install/PackageManager.rs
index 0662a15bf4bc..a1ff0d1e1e1d 100644
--- a/src/install/PackageManager.rs
+++ b/src/install/PackageManager.rs
@@ -550,20 +550,10 @@ impl Subcommand {
 
     /// `init` opens package.json read-write for these so a read-only file fails before any work.
     pub(crate) fn writes_package_json(self, has_package_args: bool) -> bool {
-        match self {
-            Self::Add | Self::Remove | Self::Update | Self::Patch | Self::PatchCommit => true,
-            Self::Install | Self::Link => has_package_args,
-            Self::Pm
-            | Self::Unlink
-            | Self::Outdated
-            | Self::Pack
-            | Self::Publish
-            | Self::Audit
-            | Self::Info
-            | Self::Why
-            | Self::Dedupe
-            | Self::Prune => false,
-        }
+        matches!(
+            self,
+            Self::Add | Self::Remove | Self::Update | Self::Patch | Self::PatchCommit
+        ) || (matches!(self, Self::Install | Self::Link) && has_package_args)
     }
 }
 
@@ -1704,11 +1694,8 @@ pub fn init(
                     let json_stat_size = json_file.get_end_pos()?;
                     let mut json_buf = vec![0u8; (json_stat_size + 64) as usize];
                     let json_len = json_file.pread_all(&mut json_buf, 0)?;
-                    // Use the cwd-space path the file was opened at, not the fd's
-                    // realpath: the realpath can sit on another drive letter
-                    // (subst / junction) or outside the project (symlink), and
-                    // relative paths cannot cross drives (#39357). Copied because
-                    // `parent_path_buf` is reused while `json_source` is live.
+                    // The path as opened, not the fd's realpath, which may be on another drive
+                    // (subst, junction) or outside the project (symlink) (#39357).
                     let json_path_len =
                         parent_without_trailing_slash.len() + b"/package.json".len();
                     // SAFETY: ROOT_PACKAGE_JSON_PATH_BUF is a process-global only touched on main
@@ -1863,9 +1850,7 @@ pub fn init(
         // until now). The slice excludes the NUL — `top_level_dir` is `[]u8`.
         // PathBuffer is repr(transparent) over [u8; N], so the raw cast is sound.
         fs.set_top_level_dir(bun_core::ffi::slice(CWD_BUF.get().cast::<u8>(), tld.len()));
-        // Build the root package.json path from `top_level_dir` instead of
-        // realpath'ing the fd, so later relative-path computations against
-        // `top_level_dir` never cross onto a different drive letter (#39357).
+        // From `top_level_dir`, not the fd's realpath, so relative paths never cross drives (#39357).
         let root_buf = &mut *ROOT_PACKAGE_JSON_PATH_BUF.get();
         let tld_no_slash = strings::without_trailing_slash(tld);
         let plen = tld_no_slash.len() + SEP_PACKAGE_JSON.len();
diff --git a/src/paths/component_iterator.rs b/src/paths/component_iterator.rs
index 28146304fabc..4f98b0a45800 100644
--- a/src/paths/component_iterator.rs
+++ b/src/paths/component_iterator.rs
@@ -207,30 +207,21 @@ pub fn make_path_with<'a, T: PathChar, E>(
     let Some(mut comp) = it.last() else {
         return Ok(());
     };
-    // A component that reports `NotFound` twice with no `Created` in between
-    // can never succeed (dangling symlink, or Windows OBJECT_NAME_INVALID
-    // surfacing as ENOENT); abort instead of ping-ponging forever (#39357).
+    // `NotFound` again once its parent exists can never succeed (dangling symlink,
+    // Windows OBJECT_NAME_INVALID surfacing as ENOENT): abort instead of looping (#39357).
     let mut last_not_found: Option<usize> = None;
     loop {
         match mkdir(comp.path)? {
-            MakePathStep::Created => {
-                last_not_found = None;
-                comp = match it.next() {
-                    Some(c) => c,
-                    None => return Ok(()),
-                };
-            }
-            MakePathStep::Exists => {
+            MakePathStep::Created | MakePathStep::Exists => {
                 comp = match it.next() {
                     Some(c) => c,
                     None => return Ok(()),
                 };
             }
             MakePathStep::NotFound(e) => {
-                if last_not_found == Some(comp.path.len()) {
+                if last_not_found.replace(comp.path.len()) == Some(comp.path.len()) {
                     return Err(e);
                 }
-                last_not_found = Some(comp.path.len());
                 comp = match it.previous() {
                     Some(c) => c,
                     None => return Err(e),
@@ -400,19 +391,14 @@ mod tests {
         let it = ComponentIterator::init(&b"/t/a/b"[..], PathFormat::Posix).unwrap();
         let mut created = std::collections::HashSet::new();
         let result: Result<(), &str> = make_path_with(it, |p| {
-            if p == b"/t" {
-                return Ok(MakePathStep::Exists);
-            }
-            if created.contains(p) {
-                return Ok(MakePathStep::Exists);
-            }
-            let parent_ok = p == b"/t/a" || created.contains(b"/t/a".as_slice());
-            if parent_ok {
+            Ok(if p == b"/t" || created.contains(p) {
+                MakePathStep::Exists
+            } else if p == b"/t/a" || created.contains(b"/t/a".as_slice()) {
                 created.insert(p);
-                Ok(MakePathStep::Created)
+                MakePathStep::Created
             } else {
-                Ok(MakePathStep::NotFound("enoent"))
-            }
+                MakePathStep::NotFound("enoent")
+            })
         });
         assert_eq!(result, Ok(()));
         assert!(created.contains(b"/t/a/b".as_slice()));
diff --git a/src/runtime/cli/pack_command.rs b/src/runtime/cli/pack_command.rs
index 506382070bbc..0df3621fece4 100644
--- a/src/runtime/cli/pack_command.rs
+++ b/src/runtime/cli/pack_command.rs
@@ -1443,10 +1443,7 @@ fn get_package_bins(json: &Expr) -> Result<Vec<BinInfo>, AllocError> {
                         else {
                             continue;
                         };
-                        let already_listed = bins.iter().any(|existing| {
-                            strings::eql_long(existing.path.as_bytes(), subpath, true)
-                        });
-                        if !already_listed {
+                        if !bins.iter().any(|listed| listed.path.as_bytes() == subpath) {
                             bins.push(BinInfo {
                                 path: ZBox::from_bytes(subpath),
                                 ty: BinType::File,

From 7339b54cae8f5eaedcaf2ecff1e5c4b99788b088 Mon Sep 17 00:00:00 2001
From: Jarred Sumner <jarred@jarredsumner.com>
Date: Mon, 17 Aug 2026 05:54:29 +0000
Subject: [PATCH 205/258] simplify(s2-paths): inline --cwd and
 --network-concurrency handling back into the param tables

(cherry picked from commit 87ae45b8c773c46a330bd1c0f1747bcef45caddd)
---
 .../PackageManager/CommandLineArguments.rs    | 79 ++++++++-----------
 1 file changed, 34 insertions(+), 45 deletions(-)

diff --git a/src/install/PackageManager/CommandLineArguments.rs b/src/install/PackageManager/CommandLineArguments.rs
index 809fdf6016b1..80ccb7f285a0 100644
--- a/src/install/PackageManager/CommandLineArguments.rs
+++ b/src/install/PackageManager/CommandLineArguments.rs
@@ -81,15 +81,6 @@ const BACKEND_PARAM: ParamType = clap::param!(
     "--backend <STR>                       Platform-specific optimizations for installing dependencies. Possible values: \"hardlink\" (default), \"symlink\", \"copyfile\""
 );
 
-const NETWORK_CONCURRENCY_PARAM: ParamType = clap::param!(
-    "--network-concurrency <NUM>           Maximum number of concurrent network requests (default 64)"
-);
-const _: () = assert!(
-    super::DEFAULT_MAX_SIMULTANEOUS_REQUESTS_FOR_BUN_INSTALL == 64
-        && super::DEFAULT_MAX_SIMULTANEOUS_REQUESTS_FOR_BUN_INSTALL_FOR_PROXIES == 64,
-    "update the default in the --network-concurrency help text (and docs/snippets/cli/*.mdx)"
-);
-
 const SHARED_HEAD_PARAMS: &[ParamType] = &[
     clap::param!("-c, --config <STR>?                   Specify path to config file (bunfig.toml)"),
     clap::param!("-y, --yarn                            Write a yarn.lock file (yarn v1)"),
@@ -156,7 +147,9 @@ const SHARED_TAIL_PARAMS: &[ParamType] = &[
     clap::param!(
         "--concurrent-scripts <NUM>            Maximum number of concurrent jobs for lifecycle scripts (default: 2x CPU cores)"
     ),
-    NETWORK_CONCURRENCY_PARAM,
+    clap::param!(
+        "--network-concurrency <NUM>           Maximum number of concurrent network requests (default 64)"
+    ),
     clap::param!("--save-text-lockfile                  Save a text-based lockfile"),
     clap::param!(
         "--omit <dev|optional|peer>...         Exclude 'dev', 'optional', or 'peer' dependencies from install"
@@ -1628,8 +1621,37 @@ Full documentation is available at <magenta>https://bun.com/docs/pm/cli/prune<r>
             cli.concurrent_scripts = strings::parse_int::<usize>(concurrency, 10).ok();
         }
 
-        if let Some(cwd) = args.option(b"--cwd") {
-            change_directory(cwd)?;
+        if let Some(cwd_) = args.option(b"--cwd") {
+            let mut buf = PathBuffer::uninit();
+            let mut buf2 = PathBuffer::uninit();
+
+            let final_path: Option<&bun_core::ZStr> = if !cwd_.is_empty() && cwd_[0] == b'.' {
+                let cwd_len = bun_sys::getcwd(&mut buf[..])?;
+                let cwd = &buf[..cwd_len];
+                let parts: [&[u8]; 1] = [cwd_];
+                Path::resolve_path::join_abs_string_buf_z_checked::<Path::platform::Auto>(
+                    cwd,
+                    &mut buf2[..],
+                    &parts,
+                )
+            } else if cwd_.len() < buf.len() {
+                buf[..cwd_.len()].copy_from_slice(cwd_);
+                buf[cwd_.len()] = 0;
+                Some(bun_core::ZStr::from_buf(&buf[..], cwd_.len()))
+            } else {
+                None
+            };
+            let too_long = bun_sys::Error::from_code(bun_sys::E::ENAMETOOLONG, bun_sys::Tag::chdir);
+            if let Err(err) = final_path.map_or(Err(too_long), bun_sys::chdir) {
+                Output::err_generic(
+                    "failed to change directory to \"{}\": {}\n",
+                    (
+                        bstr::BStr::new(final_path.map_or(cwd_, |p| p.as_bytes())),
+                        bstr::BStr::new(err.name()),
+                    ),
+                );
+                Global::crash();
+            }
         }
 
         if subcommand == Subcommand::Update {
@@ -1801,36 +1823,3 @@ Full documentation is available at <magenta>https://bun.com/docs/pm/cli/prune<r>
         Ok(cli)
     }
 }
-
-/// `--cwd`. Exits the process when the directory cannot be entered.
-fn change_directory(arg: &[u8]) -> Result<(), crate::Error> {
-    let mut buf = PathBuffer::uninit();
-    let mut buf2 = PathBuffer::uninit();
-    let path = if arg.first() == Some(&b'.') {
-        let cwd_len = bun_sys::getcwd(&mut buf[..])?;
-        Path::resolve_path::join_abs_string_buf_z_checked::<Path::platform::Auto>(
-            &buf[..cwd_len],
-            &mut buf2[..],
-            &[arg],
-        )
-    } else if arg.len() < buf.len() {
-        buf[..arg.len()].copy_from_slice(arg);
-        buf[arg.len()] = 0;
-        Some(bun_core::ZStr::from_buf(&buf[..], arg.len()))
-    } else {
-        None
-    };
-    let err = match path.map(bun_sys::chdir) {
-        Some(Ok(())) => return Ok(()),
-        Some(Err(err)) => err,
-        None => bun_sys::Error::from_code(bun_sys::E::ENAMETOOLONG, bun_sys::Tag::chdir),
-    };
-    Output::err_generic(
-        "failed to change directory to \"{}\": {}\n",
-        (
-            bstr::BStr::new(path.map_or(arg, |p| p.as_bytes())),
-            bstr::BStr::new(err.name()),
-        ),
-    );
-    Global::crash();
-}

From d4ff1d787a189dde8c86df130bb1643c92cdfde5 Mon Sep 17 00:00:00 2001
From: Jarred Sumner <jarred@jarredsumner.com>
Date: Mon, 17 Aug 2026 05:55:45 +0000
Subject: [PATCH 206/258] simplify(s2-paths): bin.rs candidate loop and rel_buf
 spill via resolve_path::buf_or_spill

(cherry picked from commit 7157106e76ab84258fd6659062a301bbffdf93cc)
---
 src/install/bin.rs        | 50 ++++++++++-----------------------------
 src/paths/resolve_path.rs |  2 +-
 2 files changed, 13 insertions(+), 39 deletions(-)

diff --git a/src/install/bin.rs b/src/install/bin.rs
index 707a25df57a3..48fe1b06cabc 100644
--- a/src/install/bin.rs
+++ b/src/install/bin.rs
@@ -1185,11 +1185,8 @@ impl<'a> Linker<'a> {
             abs_target.as_bytes(),
         );
 
-        // The shim resolves `bin_path` against the parent of its own directory,
-        // so the leading `..\` is implied. `relative` yields no `..\` when the
-        // target is on another drive (it returns the absolute path) or when the
-        // target is inside the bin directory itself, both of which happen with
-        // global installs; those shims store the absolute target.
+        // The shim resolves `bin_path` against its directory's parent, hence no `..\`. Global
+        // installs can target another drive or the bin directory itself: store those absolute.
         let (bin_path, is_absolute_target): (&[u8], bool) =
             match strings::without_prefix_if_possible_comptime(rel_target.as_bytes(), b"..\\") {
                 Some(rel_to_parent) => (rel_to_parent, false),
@@ -1276,17 +1273,11 @@ impl<'a> Linker<'a> {
         // so each return path calls `Self::chmod_on_ok` explicitly instead.
 
         let abs_dest_dir = resolve_path::dirname::<PlatformAuto>(abs_dest.as_bytes());
-        // Usually starts with `..`, but a global install may nest the package
-        // directory inside the bin directory; any relative path works here.
-        // One `..` per component of `abs_dest_dir` can make this longer than `abs_target`.
+        // Need not start with `..` (a global install may nest the package inside the bin
+        // directory), and one `..` per component of `abs_dest_dir` can outgrow `abs_target`.
         let rel_bound = abs_target.len() + 3 * (strings::count_char(abs_dest_dir, SEP) + 1) + 2;
-        let mut rel_spill: Vec<u8>;
-        let rel_buf: &mut [u8] = if rel_bound <= self.rel_buf.len() {
-            self.rel_buf
-        } else {
-            rel_spill = vec![0; rel_bound];
-            &mut rel_spill
-        };
+        let mut rel_spill = Vec::new();
+        let rel_buf = resolve_path::buf_or_spill(self.rel_buf, &mut rel_spill, rel_bound);
         let rel_target = resolve_path::relative_buf_z(rel_buf, abs_dest_dir, abs_target.as_bytes());
 
         match sys::symlink_running_executable(rel_target, abs_dest) {
@@ -1501,38 +1492,21 @@ impl<'a> Linker<'a> {
         }
 
         let target_basename = path::basename(target);
+        let in_subdir = target_basename.len() != target.len();
         let exe_name: Vec<u8> =
             if !bin_name.is_empty() && !strings::has_suffix_comptime(bin_name, b".exe") {
                 [bin_name, b".exe"].concat()
             } else {
                 Vec::new()
             };
-        let candidates: [&[u8]; 4] = [
-            // (1)
-            target,
-            // (2)
-            bin_name,
-            // (3), only when `target` has a directory component
-            if target_basename.len() != target.len() {
-                target_basename
-            } else {
-                b""
-            },
-            // (4)
-            &exe_name,
-        ];
-
-        for candidate in candidates {
+        let at_root = if in_subdir { target_basename } else { b"" };
+        for candidate in [target, bin_name, at_root, &exe_name] {
             if candidate.is_empty() {
                 continue;
             }
-            let Some(abs_candidate) =
-                join_z_checked::<PlatformAuto>(package_dir, buf, &[candidate])
-            else {
-                continue;
-            };
-            if sys::exists_z(abs_candidate) {
-                let len = abs_candidate.len();
+            let found = join_z_checked::<PlatformAuto>(package_dir, buf, &[candidate])
+                .filter(|abs| sys::exists_z(abs));
+            if let Some(len) = found.map(ZStr::len) {
                 return Some(ZStr::from_buf(buf, len));
             }
         }
diff --git a/src/paths/resolve_path.rs b/src/paths/resolve_path.rs
index 5a28572b73e9..5d9e48a258a9 100644
--- a/src/paths/resolve_path.rs
+++ b/src/paths/resolve_path.rs
@@ -1314,7 +1314,7 @@ pub fn normalize_buf_z_spill<'a, P: PlatformT>(
 }
 
 /// `buf` when it holds `needed` bytes, otherwise `spill` grown to `needed`.
-fn buf_or_spill<'a>(buf: &'a mut [u8], spill: &'a mut Vec<u8>, needed: usize) -> &'a mut [u8] {
+pub fn buf_or_spill<'a>(buf: &'a mut [u8], spill: &'a mut Vec<u8>, needed: usize) -> &'a mut [u8] {
     if needed <= buf.len() {
         buf
     } else {

From 466acbfcb423a05b0a6dc74d9301609c8a224e82 Mon Sep 17 00:00:00 2001
From: Jarred Sumner <jarred@jarredsumner.com>
Date: Mon, 17 Aug 2026 05:56:41 +0000
Subject: [PATCH 207/258] simplify(s2-paths): compact test-only highway stubs
 in resolve_path

(cherry picked from commit 664e48f3bbc324927da43bb33fbeef5e1f6cb753)
---
 src/paths/resolve_path.rs | 42 +++++++++++++++------------------------
 1 file changed, 16 insertions(+), 26 deletions(-)

diff --git a/src/paths/resolve_path.rs b/src/paths/resolve_path.rs
index 5d9e48a258a9..12d5d23251f5 100644
--- a/src/paths/resolve_path.rs
+++ b/src/paths/resolve_path.rs
@@ -2537,43 +2537,33 @@ mod tests {
             .unwrap_or(text_len)
     }
 
-    /// Returns `haystack_len` when `needle` does not occur, like the kernel.
+    /// `n` when `c` does not occur, like the kernel.
     #[unsafe(no_mangle)]
-    unsafe extern "C" fn highway_last_index_of_char(
-        haystack: *const u8,
-        haystack_len: usize,
-        needle: u8,
-    ) -> usize {
+    unsafe extern "C" fn highway_last_index_of_char(h: *const u8, n: usize, c: u8) -> usize {
         // SAFETY: test stub; callers pass a valid (ptr, len) pair.
-        let haystack = unsafe { core::slice::from_raw_parts(haystack, haystack_len) };
-        haystack
-            .iter()
-            .rposition(|&b| b == needle)
-            .unwrap_or(haystack_len)
+        let h = unsafe { core::slice::from_raw_parts(h, n) };
+        h.iter().rposition(|&b| b == c).unwrap_or(n)
     }
 
-    /// Returns `usize::MAX` when `needle` does not occur, like the kernel.
+    /// `usize::MAX` when `nd` does not occur, like the kernel.
     #[unsafe(no_mangle)]
     unsafe extern "C" fn highway_memrmem16(
-        haystack: *const u16,
-        haystack_len: usize,
-        needle: *const u16,
-        needle_len: usize,
+        h: *const u16,
+        n: usize,
+        nd: *const u16,
+        k: usize,
     ) -> usize {
         // SAFETY: test stub; callers pass valid (ptr, len) pairs.
-        let (haystack, needle) = unsafe {
+        let (h, nd) = unsafe {
             (
-                core::slice::from_raw_parts(haystack, haystack_len),
-                core::slice::from_raw_parts(needle, needle_len),
+                core::slice::from_raw_parts(h, n),
+                core::slice::from_raw_parts(nd, k),
             )
         };
-        if needle_len > haystack_len {
-            return usize::MAX;
-        }
-        (0..=haystack_len - needle_len)
-            .rev()
-            .find(|&i| haystack[i..i + needle_len] == *needle)
-            .unwrap_or(usize::MAX)
+        let last = n
+            .checked_sub(k)
+            .and_then(|end| (0..=end).rev().find(|&i| h[i..i + k] == *nd));
+        last.unwrap_or(usize::MAX)
     }
 
     #[test]

From 758d7b30bb8cb1247ee2b96664cd3acca20d2b36 Mon Sep 17 00:00:00 2001
From: Jarred Sumner <jarred@jarredsumner.com>
Date: Mon, 17 Aug 2026 05:56:52 +0000
Subject: [PATCH 208/258] simplify(s2-paths): arrays instead of vec! in
 resolve_path test

(cherry picked from commit 47367e3d5f3c8a239c7a4ed1fe0f2ddac61be8f1)
---
 src/paths/resolve_path.rs | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/src/paths/resolve_path.rs b/src/paths/resolve_path.rs
index 12d5d23251f5..65316686d369 100644
--- a/src/paths/resolve_path.rs
+++ b/src/paths/resolve_path.rs
@@ -2630,9 +2630,9 @@ mod tests {
             ([b"/work/", &name[..]].concat(), true)
         );
 
-        let abs = [b"/".as_slice(), &vec![b'a'; N * 2]].concat();
+        let abs = [b"/".as_slice(), &[b'a'; N * 2]].concat();
         assert_eq!(join(b"/", &abs).0, abs);
-        let cwd = [b"/".as_slice(), &vec![b'c'; N - 1]].concat();
+        let cwd = [b"/".as_slice(), &[b'c'; N - 1]].concat();
         assert_eq!(join(&cwd, b"./x").0, [&cwd[..], b"/x"].concat());
 
         // `sub/../` repeated past the buffer size resolves back under the cwd.

From 799a6508a6afdb7b96aec1f4e8f9b03a5e700c9a Mon Sep 17 00:00:00 2001
From: Jarred Sumner <jarred@jarredsumner.com>
Date: Mon, 17 Aug 2026 06:00:33 +0000
Subject: [PATCH 209/258] simplify(s2-paths): compact Windows flock and the
 keep_existing_destination test

(cherry picked from commit f82bb9e10ab8b6b586da6ae510a0b6d3b7724654)
---
 src/sys/lib.rs | 34 +++++++++++-----------------------
 1 file changed, 11 insertions(+), 23 deletions(-)

diff --git a/src/sys/lib.rs b/src/sys/lib.rs
index 74d20f2010a8..744744569f04 100644
--- a/src/sys/lib.rs
+++ b/src/sys/lib.rs
@@ -3723,19 +3723,13 @@ mod windows_impl {
     /// `Ok(false)` when `nonblocking` and the lock is held elsewhere. Unlike `flock(2)`,
     /// `LockFileEx` cannot convert a lock the handle already holds.
     pub fn flock(fd: Fd, mode: FileLockMode, nonblocking: bool) -> Maybe<bool> {
-        let mut flags: w::DWORD = 0;
-        if mode == FileLockMode::Exclusive {
-            flags |= w::kernel32::LOCKFILE_EXCLUSIVE_LOCK;
-        }
-        if nonblocking {
-            flags |= w::kernel32::LOCKFILE_FAIL_IMMEDIATELY;
-        }
+        use w::kernel32::{LOCKFILE_EXCLUSIVE_LOCK, LOCKFILE_FAIL_IMMEDIATELY};
+        let flags = (LOCKFILE_EXCLUSIVE_LOCK * u32::from(mode == FileLockMode::Exclusive))
+            | (LOCKFILE_FAIL_IMMEDIATELY * u32::from(nonblocking));
         let mut overlapped: w::OVERLAPPED = bun_core::ffi::zeroed();
-        // SAFETY: FFI; `fd.native()` is a valid HANDLE and `overlapped` is a
-        // valid out-param selecting range start 0.
-        let rc = unsafe {
-            w::kernel32::LockFileEx(fd.native(), flags, 0, u32::MAX, u32::MAX, &mut overlapped)
-        };
+        let ol = &raw mut overlapped;
+        // SAFETY: FFI; `fd.native()` is a valid HANDLE, `ol` a valid out-param at range start 0.
+        let rc = unsafe { w::kernel32::LockFileEx(fd.native(), flags, 0, u32::MAX, u32::MAX, ol) };
         if rc != 0 {
             return Ok(true);
         }
@@ -9625,23 +9619,17 @@ mod owned_handle_tests {
             ..Default::default()
         };
 
+        let kind = |p: &'static [u8]| exists_at_type(root, ZStr::from_static(p)).ok();
         // Destination taken: it is kept as-is and the source goes away.
         renameat_concurrently_a(root, b"from/sub", to_dir, b"sub", opts).expect("rename");
-        assert!(matches!(
-            exists_at_type(root, ZStr::from_static(b"to/sub/winner\0")),
-            Ok(ExistsAtType::File)
-        ));
-        assert!(exists_at_type(root, ZStr::from_static(b"to/sub/loser\0")).is_err());
-        assert!(exists_at_type(root, ZStr::from_static(b"from/sub\0")).is_err());
+        assert!(matches!(kind(b"to/sub/winner\0"), Some(ExistsAtType::File)));
+        assert!(kind(b"to/sub/loser\0").is_none() && kind(b"from/sub\0").is_none());
 
         // Destination free: a plain rename.
         let _ = mkdir_recursive_at(root, b"from/other");
         renameat_concurrently_a(root, b"from/other", to_dir, b"other", opts).expect("rename");
-        assert!(matches!(
-            exists_at_type(root, ZStr::from_static(b"to/other\0")),
-            Ok(ExistsAtType::Directory)
-        ));
-        assert!(exists_at_type(root, ZStr::from_static(b"from/other\0")).is_err());
+        assert!(matches!(kind(b"to/other\0"), Some(ExistsAtType::Directory)));
+        assert!(kind(b"from/other\0").is_none());
 
         let _ = close(to_dir);
         let _ = close(root);

From 68532c34f50b5c67e95233dc85e0c4e26733fdeb Mon Sep 17 00:00:00 2001
From: Jarred Sumner <jarred@jarredsumner.com>
Date: Mon, 17 Aug 2026 06:01:36 +0000
Subject: [PATCH 210/258] simplify(s2-paths): parse_platform_flag returns the
 value directly

(cherry picked from commit 32eedd38e6a2e8692bb5aebc58e5b163a8cb8df4)
---
 .../PackageManager/CommandLineArguments.rs    | 25 ++++++++-----------
 1 file changed, 11 insertions(+), 14 deletions(-)

diff --git a/src/install/PackageManager/CommandLineArguments.rs b/src/install/PackageManager/CommandLineArguments.rs
index 80ccb7f285a0..5d0f2e0ec11a 100644
--- a/src/install/PackageManager/CommandLineArguments.rs
+++ b/src/install/PackageManager/CommandLineArguments.rs
@@ -36,11 +36,12 @@ fn pretty_help(text: &str) {
 /// (`Negatable::apply` skips names this build does not know), an unknown name is a typo and fatal.
 fn parse_platform_flag<T: Npm::NegatableEnum>(
     values: &[&[u8]],
+    unset: T,
     what: &str,
     valid_names: &str,
-) -> Option<T> {
+) -> T {
     if values.is_empty() {
-        return None;
+        return unset;
     }
     let mut negatable = Npm::Negatable::<T>::default();
     for &value in values {
@@ -60,7 +61,7 @@ fn parse_platform_flag<T: Npm::NegatableEnum>(
             }
         }
     }
-    Some(negatable.combine())
+    negatable.combine()
 }
 
 type ParamType = clap::Param<clap::Help>;
@@ -1581,23 +1582,19 @@ Full documentation is available at <magenta>https://bun.com/docs/pm/cli/prune<r>
             cli.config = Some(opt);
         }
 
-        if let Some(cpu) = parse_platform_flag(
+        cli.cpu = parse_platform_flag(
             args.options(b"--cpu"),
+            cli.cpu,
             "CPU architecture",
             "arm, arm64, ia32, mips, mipsel, ppc, ppc64, s390, s390x, x32, x64",
-        ) {
-            cli.cpu = cpu;
-        }
-        if let Some(os) = parse_platform_flag(
+        );
+        cli.os = parse_platform_flag(
             args.options(b"--os"),
+            cli.os,
             "operating system",
             "aix, darwin, freebsd, linux, openbsd, sunos, win32, android",
-        ) {
-            cli.os = os;
-        }
-        if let Some(libc) = parse_platform_flag(args.options(b"--libc"), "libc", "glibc, musl") {
-            cli.libc = libc;
-        }
+        );
+        cli.libc = parse_platform_flag(args.options(b"--libc"), cli.libc, "libc", "glibc, musl");
 
         if matches!(subcommand, Subcommand::Add | Subcommand::Install) {
             cli.dependency_group = if args.flag(b"--development") || args.flag(b"--dev") {

From bc6fac84df158e914889c2d582b2a25d2da99345 Mon Sep 17 00:00:00 2001
From: Jarred Sumner <jarred@jarredsumner.com>
Date: Mon, 17 Aug 2026 06:02:39 +0000
Subject: [PATCH 211/258] simplify(s2-paths): tuple variants for pack
 Substitution

(cherry picked from commit 7b86d385f34f82306032ebfea93f66bac761e5a2)
---
 src/runtime/cli/pack_command.rs | 26 ++++++++++++--------------
 1 file changed, 12 insertions(+), 14 deletions(-)

diff --git a/src/runtime/cli/pack_command.rs b/src/runtime/cli/pack_command.rs
index 0df3621fece4..df437162b9d9 100644
--- a/src/runtime/cli/pack_command.rs
+++ b/src/runtime/cli/pack_command.rs
@@ -3162,14 +3162,11 @@ fn add_archive_entry(
 /// What the tarball's package.json gets in place of a `workspace:` or `catalog:` spec.
 enum Substitution<'a> {
     /// `workspace:^` / `~` / `*`: the workspace's current version behind that prefix.
-    WorkspaceVersion {
-        prefix: &'static str,
-    },
+    WorkspaceVersion(&'static str),
     /// `workspace:@acme/core@*` (alias), `workspace:../core`, or `workspace:1.x` on a workspace.
     WorkspaceRangeOrDirectory(&'a [u8]),
-    Catalog {
-        catalog_name: &'a [u8],
-    },
+    /// `catalog:<name>`
+    Catalog(&'a [u8]),
 }
 
 impl<'a> Substitution<'a> {
@@ -3177,16 +3174,17 @@ impl<'a> Substitution<'a> {
         let spec = bun_install::dependency::trim_literal(spec);
         if let Some(range) = strings::without_prefix_if_possible_comptime(spec, b"workspace:") {
             return Some(match range {
-                b"^" => Substitution::WorkspaceVersion { prefix: "^" },
-                b"~" => Substitution::WorkspaceVersion { prefix: "~" },
-                b"*" => Substitution::WorkspaceVersion { prefix: "" },
+                b"^" => Substitution::WorkspaceVersion("^"),
+                b"~" => Substitution::WorkspaceVersion("~"),
+                b"*" => Substitution::WorkspaceVersion(""),
                 _ => Substitution::WorkspaceRangeOrDirectory(range),
             });
         }
         let catalog_name = strings::without_prefix_if_possible_comptime(spec, b"catalog:")?;
-        Some(Substitution::Catalog {
-            catalog_name: strings::trim(catalog_name, &strings::WHITESPACE_CHARS),
-        })
+        Some(Substitution::Catalog(strings::trim(
+            catalog_name,
+            &strings::WHITESPACE_CHARS,
+        )))
     }
 }
 
@@ -3352,7 +3350,7 @@ fn edit_root_package_json(
 
         // `E::EString::init` keeps a pointer to the bytes, so they go into the pack arena.
         let replacement: &[u8] = match substitution {
-            Substitution::WorkspaceVersion { prefix } => {
+            Substitution::WorkspaceVersion(prefix) => {
                 let Some(version) = manifests().workspace_version(dependency_name) else {
                     fail(
                         "workspace",
@@ -3376,7 +3374,7 @@ fn edit_root_package_json(
                     Err(why) => fail("workspace", format_args!("{why}")),
                 }
             }
-            Substitution::Catalog { catalog_name } => {
+            Substitution::Catalog(catalog_name) => {
                 match manifests().catalog_version(catalog_name, dependency_name) {
                     Some(version) => bump.alloc_slice_copy(version),
                     None => fail("catalog", format_args!("no matching catalog dependency")),

From 4f9285e72cf0694d12081188858ed7c66910fd10 Mon Sep 17 00:00:00 2001
From: Jarred Sumner <jarred@jarredsumner.com>
Date: Mon, 17 Aug 2026 06:05:40 +0000
Subject: [PATCH 212/258] simplify(s2-paths): keep --save/--no-save in
 SHARED_TAIL_PARAMS, splice link/unlink wording

(cherry picked from commit 58244aeb70a64b98f0e183b610474dda03b2d1c4)
---
 .../PackageManager/CommandLineArguments.rs    | 39 +++++++------------
 1 file changed, 15 insertions(+), 24 deletions(-)

diff --git a/src/install/PackageManager/CommandLineArguments.rs b/src/install/PackageManager/CommandLineArguments.rs
index 5d0f2e0ec11a..288f730c5db7 100644
--- a/src/install/PackageManager/CommandLineArguments.rs
+++ b/src/install/PackageManager/CommandLineArguments.rs
@@ -92,24 +92,11 @@ const PRODUCTION_PARAMS: &[ParamType] = &[
     clap::param!("-P, --prod"),
 ];
 
-const SAVE_PARAMS: &[ParamType] = &[
+const SHARED_TAIL_PARAMS: &[ParamType] = &[
     clap::param!(
         "--no-save                             Don't update package.json or save a lockfile"
     ),
     clap::param!("--save                                Save to package.json (true by default)"),
-];
-
-// `parse` gives link and unlink the opposite default: they only save when --save is passed.
-const LINK_SAVE_PARAMS: &[ParamType] = &[
-    clap::param!(
-        "--no-save                             Don't update package.json or save a lockfile (the default)"
-    ),
-    clap::param!(
-        "--save                                Update package.json and save a lockfile (false by default)"
-    ),
-];
-
-const SHARED_TAIL_PARAMS: &[ParamType] = &[
     clap::param!(
         "--ca <STR>...                         Provide a Certificate Authority signing certificate"
     ),
@@ -176,18 +163,22 @@ const SHARED_TAIL_PARAMS: &[ParamType] = &[
     clap::param!("-h, --help                            Print this help menu"),
 ];
 
-const SHARED_PARAMS: &[ParamType] = concat_params![
-    SHARED_HEAD_PARAMS,
-    PRODUCTION_PARAMS,
-    SAVE_PARAMS,
-    SHARED_TAIL_PARAMS
-];
+const SHARED_PARAMS: &[ParamType] =
+    concat_params![SHARED_HEAD_PARAMS, PRODUCTION_PARAMS, SHARED_TAIL_PARAMS];
 
+// `parse` gives link and unlink the opposite default: they only save when --save is passed.
 const LINK_SHARED_PARAMS: &[ParamType] = concat_params![
     SHARED_HEAD_PARAMS,
     PRODUCTION_PARAMS,
-    LINK_SAVE_PARAMS,
-    SHARED_TAIL_PARAMS
+    &[
+        clap::param!(
+            "--no-save                             Don't update package.json or save a lockfile (the default)"
+        ),
+        clap::param!(
+            "--save                                Update package.json and save a lockfile (false by default)"
+        ),
+    ],
+    SHARED_TAIL_PARAMS.split_at(2).1
 ];
 
 pub(crate) static INSTALL_PARAMS: &[ParamType] = concat_params![
@@ -224,7 +215,6 @@ pub(crate) static UPDATE_PARAMS: &[ParamType] = concat_params![
         ),
         clap::param!("-P, --prod"),
     ],
-    SAVE_PARAMS,
     SHARED_TAIL_PARAMS,
     &[
         clap::param!(
@@ -1533,7 +1523,8 @@ Full documentation is available at <magenta>https://bun.com/docs/pm/cli/prune<r>
             cli.tolerate_republish = args.flag(b"--tolerate-republish");
         }
 
-        // link and unlink default to not saving (see `LINK_SAVE_PARAMS`), all others to saving.
+        // link and unlink default to not saving, all others default to
+        // saving.
         if matches!(subcommand, Subcommand::Link | Subcommand::Unlink) {
             cli.no_save = !args.flag(b"--save");
         } else {

From 088e2fcfb7513a6c508f3ca2c3f53995adee9ad5 Mon Sep 17 00:00:00 2001
From: Jarred Sumner <jarred@jarredsumner.com>
Date: Mon, 17 Aug 2026 06:06:36 +0000
Subject: [PATCH 213/258] simplify(s2-paths): publish reads a too-long tarball
 path through the same error path

(cherry picked from commit 06cd3eb09f8fbb6df4533d9cc19a0624306760cf)
---
 src/runtime/cli/publish_command.rs | 17 +++++++----------
 1 file changed, 7 insertions(+), 10 deletions(-)

diff --git a/src/runtime/cli/publish_command.rs b/src/runtime/cli/publish_command.rs
index 7e82eff019e2..f2465775878d 100644
--- a/src/runtime/cli/publish_command.rs
+++ b/src/runtime/cli/publish_command.rs
@@ -139,20 +139,17 @@ impl<'a, const DIRECTORY_PUBLISH: bool> Context<'a, DIRECTORY_PUBLISH> {
         tarball_path: &[u8],
     ) -> Result<Context<'a, DIRECTORY_PUBLISH>, FromTarballError> {
         let mut abs_buf = PathBuffer::uninit();
-        let Some(abs_tarball_path) = join_abs_string_buf_checked::<path::platform::Auto>(
+        let abs_tarball_path = join_abs_string_buf_checked::<path::platform::Auto>(
             original_cwd,
             &mut abs_buf,
             &[tarball_path],
-        ) else {
-            Output::err(
-                bun_sys::Error::from_code(bun_sys::E::ENAMETOOLONG, bun_sys::Tag::open),
-                "failed to read tarball: '{}'",
-                (bstr::BStr::new(tarball_path),),
-            );
-            Global::crash();
-        };
+        )
+        .ok_or(bun_sys::Error::from_code(
+            bun_sys::E::ENAMETOOLONG,
+            bun_sys::Tag::open,
+        ));
 
-        let tarball_bytes = match File::read_from(Fd::cwd(), abs_tarball_path) {
+        let tarball_bytes = match abs_tarball_path.and_then(|p| File::read_from(Fd::cwd(), p)) {
             Ok(b) => b,
             Err(e) => {
                 Output::err(

From 3a3fea359ebec19cefcc58b2db84afba96c115c7 Mon Sep 17 00:00:00 2001
From: Jarred Sumner <jarred@jarredsumner.com>
Date: Mon, 17 Aug 2026 06:09:49 +0000
Subject: [PATCH 214/258] simplify(s2-paths): clippy (needless borrow,
 or_fun_call)

(cherry picked from commit e0c187024c5007911d215b0c7d272900d24d792e)
---
 src/runtime/cli/bunx_command.rs    | 2 +-
 src/runtime/cli/publish_command.rs | 5 +----
 2 files changed, 2 insertions(+), 5 deletions(-)

diff --git a/src/runtime/cli/bunx_command.rs b/src/runtime/cli/bunx_command.rs
index 322be90f8fd1..39da0a5ae432 100644
--- a/src/runtime/cli/bunx_command.rs
+++ b/src/runtime/cli/bunx_command.rs
@@ -48,7 +48,7 @@ impl InstallLock {
         nonblocking: bool,
     ) -> Option<Self> {
         let sep = bun_paths::SEP_STR.as_bytes();
-        let path = bun_core::ZBox::from_bytes(&[bunx_cache_dir, sep, b".bunx-lock"].concat());
+        let path = bun_core::ZBox::from_bytes([bunx_cache_dir, sep, b".bunx-lock"].concat());
         for _ in 0..5 {
             let fd = bun_sys::openat(Fd::cwd(), &path, O::CREAT | O::RDWR | O::CLOEXEC, 0o600);
             let file = bun_sys::File::from_fd(fd.ok()?);
diff --git a/src/runtime/cli/publish_command.rs b/src/runtime/cli/publish_command.rs
index f2465775878d..fb336cebe536 100644
--- a/src/runtime/cli/publish_command.rs
+++ b/src/runtime/cli/publish_command.rs
@@ -144,10 +144,7 @@ impl<'a, const DIRECTORY_PUBLISH: bool> Context<'a, DIRECTORY_PUBLISH> {
             &mut abs_buf,
             &[tarball_path],
         )
-        .ok_or(bun_sys::Error::from_code(
-            bun_sys::E::ENAMETOOLONG,
-            bun_sys::Tag::open,
-        ));
+        .ok_or_else(|| bun_sys::Error::from_code(bun_sys::E::ENAMETOOLONG, bun_sys::Tag::open));
 
         let tarball_bytes = match abs_tarball_path.and_then(|p| File::read_from(Fd::cwd(), p)) {
             Ok(b) => b,

From c75cf5198cb33a43b6f9634e2c33b8f87aa4e910 Mon Sep 17 00:00:00 2001
From: Jarred Sumner <jarred@jarredsumner.com>
Date: Mon, 17 Aug 2026 06:10:44 +0000
Subject: [PATCH 215/258] simplify(s2-paths): bunx directories.bin path in two
 lines

(cherry picked from commit a05272a5a40af0a4416debea04f725c616ae969d)
---
 src/runtime/cli/bunx_command.rs | 10 +++-------
 1 file changed, 3 insertions(+), 7 deletions(-)

diff --git a/src/runtime/cli/bunx_command.rs b/src/runtime/cli/bunx_command.rs
index 39da0a5ae432..f08c4ab29700 100644
--- a/src/runtime/cli/bunx_command.rs
+++ b/src/runtime/cli/bunx_command.rs
@@ -410,14 +410,10 @@ impl BunxCommand {
                 if let Some(dir_name) = bin_prop.expr.as_utf8_string_literal().filter(|dir| {
                     !dir.is_empty() && !bun_install::bin::bin_target_escapes_package_dir(dir)
                 }) {
+                    use bun_paths::{platform::Auto, resolve_path::dirname, resolve_path::join_z};
                     // `directories.bin` is relative to the package, not to `dir_fd`.
-                    use bun_paths::platform::Auto;
-                    let package_dir =
-                        bun_paths::resolve_path::dirname::<Auto>(subpath_z.as_bytes());
-                    let bin_dir_path =
-                        bun_paths::resolve_path::join_z::<Auto>(&[package_dir, dir_name]);
-                    let bin_dir =
-                        bun_sys::openat(dir_fd, bin_dir_path, O::RDONLY | O::DIRECTORY, 0)?;
+                    let path = join_z::<Auto>(&[dirname::<Auto>(subpath_z.as_bytes()), dir_name]);
+                    let bin_dir = bun_sys::openat(dir_fd, path, O::RDONLY | O::DIRECTORY, 0)?;
                     // Fd is non-owning Copy; guard it.
                     let _close_bin_dir = bun_sys::CloseOnDrop::new(bin_dir);
                     let mut iterator = bun_sys::dir_iterator::iterate(bin_dir);

From 83ca65a5b74799c12b9a190d2042a09b85c66595 Mon Sep 17 00:00:00 2001
From: Jarred Sumner <jarred@jarredsumner.com>
Date: Mon, 17 Aug 2026 06:11:55 +0000
Subject: [PATCH 216/258] simplify(s2-paths): note the SHARED_TAIL_PARAMS
 prefix LINK_SHARED_PARAMS replaces

(cherry picked from commit cc5aa509862897edadeed28881ab0f98cfd65d78)
---
 src/install/PackageManager/CommandLineArguments.rs | 1 +
 1 file changed, 1 insertion(+)

diff --git a/src/install/PackageManager/CommandLineArguments.rs b/src/install/PackageManager/CommandLineArguments.rs
index 288f730c5db7..6f65e9477432 100644
--- a/src/install/PackageManager/CommandLineArguments.rs
+++ b/src/install/PackageManager/CommandLineArguments.rs
@@ -92,6 +92,7 @@ const PRODUCTION_PARAMS: &[ParamType] = &[
     clap::param!("-P, --prod"),
 ];
 
+// `LINK_SHARED_PARAMS` swaps out the first two.
 const SHARED_TAIL_PARAMS: &[ParamType] = &[
     clap::param!(
         "--no-save                             Don't update package.json or save a lockfile"

From caab3280d6b4e36e8b3ab7c58c95e6be14de875e Mon Sep 17 00:00:00 2001
From: Jarred Sumner <jarred@jarredsumner.com>
Date: Mon, 17 Aug 2026 05:44:13 +0000
Subject: [PATCH 217/258] simplify(s5-net-pm): collapse registry/credential
 helpers, redirect policy, tree dedup bookkeeping

- PackageManagerOptions: drop RegistryPath/set_scope_registry, make scope_for_registry_url
  infallible, reuse scope_for_package_name/copy_credentials_from, trim doc comments
- NetworkTask: shorter userinfo split / Basic auth, one precedence rule for URL vs configured credentials
- http: drop StrippedOnRedirect enum, fold credential policy into RedirectHop
- fmt: add for_terminal(), tuple writer for EscapeControlChars, trim docs
- pm ls / why: InstalledFilter::init -> Option, tuple (lines, cutoff) instead of two structs
- npm: tighter UrlAuth::from_api/matches, inline is_version_excluded_from_age_filter, integrity warn flag

(cherry picked from commit 616a77f607dad74508d09cda97a5b9c89e2b9507)
---
 src/bun_core/fmt.rs                           |  79 ++++-----
 src/http/lib.rs                               |  55 +++----
 src/install/NetworkTask.rs                    |  95 ++++-------
 .../PackageManager/PackageManagerOptions.rs   | 153 +++++-------------
 src/install/npm.rs                            | 105 ++++--------
 src/runtime/cli/package_manager_command.rs    | 120 +++++---------
 src/runtime/cli/why_command.rs                |  90 +++--------
 7 files changed, 221 insertions(+), 476 deletions(-)

diff --git a/src/bun_core/fmt.rs b/src/bun_core/fmt.rs
index 1b9070fd8e3c..2c3fa607954a 100644
--- a/src/bun_core/fmt.rs
+++ b/src/bun_core/fmt.rs
@@ -257,11 +257,8 @@ impl Display for RedactedNpmUrlFormatter<'_> {
             }
 
             // Emit the run of bytes up to the next position where a uuid/npm
-            // secret could possibly start. Runs split only at ASCII bytes, so
-            // multi-byte sequences stay intact; `BStr` turns invalid UTF-8 (the
-            // URL is package metadata, not guaranteed UTF-8) into U+FFFD instead
-            // of handing a bogus `&str` to a `Display` wrapper such as
-            // [`EscapeControlChars`].
+            // secret could possibly start, so multi-byte UTF-8 sequences are
+            // written intact (`BStr`: invalid UTF-8 becomes U+FFFD, not a bogus `&str`).
             let mut next = i + 1;
             while next < self.url.len() {
                 let b = self.url[next];
@@ -285,20 +282,14 @@ pub fn redacted_npm_url(str: &[u8]) -> RedactedNpmUrlFormatter<'_> {
     RedactedNpmUrlFormatter { url: str }
 }
 
-/// [`redacted_npm_url`] for a value that only exists as a `Display` impl: a
-/// lockfile resolution or a dependency specifier, which is the tarball or git
-/// URL written in package.json when the package came from one. Anything that
-/// does not contain a URL (a version, a path, a `github:` specifier) is written
-/// unchanged: the token and UUID masks are meant for URLs, and a version whose
-/// pre-release tag happens to look like one must not be masked.
+/// [`redacted_npm_url`] over a `Display` (a lockfile resolution, a dependency specifier); values
+/// without `://` pass unchanged so a version whose pre-release tag looks like a token is not masked.
 pub struct Redacted<T>(T);
 
 impl<T: Display> Display for Redacted<T> {
     fn fmt(&self, f: &mut Formatter<'_>) -> fmt::Result {
-        // Rendered in full first: the inner impl may write in pieces, and the
-        // password scan is anchored at the start of the whole value.
-        let mut text = String::new();
-        write!(text, "{}", self.0)?;
+        // Rendered in full first: the password scan is anchored at the start of the whole value.
+        let text = self.0.to_string();
         if !strings::contains(text.as_bytes(), b"://") {
             return f.write_str(&text);
         }
@@ -310,6 +301,11 @@ pub fn redacted<T: Display>(value: T) -> Redacted<T> {
     Redacted(value)
 }
 
+/// [`redacted`] + [`EscapeControlChars`]: how untrusted specifiers/resolutions go to a terminal.
+pub fn for_terminal<T: Display>(value: T) -> EscapeControlChars<Redacted<T>> {
+    EscapeControlChars(Redacted(value))
+}
+
 // ───────────────────────────────────────────────────────────────────────────
 // RedactedSourceFormatter
 // ───────────────────────────────────────────────────────────────────────────
@@ -3358,80 +3354,63 @@ fn escape_powershell_impl(str: &[u8], writer: &mut impl fmt::Write) -> fmt::Resu
 // escapeControlChars
 // ───────────────────────────────────────────────────────────────────────────
 
-/// Renders the wrapped `Display` with C0 controls, DEL and C1 controls
-/// spelled out (`\n`, `\r`, `\t`, `\x1b`, `\x7f`, `\u009b`) instead of
-/// written raw. For text somebody else authored (a registry manifest, a
-/// dependency's `package.json`): printed raw, an ESC/CR/C1 sequence can erase
-/// or repaint the line it is shown on and a newline can forge further lines
-/// of our output. Everything else passes through unchanged.
+/// Spells out C0/C1 controls and DEL (`\n`, `\x1b`, `\u009b`) in text somebody else authored
+/// (registry manifests, a dependency's `package.json`) so it cannot repaint or forge our output.
 pub struct EscapeControlChars<T>(pub T);
 
-/// [`EscapeControlChars`] for a value that is legitimately multi-line and is
-/// printed on its own (`bun pm view <pkg> readme`): `\t`, `\n` and `\r\n`
-/// pass through. A `\r` not followed by `\n` is still escaped; on a terminal
-/// it only overwrites the line printed so far.
+/// [`EscapeControlChars`] that lets `\t`, `\n` and `\r\n` through (`bun pm view <pkg> readme`).
 pub struct EscapeControlCharsMultiline<T>(pub T);
 
-/// [`EscapeControlChars`] over raw bytes; invalid UTF-8 renders as U+FFFD.
+/// Invalid UTF-8 renders as U+FFFD.
 pub fn escape_control_chars(text: &[u8]) -> EscapeControlChars<&bstr::BStr> {
     EscapeControlChars(bstr::BStr::new(text))
 }
 
-/// [`EscapeControlCharsMultiline`] over raw bytes; invalid UTF-8 renders as U+FFFD.
 pub fn escape_control_chars_multiline(text: &[u8]) -> EscapeControlCharsMultiline<&bstr::BStr> {
     EscapeControlCharsMultiline(bstr::BStr::new(text))
 }
 
 impl<T: Display> Display for EscapeControlChars<T> {
     fn fmt(&self, f: &mut Formatter<'_>) -> fmt::Result {
-        let mut writer = EscapeControlCharsWriter {
-            f,
-            keep_line_breaks: false,
-        };
-        write!(writer, "{}", self.0)
+        write!(EscapeControlCharsWriter(f, false), "{}", self.0)
     }
 }
 
 impl<T: Display> Display for EscapeControlCharsMultiline<T> {
     fn fmt(&self, f: &mut Formatter<'_>) -> fmt::Result {
-        let mut writer = EscapeControlCharsWriter {
-            f,
-            keep_line_breaks: true,
-        };
-        write!(writer, "{}", self.0)
+        write!(EscapeControlCharsWriter(f, true), "{}", self.0)
     }
 }
 
-struct EscapeControlCharsWriter<'a, 'f> {
-    f: &'a mut Formatter<'f>,
-    keep_line_breaks: bool,
-}
+/// `.1`: keep `\t`, `\n`, `\r\n`.
+struct EscapeControlCharsWriter<'a, 'f>(&'a mut Formatter<'f>, bool);
 
 impl fmt::Write for EscapeControlCharsWriter<'_, '_> {
     fn write_str(&mut self, s: &str) -> fmt::Result {
+        let Self(f, keep_line_breaks) = self;
         let mut start = 0;
         let mut chars = s.char_indices().peekable();
         while let Some((i, c)) = chars.next() {
             let pass_through = match c {
-                '\t' | '\n' => self.keep_line_breaks,
-                '\r' => self.keep_line_breaks && matches!(chars.peek(), Some((_, '\n'))),
+                '\t' | '\n' => *keep_line_breaks,
+                '\r' => *keep_line_breaks && matches!(chars.peek(), Some((_, '\n'))),
                 '\0'..='\x1f' | '\x7f' | '\u{80}'..='\u{9f}' => false,
                 _ => true,
             };
             if pass_through {
                 continue;
             }
-            self.f.write_str(&s[start..i])?;
+            f.write_str(&s[start..i])?;
             match c {
-                '\n' => self.f.write_str("\\n")?,
-                '\r' => self.f.write_str("\\r")?,
-                '\t' => self.f.write_str("\\t")?,
-                c if c.is_ascii() => write!(self.f, "\\x{:02x}", c as u32)?,
-                c => write!(self.f, "\\u{:04x}", c as u32)?,
+                '\n' => f.write_str("\\n")?,
+                '\r' => f.write_str("\\r")?,
+                '\t' => f.write_str("\\t")?,
+                c if c.is_ascii() => write!(f, "\\x{:02x}", c as u32)?,
+                c => write!(f, "\\u{:04x}", c as u32)?,
             }
             start = i + c.len_utf8();
         }
-        self.f.write_str(&s[start..])
+        f.write_str(&s[start..])
     }
 }
 
diff --git a/src/http/lib.rs b/src/http/lib.rs
index 8ed149667e41..6d4f93d8d32d 100644
--- a/src/http/lib.rs
+++ b/src/http/lib.rs
@@ -1066,31 +1066,25 @@ bun_core::comptime_string_map! {
     };
 }
 
-#[derive(Copy, Clone)]
-enum StrippedOnRedirect {
-    /// Per `Flags::redirect_credentials`.
-    Credential,
-    /// Would suppress the default Host header derived from the new URL.
-    Host,
-}
-
 bun_core::comptime_string_map! {
     /// Headers deleted from the request on a cross-origin redirect.
+    /// `host` is included because a user-supplied Host header names the
+    /// previous origin; keeping it would also suppress the default Host
+    /// header derived from the new URL.
     /// Keys are lowercase: looked up via `get_ascii_case_insensitive`.
-    static CROSS_ORIGIN_STRIPPED_REQUEST_HEADERS: StrippedOnRedirect = {
-        b"authorization" => StrippedOnRedirect::Credential,
-        b"proxy-authorization" => StrippedOnRedirect::Credential,
-        b"cookie" => StrippedOnRedirect::Credential,
-        b"host" => StrippedOnRedirect::Host,
+    static CROSS_ORIGIN_STRIPPED_REQUEST_HEADERS: () = {
+        b"authorization" => (),
+        b"proxy-authorization" => (),
+        b"cookie" => (),
+        b"host" => (),
     };
 }
 
 #[derive(Copy, Clone)]
 struct RedirectHop {
     same_origin: bool,
-    same_hostname: bool,
-    /// https -> http; credentials never follow this hop (cleartext replay).
-    downgrades_to_http: bool,
+    /// What `RedirectCredentialsPolicy::SameHostname` keeps credentials on: never https -> http.
+    same_hostname_no_downgrade: bool,
 }
 
 impl RedirectHop {
@@ -1101,17 +1095,8 @@ impl RedirectHop {
                 strings::without_trailing_slash(from.origin),
                 true,
             ),
-            same_hostname: strings::eql_case_insensitive_ascii(to.hostname, from.hostname, true),
-            downgrades_to_http: from.is_https() && !to.is_https(),
-        }
-    }
-
-    fn strips_credentials(self, policy: RedirectCredentialsPolicy) -> bool {
-        match policy {
-            RedirectCredentialsPolicy::SameOrigin => !self.same_origin,
-            RedirectCredentialsPolicy::SameHostname => {
-                !self.same_hostname || self.downgrades_to_http
-            }
+            same_hostname_no_downgrade: !(from.is_https() && !to.is_https())
+                && strings::eql_case_insensitive_ascii(to.hostname, from.hostname, true),
         }
     }
 }
@@ -5242,20 +5227,20 @@ impl<'a> HTTPClient<'a> {
                 // locationURL's origin, then for each headerName of CORS
                 // non-wildcard request-header name, delete headerName from
                 // request's header list.
-                // The credential headers follow `Flags::redirect_credentials`.
+                // The credential headers (all but `host`) follow `Flags::redirect_credentials`.
                 if !hop.same_origin && self.header_entries.len() > 0 {
-                    let strip_credentials = hop.strips_credentials(self.flags.redirect_credentials);
+                    let strip_credentials = match self.flags.redirect_credentials {
+                        RedirectCredentialsPolicy::SameOrigin => true,
+                        RedirectCredentialsPolicy::SameHostname => !hop.same_hostname_no_downgrade,
+                    };
                     let mut i = 0;
                     while i < self.header_entries.len() {
                         let name = self.header_str(self.header_entries.items_name()[i]);
-                        let strip = match CROSS_ORIGIN_STRIPPED_REQUEST_HEADERS
+                        if CROSS_ORIGIN_STRIPPED_REQUEST_HEADERS
                             .get_ascii_case_insensitive(name)
+                            .is_some()
+                            && (strip_credentials || name.eq_ignore_ascii_case(b"host"))
                         {
-                            Some(StrippedOnRedirect::Host) => true,
-                            Some(StrippedOnRedirect::Credential) => strip_credentials,
-                            None => false,
-                        };
-                        if strip {
                             let _ = self.header_entries.ordered_remove(i);
                         } else {
                             i += 1;
diff --git a/src/install/NetworkTask.rs b/src/install/NetworkTask.rs
index 98573729448f..0610b33e7bf1 100644
--- a/src/install/NetworkTask.rs
+++ b/src/install/NetworkTask.rs
@@ -64,9 +64,7 @@ pub struct NetworkTask {
     pub(crate) header_buf: Box<[u8]>,
     /// Proxy href for this request (empty: direct); owned like `url_buf`, `AsyncHTTP` borrows it.
     pub(crate) http_proxy_buf: Box<[u8]>,
-    /// Whether this request was allowed to carry registry credentials at all
-    /// (`github:` and URL tarball dependencies are not). Read back when a
-    /// 401/403 is reported, so the suggested fix is one that would apply.
+    /// Read back when a 401/403 is reported (`Options::missing_credentials_note`).
     pub(crate) authorization: Authorization,
     pub(crate) retried: u16,
     pub(crate) response_buffer: MutableString,
@@ -132,21 +130,14 @@ pub struct DedupeMapEntry {
     /// later `enqueue_*_for_download` can observe the failure instead of
     /// re-scheduling the entire network task (and its retry cycle) a second time.
     pub(crate) failed: bool,
-    /// Manifest tasks only: a request for the extended document has been issued
-    /// for this task id. See `PackageManager::has_created_manifest_task`.
+    /// Manifest tasks only (these three): see `PackageManager::has_created_manifest_task`.
     pub(crate) is_extended_manifest: bool,
-    /// Manifest tasks only: a request for the abbreviated document has been
-    /// issued for this task id.
     pub(crate) has_abbreviated_manifest_request: bool,
-    /// Manifest tasks only: the extended request failed. Every dependency on the
-    /// package now resolves from the abbreviated document instead
-    /// (`PackageManager::needs_extended_manifest`), which is the pre-libc
-    /// behavior for this one package.
+    /// The package then resolves from the abbreviated document (`PackageManager::needs_extended_manifest`).
     pub(crate) extended_manifest_failed: bool,
 }
 
 impl DedupeMapEntry {
-    /// Whether the document a dependency needs has been requested.
     pub(crate) fn manifest_requested(&mut self, extended: bool) -> &mut bool {
         if extended {
             &mut self.is_extended_manifest
@@ -453,39 +444,28 @@ fn count_auth(header_builder: &mut HeaderBuilder, scope: &npm::registry::Scope)
     header_builder.count("npm-auth-type", "legacy");
 }
 
-/// Splits `http://user:pass@host/pkg.tgz` into `user:pass` and
-/// `http://host/pkg.tgz`. `None` when the authority has no `@`; the `@` of a
-/// scoped package in the path (`/@scope/pkg/-/pkg.tgz`) is not one.
+/// `http://user:pass@host/pkg.tgz` -> (`user:pass`, `http://host/pkg.tgz`). Like `bun_url`, userinfo
+/// ends at the last `@` before the first `/` (so `#`/`?` in a password stay, `/@scope/` is path).
 fn split_url_userinfo(url: &[u8]) -> Option<(&[u8], Box<[u8]>)> {
     let authority_start = strings::index_of(url, b"://")? + b"://".len();
     let rest = &url[authority_start..];
-    // Like `bun_url`: userinfo ends at the last `@` before the path, so an unencoded `#` or `?` in
-    // a password stays part of it.
     let authority = &rest[..strings::index_of_char_usize(rest, b'/').unwrap_or(rest.len())];
     let at = strings::last_index_of_char(authority, b'@')?;
-
-    let mut without_userinfo = Vec::with_capacity(url.len() - (at + 1));
-    without_userinfo.extend_from_slice(&url[..authority_start]);
-    without_userinfo.extend_from_slice(&rest[at + 1..]);
+    let without_userinfo = [&url[..authority_start], &rest[at + 1..]].concat();
     Some((&rest[..at], without_userinfo.into_boxed_slice()))
 }
 
-/// `Basic base64(userinfo)`, the header npm sends for credentials embedded in a
-/// tarball URL: minipass-fetch (`getNodeRequestOptions` in `lib/request.js`)
-/// hands the URL's `username:password` to node's `auth` option as is, so
-/// nothing is percent-decoded here either, and a userinfo without a `:` is a
-/// username with an empty password.
+/// `Basic base64(userinfo)` as npm sends it: not percent-decoded, and no `:` means an empty password.
 fn basic_authorization_from_userinfo(userinfo: &[u8]) -> Vec<u8> {
-    const SCHEME: &[u8] = b"Basic ";
-    let mut user_pass = Vec::with_capacity(userinfo.len() + 1);
-    user_pass.extend_from_slice(userinfo);
+    let mut user_pass = userinfo.to_vec();
     if !strings::contains_char(userinfo, b':') {
         user_pass.push(b':');
     }
-    let mut value = vec![0u8; SCHEME.len() + bun_core::base64::encode_len(&user_pass)];
-    value[..SCHEME.len()].copy_from_slice(SCHEME);
-    let encoded_len = bun_core::base64::encode(&mut value[SCHEME.len()..], &user_pass);
-    value.truncate(SCHEME.len() + encoded_len);
+    let mut value = b"Basic ".to_vec();
+    let start = value.len();
+    value.resize(start + bun_core::base64::encode_len(&user_pass), 0);
+    let encoded_len = bun_core::base64::encode(&mut value[start..], &user_pass);
+    value.truncate(start + encoded_len);
     value
 }
 
@@ -881,56 +861,41 @@ impl NetworkTask {
             return Err(ForTarballError::InvalidURL);
         }
 
-        // `"dep": "https://user:pass@host/dep.tgz"`: the credentials become a
-        // header, as npm sends them, and the URL is requested without them.
-        // They cannot stay in the URL: `bun_url` keeps the userinfo in `origin`,
-        // and the HTTP client compares origins to decide whether `Authorization`
-        // follows a redirect, so a redirect to the same host would lose it.
-        let url_authorization: Option<Vec<u8>> = match split_url_userinfo(&self.url_buf) {
-            Some((userinfo, url_without_userinfo)) => {
-                let value =
-                    (!userinfo.is_empty()).then(|| basic_authorization_from_userinfo(userinfo));
-                self.url_buf = url_without_userinfo;
-                value
-            }
-            None => None,
-        };
+        // `https://user:pass@host/dep.tgz`: sent as a header, as npm does; left in the URL it would
+        // be part of `origin` to `bun_url` and a same-host redirect would drop `Authorization`.
+        let mut url_authorization: Option<Vec<u8>> = None;
+        if let Some((userinfo, url_without_userinfo)) = split_url_userinfo(&self.url_buf) {
+            url_authorization =
+                (!userinfo.is_empty()).then(|| basic_authorization_from_userinfo(userinfo));
+            self.url_buf = url_without_userinfo;
+        }
 
         self.authorization = authorization;
-        // The empty-`tarball_url` branch above built the URL from `scope.url`,
-        // so it is same-origin and gets the scope's credentials.
         let credentials = match authorization {
             Authorization::NoAuthorization => None,
             Authorization::AllowAuthorization => pm
                 .options
                 .tarball_credentials(scope, &URL::parse(&self.url_buf)),
         };
+        // As in npm, credentials configured for the host win over the ones embedded in the URL.
+        let url_authorization = url_authorization.filter(|_| credentials.is_none());
 
         self.response_buffer = MutableString::init_empty();
 
         let mut header_builder = HeaderBuilder::default();
 
-        if let Some(credentials) = credentials {
+        if let Some(value) = &url_authorization {
+            header_builder.count("Authorization", value);
+        } else if let Some(credentials) = credentials {
             count_auth(&mut header_builder, credentials);
         }
 
-        // Same precedence as npm, where node derives `Authorization` from the
-        // URL only when the request does not carry one already: credentials
-        // configured for the registry win over the ones embedded in the URL.
-        let url_authorization = match url_authorization {
-            Some(value) if header_builder.header_count == 0 => {
-                header_builder.count("Authorization", &value);
-                Some(value)
-            }
-            _ => None,
-        };
-
         let header_buf: &'static [u8] = if header_builder.header_count > 0 {
             header_builder.allocate()?;
-            match (&url_authorization, credentials) {
-                (Some(value), _) => header_builder.append("Authorization", value),
-                (None, Some(credentials)) => append_auth(&mut header_builder, credentials),
-                (None, None) => {}
+            if let Some(value) = &url_authorization {
+                header_builder.append("Authorization", value);
+            } else if let Some(credentials) = credentials {
+                append_auth(&mut header_builder, credentials);
             }
             debug_assert_eq!(header_builder.content.len, header_builder.content.cap);
             self.header_buf = header_builder.content.move_to_slice();
diff --git a/src/install/PackageManager/PackageManagerOptions.rs b/src/install/PackageManager/PackageManagerOptions.rs
index 14a9045447dd..5e98ef2e59d5 100644
--- a/src/install/PackageManager/PackageManagerOptions.rs
+++ b/src/install/PackageManager/PackageManagerOptions.rs
@@ -31,9 +31,7 @@ pub struct Options {
     pub scope: Npm::registry::Scope,
 
     pub(crate) registries: Npm::registry::Map,
-    /// `.npmrc` `//host/path/` credential lines, resolved by request URL. Fills
-    /// in scopes whose registry was configured without credentials of its own
-    /// and authenticates tarballs hosted somewhere other than their registry.
+    /// `.npmrc` `//host/path/` credential lines, resolved by request URL.
     pub(crate) url_auth: Vec<Npm::registry::UrlAuth>,
     pub(crate) cache_directory: &'static [u8],
     pub enable: Enable,
@@ -111,19 +109,13 @@ pub struct Options {
 }
 
 impl Options {
-    /// Whether picking versions needs the full registry document instead of the
-    /// abbreviated one: only the full one has the publish times `minimumReleaseAge`
-    /// filters on.
+    /// Only the full registry document has the publish times `minimumReleaseAge` filters on.
     pub(crate) fn needs_extended_manifest_to_pick_versions(&self) -> bool {
         self.minimum_release_age_ms.is_some()
     }
 
-    /// Whether resolving `dependency` needs the full registry document. Besides
-    /// the publish times, the abbreviated document lacks the `libc` field, which
-    /// is only enforced for optional dependencies (`Libc::for_dependency`), so
-    /// only those pay for the larger document. This is also what decides the
-    /// `libc` recorded in the lockfile, so it does not depend on the host: a
-    /// lockfile written on macOS still filters on Linux.
+    /// The abbreviated document also lacks `libc`, which is only enforced for optional
+    /// dependencies (`Libc::for_dependency`); host-independent so lockfiles stay portable.
     pub(crate) fn needs_extended_manifest(&self, dependency: Behavior) -> bool {
         self.needs_extended_manifest_to_pick_versions() || dependency.is_optional()
     }
@@ -294,16 +286,8 @@ impl Options {
         }
     }
 
-    /// The credentials a tarball download may carry.
-    ///
-    /// The manifest that names the tarball URL comes from the registry, so a
-    /// malicious registry could point `dist.tarball` at a host of its choosing;
-    /// `scope`'s credentials therefore only go to `scope`'s own origin. Any
-    /// other origin gets exactly what the user configured for it in `.npmrc`
-    /// (`//that-host/:_authToken=...`), which covers registries that serve
-    /// tarballs from a separate host and lockfiles recorded against a
-    /// registry that has since moved; an origin without such a line gets
-    /// nothing.
+    /// `scope`'s credentials only go to its own origin (the registry controls `dist.tarball`);
+    /// any other origin gets exactly what `.npmrc` configures for it, or nothing.
     pub(crate) fn tarball_credentials<'a>(
         &'a self,
         scope: &'a Npm::registry::Scope,
@@ -315,12 +299,8 @@ impl Options {
         Npm::registry::UrlAuth::find(&self.url_auth, tarball)
     }
 
-    /// Text to append to the `GET <url> - 401` line of a request that bun sent
-    /// without an `Authorization` header, saying which `.npmrc` line would have
-    /// supplied one. Empty when credentials were sent (the registry rejected
-    /// them, and the status line already says everything bun knows) and for
-    /// downloads that never carry registry credentials, where no `.npmrc` line
-    /// would change anything.
+    /// Appended to the `GET <url> - 401` line of a request bun sent without `Authorization`:
+    /// which `.npmrc` line would have supplied one. Empty when credentials were sent.
     pub(crate) fn missing_credentials_note(
         &self,
         package_name: &[u8],
@@ -332,19 +312,20 @@ impl Options {
         let scope = self.scope_for_package_name(package_name);
         let mut note = Vec::new();
         match request {
-            RequestKind::Manifest => {
-                if scope.has_credentials() {
-                    return note;
-                }
+            RequestKind::Manifest if !scope.has_credentials() => {
                 let registry = scope.url.url();
+                let slash = if registry.pathname.ends_with(b"/") {
+                    ""
+                } else {
+                    "/"
+                };
                 let _ = write!(
                     note,
-                    "\n  no credentials are configured for this registry; add //{}{}:_authToken=<token> to .npmrc",
+                    "\n  no credentials are configured for this registry; add //{}{}{slash}:_authToken=<token> to .npmrc",
                     bstr::BStr::new(registry.host),
-                    RegistryPath(registry.pathname),
+                    bstr::BStr::new(registry.pathname),
                 );
             }
-            RequestKind::Tarball(Authorization::NoAuthorization) => {}
             RequestKind::Tarball(Authorization::AllowAuthorization) => {
                 let url = bun_url::URL::parse(url);
                 if self.tarball_credentials(scope, &url).is_some() {
@@ -367,35 +348,25 @@ impl Options {
                     );
                 }
             }
+            _ => {}
         }
         note
     }
 
-    /// Give every scope that ended up without credentials the ones `.npmrc`
-    /// configures for its registry URL. This is how `--registry` and
-    /// `$NPM_CONFIG_REGISTRY` pick up a `//host/:_authToken=` line: they are
-    /// applied after the `.npmrc` files were read, so the loader could not
-    /// attach the line to them.
+    /// How `--registry` and `$NPM_CONFIG_REGISTRY` pick up a `//host/:_authToken=` line.
     fn fill_credentials_from_url_auth(&mut self) {
-        if self.url_auth.is_empty() {
-            return;
-        }
         let url_auth = &self.url_auth;
         for scope in core::iter::once(&mut self.scope).chain(self.registries.values_mut()) {
-            if scope.has_credentials() {
-                continue;
-            }
-            let found = Npm::registry::UrlAuth::find(url_auth, &scope.url.url());
-            if let Some(credentials) = found {
-                scope.copy_credentials_from(credentials);
+            if !scope.has_credentials() {
+                if let Some(found) = Npm::registry::UrlAuth::find(url_auth, &scope.url.url()) {
+                    scope.copy_credentials_from(found);
+                }
             }
         }
     }
 }
 
-/// Scheme, host and effective port are equal. Compared component-wise rather
-/// than on the raw `URL.origin` slice: some registries spell out the default
-/// port in `dist.tarball` (`https://host:443/...`) while `.npmrc` does not.
+/// Component-wise, so `https://host:443/` in `dist.tarball` matches `https://host/` in `.npmrc`.
 fn is_same_origin(a: &bun_url::URL, b: &bun_url::URL) -> bool {
     a.protocol.eq_ignore_ascii_case(b.protocol)
         && a.hostname.eq_ignore_ascii_case(b.hostname)
@@ -404,26 +375,11 @@ fn is_same_origin(a: &bun_url::URL, b: &bun_url::URL) -> bool {
 
 #[derive(Clone, Copy)]
 pub(crate) enum RequestKind {
-    /// Always on the package's registry, so it carries the scope's credentials.
     Manifest,
-    /// May be anywhere; see `Options::tarball_credentials`. Carries what the
-    /// request was enqueued with (`NetworkTask::authorization`).
+    /// What the request was enqueued with (`NetworkTask::authorization`).
     Tarball(Authorization),
 }
 
-/// A registry pathname in the form `.npmrc` keys use: `/` or `/some/path/`.
-struct RegistryPath<'a>(&'a [u8]);
-
-impl core::fmt::Display for RegistryPath<'_> {
-    fn fmt(&self, f: &mut core::fmt::Formatter<'_>) -> core::fmt::Result {
-        write!(f, "{}", bstr::BStr::new(self.0))?;
-        if !self.0.ends_with(b"/") {
-            f.write_str("/")?;
-        }
-        Ok(())
-    }
-}
-
 impl Options {
     /// The scope for `url` once it replaces `current`, with the credentials configured for `url`.
     fn scope_for_registry_url(
@@ -431,53 +387,34 @@ impl Options {
         name: &[u8],
         current: &Npm::registry::Scope,
         url: &[u8],
-    ) -> Result<Npm::registry::Scope, AllocError> {
+    ) -> Npm::registry::Scope {
         let mut scope = Npm::registry::Scope {
             name: name.into(),
             ..Default::default()
         };
         scope.set_url(url.into());
-        if let Some(configured) = core::iter::once(&self.scope)
+        let configured = core::iter::once(&self.scope)
             .chain(self.registries.values())
             .find(|configured| configured.url_hash == scope.url_hash)
-        {
+            .or_else(|| Npm::registry::UrlAuth::find(&self.url_auth, &scope.url.url()));
+        if let Some(configured) = configured {
             scope.copy_credentials_from(configured);
-            return Ok(scope);
-        }
-        if let Some(credentials) = Npm::registry::UrlAuth::find(&self.url_auth, &scope.url.url()) {
-            scope.copy_credentials_from(credentials);
-            return Ok(scope);
+            return scope;
         }
-        // Unconfigured `url`: `current`'s credentials follow it only same-origin, and never to http.
-        let new_url = scope.url.url();
-        let current_url = current.url.url();
+        // Unconfigured `url`: `current`'s credentials follow it only same-host, and never to http.
+        let (new_url, current_url) = (scope.url.url(), current.url.url());
         if bun_core::without_trailing_slash(new_url.host)
             == bun_core::without_trailing_slash(current_url.host)
             && (new_url.is_https() || !current_url.is_https())
         {
-            scope.token.clone_from(&current.token);
-            scope.auth.clone_from(&current.auth);
-            scope.user.clone_from(&current.user);
+            scope.copy_credentials_from(current);
         }
-        Ok(scope)
+        scope
     }
 
-    /// Replaces the registry used by packages that have no registry for their scope.
-    fn set_default_registry(&mut self, url: &[u8]) -> Result<(), AllocError> {
-        self.scope = self.scope_for_registry_url(b"", &self.scope, url)?;
+    fn set_default_registry(&mut self, url: &[u8]) {
+        self.scope = self.scope_for_registry_url(b"", &self.scope, url);
         self.did_override_default_scope = self.scope.url_hash != *Npm::registry::DEFAULT_URL_HASH;
-        Ok(())
-    }
-
-    /// Replaces the registry used by the packages of `scope_name` (without the `@`).
-    fn set_scope_registry(&mut self, scope_name: &[u8], url: &[u8]) -> Result<(), AllocError> {
-        let key = Npm::registry::Scope::hash(scope_name);
-        let current = match self.registries.get(&key) {
-            Some(scope) if *scope.name == *scope_name => scope,
-            _ => &self.scope,
-        };
-        let scope = self.scope_for_registry_url(scope_name, current, url)?;
-        self.registries.put(key, scope)
     }
 
     /// Applies the `publishConfig` of the package being published; command-line flags win over it.
@@ -509,18 +446,18 @@ impl Options {
         // As in npm, `registry` replaces only the default registry; `@scope:registry` the scope's.
         if !self.registry_from_command_line {
             if let Some(url) = publish_config_registry(&config, bump, b"registry")? {
-                self.set_default_registry(url)?;
+                self.set_default_registry(url);
             }
         }
 
-        if !package_name.is_empty() && package_name[0] == b'@' {
+        if package_name.starts_with(b"@") {
             let scope_name = Npm::registry::Scope::get_name(package_name);
-            let mut key = Vec::with_capacity(b"@:registry".len() + scope_name.len());
-            key.push(b'@');
-            key.extend_from_slice(scope_name);
-            key.extend_from_slice(b":registry");
+            let key = [b"@".as_slice(), scope_name, b":registry"].concat();
             if let Some(url) = publish_config_registry(&config, bump, &key)? {
-                self.set_scope_registry(scope_name, url)?;
+                let current = self.scope_for_package_name(package_name);
+                let scope = self.scope_for_registry_url(scope_name, current, url);
+                self.registries
+                    .put(Npm::registry::Scope::hash(scope_name), scope)?;
             }
         }
 
@@ -923,10 +860,8 @@ impl Options {
                 let api_registry = Api::NpmRegistry::from_url(cli.registry);
                 if api_registry.has_credentials() {
                     self.scope = Npm::registry::Scope::from_api(b"", api_registry, env)?;
-                    self.did_override_default_scope =
-                        self.scope.url_hash != *Npm::registry::DEFAULT_URL_HASH;
                 } else {
-                    self.set_default_registry(&api_registry.url)?;
+                    self.set_default_registry(&api_registry.url);
                 }
                 self.registry_from_command_line = true;
             }
@@ -1190,8 +1125,6 @@ impl Options {
             self.enable.set(Enable::FORCE_SAVE_LOCKFILE, false);
         }
 
-        // After every source that can set a registry URL (bunfig, .npmrc,
-        // environment, command line) has been applied.
         self.fill_credentials_from_url_auth();
 
         // moved from `defer { ... }` after scope assignment (see note above).
diff --git a/src/install/npm.rs b/src/install/npm.rs
index ac23ad45de26..fbde741be7d8 100644
--- a/src/install/npm.rs
+++ b/src/install/npm.rs
@@ -553,15 +553,11 @@ pub mod registry {
     // Keys are pre-hashed (`Scope::hash`), so don't re-hash them.
     pub type Map = HashMap<u64, Scope, bun_collections::IdentityContext<u64>>;
 
-    /// Credentials from a `.npmrc` `//host/path/:...` line, matched against
-    /// request URLs the way npm resolves credentials for a URL: the host
-    /// (including the port) must be the same and the key's path must be the
-    /// request path or one of its parent directories. Keys have no scheme, so
-    /// a key applies to both `http` and `https` requests to its host.
+    /// A `.npmrc` `//host/path/:...` line, matched like npm does: same host and port, and the
+    /// key's path is the request path or a parent directory of it; either scheme.
     pub(crate) struct UrlAuth {
         hostname: Box<[u8]>,
-        /// `None` when the key does not spell out a port, which means the
-        /// scheme's default port of whatever request is being matched.
+        /// `None`: the default port of the request's scheme.
         port: Option<u16>,
         /// Without trailing slash; `/` for a bare host.
         pathname: Box<[u8]>,
@@ -570,58 +566,41 @@ pub mod registry {
     }
 
     impl UrlAuth {
-        /// `None` when the line carries nothing that can be sent as an
-        /// `Authorization` header (for example only an `email`), so it never
-        /// shadows a shallower key that does.
+        /// `None` when the line has nothing to send as `Authorization` (e.g. only `email`), so it
+        /// never shadows a shallower key that does.
         pub(crate) fn from_api(
             api: &api::NpmUrlAuth,
             env: &mut DotEnv,
         ) -> Result<Option<UrlAuth>, AllocError> {
             let credentials = Scope::from_api(b"", api.credentials.clone(), env)?;
-            if !credentials.has_credentials() {
-                return Ok(None);
-            }
             let host = URL::parse(&api.host);
-            let port = if host.port.is_empty() {
-                None
-            } else {
-                match host.get_port() {
-                    Some(port) => Some(port),
-                    // `//host:notaport/` cannot match any request.
-                    None => return Ok(None),
-                }
-            };
-            if host.hostname.is_empty() {
+            // `//host:notaport/` cannot match any request.
+            if !credentials.has_credentials()
+                || host.hostname.is_empty()
+                || (!host.port.is_empty() && host.get_port().is_none())
+            {
                 return Ok(None);
             }
             Ok(Some(UrlAuth {
                 hostname: host.hostname.into(),
-                port,
+                port: host.get_port(),
                 pathname: api.pathname.clone(),
                 credentials,
             }))
         }
 
         fn matches(&self, url: &URL) -> bool {
-            if !strings::eql_case_insensitive_ascii(url.hostname, &self.hostname, true) {
-                return false;
-            }
-            let port = url.get_port_auto();
-            let port_matches = match self.port {
-                Some(expected) => port == expected,
-                None => port == if url.is_https() { 443 } else { 80 },
-            };
-            if !port_matches {
-                return false;
-            }
-            let prefix: &[u8] = &self.pathname;
-            prefix == b"/"
-                || (url.pathname.starts_with(prefix)
-                    && url.pathname.get(prefix.len()).is_none_or(|&c| c == b'/'))
+            let (path, default_port) = (&*self.pathname, if url.is_https() { 443 } else { 80 });
+            strings::eql_case_insensitive_ascii(url.hostname, &self.hostname, true)
+                && url.get_port_auto() == self.port.unwrap_or(default_port)
+                && (path == b"/"
+                    || url
+                        .pathname
+                        .strip_prefix(path)
+                        .is_some_and(|r| matches!(r, [] | [b'/', ..])))
         }
 
-        /// The credentials configured for `url`: the matching key with the
-        /// longest path (`//host/a/b/` beats `//host/`).
+        /// The matching key with the longest path (`//host/a/b/` beats `//host/`).
         pub(crate) fn find<'a>(list: &'a [UrlAuth], url: &URL) -> Option<&'a Scope> {
             list.iter()
                 .filter(|entry| entry.matches(url))
@@ -833,9 +812,7 @@ pub struct PackageVersion {
     /// `"cpu"` field in package.json
     pub(crate) cpu: Architecture,
 
-    /// `"libc"` field in package.json. The abbreviated registry document omits
-    /// it, so this is only populated when the manifest was fetched with
-    /// `has_extended_manifest` (`Libc::NONE` = not declared).
+    /// `"libc"` field in package.json; only in the extended manifest (`Libc::NONE` = not declared).
     pub(crate) libc: Libc,
 
     /// `hasInstallScript` field in registry API.
@@ -966,9 +943,7 @@ pub struct NpmPackage {
     pub(crate) versions_buf: VersionSlice,
     pub(crate) string_lists_buf: ExternalStringList,
 
-    /// Fetched with `Accept: application/json` (the full document) rather than
-    /// the abbreviated one, so `publish_timestamp_ms` and `PackageVersion.libc`
-    /// are populated. See `PackageManager::needs_extended_manifest`.
+    // The full document was fetched: `publish_timestamp_ms` and `PackageVersion.libc` are populated.
     pub(crate) has_extended_manifest: bool,
     pub(crate) _padding_tail: [u8; 7],
 }
@@ -1741,14 +1716,6 @@ impl PackageManifest {
         exclusions.is_some_and(|excludes| excludes.excludes_package(self.name()))
     }
 
-    fn is_version_excluded_from_age_filter(
-        &self,
-        version: Semver::Version,
-        exclusions: Option<&MinimumReleaseAgeExcludes>,
-    ) -> bool {
-        exclusions.is_some_and(|excludes| excludes.excludes_version(self.name(), version))
-    }
-
     /// Too recent for the gate and not listed in `exclusions`.
     pub(crate) fn is_version_blocked_by_age_filter(
         &self,
@@ -1757,7 +1724,7 @@ impl PackageManifest {
         exclusions: Option<&MinimumReleaseAgeExcludes>,
     ) -> bool {
         Self::is_package_version_too_recent(result.package, minimum_release_age_ms)
-            && !self.is_version_excluded_from_age_filter(result.version, exclusions)
+            && !exclusions.is_some_and(|e| e.excludes_version(self.name(), result.version))
     }
 
     #[inline]
@@ -1795,7 +1762,7 @@ impl PackageManifest {
             if group.satisfies(version, group_buf, &self.string_buf) {
                 let package = &packages[i];
                 // Listed versions count as stable: no age gate, and they replace an unstable fallback in `best_version`.
-                if self.is_version_excluded_from_age_filter(version, exclusions) {
+                if exclusions.is_some_and(|e| e.excludes_version(self.name(), version)) {
                     best_version = Some(FindResult { version, package });
                     break;
                 }
@@ -1967,7 +1934,7 @@ impl PackageManifest {
             }
 
             // See `search_version_list`.
-            if self.is_version_excluded_from_age_filter(version, exclusions) {
+            if exclusions.is_some_and(|e| e.excludes_version(self.name(), version)) {
                 best_version = Some(FindResult { version, package });
                 break;
             }
@@ -2815,31 +2782,27 @@ impl PackageManifest {
                             package_version.unpacked_size = n.value() as u32;
                         }
 
-                        let integrity_str = dist
-                            .get(b"integrity")
-                            .and_then(|v| v.as_str())
-                            .unwrap_or(b"");
-                        if !integrity_str.is_empty() {
-                            package_version.integrity = Integrity::parse(integrity_str);
+                        let mut malformed = false;
+                        if let Some(shasum_str) = dist.get(b"integrity").and_then(|v| v.as_str()) {
+                            package_version.integrity = Integrity::parse(shasum_str);
                             if package_version.integrity.tag.is_supported() {
                                 break 'integrity;
                             }
+                            malformed = !shasum_str.is_empty();
                         }
 
-                        let mut malformed_shasum = false;
                         if let Some(shasum_str) = dist.get(b"shasum").and_then(|v| v.as_str()) {
                             match Integrity::parse_sha_sum(shasum_str) {
-                                Ok(integrity) => {
+                                Ok(integrity) if integrity.tag.is_supported() => {
                                     package_version.integrity = integrity;
-                                    if integrity.tag.is_supported() {
-                                        break 'integrity;
-                                    }
+                                    break 'integrity;
                                 }
-                                Err(_) => malformed_shasum = true,
+                                Ok(_) => {}
+                                Err(_) => malformed = true,
                             }
                         }
 
-                        if !integrity_str.is_empty() || malformed_shasum {
+                        if malformed {
                             log.add_warning_fmt(
                                 None,
                                 bun_ast::Loc::EMPTY,
diff --git a/src/runtime/cli/package_manager_command.rs b/src/runtime/cli/package_manager_command.rs
index f3a29832eaa9..0c15f7e2f30a 100644
--- a/src/runtime/cli/package_manager_command.rs
+++ b/src/runtime/cli/package_manager_command.rs
@@ -36,10 +36,7 @@ pub(crate) struct NodeModulesFolder {
     dependencies: Box<[DependencyID]>,
 }
 
-/// Disk-existence check for `bun pm ls`: the lockfile also contains entries
-/// that were never installed (platform-mismatched optionals) or were removed
-/// after install (`bun prune --production`), and those must not be listed as
-/// the contents of `node_modules`.
+/// `bun pm ls` lists what is on disk: the lockfile also has never-installed optionals and pruned entries.
 struct InstalledFilter {
     path: AutoAbsPath,
     top_len: usize,
@@ -47,38 +44,28 @@ struct InstalledFilter {
 }
 
 impl InstalledFilter {
-    fn init() -> Self {
-        let path = AutoAbsPath::init_top_level_dir();
+    /// `None` when there is no `node_modules`.
+    fn init() -> Option<Self> {
+        let mut path = AutoAbsPath::init_top_level_dir();
         let top_len = path.len();
-        Self {
+        let _ = path.append(b"node_modules");
+        let store = BunStore::init();
+        bun_sys::exists(path.slice()).then(|| Self {
             path,
             top_len,
-            store: BunStore::init(),
-        }
-    }
-
-    fn node_modules_exists(&mut self) -> bool {
-        self.path.set_length(self.top_len);
-        let _ = self.path.append(b"node_modules");
-        let exists = bun_sys::exists(self.path.slice());
-        self.path.set_length(self.top_len);
-        exists
+            store,
+        })
     }
 
-    fn is_installed(
-        &mut self,
-        lockfile: &Lockfile,
-        relative_path: &[u8],
-        dep_id: DependencyID,
-    ) -> bool {
-        let package_id = lockfile.buffers.resolutions.as_slice()[dep_id as usize];
-        if package_id as usize >= lockfile.packages.len() {
+    fn is_installed(&mut self, lockfile: &Lockfile, dir: &[u8], dep_id: DependencyID) -> bool {
+        let package_id = lockfile.buffers.resolutions.as_slice()[dep_id as usize] as usize;
+        if package_id >= lockfile.packages.len() {
             return false;
         }
         let slice = lockfile.packages.slice();
-        let resolution = &slice.items_resolution()[package_id as usize];
-        // Local sources (the project itself, workspaces, `bun link`ed packages)
-        // always exist on disk outside of node_modules.
+        let name = slice.items_name()[package_id];
+        let resolution = &slice.items_resolution()[package_id];
+        // Local sources always exist on disk, outside of node_modules.
         if matches!(
             resolution.tag,
             ResolutionTag::Root | ResolutionTag::Workspace | ResolutionTag::Symlink
@@ -91,25 +78,14 @@ impl InstalledFilter {
             .name
             .slice(buf);
         self.path.set_length(self.top_len);
-        let _ = self.path.append(relative_path);
+        let _ = self.path.append(dir);
         let _ = self.path.append(alias);
-        let exists = bun_sys::exists(self.path.slice());
-        self.path.set_length(self.top_len);
-        if exists {
-            return true;
-        }
-
-        // Isolated installs (`node_modules/.bun`) only link direct dependencies
-        // into each package's node_modules; transitive packages live in the store.
-        self.store
-            .lookup(
-                &mut self.path,
-                self.top_len,
-                slice.items_name()[package_id as usize],
-                resolution,
-                buf,
-            )
-            .is_some()
+        // Isolated installs only link direct dependencies into each node_modules; the rest is in the store.
+        bun_sys::exists(self.path.slice())
+            || self
+                .store
+                .lookup(&mut self.path, self.top_len, name, resolution, buf)
+                .is_some()
     }
 }
 
@@ -615,14 +591,13 @@ Learn more about these at <magenta>https://bun.com/docs/cli/pm<r>.\n";
             Output::disable_buffering();
             let lockfile: &Lockfile = &pm.lockfile;
 
-            let mut installed = InstalledFilter::init();
-            if !installed.node_modules_exists() {
+            let Some(mut installed) = InstalledFilter::init() else {
                 if log_level != LogLevel::Silent {
                     Output::err_generic("node_modules not found, nothing to list", ());
                     bun_core::note!("run 'bun install' first");
                 }
                 Global::exit(1);
-            }
+            };
 
             let mut iterator =
                 tree::Iterator::<{ tree::IteratorPathStyle::NodeModules }>::init(lockfile);
@@ -637,18 +612,9 @@ Learn more about these at <magenta>https://bun.com/docs/cli/pm<r>.\n";
                 path.extend_from_slice(node_modules.relative_path.as_bytes());
                 path.push(0);
 
-                let dependencies: Box<[DependencyID]> = node_modules
-                    .dependencies
-                    .iter()
-                    .copied()
-                    .filter(|&dep_id| {
-                        installed.is_installed(
-                            lockfile,
-                            node_modules.relative_path.as_bytes(),
-                            dep_id,
-                        )
-                    })
-                    .collect();
+                let dir = node_modules.relative_path.as_bytes();
+                let mut dependencies = node_modules.dependencies.to_vec();
+                dependencies.retain(|&dep_id| installed.is_installed(lockfile, dir, dep_id));
                 installed_count += dependencies.len();
 
                 if max_depth < node_modules.depth + 1 {
@@ -658,7 +624,7 @@ Learn more about these at <magenta>https://bun.com/docs/cli/pm<r>.\n";
                 directories.push(NodeModulesFolder {
                     // SAFETY: NUL terminator just appended above.
                     relative_path: bun_core::ZBox::from_vec_with_nul(path),
-                    dependencies,
+                    dependencies: dependencies.into(),
                 });
             }
 
@@ -757,9 +723,9 @@ Learn more about these at <magenta>https://bun.com/docs/cli/pm<r>.\n";
                         .name
                         .slice(string_bytes);
                     let name = bun_fmt::escape_control_chars(name);
-                    let resolution = bun_core::fmt::EscapeControlChars(bun_fmt::redacted(
+                    let resolution = bun_fmt::for_terminal(
                         resolutions[package_id as usize].fmt(string_bytes, PathSep::Auto),
-                    ));
+                    );
 
                     if index < sorted_dependencies.len() - 1 {
                         bun_core::prettyln!("<d>├──<r> {}<r><d>@{}<r>\n", name, resolution);
@@ -902,20 +868,12 @@ fn print_node_modules_folder_structure(
                 }
             }
             let directory_version =
-                bun_fmt::redacted(resolutions[id as usize].fmt(string_bytes, PathSep::Auto));
+                bun_fmt::for_terminal(resolutions[id as usize].fmt(string_bytes, PathSep::Auto));
             if let Some(j) = strings::index_of(path, b"node_modules") {
-                bun_core::prettyln!(
-                    "{}<d>@{}<r>",
-                    bun_fmt::escape_control_chars(&path[0..j - 1]),
-                    bun_fmt::EscapeControlChars(directory_version),
-                );
-            } else {
-                bun_core::prettyln!(
-                    "{}<d>@{}<r>",
-                    bun_fmt::escape_control_chars(path),
-                    bun_fmt::EscapeControlChars(directory_version),
-                );
+                path = &path[0..j - 1];
             }
+            let path = bun_fmt::escape_control_chars(path);
+            bun_core::prettyln!("{}<d>@{}<r>", path, directory_version);
         } else {
             let mut cwd_buf = PathBuffer::uninit();
             let path = match bun_sys::getcwd(&mut cwd_buf[..]) {
@@ -1024,9 +982,9 @@ fn print_node_modules_folder_structure(
         bun_core::prettyln!(
             "{}<d>@{}<r>",
             bun_fmt::escape_control_chars(package_name),
-            bun_fmt::EscapeControlChars(bun_fmt::redacted(
-                resolutions[package_id as usize].fmt(string_bytes, PathSep::Auto),
-            )),
+            bun_fmt::for_terminal(
+                resolutions[package_id as usize].fmt(string_bytes, PathSep::Auto)
+            ),
         );
     }
 
@@ -1093,9 +1051,9 @@ fn print_trusted_dependencies_flat(
         let package_id = resolutions_buf[dep_id as usize];
         let name =
             bun_fmt::escape_control_chars(dependencies[dep_id as usize].name.slice(string_bytes));
-        let resolution = bun_core::fmt::EscapeControlChars(bun_fmt::redacted(
+        let resolution = bun_fmt::for_terminal(
             resolutions[package_id as usize].fmt(string_bytes, PathSep::Auto),
-        ));
+        );
         if index + 1 < trusted.len() {
             bun_core::prettyln!("<d>├──<r> {}<r><d>@{}<r>\n", name, resolution);
         } else {
diff --git a/src/runtime/cli/why_command.rs b/src/runtime/cli/why_command.rs
index b7ca12db313f..72b97590059b 100644
--- a/src/runtime/cli/why_command.rs
+++ b/src/runtime/cli/why_command.rs
@@ -5,7 +5,7 @@ use std::io::Write as _;
 use bstr::BStr;
 
 use bun_collections::HashMap;
-use bun_core::fmt::{PathSep, escape_control_chars, redacted};
+use bun_core::fmt::{PathSep, escape_control_chars, for_terminal};
 use bun_core::strings;
 use bun_core::{Global, Output};
 use bun_install::dependency::Behavior;
@@ -477,7 +477,7 @@ impl WhyCommand {
             bun_core::prettyln!(
                 "<b>{}@{}<r>",
                 BStr::new(target_name),
-                bun_core::fmt::EscapeControlChars(redacted(BStr::new(&target_version.version)))
+                for_terminal(BStr::new(&target_version.version))
             );
 
             if let Some(dependents) = all_dependents.get(&target_version.pkg_id) {
@@ -549,17 +549,14 @@ fn print_package_with_type(prefix: &[u8], package: &DependentInfo) {
     } else {
         bun_core::pretty!("{}", escape_control_chars(&package.name));
         if !package.version.is_empty() {
-            bun_core::pretty!(
-                "<d>@{}<r>",
-                bun_core::fmt::EscapeControlChars(redacted(BStr::new(&package.version)))
-            );
+            bun_core::pretty!("<d>@{}<r>", for_terminal(BStr::new(&package.version)));
         }
     }
 
     if !package.spec.is_empty() {
         bun_core::prettyln!(
             " <d>(requires {})<r>",
-            bun_core::fmt::EscapeControlChars(redacted(BStr::new(&package.spec)))
+            for_terminal(BStr::new(&package.spec))
         );
     } else {
         bun_core::prettyln!("");
@@ -570,22 +567,9 @@ pub(crate) struct TreeContext<'a> {
     all_dependents: &'a HashMap<PackageID, Vec<DependentInfo>>,
     /// Packages being expanded right now; the value records whether a `*circular` pointed at it.
     path_tracker: HashMap<PackageID, bool>,
-    /// Subtrees already printed; repeats print `*deduped` (there are exponentially many paths).
-    expanded: HashMap<PackageID, Expanded>,
-}
-
-#[derive(Clone, Copy)]
-struct Expanded {
-    depth: usize,
-    cutoff: usize,
-}
-
-/// What `print_dependency_tree` printed below a package line.
-#[derive(Clone, Copy)]
-struct Printed {
-    lines: usize,
-    /// Repeating the package at a depth below this shows more: a branch ran into `MAX_DEPTH`.
-    cutoff: usize,
+    /// `(depth, cutoff)` of subtrees already printed; repeats print `*deduped` (there are
+    /// exponentially many paths) unless shallower than `cutoff`, where a branch cut at `MAX_DEPTH` shows more.
+    expanded: HashMap<PackageID, (usize, usize)>,
 }
 
 impl<'a> TreeContext<'a> {
@@ -596,14 +580,9 @@ impl<'a> TreeContext<'a> {
             expanded: HashMap::default(),
         }
     }
-
-    /// The earlier expansion of `pkg_id`, unless repeating it at `depth` would show more.
-    fn already_expanded(&self, pkg_id: PackageID, depth: usize) -> Option<Expanded> {
-        let previous = *self.expanded.get(&pkg_id)?;
-        (depth >= previous.cutoff).then_some(previous)
-    }
 }
 
+/// Returns `(lines printed, cutoff)`; see `TreeContext::expanded`.
 fn print_dependency_tree(
     ctx: &mut TreeContext<'_>,
     current_pkg_id: PackageID,
@@ -611,32 +590,23 @@ fn print_dependency_tree(
     depth: usize,
     printed_break_line: bool,
     parent_is_workspace: bool,
-) -> Printed {
+) -> (usize, usize) {
     if let Some(pointed_at_by_cycle) = ctx.path_tracker.get_mut(&current_pkg_id) {
         *pointed_at_by_cycle = true;
         bun_core::prettyln!("<d>{}└─ <yellow>*circular<r>", BStr::new(prefix));
-        return Printed {
-            lines: 1,
-            cutoff: 0,
-        };
+        return (1, 0);
     }
 
-    if let Some(previous) = ctx.already_expanded(current_pkg_id, depth) {
+    if let Some(&(_, cutoff)) = ctx.expanded.get(&current_pkg_id).filter(|e| depth >= e.1) {
         bun_core::prettyln!("<d>{}└─ *deduped<r>", BStr::new(prefix));
-        return Printed {
-            lines: 1,
-            cutoff: previous.cutoff,
-        };
+        return (1, cutoff);
     }
 
     ctx.path_tracker.insert(current_pkg_id, false);
     // All post-insert exit paths below remove explicitly. Error paths are gone
     // (alloc failures abort under global mimalloc).
 
-    let mut printed = Printed {
-        lines: 0,
-        cutoff: 0,
-    };
+    let (mut lines, mut cutoff) = (0usize, 0usize);
 
     if let Some(dependents) = ctx.all_dependents.get(&current_pkg_id) {
         let mut sorted_dependents: Vec<DependentInfo> = dependents.clone();
@@ -650,8 +620,8 @@ fn print_dependency_tree(
 
             if depth >= MAX_DEPTH.load(AtomicOrdering::Relaxed) {
                 bun_core::prettyln!("<d>{}└─ (deeper dependencies hidden)<r>", BStr::new(prefix));
-                printed.lines += 1;
-                printed.cutoff = depth;
+                lines += 1;
+                cutoff = depth;
                 break;
             }
 
@@ -666,7 +636,7 @@ fn print_dependency_tree(
             full_prefix.extend_from_slice(prefix);
             full_prefix.extend_from_slice(prefix_char);
             print_package_with_type(&full_prefix, dep);
-            printed.lines += 1;
+            lines += 1;
 
             let next_suffix: &[u8] = if is_dep_last {
                 b"   "
@@ -678,7 +648,7 @@ fn print_dependency_tree(
             next_prefix.extend_from_slice(next_suffix);
 
             let print_break_line = is_dep_last && len > 1 && !printed_break_line;
-            let subtree = print_dependency_tree(
+            let (subtree_lines, subtree_cutoff) = print_dependency_tree(
                 ctx,
                 dep.pkg_id,
                 &next_prefix,
@@ -686,9 +656,9 @@ fn print_dependency_tree(
                 printed_break_line || print_break_line,
                 dep.workspace,
             );
-            printed.lines += subtree.lines;
+            lines += subtree_lines;
             // A dependent repeats one level deeper than this package does.
-            printed.cutoff = printed.cutoff.max(subtree.cutoff.saturating_sub(1));
+            cutoff = cutoff.max(subtree_cutoff.saturating_sub(1));
 
             if print_break_line {
                 bun_core::prettyln!("<d>{}<r>", BStr::new(prefix));
@@ -696,27 +666,19 @@ fn print_dependency_tree(
         }
     }
 
-    let pointed_at_by_cycle = ctx.path_tracker.remove(&current_pkg_id) == Some(true);
-
-    if pointed_at_by_cycle && printed.cutoff > 0 {
+    if ctx.path_tracker.remove(&current_pkg_id) == Some(true) && cutoff > 0 {
         // Their `*circular` stood in for this cut-off subtree; a repeat reaches it one level down.
-        for record in ctx.expanded.values_mut() {
-            if record.depth > depth {
-                record.cutoff = record.cutoff.max(printed.cutoff - 1);
+        for (their_depth, their_cutoff) in ctx.expanded.values_mut() {
+            if *their_depth > depth {
+                *their_cutoff = (*their_cutoff).max(cutoff - 1);
             }
         }
     }
 
     // A one-line subtree is no longer than the `*deduped` marker, so it is repeated instead.
-    if printed.lines > 1 {
-        ctx.expanded.insert(
-            current_pkg_id,
-            Expanded {
-                depth,
-                cutoff: printed.cutoff,
-            },
-        );
+    if lines > 1 {
+        ctx.expanded.insert(current_pkg_id, (depth, cutoff));
     }
 
-    printed
+    (lines, cutoff)
 }

From fcb24ff765e2ab8b443dba2e286ebfed21008085 Mon Sep 17 00:00:00 2001
From: Jarred Sumner <jarred@jarredsumner.com>
Date: Mon, 17 Aug 2026 05:51:35 +0000
Subject: [PATCH 218/258] simplify(s5-net-pm): flatten pm pkg Segment, shorter
 escape sites, trim manifest-map/trust/ini comments

- pm pkg: Segment { name, bracketed, end } instead of Segment + SegmentKind
- pm view / audit: import escape_control_chars, hoist repeated escapes into locals
- audit fix: inline same_release_line, root_package_json via target_for
- ini: index-based upsert in apply_to_url_auth
- PackageManifestMap / pm trust: comment trims only

(cherry picked from commit 0431daa3e058f7a2dbb731436eaefa2d9286152c)
---
 src/ini/lib.rs                              |  30 +++---
 src/install/PackageManifestMap.rs           |  19 +---
 src/install/audit_fix.rs                    |  31 +++---
 src/install/audit_fix/package_json_edits.rs |   6 +-
 src/runtime/cli/audit_command.rs            |  13 +--
 src/runtime/cli/pm_pkg_command.rs           | 104 ++++++++------------
 src/runtime/cli/pm_trusted_command.rs       |   9 +-
 src/runtime/cli/pm_view_command.rs          |  80 +++++----------
 8 files changed, 106 insertions(+), 186 deletions(-)

diff --git a/src/ini/lib.rs b/src/ini/lib.rs
index 8c6097257892..d9df42d92dc6 100644
--- a/src/ini/lib.rs
+++ b/src/ini/lib.rs
@@ -1184,24 +1184,20 @@ mod draft {
             }
         }
 
-        /// Record this line under its `//host/path/` prefix so the package
-        /// manager can also resolve it by request URL (see `NpmUrlAuth`).
+        /// Also record the line by `//host/path/` so it can be resolved by request URL (`NpmUrlAuth`).
         fn apply_to_url_auth(&self, url_auth: &mut Vec<NpmUrlAuth>) {
-            let entry = match url_auth
-                .iter_mut()
-                .find(|entry| entry.host == self.host && entry.pathname == self.pathname)
-            {
-                Some(entry) => entry,
-                None => {
-                    url_auth.push(NpmUrlAuth {
-                        host: self.host.clone(),
-                        pathname: self.pathname.clone(),
-                        credentials: NpmRegistry::default(),
-                    });
-                    url_auth.last_mut().expect("just pushed")
-                }
-            };
-            self.apply_to(&mut entry.credentials);
+            let existing = url_auth
+                .iter()
+                .position(|entry| entry.host == self.host && entry.pathname == self.pathname);
+            let index = existing.unwrap_or_else(|| {
+                url_auth.push(NpmUrlAuth {
+                    host: self.host.clone(),
+                    pathname: self.pathname.clone(),
+                    credentials: NpmRegistry::default(),
+                });
+                url_auth.len() - 1
+            });
+            self.apply_to(&mut url_auth[index].credentials);
         }
     }
 
diff --git a/src/install/PackageManifestMap.rs b/src/install/PackageManifestMap.rs
index fc8f4e942eb4..4c52cc1e3ac2 100644
--- a/src/install/PackageManifestMap.rs
+++ b/src/install/PackageManifestMap.rs
@@ -74,18 +74,8 @@ impl PackageManifestMap {
         )
     }
 
-    /// Stores a manifest that was just fetched. When the same package was
-    /// requested both abbreviated and extended during this install (it is a
-    /// regular dependency of one package and an optional dependency of
-    /// another), the extended response must win regardless of which one
-    /// arrives last, otherwise the dependencies waiting for the extended one
-    /// would never resolve.
-    ///
-    /// This only decides what this install resolves from. A fetched document
-    /// is written to the disk cache by the task that parsed it, before it gets
-    /// here, so when both were fetched the disk ends up with whichever save
-    /// finished last; if that was the abbreviated one, the next resolve that
-    /// needs the extended document fetches it again, nothing else depends on it.
+    /// When a package was requested both abbreviated and extended in one install, the extended
+    /// response wins whichever arrives last, or dependencies waiting on it would never resolve.
     pub(crate) fn insert(
         &mut self,
         name_hash: PackageNameHash,
@@ -166,10 +156,7 @@ impl PackageManifestMap {
     /// [`DiskCacheCtx`] so callers never hold `&mut pm.manifests` and a
     /// `PackageManager` borrow simultaneously.
     ///
-    /// With `needs_extended_manifest`, an abbreviated manifest is reported as
-    /// missing so the caller fetches the extended one. The entry itself is left
-    /// untouched: it is still valid for the callers that don't need the
-    /// extended fields, and `insert` replaces it once the extended one arrives.
+    /// With `needs_extended_manifest`, an abbreviated entry reads as missing but stays for other callers.
     pub(crate) fn by_name_hash_allow_expired(
         &mut self,
         ctx: DiskCacheCtx,
diff --git a/src/install/audit_fix.rs b/src/install/audit_fix.rs
index ef895fcb2781..12a34236839b 100644
--- a/src/install/audit_fix.rs
+++ b/src/install/audit_fix.rs
@@ -5,6 +5,7 @@ use std::io::Write as _;
 use bstr::BStr;
 use bun_ast::Expr;
 use bun_collections::{DynamicBitSet, HashMap, index_sort};
+use bun_core::fmt::escape_control_chars;
 use bun_core::{Global, Output, UnwrapOrOom as _, pretty, prettyln, strings};
 use bun_semver::query::Group;
 use bun_semver::{self as Semver, SlicedString};
@@ -223,11 +224,6 @@ struct Candidate {
     downgrade: bool,
 }
 
-/// Downgrades stay in the installed major (minor below 1.0.0): an older line is a different API, and the bulk response only carries advisories matching the installed versions, so its releases merely look safe (#39309).
-fn same_release_line(a: Semver::Version, b: Semver::Version) -> bool {
-    a.major == b.major && (a.major != 0 || a.minor == b.minor)
-}
-
 fn fmt_version(version: Semver::Version, buf: &[u8]) -> Box<[u8]> {
     let mut out: Vec<u8> = Vec::new();
     let _ = write!(out, "{}", version.fmt(buf));
@@ -258,11 +254,8 @@ fn print_elapsed_line() {
 
 fn print_tokens(tokens: &[Box<[u8]>]) {
     for (i, token) in tokens.iter().enumerate() {
-        pretty!(
-            "{}{}",
-            if i > 0 { ", " } else { "" },
-            bun_core::fmt::escape_control_chars(token)
-        );
+        let token = escape_control_chars(token);
+        pretty!("{}{}", if i > 0 { ", " } else { "" }, token);
     }
 }
 
@@ -317,14 +310,14 @@ pub fn print_unaudited(groups: &[UnauditedRegistry]) {
             bun_core::warn!(
                 "{} did not answer the audit request; skipped {}",
                 bun_core::fmt::redacted_npm_url(&group.registry),
-                bun_core::fmt::escape_control_chars(&packages)
+                escape_control_chars(&packages)
             );
         } else {
             bun_core::warn!(
                 "{} did not answer the audit request ({}); skipped {}",
                 bun_core::fmt::redacted_npm_url(&group.registry),
                 BStr::new(&group.reason),
-                bun_core::fmt::escape_control_chars(&packages)
+                escape_control_chars(&packages)
             );
         }
     }
@@ -740,7 +733,10 @@ pub fn plan_fixes(manager: &mut PackageManager, advisories: &[Advisory]) -> crat
             if v.order(inst.current, manifest_buf, buf) != Ordering::Less {
                 continue;
             }
-            if !same_release_line(v, inst.current) {
+            // Downgrades stay in the installed major (minor below 1.0.0): an older line is a different API,
+            // and the bulk response only has advisories for the installed versions' lines (#39309).
+            let cur = inst.current;
+            if v.major != cur.major || (v.major == 0 && v.minor != cur.minor) {
                 break;
             }
             if is_safe(v) {
@@ -1084,7 +1080,7 @@ impl FixPlan {
             }
             pretty!("    <cyan>bun audit fix");
             for token in &all_tokens {
-                pretty!(" --ignore {}", bun_core::fmt::escape_control_chars(token));
+                pretty!(" --ignore {}", escape_control_chars(token));
             }
             prettyln!("<r>");
             prettyln!("");
@@ -1092,11 +1088,8 @@ impl FixPlan {
         if !self.unmatched.is_empty() {
             prettyln!("not matched to an installed version:");
             for item in &self.unmatched {
-                prettyln!(
-                    "  {}@{}",
-                    bun_core::fmt::escape_control_chars(&item.name),
-                    bun_core::fmt::escape_control_chars(&item.range)
-                );
+                let name = escape_control_chars(&item.name);
+                prettyln!("  {}@{}", name, escape_control_chars(&item.range));
             }
             prettyln!("");
         }
diff --git a/src/install/audit_fix/package_json_edits.rs b/src/install/audit_fix/package_json_edits.rs
index 3f94d3fb0fc8..46cc49192349 100644
--- a/src/install/audit_fix/package_json_edits.rs
+++ b/src/install/audit_fix/package_json_edits.rs
@@ -281,11 +281,7 @@ fn rewrite_value(arena: &bun_alloc::Arena, value: &mut Option<Expr>, edit: &Pack
 }
 
 pub(super) fn root_package_json(manager: &mut PackageManager) -> Expr {
-    let target = WorkspaceTarget {
-        name: Box::default(),
-        name_hash: None,
-        package_json_path: root_package_json_path(),
-    };
+    let target = target_for(manager, 0).expect("root target");
     fetch_entry_root(manager, &target)
 }
 
diff --git a/src/runtime/cli/audit_command.rs b/src/runtime/cli/audit_command.rs
index 8e5781659387..547650b03a3d 100644
--- a/src/runtime/cli/audit_command.rs
+++ b/src/runtime/cli/audit_command.rs
@@ -1104,11 +1104,8 @@ fn print_severity(severity: &[u8]) {
 fn print_package_heading(name: &[u8], installed: &[Box<[u8]>]) {
     pretty!("<red>{}<r>", escape_control_chars(name));
     for (i, version) in installed.iter().enumerate() {
-        pretty!(
-            "{}{}",
-            if i == 0 { "@" } else { ", " },
-            escape_control_chars(version)
-        );
+        let separator = if i == 0 { "@" } else { ", " };
+        pretty!("{}{}", separator, escape_control_chars(version));
     }
     prettyln!("");
 }
@@ -1205,10 +1202,8 @@ fn print_enhanced_audit_report(
             print_severity(&vuln.severity);
             pretty!(" {}", escape_control_chars(&vuln.title));
             if !vuln.vulnerable_versions.is_empty() {
-                pretty!(
-                    " <d>({})<r>",
-                    escape_control_chars(&vuln.vulnerable_versions)
-                );
+                let versions = escape_control_chars(&vuln.vulnerable_versions);
+                pretty!(" <d>({})<r>", versions);
             }
             prettyln!(" - <d>{}<r>", escape_control_chars(&vuln.url));
         }
diff --git a/src/runtime/cli/pm_pkg_command.rs b/src/runtime/cli/pm_pkg_command.rs
index 2ad62ff0123b..f9948e3cb301 100644
--- a/src/runtime/cli/pm_pkg_command.rs
+++ b/src/runtime/cli/pm_pkg_command.rs
@@ -52,30 +52,21 @@ struct PackageJson {
 /// One step of a key path such as `contributors[0].name` or `keywords[]`.
 #[derive(Clone, Copy)]
 struct Segment<'a> {
-    kind: SegmentKind<'a>,
+    /// An index when applied to an array, else a property name. Empty only for `[]` (append).
+    name: &'a [u8],
+    /// `a[b]` rather than `a.b`: `files[0]=x` and `files[]=x` create an array, `config.0=x` an object.
+    bracketed: bool,
     /// Offset just past this segment in the key; errors name a value by `&key[..end]`.
     end: usize,
 }
 
-#[derive(Clone, Copy)]
-enum SegmentKind<'a> {
-    /// `b` in `a.b` or `a[b]`: an index when applied to an array, otherwise a property name.
-    Key { name: &'a [u8], bracketed: bool },
-    /// `[]`: the slot after the last element of an array.
-    Append,
-}
-
 impl Segment<'_> {
-    /// `files[0]=x` and `files[]=x` create an array; `config.0=x` creates an object keyed `"0"`.
+    fn is_append(self) -> bool {
+        self.name.is_empty()
+    }
+
     fn creates_array(self) -> bool {
-        match self.kind {
-            SegmentKind::Key {
-                name,
-                bracketed: true,
-            } => array_index(name).is_some(),
-            SegmentKind::Key { .. } => false,
-            SegmentKind::Append => true,
-        }
+        self.bracketed && (self.is_append() || array_index(self.name).is_some())
     }
 }
 
@@ -528,10 +519,10 @@ impl PmPkgCommand {
 
     fn resolve_path(root: Expr, key: &[u8]) -> Result<Expr, Error> {
         let mut current = root;
-        for segment in Self::parse_key_path(key)? {
-            let SegmentKind::Key { name, .. } = segment.kind else {
+        for Segment { name, .. } in Self::parse_key_path(key)? {
+            if name.is_empty() {
                 return Err(crate::Error::InvalidPath);
-            };
+            }
             current = match &current.data {
                 ExprData::EArray(array) => array_index(name)
                     .and_then(|index| array.items.slice().get(index).copied())
@@ -555,10 +546,8 @@ impl PmPkgCommand {
             let name_len = strings::index_of(part, b"[").unwrap_or(part.len());
             if name_len > 0 {
                 segments.push(Segment {
-                    kind: SegmentKind::Key {
-                        name: &part[..name_len],
-                        bracketed: false,
-                    },
+                    name: &part[..name_len],
+                    bracketed: false,
                     end: start + name_len,
                 });
             }
@@ -570,16 +559,9 @@ impl PmPkgCommand {
                     return Err(crate::Error::InvalidPath);
                 };
                 let close = open + close;
-                let name = &part[open + 1..close];
                 segments.push(Segment {
-                    kind: if name.is_empty() {
-                        SegmentKind::Append
-                    } else {
-                        SegmentKind::Key {
-                            name,
-                            bracketed: true,
-                        }
-                    },
+                    name: &part[open + 1..close],
+                    bracketed: true,
                     end: start + close + 1,
                 });
                 cursor = close + 1;
@@ -618,29 +600,27 @@ impl PmPkgCommand {
 
         if let Some(array) = container.data.e_array_mut() {
             let len = array.items.len();
-            let index = match segment.kind {
-                SegmentKind::Append => len,
-                SegmentKind::Key { name, .. } => match array_index(name) {
-                    Some(index) if index <= len => index,
-                    Some(index) => {
-                        Output::err_generic(
-                            "{s}: index {s} is out of range for {s} (length {s})",
-                            (quote(key), index, quote(container_name), len),
-                        );
-                        bun_core::note!(
-                            "{}[] appends to the end of the array",
-                            bstr::BStr::new(container_name)
-                        );
-                        Global::exit(1);
-                    }
-                    None => {
-                        Output::err_generic(
-                            "{s}: {s} is an array, so {s} must be an index or []",
-                            (quote(key), quote(container_name), quote(name)),
-                        );
-                        Global::exit(1);
-                    }
-                },
+            let index = match array_index(segment.name) {
+                _ if segment.is_append() => len,
+                Some(index) if index <= len => index,
+                Some(index) => {
+                    Output::err_generic(
+                        "{s}: index {s} is out of range for {s} (length {s})",
+                        (quote(key), index, quote(container_name), len),
+                    );
+                    bun_core::note!(
+                        "{}[] appends to the end of the array",
+                        bstr::BStr::new(container_name)
+                    );
+                    Global::exit(1);
+                }
+                None => {
+                    Output::err_generic(
+                        "{s}: {s} is an array, so {s} must be an index or []",
+                        (quote(key), quote(container_name), quote(segment.name)),
+                    );
+                    Global::exit(1);
+                }
             };
             if index == len {
                 array.push(dummy_bump(), Expr::init(E::Null {}, Loc::EMPTY))?;
@@ -654,13 +634,14 @@ impl PmPkgCommand {
             return Self::set_in_container(&mut child, slot_name, key, rest, value);
         }
 
-        let SegmentKind::Key { name, .. } = segment.kind else {
+        if segment.is_append() {
             Output::err_generic(
                 "{s}: cannot append to {s} because it is not an array",
                 (quote(key), quote(container_name)),
             );
             Global::exit(1);
-        };
+        }
+        let name = segment.name;
         let object = container
             .data
             .e_object_mut()
@@ -742,13 +723,14 @@ impl PmPkgCommand {
         let [segment, rest @ ..] = path else {
             return Ok(false);
         };
-        let SegmentKind::Key { name, .. } = segment.kind else {
+        let name = segment.name;
+        if segment.is_append() {
             Output::err_generic(
                 "Empty brackets are not valid syntax for deleting values.",
                 (),
             );
             Global::exit(1);
-        };
+        }
 
         let mut child = if let Some(array) = container.data.e_array_mut() {
             let Some(index) = array_index(name).filter(|&index| index < array.items.len()) else {
diff --git a/src/runtime/cli/pm_trusted_command.rs b/src/runtime/cli/pm_trusted_command.rs
index 6fbf10ec7ae2..4e9afc242ca5 100644
--- a/src/runtime/cli/pm_trusted_command.rs
+++ b/src/runtime/cli/pm_trusted_command.rs
@@ -440,8 +440,7 @@ impl TrustCommand {
             Global::crash();
         }
 
-        // Opened before any script runs: package.json is rewritten at the end, and a script
-        // whose trust cannot be recorded must not run.
+        // Opened before any script runs: a script whose trust cannot be recorded must not run.
         // SAFETY: `ROOT_PACKAGE_JSON_PATH` is set during `PackageManager::init`
         // (single-threaded startup) and immutable thereafter.
         let root_package_json_path = unsafe { ROOT_PACKAGE_JSON_PATH.read() };
@@ -559,10 +558,8 @@ impl TrustCommand {
             }
         }
 
-        // The `trustedDependencies` edit below re-reads package.json from disk, so the edits a pnpm
-        // migration made to it have to be written first (the migrated lockfile is saved below).
-        // SAFETY: `pm_raw` singleton; `load_lockfile` only borrows the boxed lockfile, which this
-        // does not touch.
+        // A pnpm migration's package.json edits must hit disk before the re-read below.
+        // SAFETY: `pm_raw` singleton; `load_lockfile` only borrows the boxed lockfile.
         unsafe { package_json_write_back::write_migrated_root(&mut *pm_raw) };
 
         let package_json_contents = root_file.read_to_end().map_err(crate::Error::from)?;
diff --git a/src/runtime/cli/pm_view_command.rs b/src/runtime/cli/pm_view_command.rs
index bf15dd588018..fdd74d51645b 100644
--- a/src/runtime/cli/pm_view_command.rs
+++ b/src/runtime/cli/pm_view_command.rs
@@ -3,6 +3,7 @@ use bun_alloc::Arena as Bump;
 use bun_collections::VecExt;
 use bun_core::MutableString;
 use bun_core::fmt as bun_fmt;
+use bun_core::fmt::escape_control_chars;
 use bun_core::strings;
 use bun_core::{Global, Output, prettyln};
 use bun_http as http;
@@ -417,23 +418,22 @@ pub(crate) fn view(
             .len_u32() as usize;
     }
 
-    // Every string printed below is registry-controlled: always go through
-    // `escape_control_chars`.
+    // Every string printed below is registry-controlled: always `escape_control_chars` it.
     prettyln!(
         "<b><blue><u>{}<r><d>@<r><blue><b><u>{}<r> <d>|<r> <cyan>{}<r> <d>|<r> deps<d>:<r> {} <d>|<r> versions<d>:<r> {}",
-        bun_fmt::escape_control_chars(pkg_name),
-        bun_fmt::escape_control_chars(pkg_version),
-        bun_fmt::escape_control_chars(license),
+        escape_control_chars(pkg_name),
+        escape_control_chars(pkg_version),
+        escape_control_chars(license),
         dep_count,
         versions_len,
     );
 
     // Get description and homepage from the top-level package manifest, not the version-specific one
     if let Some(desc) = json.get_string_cloned(&bump, b"description").ok().flatten() {
-        prettyln!("{}", bun_fmt::escape_control_chars(desc));
+        prettyln!("{}", escape_control_chars(desc));
     }
     if let Some(hp) = json.get_string_cloned(&bump, b"homepage").ok().flatten() {
-        prettyln!("<blue>{}<r>", bun_fmt::escape_control_chars(hp));
+        prettyln!("<blue>{}<r>", escape_control_chars(hp));
     }
 
     if let Some(mut iter) = json.get_array(b"keywords") {
@@ -450,10 +450,8 @@ pub(crate) fn view(
             }
         }
         if !keywords.list.is_empty() {
-            prettyln!(
-                "<d>keywords:<r> {}",
-                bun_fmt::escape_control_chars(keywords.list.as_slice())
-            );
+            let keywords = escape_control_chars(keywords.list.as_slice());
+            prettyln!("<d>keywords:<r> {}", keywords);
         }
     }
 
@@ -487,8 +485,8 @@ pub(crate) fn view(
             };
             prettyln!(
                 "- <cyan>{}<r><d>:<r> {}",
-                bun_fmt::escape_control_chars(dep_name),
-                bun_fmt::escape_control_chars(dep_version),
+                escape_control_chars(dep_name),
+                escape_control_chars(dep_version),
             );
         }
     }
@@ -496,22 +494,15 @@ pub(crate) fn view(
     if let Some(dist) = manifest.get_object(b"dist") {
         prettyln!("\n<d><r><b>dist<r>");
         if let Some(t) = dist.get_string_cloned(&bump, b"tarball").ok().flatten() {
-            prettyln!(
-                " <d>.<r>tarball<d>:<r> {}",
-                bun_fmt::escape_control_chars(t)
-            );
+            prettyln!(" <d>.<r>tarball<d>:<r> {}", escape_control_chars(t));
         }
         if let Some(s) = dist.get_string_cloned(&bump, b"shasum").ok().flatten() {
-            prettyln!(
-                " <d>.<r>shasum<r><d>:<r> <green>{}<r>",
-                bun_fmt::escape_control_chars(s)
-            );
+            let s = escape_control_chars(s);
+            prettyln!(" <d>.<r>shasum<r><d>:<r> <green>{}<r>", s);
         }
         if let Some(i) = dist.get_string_cloned(&bump, b"integrity").ok().flatten() {
-            prettyln!(
-                " <d>.<r>integrity<r><d>:<r> <green>{}<r>",
-                bun_fmt::escape_control_chars(i)
-            );
+            let i = escape_control_chars(i);
+            prettyln!(" <d>.<r>integrity<r><d>:<r> <green>{}<r>", i);
         }
         if let Some(u) = dist.get_number(b"unpackedSize") {
             prettyln!(
@@ -537,8 +528,8 @@ pub(crate) fn view(
             let val_expr = prop.value.as_ref().expect("infallible: prop has value");
             if let Some(tag) = tagname_expr.as_string(&bump) {
                 if let Some(val) = val_expr.as_string(&bump) {
-                    let tag_fmt = bun_fmt::escape_control_chars(tag);
-                    let val_fmt = bun_fmt::escape_control_chars(val);
+                    let tag_fmt = escape_control_chars(tag);
+                    let val_fmt = escape_control_chars(val);
                     if tag == b"latest" {
                         prettyln!("<cyan>{}<r><d>:<r> {}", tag_fmt, val_fmt);
                     } else if tag == b"beta" {
@@ -564,39 +555,22 @@ pub(crate) fn view(
                 .ok()
                 .flatten()
                 .unwrap_or(b"");
-            if !em.is_empty() {
-                prettyln!(
-                    "<d>-<r> {} <d>\\<{}\\><r>",
-                    bun_fmt::escape_control_chars(nm),
-                    bun_fmt::escape_control_chars(em)
-                );
-            } else if !nm.is_empty() {
-                prettyln!("<d>-<r> {}", bun_fmt::escape_control_chars(nm));
+            let (nm, em) = (escape_control_chars(nm), escape_control_chars(em));
+            if !em.0.is_empty() {
+                prettyln!("<d>-<r> {} <d>\\<{}\\><r>", nm, em);
+            } else if !nm.0.is_empty() {
+                prettyln!("<d>-<r> {}", nm);
             }
         }
     }
 
     // Add published date information
     if let Some(time_obj) = json.get_object(b"time") {
+        let time = |key: &[u8]| time_obj.get_string_cloned(&bump, key).ok().flatten();
         // TODO: use a relative time formatter
-        if let Some(published_time) = time_obj
-            .get_string_cloned(&bump, pkg_version)
-            .ok()
-            .flatten()
-        {
-            prettyln!(
-                "\n<b>Published<r><d>:<r> {}",
-                bun_fmt::escape_control_chars(published_time)
-            );
-        } else if let Some(modified_time) = time_obj
-            .get_string_cloned(&bump, b"modified")
-            .ok()
-            .flatten()
-        {
-            prettyln!(
-                "\n<b>Published<r><d>:<r> {}",
-                bun_fmt::escape_control_chars(modified_time)
-            );
+        if let Some(published_time) = time(pkg_version).or_else(|| time(b"modified")) {
+            let published_time = escape_control_chars(published_time);
+            prettyln!("\n<b>Published<r><d>:<r> {}", published_time);
         }
     }
 

From 161be976195a075cb0921496fac4e5c0d83f245d Mon Sep 17 00:00:00 2001
From: Jarred Sumner <jarred@jarredsumner.com>
Date: Mon, 17 Aug 2026 05:57:52 +0000
Subject: [PATCH 219/258] simplify(s5-net-pm): tighter override-rule matching
 in audit fix edits, comment trims

- package_json_edits: OverrideSelector::matches takes (parent, target); from_rule via let-else;
  one lookup for overrides/resolutions
- Options: strip_suffix instead of a slash formatter in the 401 note
- shorter SAFETY/format comments in NetworkTask, audit, pm view

(cherry picked from commit 29b8d4ab7b162c7255698f69ed94e0e79aeb57ab)
---
 src/install/NetworkTask.rs                    |  5 +-
 .../PackageManager/PackageManagerOptions.rs   | 13 ++-
 src/install/audit_fix/package_json_edits.rs   | 97 ++++++++-----------
 src/runtime/cli/audit_command.rs              |  3 +-
 src/runtime/cli/pm_view_command.rs            |  3 +-
 5 files changed, 49 insertions(+), 72 deletions(-)

diff --git a/src/install/NetworkTask.rs b/src/install/NetworkTask.rs
index 0610b33e7bf1..5e90e7d57d0e 100644
--- a/src/install/NetworkTask.rs
+++ b/src/install/NetworkTask.rs
@@ -199,9 +199,8 @@ impl NetworkTask {
         if self.http_proxy_buf.is_empty() {
             return None;
         }
-        // SAFETY: lifetime extension, same as `url_buf` in `for_manifest` /
-        // `for_tarball` — `run_tasks` drops `unsafe_http_client` before the slot
-        // (and this buffer) goes back to the pool.
+        // SAFETY: same lifetime extension as `url_buf` in `for_manifest`: `run_tasks` drops
+        // `unsafe_http_client` before the slot (and this buffer) goes back to the pool.
         Some(URL::parse(unsafe {
             bun_ptr::detach_lifetime(&self.http_proxy_buf)
         }))
diff --git a/src/install/PackageManager/PackageManagerOptions.rs b/src/install/PackageManager/PackageManagerOptions.rs
index 5e98ef2e59d5..50c16fe8c47e 100644
--- a/src/install/PackageManager/PackageManagerOptions.rs
+++ b/src/install/PackageManager/PackageManagerOptions.rs
@@ -314,16 +314,15 @@ impl Options {
         match request {
             RequestKind::Manifest if !scope.has_credentials() => {
                 let registry = scope.url.url();
-                let slash = if registry.pathname.ends_with(b"/") {
-                    ""
-                } else {
-                    "/"
-                };
+                let path = registry
+                    .pathname
+                    .strip_suffix(b"/")
+                    .unwrap_or(registry.pathname);
                 let _ = write!(
                     note,
-                    "\n  no credentials are configured for this registry; add //{}{}{slash}:_authToken=<token> to .npmrc",
+                    "\n  no credentials are configured for this registry; add //{}{}/:_authToken=<token> to .npmrc",
                     bstr::BStr::new(registry.host),
-                    bstr::BStr::new(registry.pathname),
+                    bstr::BStr::new(path),
                 );
             }
             RequestKind::Tarball(Authorization::AllowAuthorization) => {
diff --git a/src/install/audit_fix/package_json_edits.rs b/src/install/audit_fix/package_json_edits.rs
index 46cc49192349..84ce16dcfee9 100644
--- a/src/install/audit_fix/package_json_edits.rs
+++ b/src/install/audit_fix/package_json_edits.rs
@@ -1,4 +1,4 @@
-use bun_ast::{E, Expr, ExprData};
+use bun_ast::{E, Expr};
 use bun_collections::VecExt as _;
 use bun_collections::index_sort;
 use bun_core::strings;
@@ -10,7 +10,9 @@ use crate::bun_fs::FileSystem;
 use crate::lockfile::CatalogMap;
 use crate::lockfile::override_map::OverrideRule;
 use crate::lockfile::package::PackageColumns as _;
-use crate::lockfile_real::override_selector::{Selector, parse_package_segment, parse_selector};
+use crate::lockfile_real::override_selector::{
+    PackageSelector, Selector, parse_package_segment, parse_selector,
+};
 use crate::package_manager_real::add_remove_with_filter::{
     WorkspaceTarget, fetch_entry_root, root_package_json_path, store_entry,
 };
@@ -57,20 +59,17 @@ pub struct OverrideSelector {
 
 impl OverrideSelector {
     pub(super) fn from_rule(rule: OverrideRule<'_>, buf: &[u8]) -> OverrideSelector {
-        match rule {
-            OverrideRule::Flat(_) => OverrideSelector {
+        let OverrideRule::Scoped(rule) = rule else {
+            return OverrideSelector {
                 parent: None,
                 target_range: Box::default(),
-            },
-            OverrideRule::Scoped(rule) => OverrideSelector {
-                parent: rule.parent.as_ref().map(|parent| {
-                    (
-                        Box::from(parent.name.slice(buf)),
-                        Box::from(parent.version.literal.slice(buf)),
-                    )
-                }),
-                target_range: Box::from(rule.target_range.literal.slice(buf)),
-            },
+            };
+        };
+        let text = |s: &bun_semver::String| Box::from(s.slice(buf));
+        let parent = rule.parent.as_ref();
+        OverrideSelector {
+            parent: parent.map(|p| (text(&p.name), text(&p.version.literal))),
+            target_range: text(&rule.target_range.literal),
         }
     }
 
@@ -90,16 +89,18 @@ impl OverrideSelector {
         out.into_boxed_slice()
     }
 
-    fn matches(&self, name: &[u8], selector: &Selector<'_>) -> bool {
-        selector.target.name == name
-            && selector.target.range == &*self.target_range
-            && match (&self.parent, &selector.parent) {
-                (None, None) => true,
-                (Some((parent, parent_range)), Some(declared)) => {
-                    declared.name == &**parent && declared.range == &**parent_range
-                }
-                _ => false,
-            }
+    fn matches(
+        &self,
+        name: &[u8],
+        parent: Option<PackageSelector>,
+        target: PackageSelector,
+    ) -> bool {
+        let own_parent = self
+            .parent
+            .as_ref()
+            .map(|(name, range)| (&**name, &**range));
+        (target.name, target.range) == (name, &*self.target_range)
+            && parent.map(|p| (p.name, p.range)) == own_parent
     }
 }
 
@@ -309,12 +310,10 @@ fn for_each_override_value(
     selector: &OverrideSelector,
     mut f: impl FnMut(&mut Option<Expr>),
 ) {
-    let (mut rules, nested) = match root.get(b"overrides") {
-        Some(overrides) => (overrides, true),
-        None => match root.get(b"resolutions") {
-            Some(resolutions) => (resolutions, false),
-            None => return,
-        },
+    let overrides = root.get(b"overrides");
+    let nested = overrides.is_some();
+    let Some(mut rules) = overrides.or_else(|| root.get(b"resolutions")) else {
+        return;
     };
     let Some(object) = rules.data.e_object_mut() else {
         return;
@@ -323,13 +322,8 @@ fn for_each_override_value(
         let Some(key) = prop.key.as_ref().and_then(Expr::as_utf8_string_literal) else {
             continue;
         };
-        let is_group = nested
-            && prop
-                .value
-                .as_ref()
-                .is_some_and(|value| matches!(value.data, ExprData::EObject(_)));
-        if !is_group {
-            if parse_selector(key).is_ok_and(|rule| selector.matches(name, &rule)) {
+        if !(nested && prop.value.as_ref().is_some_and(|value| value.is_object())) {
+            if parse_selector(key).is_ok_and(|r| selector.matches(name, r.parent, r.target)) {
                 f(&mut prop.value);
             }
             continue;
@@ -337,35 +331,22 @@ fn for_each_override_value(
         let Ok(parent) = parse_package_segment(key) else {
             continue;
         };
-        let Some(group) = prop
-            .value
-            .as_mut()
-            .and_then(|value| value.data.e_object_mut())
-        else {
+        let Some(group) = prop.value.as_mut().and_then(|v| v.data.e_object_mut()) else {
             continue;
         };
         for child in group.properties.slice_mut() {
             let Some(child_key) = child.key.as_ref().and_then(Expr::as_utf8_string_literal) else {
                 continue;
             };
-            let rule = if child_key == b"." {
-                Selector {
+            let (rule_parent, target) = match parse_selector(child_key) {
+                _ if child_key == b"." => (None, parent),
+                Ok(Selector {
                     parent: None,
-                    target: parent,
-                }
-            } else {
-                match parse_selector(child_key) {
-                    Ok(Selector {
-                        parent: None,
-                        target,
-                    }) => Selector {
-                        parent: Some(parent),
-                        target,
-                    },
-                    _ => continue,
-                }
+                    target,
+                }) => (Some(parent), target),
+                _ => continue,
             };
-            if selector.matches(name, &rule) {
+            if selector.matches(name, rule_parent, target) {
                 f(&mut child.value);
             }
         }
diff --git a/src/runtime/cli/audit_command.rs b/src/runtime/cli/audit_command.rs
index 547650b03a3d..3699b70ba02a 100644
--- a/src/runtime/cli/audit_command.rs
+++ b/src/runtime/cli/audit_command.rs
@@ -1057,8 +1057,7 @@ fn collect_vulnerabilities(
         Err(_) => return Ok(Err(SkipReason::NotJson)),
     };
 
-    // The bulk endpoint answers `{ [package name]: Advisory[] }`; a document of any other shape (a
-    // mirror's `{"error": ...}`, ...) must not pass for a clean audit.
+    // The bulk endpoint answers `{ [package name]: Advisory[] }`; anything else is not a clean audit.
     let ExprData::EObjectJSON(obj) = &parsed.root.data else {
         return Ok(Err(SkipReason::NotAdvisories));
     };
diff --git a/src/runtime/cli/pm_view_command.rs b/src/runtime/cli/pm_view_command.rs
index fdd74d51645b..0928b49ed910 100644
--- a/src/runtime/cli/pm_view_command.rs
+++ b/src/runtime/cli/pm_view_command.rs
@@ -208,8 +208,7 @@ pub(crate) fn view(
                         // Parse as semver query and find best version
                         let sliced_literal = Semver::SlicedString::init(version, version);
                         let query = Semver::query::parse(version, sliced_literal)?;
-                        // The query's prerelease/build tags are offsets into `version`, the
-                        // buffer it was parsed from, so that is the buffer to match it with.
+                        // The query's pre/build tags are offsets into `version`, so match with it.
                         if let Some(result) = parsed_manifest.find_best_version(&query, version) {
                             break 'brk2 result.version;
                         }

From eb44523e2709a787ef1f83560da7046addd51b83 Mon Sep 17 00:00:00 2001
From: Jarred Sumner <jarred@jarredsumner.com>
Date: Mon, 17 Aug 2026 06:10:39 +0000
Subject: [PATCH 220/258] simplify(s5-net-pm): one entry list for
 minimumReleaseAgeExcludes, shorter package.json open in pm trust

No-Verification-Needed: refactor-only worktree without a build; cargo check/clippy clean
(cherry picked from commit 3caac7bb5db5598ce58dbc15c50eb5c02f4a1531)
---
 src/install/npm.rs                    | 60 ++++++++++-----------------
 src/runtime/cli/pm_trusted_command.rs |  8 +---
 2 files changed, 24 insertions(+), 44 deletions(-)

diff --git a/src/install/npm.rs b/src/install/npm.rs
index fbde741be7d8..b173e30ed260 100644
--- a/src/install/npm.rs
+++ b/src/install/npm.rs
@@ -1584,36 +1584,26 @@ pub struct FindResult<'a> {
     pub(crate) package: &'a PackageVersion,
 }
 
-/// `minimumReleaseAgeExcludes` entries (pnpm grammar): `name` exempts a package, `name@1.2.3 || 1.2.4` only those versions.
-pub struct MinimumReleaseAgeExcludes {
-    packages: Box<[&'static [u8]]>,
-    /// Matched with `Version::eql`, which compares tags by hash, so no string buffer is kept.
-    versions: Box<[(&'static [u8], Semver::Version)]>,
-}
+/// `minimumReleaseAgeExcludes` entries (pnpm grammar): `name` exempts a package, `name@1.2.3 || 1.2.4` only those
+/// versions (matched with `Version::eql`, which compares tags by hash, so no string buffer is kept).
+pub struct MinimumReleaseAgeExcludes(Vec<(&'static [u8], Option<Semver::Version>)>);
 
 impl MinimumReleaseAgeExcludes {
     /// A malformed entry (`foo@`, `foo@^1`) is dropped with a warning, never widened to the bare name.
-    pub(crate) fn parse(
-        entries: &[&'static [u8]],
-        log: &mut bun_ast::Log,
-    ) -> MinimumReleaseAgeExcludes {
-        let mut packages: Vec<&'static [u8]> = Vec::new();
-        let mut versions: Vec<(&'static [u8], Semver::Version)> = Vec::new();
-
+    pub(crate) fn parse(entries: &[&'static [u8]], log: &mut bun_ast::Log) -> Self {
+        let mut list = Vec::new();
         for &entry in entries {
             // Skip a scope's leading `@` so `@types/node@20.0.0` splits after the name.
             let name_start = usize::from(strings::starts_with_char(entry, b'@'));
             let Some(at) = strings::index_of_char_usize(&entry[name_start..], b'@') else {
-                packages.push(entry);
+                list.push((entry, None));
                 continue;
             };
-            let name = &entry[..name_start + at];
-            let specs = &entry[name_start + at + 1..];
-
-            let first_of_entry = versions.len();
+            let (name, specs) = (&entry[..name_start + at], &entry[name_start + at + 1..]);
+            let first_of_entry = list.len();
             for spec in strings::split(specs, b"||") {
                 let Some(version) = parse_exact_version(spec) else {
-                    versions.truncate(first_of_entry);
+                    list.truncate(first_of_entry);
                     log.add_warning_fmt(
                         None,
                         bun_ast::Loc::EMPTY,
@@ -1625,38 +1615,32 @@ impl MinimumReleaseAgeExcludes {
                     );
                     break;
                 };
-                versions.push((name, version));
+                list.push((name, Some(version)));
             }
         }
-
-        MinimumReleaseAgeExcludes {
-            packages: packages.into_boxed_slice(),
-            versions: versions.into_boxed_slice(),
-        }
+        MinimumReleaseAgeExcludes(list)
     }
 
-    /// `self` (if any) plus bare-name exemptions for `names`; `bun audit fix` exempts the packages it must move past the age gate.
+    /// `base` plus bare-name exemptions; `bun audit fix` exempts the packages it must move past the age gate.
     pub(crate) fn with_packages(
-        base: Option<&MinimumReleaseAgeExcludes>,
+        base: Option<&Self>,
         names: impl IntoIterator<Item = &'static [u8]>,
-    ) -> MinimumReleaseAgeExcludes {
-        let mut packages: Vec<&'static [u8]> =
-            base.map_or_else(Vec::new, |base| base.packages.to_vec());
-        packages.extend(names);
-        MinimumReleaseAgeExcludes {
-            packages: packages.into_boxed_slice(),
-            versions: base.map_or_else(Box::default, |base| base.versions.clone()),
-        }
+    ) -> Self {
+        let mut list = base.map_or_else(Vec::new, |base| base.0.clone());
+        list.extend(names.into_iter().map(|name| (name, None)));
+        MinimumReleaseAgeExcludes(list)
     }
 
     fn excludes_package(&self, name: &[u8]) -> bool {
-        self.packages.contains(&name)
+        self.0
+            .iter()
+            .any(|&(package, v)| package == name && v.is_none())
     }
 
     fn excludes_version(&self, name: &[u8], version: Semver::Version) -> bool {
-        self.versions
+        self.0
             .iter()
-            .any(|&(package, excluded)| package == name && excluded.eql(version))
+            .any(|&(p, v)| p == name && v.is_some_and(|v| v.eql(version)))
     }
 }
 
diff --git a/src/runtime/cli/pm_trusted_command.rs b/src/runtime/cli/pm_trusted_command.rs
index 4e9afc242ca5..ce549acad7ed 100644
--- a/src/runtime/cli/pm_trusted_command.rs
+++ b/src/runtime/cli/pm_trusted_command.rs
@@ -444,12 +444,8 @@ impl TrustCommand {
         // SAFETY: `ROOT_PACKAGE_JSON_PATH` is set during `PackageManager::init`
         // (single-threaded startup) and immutable thereafter.
         let root_package_json_path = unsafe { ROOT_PACKAGE_JSON_PATH.read() };
-        let root_file = match bun_sys::File::openat(
-            bun_sys::Fd::cwd(),
-            root_package_json_path.as_bytes(),
-            bun_sys::O::RDWR | bun_sys::O::CLOEXEC,
-            0,
-        ) {
+        let (cwd, flags) = (bun_sys::Fd::cwd(), bun_sys::O::RDWR | bun_sys::O::CLOEXEC);
+        let root_file = match bun_sys::File::openat(cwd, root_package_json_path, flags, 0) {
             Ok(file) => file,
             Err(err) => {
                 Output::err(

From 5b747d0689b2a2537e09c176c80e27364603ebdc Mon Sep 17 00:00:00 2001
From: Jarred Sumner <jarred@jarredsumner.com>
Date: Mon, 17 Aug 2026 06:12:55 +0000
Subject: [PATCH 221/258] simplify(s5-net-pm): one error arm for invalid
 publishConfig registry values

No-Verification-Needed: refactor-only worktree without a build; cargo check/clippy clean
(cherry picked from commit 6fbd4743cc2f220dfaa8c264878a2954dbbc4fcd)
---
 .../PackageManager/PackageManagerOptions.rs       | 15 +++++----------
 1 file changed, 5 insertions(+), 10 deletions(-)

diff --git a/src/install/PackageManager/PackageManagerOptions.rs b/src/install/PackageManager/PackageManagerOptions.rs
index 50c16fe8c47e..a6690ef9611f 100644
--- a/src/install/PackageManager/PackageManagerOptions.rs
+++ b/src/install/PackageManager/PackageManagerOptions.rs
@@ -475,17 +475,12 @@ fn publish_config_registry<'b>(
     };
     match value.as_string_cloned(bump)? {
         Some(url) if url.starts_with(b"https://") || url.starts_with(b"http://") => Ok(Some(url)),
-        Some(url) => {
+        not_a_url => {
+            let got =
+                not_a_url.map_or_else(String::new, |v| format!(": {}", bun_core::fmt::quote(v)));
             Output::err_generic(
-                "invalid `{}` value in `publishConfig`: {}, expected a URL starting with 'https://' or 'http://'",
-                (bstr::BStr::new(key), bun_core::fmt::quote(url)),
-            );
-            Global::crash();
-        }
-        None => {
-            Output::err_generic(
-                "invalid `{}` value in `publishConfig`, expected a URL starting with 'https://' or 'http://'",
-                (bstr::BStr::new(key),),
+                "invalid `{}` value in `publishConfig`{}, expected a URL starting with 'https://' or 'http://'",
+                (bstr::BStr::new(key), got),
             );
             Global::crash();
         }

From 04ee65a7bc20a4d5fa909b595d4eb54227bdf687 Mon Sep 17 00:00:00 2001
From: Jarred Sumner <jarred@jarredsumner.com>
Date: Mon, 17 Aug 2026 05:39:44 +0000
Subject: [PATCH 222/258] simplify(s1-resolver): one
 Lockfile::package_satisfying for the name+range scans

Lockfile::packages_named/package_satisfying/patched_package_satisfying replace
npm_package_satisfying, patched_package_satisfying,
direct_dependency_package_satisfying (PackageManagerEnqueue.rs),
patched_capture/locked_in_lockfile (update_transitive.rs), the Id/Ids match in
get_package_id and prune's version_in_lockfile. resolve_peer_dep_version_based
takes the is_candidate filter directly instead of an _among twin.
LoadResult::migrated_from() folds Migrated::source_lockfile_name.

(cherry picked from commit 867fc7466c0d1525ef10830ba151d16a7d86a868)
---
 .../PackageManager/PackageManagerEnqueue.rs   | 110 ++------
 .../PackageManager/install_with_manager.rs    |   4 +-
 src/install/lockfile.rs                       | 244 ++++++++----------
 src/install/lockfile/Tree.rs                  |   1 +
 src/install/lockfile/bun.lock.rs              |  36 +--
 src/install/pnpm.rs                           |   1 +
 src/install/prune.rs                          |  11 +-
 src/install/update_transitive.rs              |  74 ++----
 8 files changed, 162 insertions(+), 319 deletions(-)

diff --git a/src/install/PackageManager/PackageManagerEnqueue.rs b/src/install/PackageManager/PackageManagerEnqueue.rs
index cb8a817508b0..4ab180e4c73e 100644
--- a/src/install/PackageManager/PackageManagerEnqueue.rs
+++ b/src/install/PackageManager/PackageManagerEnqueue.rs
@@ -2248,26 +2248,21 @@ fn get_or_put_resolved_package_with_find_result(
                     .is_root_dependency(unsafe { &mut *this_ptr }, dependency_id)
         };
 
-    // A patched package is held while the range still allows it (update_transitive holds the transitive rows the same way); audit fix does not set to_update and moves it.
+    // A patched package is held while the range still allows it (audit fix does not set to_update and moves it);
+    // a row owned by a regular package stays on the copy a direct row (enqueued first) resolves to when its
+    // range allows, as a fresh resolution would dedupe it there.
     if should_update && !behavior.is_peer() {
-        if let Some(id) = patched_package_satisfying(this, name_hash, version) {
+        let lockfile = &this.lockfile;
+        let held = if let Some(id) = lockfile.patched_package_satisfying(name_hash, version) {
             this.kept_patched.push(id);
-            success_fn(this, dependency_id, id);
-            return Ok(Some(ResolvedPackageResult {
-                package: *this.lockfile.packages.get(id as usize),
-                is_first_time: false,
-                task: None,
-            }));
-        }
-    }
-
-    // `bun update <name>` re-resolves every row of the name. A row owned by a
-    // regular package stays on the copy a root/workspace dependency resolves to
-    // whenever its range allows, as a fresh resolution would dedupe it there;
-    // the direct rows themselves (enqueued first) move within their own ranges.
-    if should_update && !behavior.is_peer() && !this.lockfile.is_workspace_dependency(dependency_id)
-    {
-        if let Some(id) = direct_dependency_package_satisfying(this, name_hash, version) {
+            Some(id)
+        } else if !lockfile.is_workspace_dependency(dependency_id) {
+            let direct = |id| lockfile.is_direct_dependency_resolution(id);
+            lockfile.package_satisfying(name_hash, version, direct)
+        } else {
+            None
+        };
+        if let Some(id) = held {
             success_fn(this, dependency_id, id);
             return Ok(Some(ResolvedPackageResult {
                 package: *this.lockfile.packages.get(id as usize),
@@ -3010,23 +3005,12 @@ fn locked_version_in_lockfile<'a>(
     name_hash: PackageNameHash,
     version: &dependency::Version,
 ) -> Option<(Semver::Version, &'a [u8])> {
-    if version.tag != dependency::version::Tag::Npm {
-        return None;
-    }
     let lockfile: &Lockfile::Lockfile = &this.lockfile;
-    let candidates = lockfile.package_index.get(&name_hash)?.as_slice();
-    let pkg_res = lockfile.packages.items_resolution();
-    let buf = lockfile.buffers.string_bytes.as_slice();
-    let range = &version.npm().version;
-    candidates
-        .iter()
-        .copied()
-        .filter(|&id| id < lockfile.loaded_package_count)
-        .map(|id| &pkg_res[id as usize])
-        .filter(|res| res.tag == ResolutionTag::Npm)
-        .map(|res| res.npm().version)
-        .find(|&locked| range.satisfies(locked, buf, buf))
-        .map(|locked| (locked, buf))
+    let in_lockfile = |id| id < lockfile.loaded_package_count;
+    let id = lockfile.package_satisfying(name_hash, version, in_lockfile)?;
+    let res = &lockfile.packages.items_resolution()[id as usize];
+    (res.tag == ResolutionTag::Npm)
+        .then(|| (res.npm().version, lockfile.buffers.string_bytes.as_slice()))
 }
 
 /// The package to bind a deferred peer row to and whether it satisfies the row; the highest-or-nothing fallback is what `resolve_peer_dep_version_based` rebinds to on load.
@@ -3037,13 +3021,7 @@ fn existing_peer_target(
     row: DependencyID,
 ) -> Option<(PackageID, bool)> {
     let lockfile: &Lockfile::Lockfile = &this.lockfile;
-    let candidates = lockfile.package_index.get(&name_hash)?.as_slice();
-    let pkg_res = lockfile.packages.items_resolution();
-    let buf = lockfile.buffers.string_bytes.as_slice();
-    if let Some(&id) = candidates.iter().find(|&&id| {
-        (id as usize) < pkg_res.len()
-            && pkg_res[id as usize].satisfies_dependency_version(version, buf, buf)
-    }) {
+    if let Some(id) = lockfile.package_satisfying(name_hash, version, |_| true) {
         return Some((id, true));
     }
     let highest = highest_peer_candidate(lockfile, name_hash, version)?;
@@ -3056,7 +3034,7 @@ fn highest_peer_candidate(
     name_hash: PackageNameHash,
     version: &dependency::Version,
 ) -> Option<PackageID> {
-    let &highest = lockfile.package_index.get(&name_hash)?.as_slice().first()?;
+    let &highest = lockfile.packages_named(name_hash).first()?;
     let resolution = lockfile.packages.items_resolution().get(highest as usize)?;
     let same_kind = matches!(
         (resolution.tag, version.tag),
@@ -3128,54 +3106,6 @@ fn would_revive_leftover(
     })
 }
 
-/// The first npm package of this name that `version` allows and `accept` takes.
-fn npm_package_satisfying(
-    lockfile: &Lockfile::Lockfile,
-    name_hash: PackageNameHash,
-    version: &dependency::Version,
-    accept: impl Fn(PackageID) -> bool,
-) -> Option<PackageID> {
-    let candidates = lockfile.package_index.get(&name_hash)?.as_slice();
-    let pkg_res = lockfile.packages.items_resolution();
-    let buf = lockfile.buffers.string_bytes.as_slice();
-    candidates.iter().copied().find(|&id| {
-        let res = &pkg_res[id as usize];
-        res.tag == ResolutionTag::Npm
-            && res.satisfies_dependency_version(version, buf, buf)
-            && accept(id)
-    })
-}
-
-fn patched_package_satisfying(
-    this: &PackageManager,
-    name_hash: PackageNameHash,
-    version: &dependency::Version,
-) -> Option<PackageID> {
-    let lockfile: &Lockfile::Lockfile = &this.lockfile;
-    if lockfile.patched_dependencies.count() == 0 {
-        return None;
-    }
-    npm_package_satisfying(lockfile, name_hash, version, |id| {
-        lockfile
-            .patched_dependencies
-            .contains(&Semver::string::Builder::string_hash(
-                &crate::dedupe::label(lockfile, id),
-            ))
-    })
-}
-
-/// The package of this name that a root or workspace dependency resolves to, if `version` allows it.
-fn direct_dependency_package_satisfying(
-    this: &PackageManager,
-    name_hash: PackageNameHash,
-    version: &dependency::Version,
-) -> Option<PackageID> {
-    let lockfile: &Lockfile::Lockfile = &this.lockfile;
-    npm_package_satisfying(lockfile, name_hash, version, |id| {
-        lockfile.is_direct_dependency_resolution(id)
-    })
-}
-
 // ──────────────────────────────────────────────────────────────────────────
 // `impl PackageManager` — inherent-method facade over the free fns above.
 //
diff --git a/src/install/PackageManager/install_with_manager.rs b/src/install/PackageManager/install_with_manager.rs
index 5e99ae2aee38..de33f1b76c86 100644
--- a/src/install/PackageManager/install_with_manager.rs
+++ b/src/install/PackageManager/install_with_manager.rs
@@ -789,7 +789,7 @@ pub fn install_with_manager(
     }
 
     if manager.options.enable.frozen_lockfile() && !manager.options.do_.save_lockfile() {
-        if let Some(source) = load_result.migrated().source_lockfile_name() {
+        if let Some(source) = load_result.migrated_from() {
             note_migrated_lockfile_not_saved(manager, source);
         }
     }
@@ -1428,7 +1428,7 @@ fn overrides_field_name(
 }
 
 pub(crate) fn loaded_lockfile_name(load_result: &lockfile::LoadResult) -> &'static str {
-    if let Some(source) = load_result.migrated().source_lockfile_name() {
+    if let Some(source) = load_result.migrated_from() {
         source
     } else if load_result.loaded_from_binary_lockfile() {
         "bun.lockb"
diff --git a/src/install/lockfile.rs b/src/install/lockfile.rs
index 5b6cadd2be4d..70b718e4f897 100644
--- a/src/install/lockfile.rs
+++ b/src/install/lockfile.rs
@@ -195,38 +195,23 @@ pub struct Lockfile {
     /// this run (`mark_loaded_packages`). Runtime-only, never serialised.
     pub(crate) loaded_package_count: PackageID,
 
-    /// `bit[id] == true` ⇔ a dependency other than an optional peer resolved
-    /// to package `id` in the lockfile as loaded. An optional peer slot never
-    /// keeps such a package alive through `clean_with_logger` (it is bound in
-    /// `Cloner::flush` if something else still reaches it), so a package whose
-    /// last real dependent leaves package.json is dropped. A loaded package
-    /// with the bit unset was held by optional peers alone; 1.3.x wrote such
-    /// entries and they are kept, otherwise every resolve would prune them and
-    /// rewrite the file on any unrelated change. Sized to
-    /// `loaded_package_count`, so packages appended during this resolve read
-    /// as held (a fresh resolve never creates peer-only entries). Set by
-    /// `mark_loaded_packages`; runtime-only — never serialised.
+    /// Loaded packages a non-optional-peer row resolved to (`mark_loaded_packages`); an optional peer
+    /// slot alone keeps a package through `clean_with_logger` only if it was already peer-only on load.
     pub(crate) held_at_load: DynamicBitSet,
 
-    /// Packages below this were loaded or appended before resolution last
-    /// drained (`mark_settled_packages`), so they exist on every install; see
-    /// `is_reusable`. Runtime-only, never serialised.
+    /// Packages below this existed when resolution last drained (`mark_settled_packages`); see `is_reusable`.
     pub(crate) settled_package_count: PackageID,
 
-    /// Indexed by `PackageID`, filled by `mark_appended_for` for the packages
-    /// appended from a manifest in this run. Runtime-only, never serialised.
+    /// Indexed by `PackageID`; see `mark_appended_for`. Runtime-only.
     appended_for_by_id: Vec<AppendedFor>,
 }
 
-/// The rows a package appended in this run was resolved for; see
-/// `Lockfile::get_package_id`.
+/// The rows a package appended in this run was resolved for; see `Lockfile::get_package_id`.
 #[derive(Clone, Copy, Debug, Default)]
 pub(crate) struct AppendedFor {
-    /// The row it was appended for is declared by the root or a workspace.
+    /// Appended for a row the root or a workspace declares.
     pub direct: bool,
-    /// A regular (non-peer) row's range, after overrides and catalogs, was
-    /// this exact version: the appending row's, or a later one's while the
-    /// package was not yet reusable (`mark_pinned_by_reuse`).
+    /// A regular row's exact-version range resolved to it while it was not yet reusable.
     pub pinned: bool,
 }
 
@@ -341,7 +326,6 @@ pub enum LoadStep {
 }
 
 impl LoadStep {
-    /// The word for the step in a "failed to ... lockfile" message.
     pub fn verb(self) -> &'static str {
         match self {
             LoadStep::OpenFile => "open",
@@ -361,17 +345,6 @@ pub enum Migrated {
     Pnpm,
 }
 
-impl Migrated {
-    pub(crate) fn source_lockfile_name(self) -> Option<&'static str> {
-        match self {
-            Migrated::None => None,
-            Migrated::Npm => Some("package-lock.json"),
-            Migrated::Yarn => Some("yarn.lock"),
-            Migrated::Pnpm => Some("pnpm-lock.yaml"),
-        }
-    }
-}
-
 pub struct LoadResultErr {
     pub step: LoadStep,
     pub value: BunError,
@@ -423,10 +396,16 @@ impl<'a> LoadResult<'a> {
         }
     }
 
-    pub(crate) fn migrated(&self) -> Migrated {
+    /// The foreign lockfile this load migrated from, if any.
+    pub(crate) fn migrated_from(&self) -> Option<&'static str> {
         match self {
-            LoadResult::Ok(ok) => ok.migrated,
-            _ => Migrated::None,
+            LoadResult::Ok(LoadResultOk { migrated, .. }) => match migrated {
+                Migrated::None => None,
+                Migrated::Npm => Some("package-lock.json"),
+                Migrated::Yarn => Some("yarn.lock"),
+                Migrated::Pnpm => Some("pnpm-lock.yaml"),
+            },
+            _ => None,
         }
     }
 
@@ -763,10 +742,8 @@ impl Lockfile {
         })
     }
 
-    /// A lockfile stores a folder dependency as its literal, relative to the
-    /// declaring package; give the rows of root, workspace and `file:` packages
-    /// the top-level relative `value.folder` that `Package::parse` gives them.
-    /// Idempotent, since the literal is left as is.
+    /// Gives the folder rows of root, workspace and `file:` packages the top-level relative
+    /// `value.folder` that `Package::parse` gives them (the stored literal is package-relative).
     pub(crate) fn rebase_folder_dependencies(&mut self) -> Result<(), AllocError> {
         let Lockfile {
             packages,
@@ -798,28 +775,24 @@ impl Lockfile {
                 if dep.version.tag != dependency::Tag::Folder {
                     continue;
                 }
-                let relative = {
-                    let buf = string_bytes.as_slice();
-                    let literal = dep.version.literal.sliced(buf);
-                    let Some(declared) = dependency::parse_with_tag(
-                        dep.name,
-                        Some(dep.name_hash),
-                        literal.slice,
-                        dependency::Tag::Folder,
-                        &literal,
-                        None,
-                        None,
-                    ) else {
-                        continue;
-                    };
-                    let declared_folder = *declared.folder();
-                    package::folder_relative_to_top_level_dir(
-                        pkg_dir.slice(buf),
-                        declared_folder.slice(buf),
-                        &mut path_buf[..],
-                    )
+                let buf = string_bytes.as_slice();
+                let literal = dep.version.literal.sliced(buf);
+                let Some(declared) = dependency::parse_with_tag(
+                    dep.name,
+                    Some(dep.name_hash),
+                    literal.slice,
+                    dependency::Tag::Folder,
+                    &literal,
+                    None,
+                    None,
+                ) else {
+                    continue;
                 };
-                let Some(relative) = relative else {
+                let Some(relative) = package::folder_relative_to_top_level_dir(
+                    pkg_dir.slice(buf),
+                    declared.folder().slice(buf),
+                    &mut path_buf[..],
+                ) else {
                     continue;
                 };
                 dep.version.value.folder = SemverStringBuf {
@@ -915,8 +888,7 @@ impl Lockfile {
         self.get_workspace_pkg_if_workspace_dep(id) != invalid_package_id
     }
 
-    /// Does a dependency declared by the root package or a workspace currently
-    /// resolve to package `id`?
+    /// Does a row of the root or a workspace currently resolve to package `id`?
     pub(crate) fn is_direct_dependency_resolution(&self, id: PackageID) -> bool {
         let packages = self.packages.slice();
         let resolutions_buf = self.buffers.resolutions.as_slice();
@@ -932,14 +904,52 @@ impl Lockfile {
             })
     }
 
+    /// Highest version first (`get_or_put_id`); empty when nothing has the name.
+    pub(crate) fn packages_named(&self, name_hash: PackageNameHash) -> &[PackageID] {
+        self.package_index
+            .get(&name_hash)
+            .map_or(&[], PackageIndexEntry::as_slice)
+    }
+
+    /// The first package of the name whose resolution `version` accepts and `accept` takes.
+    pub(crate) fn package_satisfying(
+        &self,
+        name_hash: PackageNameHash,
+        version: &DependencyVersion,
+        accept: impl Fn(PackageID) -> bool,
+    ) -> Option<PackageID> {
+        let buf = self.buffers.string_bytes.as_slice();
+        let pkg_res = self.packages.items_resolution();
+        TextLockfile::resolve_peer_dep_by_range(
+            version,
+            name_hash,
+            &self.package_index,
+            pkg_res,
+            buf,
+            accept,
+        )
+    }
+
+    /// A patched npm package that `version` still allows; `bun update` holds rows there.
+    pub(crate) fn patched_package_satisfying(
+        &self,
+        name_hash: PackageNameHash,
+        version: &DependencyVersion,
+    ) -> Option<PackageID> {
+        if self.patched_dependencies.count() == 0 {
+            return None;
+        }
+        self.package_satisfying(name_hash, version, |id| {
+            let label = crate::dedupe::label(self, id);
+            self.patched_dependencies
+                .contains(&SemverStringBuilder::string_hash(&label))
+        })
+    }
+
     /// `None` for the edges `enqueue_dependency_to_root` appends outside of any package.
     pub(crate) fn get_parent_pkg_of_dependency(&self, id: DependencyID) -> Option<PackageID> {
-        for (pkg_id, dependencies) in self.packages.items_dependencies().iter().enumerate() {
-            if dependencies.contains(id) {
-                return Some(PackageID::try_from(pkg_id).expect("int cast"));
-            }
-        }
-        None
+        let lists = self.packages.items_dependencies();
+        Some(lists.iter().position(|list| list.contains(id))? as PackageID)
     }
 
     /// Does the root package.json declare the same dependency (name and specifier) itself?
@@ -971,11 +981,7 @@ impl Lockfile {
         invalid_package_id
     }
 
-    /// Is this a direct dependency of a local package (`resolution::Tag::is_local_package`)?
-    ///
-    /// A folder package declared by a registry package gets no dependency list (see the
-    /// Folder arm of `get_or_put_resolved_package`), so every folder package that
-    /// declares anything is reached from the root through local packages only.
+    /// A folder package a registry package declares gets no dependency list, so a local declarer was reached through local packages only.
     pub(crate) fn is_dependency_of_local_package(&self, id: DependencyID) -> bool {
         self.get_parent_pkg_of_dependency(id)
             .is_some_and(|parent_id| {
@@ -1008,8 +1014,6 @@ impl Lockfile {
     }
 
     /// Is there a root `overrides`/`resolutions` rule (plain or scoped) for this dependency?
-    /// Rules are written in the root package.json, so a `file:` path applied through one is
-    /// relative to the top-level dir whichever package declares the dependency.
     pub(crate) fn is_overridden_dependency(&self, id: DependencyID) -> bool {
         let dependency = &self.buffers.dependencies[id as usize];
         self.overrides.get(self, id, dependency.name_hash).is_some()
@@ -2192,19 +2196,13 @@ impl Lockfile {
         }
     }
 
-    /// Snapshot `packages.len()` as the "loaded from lockfile" watermark and
-    /// which of those packages a non-peer dependency resolves to
-    /// (`held_at_load`). Call exactly once after `load_from_cwd` (including
-    /// npm/pnpm/yarn migration), before the differ, an update or a dedupe
-    /// re-points any resolution and before any manifest-driven
-    /// `append_package`.
+    /// Call exactly once after `load_from_cwd` (migrations included), before anything
+    /// re-points a resolution or appends a package.
     pub(crate) fn mark_loaded_packages(&mut self) -> Result<(), AllocError> {
         let packages_len = self.packages.len();
         self.loaded_package_count = packages_len as PackageID;
         self.settled_package_count = self.loaded_package_count;
         let mut held = DynamicBitSet::init_empty(packages_len)?;
-        // A load that failed partway leaves `resolutions` shorter than `dependencies`;
-        // that lockfile is replaced by `init_empty` before anything reads the set.
         let dependencies = self.buffers.dependencies.as_slice();
         let resolutions = self.buffers.resolutions.as_slice();
         for (dependency, &package_id) in dependencies.iter().zip(resolutions) {
@@ -2216,9 +2214,7 @@ impl Lockfile {
         Ok(())
     }
 
-    /// Call only while nothing is being resolved (no row enqueued, no manifest
-    /// in flight); see `get_package_id`.
-    #[inline]
+    /// Call only while nothing is being resolved; see `get_package_id`.
     pub(crate) fn mark_settled_packages(&mut self) {
         self.settled_package_count = self.packages.len() as PackageID;
     }
@@ -2233,10 +2229,7 @@ impl Lockfile {
         *self.appended_for_mut(id) = AppendedFor { direct, pinned };
     }
 
-    /// A regular row whose range is exactly `id`'s version resolved to it.
-    /// Ignored once the package is reusable: from then on rows read
-    /// `pinned`, and which rows have resolved to it by any given moment
-    /// depends on registry timing.
+    /// Ignored once the package is reusable: which rows reach it from then on depends on registry timing.
     pub(crate) fn mark_pinned_by_reuse(&mut self, id: PackageID) {
         if !self.is_reusable(id) {
             self.appended_for_mut(id).pinned = true;
@@ -2259,73 +2252,44 @@ impl Lockfile {
             .unwrap_or_default()
     }
 
-    /// Whether package `id` exists on every install of this package.json, so a
-    /// range it merely satisfies may resolve to it: it was loaded or settled,
-    /// or appended for a direct row. Direct rows are enqueued before any
-    /// manifest is processed and a manifest's waiting rows resolve FIFO, so
-    /// for one name they resolve before every transitive row; which packages
-    /// transitive rows have appended so far depends on registry timing.
+    /// Whether package `id` exists on every install of this package.json (loaded, settled, or
+    /// appended for a direct row, which resolve before any transitive row of the name), so a
+    /// range it merely satisfies may resolve to it; what transitive rows appended is timing.
     fn is_reusable(&self, id: PackageID) -> bool {
         id < self.settled_package_count || self.appended_for(id).direct
     }
 
-    /// The package `resolution` is already stored as, if any.
-    ///
-    /// For an npm range `version`, `resolution` is its best match from the
-    /// manifest, and the highest reusable version the range accepts is
-    /// preferred over it (`is_reusable`; a lockfile version always, an
-    /// appended one when a row pinned it or it is of the best match's major).
-    /// Anything else only answers for a range whose best match it is.
+    /// The package `resolution` is stored as, if any; for an npm range, the highest reusable
+    /// version it accepts is preferred (a lockfile version always, an appended one when a row
+    /// pinned it or it is of the best match's major).
     pub(crate) fn get_package_id(
         &self,
         name_hash: u64,
         version: Option<&DependencyVersion>,
         resolution: &Resolution,
     ) -> Option<PackageID> {
-        // Highest version first (`get_or_put_id`).
-        let ids: &[PackageID] = match self.package_index.get(&name_hash)? {
-            PackageIndexEntry::Id(id) => core::slice::from_ref(id),
-            PackageIndexEntry::Ids(ids) => ids.as_slice(),
-        };
         let resolutions: &[Resolution] = self.packages.items_resolution();
-        debug_assert!(ids.iter().all(|&id| (id as usize) < resolutions.len()));
         let buf = self.buffers.string_bytes.as_slice();
-
-        if let Some(range) = version
-            .filter(|v| v.tag == dependency::Tag::Npm)
-            .map(|v| &v.npm().version)
-        {
+        if let Some(version) = version.filter(|v| v.tag == dependency::Tag::Npm) {
             let best_match =
                 (resolution.tag == ResolutionTag::Npm).then(|| resolution.npm().version);
-            let reusable = ids.iter().copied().find(|&id| {
-                let existing = &resolutions[id as usize];
-                if existing.tag != ResolutionTag::Npm {
-                    return false;
-                }
-                let existing_version = existing.npm().version;
-                if !range.satisfies(existing_version, buf, buf) {
-                    return false;
-                }
-                if id < self.loaded_package_count {
-                    return true;
-                }
-                // A copy a root or workspace row resolves to is in place before
-                // any transitive row on the name gets here (those rows are
-                // enqueued first), so every `@types/*` package's `@types/node: *`
-                // lands on the project's `@types/node: ~20` instead of nesting
-                // the latest major.
-                self.is_reusable(id)
-                    && (self.appended_for(id).pinned
-                        || self.is_direct_dependency_resolution(id)
-                        || best_match
-                            .is_none_or(|best_match| existing_version.major == best_match.major))
+            // A copy a direct row resolves to is in place before any transitive row of the
+            // name gets here, so `@types/*`'s `@types/node: *` lands on the project's copy.
+            let reusable = self.package_satisfying(name_hash, version, |id| {
+                id < self.loaded_package_count
+                    || self.is_reusable(id)
+                        && (self.appended_for(id).pinned
+                            || self.is_direct_dependency_resolution(id)
+                            || best_match.is_none_or(|best_match| {
+                                resolutions[id as usize].npm().version.major == best_match.major
+                            }))
             });
             if reusable.is_some() {
                 return reusable;
             }
         }
-
-        ids.iter()
+        self.packages_named(name_hash)
+            .iter()
             .copied()
             .find(|&id| resolutions[id as usize].eql(resolution, buf, buf))
     }
diff --git a/src/install/lockfile/Tree.rs b/src/install/lockfile/Tree.rs
index 5b2fb04b01bb..ad2653dea245 100644
--- a/src/install/lockfile/Tree.rs
+++ b/src/install/lockfile/Tree.rs
@@ -541,6 +541,7 @@ impl<'a, const METHOD: BuilderMethod> Builder<'a, METHOD> {
             &lockfile.overrides,
             lockfile.packages.items_resolution(),
             lockfile.buffers.string_bytes.as_slice(),
+            |_| true,
         ) {
             self.resolutions[dep_id as usize] = pkg_id;
         }
diff --git a/src/install/lockfile/bun.lock.rs b/src/install/lockfile/bun.lock.rs
index 87b74222fc16..050f002e5717 100644
--- a/src/install/lockfile/bun.lock.rs
+++ b/src/install/lockfile/bun.lock.rs
@@ -3148,6 +3148,7 @@ pub(crate) fn parse_into_binary_lockfile(
                     overrides,
                     pkg_resolutions,
                     string_buf,
+                    |_| true,
                 );
                 let Some(res_id) =
                     peer_res_id.or_else(|| pkg_map.get(dep.name.slice(string_buf)).copied())
@@ -3220,6 +3221,7 @@ pub(crate) fn parse_into_binary_lockfile(
                         overrides,
                         pkg_resolutions,
                         string_buf,
+                        |_| true,
                     );
                     let Some(res_id) = peer_res_id.or_else(|| {
                         pkg_map
@@ -3299,6 +3301,7 @@ pub(crate) fn parse_into_binary_lockfile(
                     overrides,
                     pkg_resolutions,
                     string_buf,
+                    |_| true,
                 );
                 let res_id = match peer_res_id {
                     Some(id) => id,
@@ -3413,6 +3416,8 @@ fn deferred_peer_range<'a>(
 /// so the isolated store's ancestor walk and the hoisted tree's dedupe
 /// both resolve the name through the root's workspace entry before the
 /// edge value is ever consulted.
+///
+/// `is_candidate` restricts the scan for lockfiles holding packages a reload will not see.
 pub(crate) fn resolve_peer_dep_version_based(
     dep: &Dependency,
     catalogs: &CatalogMap,
@@ -3420,27 +3425,6 @@ pub(crate) fn resolve_peer_dep_version_based(
     overrides: &OverrideMap,
     pkg_resolutions: &[Resolution],
     string_buf: &[u8],
-) -> Option<PackageID> {
-    resolve_peer_dep_version_based_among(
-        dep,
-        catalogs,
-        package_index,
-        overrides,
-        pkg_resolutions,
-        string_buf,
-        |_| true,
-    )
-}
-
-/// `resolve_peer_dep_version_based` over the candidates `is_candidate` accepts, for callers
-/// whose lockfile holds packages a reload will not see (`rebind_peers_to_printed_packages`).
-pub(crate) fn resolve_peer_dep_version_based_among(
-    dep: &Dependency,
-    catalogs: &CatalogMap,
-    package_index: &PackageIndexMap,
-    overrides: &OverrideMap,
-    pkg_resolutions: &[Resolution],
-    string_buf: &[u8],
     is_candidate: impl Fn(PackageID) -> bool,
 ) -> Option<PackageID> {
     let range = deferred_peer_range(dep, catalogs, string_buf)?;
@@ -3511,10 +3495,10 @@ pub(crate) fn resolve_peer_dep_by_range(
 ) -> Option<PackageID> {
     let candidates = package_index.get(&name_hash)?.as_slice();
     candidates.iter().copied().find(|&id| {
-        is_candidate(id)
-            && pkg_resolutions
-                .get(id as usize)
-                .is_some_and(|res| res.satisfies_dependency_version(range, string_buf, string_buf))
+        pkg_resolutions
+            .get(id as usize)
+            .is_some_and(|res| res.satisfies_dependency_version(range, string_buf, string_buf))
+            && is_candidate(id)
     })
 }
 
@@ -3566,7 +3550,7 @@ pub(crate) fn rebind_peers_to_printed_packages(
         {
             continue;
         }
-        if let Some(printed_target) = resolve_peer_dep_version_based_among(
+        if let Some(printed_target) = resolve_peer_dep_version_based(
             dep,
             catalogs,
             package_index,
diff --git a/src/install/pnpm.rs b/src/install/pnpm.rs
index ce60f324e6c3..7a8d4b09654e 100644
--- a/src/install/pnpm.rs
+++ b/src/install/pnpm.rs
@@ -156,6 +156,7 @@ fn resolve_peer_like_bun_lock(lockfile: &Lockfile, dep: &Dependency) -> Option<P
         &lockfile.overrides,
         lockfile.packages.items_resolution(),
         string_bytes!(lockfile),
+        |_| true,
     )
 }
 
diff --git a/src/install/prune.rs b/src/install/prune.rs
index a92cbf3dc748..fb0b38e94bae 100644
--- a/src/install/prune.rs
+++ b/src/install/prune.rs
@@ -14,7 +14,7 @@ use crate::isolated_install::store::{EntryColumns as _, NodeColumns as _, entry
 use crate::isolated_install::{Store, Timings, build_store};
 use crate::lockfile::package::PackageColumns as _;
 use crate::lockfile::tree::is_filtered_dependency_or_workspace;
-use crate::lockfile::{LoadResult, Lockfile, PackageIndexEntry, reachable, tree};
+use crate::lockfile::{LoadResult, Lockfile, reachable, tree};
 use crate::lockfile_real::package::{Diff, DiffSummary, Package};
 use crate::package_manager::Options::{Enable, LogLevel};
 use crate::package_manager::ROOT_PACKAGE_JSON_PATH;
@@ -894,15 +894,8 @@ impl<'a> HoistedTree<'a> {
         let lockfile = self.lockfile;
         let buf = lockfile.buffers.string_bytes.as_slice();
         let name_hash = lockfile.packages.items_name_hash()[pkg_id as usize];
-        let Some(entry) = lockfile.package_index.get(&name_hash) else {
-            return false;
-        };
-        let ids: &[PackageID] = match entry {
-            PackageIndexEntry::Id(id) => core::slice::from_ref(id),
-            PackageIndexEntry::Ids(ids) => ids,
-        };
         let pkg_res = lockfile.packages.items_resolution();
-        ids.iter().any(|&id| {
+        lockfile.packages_named(name_hash).iter().any(|&id| {
             pkg_res.get(id as usize).is_some_and(|res| {
                 res.tag == ResolutionTag::Npm
                     && without_build(version)
diff --git a/src/install/update_transitive.rs b/src/install/update_transitive.rs
index 4275dde972b9..beeace47dc2a 100644
--- a/src/install/update_transitive.rs
+++ b/src/install/update_transitive.rs
@@ -1645,58 +1645,24 @@ fn original_literal_is_dist_tag(manager: &PackageManager, dep_id: DependencyID)
         })
 }
 
-/// Mirrors `patched_package_satisfying`: a patched loaded instance the row's range accepts captures the row before any lookup.
-fn patched_capture(lockfile: &Lockfile, dep_id: DependencyID) -> Option<Semver::Version> {
-    if lockfile.patched_dependencies.count() == 0 {
-        return None;
-    }
-    let buf = lockfile.buffers.string_bytes.as_slice();
-    let dep = &lockfile.buffers.dependencies[dep_id as usize];
-    let version = dedupe::effective_version(lockfile, dep_id, dep)?;
-    if version.tag != DependencyVersionTag::Npm {
-        return None;
-    }
-    let hash = Semver::string::Builder::string_hash(version.npm().name.slice(buf));
-    let candidates = lockfile.package_index.get(&hash)?.as_slice();
-    let pkg_res = lockfile.packages.items_resolution();
-    let range = &version.npm().version;
-    candidates
-        .iter()
-        .copied()
-        .filter(|&id| (id as usize) < lockfile.packages.len())
-        .find(|&id| {
-            let res = &pkg_res[id as usize];
-            res.tag == ResolutionTag::Npm
-                && range.satisfies(res.npm().version, buf, buf)
-                && lockfile
-                    .patched_dependencies
-                    .contains(&Semver::string::Builder::string_hash(&dedupe::label(
-                        lockfile, id,
-                    )))
-        })
-        .map(|id| pkg_res[id as usize].npm().version)
-}
-
-/// Mirrors `locked_version_in_lockfile`: the highest loaded npm instance the row's range accepts.
-fn locked_in_lockfile(lockfile: &Lockfile, dep_id: DependencyID) -> Option<Semver::Version> {
+/// The version of the npm instance `find` picks for the row's effective range (by the range's name hash).
+fn instance_version(
+    lockfile: &Lockfile,
+    dep_id: DependencyID,
+    find: impl FnOnce(PackageNameHash, &dependency::Version) -> Option<PackageID>,
+) -> Option<Semver::Version> {
     let buf = lockfile.buffers.string_bytes.as_slice();
     let dep = &lockfile.buffers.dependencies[dep_id as usize];
-    let version = dedupe::effective_version(lockfile, dep_id, dep)?;
-    if version.tag != DependencyVersionTag::Npm {
-        return None;
-    }
-    let hash = Semver::string::Builder::string_hash(version.npm().name.slice(buf));
-    let candidates = lockfile.package_index.get(&hash)?.as_slice();
-    let pkg_res = lockfile.packages.items_resolution();
-    let range = &version.npm().version;
-    candidates
-        .iter()
-        .copied()
-        .filter(|&id| id < lockfile.loaded_package_count)
-        .map(|id| &pkg_res[id as usize])
-        .filter(|res| res.tag == ResolutionTag::Npm)
-        .map(|res| res.npm().version)
-        .find(|&locked| range.satisfies(locked, buf, buf))
+    let range = dedupe::effective_npm_range(lockfile, dep_id, dep)?;
+    let id = find(
+        Semver::string::Builder::string_hash(range.npm().name.slice(buf)),
+        &range,
+    )?;
+    Some(
+        lockfile.packages.items_resolution()[id as usize]
+            .npm()
+            .version,
+    )
 }
 
 /// The pre-differ resolution of a root/workspace row, matched by owner, name hash and behavior like `moved_pairs`.
@@ -1762,7 +1728,8 @@ fn direct_row_landing(
         .behavior
         .is_peer()
     {
-        if let Some(patched) = patched_capture(lockfile, dep_id) {
+        let patched = |hash, range: &_| lockfile.patched_package_satisfying(hash, range);
+        if let Some(patched) = instance_version(lockfile, dep_id, patched) {
             return Some((patched, false));
         }
     }
@@ -1788,7 +1755,10 @@ fn direct_row_landing(
     let locked = match keep {
         KeepLocked::No => None,
         KeepLocked::Version(locked) => Some(locked),
-        KeepLocked::Range => locked_in_lockfile(lockfile, dep_id),
+        // As `locked_version_in_lockfile`: the highest loaded instance the range accepts.
+        KeepLocked::Range => instance_version(lockfile, dep_id, |hash, range| {
+            lockfile.package_satisfying(hash, range, |id| id < lockfile.loaded_package_count)
+        }),
     };
     if let Some(locked) = locked {
         if found.version.order(locked, &manifest.string_buf, buf) == Ordering::Less

From 3e713fe1f66789f4d2eea56760717036a34a44c0 Mon Sep 17 00:00:00 2001
From: Jarred Sumner <jarred@jarredsumner.com>
Date: Mon, 17 Aug 2026 05:43:34 +0000
Subject: [PATCH 223/258] simplify(s1-resolver): drop
 Plan/Planned/InstanceEdges/DirectRow scaffolding in update_transitive

plan_edges returns a TransitiveUpdate and registers the moved packages
itself; the report is kept unconditionally (print_plan already gates on
--dry-run/--lockfile-only), planned wants are tuples again.

(cherry picked from commit c4fb9d4cc965dc5326874d87290fefaf50b737a1)
---
 src/install/update_transitive.rs | 155 ++++++++++---------------------
 1 file changed, 49 insertions(+), 106 deletions(-)

diff --git a/src/install/update_transitive.rs b/src/install/update_transitive.rs
index beeace47dc2a..32412c14ce4e 100644
--- a/src/install/update_transitive.rs
+++ b/src/install/update_transitive.rs
@@ -23,17 +23,11 @@ use crate::{
     PackageManager, PackageNameHash, ResolutionTag, invalid_package_id,
 };
 
-struct DirectRow {
-    name_hash: PackageNameHash,
-    behavior: Behavior,
-    resolved: PackageID,
-}
-
 /// Root/workspace dependency rows as loaded from bun.lock, taken before the differ re-enqueues them.
 #[derive(Default)]
 pub struct DirectDependencies {
     owners: Vec<(PackageID, u32, u32)>,
-    rows: Vec<DirectRow>,
+    rows: Vec<(PackageNameHash, Behavior, PackageID)>,
 }
 
 impl DirectDependencies {
@@ -62,11 +56,7 @@ impl DirectDependencies {
                     .get(deps)
                     .iter()
                     .zip(res_slices[owner].get(resolutions))
-                    .map(|(dep, &resolved)| DirectRow {
-                        name_hash: dep.name_hash,
-                        behavior: dep.behavior,
-                        resolved,
-                    }),
+                    .map(|(dep, &resolved)| (dep.name_hash, dep.behavior, resolved)),
             );
             out.owners.push((
                 owner as PackageID,
@@ -80,9 +70,9 @@ impl DirectDependencies {
     /// One bit per package: the packages the direct rows resolve to.
     fn resolved_packages(&self, packages_len: usize) -> DynamicBitSet {
         let mut set = DynamicBitSet::init_empty(packages_len).unwrap_or_oom();
-        for row in &self.rows {
-            if (row.resolved as usize) < packages_len {
-                set.set(row.resolved as usize);
+        for &(_, _, resolved) in &self.rows {
+            if (resolved as usize) < packages_len {
+                set.set(resolved as usize);
             }
         }
         set
@@ -118,8 +108,8 @@ impl DirectDependencies {
                 .iter()
                 .zip(res_slices[owner].get(resolutions));
             for (i, (dep, &new)) in current.enumerate() {
-                let same = |row: &DirectRow| {
-                    row.name_hash == dep.name_hash && row.behavior == dep.behavior
+                let same = |row: &(PackageNameHash, Behavior, PackageID)| {
+                    row.0 == dep.name_hash && row.1 == dep.behavior
                 };
                 let index = if claimed.is_none() && rows.get(i).is_some_and(same) {
                     i
@@ -147,7 +137,7 @@ impl DirectDependencies {
                     taken.set(k);
                     k
                 };
-                let old = rows[index].resolved;
+                let old = rows[index].2;
                 if old == new
                     || (old as usize) >= packages_len
                     || (new as usize) >= packages_len
@@ -284,20 +274,13 @@ struct Pin {
     to: Option<Semver::Version>,
 }
 
-struct Planned {
-    v: Semver::Version,
-    /// `None` re-resolves the edge through its own dist-tag.
-    to: Option<Semver::Version>,
-    later: Box<[u8]>,
-}
-
 /// The transitive half of a bare `bun update`: every edge owned by a non-workspace package the selected workspaces reach (all of them from the root or with -r) moves to the newest release its own range allows, or to wherever its dist-tag points now. A range edge sharing the package a root/workspace entry resolves to follows that entry instead (`deferred`).
 #[derive(Default)]
 pub struct TransitiveUpdate {
     pins: Vec<Pin>,
-    /// Kept for `print_plan` when no install summary will print the rows (`--dry-run`, `--lockfile-only`).
-    report: Option<Report>,
-    /// Range rows left to follow the direct entry whose package they share; `plan_unanchored` plans the ones that entry did not take along.
+    /// For `print_plan`, when no install summary will print the rows (`--dry-run`, `--lockfile-only`).
+    report: Report,
+    /// Range rows left to follow the direct entry whose package they share; see `plan_unanchored`.
     deferred: Vec<DependencyID>,
 }
 
@@ -320,14 +303,7 @@ impl TransitiveUpdate {
             }
             edges
         };
-        let planned = plan_edges(manager, &edges, direct)?;
-        register_moved(manager, &planned.report.moved)?;
-        let printed_here = manager.options.dry_run || manager.options.lockfile_only;
-        Ok(TransitiveUpdate {
-            pins: planned.pins,
-            report: printed_here.then_some(planned.report),
-            deferred: planned.deferred,
-        })
+        plan_edges(manager, &edges, direct)
     }
 
     pub fn has_deferred(&self) -> bool {
@@ -362,19 +338,12 @@ impl TransitiveUpdate {
         if edges.count() == 0 {
             return Ok(false);
         }
-        let planned = plan_edges(manager, &edges, &current)?;
-        register_moved(manager, &planned.report.moved)?;
-        if let Some(report) = &mut self.report {
-            report.rows.extend(planned.report.rows);
-            report.moved.extend(planned.report.moved);
-        }
-        if planned.pins.is_empty() {
+        let mut round = plan_edges(manager, &edges, &current)?;
+        self.report.rows.append(&mut round.report.rows);
+        self.report.moved.append(&mut round.report.moved);
+        if round.pins.is_empty() {
             return Ok(false);
         }
-        let round = TransitiveUpdate {
-            pins: planned.pins,
-            ..Default::default()
-        };
         round.enqueue(manager)?;
         manager.drain_dependency_list();
         self.pins.extend(round.pins);
@@ -434,10 +403,7 @@ impl TransitiveUpdate {
             return;
         }
         let dry_run = options.dry_run;
-        let mut rows = self
-            .report
-            .as_ref()
-            .map_or_else(Vec::new, |report| report.rows.clone());
+        let mut rows = self.report.rows.clone();
         let mut pairs = direct.moved_pairs(&manager.lockfile);
         pairs.extend(named_pairs(&manager.lockfile, named));
         rows.extend(rows_between(manager, pairs));
@@ -505,12 +471,7 @@ pub(crate) fn refresh_children_of(
     };
     // The direct rows are resolved by now, so the rows `plan_edges` defers are sharing a package those rows settled on and simply stay there.
     let direct = DirectDependencies::snapshot(&manager.lockfile);
-    let planned = plan_edges(manager, &edges, &direct)?;
-    register_moved(manager, &planned.report.moved)?;
-    let update = TransitiveUpdate {
-        pins: planned.pins,
-        ..Default::default()
-    };
+    let update = plan_edges(manager, &edges, &direct)?;
     update.enqueue(manager)?;
     Ok(update
         .pins
@@ -1060,9 +1021,9 @@ pub(crate) fn plannable_peer_rows(
     let resolutions = lockfile.buffers.resolutions.as_slice();
 
     let mut providers = DynamicBitSet::init_empty(packages_len).unwrap_or_oom();
-    for row in &direct.rows {
-        if !row.behavior.is_peer() && (row.resolved as usize) < packages_len {
-            providers.set(row.resolved as usize);
+    for &(_, behavior, resolved) in &direct.rows {
+        if !behavior.is_peer() && (resolved as usize) < packages_len {
+            providers.set(resolved as usize);
         }
     }
     for owner in 0..packages_len {
@@ -1103,20 +1064,12 @@ pub(crate) fn plannable_peer_rows(
     rows
 }
 
-#[derive(Default)]
-struct Plan {
-    pins: Vec<Pin>,
-    report: Report,
-    /// Range rows sharing a package a row of `direct` resolves to; see `TransitiveUpdate::deferred`.
-    deferred: Vec<DependencyID>,
-}
-
-/// `edges` selects the rows to plan; each moves to the newest release its (post-override/catalog) range allows, or follows its dist-tag. A range row on a package that a row of `direct` resolves to is deferred instead, since it belongs with that entry; a dist-tag row keeps following its tag.
+/// `edges` selects the rows to plan; each moves to the newest release its (post-override/catalog) range allows, or follows its dist-tag. A range row on a package that a row of `direct` resolves to is deferred instead, since it belongs with that entry; a dist-tag row keeps following its tag. The moved packages are registered for the summary.
 fn plan_edges(
     manager: &mut PackageManager,
     edges: &DynamicBitSet,
     direct: &DirectDependencies,
-) -> crate::Result<Plan> {
+) -> crate::Result<TransitiveUpdate> {
     let mut instances: Vec<Instance> = Vec::new();
     let mut kept: Vec<PackageID> = Vec::new();
     {
@@ -1215,10 +1168,10 @@ fn plan_edges(
     }
     instances.retain(|inst| !inst.wants.is_empty());
     if instances.is_empty() {
-        return Ok(Plan::default());
+        return Ok(TransitiveUpdate::default());
     }
 
-    let mut plan = Plan::default();
+    let mut plan = TransitiveUpdate::default();
     let shared_with_direct = direct.resolved_packages(manager.lockfile.packages.len());
     instances.retain_mut(|inst| {
         if inst.held || !shared_with_direct.is_set(inst.pkg_id as usize) {
@@ -1236,7 +1189,7 @@ fn plan_edges(
     if instances.is_empty() {
         return Ok(plan);
     }
-    let edges_on = edges_on_instances(manager, &instances, direct);
+    let (followers, direct_rows) = edges_on_instances(manager, &instances, direct);
 
     let ids: Vec<PackageID> = instances.iter().map(|inst| inst.pkg_id).collect();
     let msgs_before = manager.log_mut().msgs.len();
@@ -1248,7 +1201,7 @@ fn plan_edges(
     let buf = manager.lockfile.buffers.string_bytes.as_slice();
     let pkg_names = manager.lockfile.packages.items_name();
 
-    let Plan { pins, report, .. } = &mut plan;
+    let TransitiveUpdate { pins, report, .. } = &mut plan;
     let mut unchecked: Vec<(Box<[u8]>, Box<[u8]>)> = Vec::new();
     // Non-inline prerelease strings of planned versions live in the manifest buffer; copied into the lockfile's below.
     let mut pre_strings: Vec<(core::ops::Range<usize>, u64, Box<[u8]>)> = Vec::new();
@@ -1276,7 +1229,8 @@ fn plan_edges(
         let manifest: &PackageManifest = manifest;
         let manifest_buf: &[u8] = &manifest.string_buf;
         let rows_before = report.rows.len();
-        let planned: Vec<Option<Planned>> = inst
+        // Per want: (version, pin target (`None` re-resolves through the dist-tag), `later` hint).
+        let planned: Vec<Option<(Semver::Version, Option<Semver::Version>, Box<[u8]>)>> = inst
             .wants
             .iter()
             .map(|want| {
@@ -1287,11 +1241,7 @@ fn plan_edges(
                         .unwrap()
                         .map(|found| found.version)
                         .filter(|&v| v.order(inst.current, manifest_buf, buf) == Ordering::Greater)
-                        .map(|v| Planned {
-                            v,
-                            to: Some(v),
-                            later: later_than(manifest, v, min_age, excludes),
-                        })
+                        .map(|v| (v, Some(v), later_than(manifest, v, min_age, excludes)))
                 } else {
                     let tag = want.version.dist_tag().tag.slice(buf);
                     manifest
@@ -1299,15 +1249,11 @@ fn plan_edges(
                         .unwrap()
                         .map(|found| found.version)
                         .filter(|&v| v.order(inst.current, manifest_buf, buf) != Ordering::Equal)
-                        .map(|v| Planned {
-                            v,
-                            to: None,
-                            later: Box::default(),
-                        })
+                        .map(|v| (v, None, Box::default()))
                 }
             })
             .collect();
-        let edge_wants: Vec<(DependencyID, Option<usize>)> = edges_on.followers[inst_i]
+        let edge_wants: Vec<(DependencyID, Option<usize>)> = followers[inst_i]
             .iter()
             .map(|&edge| {
                 let owner = inst
@@ -1320,7 +1266,7 @@ fn plan_edges(
         // Rows landing back on `current` are stayers the redirect can still carry; the first moved row's landing is the instance's only direct redirect target (`redirect` is first-wins over `moved_pairs`, both in owner order).
         let mut direct_stayers: Vec<DependencyID> = Vec::new();
         let mut direct_landing: Option<(Semver::Version, bool)> = None;
-        for &(dep_id, latest, keep, res_slot) in &edges_on.direct[inst_i] {
+        for &(dep_id, latest, keep, res_slot) in &direct_rows[inst_i] {
             let Some((landing, in_manifest)) = direct_row_landing(
                 &manager.lockfile,
                 manifest,
@@ -1344,17 +1290,17 @@ fn plan_edges(
         loop {
             let mut changed = false;
             for w in 0..inst.wants.len() {
-                let Some(plan) = &planned[w] else {
+                let Some((v, Some(_), _)) = &planned[w] else {
                     continue;
                 };
-                if held_wants[w] || plan.to.is_none() {
+                if held_wants[w] {
                     continue;
                 }
                 // The redirect carries every remaining edge toward the FIRST pinned want's target (dist-tag pins included).
                 let redirect_v = (0..inst.wants.len())
                     .find(|&i| !held_wants[i] && planned[i].is_some())
-                    .and_then(|i| planned[i].as_ref().map(|plan| plan.v))
-                    .unwrap_or(plan.v);
+                    .and_then(|i| planned[i].as_ref())
+                    .map_or(*v, |plan| plan.0);
                 if forks_surviving_instance(
                     &manager.lockfile,
                     inst,
@@ -1376,13 +1322,13 @@ fn plan_edges(
             }
         }
         for (w, want) in inst.wants.iter().enumerate() {
-            let Some(plan) = &planned[w] else {
+            let Some((v, to, later)) = &planned[w] else {
                 continue;
             };
             if held_wants[w] {
                 continue;
             }
-            let (v, to) = (plan.v, plan.to);
+            let (v, to) = (*v, *to);
             if to.is_some() && !v.tag.pre.value.is_inline() {
                 let end = pins.len() + want.dep_ids.len();
                 pre_strings.push((
@@ -1400,7 +1346,7 @@ fn plan_edges(
                 name: Box::from(name),
                 from: text(inst.current.fmt(buf)),
                 to: text(v.fmt(manifest_buf)),
-                later: plan.later.clone(),
+                later: later.clone(),
             });
         }
         if report.rows.len() != rows_before {
@@ -1424,20 +1370,18 @@ fn plan_edges(
     }
 
     sort_dedup_rows(&mut report.rows);
+    register_moved(manager, &plan.report.moved)?;
     Ok(plan)
 }
 
-/// Live rows per planned instance: `followers` move only via the post-resolve redirect; `direct` rows are the root/workspace rows the differ re-resolves, as `(dep_id, lands on the latest dist-tag, keep_locked_if_ahead model)` per `should_update`.
-struct InstanceEdges {
-    followers: Vec<Vec<DependencyID>>,
-    direct: Vec<Vec<(DependencyID, bool, KeepLocked, u32)>>,
-}
+type DirectRows = Vec<(DependencyID, bool, KeepLocked, u32)>;
 
+/// Live rows per planned instance: followers move only via the post-resolve redirect; direct rows are the root/workspace rows the differ re-resolves, as `(dep_id, lands on the latest dist-tag, keep_locked_if_ahead model, slot it resolves to)` per `should_update`.
 fn edges_on_instances(
     manager: &mut PackageManager,
     instances: &[Instance],
     direct_deps: &DirectDependencies,
-) -> InstanceEdges {
+) -> (Vec<Vec<DependencyID>>, Vec<DirectRows>) {
     struct DirectRow {
         dep_id: DependencyID,
         inst: u32,
@@ -1450,8 +1394,7 @@ fn edges_on_instances(
         npm: bool,
     }
     let mut followers: Vec<Vec<DependencyID>> = vec![Vec::new(); instances.len()];
-    let mut direct: Vec<Vec<(DependencyID, bool, KeepLocked, u32)>> =
-        vec![Vec::new(); instances.len()];
+    let mut direct: Vec<DirectRows> = vec![Vec::new(); instances.len()];
     let mut direct_rows: Vec<DirectRow> = Vec::new();
     {
         let lockfile: &Lockfile = &manager.lockfile;
@@ -1620,7 +1563,7 @@ fn edges_on_instances(
         };
         direct[row.inst as usize].push((row.dep_id, latest, keep, row.res_slot));
     }
-    InstanceEdges { followers, direct }
+    (followers, direct)
 }
 
 #[derive(Clone, Copy)]
@@ -1678,8 +1621,8 @@ fn snapshot_resolution(
         .find(|&&(pkg, _, _)| pkg == owner)?;
     direct_deps.rows[start as usize..(start + len) as usize]
         .iter()
-        .find(|row| row.name_hash == name_hash && row.behavior == behavior)
-        .map(|row| row.resolved)
+        .find(|row| row.0 == name_hash && row.1 == behavior)
+        .map(|row| row.2)
 }
 
 /// Mirrors `should_update`'s named branch: the row names a requested package and sits in the update scope.
@@ -1776,7 +1719,7 @@ fn forks_surviving_instance(
     lockfile: &Lockfile,
     inst: &Instance,
     want_index: usize,
-    planned: &[Option<Planned>],
+    planned: &[Option<(Semver::Version, Option<Semver::Version>, Box<[u8]>)>],
     held_wants: &[bool],
     edge_wants: &[(DependencyID, Option<usize>)],
     direct_stayers: &[DependencyID],

From e0f4a09f664f16f867750e071b7fd2119b1f0388 Mon Sep 17 00:00:00 2001
From: Jarred Sumner <jarred@jarredsumner.com>
Date: Mon, 17 Aug 2026 05:46:16 +0000
Subject: [PATCH 224/258] simplify(s1-resolver): update_transitive direct rows
 use keep_locked_if_ahead itself

KeepLocked enum becomes the Option<(Version)> the resolver's
keep_locked_if_ahead takes; the -r/--filter locked version is looked up
when the row is classified (the manifests-only fetch in between does not
touch the lockfile). overridden_row is dedupe::applied_override.

(cherry picked from commit caff218237a952a462f3cce1d21642618b13eb87)
---
 .../PackageManager/PackageManagerEnqueue.rs   |  2 +-
 src/install/update_transitive.rs              | 65 +++++--------------
 2 files changed, 18 insertions(+), 49 deletions(-)

diff --git a/src/install/PackageManager/PackageManagerEnqueue.rs b/src/install/PackageManager/PackageManagerEnqueue.rs
index 4ab180e4c73e..38e5fc339ff3 100644
--- a/src/install/PackageManager/PackageManagerEnqueue.rs
+++ b/src/install/PackageManager/PackageManagerEnqueue.rs
@@ -2950,7 +2950,7 @@ fn resolved_folder_package(
 }
 
 /// `--latest` never moves a row below what bun.lock already has (e.g. a prerelease or a version ahead of the tag).
-fn keep_locked_if_ahead<'m>(
+pub(crate) fn keep_locked_if_ahead<'m>(
     manifest: &'m Npm::PackageManifest,
     found: Npm::FindResult<'m>,
     locked: &Option<(Semver::Version, &[u8])>,
diff --git a/src/install/update_transitive.rs b/src/install/update_transitive.rs
index 32412c14ce4e..f1aaca618b37 100644
--- a/src/install/update_transitive.rs
+++ b/src/install/update_transitive.rs
@@ -15,6 +15,7 @@ use crate::lockfile::{Lockfile, PackageIndexEntry};
 use crate::npm::{MinimumReleaseAgeExcludes, PackageManifest};
 use crate::package_manager::Options::LogLevel;
 use crate::package_manager::ROOT_PACKAGE_JSON_PATH;
+use crate::package_manager_real::enqueue::keep_locked_if_ahead;
 use crate::package_manager_real::populate_manifest_cache::{self, Packages};
 use crate::package_manager_real::{PackageUpdateInfo, enqueue_dependency_with_main};
 use crate::update_scope::UpdateScope;
@@ -1374,9 +1375,9 @@ fn plan_edges(
     Ok(plan)
 }
 
-type DirectRows = Vec<(DependencyID, bool, KeepLocked, u32)>;
+type DirectRows = Vec<(DependencyID, bool, Option<Semver::Version>, u32)>;
 
-/// Live rows per planned instance: followers move only via the post-resolve redirect; direct rows are the root/workspace rows the differ re-resolves, as `(dep_id, lands on the latest dist-tag, keep_locked_if_ahead model, slot it resolves to)` per `should_update`.
+/// Live rows per planned instance: followers move only via the post-resolve redirect; direct rows are the root/workspace rows the differ re-resolves, as `(dep_id, lands on the latest dist-tag, locked version for keep_locked_if_ahead, slot it resolves to)` per `should_update`.
 fn edges_on_instances(
     manager: &mut PackageManager,
     instances: &[Instance],
@@ -1548,33 +1549,28 @@ fn edges_on_instances(
             }
             continue;
         }
-        // Mirrors `latest_for_target` (catalog and overridden rows resolve by their range, never by `latest`); named rows reach plan_edges via the --latest-only path.
-        let overridden = overridden_row(&manager.lockfile, row.dep_id);
+        // Mirrors `latest_for_target` (catalog and overridden rows resolve by their range, never `latest`; `!version_was_replaced`); named rows reach plan_edges via the --latest-only path.
+        let lockfile: &Lockfile = &manager.lockfile;
+        let dep = &lockfile.buffers.dependencies[row.dep_id as usize];
+        let overridden = dedupe::applied_override(lockfile, row.dep_id, dep).is_some();
         let latest = to_latest && (!bare || in_targets) && !row.catalog && !overridden;
-        // `keep_locked_if_ahead` finds a locked version only where its path can: the range's loaded lockfile instance for -r/--filter npm rows, the invoking workspace's rewritten rows otherwise (rows that were dist-tag literals follow their tag).
+        // The locked version `keep_locked_if_ahead` gets: `locked_version_in_lockfile` for -r/--filter npm rows, `locked_version_of_invoking_workspace_row` otherwise (rows that were dist-tag literals follow their tag).
         let keep = if !to_latest || row.catalog || overridden {
-            KeepLocked::No
+            None
         } else if has_targets && in_targets && row.npm {
-            KeepLocked::Range
+            instance_version(lockfile, row.dep_id, |hash, range| {
+                lockfile.package_satisfying(hash, range, |id| id < lockfile.loaded_package_count)
+            })
         } else if !has_targets && !row.npm && !original_literal_is_dist_tag(manager, row.dep_id) {
-            row.locked.map_or(KeepLocked::No, KeepLocked::Version)
+            row.locked
         } else {
-            KeepLocked::No
+            None
         };
         direct[row.inst as usize].push((row.dep_id, latest, keep, row.res_slot));
     }
     (followers, direct)
 }
 
-#[derive(Clone, Copy)]
-enum KeepLocked {
-    No,
-    /// The highest loaded instance the row's range accepts keeps the row when it is ahead.
-    Range,
-    /// The row's own locked version keeps it when ahead of the lookup.
-    Version(Semver::Version),
-}
-
 /// Mirrors `locked_version_of_invoking_workspace_row`'s dist-tag-literal exclusion.
 fn original_literal_is_dist_tag(manager: &PackageManager, dep_id: DependencyID) -> bool {
     let lockfile: &Lockfile = &manager.lockfile;
@@ -1644,24 +1640,13 @@ fn named_row_in_scope(manager: &PackageManager, dep_id: DependencyID) -> bool {
     named && UpdateScope::of(manager).contains_dependency(lockfile, dep_id)
 }
 
-/// Overridden rows resolve by the override range, never by `latest` (`!version_was_replaced` in `latest_for_target`).
-fn overridden_row(lockfile: &Lockfile, dep_id: DependencyID) -> bool {
-    let dep = &lockfile.buffers.dependencies[dep_id as usize];
-    !dep.behavior.is_workspace()
-        && !(dep.version.tag == DependencyVersionTag::Npm && dep.version.npm().is_alias)
-        && lockfile
-            .overrides
-            .get(lockfile, dep_id, dep.name_hash)
-            .is_some()
-}
-
-/// The release the differ lands this row on (with whether it lives in the manifest buffer): the patched capture, the keep-locked version, or the lookup (`latest` dist-tag for `--latest` target rows, else the row's own range or tag).
+/// The release the differ lands this row on (with whether it lives in the manifest buffer): the patched capture, or the lookup (`latest` dist-tag for `--latest` target rows, else the row's own range or tag) through `keep_locked_if_ahead`.
 fn direct_row_landing(
     lockfile: &Lockfile,
     manifest: &PackageManifest,
     dep_id: DependencyID,
     latest: bool,
-    keep: KeepLocked,
+    keep: Option<Semver::Version>,
     min_age: Option<f64>,
     excludes: Option<&MinimumReleaseAgeExcludes>,
 ) -> Option<(Semver::Version, bool)> {
@@ -1693,23 +1678,7 @@ fn direct_row_landing(
             _ => return None,
         }
     };
-    let found = found?;
-    // `keep_locked_if_ahead`: a lookup below the row's locked version lands it back on that version, when the manifest still has it.
-    let locked = match keep {
-        KeepLocked::No => None,
-        KeepLocked::Version(locked) => Some(locked),
-        // As `locked_version_in_lockfile`: the highest loaded instance the range accepts.
-        KeepLocked::Range => instance_version(lockfile, dep_id, |hash, range| {
-            lockfile.package_satisfying(hash, range, |id| id < lockfile.loaded_package_count)
-        }),
-    };
-    if let Some(locked) = locked {
-        if found.version.order(locked, &manifest.string_buf, buf) == Ordering::Less
-            && manifest.find_by_version(locked).is_some()
-        {
-            return Some((locked, false));
-        }
-    }
+    let found = keep_locked_if_ahead(manifest, found?, &keep.map(|locked| (locked, buf)));
     Some((found.version, true))
 }
 

From 69d743e9b7578e28f3c54afc3c5ccef72268a1c1 Mon Sep 17 00:00:00 2001
From: Jarred Sumner <jarred@jarredsumner.com>
Date: Mon, 17 Aug 2026 05:47:34 +0000
Subject: [PATCH 225/258] simplify(s1-resolver): share is_named_update_row
 between should_update and the transitive plan

(cherry picked from commit 7c288ca28a2d729017779793b780483d4fff08a2)
---
 .../PackageManager/PackageManagerEnqueue.rs   | 24 ++++++++++-----
 src/install/update_transitive.rs              | 29 +++++--------------
 2 files changed, 25 insertions(+), 28 deletions(-)

diff --git a/src/install/PackageManager/PackageManagerEnqueue.rs b/src/install/PackageManager/PackageManagerEnqueue.rs
index 38e5fc339ff3..12762c8109c2 100644
--- a/src/install/PackageManager/PackageManagerEnqueue.rs
+++ b/src/install/PackageManager/PackageManagerEnqueue.rs
@@ -2224,13 +2224,7 @@ fn get_or_put_resolved_package_with_find_result(
     // borrows `this.lockfile` and `this` at once. Split via raw root.
     let should_update = this.to_update
         && if !this.update_requests.is_empty() {
-            // bun update <name>: every in-scope <name> row (declared or `npm:<name>@…` aliased, see update_scope); other resolutions stay pinned.
-            let string_buf = this.lockfile.buffers.string_bytes.as_slice();
-            (this.is_update_request(dependency.name_hash, dependency.name.slice(string_buf))
-                || (name_hash != dependency.name_hash
-                    && this.is_update_request(name_hash, name.slice(string_buf))))
-                && crate::update_scope::UpdateScope::of(&*this)
-                    .contains_dependency(&this.lockfile, dependency_id)
+            is_named_update_row(this, dependency, dependency_id, name_hash, name)
         } else if let Some(targets) = this.update_target_workspaces.as_deref() {
             // `bun update -r`/`--filter`: direct deps of the selected workspaces; catalogs are root-scoped.
             dependency.version.tag == dependency::version::Tag::Catalog
@@ -2949,6 +2943,22 @@ fn resolved_folder_package(
     }))
 }
 
+/// `bun update <name>`: the row names a requested package (declared or `npm:<name>@…` aliased) and is in the update scope; other resolutions stay pinned.
+pub(crate) fn is_named_update_row(
+    this: &PackageManager,
+    dependency: &Dependency,
+    dependency_id: DependencyID,
+    name_hash: PackageNameHash,
+    name: SemverString,
+) -> bool {
+    let string_buf = this.lockfile.buffers.string_bytes.as_slice();
+    (this.is_update_request(dependency.name_hash, dependency.name.slice(string_buf))
+        || (name_hash != dependency.name_hash
+            && this.is_update_request(name_hash, name.slice(string_buf))))
+        && crate::update_scope::UpdateScope::of(this)
+            .contains_dependency(&this.lockfile, dependency_id)
+}
+
 /// `--latest` never moves a row below what bun.lock already has (e.g. a prerelease or a version ahead of the tag).
 pub(crate) fn keep_locked_if_ahead<'m>(
     manifest: &'m Npm::PackageManifest,
diff --git a/src/install/update_transitive.rs b/src/install/update_transitive.rs
index f1aaca618b37..663482fca83f 100644
--- a/src/install/update_transitive.rs
+++ b/src/install/update_transitive.rs
@@ -15,7 +15,7 @@ use crate::lockfile::{Lockfile, PackageIndexEntry};
 use crate::npm::{MinimumReleaseAgeExcludes, PackageManifest};
 use crate::package_manager::Options::LogLevel;
 use crate::package_manager::ROOT_PACKAGE_JSON_PATH;
-use crate::package_manager_real::enqueue::keep_locked_if_ahead;
+use crate::package_manager_real::enqueue::{is_named_update_row, keep_locked_if_ahead};
 use crate::package_manager_real::populate_manifest_cache::{self, Packages};
 use crate::package_manager_real::{PackageUpdateInfo, enqueue_dependency_with_main};
 use crate::update_scope::UpdateScope;
@@ -1385,6 +1385,9 @@ fn edges_on_instances(
 ) -> (Vec<Vec<DependencyID>>, Vec<DirectRows>) {
     struct DirectRow {
         dep_id: DependencyID,
+        /// The effective version's package name.
+        name: Semver::String,
+        name_hash: PackageNameHash,
         inst: u32,
         /// Slot of the instance the row currently resolves to, `u32::MAX` when unresolved or unplanned.
         res_slot: u32,
@@ -1500,6 +1503,8 @@ fn edges_on_instances(
                     {
                         direct_rows.push(DirectRow {
                             dep_id: row as DependencyID,
+                            name: names,
+                            name_hash: row_hash,
                             inst: i as u32,
                             res_slot,
                             locked,
@@ -1540,7 +1545,8 @@ fn edges_on_instances(
                         .is_root_dependency(unsafe { &mut *this_ptr }, row.dep_id)
                 }
         } else {
-            named_row_in_scope(manager, row.dep_id)
+            let dep = &manager.lockfile.buffers.dependencies[row.dep_id as usize];
+            is_named_update_row(manager, dep, row.dep_id, row.name_hash, row.name)
         };
         if !reresolves {
             // The row keeps its locked resolution, so it sits on exactly that instance; only the redirect can carry it.
@@ -1621,25 +1627,6 @@ fn snapshot_resolution(
         .map(|row| row.2)
 }
 
-/// Mirrors `should_update`'s named branch: the row names a requested package and sits in the update scope.
-fn named_row_in_scope(manager: &PackageManager, dep_id: DependencyID) -> bool {
-    let lockfile: &Lockfile = &manager.lockfile;
-    let buf = lockfile.buffers.string_bytes.as_slice();
-    let dep = &lockfile.buffers.dependencies[dep_id as usize];
-    let aliased =
-        dedupe::effective_version(lockfile, dep_id, dep).and_then(|version| match version.tag {
-            DependencyVersionTag::Npm => Some(version.npm().name),
-            DependencyVersionTag::DistTag => Some(version.dist_tag().name),
-            _ => None,
-        });
-    let named = manager.is_update_request(dep.name_hash, dep.name.slice(buf))
-        || aliased.is_some_and(|name| {
-            let hash = Semver::string::Builder::string_hash(name.slice(buf));
-            hash != dep.name_hash && manager.is_update_request(hash, name.slice(buf))
-        });
-    named && UpdateScope::of(manager).contains_dependency(lockfile, dep_id)
-}
-
 /// The release the differ lands this row on (with whether it lives in the manifest buffer): the patched capture, or the lookup (`latest` dist-tag for `--latest` target rows, else the row's own range or tag) through `keep_locked_if_ahead`.
 fn direct_row_landing(
     lockfile: &Lockfile,

From ed69d51b54ed1a7724600c779dbed4a3b3d48a21 Mon Sep 17 00:00:00 2001
From: Jarred Sumner <jarred@jarredsumner.com>
Date: Mon, 17 Aug 2026 05:49:28 +0000
Subject: [PATCH 226/258] simplify(s1-resolver): runTasks manifest-fallback
 helpers as free fns only, note lookup inline

(cherry picked from commit b280274d1219cb5e27a414346d1179e6e2881daa)
---
 .../PackageManager/PackageManagerEnqueue.rs   |  22 +++-
 src/install/PackageManager/runTasks.rs        | 121 +++++-------------
 2 files changed, 44 insertions(+), 99 deletions(-)

diff --git a/src/install/PackageManager/PackageManagerEnqueue.rs b/src/install/PackageManager/PackageManagerEnqueue.rs
index 12762c8109c2..a72daeef720f 100644
--- a/src/install/PackageManager/PackageManagerEnqueue.rs
+++ b/src/install/PackageManager/PackageManagerEnqueue.rs
@@ -1057,9 +1057,13 @@ pub fn enqueue_dependency_with_main_and_success_fn(
                         }
 
                         if !dependency.behavior.is_peer() || install_peer {
-                            let needs_extended_manifest =
-                                this.needs_extended_manifest(dependency.behavior, task_id);
-                            if !this.has_created_manifest_task(
+                            let needs_extended_manifest = run_tasks::needs_extended_manifest(
+                                this,
+                                dependency.behavior,
+                                task_id,
+                            );
+                            if !run_tasks::has_created_manifest_task(
+                                this,
                                 task_id,
                                 dependency.behavior.is_required(),
                                 needs_extended_manifest,
@@ -1134,7 +1138,8 @@ pub fn enqueue_dependency_with_main_and_success_fn(
                                                         // Reported by the `TooRecentVersion` arm above, like a fresh manifest would be.
                                                         resolve_result_ =
                                                             Err(crate::Error::TooRecentVersion);
-                                                        this.manifest_request_not_sent(
+                                                        run_tasks::manifest_request_not_sent(
+                                                            this,
                                                             task_id,
                                                             needs_extended_manifest,
                                                         );
@@ -1169,7 +1174,8 @@ pub fn enqueue_dependency_with_main_and_success_fn(
                                                     .flatten()
                                                 {
                                                     resolve_result_ = Ok(Some(new_resolve_result));
-                                                    this.manifest_request_not_sent(
+                                                    run_tasks::manifest_request_not_sent(
+                                                        this,
                                                         task_id,
                                                         needs_extended_manifest,
                                                     );
@@ -1181,7 +1187,8 @@ pub fn enqueue_dependency_with_main_and_success_fn(
                                         // Was it recent enough to just load it without the network call?
                                         if this.options.enable.manifest_cache_control() && !expired
                                         {
-                                            this.manifest_request_not_sent(
+                                            run_tasks::manifest_request_not_sent(
+                                                this,
                                                 task_id,
                                                 needs_extended_manifest,
                                             );
@@ -2522,7 +2529,8 @@ fn get_or_put_resolved_package(
             // materializing `&mut *this_ptr` after `name_str`/`scope` are
             // derived from it would pop their borrow-stack tags under SB.
             let cache_ctx = this.manifest_disk_cache_ctx();
-            let needs_ext = this.needs_extended_manifest(
+            let needs_ext = run_tasks::needs_extended_manifest(
+                this,
                 behavior,
                 Task::Id::for_manifest(this.lockfile.str(&name)),
             );
diff --git a/src/install/PackageManager/runTasks.rs b/src/install/PackageManager/runTasks.rs
index 18d80abdf566..03f2bc46bd75 100644
--- a/src/install/PackageManager/runTasks.rs
+++ b/src/install/PackageManager/runTasks.rs
@@ -421,13 +421,11 @@ pub fn run_tasks<C: RunTasksCallbacks>(
                     .metadata
                     .as_ref()
                     .is_none_or(|metadata| metadata.response.status_code > 399);
-                // Only while resolving: the manifests-only callers (lockfile
-                // migrations, `bun outdated`, ...) have nothing waiting that
-                // could fall back, so for them a failed request is just that.
+                // Manifests-only callers (migrations, `bun outdated`) have nothing waiting that could fall back.
                 if request_failed
                     && is_extended_manifest
                     && !C::MANIFESTS_ONLY
-                    && manager.fall_back_to_abbreviated_manifest(task.task_id)
+                    && fall_back_to_abbreviated_manifest(manager, task.task_id)
                 {
                     let reason = match task.response.metadata.as_ref() {
                         Some(metadata) => format!("HTTP {}", metadata.response.status_code),
@@ -522,13 +520,15 @@ pub fn run_tasks<C: RunTasksCallbacks>(
                         continue;
                     }
 
-                    let note = http_status_note(
-                        manager,
-                        response.status_code,
-                        name,
-                        &task.url_buf,
-                        RequestKind::Manifest,
-                    );
+                    // What to configure, on 401/403.
+                    let note = match response.status_code {
+                        401 | 403 => manager.options.missing_credentials_note(
+                            name,
+                            &task.url_buf,
+                            RequestKind::Manifest,
+                        ),
+                        _ => Vec::new(),
+                    };
                     if manager.is_network_task_required(task.task_id) {
                         bun_ast::add_error_pretty!(
                             manager.log_mut(),
@@ -876,13 +876,14 @@ pub fn run_tasks<C: RunTasksCallbacks>(
                         continue;
                     }
 
-                    let note = http_status_note(
-                        manager,
-                        response.status_code,
-                        extract.name.slice(),
-                        &task.url_buf,
-                        RequestKind::Tarball(task.authorization),
-                    );
+                    let note = match response.status_code {
+                        401 | 403 => manager.options.missing_credentials_note(
+                            extract.name.slice(),
+                            &task.url_buf,
+                            RequestKind::Tarball(task.authorization),
+                        ),
+                        _ => Vec::new(),
+                    };
                     if is_required {
                         bun_ast::add_error_pretty!(
                             manager.log_mut(),
@@ -1613,24 +1614,6 @@ pub fn run_tasks<C: RunTasksCallbacks>(
     Ok(())
 }
 
-/// Extra line for the `GET <url> - <status>` message: on 401/403, what the
-/// user can configure to authenticate the request (see
-/// `Options::missing_credentials_note`); empty for every other status.
-fn http_status_note(
-    manager: &PackageManager,
-    status_code: u32,
-    package_name: &[u8],
-    url: &[u8],
-    request: RequestKind,
-) -> Vec<u8> {
-    match status_code {
-        401 | 403 => manager
-            .options
-            .missing_credentials_note(package_name, url, request),
-        _ => Vec::new(),
-    }
-}
-
 #[inline]
 pub fn pending_task_count(manager: &PackageManager) -> u32 {
     manager.pending_tasks.load(Ordering::Acquire)
@@ -1814,13 +1797,8 @@ pub fn has_created_network_task(
     gpe.found_existing
 }
 
-/// `has_created_network_task` for manifest requests, which are deduplicated per
-/// document: a package that is a regular dependency of one package and an
-/// optional dependency of another is requested both ways, whichever of the two
-/// dependencies comes first, since the abbreviated document does not cover the
-/// dependency that needs the extended one (see
-/// `PackageManager::needs_extended_manifest`). Both responses drain the same
-/// `task_queue` entry and `PackageManifestMap::insert` keeps the extended one.
+/// `has_created_network_task` per manifest document (abbreviated or extended, see `needs_extended_manifest`);
+/// both responses drain the same `task_queue` entry and `PackageManifestMap::insert` keeps the extended one.
 pub fn has_created_manifest_task(
     this: &mut PackageManager,
     task_id: Task::Id,
@@ -1835,11 +1813,8 @@ pub fn has_created_manifest_task(
     core::mem::replace(entry.manifest_requested(needs_extended_manifest), true)
 }
 
-/// The caller of `has_created_manifest_task` resolved from the manifest cache
-/// instead of sending the request it was cleared to send. Forget that request;
-/// the entry stays as long as it records anything else (a request of the other
-/// kind that is in flight, or a failed extended request), otherwise a later
-/// dependency would request that document again or wait for it.
+/// The caller of `has_created_manifest_task` resolved from the cache instead of sending the request;
+/// the entry stays while it records anything else (the other kind in flight, a failed extended request).
 pub fn manifest_request_not_sent(
     this: &mut PackageManager,
     task_id: Task::Id,
@@ -1857,11 +1832,8 @@ pub fn manifest_request_not_sent(
     }
 }
 
-/// `Options::needs_extended_manifest`, unless the extended request for this
-/// package has failed and the abbreviated one stands in for it
-/// (`fall_back_to_abbreviated_manifest`). Every lookup on the resolve path goes
-/// through this so that dependencies enqueued after the failure resolve from the
-/// abbreviated document too instead of waiting for a response that is not coming.
+/// `Options::needs_extended_manifest`, unless the extended request failed and the abbreviated document
+/// stands in (`fall_back_to_abbreviated_manifest`); every lookup on the resolve path goes through this.
 pub fn needs_extended_manifest(
     this: &PackageManager,
     dependency: Behavior,
@@ -1877,17 +1849,9 @@ pub fn needs_extended_manifest(
             .is_some_and(|entry| entry.extended_manifest_failed)
 }
 
-/// Called when the request for the extended document of a manifest has failed
-/// for good. From then on the package behaves as it did before libc was read:
-/// every dependency on it resolves from the abbreviated document, losing only
-/// the `libc` filtering of this one package. The caller re-enqueues the
-/// dependencies that were waiting for the extended document; each of them then
-/// resolves from the abbreviated document if it is cached or was requested as
-/// well, and otherwise the first of them requests it (`has_created_manifest_task`
-/// dedupes that request), whose failure is then reported like that of any other
-/// manifest. Returns false when there is nothing to fall back to because the
-/// extended document is what versions are picked from (`minimumReleaseAge`):
-/// the abbreviated one has no publish times.
+/// The extended request failed for good: dependencies on the package resolve from the abbreviated document
+/// from now on (losing its `libc` filtering); the caller re-enqueues the waiting ones. False when versions are
+/// picked from the extended document (`minimumReleaseAge` needs its publish times).
 pub fn fall_back_to_abbreviated_manifest(this: &mut PackageManager, task_id: Task::Id) -> bool {
     if this.options.needs_extended_manifest_to_pick_versions() {
         return false;
@@ -2088,31 +2052,6 @@ impl PackageManager {
         has_created_network_task(self, task_id, is_required)
     }
     #[inline]
-    pub(crate) fn has_created_manifest_task(
-        &mut self,
-        task_id: Task::Id,
-        is_required: bool,
-        needs_extended_manifest: bool,
-    ) -> bool {
-        has_created_manifest_task(self, task_id, is_required, needs_extended_manifest)
-    }
-    #[inline]
-    pub(crate) fn manifest_request_not_sent(
-        &mut self,
-        task_id: Task::Id,
-        needs_extended_manifest: bool,
-    ) {
-        manifest_request_not_sent(self, task_id, needs_extended_manifest)
-    }
-    #[inline]
-    pub(crate) fn needs_extended_manifest(&self, dependency: Behavior, task_id: Task::Id) -> bool {
-        needs_extended_manifest(self, dependency, task_id)
-    }
-    #[inline]
-    pub(crate) fn fall_back_to_abbreviated_manifest(&mut self, task_id: Task::Id) -> bool {
-        fall_back_to_abbreviated_manifest(self, task_id)
-    }
-    #[inline]
     pub(crate) fn is_network_task_required(&self, task_id: Task::Id) -> bool {
         is_network_task_required(self, task_id)
     }
@@ -2134,9 +2073,7 @@ impl PackageManager {
     }
 }
 
-/// Resolves the dependencies waiting for the manifest with this task id. A
-/// dependency that still cannot be resolved (it needs the extended document and
-/// the response was the abbreviated one) queues itself up again.
+/// Resolves the rows waiting for this manifest; one that needs the extended document re-queues itself on the abbreviated one.
 fn process_manifest_task_queue<C: RunTasksCallbacks>(
     manager: &mut PackageManager,
     task_id: Task::Id,

From e5231028b83fbd6b32baf046a369829faa984907 Mon Sep 17 00:00:00 2001
From: Jarred Sumner <jarred@jarredsumner.com>
Date: Mon, 17 Aug 2026 05:51:01 +0000
Subject: [PATCH 227/258] simplify(s1-resolver): Tree.rs comment trims;
 bind_peer relies on deferred_peer_range's peer check

(cherry picked from commit 8016bbd26a2938cf4d978eaf9981d116a30f1fd3)
---
 src/install/lockfile/Tree.rs | 25 +++++++------------------
 1 file changed, 7 insertions(+), 18 deletions(-)

diff --git a/src/install/lockfile/Tree.rs b/src/install/lockfile/Tree.rs
index ad2653dea245..3bb151a6a045 100644
--- a/src/install/lockfile/Tree.rs
+++ b/src/install/lockfile/Tree.rs
@@ -528,14 +528,10 @@ impl<'a, const METHOD: BuilderMethod> Builder<'a, METHOD> {
     /// Binds a peer edge the way loading `bun.lock` does, whatever the resolver, a previous
     /// lockfile or a migration left it bound to, so every tree built from these packages agrees.
     fn bind_peer(&mut self, dep_id: DependencyID) {
-        let dependency: &Dependency = &self.dependencies[dep_id as usize];
-        if !dependency.behavior.is_peer() {
-            return;
-        }
         let lockfile_ref = self.lockfile;
         let lockfile: &Lockfile = lockfile_ref.get();
         if let Some(pkg_id) = bun_lock::resolve_peer_dep_version_based(
-            dependency,
+            &self.dependencies[dep_id as usize],
             &lockfile.catalogs,
             &lockfile.package_index,
             &lockfile.overrides,
@@ -709,10 +705,8 @@ impl Tree {
             return Ok(());
         }
 
-        // Below another copy of itself, a package's dependencies are already placed; laying
-        // them out again only re-nests what the levels in between shadow, which for a cycle
-        // through two versions (a@1 -> b@1 -> a@2 -> b@2 -> a@1 ...) never ends. npm stops
-        // here as well (linking to the copy above); bun.lock.rs skips these copies to match.
+        // Below another copy of itself a package's dependencies are already placed; a cycle through two
+        // versions (a@1 -> b@1 -> a@2 -> b@2 ...) would re-nest forever. bun.lock.rs skips these copies too.
         {
             let trees = builder.list.items_tree();
             let mut ancestor_id = self.id;
@@ -824,8 +818,7 @@ impl Tree {
             // don't treat it as unsafe — match the lockfile parser and isolated
             // installer (`bun.lock.rs`, `isolated_install.rs`) which guard
             // `!name.is_empty()` here rather than failing the whole install.
-            // Neither does an unresolved dependency, and if its name is why it
-            // did not resolve, enqueue already reported it.
+            // An unresolved dependency's name was already reported by enqueue if it is why.
             let dependency_name = dependency
                 .name
                 .slice(lockfile.buffers.string_bytes.as_slice());
@@ -850,10 +843,7 @@ impl Tree {
                 }
 
                 if pkg_id == invalid_package_id {
-                    // An unbound peer (optional, or one a migration had nothing recorded for)
-                    // binds to the copy next to or above its dependent, which is where loading
-                    // the saved bun.lock binds it (`PkgMap::find_resolution`); the isolated
-                    // store keys the dependent by that binding.
+                    // An unbound peer binds to the copy next to or above its dependent, as loading bun.lock does.
                     if dependency.behavior.is_peer() {
                         break 'hoisted Tree::hoist_dependency::<true, METHOD>(
                             next_id,
@@ -1176,9 +1166,8 @@ impl Tree {
             return HoistDependencyResult::DependencyLoop; // 3
         }
 
-        // A bundled root's walk ends below the folder holding the bundling package, which is
-        // resolvable from inside it; a bundled dependency depending back on it would otherwise
-        // copy it into itself, and the copy's bundled dependencies bring it back, forever.
+        // A bundled dependency depending back on the bundling package resolves it from inside; copying it
+        // into itself would recurse forever.
         if (this.dependency_id as usize) < deps.len()
             && builder.resolutions[this.dependency_id as usize] == package_id
             && deps[this.dependency_id as usize].name_hash == target_name_hash

From e212fd69d56889450f65f768a252e9d871057cbe Mon Sep 17 00:00:00 2001
From: Jarred Sumner <jarred@jarredsumner.com>
Date: Mon, 17 Aug 2026 05:55:36 +0000
Subject: [PATCH 228/258] simplify(s1-resolver): bun.lock.rs: fold FoundAt into
 RowEvidence, WorkspaceLinks into a closure over map_dep_to_pkg

(cherry picked from commit 5655ffce1ee96ff441108c24eb580499a7702f93)
---
 src/install/lockfile/bun.lock.rs | 214 ++++++++++---------------------
 1 file changed, 65 insertions(+), 149 deletions(-)

diff --git a/src/install/lockfile/bun.lock.rs b/src/install/lockfile/bun.lock.rs
index 050f002e5717..631a7cd6181d 100644
--- a/src/install/lockfile/bun.lock.rs
+++ b/src/install/lockfile/bun.lock.rs
@@ -1647,34 +1647,16 @@ pub(crate) enum ResolveError {
     Unresolvable,
 }
 
-/// Where `PkgMap::find_resolution` found the entry it returned.
-#[derive(Debug, Clone, Copy, Eq, PartialEq)]
-enum FoundAt {
-    /// `<pkg_path>/<name>`.
-    OwnPath,
-    /// `<some enclosing path>/<name>`.
-    EnclosingPath,
-    /// The top-level `<name>` entry.
-    Root,
-}
-
-/// Which row binds an edge of a package printed at more than one path. `append_package_dedupe`
-/// gives every such row the same package, so each row binds the same edges again, and the
-/// rows can walk into different copies of a peer. A row overwrites an earlier row's binding
-/// only when its find says at least as much about the binding; rows whose finds say the same
-/// keep the last one, and a package printed once binds each edge exactly once, as before.
-///
-/// What a find says follows from where `Tree::hoist_dependency` puts the package an edge is
-/// bound to: nested in the dependent's own path when a copy above blocks it, or at the root
-/// when nothing above holds the name. It never ends up at an enclosing path in between; a copy
-/// found there was placed for another package's edge, and this edge deduped onto it (a peer
-/// the copy satisfies), which says nothing about what the edge is bound to.
+/// Which row's `find_resolution` binds an edge of a package printed at several paths (each row
+/// binds the same edges again and can walk into a different copy of a peer): a row overwrites an
+/// earlier binding only with at least as much evidence. `Tree::hoist_dependency` puts an edge's
+/// target in the dependent's own path or at the root, never at an enclosing path in between (a
+/// copy there was placed for another edge and this one merely deduped onto it).
 #[derive(Debug, Clone, Copy, Eq, PartialEq, PartialOrd, Ord)]
 enum RowEvidence {
     Unbound,
-    /// A copy found by walking up. Every walked find of an optional peer ranks here: the
-    /// hoister rebinds those to whatever each placement dedupes onto
-    /// (`HoistDependencyResult::Rebind`), so which copy a row walked into decides nothing.
+    /// Found by walking up; every walked find of an optional peer too, since the hoister rebinds
+    /// those to whatever each placement dedupes onto (`HoistDependencyResult::Rebind`).
     Walked,
     /// The root's copy, which may be this edge's own binding, placed there from this row.
     WalkedToRoot,
@@ -1682,16 +1664,6 @@ enum RowEvidence {
     OwnEntry,
 }
 
-impl RowEvidence {
-    fn of(found_at: FoundAt, dep: &Dependency) -> RowEvidence {
-        match found_at {
-            FoundAt::OwnPath => RowEvidence::OwnEntry,
-            FoundAt::Root if !dep.behavior.is_optional_peer() => RowEvidence::WalkedToRoot,
-            FoundAt::Root | FoundAt::EnclosingPath => RowEvidence::Walked,
-        }
-    }
-}
-
 impl<T> PkgMap<T> {
     // No `Entry` alias — inherent associated types are
     // unstable; callers name `T` directly.
@@ -1732,7 +1704,7 @@ impl<T> PkgMap<T> {
         dep: &Dependency,
         string_buf: &[u8],
         path_buf: &mut [u8],
-    ) -> Result<(&T, FoundAt), ResolveError> {
+    ) -> Result<(&T, RowEvidence), ResolveError> {
         self.find_resolution_impl(pkg_path, dep, string_buf, path_buf, None)
     }
 
@@ -1753,7 +1725,7 @@ impl<T> PkgMap<T> {
         string_buf: &[u8],
         path_buf: &mut [u8],
         bundled_pkgs: &PkgPathSet,
-    ) -> Result<(&T, FoundAt), ResolveError> {
+    ) -> Result<(&T, RowEvidence), ResolveError> {
         self.find_resolution_impl(pkg_path, dep, string_buf, path_buf, Some(bundled_pkgs))
     }
 
@@ -1764,7 +1736,7 @@ impl<T> PkgMap<T> {
         string_buf: &[u8],
         path_buf: &mut [u8],
         bundled_pkgs: Option<&PkgPathSet>,
-    ) -> Result<(&T, FoundAt), ResolveError> {
+    ) -> Result<(&T, RowEvidence), ResolveError> {
         let dep_name = dep.name.slice(string_buf);
 
         if pkg_path.len() + 1 + dep_name.len() > path_buf.len() {
@@ -1783,14 +1755,14 @@ impl<T> PkgMap<T> {
             let res_path = &path_buf[0..offset + dep_name.len()];
 
             if let Some(entry) = self.map.get(res_path) {
-                let found_at = if own_path {
-                    FoundAt::OwnPath
-                } else if offset == 0 {
-                    FoundAt::Root
+                let evidence = if own_path {
+                    RowEvidence::OwnEntry
+                } else if offset == 0 && !dep.behavior.is_optional_peer() {
+                    RowEvidence::WalkedToRoot
                 } else {
-                    FoundAt::EnclosingPath
+                    RowEvidence::Walked
                 };
-                return Ok((entry, found_at));
+                return Ok((entry, evidence));
             }
 
             if offset == 0 || at_bundle_root {
@@ -3125,14 +3097,40 @@ pub(crate) fn parse_into_binary_lockfile(
         let dependencies: &mut [Dependency] = buffers.dependencies.as_mut_slice();
         let resolutions: &mut [PackageID] = buffers.resolutions.as_mut_slice();
 
-        let workspace_links = WorkspaceLinks {
-            pkg_names,
-            pkg_name_hashes,
-            workspace_versions,
-            catalogs,
-            overrides,
-            string_buf,
-            link_workspace_packages,
+        // Whether `Package::parse_dependency` links `dep` to the workspace bun.lock bound it to, so
+        // `Diff::generate` sees the loaded and parsed rows as equal. With `linkWorkspacePackages` off it
+        // links no range (a range still bound to a workspace is loaded as linked so the diff re-resolves
+        // it); peers, overridden entries (never `npm:` aliases) and dist-tags bind to a workspace either way.
+        let links_workspace = |dep: &Dependency, workspace_pkg_id: PackageID| -> bool {
+            if dep.version.tag == DependencyVersionTag::Workspace {
+                return true;
+            }
+            let is_alias =
+                dep.version.tag == DependencyVersionTag::Npm && dep.version.npm().is_alias;
+            let range = if link_workspace_packages {
+                &dep.version
+            } else if dep.behavior.is_peer()
+                || (!is_alias && overrides.has_rule_for_name(dep.name_hash))
+            {
+                return false;
+            } else {
+                catalogs.resolve_range(string_buf, dep)
+            };
+            if range.tag != DependencyVersionTag::Npm {
+                return false;
+            }
+            let npm = range.npm();
+            let workspace_pkg = workspace_pkg_id as usize;
+            // `workspace_versions` and a peer's binding are keyed by name hash; the names must match too.
+            npm.name
+                .eql(pkg_names[workspace_pkg], string_buf, string_buf)
+                && (!link_workspace_packages
+                    || workspace_versions
+                        .get(&pkg_name_hashes[workspace_pkg])
+                        .is_some_and(|workspace_version| {
+                            npm.version
+                                .satisfies(*workspace_version, string_buf, string_buf)
+                        }))
         };
 
         {
@@ -3167,14 +3165,14 @@ pub(crate) fn parse_into_binary_lockfile(
                     return Err(ParseError::InvalidPackageInfo);
                 };
 
-                map_manifest_dep_to_pkg(
+                map_dep_to_pkg(
                     dep,
                     dep_id,
                     res_id,
                     resolutions,
                     lockfile_version,
                     pkg_resolutions,
-                    &workspace_links,
+                    links_workspace,
                 );
             }
         }
@@ -3243,14 +3241,14 @@ pub(crate) fn parse_into_binary_lockfile(
                         return Err(ParseError::InvalidPackageInfo);
                     };
 
-                    map_manifest_dep_to_pkg(
+                    map_dep_to_pkg(
                         dep,
                         dep_id,
                         res_id,
                         resolutions,
                         lockfile_version,
                         pkg_resolutions,
-                        &workspace_links,
+                        links_workspace,
                     );
                 }
             }
@@ -3321,8 +3319,7 @@ pub(crate) fn parse_into_binary_lockfile(
                             pkg_map.find_resolution(pkg_path, dep, string_buf, &mut path_buf[..])
                         };
                         match found {
-                            Ok((&id, found_at)) => {
-                                let evidence = RowEvidence::of(found_at, dep);
+                            Ok((&id, evidence)) => {
                                 if bound_by[dep_id as usize] > evidence {
                                     continue 'deps;
                                 }
@@ -3358,6 +3355,7 @@ pub(crate) fn parse_into_binary_lockfile(
                     resolutions,
                     lockfile_version,
                     pkg_resolutions,
+                    |_, _| true,
                 );
             }
         }
@@ -3578,11 +3576,16 @@ fn map_dep_to_pkg(
     resolutions: &mut [PackageID],
     text_lockfile_version: Version,
     pkg_resolutions: &[Resolution],
+    links_workspace: impl Fn(&Dependency, PackageID) -> bool,
 ) {
     resolutions[dep_id as usize] = pkg_id;
 
-    if text_lockfile_version != Version::V0 {
-        adopt_workspace_resolution(dep, &pkg_resolutions[pkg_id as usize]);
+    let res = &pkg_resolutions[pkg_id as usize];
+    if text_lockfile_version != Version::V0
+        && res.tag == ResolutionTag::Workspace
+        && links_workspace(dep, pkg_id)
+    {
+        adopt_workspace_resolution(dep, res);
     }
 }
 
@@ -3591,95 +3594,8 @@ fn may_stay_unresolved(dep: &Dependency) -> bool {
     dep.behavior.intersects(Behavior::OPTIONAL | Behavior::PEER)
 }
 
-fn map_manifest_dep_to_pkg(
-    dep: &mut Dependency,
-    dep_id: DependencyID,
-    pkg_id: PackageID,
-    resolutions: &mut [PackageID],
-    text_lockfile_version: Version,
-    pkg_resolutions: &[Resolution],
-    workspace_links: &WorkspaceLinks<'_>,
-) {
-    resolutions[dep_id as usize] = pkg_id;
-
-    if text_lockfile_version == Version::V0 {
-        return;
-    }
-
-    let res = &pkg_resolutions[pkg_id as usize];
-    if res.tag == ResolutionTag::Workspace && workspace_links.links(dep, pkg_id) {
-        adopt_workspace_resolution(dep, res);
-    }
-}
-
-struct WorkspaceLinks<'a> {
-    pkg_names: &'a [String],
-    pkg_name_hashes: &'a [PackageNameHash],
-    workspace_versions: &'a VersionHashMap,
-    catalogs: &'a CatalogMap,
-    overrides: &'a OverrideMap,
-    string_buf: &'a [u8],
-    link_workspace_packages: bool,
-}
-
-impl WorkspaceLinks<'_> {
-    /// Whether `Package::parse_dependency` links `dep` to the workspace `bun.lock`
-    /// bound it to, so that `Diff::generate` sees the loaded and the parsed
-    /// dependency as equal. With `linkWorkspacePackages` off it links no range, and
-    /// a range still bound to a workspace is loaded as linked on purpose: the diff
-    /// re-resolves it. Peers, overridden entries and dist-tags bind to a workspace
-    /// either way.
-    fn links(&self, dep: &Dependency, workspace_pkg_id: PackageID) -> bool {
-        if dep.version.tag == DependencyVersionTag::Workspace {
-            return true;
-        }
-
-        let range = if self.link_workspace_packages {
-            &dep.version
-        } else {
-            if dep.behavior.is_peer() || self.overridden(dep) {
-                return false;
-            }
-            self.catalogs.resolve_range(self.string_buf, dep)
-        };
-        if range.tag != DependencyVersionTag::Npm {
-            return false;
-        }
-
-        let npm = range.npm();
-        let workspace_pkg = workspace_pkg_id as usize;
-        // `workspace_versions` and a peer's binding are keyed by name hash; the
-        // names themselves have to match as well.
-        if !npm.name.eql(
-            self.pkg_names[workspace_pkg],
-            self.string_buf,
-            self.string_buf,
-        ) {
-            return false;
-        }
-
-        !self.link_workspace_packages
-            || self
-                .workspace_versions
-                .get(&self.pkg_name_hashes[workspace_pkg])
-                .is_some_and(|workspace_version| {
-                    npm.version
-                        .satisfies(*workspace_version, self.string_buf, self.string_buf)
-                })
-    }
-
-    /// Same exemption as `enqueue_dependency_with_main_and_success_fn`: an `npm:`
-    /// alias is never overridden.
-    fn overridden(&self, dep: &Dependency) -> bool {
-        let is_alias = dep.version.tag == DependencyVersionTag::Npm && dep.version.npm().is_alias;
-        !is_alias && self.overrides.has_rule_for_name(dep.name_hash)
-    }
-}
-
-/// An edge bound to a workspace member takes the shape `Package::parse_dependency`
-/// gives it (`workspace` tag carrying the member's path, literal kept), so the
-/// differ compares equal against a fresh package.json parse. Other targets leave
-/// the edge as parsed.
+/// An edge bound to a workspace member takes the shape `Package::parse_dependency` gives it (`workspace`
+/// tag carrying the member's path, literal kept), so the differ compares equal against a fresh parse.
 pub(crate) fn adopt_workspace_resolution(dep: &mut Dependency, res: &Resolution) {
     if res.tag != ResolutionTag::Workspace {
         return;

From 7e92966df3d1a1aaaef66a494857ef0b0a5f7d50 Mon Sep 17 00:00:00 2001
From: Jarred Sumner <jarred@jarredsumner.com>
Date: Mon, 17 Aug 2026 05:56:51 +0000
Subject: [PATCH 229/258] simplify(s1-resolver): bun.lock.rs comment trims

(cherry picked from commit cdee51e544076c9faeab85ae9a604fabea290ea0)
---
 src/install/lockfile/bun.lock.rs | 40 +++++++++-----------------------
 1 file changed, 11 insertions(+), 29 deletions(-)

diff --git a/src/install/lockfile/bun.lock.rs b/src/install/lockfile/bun.lock.rs
index 631a7cd6181d..5dd99039da79 100644
--- a/src/install/lockfile/bun.lock.rs
+++ b/src/install/lockfile/bun.lock.rs
@@ -1166,9 +1166,7 @@ impl Stringifier {
             Negatable::<Npm::Architecture>::to_json(meta.arch, &mut AsFmt::new(writer))?;
         }
 
-        // Undeclared and "both" are the same thing at install time, so only a
-        // restriction to one libc is written. `Negatable::to_json` would spell
-        // it as the negation of the other one ("!musl"); the name is clearer.
+        // Only a restriction to one libc matters at install time; written by name rather than `Negatable`'s "!musl".
         if let Some(libc) = meta.libc.single_name() {
             if any {
                 writer.write_byte(b',')?;
@@ -3254,11 +3252,8 @@ pub(crate) fn parse_into_binary_lockfile(
             }
         }
 
-        // then each package dependency
-        //
-        // A package printed at several paths comes through here once per path; see
-        // `RowEvidence` for which path's find an edge ends up bound to. Edges bound by
-        // version below do not depend on the path, so every row writes them.
+        // then each package dependency; a package printed at several paths comes through once per
+        // path (see `RowEvidence`; edges bound by version do not depend on the path).
         let mut bound_by: Vec<RowEvidence> = vec![RowEvidence::Unbound; dependencies.len()];
         for row in pkg_rows {
             let pkg_path = row.key.slice();
@@ -3274,9 +3269,8 @@ pub(crate) fn parse_into_binary_lockfile(
                 continue;
             }
 
-            // A copy below another copy of its package has no node_modules of its own
-            // (`Tree::process_subtree`), so walking up from it finds the versions it sits
-            // under rather than the package's resolutions; the copy above binds those.
+            // A copy below another copy of itself has no node_modules of its own (`Tree::process_subtree`);
+            // the copy above binds the package's edges.
             if pkg_map.is_below_copy_of(pkg_path, pkg_id) {
                 continue;
             }
@@ -3368,13 +3362,9 @@ pub(crate) fn parse_into_binary_lockfile(
     Ok(())
 }
 
-/// The catalog-resolved range of a peer edge the fresh resolver binds by
-/// version in its `install_peer` pass. Two exemptions keep the printed tree's
-/// path walk, which reproduces their saved binding exactly: optional peers are
-/// bound to the hoisted-tree sibling by `process_subtree` instead, and a bundled
-/// peer is always placed under its own package by `process_subtree`, so its
-/// entry is always printed and, like every other bundled edge (`bun update` and
-/// dedupe hold them in place too), it stays on the version recorded there.
+/// The catalog-resolved range of a peer edge the fresh resolver binds by version in its `install_peer`
+/// pass. Optional peers (bound to the hoisted-tree sibling by `process_subtree`) and bundled peers (always
+/// printed under their own package) keep the path walk, which reproduces their saved binding exactly.
 fn deferred_peer_range<'a>(
     dep: &'a Dependency,
     catalogs: &'a CatalogMap,
@@ -3500,17 +3490,9 @@ pub(crate) fn resolve_peer_dep_by_range(
     })
 }
 
-/// Call after hoisting. The printed tree is the lockfile's only record of which packages
-/// exist, and a package whose incoming edges are all ranged peers that `Tree::hoist_dependency`
-/// deduped onto another version of the same name is in no tree at all (pnpm's auto-installed
-/// peers arrive like this from pnpm-lock.yaml; adding a pinned version of a package that was
-/// only auto-installed for a peer creates the same shape). `resolve_peer_dep_version_based`
-/// therefore binds such edges to another package on reload, and the install that wrote the
-/// lockfile links something different from every install that reads it. Binding them here over
-/// the packages the print will contain makes the writing install match its readers.
-///
-/// Every edge rebound here was deduped during hoisting, so it is not in `hoisted_dependencies`
-/// and the tree stays valid; the old target is dropped by the next `clean_with_logger`.
+/// Call after hoisting: a package reached only by ranged peers the hoister deduped onto another version is
+/// in no tree, so a reload would bind those edges elsewhere; bind them now over the packages the print will
+/// contain. Such edges are not in `hoisted_dependencies`, so the tree stays valid; `clean` drops the old target.
 pub(crate) fn rebind_peers_to_printed_packages(
     lockfile: &mut BinaryLockfile,
 ) -> Result<(), bun_alloc::AllocError> {

From cfbf752473237433fe0c6fa457963a3807f5693b Mon Sep 17 00:00:00 2001
From: Jarred Sumner <jarred@jarredsumner.com>
Date: Mon, 17 Aug 2026 05:58:41 +0000
Subject: [PATCH 230/258] simplify(s1-resolver): one add_dependency_error for
 enqueue_dependency_list and the re-resolve loops; iwm comment trims

(cherry picked from commit cb676e27a95e53212221a0edc809fe26899f63e3)
---
 .../PackageManager/PackageManagerEnqueue.rs   | 68 ++++++++++---------
 .../PackageManager/install_with_manager.rs    | 61 +++--------------
 2 files changed, 45 insertions(+), 84 deletions(-)

diff --git a/src/install/PackageManager/PackageManagerEnqueue.rs b/src/install/PackageManager/PackageManagerEnqueue.rs
index a72daeef720f..2a7782ac21ee 100644
--- a/src/install/PackageManager/PackageManagerEnqueue.rs
+++ b/src/install/PackageManager/PackageManagerEnqueue.rs
@@ -98,37 +98,7 @@ pub fn enqueue_dependency_list(
         let dependency = this.lockfile.buffers.dependencies[i as usize].clone();
         let resolution = this.lockfile.buffers.resolutions[i as usize];
         if let Err(err) = enqueue_dependency_with_main(this, i, &dependency, resolution, false) {
-            let path_sep = match dependency.version.tag {
-                dependency::version::Tag::Folder => bun_fmt::PathSep::Auto,
-                _ => bun_fmt::PathSep::Any,
-            };
-            // `format_args!` borrows temporaries — bind the
-            // formatter first so it outlives the macro expansion.
-            let realname = dependency.realname();
-            let path_fmt = bun_fmt::EscapeControlChars(bun_fmt::fmt_path_u8(
-                this.lockfile.str(&realname),
-                bun_fmt::PathFormatOptions {
-                    path_sep,
-                    escape_backslashes: false,
-                },
-            ));
-            let log = this.log_mut();
-            if dependency.behavior.is_optional() || dependency.behavior.is_peer() {
-                log.add_warning_with_note(
-                    None,
-                    bun_ast::Loc::default(),
-                    err.name().as_bytes(),
-                    format_args!("error occurred while resolving {}", path_fmt),
-                );
-            } else {
-                log.add_zig_error_with_note(
-                    err.name(),
-                    format_args!("error occurred while resolving {}", path_fmt),
-                );
-            }
-
-            i += 1;
-            continue;
+            add_dependency_error(this, &dependency, err);
         }
         i += 1;
     }
@@ -136,6 +106,42 @@ pub fn enqueue_dependency_list(
     this.drain_dependency_list();
 }
 
+/// Logged to `this.log`; the install fails later when `has_errors()` is checked.
+#[cold]
+#[inline(never)]
+pub(crate) fn add_dependency_error(
+    this: &mut PackageManager,
+    dependency: &Dependency,
+    err: crate::Error,
+) {
+    let path_sep = match dependency.version.tag {
+        dependency::version::Tag::Folder => bun_fmt::PathSep::Auto,
+        _ => bun_fmt::PathSep::Any,
+    };
+    let realname = dependency.realname();
+    let path_fmt = bun_fmt::EscapeControlChars(bun_fmt::fmt_path_u8(
+        this.lockfile.str(&realname),
+        bun_fmt::PathFormatOptions {
+            path_sep,
+            escape_backslashes: false,
+        },
+    ));
+    let log = this.log_mut();
+    if dependency.behavior.is_optional() || dependency.behavior.is_peer() {
+        log.add_warning_with_note(
+            None,
+            bun_ast::Loc::default(),
+            err.name().as_bytes(),
+            format_args!("error occurred while resolving {}", path_fmt),
+        );
+    } else {
+        log.add_zig_error_with_note(
+            err.name(),
+            format_args!("error occurred while resolving {}", path_fmt),
+        );
+    }
+}
+
 pub fn enqueue_tarball_for_download(
     this: &mut PackageManager,
     dependency_id: DependencyID,
diff --git a/src/install/PackageManager/install_with_manager.rs b/src/install/PackageManager/install_with_manager.rs
index de33f1b76c86..fbd962b5dfe0 100644
--- a/src/install/PackageManager/install_with_manager.rs
+++ b/src/install/PackageManager/install_with_manager.rs
@@ -39,6 +39,7 @@ use bun_install_types::NodeLinker::NodeLinker;
 
 // Free-function "methods" on `PackageManager` hosted in sibling modules
 // to avoid one giant `impl PackageManager` block.
+use crate::package_manager_real::enqueue::add_dependency_error;
 use crate::package_manager_real::remove_stale_workspace_links::remove_stale_workspace_links;
 use crate::package_manager_real::run_tasks::{RunTasksCallbacks, run_tasks};
 use crate::package_manager_real::{
@@ -92,8 +93,7 @@ pub fn install_with_manager(
 
     // Snapshot the loaded-from-lockfile package count so
     // `Lockfile::get_package_id` can tell loaded pins apart from packages
-    // appended by manifest fetches in this resolve session, and which loaded
-    // packages a non-peer dependency holds, for `clean_with_logger`.
+    // appended by manifest fetches in this resolve session.
     manager.lockfile.mark_loaded_packages()?;
 
     let (config_version, changed_config_version) = load_result.choose_config_version();
@@ -1437,44 +1437,6 @@ pub(crate) fn loaded_lockfile_name(load_result: &lockfile::LoadResult) -> &'stat
     }
 }
 
-/// Adds a contextual error for a dependency resolution failure.
-/// This provides better error messages than just propagating the raw error.
-/// The error is logged to manager.log, and the install will fail later when
-/// manager.log.hasErrors() is checked.
-#[cold]
-#[inline(never)]
-fn add_dependency_error(manager: &mut PackageManager, dependency: &Dependency, err: crate::Error) {
-    // reshaped for borrowck — capture the realname slice before
-    // taking `&mut` on `manager.log`.
-    let realname = dependency.realname();
-    let path = manager.lockfile.str(&realname).to_vec();
-    let path_fmt = bun_core::fmt::EscapeControlChars(bun_core::fmt::fmt_path(
-        &path,
-        bun_core::fmt::PathFormatOptions {
-            path_sep: match dependency.version.tag {
-                DependencyVersionTag::Folder => bun_core::fmt::PathSep::Auto,
-                _ => bun_core::fmt::PathSep::Any,
-            },
-            ..Default::default()
-        },
-    ));
-
-    let log = manager.log_mut();
-    if dependency.behavior.is_optional() || dependency.behavior.is_peer() {
-        log.add_warning_with_note(
-            None,
-            Default::default(),
-            err.name().as_bytes(),
-            format_args!("error occurred while resolving {}", path_fmt),
-        );
-    } else {
-        log.add_zig_error_with_note(
-            err.name(),
-            format_args!("error occurred while resolving {}", path_fmt),
-        );
-    }
-}
-
 // ─── cold install branches ────────────────────────────────────────────────
 // These are the rarely-taken arms of `install_with_manager` (lockfile load
 // error reporting, building a brand-new lockfile, the network resolve loop,
@@ -1534,11 +1496,8 @@ fn enqueue_transitive(
     transitive.enqueue_tracked(manager)
 }
 
-/// Re-resolves the rows `selects`, walking each package's current dependency list in package order. The root's
-/// list (just rebuilt by the differ) goes first because a later row dedupes onto what an earlier one appended
-/// (`Lockfile::get_package_id`); the root's loaded rows, now in no list, would resolve as nobody's and are not
-/// walked, nor are `pinned_rows`, which the update plan just resolved. A workspace the add/update pass is about
-/// to re-read still holds its loaded list here and is walked like any other package.
+/// Re-resolves the rows `selects` in package order (root first, so later rows dedupe onto what its rows append),
+/// skipping rows in no list (the root's loaded rows the differ replaced) and `pinned_rows` (the update plan's).
 fn reresolve_owned_rows(
     manager: &mut PackageManager,
     pinned_rows: &DynamicBitSet,
@@ -1622,10 +1581,8 @@ fn enqueue_named_updates(
         rows.push((dependency_i as DependencyID, package_id));
     }
 
-    // Rows declared by the root or a workspace resolve first, so the rows regular
-    // packages own can land on the copy they move to (see
-    // `get_or_put_resolved_package_with_find_result`), and edges following a
-    // vacated package through `redirect_moved_edges` follow the direct entry.
+    // Direct rows resolve first, so rows regular packages own can land on the copy they move to
+    // (`get_or_put_resolved_package_with_find_result`) and redirected edges follow the direct entry.
     let (direct_rows, transitive_rows): (Vec<_>, Vec<_>) = rows
         .into_iter()
         .partition(|&(dependency_i, _)| manager.lockfile.is_workspace_dependency(dependency_i));
@@ -2191,10 +2148,8 @@ fn run_security_scanner(
     }
 }
 
-// The documented bun.lockb -> bun.lock recipe (`--save-text-lockfile --frozen-lockfile --lockfile-only`) is the one
-// write that happens while `Do::SAVE_LOCKFILE` is off (--frozen-lockfile, --dry-run, --no-save). A migrated
-// package-lock.json / yarn.lock / pnpm-lock.yaml is saved through `FORCE_SAVE_LOCKFILE` like any other change, so
-// those flags keep it in memory. (A migrated load can report `Format::Binary` too, hence the `migrated` check.)
+// bun.lockb -> bun.lock (`--save-text-lockfile --frozen-lockfile --lockfile-only`) is the one write while
+// `Do::SAVE_LOCKFILE` is off; migrations (which may report `Format::Binary` too) save via `FORCE_SAVE_LOCKFILE`.
 fn converts_binary_lockfile_to_text(
     load_result: &lockfile::LoadResult,
     save_format: lockfile::Format,

From 54bc94aca6d0477c3006bf1da153bf7d7d67c59c Mon Sep 17 00:00:00 2001
From: Jarred Sumner <jarred@jarredsumner.com>
Date: Mon, 17 Aug 2026 06:00:23 +0000
Subject: [PATCH 231/258] simplify(s1-resolver): Package.rs drops the name
 check is_safe_lockfile_package_name subsumes; dependency.rs trims

(cherry picked from commit 52f11087637146ffaca82549ccb00d890cf6f699)
---
 src/install/dependency.rs       | 26 ++++++++------------------
 src/install/lockfile/Package.rs | 10 ----------
 2 files changed, 8 insertions(+), 28 deletions(-)

diff --git a/src/install/dependency.rs b/src/install/dependency.rs
index 150a83333e1a..e4bf24a2d1c5 100644
--- a/src/install/dependency.rs
+++ b/src/install/dependency.rs
@@ -233,7 +233,7 @@ impl DependencyExt for Dependency {
                 Some(Semver::string::Builder::string_hash(
                     new_name.slice(out_slice),
                 )),
-                trim_literal(new_literal.slice(out_slice)),
+                new_literal.slice(out_slice),
                 self.version.tag,
                 &sliced,
                 None,
@@ -587,24 +587,15 @@ pub(crate) fn contains_control_character(name: &[u8]) -> bool {
     })
 }
 
-/// bun.lock stores a package as `"<name>@<resolution>"` and takes it apart again with
-/// `split_name_and_version`, then rejects names that fail `is_safe_install_folder_name`.
-/// A name containing any `@` other than a scope marker (`a@b`, `@s/a@b`) or failing that
-/// check would therefore be written out but could never be loaded back.
+/// A name bun.lock's `"<name>@<resolution>"` keys can round-trip: a safe folder name with no `@` past the scope marker.
 pub(crate) fn is_safe_lockfile_package_name(name: &[u8]) -> bool {
     is_safe_install_folder_name(name) && !strings::contains_char(&name[1..], b'@')
 }
 
-const FALLBACK_PACKAGE_NAME: &[u8] = b"unnamed-package";
-
-/// Name for a package whose own package.json has no `name`: the last component of where it
-/// came from, so `../pkgs/foo`, `https://host/foo.tgz?token=x` and `https://host/user/foo`
-/// all become `foo`. Always `is_safe_lockfile_package_name`, since it ends up in bun.lock.
+/// Name for a package whose package.json has none: the last component of where it came from
+/// (`../pkgs/foo`, `https://host/foo.tgz?token=x`, `https://host/user/foo` all become `foo`).
 pub(crate) fn fallback_package_name(location: &[u8]) -> &[u8] {
-    let without_query = match strings::index_of_char(location, b'?') {
-        Some(query_start) => &location[..query_start as usize],
-        None => location,
-    };
+    let without_query = location.split(|&b| b == b'?').next().unwrap_or(location);
     let basename = bun_paths::basename(without_query);
     let name = strings::without_suffix_comptime(
         strings::without_suffix_comptime(basename, b".tgz"),
@@ -613,7 +604,7 @@ pub(crate) fn fallback_package_name(location: &[u8]) -> &[u8] {
     if is_safe_lockfile_package_name(name) {
         name
     } else {
-        FALLBACK_PACKAGE_NAME
+        b"unnamed-package"
     }
 }
 
@@ -724,7 +715,7 @@ impl VersionExt for Version {
         parse_with_tag(
             alias,
             Some(alias_hash),
-            trim_literal(sliced.slice),
+            sliced.slice,
             tag,
             &sliced,
             Some(ctx.log),
@@ -913,8 +904,7 @@ impl TagExt for Tag {
                                 }
                             }
                             b'+' => {
-                                // `git+git:` is how a Git resolution of a `git://` dependency is
-                                // written back to bun.lock (`git+` label + the original URL).
+                                // bun.lock writes a `git://` dependency's resolution as `git+git:`.
                                 if url.starts_with(b"+ssh:")
                                     || url.starts_with(b"+file:")
                                     || url.starts_with(b"+git:")
diff --git a/src/install/lockfile/Package.rs b/src/install/lockfile/Package.rs
index 34ba727f3bd0..70613cabc958 100644
--- a/src/install/lockfile/Package.rs
+++ b/src/install/lockfile/Package.rs
@@ -2189,16 +2189,6 @@ impl Package<u64> {
             if let Some(name_q) = json.as_property(b"name") {
                 if let Some(name) = name_q.expr.as_utf8(&bump) {
                     if !name.is_empty() {
-                        // Non-root names become bun.lock `packages` entries, which the
-                        // lockfile parser rejects with the same check (see bun.lock.rs).
-                        if !FEATURES.is_main && !dependency::is_safe_install_folder_name(name) {
-                            log.add_error_fmt(
-                                source,
-                                value_loc_of(source, name_q.loc),
-                                format_args!("Invalid package name {}", bun_core::fmt::quote(name)),
-                            );
-                            return Err(crate::Error::InvalidPackageJSON);
-                        }
                         // Non-root names become bun.lock `packages` entries, which can
                         // only be read back if `is_safe_lockfile_package_name` holds.
                         if !FEATURES.is_main && !dependency::is_safe_lockfile_package_name(name) {

From 70dcc0ab1cda17e7bfa16cadfaa8e8dc7df04ac5 Mon Sep 17 00:00:00 2001
From: Jarred Sumner <jarred@jarredsumner.com>
Date: Mon, 17 Aug 2026 06:02:00 +0000
Subject: [PATCH 232/258] simplify(s1-resolver): comment trims across the
 cluster

(cherry picked from commit da762b3a2d9efef269eef974141901794a3d2285)
---
 .../PackageManager/PackageManagerEnqueue.rs   | 28 ++++++-------------
 src/install/PackageManager/runTasks.rs        |  4 +--
 src/install/dedupe.rs                         |  4 ---
 src/install/dependency.rs                     |  6 ++--
 src/install/lockfile.rs                       |  5 +---
 src/install/lockfile/Package.rs               | 11 ++------
 src/install/prune.rs                          |  4 +--
 7 files changed, 17 insertions(+), 45 deletions(-)

diff --git a/src/install/PackageManager/PackageManagerEnqueue.rs b/src/install/PackageManager/PackageManagerEnqueue.rs
index 2a7782ac21ee..076a97516bd3 100644
--- a/src/install/PackageManager/PackageManagerEnqueue.rs
+++ b/src/install/PackageManager/PackageManagerEnqueue.rs
@@ -640,10 +640,8 @@ pub fn enqueue_dependency_with_main_and_success_fn(
     resolution: PackageID,
     install_peer: bool,
     success_fn: SuccessFn,
-    // True for runtime auto-install's root enqueues
-    // (`enqueue_dependency_to_root`): their resolution errors go to `this.log`
-    // instead of propagating. An explicit flag, not a `success_fn` address
-    // comparison: the linker may fold the byte-identical fn bodies.
+    // `enqueue_dependency_to_root` (auto-install): resolution errors go to `this.log` instead of propagating.
+    // A flag rather than a `success_fn` address comparison, which linker folding would break.
     is_root: bool,
 ) -> crate::Result<()> {
     if dependency.behavior.is_optional_peer() {
@@ -764,9 +762,7 @@ pub fn enqueue_dependency_with_main_and_success_fn(
         break 'version dependency.version.clone();
     };
 
-    // Refuse an unsafe alias (the future `node_modules/` folder) or registry
-    // name (the request and the package name) here, before either is fetched
-    // or printed. Empty names are tolerated, as in the tree builder.
+    // Refuse an unsafe alias (a future folder) or registry name before either is fetched or printed; empty is tolerated.
     let invalid_name = {
         let alias = this.lockfile.str(&dependency.name);
         let alias_is_safe = if alias == this.lockfile.str(&dependency.version.literal) {
@@ -1100,10 +1096,8 @@ pub fn enqueue_dependency_with_main_and_success_fn(
                                         loaded_manifest = Some(manifest.clone());
 
                                         // If it's an exact package version already living in the cache
-                                        // We can skip the network request, even if it's beyond the caching period.
-                                        // Except when minimum-release-age needs publish times and the cached
-                                        // manifest is abbreviated: its timestamps are all 0, so the age check
-                                        // below would pass any version. Fall through and fetch the extended one.
+                                        // We can skip the network request, even if it's beyond the caching period
+                                        // (unless minimum-release-age needs publish times an abbreviated manifest lacks).
                                         if version.tag == dependency::version::Tag::Npm
                                             && version.npm().version.is_exact()
                                             && (!needs_extended_manifest
@@ -2281,13 +2275,9 @@ fn get_or_put_resolved_package_with_find_result(
 
     // Was this package already allocated? Let's reuse the existing one.
     //
-    // A peer that is still deferred may only reuse an exact match: which
-    // siblings exist at this point depends on response arrival order, so the
-    // range match waits for the `install_peer` pass, when all of them exist.
+    // A deferred peer may only reuse an exact match: which siblings exist yet depends on arrival
+    // order, so its range match waits for the `install_peer` pass; likewise only regular rows' pins count.
     let suppress_peer_satisfies = behavior.is_peer() && !install_peer;
-    // Which peer rows have landed on a version by any given moment depends on
-    // what has arrived (they bind on sight or in the peer pass), so only
-    // regular rows' pins are recorded (`AppendedFor::pinned`).
     let pins = !behavior.is_peer()
         && version.tag == dependency::version::Tag::Npm
         && version.npm().version.is_exact();
@@ -2307,9 +2297,7 @@ fn get_or_put_resolved_package_with_find_result(
         if pins {
             this.lockfile.mark_pinned_by_reuse(id);
         }
-        // The existing entry may have been created from the abbreviated
-        // manifest (a regular dependency elsewhere in the tree, or a lockfile
-        // written before `libc` was recorded); this manifest knows the libc.
+        // The existing entry may come from an abbreviated manifest or a pre-`libc` lockfile.
         if find_result.package.libc != Npm::Libc::NONE {
             let buf = this.lockfile.buffers.string_bytes.as_slice();
             let same_version = this.lockfile.packages.items_resolution()[id as usize].eql(
diff --git a/src/install/PackageManager/runTasks.rs b/src/install/PackageManager/runTasks.rs
index 03f2bc46bd75..a3b20c7bd29e 100644
--- a/src/install/PackageManager/runTasks.rs
+++ b/src/install/PackageManager/runTasks.rs
@@ -595,9 +595,7 @@ pub fn run_tasks<C: RunTasksCallbacks>(
 
                         manifest.pkg.public_max_age = timestamp_this_tick.unwrap();
 
-                        // Insert by-value and reborrow below; `insert` may keep
-                        // an extended manifest that arrived in the meantime, in
-                        // which case that is the one written back to disk.
+                        // `insert` may keep an extended manifest that arrived meanwhile; that one is written back.
                         let name_hash = manifest.pkg.name.hash;
                         manager.manifests.insert(name_hash, manifest)?;
 
diff --git a/src/install/dedupe.rs b/src/install/dedupe.rs
index 561ec7c4059b..173637999c4a 100644
--- a/src/install/dedupe.rs
+++ b/src/install/dedupe.rs
@@ -380,7 +380,6 @@ struct Wanted {
 
 struct Row {
     name: Box<[u8]>,
-    /// The removed version.
     from: Box<[u8]>,
     /// Surviving version(s); empty when `from` is dropped outright.
     to: Box<[u8]>,
@@ -621,9 +620,6 @@ fn dedupe_lockfile(lockfile: &mut Lockfile, why: bool) -> Report {
                 let Some(rows) = explains.get(original[dep_id] as usize) else {
                     continue;
                 };
-                if rows.is_empty() {
-                    continue;
-                }
                 let dep = &deps[dep_id];
                 let literal = effective_version(lockfile, dep_id as DependencyID, dep)
                     .map(|version| version.literal)
diff --git a/src/install/dependency.rs b/src/install/dependency.rs
index e4bf24a2d1c5..caf4ec43b206 100644
--- a/src/install/dependency.rs
+++ b/src/install/dependency.rs
@@ -555,9 +555,9 @@ pub fn is_scoped_package_name(name: &[u8]) -> Result<bool, PackageNameError> {
     Err(PackageNameError::InvalidPackageName)
 }
 
-/// Names come from untrusted `package.json` / manifest keys and end up as
-/// `node_modules/` directories and in progress and error output, so reject path
-/// escapes and terminal control characters. `@scope/name` stays valid.
+/// A dependency name/alias becomes a directory under `node_modules/`. Names
+/// come from untrusted `package.json` / manifest keys, so reject anything that
+/// could resolve outside that directory, and terminal control characters. `@scope/name` stays valid.
 pub(crate) fn is_safe_install_folder_name(name: &[u8]) -> bool {
     if name.is_empty() || contains_control_character(name) {
         return false;
diff --git a/src/install/lockfile.rs b/src/install/lockfile.rs
index 70b718e4f897..4f89af469928 100644
--- a/src/install/lockfile.rs
+++ b/src/install/lockfile.rs
@@ -3159,10 +3159,7 @@ impl Lockfile {
         Ok(digest)
     }
 
-    /// `version_buf` is the buffer `version`'s strings (prerelease/build tags)
-    /// were parsed against. The auto-install resolver passes versions parsed
-    /// from a project's package.json here, so it is not always this lockfile's
-    /// string buffer.
+    /// `version_buf` is what `version`'s tag strings were parsed against (auto-install passes a package.json's).
     pub(crate) fn resolve_package_from_name_and_version(
         &self,
         package_name: &[u8],
diff --git a/src/install/lockfile/Package.rs b/src/install/lockfile/Package.rs
index 70613cabc958..c74984264db3 100644
--- a/src/install/lockfile/Package.rs
+++ b/src/install/lockfile/Package.rs
@@ -258,10 +258,7 @@ pub trait ResolverContext {
         json: &Expr,
     ) -> crate::Result<ResolutionType<u64>>;
 
-    /// Name to store when the package.json has no `name`. Resolvers for
-    /// packages fetched from somewhere (git, tarballs, folders) derive one from
-    /// the source; `None` (the root, workspace members, the npm cache) leaves
-    /// the package unnamed.
+    /// Name to store when the package.json has none; git/tarball/folder resolvers derive one from the source.
     fn fallback_name(&self) -> Option<Vec<u8>> {
         None
     }
@@ -613,10 +610,8 @@ impl Package<u64> {
                 resolve_id: new_package.resolutions.off + PackageID::try_from(i).expect("int cast"),
             };
 
-            // A peer slot must not keep a target alive that something else held
-            // when the lockfile was loaded; it is bound in `Cloner::flush` if that
-            // holder survived. A target the loaded lockfile held through optional
-            // peers alone is cloned like a dependency (see `Lockfile::held_at_load`).
+            // Peer slots must not keep their target alive; bound in `Cloner::flush`. A target the
+            // loaded lockfile held through optional peers alone is cloned like a dependency.
             if old_dependencies[i].behavior.is_optional_peer()
                 && old
                     .held_at_load
diff --git a/src/install/prune.rs b/src/install/prune.rs
index fb0b38e94bae..225290fae8c1 100644
--- a/src/install/prune.rs
+++ b/src/install/prune.rs
@@ -660,9 +660,7 @@ enum Installed {
     Matches,
     Missing,
     Mismatch,
-    /// A version the lockfile installs elsewhere; the filter just favors a
-    /// different copy at this position, so it is kept without warning.
-    /// Only produced when `filtered` is set.
+    /// `filtered` only: a version the lockfile installs elsewhere, kept without warning.
     OtherVersion,
 }
 

From e7a1d30d605ab34aed4b6dedb035610df67ba836 Mon Sep 17 00:00:00 2001
From: Jarred Sumner <jarred@jarredsumner.com>
Date: Mon, 17 Aug 2026 06:03:53 +0000
Subject: [PATCH 233/258] simplify(s1-resolver): edges_on_instances walks
 reachability with lockfile::reachable over snapshot-patched resolutions

(cherry picked from commit b63643331b0b58a17d666c6e2c7f108f99e1981f)
---
 src/install/update_transitive.rs | 87 +++++++++++---------------------
 1 file changed, 30 insertions(+), 57 deletions(-)

diff --git a/src/install/update_transitive.rs b/src/install/update_transitive.rs
index 663482fca83f..9f75e3e21121 100644
--- a/src/install/update_transitive.rs
+++ b/src/install/update_transitive.rs
@@ -1415,50 +1415,35 @@ fn edges_on_instances(
         let deps = lockfile.buffers.dependencies.as_slice();
         let resolutions = lockfile.buffers.resolutions.as_slice();
 
-        // Removed or superseded subtrees (a dropped workspace member included) are still in the buffers: only owners reachable from the root contribute rows.
-        let mut reachable = DynamicBitSet::init_empty(packages_len).unwrap_or_oom();
-        let mut queue: Vec<usize> = Vec::new();
-        for owner in 0..packages_len {
-            if pkg_res[owner].tag == ResolutionTag::Root {
-                reachable.set(owner);
-                queue.push(owner);
-            }
-        }
-        while let Some(owner) = queue.pop() {
-            let slice = dep_slices[owner];
-            let snapshot = matches!(
+        // The differ re-appends root rows unresolved; their pre-diff resolution lives in the snapshot.
+        let is_direct = |owner: usize| {
+            matches!(
                 pkg_res[owner].tag,
                 ResolutionTag::Root | ResolutionTag::Workspace
-            );
-            for row in slice.begin() as usize..slice.end() as usize {
-                let mut target = resolutions[row] as usize;
-                if target >= packages_len && snapshot {
-                    target = snapshot_resolution(
-                        direct_deps,
-                        owner as PackageID,
-                        deps[row].name_hash,
-                        deps[row].behavior,
-                    )
-                    .map_or(usize::MAX, |resolved| resolved as usize);
-                }
-                if target < packages_len && !reachable.is_set(target) {
-                    reachable.set(target);
-                    queue.push(target);
+            )
+        };
+        let mut locked_resolutions = resolutions.to_vec();
+        for owner in (0..packages_len).filter(|&owner| is_direct(owner)) {
+            for row in dep_slices[owner].begin() as usize..dep_slices[owner].end() as usize {
+                if locked_resolutions[row] as usize >= packages_len {
+                    let dep = &deps[row];
+                    let owned =
+                        snapshot_resolution(direct_deps, owner, dep.name_hash, dep.behavior);
+                    locked_resolutions[row] = owned.unwrap_or(invalid_package_id);
                 }
             }
         }
+        // Removed or superseded subtrees (a dropped workspace member included) are still in the buffers.
+        let reachable = crate::lockfile::reachable::packages(
+            lockfile,
+            &locked_resolutions,
+            crate::lockfile::reachable::Options::all(0),
+        );
 
-        for owner in 0..packages_len {
-            if !reachable.is_set(owner) {
-                continue;
-            }
+        for owner in (0..packages_len).filter(|&owner| reachable.is_set(owner)) {
             let slice = dep_slices[owner];
-            let is_direct = matches!(
-                pkg_res[owner].tag,
-                ResolutionTag::Root | ResolutionTag::Workspace
-            );
             for row in slice.begin() as usize..slice.end() as usize {
-                if !is_direct {
+                if !is_direct(owner) {
                     let Some(&slot) = slot_of.get(resolutions[row] as usize) else {
                         continue;
                     };
@@ -1478,25 +1463,13 @@ fn edges_on_instances(
                     _ => continue,
                 };
                 let row_hash = Semver::string::Builder::string_hash(names.slice(buf));
-                // The differ re-appends root rows unresolved; their pre-diff resolution lives in the snapshot.
-                let locked_id = if (resolutions[row] as usize) < packages_len {
-                    Some(resolutions[row])
-                } else {
-                    snapshot_resolution(
-                        direct_deps,
-                        owner as PackageID,
-                        deps[row].name_hash,
-                        deps[row].behavior,
-                    )
-                };
-                let res_slot = locked_id
-                    .and_then(|id| slot_of.get(id as usize).copied())
-                    .unwrap_or(u32::MAX);
-                let locked = locked_id.and_then(|id| {
-                    // An optional row the loaded lockfile left unresolved snapshots as invalid.
-                    let res = pkg_res.get(id as usize)?;
-                    (res.tag == ResolutionTag::Npm).then(|| res.npm().version)
-                });
+                let locked_id = locked_resolutions[row] as usize;
+                let res_slot = slot_of.get(locked_id).copied().unwrap_or(u32::MAX);
+                // An optional row the loaded lockfile left unresolved snapshots as invalid.
+                let locked = pkg_res
+                    .get(locked_id)
+                    .filter(|res| res.tag == ResolutionTag::Npm)
+                    .map(|res| res.npm().version);
                 for (i, inst) in instances.iter().enumerate() {
                     if name_hashes[inst.pkg_id as usize] == row_hash
                         && names.eql(pkg_names[inst.pkg_id as usize], buf, buf)
@@ -1613,14 +1586,14 @@ fn instance_version(
 /// The pre-differ resolution of a root/workspace row, matched by owner, name hash and behavior like `moved_pairs`.
 fn snapshot_resolution(
     direct_deps: &DirectDependencies,
-    owner: PackageID,
+    owner: usize,
     name_hash: PackageNameHash,
     behavior: Behavior,
 ) -> Option<PackageID> {
     let &(_, start, len) = direct_deps
         .owners
         .iter()
-        .find(|&&(pkg, _, _)| pkg == owner)?;
+        .find(|&&(pkg, _, _)| pkg as usize == owner)?;
     direct_deps.rows[start as usize..(start + len) as usize]
         .iter()
         .find(|row| row.0 == name_hash && row.1 == behavior)

From 1da5488990c217a388c2071bef7ae78be55242d1 Mon Sep 17 00:00:00 2001
From: Jarred Sumner <jarred@jarredsumner.com>
Date: Mon, 17 Aug 2026 06:06:22 +0000
Subject: [PATCH 234/258] simplify(s1-resolver): small tidies (packages_named
 in verify_data, deferred field)

(cherry picked from commit 5ad0fa213e5010fc7821e8168fbaf3b1a033b487)
---
 src/install/PackageManager/install_with_manager.rs | 2 +-
 src/install/lockfile.rs                            | 7 ++-----
 src/install/update_transitive.rs                   | 6 +-----
 3 files changed, 4 insertions(+), 11 deletions(-)

diff --git a/src/install/PackageManager/install_with_manager.rs b/src/install/PackageManager/install_with_manager.rs
index fbd962b5dfe0..1075139b9143 100644
--- a/src/install/PackageManager/install_with_manager.rs
+++ b/src/install/PackageManager/install_with_manager.rs
@@ -595,7 +595,7 @@ pub fn install_with_manager(
     if manager.pending_task_count() > 0
         || manager.peer_dependencies.readable_length() > 0
         || !named.latest_rows.is_empty()
-        || transitive.has_deferred()
+        || !transitive.deferred.is_empty()
     {
         resolve_pending_tasks(
             manager,
diff --git a/src/install/lockfile.rs b/src/install/lockfile.rs
index 4f89af469928..21432d29f5a9 100644
--- a/src/install/lockfile.rs
+++ b/src/install/lockfile.rs
@@ -1933,11 +1933,8 @@ impl Lockfile {
             );
             // The hoister binds peers by scanning `package_index` under the package name.
             debug_assert!(
-                match self.package_index.get(&package.name_hash) {
-                    Some(PackageIndexEntry::Id(id)) => *id as usize == i,
-                    Some(PackageIndexEntry::Ids(ids)) => ids.iter().any(|&id| id as usize == i),
-                    None => false,
-                },
+                self.packages_named(package.name_hash)
+                    .contains(&(i as PackageID)),
                 "package {} is not in package_index under its own name",
                 i
             );
diff --git a/src/install/update_transitive.rs b/src/install/update_transitive.rs
index 9f75e3e21121..ca9dff7f38cb 100644
--- a/src/install/update_transitive.rs
+++ b/src/install/update_transitive.rs
@@ -282,7 +282,7 @@ pub struct TransitiveUpdate {
     /// For `print_plan`, when no install summary will print the rows (`--dry-run`, `--lockfile-only`).
     report: Report,
     /// Range rows left to follow the direct entry whose package they share; see `plan_unanchored`.
-    deferred: Vec<DependencyID>,
+    pub(crate) deferred: Vec<DependencyID>,
 }
 
 impl TransitiveUpdate {
@@ -307,10 +307,6 @@ impl TransitiveUpdate {
         plan_edges(manager, &edges, direct)
     }
 
-    pub fn has_deferred(&self) -> bool {
-        !self.deferred.is_empty()
-    }
-
     /// Once the direct entries have resolved: a deferred row whose entry moved to a version the row's range accepts has followed it; one whose package no direct entry resolves to any more (the entry moved where the range does not reach, or was removed from package.json in the meantime) is planned on its own range here. Returns whether anything was enqueued, in which case the caller resolves again.
     pub fn plan_unanchored(
         &mut self,

From eda2b88111d47242d5480256718493fc5372938f Mon Sep 17 00:00:00 2001
From: Jarred Sumner <jarred@jarredsumner.com>
Date: Mon, 17 Aug 2026 06:08:00 +0000
Subject: [PATCH 235/258] simplify(s1-resolver): rebase_folder_dependencies
 without the field destructuring

(cherry picked from commit 8386c70db7dc11902dadcc2a82031a18379bf938)
---
 src/install/lockfile.rs | 30 +++++++-----------------------
 1 file changed, 7 insertions(+), 23 deletions(-)

diff --git a/src/install/lockfile.rs b/src/install/lockfile.rs
index 21432d29f5a9..82b189281b90 100644
--- a/src/install/lockfile.rs
+++ b/src/install/lockfile.rs
@@ -745,24 +745,10 @@ impl Lockfile {
     /// Gives the folder rows of root, workspace and `file:` packages the top-level relative
     /// `value.folder` that `Package::parse` gives them (the stored literal is package-relative).
     pub(crate) fn rebase_folder_dependencies(&mut self) -> Result<(), AllocError> {
-        let Lockfile {
-            packages,
-            buffers,
-            string_pool,
-            ..
-        } = self;
-        let Buffers {
-            string_bytes,
-            dependencies,
-            ..
-        } = buffers;
-        let pkgs = packages.slice();
+        let pkgs = self.packages.slice();
         let mut path_buf = bun_paths::path_buffer_pool::get();
-
-        for (pkg_resolution, pkg_dependencies) in pkgs
-            .items_resolution()
-            .iter()
-            .zip(pkgs.items_dependencies())
+        for (pkg_resolution, pkg_dependencies) in
+            (pkgs.items_resolution().iter()).zip(pkgs.items_dependencies())
         {
             let pkg_dir: SemverString = match pkg_resolution.tag {
                 ResolutionTag::Root => SemverString::default(),
@@ -770,12 +756,11 @@ impl Lockfile {
                 ResolutionTag::Folder => *pkg_resolution.folder(),
                 _ => continue,
             };
-
-            for dep in pkg_dependencies.mut_(dependencies.as_mut_slice()) {
+            for dep in pkg_dependencies.mut_(self.buffers.dependencies.as_mut_slice()) {
                 if dep.version.tag != dependency::Tag::Folder {
                     continue;
                 }
-                let buf = string_bytes.as_slice();
+                let buf = self.buffers.string_bytes.as_slice();
                 let literal = dep.version.literal.sliced(buf);
                 let Some(declared) = dependency::parse_with_tag(
                     dep.name,
@@ -796,13 +781,12 @@ impl Lockfile {
                     continue;
                 };
                 dep.version.value.folder = SemverStringBuf {
-                    bytes: &mut *string_bytes,
-                    pool: &mut *string_pool,
+                    bytes: &mut self.buffers.string_bytes,
+                    pool: &mut self.string_pool,
                 }
                 .append(relative)?;
             }
         }
-
         Ok(())
     }
 

From 73f438b86fa10507b2c7a3c9969ce2576b01cf6a Mon Sep 17 00:00:00 2001
From: Jarred Sumner <jarred@jarredsumner.com>
Date: Mon, 17 Aug 2026 06:09:34 +0000
Subject: [PATCH 236/258] simplify(s1-resolver): tree_printer
 print_catalog_entry_updates without the redundant pre-scan

(cherry picked from commit 1f36ab77d7321dcbaa26e20fc61f56f46126c924)
---
 src/install/lockfile/printer/tree_printer.rs | 16 +++-------------
 1 file changed, 3 insertions(+), 13 deletions(-)

diff --git a/src/install/lockfile/printer/tree_printer.rs b/src/install/lockfile/printer/tree_printer.rs
index c9684c946016..efa78a1a0de6 100644
--- a/src/install/lockfile/printer/tree_printer.rs
+++ b/src/install/lockfile/printer/tree_printer.rs
@@ -391,7 +391,7 @@ where
     Ok(())
 }
 
-/// A bare `bun update` moves the root's catalog entries for every importer at once, but the summary's one section only walks the rows of `update_owners` (above, hence the shared `update_dedupe`), so the entries consumed elsewhere are reported through whichever `catalog:` row names them. The verbose summary prints a section per importer, each reporting its own `catalog:` rows, and skips this. Like a direct dependency's row, a row prints whether or not its new version had to be installed.
+/// A bare `bun update` moves the root's catalog entries for every importer, but the one-section summary only walks `update_owners`' rows (hence the shared `update_dedupe`); entries consumed elsewhere print through whichever `catalog:` row names them. The verbose summary has a section per importer and skips this.
 fn print_catalog_entry_updates<W, const ENABLE_ANSI_COLORS: bool>(
     this: &Printer,
     manager: &mut PackageManager,
@@ -403,27 +403,17 @@ fn print_catalog_entry_updates<W, const ENABLE_ANSI_COLORS: bool>(
 where
     W: Write,
 {
-    if !manager
-        .updating_packages
-        .values()
-        .iter()
-        .any(|info| info.catalog_entry)
-    {
-        return Ok(false);
-    }
     let string_buf = this.lockfile.buffers.string_bytes.as_slice();
     let dependencies = this.lockfile.buffers.dependencies.as_slice();
     let mut printed = false;
     for (dep_id, dep) in dependencies.iter().enumerate() {
         if dep.version.tag != DependencyVersionTag::Catalog
-            || !manager
-                .updating_packages
-                .get(dep.name.slice(string_buf))
+            || !(manager.updating_packages.get(dep.name.slice(string_buf)))
                 .is_some_and(|info| info.catalog_entry)
         {
             continue;
         }
-        let dep_id = DependencyID::try_from(dep_id).expect("int cast");
+        let dep_id = dep_id as DependencyID;
         let ShouldPrintPackageInstallResult::Update(update_info) =
             should_print_package_install(this, manager, dep_id, installed, None, pkg_metas)
         else {

From 6400e11a51ed4ea9efc921b724ba6f1d6c034ff0 Mon Sep 17 00:00:00 2001
From: Jarred Sumner <jarred@jarredsumner.com>
Date: Mon, 17 Aug 2026 06:11:27 +0000
Subject: [PATCH 237/258] simplify(s1-resolver): would_revive_leftover walks
 rows by id

(cherry picked from commit c4d5f35ad6c0a1593ca638f04c189d1b37c75e23)
---
 .../PackageManager/PackageManagerEnqueue.rs   | 19 ++++---------------
 1 file changed, 4 insertions(+), 15 deletions(-)

diff --git a/src/install/PackageManager/PackageManagerEnqueue.rs b/src/install/PackageManager/PackageManagerEnqueue.rs
index 076a97516bd3..70d9389a9c1f 100644
--- a/src/install/PackageManager/PackageManagerEnqueue.rs
+++ b/src/install/PackageManager/PackageManagerEnqueue.rs
@@ -3100,21 +3100,10 @@ fn would_revive_leftover(
     }
     let deps = lockfile.buffers.dependencies.as_slice();
     let resolutions = lockfile.buffers.resolutions.as_slice();
-    let mut owned_rows = lockfile
-        .packages
-        .items_dependencies()
-        .iter()
-        .zip(lockfile.packages.items_resolutions())
-        .enumerate()
-        .flat_map(|(owner, (dep_slice, res_slice))| {
-            dep_slice
-                .get(deps)
-                .iter()
-                .zip(res_slice.get(resolutions))
-                .map(move |(dep, &resolved)| (owner, dep, resolved))
-        });
-    !owned_rows.any(|(owner, dep, resolved)| {
-        resolved == package_id && (owner == 0 || !dep.behavior.is_peer())
+    !(lockfile.packages.items_dependencies().iter().enumerate()).any(|(owner, list)| {
+        (list.begin() as usize..list.end() as usize).any(|row| {
+            resolutions[row] == package_id && (owner == 0 || !deps[row].behavior.is_peer())
+        })
     })
 }
 

From d63b606c7007daf6726f5eed65e6ed2159241c39 Mon Sep 17 00:00:00 2001
From: Jarred Sumner <jarred@jarredsumner.com>
Date: Mon, 17 Aug 2026 06:13:37 +0000
Subject: [PATCH 238/258] simplify(s1-resolver): prune HoistedTree memoizes
 Installed in one vec

(cherry picked from commit 5665d9f6bdbb80e301ba1df47bdb7eb3ed91c44e)
---
 src/install/prune.rs | 36 +++++++-----------------------------
 1 file changed, 7 insertions(+), 29 deletions(-)

diff --git a/src/install/prune.rs b/src/install/prune.rs
index 225290fae8c1..24576718f0e3 100644
--- a/src/install/prune.rs
+++ b/src/install/prune.rs
@@ -649,10 +649,8 @@ struct HoistedTree<'a> {
     /// The expected tree excludes dev/optional/peer dependencies.
     filtered: bool,
     kept_mismatched: Cell<bool>,
-    checked: RefCell<DynamicBitSet>,
-    matched: RefCell<DynamicBitSet>,
-    missing: RefCell<DynamicBitSet>,
-    other_version: RefCell<DynamicBitSet>,
+    /// Memoized `installed()` per `expected` index.
+    verified: RefCell<Vec<Option<Installed>>>,
 }
 
 #[derive(Clone, Copy, PartialEq, Eq)]
@@ -707,10 +705,7 @@ impl<'a> HoistedTree<'a> {
             };
         }
 
-        let checked = handle_oom(DynamicBitSet::init_empty(expected.len()));
-        let matched = handle_oom(DynamicBitSet::init_empty(expected.len()));
-        let missing = handle_oom(DynamicBitSet::init_empty(expected.len()));
-        let other_version = handle_oom(DynamicBitSet::init_empty(expected.len()));
+        let verified = vec![None; expected.len()];
         HoistedTree {
             lockfile,
             trees,
@@ -720,10 +715,7 @@ impl<'a> HoistedTree<'a> {
             quiet,
             filtered,
             kept_mismatched: Cell::new(false),
-            checked: RefCell::new(checked),
-            matched: RefCell::new(matched),
-            missing: RefCell::new(missing),
-            other_version: RefCell::new(other_version),
+            verified: RefCell::new(verified),
         }
     }
 
@@ -799,25 +791,11 @@ impl<'a> HoistedTree<'a> {
         alias: &[u8],
         pkg_id: PackageID,
     ) -> Installed {
-        if self.checked.borrow().is_set(idx) {
-            return if self.matched.borrow().is_set(idx) {
-                Installed::Matches
-            } else if self.missing.borrow().is_set(idx) {
-                Installed::Missing
-            } else if self.other_version.borrow().is_set(idx) {
-                Installed::OtherVersion
-            } else {
-                Installed::Mismatch
-            };
+        if let Some(installed) = self.verified.borrow()[idx] {
+            return installed;
         }
         let installed = self.installed(tree_id, alias, pkg_id);
-        self.checked.borrow_mut().set(idx);
-        match installed {
-            Installed::Matches => self.matched.borrow_mut().set(idx),
-            Installed::Missing => self.missing.borrow_mut().set(idx),
-            Installed::OtherVersion => self.other_version.borrow_mut().set(idx),
-            Installed::Mismatch => {}
-        }
+        self.verified.borrow_mut()[idx] = Some(installed);
         installed
     }
 

From 70eb8e95da67153d4afde52de3ed9e10a8ca89ee Mon Sep 17 00:00:00 2001
From: Jarred Sumner <jarred@jarredsumner.com>
Date: Mon, 17 Aug 2026 06:14:59 +0000
Subject: [PATCH 239/258] simplify(s1-resolver): Lockfile::declarer_of for the
 three declarer-locality checks

(cherry picked from commit b96464da224ca6d23c6471d8fcc20bbbc32a22be)
---
 .../PackageManager/PackageManagerEnqueue.rs        | 12 +++---------
 src/install/lockfile.rs                            | 14 ++++++--------
 2 files changed, 9 insertions(+), 17 deletions(-)

diff --git a/src/install/PackageManager/PackageManagerEnqueue.rs b/src/install/PackageManager/PackageManagerEnqueue.rs
index 70d9389a9c1f..db0110f94efe 100644
--- a/src/install/PackageManager/PackageManagerEnqueue.rs
+++ b/src/install/PackageManager/PackageManagerEnqueue.rs
@@ -1471,10 +1471,7 @@ pub fn enqueue_dependency_with_main_and_success_fn(
             if dependency_tag == dependency::version::Tag::Symlink
                 && !version_was_replaced
                 && crate::bin::bin_target_escapes_package_dir(this.lockfile.str(version.symlink()))
-                && let Some(declarer) = this.lockfile.get_parent_pkg_of_dependency(id)
-                && !this.lockfile.packages.items_resolution()[declarer as usize]
-                    .tag
-                    .is_local_package()
+                && let Some((declarer, false)) = this.lockfile.declarer_of(id)
             {
                 if dependency.behavior.is_required() {
                     reject_escaping_link_of_remote_package(this, declarer, dependency);
@@ -1593,10 +1590,7 @@ pub fn enqueue_dependency_with_main_and_success_fn(
             let tarball = version.tarball();
             if matches!(tarball.uri, dependency::tarball::Uri::Local(_))
                 && !version_was_replaced
-                && let Some(declarer) = this.lockfile.get_parent_pkg_of_dependency(id)
-                && !this.lockfile.packages.items_resolution()[declarer as usize]
-                    .tag
-                    .is_local_package()
+                && let Some((declarer, false)) = this.lockfile.declarer_of(id)
                 && !this.lockfile.has_equal_root_dependency(dependency)
             {
                 if dependency.behavior.is_required() {
@@ -2770,7 +2764,7 @@ fn get_or_put_resolved_package(
                     }
                 }
 
-                if this.lockfile.is_dependency_of_local_package(dependency_id) {
+                if matches!(this.lockfile.declarer_of(dependency_id), Some((_, true))) {
                     // relative to cwd
                     // reshaped for borrowck — `folder_path` borrows
                     // `string_bytes`; detach the slice lifetime so the
diff --git a/src/install/lockfile.rs b/src/install/lockfile.rs
index 82b189281b90..95028009c4e4 100644
--- a/src/install/lockfile.rs
+++ b/src/install/lockfile.rs
@@ -965,14 +965,12 @@ impl Lockfile {
         invalid_package_id
     }
 
-    /// A folder package a registry package declares gets no dependency list, so a local declarer was reached through local packages only.
-    pub(crate) fn is_dependency_of_local_package(&self, id: DependencyID) -> bool {
-        self.get_parent_pkg_of_dependency(id)
-            .is_some_and(|parent_id| {
-                self.packages.items_resolution()[parent_id as usize]
-                    .tag
-                    .is_local_package()
-            })
+    /// The declaring package and whether it is local (`Tag::is_local_package`); a folder package a
+    /// registry package declares gets no dependency list, so a local declarer was reached through local ones only.
+    pub(crate) fn declarer_of(&self, id: DependencyID) -> Option<(PackageID, bool)> {
+        let declarer = self.get_parent_pkg_of_dependency(id)?;
+        let tag = self.packages.items_resolution()[declarer as usize].tag;
+        Some((declarer, tag.is_local_package()))
     }
 
     /// Does this tree id belong to a workspace (including workspace root)?

From 7649b370c1d30a54ce35caadb780475fb7d46e66 Mon Sep 17 00:00:00 2001
From: Jarred Sumner <jarred@jarredsumner.com>
Date: Mon, 17 Aug 2026 06:16:30 +0000
Subject: [PATCH 240/258] simplify(s1-resolver): dedupe --why: inline the
 dependents cap

(cherry picked from commit 36508548f417e76b906bf6573ea51311a735696a)
---
 src/install/dedupe.rs | 6 ++----
 1 file changed, 2 insertions(+), 4 deletions(-)

diff --git a/src/install/dedupe.rs b/src/install/dedupe.rs
index 173637999c4a..c8783334d227 100644
--- a/src/install/dedupe.rs
+++ b/src/install/dedupe.rs
@@ -309,9 +309,7 @@ pub(crate) fn label(lockfile: &Lockfile, id: PackageID) -> Vec<u8> {
     label
 }
 
-const MAX_DEPENDENTS_SHOWN: usize = 3;
-
-// Biggest group first, dependents in name order, versioned only when the name alone is ambiguous.
+// Biggest group first, dependents (at most 3) in name order, versioned only when the name alone is ambiguous.
 fn format_wanted(
     lockfile: &Lockfile,
     group_of: &[u32],
@@ -332,7 +330,7 @@ fn format_wanted(
                 strings::order(names[a as usize].slice(buf), names[b as usize].slice(buf))
                     .then(a.cmp(&b))
             });
-            let shown = owners.len().min(MAX_DEPENDENTS_SHOWN);
+            let shown = owners.len().min(3);
             let mut dependents = Vec::new();
             for (i, &owner) in owners[..shown].iter().enumerate() {
                 if i > 0 {

From e0bb8506c53744157b09b3a93fbcf5ce06a3d88c Mon Sep 17 00:00:00 2001
From: Jarred Sumner <jarred@jarredsumner.com>
Date: Mon, 17 Aug 2026 06:17:42 +0000
Subject: [PATCH 241/258] simplify(s1-resolver): flatter invalid-name check in
 enqueue

(cherry picked from commit 4af66bcd9663549eef04908b2d58e4bedd222c8f)
---
 .../PackageManager/PackageManagerEnqueue.rs   | 39 +++++++++----------
 1 file changed, 18 insertions(+), 21 deletions(-)

diff --git a/src/install/PackageManager/PackageManagerEnqueue.rs b/src/install/PackageManager/PackageManagerEnqueue.rs
index db0110f94efe..7c9b4b687f7a 100644
--- a/src/install/PackageManager/PackageManagerEnqueue.rs
+++ b/src/install/PackageManager/PackageManagerEnqueue.rs
@@ -763,28 +763,25 @@ pub fn enqueue_dependency_with_main_and_success_fn(
     };
 
     // Refuse an unsafe alias (a future folder) or registry name before either is fetched or printed; empty is tolerated.
-    let invalid_name = {
-        let alias = this.lockfile.str(&dependency.name);
-        let alias_is_safe = if alias == this.lockfile.str(&dependency.version.literal) {
-            // `bun add <specifier>` uses the specifier as the alias until
-            // `assign_resolution` names it: never a folder, but still printed.
-            !dependency::contains_control_character(alias)
-        } else {
-            alias.is_empty() || dependency::is_safe_install_folder_name(alias)
-        };
-        if !alias_is_safe {
-            Some(alias)
-        } else {
-            match version.tag {
-                dependency::version::Tag::Npm | dependency::version::Tag::DistTag => {
-                    let registry_name = this.lockfile.str(&name);
-                    (!registry_name.is_empty()
-                        && !dependency::is_safe_install_folder_name(registry_name))
-                    .then_some(registry_name)
-                }
-                _ => None,
-            }
+    let alias = this.lockfile.str(&dependency.name);
+    let alias_is_safe = if alias == this.lockfile.str(&dependency.version.literal) {
+        // `bun add <specifier>`'s alias until `assign_resolution` names it: never a folder, but printed.
+        !dependency::contains_control_character(alias)
+    } else {
+        alias.is_empty() || dependency::is_safe_install_folder_name(alias)
+    };
+    let registry_name: &[u8] = match version.tag {
+        dependency::version::Tag::Npm | dependency::version::Tag::DistTag => {
+            this.lockfile.str(&name)
         }
+        _ => b"",
+    };
+    let invalid_name = if !alias_is_safe {
+        Some(alias)
+    } else if !registry_name.is_empty() && !dependency::is_safe_install_folder_name(registry_name) {
+        Some(registry_name)
+    } else {
+        None
     };
     if let Some(invalid_name) = invalid_name {
         let name = bun_fmt::escape_control_chars(invalid_name);

From d0b00a65b37d1bb65e6e08ad4ae9f607079aad53 Mon Sep 17 00:00:00 2001
From: Jarred Sumner <jarred@jarredsumner.com>
Date: Mon, 17 Aug 2026 06:18:49 +0000
Subject: [PATCH 242/258] simplify(s1-resolver): Tree.rs out-of-range root peer
 check via try_npm

(cherry picked from commit 51edcf2bf8e693538504d51f78eef52e77cd457a)
---
 src/install/lockfile/Tree.rs | 16 +++++-----------
 1 file changed, 5 insertions(+), 11 deletions(-)

diff --git a/src/install/lockfile/Tree.rs b/src/install/lockfile/Tree.rs
index 3bb151a6a045..49cd98a0cc9c 100644
--- a/src/install/lockfile/Tree.rs
+++ b/src/install/lockfile/Tree.rs
@@ -1115,18 +1115,12 @@ impl Tree {
                 // to hoist other peers even if they don't satisfy the version
                 if builder.lockfile().is_workspace_root_dependency(dep_id) {
                     // Optional peers take whatever the tree offers, as they do in the resolver.
+                    let buf = builder.buf();
                     let rejected = !dependency.behavior.is_optional_peer()
-                        && peer_range.tag == crate::dependency::VersionTag::Npm
-                        && builder
-                            .lockfile()
-                            .package_version(res_id)
-                            .is_some_and(|copy| {
-                                !peer_range.npm().version.satisfies(
-                                    copy,
-                                    builder.buf(),
-                                    builder.buf(),
-                                )
-                            });
+                        && peer_range.try_npm().is_some_and(|npm| {
+                            (builder.lockfile().package_version(res_id))
+                                .is_some_and(|copy| !npm.version.satisfies(copy, buf, buf))
+                        });
                     return if rejected {
                         HoistDependencyResult::HoistedOutOfRange(res_id) // 1
                     } else {

From eeff6b203f627b40ffe657b3be66d7e15da67ba8 Mon Sep 17 00:00:00 2001
From: Jarred Sumner <jarred@jarredsumner.com>
Date: Mon, 17 Aug 2026 05:39:23 +0000
Subject: [PATCH 243/258] =?UTF-8?q?simplify(s4-migration):=20yarn.rs=20?=
 =?UTF-8?q?=E2=80=94=20one=20dependency-section=20table,=20fold=20git=20UR?=
 =?UTF-8?q?L=20parsing,=20dedupe=20package.json=20parsing?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

- Entry derives Default; the four dependency maps become one array in
  DEPENDENCY_SECTIONS order, which the parser and the migrator both iterate
- parse_git_url/ParsedGitUrl folded into Entry::set_git_source (was
  duplicated for the version and resolved keys)
- root and workspace package.json parsing share append_package_json
- package ids are handed out from one (dedupe name, version) map instead of
  the package_versions/scoped_packages pair
- os/cpu list parsing and Meta arch/os construction each written once

(cherry picked from commit 903a5f328c680483a59c17dd3712b442b92c8962)
---
 src/install/yarn.rs | 818 +++++++++++---------------------------------
 1 file changed, 204 insertions(+), 614 deletions(-)

diff --git a/src/install/yarn.rs b/src/install/yarn.rs
index 53a6e40c9de0..1c8f00e98561 100644
--- a/src/install/yarn.rs
+++ b/src/install/yarn.rs
@@ -1,5 +1,4 @@
 use std::borrow::Cow;
-use std::io::Write as _;
 
 use crate::{Error, Features, GetJsonResult};
 use bun_collections::StringHashMap;
@@ -18,7 +17,7 @@ use crate::lockfile_real::package::{
     Meta as PackageMeta, Package as LockfilePackage, PackageColumns as _,
 };
 use crate::lockfile_real::{self as lockfile, LoadResult, Lockfile};
-use bun_install::npm;
+use bun_install::npm::{self, NegatableExt as _};
 // `Package.resolution` is the file-backed `resolution_real::ResolutionType<u64>`
 // (tag + zero-padded `Value` union), constructed via `init(TaggedValue::*)`; the
 // `bun_install::resolution` stub keeps `Value` as a struct-of-fields and has no `init`.
@@ -37,19 +36,18 @@ pub(crate) struct YarnLock<'a> {
     pub(crate) entries: Vec<Entry<'a>>,
 }
 
+#[derive(Default)]
 pub struct Entry<'a> {
     pub(crate) specs: Vec<&'a [u8]>,
     /// Name of the package the entry resolves to; see `package_name_of`.
     pub(crate) name: &'a [u8],
     pub(crate) version: &'a [u8],
-    // Usually borrows from the input; owned when `parse_git_url` rewrites a
+    // Usually borrows from the input; owned when `set_git_source` rewrites a
     // `github:` spec to a `https://github.com/...` URL.
     pub(crate) resolved: Option<Cow<'a, [u8]>>,
     pub(crate) integrity: Option<&'a [u8]>,
-    pub(crate) dependencies: Option<StringHashMap<&'a [u8]>>,
-    pub(crate) optional_dependencies: Option<StringHashMap<&'a [u8]>>,
-    pub(crate) peer_dependencies: Option<StringHashMap<&'a [u8]>>,
-    pub(crate) dev_dependencies: Option<StringHashMap<&'a [u8]>>,
+    /// In `DEPENDENCY_SECTIONS` order.
+    pub(crate) dependencies: [Option<StringHashMap<&'a [u8]>>; 4],
     pub(crate) commit: Option<&'a [u8]>,
     pub(crate) workspace: bool,
     pub(crate) file: Option<&'a [u8]>,
@@ -59,37 +57,12 @@ pub struct Entry<'a> {
     pub(crate) git_repo_name: Option<Box<[u8]>>,
 }
 
-impl<'a> Default for Entry<'a> {
-    fn default() -> Self {
-        Self {
-            specs: Vec::new(),
-            name: b"",
-            version: b"",
-            resolved: None,
-            integrity: None,
-            dependencies: None,
-            optional_dependencies: None,
-            peer_dependencies: None,
-            dev_dependencies: None,
-            commit: None,
-            workspace: false,
-            file: None,
-            os: None,
-            cpu: None,
-            git_repo_name: None,
-        }
-    }
-}
-
-pub(crate) struct ParsedGitUrl<'a> {
-    pub(crate) url: &'a [u8],
-    pub(crate) commit: Option<&'a [u8]>,
-    pub(crate) repo: Option<&'a [u8]>,
-    // Optional owned "https://github.com/{path}" buffer so the borrow
-    // case stays zero-copy. Callers must check `owned_url` first: when it is `Some`,
-    // it supersedes `url` (see `into_resolved`).
-    pub(crate) owned_url: Option<Vec<u8>>,
-}
+const DEPENDENCY_SECTIONS: [(&[u8], dependency::Behavior); 4] = [
+    (b"dependencies:", dependency::Behavior::PROD),
+    (b"optionalDependencies:", dependency::Behavior::OPTIONAL),
+    (b"peerDependencies:", dependency::Behavior::PEER),
+    (b"devDependencies:", dependency::Behavior::DEV),
+];
 
 pub(crate) struct ParsedNpmAlias<'a> {
     pub(crate) name: &'a [u8],
@@ -99,13 +72,13 @@ pub(crate) struct ParsedNpmAlias<'a> {
 impl<'a> Entry<'a> {
     /// The alias spec may follow plain specs of the same package on yarn's shared key line.
     pub(crate) fn package_name_of(specs: &[&'a [u8]]) -> &'a [u8] {
-        if let Some(name) = specs.iter().find_map(|spec| Self::npm_alias_target(spec)) {
-            return name;
-        }
-        match specs.first() {
-            Some(spec) => Self::get_name_from_spec(spec),
-            None => b"",
-        }
+        let first = specs
+            .first()
+            .map_or(b"".as_slice(), |spec| Self::get_name_from_spec(spec));
+        specs
+            .iter()
+            .find_map(|spec| Self::npm_alias_target(spec))
+            .unwrap_or(first)
     }
 
     /// `alias@npm:<name>@<range>` -> `<name>`; `None` for every other kind of spec.
@@ -196,10 +169,7 @@ impl<'a> Entry<'a> {
 
     /// yarn v1 writes tarball `resolved` fields as `<url>#<sha1 of the tarball>`.
     pub(crate) fn url_without_hash(resolved: &[u8]) -> &[u8] {
-        match strings::index_of_char_usize(resolved, b'#') {
-            Some(hash_idx) => &resolved[..hash_idx],
-            None => resolved,
-        }
+        strings::split_once_char(resolved, b'#').map_or(resolved, |(url, _)| url)
     }
 
     pub(crate) fn is_workspace_dependency(version: &[u8]) -> bool {
@@ -230,63 +200,33 @@ impl<'a> Entry<'a> {
         (!name.is_empty()).then_some(name)
     }
 
-    pub(crate) fn parse_git_url(
-        _yarn_lock: &YarnLock<'a>,
-        version: &'a [u8],
-    ) -> Result<ParsedGitUrl<'a>, Error> {
-        let mut url: &[u8] = version;
-        let mut commit: Option<&[u8]> = None;
-        let mut repo: Option<&[u8]> = None;
-        let mut owned_url: Option<Vec<u8>> = None;
-
-        if url.starts_with(b"git+") {
-            url = &url[4..];
+    /// `commit`, `git_repo_name` and `resolved` of a git `version`/`resolved` value; a `github:`
+    /// shorthand resolves to its `https://github.com/` URL.
+    fn set_git_source(&mut self, version: &'a [u8]) {
+        let mut url = version.strip_prefix(b"git+").unwrap_or(version);
+        self.commit = None;
+        if let Some((before_hash, commit)) = strings::split_once_char(url, b'#') {
+            url = before_hash;
+            self.commit = Some(commit);
         }
-
-        if let Some(hash_idx) = strings::index_of(url, b"#") {
-            commit = Some(&url[hash_idx + 1..]);
-            url = &url[0..hash_idx];
+        if let Some(github_path) = version.strip_prefix(b"github:") {
+            let path = Entry::url_without_hash(github_path);
+            if let Some((_, repo)) = strings::split_once_char(path, b'/') {
+                self.git_repo_name = Some(Box::from(repo));
+            }
+            self.resolved = Some(Cow::Owned([b"https://github.com/", path].concat()));
+            return;
         }
-
-        if version.starts_with(b"github:") {
-            let github_path = &version[b"github:".len()..];
-            let path_without_commit = if let Some(idx) = strings::index_of(github_path, b"#") {
-                &github_path[0..idx]
-            } else {
-                github_path
+        if strings::index_of(url, b"github.com").is_some() {
+            let remaining = match strings::index_of(url, b"github.com/") {
+                Some(idx) => &url[idx + b"github.com/".len()..],
+                None => url,
             };
-
-            if let Some(slash_idx) = strings::index_of(path_without_commit, b"/") {
-                repo = Some(&path_without_commit[slash_idx + 1..]);
-            }
-            let mut buf =
-                Vec::with_capacity(b"https://github.com/".len() + path_without_commit.len());
-            buf.extend_from_slice(b"https://github.com/");
-            buf.extend_from_slice(path_without_commit);
-            owned_url = Some(buf);
-            // `url` still borrows the stripped input; callers must prefer
-            // `owned_url` when it is Some.
-        } else if strings::index_of(url, b"github.com").is_some() {
-            let mut remaining = url;
-            if let Some(idx) = strings::index_of(remaining, b"github.com/") {
-                remaining = &remaining[idx + b"github.com/".len()..];
-            }
-            if let Some(slash_idx) = strings::index_of(remaining, b"/") {
-                let after_owner = &remaining[slash_idx + 1..];
-                if after_owner.ends_with(b".git") {
-                    repo = Some(&after_owner[0..after_owner.len() - b".git".len()]);
-                } else {
-                    repo = Some(after_owner);
-                }
+            if let Some((_, repo)) = strings::split_once_char(remaining, b'/') {
+                self.git_repo_name = Some(Box::from(repo.strip_suffix(b".git").unwrap_or(repo)));
             }
         }
-
-        Ok(ParsedGitUrl {
-            url,
-            commit,
-            repo,
-            owned_url,
-        })
+        self.resolved = Some(Cow::Borrowed(url));
     }
 
     /// Splits `npm:<name>@<range>`; the `@` of a scoped `<name>` is not the separator.
@@ -320,11 +260,8 @@ impl<'a> YarnLock<'a> {
         let mut current_entry: Option<Entry<'a>> = None;
         let mut current_specs: Vec<&'a [u8]> = Vec::new();
 
-        let mut current_deps: Option<StringHashMap<&'a [u8]>> = None;
-        let mut current_optional_deps: Option<StringHashMap<&'a [u8]>> = None;
-        let mut current_peer_deps: Option<StringHashMap<&'a [u8]>> = None;
-        let mut current_dev_deps: Option<StringHashMap<&'a [u8]>> = None;
-        let mut current_dep_type: Option<DependencyType> = None;
+        let mut current_deps: [Option<StringHashMap<&'a [u8]>>; 4] = Default::default();
+        let mut current_dep_type: Option<usize> = None;
 
         while let Some(line_) = lines.next() {
             let line = bun_core::trim_right(line_, b" \r\t");
@@ -344,10 +281,7 @@ impl<'a> YarnLock<'a> {
 
             if indent == 0 && trimmed.ends_with(b":") {
                 if let Some(mut entry) = current_entry.take() {
-                    entry.dependencies = current_deps.take();
-                    entry.optional_dependencies = current_optional_deps.take();
-                    entry.peer_dependencies = current_peer_deps.take();
-                    entry.dev_dependencies = current_dev_deps.take();
+                    entry.dependencies = core::mem::take(&mut current_deps);
                     self.consolidate_and_append_entry(entry)?;
                 }
 
@@ -377,11 +311,7 @@ impl<'a> YarnLock<'a> {
                 }
 
                 current_entry = Some(new_entry);
-
-                current_deps = None;
-                current_optional_deps = None;
-                current_peer_deps = None;
-                current_dev_deps = None;
+                current_deps = Default::default();
                 current_dep_type = None;
                 continue;
             }
@@ -391,27 +321,9 @@ impl<'a> YarnLock<'a> {
             };
 
             if indent > 0 {
-                if trimmed == b"dependencies:" {
-                    current_dep_type = Some(DependencyType::Production);
-                    current_deps = Some(StringHashMap::new());
-                    continue;
-                }
-
-                if trimmed == b"optionalDependencies:" {
-                    current_dep_type = Some(DependencyType::Optional);
-                    current_optional_deps = Some(StringHashMap::new());
-                    continue;
-                }
-
-                if trimmed == b"peerDependencies:" {
-                    current_dep_type = Some(DependencyType::Peer);
-                    current_peer_deps = Some(StringHashMap::new());
-                    continue;
-                }
-
-                if trimmed == b"devDependencies:" {
-                    current_dep_type = Some(DependencyType::Development);
-                    current_dev_deps = Some(StringHashMap::new());
+                if let Some(i) = DEPENDENCY_SECTIONS.iter().position(|s| s.0 == trimmed) {
+                    current_dep_type = Some(i);
+                    current_deps[i] = Some(StringHashMap::new());
                     continue;
                 }
 
@@ -419,12 +331,7 @@ impl<'a> YarnLock<'a> {
                     if let Some(space_idx) = strings::index_of(trimmed, b" ") {
                         let key = strings::trim(&trimmed[0..space_idx], b" \"");
                         let value = strings::trim(&trimmed[space_idx + 1..], b" \"");
-                        let map = match dep_type {
-                            DependencyType::Production => current_deps.as_mut().unwrap(),
-                            DependencyType::Optional => current_optional_deps.as_mut().unwrap(),
-                            DependencyType::Peer => current_peer_deps.as_mut().unwrap(),
-                            DependencyType::Development => current_dev_deps.as_mut().unwrap(),
-                        };
+                        let map = current_deps[dep_type].as_mut().expect("set with the type");
                         map.put(key, value)?;
                     }
                     continue;
@@ -442,66 +349,38 @@ impl<'a> YarnLock<'a> {
                         } else if Entry::is_file_dependency(value) {
                             entry.file = Some(Entry::file_path_from_spec(value));
                         } else if Entry::is_git_dependency(value) {
-                            let git_info = Entry::parse_git_url(self, value)?;
-                            entry.commit = git_info.commit;
-                            if let Some(repo_name) = git_info.repo {
-                                entry.git_repo_name = Some(Box::<[u8]>::from(repo_name));
-                            }
-                            // For the `github:` branch the resolved URL is the
-                            // owned `https://github.com/{path}` buffer.
-                            entry.resolved = Some(match git_info.owned_url {
-                                Some(owned) => Cow::Owned(owned),
-                                None => Cow::Borrowed(git_info.url),
-                            });
+                            entry.set_git_source(value);
                         } else if Entry::is_npm_alias(value) {
-                            let alias_info = Entry::parse_npm_alias(value);
-                            entry.version = alias_info.version;
+                            entry.version = Entry::parse_npm_alias(value).version;
                         } else if Entry::is_remote_tarball(value) {
                             entry.resolved = Some(Cow::Borrowed(value));
                         }
                     } else if key == b"resolved" {
                         entry.resolved = Some(Cow::Borrowed(value));
                         if Entry::is_git_dependency(value) {
-                            let git_info = Entry::parse_git_url(self, value)?;
-                            entry.commit = git_info.commit;
-                            if let Some(repo_name) = git_info.repo {
-                                entry.git_repo_name = Some(Box::<[u8]>::from(repo_name));
-                            }
-                            // As in the `version` branch: prefer the rewritten
-                            // `https://github.com/...` buffer for `github:` specs.
-                            entry.resolved = Some(match git_info.owned_url {
-                                Some(owned) => Cow::Owned(owned),
-                                None => Cow::Borrowed(git_info.url),
-                            });
+                            entry.set_git_source(value);
                         }
                     } else if key == b"integrity" {
                         entry.integrity = Some(value);
-                    } else if key == b"os" && value.starts_with(b"[") && value.ends_with(b"]") {
-                        let mut os_list: Vec<&'a [u8]> = Vec::new();
-                        let mut os_it = strings::split(&value[1..value.len() - 1], b",");
-                        while let Some(os) = os_it.next() {
-                            let trimmed_os = strings::trim(os, b" \"");
-                            os_list.push(trimmed_os);
-                        }
-                        entry.os = Some(os_list);
-                    } else if key == b"cpu" && value.starts_with(b"[") && value.ends_with(b"]") {
-                        let mut cpu_list: Vec<&'a [u8]> = Vec::new();
-                        let mut cpu_it = strings::split(&value[1..value.len() - 1], b",");
-                        while let Some(cpu) = cpu_it.next() {
-                            let trimmed_cpu = strings::trim(cpu, b" \"");
-                            cpu_list.push(trimmed_cpu);
-                        }
-                        entry.cpu = Some(cpu_list);
+                    } else if (key == b"os" || key == b"cpu")
+                        && value.starts_with(b"[")
+                        && value.ends_with(b"]")
+                    {
+                        let list = strings::split(&value[1..value.len() - 1], b",")
+                            .map(|item| strings::trim(item, b" \""))
+                            .collect();
+                        *(if key == b"os" {
+                            &mut entry.os
+                        } else {
+                            &mut entry.cpu
+                        }) = Some(list);
                     }
                 }
             }
         }
 
         if let Some(mut entry) = current_entry.take() {
-            entry.dependencies = current_deps.take();
-            entry.optional_dependencies = current_optional_deps.take();
-            entry.peer_dependencies = current_peer_deps.take();
-            entry.dev_dependencies = current_dev_deps.take();
+            entry.dependencies = current_deps;
             self.consolidate_and_append_entry(entry)?;
         }
 
@@ -535,26 +414,26 @@ impl<'a> YarnLock<'a> {
     }
 }
 
-#[derive(Clone, Copy, PartialEq, Eq)]
-enum DependencyType {
-    Production,
-    Development,
-    Optional,
-    Peer,
-}
-
-fn read_package_json(
+/// Parses `<workspace_path>/package.json` (the root's for `None`) the way `bun install` does and appends it.
+fn append_package_json(
+    this: &mut Lockfile,
     manager: &mut PackageManager,
     log: &mut bun_ast::Log,
-    abs_package_json_path: &[u8],
-) -> Result<(bun_ast::Source, bun_ast::Expr), Error> {
-    match manager.workspace_package_json_cache.get_with_path(
+    workspace_path: Option<SemverString>,
+) -> Result<LockfilePackage, Error> {
+    let mut path = AutoAbsPath::init_top_level_dir();
+    let _ = path.append(match &workspace_path {
+        Some(workspace_path) => workspace_path.slice(this.buffers.string_bytes.as_slice()),
+        None => b"",
+    });
+    let _ = path.append(b"package.json");
+    let (source, json) = match manager.workspace_package_json_cache.get_with_path(
         log,
-        abs_package_json_path,
+        path.slice(),
         Default::default(),
     ) {
         // Cloned because parsing the root's `workspaces` grows the cache holding this entry.
-        GetJsonResult::Entry(entry) => Ok((entry.source.clone(), entry.root)),
+        GetJsonResult::Entry(entry) => (entry.source.clone(), entry.root),
         GetJsonResult::ReadErr(err) => {
             log.add_error_fmt(
                 None,
@@ -562,14 +441,21 @@ fn read_package_json(
                 format_args!(
                     "{} reading \"{}\"",
                     err.name(),
-                    bstr::BStr::new(abs_package_json_path)
+                    bstr::BStr::new(path.slice())
                 ),
             );
-            Err(err)
+            return Err(err);
         }
         // The parse diagnostics are already in `log`.
-        GetJsonResult::ParseErr(_) => Err(crate::Error::InvalidPackageJSON),
+        GetJsonResult::ParseErr(_) => return Err(crate::Error::InvalidPackageJSON),
+    };
+    let mut package = LockfilePackage::default();
+    let features = workspace_path.map_or(Features::main(), |_| Features::WORKSPACE);
+    package.parse_with_json(this, manager, log, &source, json, &mut (), features)?;
+    if let Some(workspace_path) = workspace_path {
+        package.resolution = Resolution::init(ResolutionValue::Workspace(workspace_path));
     }
+    Ok(this.append_package(&package)?)
 }
 
 struct Binder<'a> {
@@ -665,14 +551,6 @@ fn bind_importer_dependencies(
     debug_assert!(declared.next().is_none());
 }
 
-#[derive(Clone)]
-struct VersionInfo {
-    // Owned Vec<u8> (rather than a borrow from the input) avoids a second
-    // lifetime on the local map.
-    version: Vec<u8>,
-    package_id: PackageID,
-}
-
 pub(crate) fn migrate_yarn_lockfile<'a>(
     this: &'a mut Lockfile,
     manager: &mut PackageManager,
@@ -705,23 +583,7 @@ pub(crate) fn migrate_yarn_lockfile<'a>(
         };
     }
 
-    let root = {
-        let mut package_json_path = AutoAbsPath::init_top_level_dir();
-        let _ = package_json_path.append(b"package.json");
-        let (source, json) = read_package_json(manager, log, package_json_path.slice())?;
-        let mut root = LockfilePackage::default();
-        let mut resolver: () = ();
-        root.parse_with_json(
-            this,
-            manager,
-            log,
-            &source,
-            json,
-            &mut resolver,
-            Features::main(),
-        )?;
-        this.append_package(&root)?
-    };
+    let root = append_package_json(this, manager, log, None)?;
     debug_assert_eq!(root.meta.id, 0);
 
     let mut workspace_id_by_path: StringHashMap<PackageID> = StringHashMap::new();
@@ -731,26 +593,7 @@ pub(crate) fn migrate_yarn_lockfile<'a>(
             continue;
         }
         let workspace_path = *dep.version.workspace();
-
-        let mut package_json_path = AutoAbsPath::init_top_level_dir();
-        let _ =
-            package_json_path.append(workspace_path.slice(this.buffers.string_bytes.as_slice()));
-        let _ = package_json_path.append(b"package.json");
-        let (source, json) = read_package_json(manager, log, package_json_path.slice())?;
-
-        let mut workspace = LockfilePackage::default();
-        let mut resolver: () = ();
-        workspace.parse_with_json(
-            this,
-            manager,
-            log,
-            &source,
-            json,
-            &mut resolver,
-            Features::WORKSPACE,
-        )?;
-        workspace.resolution = Resolution::init(ResolutionValue::Workspace(workspace_path));
-        let workspace = this.append_package(&workspace)?;
+        let workspace = append_package_json(this, manager, log, Some(workspace_path))?;
         workspace_id_by_path.put(
             workspace_path.slice(this.buffers.string_bytes.as_slice()),
             workspace.meta.id,
@@ -758,74 +601,27 @@ pub(crate) fn migrate_yarn_lockfile<'a>(
     }
     let importer_count = this.packages.len();
 
-    let mut yarn_entry_to_package_id: Vec<PackageID> = vec![0; yarn_lock.entries.len()];
-
-    let mut package_versions: StringHashMap<VersionInfo> = StringHashMap::new();
-
-    let mut scoped_packages: StringHashMap<Vec<VersionInfo>> = StringHashMap::new();
-
+    // One id per distinct (dedupe name, version), in order of first appearance.
+    let mut yarn_entry_to_package_id: Vec<PackageID> = Vec::with_capacity(yarn_lock.entries.len());
+    let mut package_id_by_name_version: StringHashMap<PackageID> = StringHashMap::new();
     let mut next_package_id: PackageID = PackageID::try_from(importer_count).expect("int cast");
-
-    for (yarn_idx, entry) in yarn_lock.entries.iter().enumerate() {
-        let name: &[u8] = entry.dedupe_name();
-        let version = entry.version;
-
-        if let Some(existing) = package_versions.get(name).cloned() {
-            if existing.version.as_slice() != version {
-                let mut list = scoped_packages.get(name).cloned().unwrap_or_default();
-
-                let mut found_existing = false;
-                let mut found_new = false;
-                for item in list.iter() {
-                    if item.version.as_slice() == existing.version.as_slice() {
-                        found_existing = true;
-                    }
-                    if item.version.as_slice() == version {
-                        found_new = true;
-                    }
-                }
-
-                if !found_existing {
-                    list.push(existing);
-                }
-
-                if !found_new {
-                    let package_id = next_package_id;
-                    next_package_id += 1;
-                    list.push(VersionInfo {
-                        version: version.to_vec(),
-                        package_id,
-                    });
-                    yarn_entry_to_package_id[yarn_idx] = package_id;
-                } else {
-                    for item in list.iter() {
-                        if item.version.as_slice() == version {
-                            yarn_entry_to_package_id[yarn_idx] = item.package_id;
-                            break;
-                        }
-                    }
-                }
-
-                scoped_packages.put(name, list)?;
-            } else {
-                yarn_entry_to_package_id[yarn_idx] = existing.package_id;
+    let mut key: Vec<u8> = Vec::new();
+    for entry in &yarn_lock.entries {
+        key.clear();
+        key.extend_from_slice(entry.dedupe_name());
+        key.push(b'\n');
+        key.extend_from_slice(entry.version);
+        let package_id = match package_id_by_name_version.get(key.as_slice()) {
+            Some(&package_id) => package_id,
+            None => {
+                package_id_by_name_version.put(&key, next_package_id)?;
+                next_package_id += 1;
+                next_package_id - 1
             }
-        } else {
-            let package_id = next_package_id;
-            next_package_id += 1;
-            yarn_entry_to_package_id[yarn_idx] = package_id;
-            package_versions.put(
-                name,
-                VersionInfo {
-                    version: version.to_vec(),
-                    package_id,
-                },
-            )?;
-        }
+        };
+        yarn_entry_to_package_id.push(package_id);
     }
 
-    let mut package_id_to_yarn_idx: Vec<usize> = vec![usize::MAX; next_package_id as usize];
-
     // The ids handed out above count every distinct name@version, but an entry
     // whose resolution cannot be built is not appended below, and a package's id
     // has to be its index in `this.packages`. Maps the ids above to the appended
@@ -833,32 +629,23 @@ pub(crate) fn migrate_yarn_lockfile<'a>(
     // the same unresolved edge as a spec with no yarn.lock entry at all.
     let mut appended_package_ids: Vec<PackageID> =
         vec![install::INVALID_PACKAGE_ID; next_package_id as usize];
+    let mut seen_package_ids = vec![false; next_package_id as usize];
     let silent = manager.options.log_level.is_silent();
 
-    for (yarn_idx, entry) in yarn_lock.entries.iter().enumerate() {
+    for (entry, &package_id) in yarn_lock.entries.iter().zip(&yarn_entry_to_package_id) {
         let is_direct_url_dep = entry.has_direct_url_spec();
         let base_name: &[u8] = entry.name;
-        let package_id = yarn_entry_to_package_id[yarn_idx];
-
-        if (package_id as usize) < package_id_to_yarn_idx.len()
-            && package_id_to_yarn_idx[package_id as usize] != usize::MAX
-        {
+        if core::mem::replace(&mut seen_package_ids[package_id as usize], true) {
             continue;
         }
 
-        package_id_to_yarn_idx[package_id as usize] = yarn_idx;
-
         let resolved_url: Option<&[u8]> = entry.resolved.as_deref().map(Entry::url_without_hash);
-
-        let name_to_use: &[u8] = 'blk: {
-            if entry.commit.is_some() && entry.git_repo_name.is_some() {
-                break 'blk entry.git_repo_name.as_deref().unwrap();
-            } else if let (true, Some(resolved)) = (is_direct_url_dep, resolved_url) {
-                if let Some(name) = Entry::get_package_name_from_default_registry_url(resolved) {
-                    break 'blk name;
-                }
-            }
-            break 'blk base_name;
+        let name_to_use: &[u8] = match (entry.commit, entry.git_repo_name.as_deref()) {
+            (Some(_), Some(repo_name)) => repo_name,
+            _ => resolved_url
+                .filter(|_| is_direct_url_dep)
+                .and_then(Entry::get_package_name_from_default_registry_url)
+                .unwrap_or(base_name),
         };
 
         let name_hash = string_hash(name_to_use);
@@ -882,67 +669,52 @@ pub(crate) fn migrate_yarn_lockfile<'a>(
                     break 'blk Resolution::init(ResolutionValue::Folder(sbuf!().append(file)?));
                 }
             } else if let Some(commit) = entry.commit {
-                if let Some(resolved) = entry.resolved.as_deref() {
-                    let mut owner_str: &[u8] = b"";
-                    let mut repo_str: &[u8] = resolved;
-
-                    if strings::index_of(resolved, b"github.com/").is_some() {
-                        if let Some(idx) = strings::index_of(resolved, b"github.com/") {
-                            let after_github = &resolved[idx + b"github.com/".len()..];
-                            if let Some(slash_idx) = strings::index_of(after_github, b"/") {
-                                owner_str = &after_github[0..slash_idx];
-                                repo_str = &after_github[slash_idx + 1..];
-                                if repo_str.ends_with(b".git") {
-                                    repo_str = &repo_str[0..repo_str.len() - 4];
-                                }
-                            }
-                        }
-                    }
-
-                    let actual_name: &[u8] = if let Some(repo_name) = &entry.git_repo_name {
-                        repo_name
-                    } else {
-                        repo_str
-                    };
-
-                    if !owner_str.is_empty() && !repo_str.is_empty() {
-                        break 'blk Resolution::init(ResolutionValue::Github(Repository {
-                            owner: sbuf!().append(owner_str)?,
-                            repo: sbuf!().append(repo_str)?,
-                            committish: sbuf!()
-                                .append(&commit[0..b"github:".len().min(commit.len())])?,
-                            resolved: SemverString::default(),
-                            package_name: sbuf!().append(actual_name)?,
-                        }));
-                    } else {
-                        break 'blk Resolution::init(ResolutionValue::Git(Repository {
-                            owner: sbuf!().append(owner_str)?,
-                            repo: sbuf!().append(repo_str)?,
-                            committish: sbuf!().append(commit)?,
-                            resolved: SemverString::default(),
-                            package_name: sbuf!().append(actual_name)?,
-                        }));
+                let Some(resolved) = entry.resolved.as_deref() else {
+                    break 'blk Resolution::default();
+                };
+                let mut owner_str: &[u8] = b"";
+                let mut repo_str: &[u8] = resolved;
+                if let Some(idx) = strings::index_of(resolved, b"github.com/") {
+                    let after_github = &resolved[idx + b"github.com/".len()..];
+                    if let Some((owner, repo)) = strings::split_once_char(after_github, b'/') {
+                        owner_str = owner;
+                        repo_str = repo.strip_suffix(b".git").unwrap_or(repo);
                     }
                 }
-                break 'blk Resolution::default();
+                let is_github = !owner_str.is_empty() && !repo_str.is_empty();
+                let repository = Repository {
+                    owner: sbuf!().append(owner_str)?,
+                    repo: sbuf!().append(repo_str)?,
+                    committish: sbuf!().append(if is_github {
+                        &commit[0..b"github:".len().min(commit.len())]
+                    } else {
+                        commit
+                    })?,
+                    resolved: SemverString::default(),
+                    package_name: sbuf!()
+                        .append(entry.git_repo_name.as_deref().unwrap_or(repo_str))?,
+                };
+                break 'blk Resolution::init(if is_github {
+                    ResolutionValue::Github(repository)
+                } else {
+                    ResolutionValue::Git(repository)
+                });
             } else {
-                if let Some(resolved) = resolved_url {
-                    if is_direct_url_dep {
+                match resolved_url {
+                    Some(resolved) if is_direct_url_dep => {
                         break 'blk Resolution::init(ResolutionValue::RemoteTarball(
                             sbuf!().append(resolved)?,
                         ));
                     }
-                } else if !entry.is_registry_entry() {
-                    break 'blk Resolution::default();
+                    None if !entry.is_registry_entry() => break 'blk Resolution::default(),
+                    _ => {}
                 }
 
                 let version = sbuf!().append(entry.version)?;
                 let result =
                     Semver::Version::parse(version.sliced(this.buffers.string_bytes.as_slice()));
                 if !result.valid {
-                    // Not a registry version: an off-registry tarball (codeload and the like)
-                    // is installed from its URL; a registry entry with a version that is not
-                    // semver is skipped below with a warning.
+                    // An off-registry tarball (codeload and the like) installs from its URL.
                     if let Some(resolved) = resolved_url
                         && Entry::is_remote_tarball(resolved)
                         && Entry::get_package_name_from_default_registry_url(resolved).is_none()
@@ -957,19 +729,16 @@ pub(crate) fn migrate_yarn_lockfile<'a>(
                     break 'blk Resolution::default();
                 }
 
-                // `has_trusted_dependency` compares this URL with the canonical registry
-                // tarball URL, so it must be the bare URL a fresh install records: no
-                // `#sha1`, and no RemoteTarball just because the URL ends in `.tgz`.
-                // An empty url is fetched by name@version from the configured registry.
-                let is_default_registry = |resolved: &[u8]| {
-                    resolved.starts_with(b"https://registry.yarnpkg.com/")
-                        || resolved.starts_with(b"https://registry.npmjs.org/")
-                };
+                // The bare URL a fresh install records (`has_trusted_dependency` compares it); empty means the configured registry.
                 let url = match resolved_url {
-                    Some(resolved) if !is_default_registry(resolved) => sbuf!().append(resolved)?,
+                    Some(resolved)
+                        if !(resolved.starts_with(b"https://registry.yarnpkg.com/")
+                            || resolved.starts_with(b"https://registry.npmjs.org/")) =>
+                    {
+                        sbuf!().append(resolved)?
+                    }
                     _ => SemverString::default(),
                 };
-
                 break 'blk Resolution::init(ResolutionValue::Npm(VersionedURL {
                     url,
                     version: result.version.min(),
@@ -979,25 +748,19 @@ pub(crate) fn migrate_yarn_lockfile<'a>(
 
         if resolution.tag == crate::resolution::Tag::Uninitialized {
             if !silent {
-                let specs = bstr::join(", ", &entry.specs);
-                let specs = bstr::BStr::new(&specs);
-                if entry.version.is_empty() {
-                    bun_core::warn!(
-                        "skipped \"{}\" from yarn.lock: missing \"version\" field",
-                        specs
-                    );
+                let reason: Cow<str> = if entry.version.is_empty() {
+                    "missing \"version\" field".into()
                 } else if !Semver::Version::parse_utf8(entry.version).valid {
-                    bun_core::warn!(
-                        "skipped \"{}\" from yarn.lock: invalid version \"{}\"",
-                        specs,
-                        bstr::BStr::new(entry.version)
-                    );
+                    format!("invalid version \"{}\"", bstr::BStr::new(entry.version)).into()
                 } else {
-                    bun_core::warn!(
-                        "skipped \"{}\" from yarn.lock: missing \"resolved\" field",
-                        specs
-                    );
-                }
+                    "missing \"resolved\" field".into()
+                };
+                let specs = bstr::join(", ", &entry.specs);
+                bun_core::warn!(
+                    "skipped \"{}\" from yarn.lock: {}",
+                    bstr::BStr::new(&specs),
+                    reason
+                );
             }
             continue;
         }
@@ -1014,31 +777,13 @@ pub(crate) fn migrate_yarn_lockfile<'a>(
             meta: PackageMeta {
                 id: appended_id,
                 origin: Origin::Npm,
-                arch: if let Some(cpu_list) = &entry.cpu {
-                    let mut arch = npm::Architecture::NONE.negatable();
-                    for cpu in cpu_list.iter() {
-                        arch.apply(cpu);
-                    }
-                    arch.combine()
-                } else {
-                    npm::Architecture::ALL
-                },
-                os: if let Some(os_list) = &entry.os {
-                    let mut os = npm::OperatingSystem::NONE.negatable();
-                    for os_str in os_list.iter() {
-                        os.apply(os_str);
-                    }
-                    os.combine()
-                } else {
-                    npm::OperatingSystem::ALL
-                },
+                arch: platform_list(&entry.cpu),
+                os: platform_list(&entry.os),
                 man_dir: SemverString::default(),
                 has_install_script: HasInstallScript::False,
-                integrity: if let Some(integrity) = entry.integrity {
-                    Integrity::parse(integrity)
-                } else {
-                    Integrity::default()
-                },
+                integrity: entry
+                    .integrity
+                    .map_or_else(Integrity::default, Integrity::parse),
                 ..Default::default()
             },
             bin: Bin::init(),
@@ -1071,11 +816,11 @@ pub(crate) fn migrate_yarn_lockfile<'a>(
             continue;
         }
 
-        let mut dep_count: u32 = 0;
         let deps_off = u32::try_from(this.buffers.dependencies.len()).expect("int cast");
-        let resolutions_off = u32::try_from(this.buffers.resolutions.len()).expect("int cast");
-
-        if let Some(deps) = &entry.dependencies {
+        for (deps, (_, behavior)) in entry.dependencies.iter().zip(DEPENDENCY_SECTIONS) {
+            let Some(deps) = deps else {
+                continue;
+            };
             for (dep_name_key, dep_version_ref) in deps.iter() {
                 let dep_name: &[u8] = dep_name_key.as_ref();
                 let dep_version_literal: &[u8] = *dep_version_ref;
@@ -1083,210 +828,43 @@ pub(crate) fn migrate_yarn_lockfile<'a>(
                 let name_hash = string_hash(dep_name);
                 let dep_name_string = sbuf!().append_with_hash(dep_name, name_hash)?;
                 let dep_version_string = sbuf!().append(dep_version_literal)?;
-                let sliced_string = SlicedString::init(
-                    dep_version_string.slice(this.buffers.string_bytes.as_slice()),
-                    dep_version_string.slice(this.buffers.string_bytes.as_slice()),
-                );
-
-                let mut parsed_version = Dependency::parse(
-                    dep_name_string,
-                    Some(name_hash),
-                    dep_version_string.slice(this.buffers.string_bytes.as_slice()),
-                    &sliced_string,
-                    Some(&mut *log),
-                    Some(&mut *manager),
-                )
-                .unwrap_or_default();
-
-                parsed_version.literal = dep_version_string;
-
-                this.buffers.dependencies.push(Dependency {
-                    name: dep_name_string,
-                    name_hash,
-                    version: parsed_version,
-                    behavior: dependency::Behavior::PROD,
-                });
-
-                let mut dep_spec = Vec::new();
-                write!(
-                    &mut dep_spec,
-                    "{}@{}",
-                    bstr::BStr::new(dep_name),
-                    bstr::BStr::new(dep_version_literal)
-                )
-                .expect("unreachable");
-
-                if let Some(res_pkg_id) = spec_to_package_id.get(dep_spec.as_slice()).copied() {
-                    this.buffers.resolutions.push(res_pkg_id);
-                } else {
-                    this.buffers.resolutions.push(install::INVALID_PACKAGE_ID);
-                }
-
-                dep_count += 1;
-            }
-        }
-
-        if let Some(optional_deps) = &entry.optional_dependencies {
-            for (dep_name_key, dep_version_ref) in optional_deps.iter() {
-                let dep_name: &[u8] = dep_name_key.as_ref();
-                let dep_version_literal: &[u8] = *dep_version_ref;
-
-                let name_hash = string_hash(dep_name);
-                let dep_name_string = sbuf!().append_with_hash(dep_name, name_hash)?;
-
-                let dep_version_string = sbuf!().append(dep_version_literal)?;
-                let sliced_string = SlicedString::init(
-                    dep_version_string.slice(this.buffers.string_bytes.as_slice()),
-                    dep_version_string.slice(this.buffers.string_bytes.as_slice()),
-                );
-
-                let mut parsed_version = Dependency::parse(
-                    dep_name_string,
-                    Some(name_hash),
-                    dep_version_string.slice(this.buffers.string_bytes.as_slice()),
-                    &sliced_string,
-                    Some(&mut *log),
-                    Some(&mut *manager),
-                )
-                .unwrap_or_default();
-
-                parsed_version.literal = dep_version_string;
-
-                this.buffers.dependencies.push(Dependency {
-                    name: dep_name_string,
-                    name_hash,
-                    version: parsed_version,
-                    behavior: dependency::Behavior::OPTIONAL,
-                });
-
-                let mut dep_spec = Vec::new();
-                write!(
-                    &mut dep_spec,
-                    "{}@{}",
-                    bstr::BStr::new(dep_name),
-                    bstr::BStr::new(dep_version_literal)
-                )
-                .expect("unreachable");
-
-                if let Some(res_pkg_id) = spec_to_package_id.get(dep_spec.as_slice()).copied() {
-                    this.buffers.resolutions.push(res_pkg_id);
-                } else {
-                    this.buffers.resolutions.push(install::INVALID_PACKAGE_ID);
-                }
-
-                dep_count += 1;
-            }
-        }
-
-        if let Some(peer_deps) = &entry.peer_dependencies {
-            for (dep_name_key, dep_version_ref) in peer_deps.iter() {
-                let dep_name: &[u8] = dep_name_key.as_ref();
-                let dep_version_literal: &[u8] = *dep_version_ref;
-
-                let name_hash = string_hash(dep_name);
-                let dep_name_string = sbuf!().append_with_hash(dep_name, name_hash)?;
-
-                let dep_version_string = sbuf!().append(dep_version_literal)?;
-                let sliced_string = SlicedString::init(
-                    dep_version_string.slice(this.buffers.string_bytes.as_slice()),
-                    dep_version_string.slice(this.buffers.string_bytes.as_slice()),
-                );
-
-                let mut parsed_version = Dependency::parse(
-                    dep_name_string,
-                    Some(name_hash),
-                    dep_version_string.slice(this.buffers.string_bytes.as_slice()),
-                    &sliced_string,
-                    Some(&mut *log),
-                    Some(&mut *manager),
-                )
-                .unwrap_or_default();
-
-                parsed_version.literal = dep_version_string;
-
-                this.buffers.dependencies.push(Dependency {
-                    name: dep_name_string,
-                    name_hash,
-                    version: parsed_version,
-                    behavior: dependency::Behavior::PEER,
-                });
-
-                let mut dep_spec = Vec::new();
-                write!(
-                    &mut dep_spec,
-                    "{}@{}",
-                    bstr::BStr::new(dep_name),
-                    bstr::BStr::new(dep_version_literal)
-                )
-                .expect("unreachable");
-
-                if let Some(res_pkg_id) = spec_to_package_id.get(dep_spec.as_slice()).copied() {
-                    this.buffers.resolutions.push(res_pkg_id);
-                } else {
-                    this.buffers.resolutions.push(install::INVALID_PACKAGE_ID);
-                }
-
-                dep_count += 1;
-            }
-        }
-
-        if let Some(dev_deps) = &entry.dev_dependencies {
-            for (dep_name_key, dep_version_ref) in dev_deps.iter() {
-                let dep_name: &[u8] = dep_name_key.as_ref();
-                let dep_version_literal: &[u8] = *dep_version_ref;
-
-                let name_hash = string_hash(dep_name);
-                let dep_name_string = sbuf!().append_with_hash(dep_name, name_hash)?;
-
-                let dep_version_string = sbuf!().append(dep_version_literal)?;
-                let sliced_string = SlicedString::init(
-                    dep_version_string.slice(this.buffers.string_bytes.as_slice()),
-                    dep_version_string.slice(this.buffers.string_bytes.as_slice()),
-                );
-
+                let version_bytes = dep_version_string.slice(this.buffers.string_bytes.as_slice());
+                let sliced_string = SlicedString::init(version_bytes, version_bytes);
                 let mut parsed_version = Dependency::parse(
                     dep_name_string,
                     Some(name_hash),
-                    dep_version_string.slice(this.buffers.string_bytes.as_slice()),
+                    version_bytes,
                     &sliced_string,
                     Some(&mut *log),
                     Some(&mut *manager),
                 )
                 .unwrap_or_default();
-
                 parsed_version.literal = dep_version_string;
 
                 this.buffers.dependencies.push(Dependency {
                     name: dep_name_string,
                     name_hash,
                     version: parsed_version,
-                    behavior: dependency::Behavior::DEV,
+                    behavior,
                 });
 
-                let mut dep_spec = Vec::new();
-                write!(
-                    &mut dep_spec,
-                    "{}@{}",
-                    bstr::BStr::new(dep_name),
-                    bstr::BStr::new(dep_version_literal)
-                )
-                .expect("unreachable");
-
-                if let Some(res_pkg_id) = spec_to_package_id.get(dep_spec.as_slice()).copied() {
-                    this.buffers.resolutions.push(res_pkg_id);
-                } else {
-                    this.buffers.resolutions.push(install::INVALID_PACKAGE_ID);
-                }
-
-                dep_count += 1;
+                key.clear();
+                key.extend_from_slice(dep_name);
+                key.push(b'@');
+                key.extend_from_slice(dep_version_literal);
+                let resolution = spec_to_package_id.get(key.as_slice()).copied();
+                this.buffers
+                    .resolutions
+                    .push(resolution.unwrap_or(install::INVALID_PACKAGE_ID));
             }
         }
+        let dep_count =
+            u32::try_from(this.buffers.dependencies.len()).expect("int cast") - deps_off;
 
         this.packages.items_dependencies_mut()[package_id as usize] =
             lockfile::DependencySlice::new(deps_off, dep_count);
-
         this.packages.items_resolutions_mut()[package_id as usize] =
-            lockfile::DependencyIDSlice::new(resolutions_off, dep_count);
+            lockfile::DependencyIDSlice::new(deps_off, dep_count);
     }
 
     // `Lockfile::resolve` returns `Result<(), tree::SubtreeError>`; surface as
@@ -1317,3 +895,15 @@ pub(crate) fn migrate_yarn_lockfile<'a>(
 fn string_hash(s: &[u8]) -> u64 {
     Semver::string::Builder::string_hash(s)
 }
+
+/// yarn.lock's `os`/`cpu` lists; an entry without one installs everywhere.
+fn platform_list<T: npm::NegatableEnum>(list: &Option<Vec<&[u8]>>) -> T {
+    let Some(list) = list else {
+        return T::ALL;
+    };
+    let mut negatable = T::NONE.negatable();
+    for item in list {
+        negatable.apply(item);
+    }
+    negatable.combine()
+}

From 4921339e2087438bc7e022a9a6c730b8ec79dd4d Mon Sep 17 00:00:00 2001
From: Jarred Sumner <jarred@jarredsumner.com>
Date: Mon, 17 Aug 2026 05:42:09 +0000
Subject: [PATCH 244/258] =?UTF-8?q?simplify(s4-migration):=20pnpm.rs=20?=
 =?UTF-8?q?=E2=80=94=20merge-based=20copy=5Finto=5Froot,=20one=20workspace?=
 =?UTF-8?q?s=20object=20path,=20drop=20redundant=20trusted=20fill?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

- copy_into_root always merges into a (possibly new) root-level object, so
  copy_object/shallow_clone_prop go away; the bare patch-key completion that
  rewrite_bare_patch_keys did happens during that merge
- the three branches that wrote `workspaces` (array, existing object, new
  object) collapse into array-or-object
- add_trusted_dependencies no longer fills lockfile.trusted_dependencies:
  migration::record_trusted_dependencies reads the edited cache entry right
  after and records the same list
- trim multi-line comments

(cherry picked from commit 736bc1281c48622f69c7613a1015cbe3fdb89456)
---
 src/install/pnpm.rs | 305 +++++++++++---------------------------------
 1 file changed, 78 insertions(+), 227 deletions(-)

diff --git a/src/install/pnpm.rs b/src/install/pnpm.rs
index 7a8d4b09654e..87a65a971f7e 100644
--- a/src/install/pnpm.rs
+++ b/src/install/pnpm.rs
@@ -5,7 +5,7 @@ use std::io::Write as _;
 use bun_alloc::AllocError;
 use bun_collections::StringArrayHashMap;
 
-use bun_ast::{self, self as js_ast, E, Expr, ExprData, G};
+use bun_ast::{self, self as js_ast, E, Expr, ExprData};
 use bun_core::{Global, strings};
 use bun_semver as semver;
 use bun_semver::query::token::Wildcard;
@@ -47,10 +47,7 @@ macro_rules! string_bytes {
     };
 }
 
-// Binds a root or workspace edge the way bun.lock's reader does. `workspace:*` rows and ranges
-// pnpm linked to a member arrive here parsed from their literal, while the package.json rows the
-// differ compares them against carry the member's path. A macro so callers can keep slices of
-// `string_bytes` alive across the call.
+// Binds a root or workspace edge the way bun.lock's reader does (a linked member's row takes its path).
 macro_rules! bind_importer_dependency {
     ($lockfile:expr, $dep_id:expr, $pkg_id:expr) => {{
         let pkg_id: PackageID = $pkg_id;
@@ -494,16 +491,6 @@ fn e_object_mut(expr: &mut Expr) -> &mut E::Object {
     }
 }
 
-/// Shallow struct copy (`G::Property` lacks `Clone` because of its
-/// `Vec`/`NonNull` fields).
-fn shallow_clone_prop(p: &G::Property) -> G::Property {
-    G::Property {
-        key: p.key,
-        value: p.value,
-        ..Default::default()
-    }
-}
-
 pub(crate) fn migrate_pnpm_lockfile<'a>(
     lockfile: &'a mut Lockfile,
     manager: &mut PackageManager,
@@ -1812,10 +1799,8 @@ fn declared_package_peers(
     Ok(peers)
 }
 
-/// pnpm records a folder package's `file:` dependencies relative to the lockfile
-/// (`file:sub-dep/child` for a declared `file:./child`), which the resolution
-/// pass above keys on; bun.lock stores them relative to the declaring package,
-/// as declared. Importers already carry the declared `specifier`.
+/// pnpm records a folder package's `file:` dependencies relative to the lockfile (`file:sub-dep/child`
+/// for a declared `file:./child`); bun.lock stores them as declared, relative to the declaring package.
 fn declare_folder_dependencies_relative_to_their_package(
     lockfile: &mut Lockfile,
 ) -> Result<(), AllocError> {
@@ -2053,9 +2038,7 @@ fn append_importer_dependency(
     specifier_str: &[u8],
     behavior: dependency::Behavior,
 ) -> Result<(), ParseAppendDependenciesError> {
-    // The row keeps its `catalog:` reference, as the package.json parser and the bun.lock reader
-    // keep theirs; the importer's own `version:` field binds it below. Only the entry's existence
-    // is checked here.
+    // The row keeps its `catalog:` reference (the importer's `version:` binds it); only existence is checked.
     if let Some(catalog_name) =
         strings::without_prefix_if_possible_comptime(specifier_str, b"catalog:")
     {
@@ -2366,37 +2349,6 @@ fn sort_appended_dependencies(lockfile: &mut Lockfile, off: usize) {
     buffers.dependencies.append(&mut appended);
 }
 
-/// bun.lock keys patches by `name@version`; pnpm also allows a bare `name` key.
-fn rewrite_bare_patch_keys(
-    obj: &mut Expr,
-    patches: &StringArrayHashMap<Box<[u8]>>,
-) -> Result<(), AllocError> {
-    if patches.count() == 0 {
-        return Ok(());
-    }
-    let mut join_buf: Vec<u8> = Vec::new();
-    for prop in e_object_mut(obj).properties.slice_mut() {
-        let Some(key_str) = as_string(prop.key.as_ref().expect("infallible: prop has key")) else {
-            continue;
-        };
-        let Some(res_str) = patches.get(key_str) else {
-            continue;
-        };
-        join_buf.clear();
-        write!(
-            &mut join_buf,
-            "{}@{}",
-            bstr::BStr::new(key_str),
-            bstr::BStr::new(&**res_str)
-        )
-        .map_err(|_| AllocError)?;
-        // `join_buf` is reused by the next key; the tree is printed after this fn returns.
-        let interned: &[u8] = js_ast::data_store_dupe_str(join_buf.as_slice());
-        prop.key = Some(Expr::init(E::EString::init(interned), bun_ast::Loc::EMPTY));
-    }
-    Ok(())
-}
-
 /// pnpm's allow-list of packages that may run lifecycle scripts, i.e. bun's `trustedDependencies`.
 fn collect_only_built_dependencies(list: &Expr, out: &mut Vec<&'static [u8]>) -> bool {
     let Some(mut items) = list.as_array() else {
@@ -2418,10 +2370,8 @@ fn collect_only_built_dependencies(list: &Expr, out: &mut Vec<&'static [u8]>) ->
     found_any
 }
 
-/// The migrated root skips `Package::parse`, so the lockfile's list is filled in here as well.
 fn add_trusted_dependencies(
     json: &mut Expr,
-    lockfile: Option<&mut Lockfile>,
     bump: &bun_alloc::Arena,
     names: &[&'static [u8]],
 ) -> Result<bool, AllocError> {
@@ -2452,22 +2402,6 @@ fn add_trusted_dependencies(
         );
         added_any = true;
     }
-
-    // A root parsed by `Package::parse` fills this from the file; the migrated root skips that.
-    if let Some(lockfile) = lockfile {
-        let trusted = lockfile
-            .trusted_dependencies
-            .get_or_insert_with(Default::default);
-        for item in items.slice() {
-            if let Some(name) = as_string(item) {
-                trusted.put(
-                    semver::string::Builder::string_hash(name) as crate::TruncatedPackageNameHash,
-                    Box::from(name),
-                )?;
-            }
-        }
-    }
-
     if !added_any {
         return Ok(false);
     }
@@ -2505,10 +2439,8 @@ pub(crate) fn migrate_pnpm_workspace_config(
     update_package_json_after_migration(None, manager, log, &StringArrayHashMap::new())
 }
 
-/// Copies the workspace, catalog, override, patch and onlyBuiltDependencies settings pnpm keeps in
-/// `pnpm-workspace.yaml` and the `pnpm` key into the fields bun reads, in the cached root package.json. Only the
-/// cache entry changes here: the rest of the load (frozen check, differ) reads it from there, and
-/// `package_json_write_back::record_migrated_root` writes it when the migrated lockfile is saved.
+/// Copies the settings pnpm keeps in `pnpm-workspace.yaml` and the `pnpm` key into the fields bun reads, in the
+/// cached root package.json; `package_json_write_back::record_migrated_root` writes it if the lockfile is saved.
 fn update_package_json_after_migration(
     mut lockfile: Option<&mut Lockfile>,
     manager: &mut PackageManager,
@@ -2527,39 +2459,34 @@ fn update_package_json_after_migration(
     }
 
     let mut copied: Vec<&'static str> = Vec::new();
-
-    // Copied rather than moved out of the `pnpm` block: pnpm itself still reads it there.
     let mut trusted_names: Vec<&'static [u8]> = Vec::new();
     let mut pnpm_only_built_deps = false;
     let mut workspace_only_built_deps = false;
 
     // Copied, not moved: pnpm keeps reading this block, bun only reads the root-level fields.
-    if let Some(pnpm_prop) = json.as_property(b"pnpm") {
-        if pnpm_prop.expr.is_object() {
-            let pnpm_obj = e_object(&pnpm_prop.expr);
-
-            if let Some(overrides) = pnpm_obj.get(b"overrides").filter(is_non_empty_object) {
-                if copy_into_root(&mut json, &bump, b"overrides", copy_object(&overrides))? {
-                    copied.push("pnpm.overrides to overrides");
-                }
+    if let Some(pnpm_obj) = json.get(b"pnpm").filter(|pnpm| pnpm.is_object()) {
+        if let Some(overrides) = pnpm_obj.get(b"overrides").filter(is_non_empty_object) {
+            if copy_into_root(&mut json, &bump, b"overrides", &overrides, None)? {
+                copied.push("pnpm.overrides to overrides");
             }
-
-            if let Some(patched) = pnpm_obj
-                .get(b"patchedDependencies")
-                .filter(is_non_empty_object)
-            {
-                let mut patched = copy_object(&patched);
-                rewrite_bare_patch_keys(&mut patched, patches)?;
-                if copy_into_root(&mut json, &bump, b"patchedDependencies", patched)? {
-                    copied.push("pnpm.patchedDependencies to patchedDependencies");
-                }
-            }
-
-            if let Some(only_built) = pnpm_obj.get(b"onlyBuiltDependencies") {
-                pnpm_only_built_deps =
-                    collect_only_built_dependencies(&only_built, &mut trusted_names);
+        }
+        if let Some(patched) = pnpm_obj
+            .get(b"patchedDependencies")
+            .filter(is_non_empty_object)
+        {
+            if copy_into_root(
+                &mut json,
+                &bump,
+                b"patchedDependencies",
+                &patched,
+                Some(patches),
+            )? {
+                copied.push("pnpm.patchedDependencies to patchedDependencies");
             }
         }
+        if let Some(only_built) = pnpm_obj.get(b"onlyBuiltDependencies") {
+            pnpm_only_built_deps = collect_only_built_dependencies(&only_built, &mut trusted_names);
+        }
     }
 
     let mut workspace_paths: Option<Vec<&[u8]>> = None;
@@ -2617,120 +2544,51 @@ fn update_package_json_after_migration(
         Err(_) => {}
     }
 
-    let has_workspace_data =
-        workspace_paths.is_some() || catalog_obj.is_some() || catalogs_obj.is_some();
-
-    let mut wrote_workspaces = false;
-    if has_workspace_data {
-        let use_array_format =
-            workspace_paths.is_some() && catalog_obj.is_none() && catalogs_obj.is_none();
-
-        let existing_workspaces = e_object(&json).get(b"workspaces");
-        let is_object_workspaces = existing_workspaces
-            .as_ref()
-            .map(|e| e.is_object())
-            .unwrap_or(false);
-
-        if use_array_format {
-            let paths = workspace_paths.as_ref().unwrap();
+    if catalog_obj.is_none() && catalogs_obj.is_none() {
+        if let Some(paths) = &workspace_paths {
             e_object_mut(&mut json).put(&bump, b"workspaces", paths_array(paths))?;
-            wrote_workspaces = true;
-        } else if is_object_workspaces {
-            let mut existing_workspaces = existing_workspaces.unwrap();
-            let ws_obj = e_object_mut(&mut existing_workspaces);
-
-            if let Some(paths) = &workspace_paths {
-                if !paths.is_empty() {
-                    ws_obj.put(&bump, b"packages", paths_array(paths))?;
-                    wrote_workspaces = true;
-                }
-            }
-
-            if let Some(catalog) = catalog_obj {
-                ws_obj.put(&bump, b"catalog", catalog)?;
-                wrote_workspaces = true;
-            }
-
-            if let Some(catalogs) = catalogs_obj {
-                ws_obj.put(&bump, b"catalogs", catalogs)?;
-                wrote_workspaces = true;
-            }
-        } else if !use_array_format {
-            let mut ws_props = bun_alloc::AstAlloc::vec();
-
-            if let Some(paths) = &workspace_paths {
-                if !paths.is_empty() {
-                    let value = paths_array(paths);
-                    let key = Expr::init(E::EString::init(b"packages"), bun_ast::Loc::EMPTY);
-
-                    VecExt::append(
-                        &mut ws_props,
-                        G::Property {
-                            key: Some(key),
-                            value: Some(value),
-                            ..Default::default()
-                        },
-                    );
-                }
-            }
-
-            if let Some(catalog) = catalog_obj {
-                let key = Expr::init(E::EString::init(b"catalog"), bun_ast::Loc::EMPTY);
-                VecExt::append(
-                    &mut ws_props,
-                    G::Property {
-                        key: Some(key),
-                        value: Some(catalog),
-                        ..Default::default()
-                    },
-                );
-            }
-
-            if let Some(catalogs) = catalogs_obj {
-                let key = Expr::init(E::EString::init(b"catalogs"), bun_ast::Loc::EMPTY);
-                VecExt::append(
-                    &mut ws_props,
-                    G::Property {
-                        key: Some(key),
-                        value: Some(catalogs),
-                        ..Default::default()
-                    },
-                );
-            }
-
-            if ws_props.len_u32() > 0 {
-                let workspace_obj = Expr::init(
-                    E::Object {
-                        properties: ws_props,
-                        ..Default::default()
-                    },
-                    bun_ast::Loc::EMPTY,
-                );
-                e_object_mut(&mut json).put(&bump, b"workspaces", workspace_obj)?;
-                wrote_workspaces = true;
-            }
+            copied.push("pnpm-workspace.yaml to workspaces");
+        }
+    } else {
+        // An existing `workspaces` array is replaced by the object form.
+        let existing = json
+            .get(b"workspaces")
+            .filter(|workspaces| workspaces.is_object());
+        let mut workspaces = existing.unwrap_or_else(empty_object);
+        let workspaces_obj = e_object_mut(&mut workspaces);
+        if let Some(paths) = workspace_paths.as_ref().filter(|paths| !paths.is_empty()) {
+            workspaces_obj.put(&bump, b"packages", paths_array(paths))?;
+        }
+        if let Some(catalog) = catalog_obj {
+            workspaces_obj.put(&bump, b"catalog", catalog)?;
+        }
+        if let Some(catalogs) = catalogs_obj {
+            workspaces_obj.put(&bump, b"catalogs", catalogs)?;
+        }
+        if existing.is_none() {
+            e_object_mut(&mut json).put(&bump, b"workspaces", workspaces)?;
         }
-    }
-    if wrote_workspaces {
         copied.push("pnpm-workspace.yaml to workspaces");
     }
 
-    if let Some(ws_overrides) = workspace_overrides_obj {
-        if copy_into_root(&mut json, &bump, b"overrides", ws_overrides)? {
+    if let Some(overrides) = workspace_overrides_obj {
+        if copy_into_root(&mut json, &bump, b"overrides", &overrides, None)? {
             copied.push("pnpm-workspace.yaml overrides to overrides");
         }
     }
-
-    if let Some(mut ws_patched) = workspace_patched_deps_obj {
-        rewrite_bare_patch_keys(&mut ws_patched, patches)?;
-        if copy_into_root(&mut json, &bump, b"patchedDependencies", ws_patched)? {
+    if let Some(patched) = workspace_patched_deps_obj {
+        if copy_into_root(
+            &mut json,
+            &bump,
+            b"patchedDependencies",
+            &patched,
+            Some(patches),
+        )? {
             copied.push("pnpm-workspace.yaml patchedDependencies to patchedDependencies");
         }
     }
 
-    if !trusted_names.is_empty()
-        && add_trusted_dependencies(&mut json, lockfile, &bump, &trusted_names)?
-    {
+    if !trusted_names.is_empty() && add_trusted_dependencies(&mut json, &bump, &trusted_names)? {
         if pnpm_only_built_deps {
             copied.push("pnpm.onlyBuiltDependencies to trustedDependencies");
         }
@@ -2765,42 +2623,35 @@ fn is_non_empty_object(expr: &Expr) -> bool {
     matches!(&expr.data, ExprData::EObject(o) if !o.properties.is_empty())
 }
 
-/// The root-level copy gets edited further; an `Expr` from `get` would alias the `pnpm` block.
-fn copy_object(src: &Expr) -> Expr {
-    let src_props = e_object(src).properties.slice();
-    let mut properties = G::PropertyList::init_capacity(src_props.len());
-    for prop in src_props {
-        VecExt::append(&mut properties, shallow_clone_prop(prop));
-    }
-    Expr::init(
-        E::Object {
-            properties,
-            ..Default::default()
-        },
-        bun_ast::Loc::EMPTY,
-    )
+fn empty_object() -> Expr {
+    Expr::init(E::Object::default(), bun_ast::Loc::EMPTY)
 }
 
-/// Merges `src` into the root-level `field` (created when absent); `false` if it is not an object.
+/// Merges `src`'s entries into the root-level object `field`, created when absent (merged rather than aliased:
+/// the `pnpm` block stays as it is); `false` if `field` is not an object. With `patches`, a bare `name` key pnpm
+/// allows becomes bun.lock's `name@version`.
 fn copy_into_root(
     json: &mut Expr,
     bump: &bun_alloc::Arena,
     field: &[u8],
-    src: Expr,
+    src: &Expr,
+    patches: Option<&StringArrayHashMap<Box<[u8]>>>,
 ) -> Result<bool, AllocError> {
-    let Some(mut existing) = json.as_property(field) else {
-        e_object_mut(json).put(bump, field, src)?;
-        return Ok(true);
-    };
-    if !existing.expr.is_object() {
+    if json.get(field).is_none() {
+        e_object_mut(json).put(bump, field, empty_object())?;
+    }
+    let mut dest = json.get(field).expect("put above");
+    if !dest.is_object() {
         return Ok(false);
     }
-    let existing_obj = e_object_mut(&mut existing.expr);
-    for prop in e_object(&src).properties.slice() {
-        let Some(key) = as_string(prop.key.as_ref().expect("infallible: prop has key")) else {
+    for prop in e_object(src).properties.slice() {
+        let Some(mut key) = as_string(prop.key.as_ref().expect("infallible: prop has key")) else {
             continue;
         };
-        existing_obj.put(bump, key, prop.value.expect("infallible: prop has value"))?;
+        if let Some(resolved) = patches.and_then(|patches| patches.get(key)) {
+            key = js_ast::data_store_dupe_str(&[key, b"@", resolved].concat());
+        }
+        e_object_mut(&mut dest).put(bump, key, prop.value.expect("infallible: prop has value"))?;
     }
     Ok(true)
 }

From 6c30170db96867d7ed7931cd8bb5286fc918c7dc Mon Sep 17 00:00:00 2001
From: Jarred Sumner <jarred@jarredsumner.com>
Date: Mon, 17 Aug 2026 05:45:34 +0000
Subject: [PATCH 245/258] =?UTF-8?q?simplify(s4-migration):=20workspace=5Fm?=
 =?UTF-8?q?anifests=20+=20WorkspaceMap=20=E2=80=94=20reuse=20folder=5Frela?=
 =?UTF-8?q?tive=5Fto=5Ftop=5Flevel=5Fdir,=20drop=20the=20Scanned=20enum?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

- WorkspaceManifests::workspace_name_at_path resolves the linked directory
  with lockfile::package::folder_relative_to_top_level_dir (the same
  join+relative+posix steps it spelled out)
- process_workspace_name returns Option<Entry> and records a skipped
  nameless member itself, replacing Scanned/workspace_entry
- shorten doc comments

(cherry picked from commit 2abe25708470a1a78bb233953ccbe2a8258bfb94)
---
 .../PackageManager/workspace_manifests.rs     |  42 ++------
 src/install/lockfile/Package/WorkspaceMap.rs  | 101 ++++++++----------
 2 files changed, 54 insertions(+), 89 deletions(-)

diff --git a/src/install/PackageManager/workspace_manifests.rs b/src/install/PackageManager/workspace_manifests.rs
index ae707f3721cc..71a03100e741 100644
--- a/src/install/PackageManager/workspace_manifests.rs
+++ b/src/install/PackageManager/workspace_manifests.rs
@@ -3,10 +3,9 @@ use core::fmt;
 use bstr::BStr;
 use bun_collections::HashMap;
 use bun_core::{Global, Output};
-use bun_paths::{platform, resolve_path};
-use bun_resolver::fs::FileSystem;
 
 use crate::dependency::{Behavior, Tag as DependencyTag};
+use crate::lockfile::package::folder_relative_to_top_level_dir;
 use crate::lockfile::{DependencySlice, Lockfile, Package};
 use crate::{Features, PackageNameHash};
 
@@ -94,9 +93,8 @@ impl ScratchManifests {
     }
 }
 
-/// The workspace versions and catalogs `bun pm pack` / `bun publish` substitute, read from the
-/// package.json files as they are now. Not from bun.lock: it has the versions of the last install,
-/// and releases bump versions between that install and the publish.
+/// The workspace versions and catalogs `bun pm pack` / `bun publish` substitute, read from the package.json
+/// files as they are now (bun.lock has the versions of the last install; releases bump them after it).
 pub struct WorkspaceManifests {
     lockfile: Lockfile,
     /// Has a `Behavior::WORKSPACE` entry per workspace: its name and root-relative directory.
@@ -107,9 +105,7 @@ pub struct WorkspaceManifests {
 impl WorkspaceManifests {
     /// Exits with `bun install`'s errors when the root package.json or a workspace does not parse.
     pub fn load(manager: &mut PackageManager) -> WorkspaceManifests {
-        // Only the two things pack reads: the `workspaces` walk and the catalogs. The root's own
-        // dependency sections are not parsed, so `bun install`'s checks on them (a `workspace:1.2.3`
-        // range no workspace satisfies, say) do not decide whether a package packs.
+        // Only what pack reads, so `bun install`'s checks on the root's own dependency lists do not fail a pack.
         let features = Features {
             is_main: true,
             workspaces: true,
@@ -144,25 +140,8 @@ impl WorkspaceManifests {
         if path.is_empty() {
             return None;
         }
-        let top_level_dir = FileSystem::get().top_level_dir();
-        let mut directory_buf = bun_paths::path_buffer_pool::get();
-        let directory = resolve_path::join_abs_string_buf_checked::<platform::Auto>(
-            top_level_dir,
-            &mut directory_buf[..],
-            &[package_dir, path],
-        )?;
-        let relative_directory: &[u8] = resolve_path::relative(top_level_dir, directory);
-        // The workspaces' directories are stored with `/` separators on every platform.
-        #[cfg(windows)]
-        let mut posix_buf = bun_paths::path_buffer_pool::get();
-        #[cfg(windows)]
-        let relative_directory: &[u8] = {
-            let len = relative_directory.len();
-            posix_buf[..len].copy_from_slice(relative_directory);
-            bun_paths::dangerously_convert_path_to_posix_in_place::<u8>(&mut posix_buf[..len]);
-            &posix_buf[..len]
-        };
-
+        let mut buf = bun_paths::path_buffer_pool::get();
+        let relative_directory = folder_relative_to_top_level_dir(package_dir, path, &mut buf[..])?;
         let string_buf = self.lockfile.buffers.string_bytes.as_slice();
         self.root_dependencies
             .get(self.lockfile.buffers.dependencies.as_slice())
@@ -174,22 +153,19 @@ impl WorkspaceManifests {
             .map(|dependency| dependency.name.slice(string_buf))
     }
 
-    /// The package.json whose `workspaces` and catalogs these are: the workspace root's when the
-    /// package being packed is one of its workspaces, otherwise the package's own.
+    /// The package.json whose `workspaces` and catalogs these are (the packed package's own when it is no workspace).
     pub fn root_package_json_path(&self) -> &[u8] {
         &self.root_package_json_path
     }
 
-    /// The `version` in the package.json of the workspace named `name`. `None` when no workspace
-    /// has that name or its package.json has no (semver) version.
+    /// The (semver) `version` in the package.json of the workspace named `name`, if any.
     pub fn workspace_version(&self, name: &[u8]) -> Option<impl fmt::Display + '_> {
         let name_hash: PackageNameHash = bun_semver::string::Builder::string_hash(name);
         let version = self.lockfile.workspace_versions.get(&name_hash)?;
         Some(version.fmt(self.lockfile.buffers.string_bytes.as_slice()))
     }
 
-    /// The range catalog `catalog_name` (`""` and `"default"` both name the default catalog)
-    /// declares for `dependency_name`, as written in the root package.json.
+    /// The range catalog `catalog_name` (`""` or `"default"` for the default one) declares for `dependency_name`, as written.
     pub fn catalog_version(&self, catalog_name: &[u8], dependency_name: &[u8]) -> Option<&[u8]> {
         let string_buf = self.lockfile.buffers.string_bytes.as_slice();
         let dependency = self
diff --git a/src/install/lockfile/Package/WorkspaceMap.rs b/src/install/lockfile/Package/WorkspaceMap.rs
index 0e4b11077cb2..cf2549103faa 100644
--- a/src/install/lockfile/Package/WorkspaceMap.rs
+++ b/src/install/lockfile/Package/WorkspaceMap.rs
@@ -31,14 +31,6 @@ pub struct Entry {
     pub(crate) name_loc: bun_ast::Loc,
 }
 
-enum Scanned {
-    Workspace(Entry),
-    /// No usable `"name"`, so nothing to link or resolve it by; skipped, as pnpm and npm do.
-    Nameless {
-        declares_dependencies: bool,
-    },
-}
-
 impl WorkspaceMap {
     pub(crate) fn init() -> WorkspaceMap {
         WorkspaceMap {
@@ -47,26 +39,6 @@ impl WorkspaceMap {
         }
     }
 
-    fn workspace_entry(&mut self, scanned: Scanned, relative_dir: &[u8]) -> Option<Entry> {
-        match scanned {
-            Scanned::Workspace(entry) => Some(entry),
-            Scanned::Nameless {
-                declares_dependencies,
-            } => {
-                // Overlapping patterns match the same directory more than once.
-                if declares_dependencies
-                    && !self
-                        .skipped_with_dependencies
-                        .iter()
-                        .any(|dir| **dir == *relative_dir)
-                {
-                    self.skipped_with_dependencies.push(relative_dir.into());
-                }
-                None
-            }
-        }
-    }
-
     pub(crate) fn warn_skipped(&self, log: &mut bun_ast::Log) {
         for dir in &self.skipped_with_dependencies {
             log.add_warning_fmt(
@@ -168,11 +140,14 @@ pub(crate) enum MissingWorkspace<'a> {
     SkipIfInLockfile(&'a Lockfile),
 }
 
+/// `None`: no usable `"name"`, so nothing to link or resolve it by; skipped, as pnpm and npm do.
 fn process_workspace_name(
+    workspace_names: &mut WorkspaceMap,
     json_cache: &mut WorkspacePackageJSONCache,
     abs_package_json_path: &[u8],
+    root_dir: &[u8],
     log: &mut bun_ast::Log,
-) -> crate::Result<Scanned> {
+) -> crate::Result<Option<Entry>> {
     let workspace_json = json_cache
         .get_with_path(
             log,
@@ -202,14 +177,23 @@ fn process_workspace_name(
             "processWorkspaceName({}) has no name, skipping",
             BStr::new(abs_package_json_path)
         );
-        return Ok(Scanned::Nameless {
-            declares_dependencies: DependencyGroup::FOUR.iter().any(|group| {
-                workspace_json
-                    .root
-                    .get(group.prop)
-                    .is_some_and(|deps| deps.property_count() > 0)
-            }),
+        let json = &workspace_json.root;
+        let declares_dependencies = DependencyGroup::FOUR.iter().any(|group| {
+            json.get(group.prop)
+                .is_some_and(|deps| deps.property_count() > 0)
         });
+        let mut buf = path::path_buffer_pool::get();
+        let dir = relative_workspace_path(
+            &mut buf.0,
+            root_dir,
+            workspace_dir_of(abs_package_json_path),
+        );
+        // Overlapping patterns match the same directory more than once.
+        let skipped = &mut workspace_names.skipped_with_dependencies;
+        if declares_dependencies && !skipped.iter().any(|skipped| **skipped == *dir) {
+            skipped.push(dir.into());
+        }
+        return Ok(None);
     };
 
     let entry = Entry {
@@ -231,7 +215,7 @@ fn process_workspace_name(
         BStr::new(&entry.name)
     );
 
-    Ok(Scanned::Workspace(entry))
+    Ok(Some(entry))
 }
 
 fn workspace_dir_of(abs_package_json_path: &[u8]) -> &[u8] {
@@ -324,13 +308,19 @@ impl WorkspaceMap {
                         continue;
                     }
 
-                    process_workspace_name(json_cache, abs_package_json_path, log)
-                        .map(|scanned| (abs_package_json_path, scanned))
+                    process_workspace_name(
+                        workspace_names,
+                        json_cache,
+                        abs_package_json_path,
+                        root_dir,
+                        log,
+                    )
+                    .map(|entry| (abs_package_json_path, entry))
                 }
                 None => Err(crate::Error::Sys(bun_errno::SystemErrno::ENAMETOOLONG)),
             };
 
-            let (abs_package_json_path, scanned) = match processed {
+            let (abs_package_json_path, workspace_entry) = match processed {
                 Ok(processed) => processed,
                 Err(err) => {
                     if err == crate::Error::Sys(bun_errno::SystemErrno::ENOENT) {
@@ -380,17 +370,15 @@ impl WorkspaceMap {
                 }
             };
 
+            let Some(workspace_entry) = workspace_entry else {
+                continue;
+            };
             let rel_input_path = relative_workspace_path(
                 &mut rel_path_buf.0,
                 root_dir,
                 workspace_dir_of(abs_package_json_path),
             );
 
-            let Some(workspace_entry) = workspace_names.workspace_entry(scanned, rel_input_path)
-            else {
-                continue;
-            };
-
             if let Some(builder) = string_builder.as_deref_mut() {
                 builder.count(&workspace_entry.name);
                 builder.count(rel_input_path);
@@ -534,14 +522,18 @@ impl WorkspaceMap {
                     >(
                         cwd, filepath_buf, &[entry_dir, b"package.json"]
                     ) {
-                        Some(abs_package_json_path) => {
-                            process_workspace_name(json_cache, abs_package_json_path, log)
-                                .map(|scanned| (abs_package_json_path, scanned))
-                        }
+                        Some(abs_package_json_path) => process_workspace_name(
+                            workspace_names,
+                            json_cache,
+                            abs_package_json_path,
+                            root_dir,
+                            log,
+                        )
+                        .map(|entry| (abs_package_json_path, entry)),
                         None => Err(crate::Error::Sys(bun_errno::SystemErrno::ENAMETOOLONG)),
                     };
 
-                    let (abs_package_json_path, scanned) = match processed {
+                    let (abs_package_json_path, workspace_entry) = match processed {
                         Ok(processed) => processed,
                         Err(err) => {
                             if err == crate::Error::Sys(bun_errno::SystemErrno::ENOENT) {
@@ -562,18 +554,15 @@ impl WorkspaceMap {
                         }
                     };
 
+                    let Some(workspace_entry) = workspace_entry else {
+                        continue;
+                    };
                     let workspace_path: &[u8] = relative_workspace_path(
                         &mut rel_path_buf.0,
                         root_dir,
                         workspace_dir_of(abs_package_json_path),
                     );
 
-                    let Some(workspace_entry) =
-                        workspace_names.workspace_entry(scanned, workspace_path)
-                    else {
-                        continue;
-                    };
-
                     if let Some(builder) = string_builder.as_deref_mut() {
                         builder.count(&workspace_entry.name);
                         builder.count(workspace_path);

From 0ca611e35d0334a08671b1bcbc3e4d417dfcd9a3 Mon Sep 17 00:00:00 2001
From: Jarred Sumner <jarred@jarredsumner.com>
Date: Mon, 17 Aug 2026 05:51:06 +0000
Subject: [PATCH 246/258] simplify(s4-migration):
 CatalogMap/OverrideMap/migration/PackageJSONEditor tightening

- CatalogMap::put_missing_from_pnpm_workspace is a method; the recorded
  default catalog is moved out with mem::take for the `catalogs.default`
  group instead of splitting get_or_put_group into a free helper
- OverrideMap: parse_count walks both fields in one loop (count_field
  inlined), RuleCount becomes two ParseContext fields, put_scoped keeps
  push_scoped's original shape with a `keep` bound
- migration.rs: finish_migration takes the migrator's Result and builds the
  Migrating LoadResultErr in one place (migrating_error)
- PackageJSONEditor: literal_tag() for the seven infer(trim_literal(..)) sites
- shorter doc comments in package_json_write_back

(cherry picked from commit 39c13fbb5a8750e6e9184286e451bf93acfeb5cd)
---
 .../PackageManager/PackageJSONEditor.rs       |  34 ++-
 .../PackageManager/package_json_write_back.rs |  11 +-
 src/install/lockfile/CatalogMap.rs            |  42 ++--
 src/install/lockfile/OverrideMap.rs           | 195 +++++++-----------
 src/install/migration.rs                      |  93 +++------
 src/install/pnpm.rs                           |   4 +-
 6 files changed, 144 insertions(+), 235 deletions(-)

diff --git a/src/install/PackageManager/PackageJSONEditor.rs b/src/install/PackageManager/PackageJSONEditor.rs
index 34d72b6d2c17..74aa92d46c28 100644
--- a/src/install/PackageManager/PackageJSONEditor.rs
+++ b/src/install/PackageManager/PackageJSONEditor.rs
@@ -437,6 +437,11 @@ fn edit_update_aliases_of_requests(
     )
 }
 
+/// The tag of a package.json literal as `bun install` reads it (leading whitespace ignored).
+fn literal_tag(literal: &[u8]) -> dependency::Tag {
+    dependency::Tag::infer(dependency::trim_literal(literal))
+}
+
 fn edit_update_entries(
     lockfile: &crate::Lockfile,
     arena: &bun_alloc::Arena,
@@ -480,7 +485,7 @@ fn edit_update_entries(
                         let version_literal = value
                             .as_utf8_string_literal()
                             .unwrap_or_else(|| bun_core::out_of_memory());
-                        let tag = dependency::Tag::infer(dependency::trim_literal(version_literal));
+                        let tag = literal_tag(version_literal);
 
                         // npm ranges only (and dist-tags with --latest); `catalog:` is handled by edit_catalogs_*.
                         if tag != dependency::Tag::Npm
@@ -558,9 +563,7 @@ fn edit_update_entries(
                         let value_literal = value
                             .as_utf8_string_literal()
                             .unwrap_or_else(|| bun_core::out_of_memory());
-                        if dependency::Tag::infer(dependency::trim_literal(value_literal))
-                            == dependency::Tag::Catalog
-                        {
+                        if literal_tag(value_literal) == dependency::Tag::Catalog {
                             continue;
                         }
 
@@ -717,7 +720,7 @@ pub(crate) fn edit_catalogs_before_update(
             let version_literal = value
                 .as_utf8_string_literal()
                 .unwrap_or_else(|| bun_core::out_of_memory());
-            let tag = dependency::Tag::infer(dependency::trim_literal(version_literal));
+            let tag = literal_tag(version_literal);
 
             // same tag rule as direct dependencies
             if tag != dependency::Tag::Npm && (tag != dependency::Tag::DistTag || !update_to_latest)
@@ -1052,9 +1055,8 @@ pub(crate) fn edit(
                                         == Subcommand::Update
                                         && value.expr.as_utf8_string_literal().is_some_and(
                                             |version_literal| {
-                                                dependency::Tag::infer(dependency::trim_literal(
-                                                    version_literal,
-                                                )) == dependency::Tag::Catalog
+                                                literal_tag(version_literal)
+                                                    == dependency::Tag::Catalog
                                             },
                                         );
 
@@ -1075,9 +1077,7 @@ pub(crate) fn edit(
                                                 else {
                                                     break 'add_packages_to_update;
                                                 };
-                                                let tag = dependency::Tag::infer(
-                                                    dependency::trim_literal(version_literal),
-                                                );
+                                                let tag = literal_tag(version_literal);
 
                                                 if tag != dependency::Tag::Npm
                                                     && tag != dependency::Tag::DistTag
@@ -1399,7 +1399,7 @@ pub(crate) fn edit(
             let e_string = unsafe { &mut *e_string };
             // `bun update <pkg>` only moves registry entries, like `edit_update_entries`; `bun add` still replaces any entry.
             if manager.subcommand == Subcommand::Update
-                && !dependency::Tag::infer(dependency::trim_literal(e_string.data.slice())).is_npm()
+                && !literal_tag(e_string.data.slice()).is_npm()
             {
                 continue;
             }
@@ -1515,12 +1515,10 @@ pub(crate) fn edit(
                 // A range that linked a workspace member has nothing to move to; `workspace:*` is what `bun add` writes.
                 resolution::Tag::Workspace if manager.subcommand == Subcommand::Update => continue,
                 // Not the bound row: an unchanged resolution keeps the old lockfile row and its previous literal.
-                resolution::Tag::Workspace => {
-                    match dependency::Tag::infer(dependency::trim_literal(e_string.data.slice())) {
-                        dependency::Tag::Workspace => e_string.data.slice(),
-                        _ => b"workspace:*",
-                    }
-                }
+                resolution::Tag::Workspace => match literal_tag(e_string.data.slice()) {
+                    dependency::Tag::Workspace => e_string.data.slice(),
+                    _ => b"workspace:*",
+                },
                 _ => arena_dup(arena, request.version.literal.slice(request.version_buf())),
             };
             if e_string.data.slice() != new_literal {
diff --git a/src/install/PackageManager/package_json_write_back.rs b/src/install/PackageManager/package_json_write_back.rs
index 86329d4b63a4..31a326c1aff2 100644
--- a/src/install/PackageManager/package_json_write_back.rs
+++ b/src/install/PackageManager/package_json_write_back.rs
@@ -58,9 +58,8 @@ fn root_target() -> WorkspaceTarget {
     }
 }
 
-/// The root package.json a pnpm migration edited in memory (`pnpm::update_package_json_after_migration`), announced
-/// once; `None` when the load did not touch it. Only the places that save the migrated lockfile ask for it, so a load
-/// that is never saved (`--frozen-lockfile`, `--dry-run`, `bun outdated`, ...) leaves the file alone.
+/// The root package.json a pnpm migration edited in memory, announced once; `None` when the load did not touch it.
+/// Only the places that save the migrated lockfile ask, so a load that is never saved leaves the file alone.
 fn take_migrated_root(manager: &mut PackageManager) -> Option<WorkspaceTarget> {
     if manager.migrated_package_json_moves.is_empty() {
         return None;
@@ -82,10 +81,8 @@ pub(crate) fn record_migrated_root(manager: &mut PackageManager) {
     }
 }
 
-/// `bun pm migrate` and `bun pm trust` save the lockfile without consulting `--dry-run` / `--no-save`, so the
-/// package.json that belongs with it is written the same way instead of through `flush`, which those flags disable.
-/// The lockfile is already on disk at this point, so a package.json that cannot be written (a read-only checkout)
-/// is reported and left as it was rather than failing the command.
+/// `bun pm migrate` / `bun pm trust`: they save the lockfile regardless of `--dry-run` / `--no-save` (which disable
+/// `flush`), so its package.json is written directly; a write failure is reported, not fatal (the lockfile is saved).
 pub fn write_migrated_root(manager: &mut PackageManager) {
     if let Some(root) = take_migrated_root(manager) {
         let _ = write_target(manager, &root);
diff --git a/src/install/lockfile/CatalogMap.rs b/src/install/lockfile/CatalogMap.rs
index e7e5be2183fb..22a5e59dab7f 100644
--- a/src/install/lockfile/CatalogMap.rs
+++ b/src/install/lockfile/CatalogMap.rs
@@ -206,7 +206,14 @@ impl CatalogMap {
         if catalog_name.is_empty() {
             return Ok(&mut self.default);
         }
-        get_or_put_named_group(&mut self.groups, buf, catalog_name)
+
+        let entry = self.groups.get_or_put_adapted(&catalog_name, &ctx(buf))?;
+        if !entry.found_existing {
+            *entry.key_ptr = catalog_name;
+            *entry.value_ptr = Map::default();
+        }
+
+        Ok(entry.value_ptr)
     }
 
     // Deliberately takes no `Lockfile` param so `lockfile.catalogs.parse_count`
@@ -388,28 +395,30 @@ impl CatalogMap {
         Ok(())
     }
 
-    /// `catalog_obj`/`catalogs_obj` are the pnpm-workspace.yaml objects the migration writes into package.json for `parse_append` to read back, so the map takes their shape: pnpm-lock.yaml's section has only the entries in use and spells every default catalog `default`, while entries it does record keep its specifier, which their resolutions were made with.
+    /// Gives the map the shape of the pnpm-workspace.yaml objects the migration writes into package.json for `parse_append` to read back: pnpm-lock.yaml's section has only the entries in use (kept, with the specifier they were resolved with) and files every default catalog under `default`.
     pub(crate) fn put_missing_from_pnpm_workspace(
-        catalogs: &mut CatalogMap,
+        &mut self,
         catalog_obj: Option<Expr>,
         catalogs_obj: Option<Expr>,
         string_buf: &mut StringBuf,
     ) -> Result<(), AllocError> {
         if let Some(declared) = catalog_obj {
-            put_declared_entries(&mut catalogs.default, None, &declared, string_buf)?;
+            put_declared_entries(&mut self.default, None, &declared, string_buf)?;
         }
         let Some(declared_groups) = catalogs_obj else {
             return Ok(());
         };
         declared_groups.try_for_each_property(|group_name_str, _, declared| {
+            // package.json's `catalogs.default` is a named group; its recorded entries move there.
+            let mut recorded =
+                (group_name_str == b"default").then(|| core::mem::take(&mut self.default));
             let group_name = string_buf.append(group_name_str)?;
-            if group_name_str != b"default" {
-                let group = catalogs.get_or_put_group(string_buf.bytes.as_slice(), group_name)?;
-                return put_declared_entries(group, None, &declared, string_buf);
+            let group = self.get_or_put_group(string_buf.bytes.as_slice(), group_name)?;
+            put_declared_entries(group, recorded.as_mut(), &declared, string_buf)?;
+            if let Some(rest) = recorded {
+                self.default = rest;
             }
-            let CatalogMap { default, groups } = &mut *catalogs;
-            let group = get_or_put_named_group(groups, string_buf.bytes.as_slice(), group_name)?;
-            put_declared_entries(group, Some(default), &declared, string_buf)
+            Ok(())
         })
     }
 
@@ -652,16 +661,3 @@ fn parse_entry(
         ..Dependency::default()
     }))
 }
-
-fn get_or_put_named_group<'a>(
-    groups: &'a mut ArrayHashMap<String, Map>,
-    buf: &[u8],
-    catalog_name: String,
-) -> Result<&'a mut Map, AllocError> {
-    let entry = groups.get_or_put_adapted(&catalog_name, &ctx(buf))?;
-    if !entry.found_existing {
-        *entry.key_ptr = catalog_name;
-        *entry.value_ptr = Map::default();
-    }
-    Ok(entry.value_ptr)
-}
diff --git a/src/install/lockfile/OverrideMap.rs b/src/install/lockfile/OverrideMap.rs
index 981033a3aaba..05e8105f126d 100644
--- a/src/install/lockfile/OverrideMap.rs
+++ b/src/install/lockfile/OverrideMap.rs
@@ -144,16 +144,12 @@ fn is_comment_key(key: &[u8]) -> bool {
     key.starts_with(b"//")
 }
 
-/// Parsing only appends or replaces in place, so the rules `"overrides"` produced are the first `flat` entries of `map` and the first `scoped` entries of `scoped`.
-#[derive(Clone, Copy, Default)]
-struct RuleCount {
-    flat: usize,
-    scoped: usize,
-}
-
 struct ParseContext<'a, 'b> {
     field: Field,
-    from_overrides: RuleCount,
+    /// Parsing only appends or replaces in place, so the rules `"overrides"` produced are the first
+    /// `overrides_flat` entries of `map` and the first `overrides_scoped` of `scoped`.
+    overrides_flat: usize,
+    overrides_scoped: usize,
     pm: &'a mut PackageManager,
     lockfile_dependencies: &'a [Dependency],
     root_package: &'a Package,
@@ -520,37 +516,33 @@ impl OverrideMap {
         self.put_scoped(rule, buf, 0);
     }
 
-    /// Like `push_scoped`, except that a matching rule at a position below `keep` is kept and `rule` is dropped.
+    /// Like `push_scoped`, except that a matching rule among the first `keep` is kept and `rule` is dropped.
     fn put_scoped(&mut self, rule: ScopedOverride, buf: &[u8], keep: usize) {
-        match self.scoped_position(&rule, buf) {
-            Some(index) if index < keep => {}
-            Some(index) => self.scoped[index] = rule,
-            None => {
-                self.scoped_names.insert(rule.dep.name_hash, ());
-                self.scoped.push(rule);
-            }
-        }
-    }
-
-    fn scoped_position(&self, rule: &ScopedOverride, buf: &[u8]) -> Option<usize> {
-        if !self.scoped_names.contains(&rule.dep.name_hash) {
-            return None;
-        }
-        self.scoped.iter().position(|existing| {
-            existing.dep.name_hash == rule.dep.name_hash
-                && match (&existing.parent, &rule.parent) {
-                    (None, None) => true,
-                    (Some(a), Some(b)) => {
-                        a.name_hash == b.name_hash
-                            && a.version.literal.eql(b.version.literal, buf, buf)
+        if self.scoped_names.contains(&rule.dep.name_hash) {
+            if let Some(index) = self.scoped.iter().position(|existing| {
+                existing.dep.name_hash == rule.dep.name_hash
+                    && match (&existing.parent, &rule.parent) {
+                        (None, None) => true,
+                        (Some(a), Some(b)) => {
+                            a.name_hash == b.name_hash
+                                && a.version.literal.eql(b.version.literal, buf, buf)
+                        }
+                        _ => false,
                     }
-                    _ => false,
+                    && existing
+                        .target_range
+                        .literal
+                        .eql(rule.target_range.literal, buf, buf)
+            }) {
+                if index >= keep {
+                    self.scoped[index] = rule;
                 }
-                && existing
-                    .target_range
-                    .literal
-                    .eql(rule.target_range.literal, buf, buf)
-        })
+                return;
+            }
+        } else {
+            self.scoped_names.insert(rule.dep.name_hash, ());
+        }
+        self.scoped.push(rule);
     }
 
     /// Row constructor for bun.lock / pnpm-lock.yaml; `Ok(false)` when `value`, the parent range or the target range does not parse.
@@ -630,86 +622,57 @@ impl OverrideMap {
         builder: &mut StringBuilder,
     ) {
         for field in [Field::Overrides, Field::Resolutions] {
-            if let Some(property) = expr.as_property(field.json_name().as_bytes()) {
-                Self::count_field(
-                    pm,
-                    log,
-                    json_source,
-                    workspace_names,
-                    &expr,
-                    field,
-                    property.expr,
-                    builder,
-                );
-            }
-        }
-    }
-
-    fn count_field(
-        pm: &mut PackageManager,
-        log: &mut bun_ast::Log,
-        json_source: &bun_ast::Source,
-        workspace_names: &WorkspaceMap,
-        root_json: &Expr,
-        field: Field,
-        field_expr: Expr,
-        builder: &mut StringBuilder,
-    ) {
-        field_expr.for_each_property(|key, _key_loc, value| {
-            if is_comment_key(key) {
-                return;
-            }
-            builder.count(key);
-            if let Some(value) = value.as_utf8_string_literal() {
-                if let Ok(Selector { parent, target }) = parse_selector(key) {
-                    builder.count(target.name);
-                    builder.count(target.range);
-                    if let Some(parent) = parent {
-                        builder.count(parent.name);
-                        builder.count(parent.range);
-                    }
+            let Some(property) = expr.as_property(field.json_name().as_bytes()) else {
+                continue;
+            };
+            property.expr.for_each_property(|key, _key_loc, value| {
+                if is_comment_key(key) {
+                    return;
                 }
-                builder.count(value);
-                count_ref_value(
-                    pm,
-                    log,
-                    json_source,
-                    workspace_names,
-                    root_json,
-                    value,
-                    builder,
-                );
-                return;
-            }
-            if field != Field::Overrides || !value.is_object() {
-                return;
-            }
-            if let Ok(parent) = parse_package_segment(key) {
-                builder.count(parent.name);
-                builder.count(parent.range);
-            }
-            value.for_each_property(|child_key, _child_key_loc, child_value| {
-                if is_comment_key(child_key) {
+                builder.count(key);
+                if let Some(value) = value.as_utf8_string_literal() {
+                    if let Ok(Selector { parent, target }) = parse_selector(key) {
+                        builder.count(target.name);
+                        builder.count(target.range);
+                        if let Some(parent) = parent {
+                            builder.count(parent.name);
+                            builder.count(parent.range);
+                        }
+                    }
+                    builder.count(value);
+                    count_ref_value(pm, log, json_source, workspace_names, &expr, value, builder);
                     return;
                 }
-                if let Ok(selector) = parse_selector(child_key) {
-                    builder.count(selector.target.name);
-                    builder.count(selector.target.range);
+                if field != Field::Overrides || !value.is_object() {
+                    return;
                 }
-                if let Some(child_value) = child_value.as_utf8_string_literal() {
-                    builder.count(child_value);
-                    count_ref_value(
-                        pm,
-                        log,
-                        json_source,
-                        workspace_names,
-                        root_json,
-                        child_value,
-                        builder,
-                    );
+                if let Ok(parent) = parse_package_segment(key) {
+                    builder.count(parent.name);
+                    builder.count(parent.range);
                 }
+                value.for_each_property(|child_key, _child_key_loc, child_value| {
+                    if is_comment_key(child_key) {
+                        return;
+                    }
+                    if let Ok(selector) = parse_selector(child_key) {
+                        builder.count(selector.target.name);
+                        builder.count(selector.target.range);
+                    }
+                    if let Some(child_value) = child_value.as_utf8_string_literal() {
+                        builder.count(child_value);
+                        count_ref_value(
+                            pm,
+                            log,
+                            json_source,
+                            workspace_names,
+                            &expr,
+                            child_value,
+                            builder,
+                        );
+                    }
+                });
             });
-        });
+        }
     }
 
     /// Parses the root package.json's `"overrides"` and `"resolutions"` into this (empty) map.
@@ -728,7 +691,8 @@ impl OverrideMap {
         debug_assert!(self.map.count() == 0 && self.scoped.is_empty()); // only call parse once
         let mut ctx = ParseContext {
             field: Field::Overrides,
-            from_overrides: RuleCount::default(),
+            overrides_flat: 0,
+            overrides_scoped: 0,
             pm,
             lockfile_dependencies,
             root_package,
@@ -739,10 +703,7 @@ impl OverrideMap {
         };
         if let Some(overrides) = expr.as_property(b"overrides") {
             self.parse_from_overrides(&mut ctx, overrides.expr)?;
-            ctx.from_overrides = RuleCount {
-                flat: self.map.count(),
-                scoped: self.scoped.len(),
-            };
+            (ctx.overrides_flat, ctx.overrides_scoped) = (self.map.count(), self.scoped.len());
         }
         if let Some(resolutions) = expr.as_property(b"resolutions") {
             ctx.field = Field::Resolutions;
@@ -972,7 +933,7 @@ impl OverrideMap {
             && self
                 .map
                 .get_index(&name_hash)
-                .is_some_and(|index| index < ctx.from_overrides.flat)
+                .is_some_and(|index| index < ctx.overrides_flat)
         {
             return Ok(());
         }
@@ -995,7 +956,7 @@ impl OverrideMap {
                     dep,
                 },
                 ctx.builder.string_bytes.as_slice(),
-                ctx.from_overrides.scoped,
+                ctx.overrides_scoped,
             );
         }
         Ok(())
diff --git a/src/install/migration.rs b/src/install/migration.rs
index 583714376d68..0936ef703c94 100644
--- a/src/install/migration.rs
+++ b/src/install/migration.rs
@@ -55,26 +55,8 @@ pub fn detect_and_load_other_lockfile<'a>(
         let Ok(data) = lockfile.read_to_end() else {
             continue;
         };
-        let migrate_result = match migrate_npm_lockfile(
-            this,
-            manager,
-            log,
-            &data,
-            lockfile_path,
-            dir,
-            lockfile_name,
-        ) {
-            Ok(r) => r,
-            Err(e) => {
-                return LoadResult::Err(LoadResultErr {
-                    step: LoadStep::Migrating,
-                    value: e,
-                    lockfile_path: lockfile_name_z,
-                    format: LockfileFormat::Text,
-                });
-            }
-        };
-
+        let migrate_result =
+            migrate_npm_lockfile(this, manager, log, &data, lockfile_path, dir, lockfile_name);
         return finish_migration(migrate_result, manager, log, &timer, lockfile_name_z);
     }
 
@@ -83,18 +65,7 @@ pub fn detect_and_load_other_lockfile<'a>(
         let Ok(data) = File::read_from(dir, b"yarn.lock") else {
             break 'yarn;
         };
-        let migrate_result = match yarn::migrate_yarn_lockfile(this, manager, log, &data) {
-            Ok(r) => r,
-            Err(e) => {
-                return LoadResult::Err(LoadResultErr {
-                    step: LoadStep::Migrating,
-                    value: e,
-                    lockfile_path: zstr!("yarn.lock"),
-                    format: LockfileFormat::Text,
-                });
-            }
-        };
-
+        let migrate_result = yarn::migrate_yarn_lockfile(this, manager, log, &data);
         return finish_migration(migrate_result, manager, log, &timer, zstr!("yarn.lock"));
     }
 
@@ -113,12 +84,7 @@ pub fn detect_and_load_other_lockfile<'a>(
                     "pnpm install --lockfile-only",
                 );
                 log.reset();
-                return LoadResult::Err(LoadResultErr {
-                    step: LoadStep::Migrating,
-                    value: Error::UnexpectedLockfileVersion,
-                    lockfile_path: zstr!("pnpm-lock.yaml"),
-                    format: LockfileFormat::Text,
-                });
+                return migrating_error(Error::UnexpectedLockfileVersion, zstr!("pnpm-lock.yaml"));
             }
             Err(e) => {
                 if !manager.options.log_level.is_silent() {
@@ -144,37 +110,36 @@ pub fn detect_and_load_other_lockfile<'a>(
                     Output::flush();
                 }
                 log.reset();
-                return LoadResult::Err(LoadResultErr {
-                    step: LoadStep::Migrating,
-                    value: e.into(),
-                    lockfile_path: zstr!("pnpm-lock.yaml"),
-                    format: LockfileFormat::Text,
-                });
+                return migrating_error(e.into(), zstr!("pnpm-lock.yaml"));
             }
         };
-
-        return finish_migration(
-            migrate_result,
-            manager,
-            log,
-            &timer,
-            zstr!("pnpm-lock.yaml"),
-        );
+        let name = zstr!("pnpm-lock.yaml");
+        return finish_migration(Ok(migrate_result), manager, log, &timer, name);
     }
 
     LoadResult::NotFound
 }
 
+fn migrating_error(err: Error, lockfile_name: &'static ZStr) -> LoadResult<'static> {
+    LoadResult::Err(LoadResultErr {
+        step: LoadStep::Migrating,
+        value: err,
+        lockfile_path: lockfile_name,
+        format: LockfileFormat::Text,
+    })
+}
+
 fn finish_migration<'a>(
-    migrate_result: LoadResult<'a>,
+    migrate_result: Result<LoadResult<'a>, Error>,
     manager: &mut PackageManager,
     log: &mut bun_ast::Log,
     timer: &std::time::Instant,
     lockfile_name: &'static ZStr,
 ) -> LoadResult<'a> {
     let ok = match migrate_result {
-        LoadResult::Ok(ok) => ok,
-        other => return other,
+        Ok(LoadResult::Ok(ok)) => ok,
+        Ok(not_migrated) => return not_migrated,
+        Err(err) => return migrating_error(err, lockfile_name),
     };
     if let Err(err) = record_trusted_dependencies(&mut *ok.lockfile, manager, log) {
         if !manager.options.log_level.is_silent() && log.has_errors() {
@@ -182,12 +147,7 @@ fn finish_migration<'a>(
             Output::flush();
         }
         log.reset();
-        return LoadResult::Err(LoadResultErr {
-            step: LoadStep::Migrating,
-            value: err,
-            lockfile_path: lockfile_name,
-            format: LockfileFormat::Text,
-        });
+        return migrating_error(err, lockfile_name);
     }
     report_migrated(manager, log, timer, lockfile_name);
     LoadResult::Ok(ok)
@@ -201,13 +161,10 @@ fn record_trusted_dependencies(
 ) -> Result<(), Error> {
     let bump = bun_alloc::Arena::new();
     let string_bytes = lockfile.buffers.string_bytes.as_slice();
-    let root: &[u8] = b"";
-    let members = lockfile
-        .workspace_paths
-        .values()
-        .iter()
-        .map(|path| path.slice(string_bytes));
-    for relative_dir in core::iter::once(root).chain(members) {
+    let members = lockfile.workspace_paths.values().iter();
+    for relative_dir in
+        core::iter::once(b"".as_slice()).chain(members.map(|p| p.slice(string_bytes)))
+    {
         let mut package_json_path = AutoAbsPath::init_top_level_dir();
         let _ = package_json_path.append(relative_dir);
         let _ = package_json_path.append(b"package.json");
diff --git a/src/install/pnpm.rs b/src/install/pnpm.rs
index 87a65a971f7e..36ab2291a21c 100644
--- a/src/install/pnpm.rs
+++ b/src/install/pnpm.rs
@@ -2525,8 +2525,8 @@ fn update_package_json_after_migration(
             catalogs_obj = ws_root.get_object(b"catalogs").filter(is_non_empty_object);
             // The migrated root skips `Package::parse`, so the catalog these declare is recorded in the lockfile here.
             if let Some(lockfile) = lockfile.as_deref_mut() {
-                crate::lockfile_real::CatalogMap::put_missing_from_pnpm_workspace(
-                    &mut lockfile.catalogs,
+                let catalogs = &mut lockfile.catalogs;
+                catalogs.put_missing_from_pnpm_workspace(
                     catalog_obj,
                     catalogs_obj,
                     &mut sbuf!(lockfile),

From e48dfc2010e18bde2248ef27d0e027e401454aae Mon Sep 17 00:00:00 2001
From: Jarred Sumner <jarred@jarredsumner.com>
Date: Mon, 17 Aug 2026 05:54:22 +0000
Subject: [PATCH 247/258] =?UTF-8?q?simplify(s4-migration):=20yarn/pnpm=20s?=
 =?UTF-8?q?econd=20pass=20=E2=80=94=20Binder=20becomes=20a=20fn,=20get=5Fo?=
 =?UTF-8?q?r=5Fput=5Fvalue=20for=20ids,=20tighter=20helpers?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

(cherry picked from commit 20cf6c9b56b59a5bd0157b279d2420d0d6b0f155)
---
 src/install/pnpm.rs |  41 +++++-------
 src/install/yarn.rs | 158 ++++++++++++++++++++------------------------
 2 files changed, 89 insertions(+), 110 deletions(-)

diff --git a/src/install/pnpm.rs b/src/install/pnpm.rs
index 36ab2291a21c..38053e8d0b7d 100644
--- a/src/install/pnpm.rs
+++ b/src/install/pnpm.rs
@@ -196,17 +196,15 @@ fn root_package_json<'a>(
 ) -> Option<&'a mut crate::WorkspacePackageJsonCacheEntry> {
     let mut pkg_json_path = bun_paths::AutoAbsPath::init_top_level_dir();
     let _ = pkg_json_path.append(b"package.json"); // OOM/capacity error is non-actionable here
-    match manager.workspace_package_json_cache.get_with_path(
-        log,
-        pkg_json_path.slice(),
-        crate::GetJsonOptions {
-            guess_indentation: true,
-            ..Default::default()
-        },
-    ) {
-        crate::GetJsonResult::Entry(entry) => Some(entry),
-        crate::GetJsonResult::ReadErr(_) | crate::GetJsonResult::ParseErr(_) => None,
-    }
+    let options = crate::GetJsonOptions {
+        guess_indentation: true,
+        ..Default::default()
+    };
+    let cache = &mut manager.workspace_package_json_cache;
+    cache
+        .get_with_path(log, pkg_json_path.slice(), options)
+        .unwrap()
+        .ok()
 }
 
 /// Current pnpm records only the patch hash in the lockfile; the patch file path lives in the config.
@@ -2356,15 +2354,12 @@ fn collect_only_built_dependencies(list: &Expr, out: &mut Vec<&'static [u8]>) ->
     };
     let mut found_any = false;
     while let Some(item) = items.next() {
-        let Some(name) = as_string(&item) else {
+        let Some(name) = as_string(&item).filter(|name| !name.is_empty()) else {
             continue;
         };
-        if name.is_empty() {
-            continue;
-        }
         found_any = true;
         if !out.contains(&name) {
-            out.push(js_ast::data_store_dupe_str(name));
+            out.push(name);
         }
     }
     found_any
@@ -2387,22 +2382,18 @@ fn add_trusted_dependencies(
         }
     }
 
-    let mut added_any = false;
+    let existing_len = items.len_u32();
     for &name in names {
-        if items
+        if !items
             .slice()
             .iter()
             .any(|item| as_string(item) == Some(name))
         {
-            continue;
+            let item = Expr::init(E::EString::init(name), bun_ast::Loc::EMPTY);
+            VecExt::append(&mut items, item);
         }
-        VecExt::append(
-            &mut items,
-            Expr::init(E::EString::init(name), bun_ast::Loc::EMPTY),
-        );
-        added_any = true;
     }
-    if !added_any {
+    if items.len_u32() == existing_len {
         return Ok(false);
     }
 
diff --git a/src/install/yarn.rs b/src/install/yarn.rs
index 1c8f00e98561..2c9b98a71d68 100644
--- a/src/install/yarn.rs
+++ b/src/install/yarn.rs
@@ -203,12 +203,9 @@ impl<'a> Entry<'a> {
     /// `commit`, `git_repo_name` and `resolved` of a git `version`/`resolved` value; a `github:`
     /// shorthand resolves to its `https://github.com/` URL.
     fn set_git_source(&mut self, version: &'a [u8]) {
-        let mut url = version.strip_prefix(b"git+").unwrap_or(version);
-        self.commit = None;
-        if let Some((before_hash, commit)) = strings::split_once_char(url, b'#') {
-            url = before_hash;
-            self.commit = Some(commit);
-        }
+        let url = version.strip_prefix(b"git+").unwrap_or(version);
+        self.commit = strings::split_once_char(url, b'#').map(|(_, commit)| commit);
+        let url = Entry::url_without_hash(url);
         if let Some(github_path) = version.strip_prefix(b"github:") {
             let path = Entry::url_without_hash(github_path);
             if let Some((_, repo)) = strings::split_once_char(path, b'/') {
@@ -435,14 +432,12 @@ fn append_package_json(
         // Cloned because parsing the root's `workspaces` grows the cache holding this entry.
         GetJsonResult::Entry(entry) => (entry.source.clone(), entry.root),
         GetJsonResult::ReadErr(err) => {
+            let path = bstr::BStr::new(path.slice());
+            let loc = bun_ast::Loc::EMPTY;
             log.add_error_fmt(
                 None,
-                bun_ast::Loc::EMPTY,
-                format_args!(
-                    "{} reading \"{}\"",
-                    err.name(),
-                    bstr::BStr::new(path.slice())
-                ),
+                loc,
+                format_args!("{} reading \"{}\"", err.name(), path),
             );
             return Err(err);
         }
@@ -458,55 +453,47 @@ fn append_package_json(
     Ok(this.append_package(&package)?)
 }
 
-struct Binder<'a> {
-    spec_to_package_id: &'a StringHashMap<PackageID>,
-    workspace_id_by_path: &'a StringHashMap<PackageID>,
-    spec: Vec<u8>,
-}
-
-impl Binder<'_> {
-    /// Only the exact `name@range` key binds; an entry that merely satisfies it is another resolution.
-    fn bind(&mut self, this: &Lockfile, dep: &Dependency) -> Option<PackageID> {
-        let string_bytes = this.buffers.string_bytes.as_slice();
-        if dep.version.tag == dependency::Tag::Workspace {
-            return self
-                .workspace_id_by_path
-                .get(dep.version.workspace().slice(string_bytes))
-                .copied();
-        }
-        // yarn never locked these peers; bind them the way loading a bun.lock does.
-        if dep.behavior.is_peer() {
-            if dep.behavior.is_optional_peer() {
-                // Bound by the hoister, as after a fresh resolve.
-                return Some(install::INVALID_PACKAGE_ID);
-            }
-            // Overrides are not consulted: yarn applied them to the entries the candidates come from.
-            let range = this.catalogs.resolve_range(string_bytes, dep);
-            let name_hash = lockfile::bun_lock::peer_candidate_name_hash(dep, range, string_bytes);
-            return lockfile::bun_lock::resolve_peer_dep_by_range(
-                range,
-                name_hash,
-                &this.package_index,
-                this.packages.items_resolution(),
-                string_bytes,
-                |_| true,
-            )
-            // Nothing satisfies it: the highest version there is, as a fresh install's peer pass picks.
-            .or_else(|| {
-                this.package_index
-                    .get(&name_hash)?
-                    .as_slice()
-                    .first()
-                    .copied()
-            });
+/// Only the exact `name@range` key binds; an entry that merely satisfies it is another resolution.
+fn bind_importer_dependency(
+    this: &Lockfile,
+    dep: &Dependency,
+    spec_to_package_id: &StringHashMap<PackageID>,
+    workspace_id_by_path: &StringHashMap<PackageID>,
+    spec: &mut Vec<u8>,
+) -> Option<PackageID> {
+    let string_bytes = this.buffers.string_bytes.as_slice();
+    if dep.version.tag == dependency::Tag::Workspace {
+        let path = dep.version.workspace().slice(string_bytes);
+        return workspace_id_by_path.get(path).copied();
+    }
+    // yarn never locked these peers; bind them the way loading a bun.lock does.
+    if dep.behavior.is_peer() {
+        if dep.behavior.is_optional_peer() {
+            // Bound by the hoister, as after a fresh resolve.
+            return Some(install::INVALID_PACKAGE_ID);
         }
-        self.spec.clear();
-        self.spec.extend_from_slice(dep.name.slice(string_bytes));
-        self.spec.push(b'@');
-        self.spec
-            .extend_from_slice(dep.version.literal.slice(string_bytes));
-        self.spec_to_package_id.get(self.spec.as_slice()).copied()
-    }
+        // Overrides are not consulted: yarn applied them to the entries the candidates come from.
+        let range = this.catalogs.resolve_range(string_bytes, dep);
+        let name_hash = lockfile::bun_lock::peer_candidate_name_hash(dep, range, string_bytes);
+        let resolutions = this.packages.items_resolution();
+        let index = &this.package_index;
+        // Nothing satisfies it: the highest version there is, as a fresh install's peer pass picks.
+        let newest = || index.get(&name_hash)?.as_slice().first().copied();
+        return lockfile::bun_lock::resolve_peer_dep_by_range(
+            range,
+            name_hash,
+            index,
+            resolutions,
+            string_bytes,
+            |_| true,
+        )
+        .or_else(newest);
+    }
+    spec.clear();
+    spec.extend_from_slice(dep.name.slice(string_bytes));
+    spec.push(b'@');
+    spec.extend_from_slice(dep.version.literal.slice(string_bytes));
+    spec_to_package_id.get(spec.as_slice()).copied()
 }
 
 /// Packages `0..importer_count` (root, then workspaces) own every row in the buffers so far.
@@ -523,11 +510,7 @@ fn bind_importer_dependencies(
     let mut declared = core::mem::take(&mut this.buffers.dependencies).into_iter();
     this.buffers.resolutions.clear();
 
-    let mut binder = Binder {
-        spec_to_package_id,
-        workspace_id_by_path,
-        spec: Vec::new(),
-    };
+    let mut spec: Vec<u8> = Vec::new();
     let mut consumed: u32 = 0;
     for package_id in 0..importer_count {
         let declared_slice = this.packages.items_dependencies()[package_id];
@@ -536,7 +519,14 @@ fn bind_importer_dependencies(
 
         let off = u32::try_from(this.buffers.dependencies.len()).expect("int cast");
         for dep in declared.by_ref().take(declared_slice.len as usize) {
-            let Some(resolution) = binder.bind(this, &dep) else {
+            let bound = bind_importer_dependency(
+                this,
+                &dep,
+                spec_to_package_id,
+                workspace_id_by_path,
+                &mut spec,
+            );
+            let Some(resolution) = bound else {
                 // `bun install` resolves it, like a dependency added after yarn.lock was written.
                 continue;
             };
@@ -611,14 +601,10 @@ pub(crate) fn migrate_yarn_lockfile<'a>(
         key.extend_from_slice(entry.dedupe_name());
         key.push(b'\n');
         key.extend_from_slice(entry.version);
-        let package_id = match package_id_by_name_version.get(key.as_slice()) {
-            Some(&package_id) => package_id,
-            None => {
-                package_id_by_name_version.put(&key, next_package_id)?;
-                next_package_id += 1;
-                next_package_id - 1
-            }
-        };
+        let package_id = *package_id_by_name_version.get_or_put_value(&key, next_package_id)?;
+        if package_id == next_package_id {
+            next_package_id += 1;
+        }
         yarn_entry_to_package_id.push(package_id);
     }
 
@@ -682,23 +668,25 @@ pub(crate) fn migrate_yarn_lockfile<'a>(
                     }
                 }
                 let is_github = !owner_str.is_empty() && !repo_str.is_empty();
+                let committish = if is_github {
+                    &commit[..7.min(commit.len())]
+                } else {
+                    commit
+                };
+                let package_name = entry.git_repo_name.as_deref().unwrap_or(repo_str);
                 let repository = Repository {
                     owner: sbuf!().append(owner_str)?,
                     repo: sbuf!().append(repo_str)?,
-                    committish: sbuf!().append(if is_github {
-                        &commit[0..b"github:".len().min(commit.len())]
-                    } else {
-                        commit
-                    })?,
+                    committish: sbuf!().append(committish)?,
                     resolved: SemverString::default(),
-                    package_name: sbuf!()
-                        .append(entry.git_repo_name.as_deref().unwrap_or(repo_str))?,
+                    package_name: sbuf!().append(package_name)?,
                 };
-                break 'blk Resolution::init(if is_github {
-                    ResolutionValue::Github(repository)
+                let value = if is_github {
+                    ResolutionValue::Github
                 } else {
-                    ResolutionValue::Git(repository)
-                });
+                    ResolutionValue::Git
+                };
+                break 'blk Resolution::init(value(repository));
             } else {
                 match resolved_url {
                     Some(resolved) if is_direct_url_dep => {

From 211a0003bf9c8f7fa570d0942d1b8cc8c0d809f2 Mon Sep 17 00:00:00 2001
From: Jarred Sumner <jarred@jarredsumner.com>
Date: Mon, 17 Aug 2026 05:58:09 +0000
Subject: [PATCH 248/258] =?UTF-8?q?simplify(s4-migration):=20npm=5Flock/Pa?=
 =?UTF-8?q?ckageJSONEditor/pnpm=20=E2=80=94=20parse=5Fplatform=5Flist=20ta?=
 =?UTF-8?q?kes=20the=20optional=20field,=20tuple=20for=20the=20folder-in-d?=
 =?UTF-8?q?ependent=20case,=20clippy=20fix?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

(cherry picked from commit 30671fe6c180a317f8228d78e8aa19a483933f68)
---
 .../PackageManager/PackageJSONEditor.rs       | 18 +++----
 src/install/migration/npm_lock.rs             | 47 +++++++------------
 src/install/pnpm.rs                           |  4 +-
 3 files changed, 26 insertions(+), 43 deletions(-)

diff --git a/src/install/PackageManager/PackageJSONEditor.rs b/src/install/PackageManager/PackageJSONEditor.rs
index 74aa92d46c28..b24a5e7b39b4 100644
--- a/src/install/PackageManager/PackageJSONEditor.rs
+++ b/src/install/PackageManager/PackageJSONEditor.rs
@@ -768,19 +768,13 @@ pub(crate) fn record_catalog_originals(
     let string_buf = lockfile.buffers.string_bytes.as_slice();
     let package_resolutions = lockfile.packages.items_resolution();
 
-    for (dep, &package_id) in lockfile
-        .buffers
-        .dependencies
-        .iter()
-        .zip(lockfile.buffers.resolutions.iter())
-    {
-        if dep.version.tag != dependency::Tag::Catalog
-            || (package_id as usize) >= package_resolutions.len()
-        {
+    let dependencies = lockfile.buffers.dependencies.iter();
+    for (dep, &package_id) in dependencies.zip(lockfile.buffers.resolutions.iter()) {
+        let resolution = package_resolutions.get(package_id as usize);
+        let Some(resolution) = resolution.filter(|r| r.tag == resolution::Tag::Npm) else {
             continue;
-        }
-        let resolution = &package_resolutions[package_id as usize];
-        if resolution.tag != resolution::Tag::Npm {
+        };
+        if dep.version.tag != dependency::Tag::Catalog {
             continue;
         }
         let dep_name = dep.name.slice(string_buf);
diff --git a/src/install/migration/npm_lock.rs b/src/install/migration/npm_lock.rs
index 19a4fc8f250f..366c91271b80 100644
--- a/src/install/migration/npm_lock.rs
+++ b/src/install/migration/npm_lock.rs
@@ -84,7 +84,13 @@ fn parse_bundle(pkg: &E::ObjectJSON) -> Result<Bundle, Error> {
 
 /// The `os` / `cpu` / `libc` of a package-lock entry: npm copies the field
 /// from package.json as-is, so a single string is accepted like npm does.
-fn parse_platform_list<T: Npm::NegatableEnum>(value: &E::JsonValue) -> Result<T, Error> {
+fn parse_platform_list<T: Npm::NegatableEnum>(
+    value: Option<&E::JsonValue>,
+    absent: T,
+) -> Result<T, Error> {
+    let Some(value) = value else {
+        return Ok(absent);
+    };
     let mut list = T::NONE.negatable();
     if let Some(s) = value.as_str() {
         list.apply(s);
@@ -127,14 +133,6 @@ fn path_inside<'k>(dir: &[u8], path: &'k [u8]) -> Option<&'k [u8]> {
         .filter(|rest| !rest.is_empty())
 }
 
-/// Folder inside a cache-installed dependent; the installer reads its row relative to the package.
-#[derive(Clone, Copy)]
-struct FolderInDependent<'k> {
-    path: &'k [u8],
-    /// Fallback name, as in a fresh resolve; npm writes these entries without one.
-    alias: &'k [u8],
-}
-
 struct Migrator<'a> {
     this: &'a mut Lockfile,
     manager: &'a mut PackageManager,
@@ -314,7 +312,9 @@ impl<'a> Migrator<'a> {
         j: u32,
         via_link: bool,
         hint: DepTag,
-        folder_in_dependent: Option<FolderInDependent<'_>>,
+        // (path below the dependent, dependency name): a folder inside a cache-installed dependent, whose row the
+        // installer reads relative to that package; npm writes these entries nameless, so the name is the fallback.
+        folder_in_dependent: Option<(&[u8], &[u8])>,
     ) -> Result<PackageID, Error> {
         let entries = self.entries;
         let entry = &entries[j as usize];
@@ -330,8 +330,8 @@ impl<'a> Migrator<'a> {
             &ws.name
         } else if let Some(set_name) = pkg.get(b"name").and_then(|n| n.as_str()) {
             set_name
-        } else if let Some(folder) = folder_in_dependent {
-            folder.alias
+        } else if let Some((_, alias)) = folder_in_dependent {
+            alias
         } else {
             package_name_from_path(key)
         };
@@ -356,20 +356,9 @@ impl<'a> Migrator<'a> {
                 lockfile::Origin::Npm
             },
 
-            arch: match pkg.get(b"cpu") {
-                Some(cpu) => parse_platform_list(cpu)?,
-                None => Npm::Architecture::ALL,
-            },
-
-            os: match pkg.get(b"os") {
-                Some(os) => parse_platform_list(os)?,
-                None => Npm::OperatingSystem::ALL,
-            },
-
-            libc: match pkg.get(b"libc") {
-                Some(libc) => parse_platform_list(libc)?,
-                None => Npm::Libc::NONE,
-            },
+            arch: parse_platform_list(pkg.get(b"cpu"), Npm::Architecture::ALL)?,
+            os: parse_platform_list(pkg.get(b"os"), Npm::OperatingSystem::ALL)?,
+            libc: parse_platform_list(pkg.get(b"libc"), Npm::Libc::NONE)?,
 
             man_dir: SemverString::default(),
 
@@ -405,7 +394,7 @@ impl<'a> Migrator<'a> {
             workspace_entry.is_some(),
             via_link,
             hint,
-            folder_in_dependent.map(|folder| folder.path),
+            folder_in_dependent.map(|(path, _)| path),
         )?;
         debug!(
             "{} -> {}",
@@ -802,13 +791,13 @@ impl<'a> Migrator<'a> {
 
                 let version_tag = version.tag;
                 let mut found = self.find_target(key, name);
-                let mut folder_in_dependent: Option<FolderInDependent<'_>> = None;
+                let mut folder_in_dependent = None;
                 if let Some((t, through_link)) = found
                     && !is_local
                 {
                     if through_link && installed_from_cache {
                         folder_in_dependent = path_inside(key, entries[t as usize].key.slice())
-                            .map(|path| FolderInDependent { path, alias: name });
+                            .map(|path| (path, name));
                     }
                     if folder_in_dependent.is_none() && self.is_external_folder(t, through_link) {
                         self.skip_external(t, name);
diff --git a/src/install/pnpm.rs b/src/install/pnpm.rs
index 38053e8d0b7d..4c5cd05b4eb9 100644
--- a/src/install/pnpm.rs
+++ b/src/install/pnpm.rs
@@ -2433,7 +2433,7 @@ pub(crate) fn migrate_pnpm_workspace_config(
 /// Copies the settings pnpm keeps in `pnpm-workspace.yaml` and the `pnpm` key into the fields bun reads, in the
 /// cached root package.json; `package_json_write_back::record_migrated_root` writes it if the lockfile is saved.
 fn update_package_json_after_migration(
-    mut lockfile: Option<&mut Lockfile>,
+    lockfile: Option<&mut Lockfile>,
     manager: &mut PackageManager,
     log: &mut bun_ast::Log,
     patches: &StringArrayHashMap<Box<[u8]>>,
@@ -2515,7 +2515,7 @@ fn update_package_json_after_migration(
             catalog_obj = ws_root.get_object(b"catalog").filter(is_non_empty_object);
             catalogs_obj = ws_root.get_object(b"catalogs").filter(is_non_empty_object);
             // The migrated root skips `Package::parse`, so the catalog these declare is recorded in the lockfile here.
-            if let Some(lockfile) = lockfile.as_deref_mut() {
+            if let Some(lockfile) = lockfile {
                 let catalogs = &mut lockfile.catalogs;
                 catalogs.put_missing_from_pnpm_workspace(
                     catalog_obj,

From ccb8e9646560ab58ae941e756767b505e4f8f8d5 Mon Sep 17 00:00:00 2001
From: Jarred Sumner <jarred@jarredsumner.com>
Date: Mon, 17 Aug 2026 06:03:04 +0000
Subject: [PATCH 249/258] simplify(s4-migration): yarn.rs is_registry_entry
 alias strip

(cherry picked from commit 8233267302fb18a1d9709028a1fe6ce16aaf921b)
---
 src/install/yarn.rs | 9 +++------
 1 file changed, 3 insertions(+), 6 deletions(-)

diff --git a/src/install/yarn.rs b/src/install/yarn.rs
index 2c9b98a71d68..844202f8e850 100644
--- a/src/install/yarn.rs
+++ b/src/install/yarn.rs
@@ -154,12 +154,9 @@ impl<'a> Entry<'a> {
         self.specs.iter().any(|spec| {
             let name = Entry::get_name_from_spec(spec);
             let range = spec.get(name.len() + 1..).unwrap_or(b"");
-            let range = if Entry::is_npm_alias(range) {
-                Entry::parse_npm_alias(range).version
-            } else {
-                range
-            };
-            DepTag::infer(range).is_npm()
+            let alias = range.strip_prefix(b"npm:");
+            DepTag::infer(alias.map_or(range, |alias| Entry::parse_npm_alias(alias).version))
+                .is_npm()
         })
     }
 

From 648ae0f0868f1b2d152788e49a9dbdcccadc258d Mon Sep 17 00:00:00 2001
From: Jarred Sumner <jarred@jarredsumner.com>
Date: Mon, 17 Aug 2026 06:04:18 +0000
Subject: [PATCH 250/258] simplify(s4-migration): shorten two remaining
 multi-line comments

(cherry picked from commit 870ea6cecf7518598d82d62d947a3843b09df6e4)
---
 src/install/pnpm.rs | 3 +--
 src/install/yarn.rs | 7 ++-----
 2 files changed, 3 insertions(+), 7 deletions(-)

diff --git a/src/install/pnpm.rs b/src/install/pnpm.rs
index 4c5cd05b4eb9..80c3dcf967e7 100644
--- a/src/install/pnpm.rs
+++ b/src/install/pnpm.rs
@@ -794,8 +794,7 @@ pub(crate) fn migrate_pnpm_lockfile<'a>(
             let path_str = sbuf!(lockfile).append(importer_path)?;
             lockfile.workspace_paths.put(name_hash, path_str)?;
 
-            // Same rule as the `workspaces` array parser: a version that does not parse, or has a
-            // wildcard, leaves the member unversioned.
+            // As in the `workspaces` array parser, an unparsable or wildcard version leaves the member unversioned.
             if let Some((version_raw, _)) = get_string(workspace_root, b"version") {
                 let version_str = sbuf!(lockfile).append(version_raw)?;
                 let parsed = semver::Version::parse(version_str.sliced(string_bytes!(lockfile)));
diff --git a/src/install/yarn.rs b/src/install/yarn.rs
index 844202f8e850..56d7b2f9a25f 100644
--- a/src/install/yarn.rs
+++ b/src/install/yarn.rs
@@ -605,11 +605,8 @@ pub(crate) fn migrate_yarn_lockfile<'a>(
         yarn_entry_to_package_id.push(package_id);
     }
 
-    // The ids handed out above count every distinct name@version, but an entry
-    // whose resolution cannot be built is not appended below, and a package's id
-    // has to be its index in `this.packages`. Maps the ids above to the appended
-    // ones; a skipped entry stays `INVALID_PACKAGE_ID`, which gives its dependents
-    // the same unresolved edge as a spec with no yarn.lock entry at all.
+    // A package's id is its index in `this.packages`, and an entry whose resolution cannot be built is
+    // not appended; it stays `INVALID_PACKAGE_ID` here, an unresolved edge like a spec missing from yarn.lock.
     let mut appended_package_ids: Vec<PackageID> =
         vec![install::INVALID_PACKAGE_ID; next_package_id as usize];
     let mut seen_package_ids = vec![false; next_package_id as usize];

From 4f9f3b48fccbd5562e10903fd76e1d70558eecb2 Mon Sep 17 00:00:00 2001
From: Jarred Sumner <jarred@jarredsumner.com>
Date: Mon, 17 Aug 2026 06:06:07 +0000
Subject: [PATCH 251/258] simplify(s4-migration): migration.rs report line

(cherry picked from commit 8494fc54d3afa52f53274df5f143ddba2c7357de)
---
 src/install/migration.rs | 6 ++----
 1 file changed, 2 insertions(+), 4 deletions(-)

diff --git a/src/install/migration.rs b/src/install/migration.rs
index 0936ef703c94..236db43923d5 100644
--- a/src/install/migration.rs
+++ b/src/install/migration.rs
@@ -260,10 +260,8 @@ fn report_migrated(
         log.reset();
     }
     Output::print_elapsed(timer.elapsed().as_nanos() as f64 / 1_000_000.0);
-    bun_core::pretty_errorln!(
-        " <d>migrated lockfile from <r><green>{}<r>",
-        bstr::BStr::new(lockfile_name.as_bytes())
-    );
+    let lockfile_name = bstr::BStr::new(lockfile_name.as_bytes());
+    bun_core::pretty_errorln!(" <d>migrated lockfile from <r><green>{}<r>", lockfile_name);
     Output::flush();
 }
 

From 256407bf6b79460e2620ec0d920454cef8203968 Mon Sep 17 00:00:00 2001
From: Jarred Sumner <jarred@jarredsumner.com>
Date: Mon, 17 Aug 2026 06:22:42 +0000
Subject: [PATCH 252/258] simplify(s4-migration): apply review findings

- yarn.rs: os/cpu fold into Negatable fields at parse time (platform_list
  gone); dependency sections write straight into entry.dependencies
- pnpm.rs: get_object for the pnpm/workspaces lookups, copy_into_root
  without the get/expect round-trip, root_package_json via entry().ok()
- CatalogMap: back to a split borrow (get_or_put_named_group) instead of
  take-and-restore of the default catalog
- npm_lock.rs: keep FolderInDependent as a named struct
- PackageJSONEditor: test the catalog tag before the resolution lookup

No-Verification-Needed: worktree has no build; install tests run centrally by the integrator
(cherry picked from commit a1c29a31366a0e9e3bbb75dc6c4fafe5feed9810)
---
 .../PackageManager/PackageJSONEditor.rs       |  6 +--
 src/install/lockfile/CatalogMap.rs            | 25 ++++++----
 src/install/migration/npm_lock.rs             | 22 +++++---
 src/install/pnpm.rs                           | 31 ++++++------
 src/install/yarn.rs                           | 50 +++++++------------
 5 files changed, 62 insertions(+), 72 deletions(-)

diff --git a/src/install/PackageManager/PackageJSONEditor.rs b/src/install/PackageManager/PackageJSONEditor.rs
index b24a5e7b39b4..543899e7273f 100644
--- a/src/install/PackageManager/PackageJSONEditor.rs
+++ b/src/install/PackageManager/PackageJSONEditor.rs
@@ -770,13 +770,13 @@ pub(crate) fn record_catalog_originals(
 
     let dependencies = lockfile.buffers.dependencies.iter();
     for (dep, &package_id) in dependencies.zip(lockfile.buffers.resolutions.iter()) {
+        if dep.version.tag != dependency::Tag::Catalog {
+            continue;
+        }
         let resolution = package_resolutions.get(package_id as usize);
         let Some(resolution) = resolution.filter(|r| r.tag == resolution::Tag::Npm) else {
             continue;
         };
-        if dep.version.tag != dependency::Tag::Catalog {
-            continue;
-        }
         let dep_name = dep.name.slice(string_buf);
         let catalog_name = dep.version.catalog().slice(string_buf);
         let Some(info) = by_name
diff --git a/src/install/lockfile/CatalogMap.rs b/src/install/lockfile/CatalogMap.rs
index 22a5e59dab7f..3bec5982c4f5 100644
--- a/src/install/lockfile/CatalogMap.rs
+++ b/src/install/lockfile/CatalogMap.rs
@@ -206,13 +206,19 @@ impl CatalogMap {
         if catalog_name.is_empty() {
             return Ok(&mut self.default);
         }
+        Self::get_or_put_named_group(&mut self.groups, buf, catalog_name)
+    }
 
-        let entry = self.groups.get_or_put_adapted(&catalog_name, &ctx(buf))?;
+    fn get_or_put_named_group<'a>(
+        groups: &'a mut ArrayHashMap<String, Map>,
+        buf: &[u8],
+        catalog_name: String,
+    ) -> Result<&'a mut Map, AllocError> {
+        let entry = groups.get_or_put_adapted(&catalog_name, &ctx(buf))?;
         if !entry.found_existing {
             *entry.key_ptr = catalog_name;
             *entry.value_ptr = Map::default();
         }
-
         Ok(entry.value_ptr)
     }
 
@@ -408,17 +414,14 @@ impl CatalogMap {
         let Some(declared_groups) = catalogs_obj else {
             return Ok(());
         };
+        let CatalogMap { default, groups } = self;
         declared_groups.try_for_each_property(|group_name_str, _, declared| {
-            // package.json's `catalogs.default` is a named group; its recorded entries move there.
-            let mut recorded =
-                (group_name_str == b"default").then(|| core::mem::take(&mut self.default));
             let group_name = string_buf.append(group_name_str)?;
-            let group = self.get_or_put_group(string_buf.bytes.as_slice(), group_name)?;
-            put_declared_entries(group, recorded.as_mut(), &declared, string_buf)?;
-            if let Some(rest) = recorded {
-                self.default = rest;
-            }
-            Ok(())
+            let group =
+                Self::get_or_put_named_group(groups, string_buf.bytes.as_slice(), group_name)?;
+            // package.json's `catalogs.default` is a named group; the entries recorded in `default` move there.
+            let recorded = (group_name_str == b"default").then_some(&mut *default);
+            put_declared_entries(group, recorded, &declared, string_buf)
         })
     }
 
diff --git a/src/install/migration/npm_lock.rs b/src/install/migration/npm_lock.rs
index 366c91271b80..4c4448b0a12f 100644
--- a/src/install/migration/npm_lock.rs
+++ b/src/install/migration/npm_lock.rs
@@ -133,6 +133,14 @@ fn path_inside<'k>(dir: &[u8], path: &'k [u8]) -> Option<&'k [u8]> {
         .filter(|rest| !rest.is_empty())
 }
 
+/// Folder inside a cache-installed dependent; the installer reads its row relative to the package.
+#[derive(Clone, Copy)]
+struct FolderInDependent<'k> {
+    path: &'k [u8],
+    /// Fallback name, as in a fresh resolve; npm writes these entries without one.
+    alias: &'k [u8],
+}
+
 struct Migrator<'a> {
     this: &'a mut Lockfile,
     manager: &'a mut PackageManager,
@@ -312,9 +320,7 @@ impl<'a> Migrator<'a> {
         j: u32,
         via_link: bool,
         hint: DepTag,
-        // (path below the dependent, dependency name): a folder inside a cache-installed dependent, whose row the
-        // installer reads relative to that package; npm writes these entries nameless, so the name is the fallback.
-        folder_in_dependent: Option<(&[u8], &[u8])>,
+        folder_in_dependent: Option<FolderInDependent<'_>>,
     ) -> Result<PackageID, Error> {
         let entries = self.entries;
         let entry = &entries[j as usize];
@@ -330,8 +336,8 @@ impl<'a> Migrator<'a> {
             &ws.name
         } else if let Some(set_name) = pkg.get(b"name").and_then(|n| n.as_str()) {
             set_name
-        } else if let Some((_, alias)) = folder_in_dependent {
-            alias
+        } else if let Some(folder) = folder_in_dependent {
+            folder.alias
         } else {
             package_name_from_path(key)
         };
@@ -394,7 +400,7 @@ impl<'a> Migrator<'a> {
             workspace_entry.is_some(),
             via_link,
             hint,
-            folder_in_dependent.map(|(path, _)| path),
+            folder_in_dependent.map(|folder| folder.path),
         )?;
         debug!(
             "{} -> {}",
@@ -791,13 +797,13 @@ impl<'a> Migrator<'a> {
 
                 let version_tag = version.tag;
                 let mut found = self.find_target(key, name);
-                let mut folder_in_dependent = None;
+                let mut folder_in_dependent: Option<FolderInDependent<'_>> = None;
                 if let Some((t, through_link)) = found
                     && !is_local
                 {
                     if through_link && installed_from_cache {
                         folder_in_dependent = path_inside(key, entries[t as usize].key.slice())
-                            .map(|path| (path, name));
+                            .map(|path| FolderInDependent { path, alias: name });
                     }
                     if folder_in_dependent.is_none() && self.is_external_folder(t, through_link) {
                         self.skip_external(t, name);
diff --git a/src/install/pnpm.rs b/src/install/pnpm.rs
index 80c3dcf967e7..81c00250ce0e 100644
--- a/src/install/pnpm.rs
+++ b/src/install/pnpm.rs
@@ -203,7 +203,7 @@ fn root_package_json<'a>(
     let cache = &mut manager.workspace_package_json_cache;
     cache
         .get_with_path(log, pkg_json_path.slice(), options)
-        .unwrap()
+        .entry()
         .ok()
 }
 
@@ -2454,7 +2454,7 @@ fn update_package_json_after_migration(
     let mut workspace_only_built_deps = false;
 
     // Copied, not moved: pnpm keeps reading this block, bun only reads the root-level fields.
-    if let Some(pnpm_obj) = json.get(b"pnpm").filter(|pnpm| pnpm.is_object()) {
+    if let Some(pnpm_obj) = json.get_object(b"pnpm") {
         if let Some(overrides) = pnpm_obj.get(b"overrides").filter(is_non_empty_object) {
             if copy_into_root(&mut json, &bump, b"overrides", &overrides, None)? {
                 copied.push("pnpm.overrides to overrides");
@@ -2541,10 +2541,9 @@ fn update_package_json_after_migration(
         }
     } else {
         // An existing `workspaces` array is replaced by the object form.
-        let existing = json
-            .get(b"workspaces")
-            .filter(|workspaces| workspaces.is_object());
-        let mut workspaces = existing.unwrap_or_else(empty_object);
+        let existing = json.get_object(b"workspaces");
+        let mut workspaces =
+            existing.unwrap_or_else(|| Expr::init(E::Object::default(), bun_ast::Loc::EMPTY));
         let workspaces_obj = e_object_mut(&mut workspaces);
         if let Some(paths) = workspace_paths.as_ref().filter(|paths| !paths.is_empty()) {
             workspaces_obj.put(&bump, b"packages", paths_array(paths))?;
@@ -2613,10 +2612,6 @@ fn is_non_empty_object(expr: &Expr) -> bool {
     matches!(&expr.data, ExprData::EObject(o) if !o.properties.is_empty())
 }
 
-fn empty_object() -> Expr {
-    Expr::init(E::Object::default(), bun_ast::Loc::EMPTY)
-}
-
 /// Merges `src`'s entries into the root-level object `field`, created when absent (merged rather than aliased:
 /// the `pnpm` block stays as it is); `false` if `field` is not an object. With `patches`, a bare `name` key pnpm
 /// allows becomes bun.lock's `name@version`.
@@ -2627,13 +2622,15 @@ fn copy_into_root(
     src: &Expr,
     patches: Option<&StringArrayHashMap<Box<[u8]>>>,
 ) -> Result<bool, AllocError> {
-    if json.get(field).is_none() {
-        e_object_mut(json).put(bump, field, empty_object())?;
-    }
-    let mut dest = json.get(field).expect("put above");
-    if !dest.is_object() {
-        return Ok(false);
-    }
+    let mut dest = match json.get(field) {
+        Some(dest) if !dest.is_object() => return Ok(false),
+        Some(dest) => dest,
+        None => {
+            let dest = Expr::init(E::Object::default(), bun_ast::Loc::EMPTY);
+            e_object_mut(json).put(bump, field, dest)?;
+            dest
+        }
+    };
     for prop in e_object(src).properties.slice() {
         let Some(mut key) = as_string(prop.key.as_ref().expect("infallible: prop has key")) else {
             continue;
diff --git a/src/install/yarn.rs b/src/install/yarn.rs
index 56d7b2f9a25f..03d880c48652 100644
--- a/src/install/yarn.rs
+++ b/src/install/yarn.rs
@@ -17,7 +17,7 @@ use crate::lockfile_real::package::{
     Meta as PackageMeta, Package as LockfilePackage, PackageColumns as _,
 };
 use crate::lockfile_real::{self as lockfile, LoadResult, Lockfile};
-use bun_install::npm::{self, NegatableExt as _};
+use bun_install::npm;
 // `Package.resolution` is the file-backed `resolution_real::ResolutionType<u64>`
 // (tag + zero-padded `Value` union), constructed via `init(TaggedValue::*)`; the
 // `bun_install::resolution` stub keeps `Value` as a struct-of-fields and has no `init`.
@@ -51,8 +51,8 @@ pub struct Entry<'a> {
     pub(crate) commit: Option<&'a [u8]>,
     pub(crate) workspace: bool,
     pub(crate) file: Option<&'a [u8]>,
-    pub(crate) os: Option<Vec<&'a [u8]>>,
-    pub(crate) cpu: Option<Vec<&'a [u8]>>,
+    pub(crate) os: npm::Negatable<npm::OperatingSystem>,
+    pub(crate) cpu: npm::Negatable<npm::Architecture>,
     // Owned heap allocation (unlike the borrowed fields above); created in parse()
     pub(crate) git_repo_name: Option<Box<[u8]>>,
 }
@@ -254,7 +254,6 @@ impl<'a> YarnLock<'a> {
         let mut current_entry: Option<Entry<'a>> = None;
         let mut current_specs: Vec<&'a [u8]> = Vec::new();
 
-        let mut current_deps: [Option<StringHashMap<&'a [u8]>>; 4] = Default::default();
         let mut current_dep_type: Option<usize> = None;
 
         while let Some(line_) = lines.next() {
@@ -274,8 +273,7 @@ impl<'a> YarnLock<'a> {
             }
 
             if indent == 0 && trimmed.ends_with(b":") {
-                if let Some(mut entry) = current_entry.take() {
-                    entry.dependencies = core::mem::take(&mut current_deps);
+                if let Some(entry) = current_entry.take() {
                     self.consolidate_and_append_entry(entry)?;
                 }
 
@@ -305,7 +303,6 @@ impl<'a> YarnLock<'a> {
                 }
 
                 current_entry = Some(new_entry);
-                current_deps = Default::default();
                 current_dep_type = None;
                 continue;
             }
@@ -317,7 +314,7 @@ impl<'a> YarnLock<'a> {
             if indent > 0 {
                 if let Some(i) = DEPENDENCY_SECTIONS.iter().position(|s| s.0 == trimmed) {
                     current_dep_type = Some(i);
-                    current_deps[i] = Some(StringHashMap::new());
+                    entry.dependencies[i] = Some(StringHashMap::new());
                     continue;
                 }
 
@@ -325,7 +322,7 @@ impl<'a> YarnLock<'a> {
                     if let Some(space_idx) = strings::index_of(trimmed, b" ") {
                         let key = strings::trim(&trimmed[0..space_idx], b" \"");
                         let value = strings::trim(&trimmed[space_idx + 1..], b" \"");
-                        let map = current_deps[dep_type].as_mut().expect("set with the type");
+                        let map = entry.dependencies[dep_type].get_or_insert_default();
                         map.put(key, value)?;
                     }
                     continue;
@@ -360,21 +357,20 @@ impl<'a> YarnLock<'a> {
                         && value.starts_with(b"[")
                         && value.ends_with(b"]")
                     {
-                        let list = strings::split(&value[1..value.len() - 1], b",")
-                            .map(|item| strings::trim(item, b" \""))
-                            .collect();
-                        *(if key == b"os" {
-                            &mut entry.os
-                        } else {
-                            &mut entry.cpu
-                        }) = Some(list);
+                        for item in strings::split(&value[1..value.len() - 1], b",") {
+                            let item = strings::trim(item, b" \"");
+                            if key == b"os" {
+                                entry.os.apply(item);
+                            } else {
+                                entry.cpu.apply(item);
+                            }
+                        }
                     }
                 }
             }
         }
 
-        if let Some(mut entry) = current_entry.take() {
-            entry.dependencies = current_deps;
+        if let Some(entry) = current_entry.take() {
             self.consolidate_and_append_entry(entry)?;
         }
 
@@ -759,8 +755,8 @@ pub(crate) fn migrate_yarn_lockfile<'a>(
             meta: PackageMeta {
                 id: appended_id,
                 origin: Origin::Npm,
-                arch: platform_list(&entry.cpu),
-                os: platform_list(&entry.os),
+                arch: entry.cpu.combine(),
+                os: entry.os.combine(),
                 man_dir: SemverString::default(),
                 has_install_script: HasInstallScript::False,
                 integrity: entry
@@ -877,15 +873,3 @@ pub(crate) fn migrate_yarn_lockfile<'a>(
 fn string_hash(s: &[u8]) -> u64 {
     Semver::string::Builder::string_hash(s)
 }
-
-/// yarn.lock's `os`/`cpu` lists; an entry without one installs everywhere.
-fn platform_list<T: npm::NegatableEnum>(list: &Option<Vec<&[u8]>>) -> T {
-    let Some(list) = list else {
-        return T::ALL;
-    };
-    let mut negatable = T::NONE.negatable();
-    for item in list {
-        negatable.apply(item);
-    }
-    negatable.combine()
-}

From 98c14efc714f5b2f6850eae78815337f7fc41b45 Mon Sep 17 00:00:00 2001
From: Jarred Sumner <jarred@jarredsumner.com>
Date: Mon, 17 Aug 2026 06:33:39 +0000
Subject: [PATCH 253/258] =?UTF-8?q?mega-merge=20fixup:=20CI=20failures=20?=
 =?UTF-8?q?=E2=80=94=20skip=20the=20pthread=5Fcreate=20shim=20under=20ASAN?=
 =?UTF-8?q?,=20root=20package.json=20write=20error=20wording=20(#38754=20x?=
 =?UTF-8?q?=20#38804),=20bun=20update=20keeps=20a=20still-covering=20>=3D?=
 =?UTF-8?q?=20range=20(#38185)?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 src/install/PackageManager/add_remove_with_filter.rs | 12 ++++++++----
 .../install/bun-install-thread-spawn-failure.test.ts |  7 ++++---
 .../cli/install/bun-update-security-provider.test.ts |  3 ++-
 .../install/migration/pnpm-lock-migration.test.ts    |  5 ++---
 4 files changed, 16 insertions(+), 11 deletions(-)

diff --git a/src/install/PackageManager/add_remove_with_filter.rs b/src/install/PackageManager/add_remove_with_filter.rs
index 1ae652f46c3e..bcda0f4430a6 100644
--- a/src/install/PackageManager/add_remove_with_filter.rs
+++ b/src/install/PackageManager/add_remove_with_filter.rs
@@ -298,10 +298,14 @@ pub(crate) fn write_target(manager: &mut PackageManager, target: &WorkspaceTarge
     match File::write_file(Fd::cwd(), path, &entry.source.contents) {
         Ok(()) => true,
         Err(err) => {
-            Output::err_generic(
-                "failed to write package.json for workspace '{}': {}",
-                (BStr::new(&target.name), BStr::new(err.name())),
-            );
+            if target.name.is_empty() {
+                Output::err_generic("failed to write package.json: {}", (BStr::new(err.name()),));
+            } else {
+                Output::err_generic(
+                    "failed to write package.json for workspace '{}': {}",
+                    (BStr::new(&target.name), BStr::new(err.name())),
+                );
+            }
             false
         }
     }
diff --git a/test/cli/install/bun-install-thread-spawn-failure.test.ts b/test/cli/install/bun-install-thread-spawn-failure.test.ts
index 907cfa20ca70..17dd33ba4207 100644
--- a/test/cli/install/bun-install-thread-spawn-failure.test.ts
+++ b/test/cli/install/bun-install-thread-spawn-failure.test.ts
@@ -4,7 +4,7 @@
 // it must be reported as a plain error with exit code 1 instead of going
 // through the crash reporter ("oh no: Bun has crashed", bun.report link).
 import { describe, expect, test } from "bun:test";
-import { bunEnv, bunExe, compileFixture, isLinux, isMusl, tempDir } from "harness";
+import { bunEnv, bunExe, compileFixture, isASAN, isLinux, isMusl, tempDir } from "harness";
 import { join } from "node:path";
 
 const cc = Bun.which("cc") || Bun.which("gcc") || Bun.which("clang");
@@ -21,8 +21,9 @@ int pthread_create(pthread_t *thread, const pthread_attr_t *attr, void *(*start)
 }
 `;
 
-// bun-musl is statically linked, so LD_PRELOAD cannot intercept pthread_create.
-describe.skipIf(!isLinux || isMusl || !cc)("bun install when the HTTP client thread cannot be started", () => {
+// bun-musl is statically linked, and ASAN builds carry their own pthread_create
+// interceptor in the executable, so LD_PRELOAD cannot intercept pthread_create in either.
+describe.skipIf(!isLinux || isMusl || isASAN || !cc)("bun install when the HTTP client thread cannot be started", () => {
   test.concurrent.each([
     // [pthread_create result, how it is reported, whether the thread-limit hint applies]
     ["EAGAIN", "EAGAIN", true],
diff --git a/test/cli/install/bun-update-security-provider.test.ts b/test/cli/install/bun-update-security-provider.test.ts
index 00b3110e46d9..aa692983f0fd 100644
--- a/test/cli/install/bun-update-security-provider.test.ts
+++ b/test/cli/install/bun-update-security-provider.test.ts
@@ -151,7 +151,8 @@ test.concurrent("security scanner does not run on bun update when not configured
     expect(exitCode).toBe(0);
 
     expect(urls).toEqual([`${ctx.registry_url}moo`, `${ctx.registry_url}moo-0.2.0.tgz`]);
-    expect(await mooState(ctx)).toEqual({ range: "^0.2.0", locked: "moo@0.2.0", installed: "0.2.0" });
+    // `>=0.1.0` still covers 0.2.0, so the literal is kept.
+    expect(await mooState(ctx)).toEqual({ range: ">=0.1.0", locked: "moo@0.2.0", installed: "0.2.0" });
   } finally {
     destroyTestContext(ctx);
   }
diff --git a/test/cli/install/migration/pnpm-lock-migration.test.ts b/test/cli/install/migration/pnpm-lock-migration.test.ts
index cd319c541d76..3f53ce13e2f6 100644
--- a/test/cli/install/migration/pnpm-lock-migration.test.ts
+++ b/test/cli/install/migration/pnpm-lock-migration.test.ts
@@ -671,12 +671,11 @@ importers:
     });
     fs.chmodSync(join(dir, "package.json"), 0o444);
 
+    // The migrated package.json is written with the command's other package.json edits, after the lockfile.
     const { stderr, exitCode } = await runBun(dir, "install");
-    expect(stderr).toContain("failed to move pnpm-workspace.yaml to workspaces in package.json");
-    expect(stderr).not.toContain("copied pnpm");
+    expect(stderr).toContain("error: failed to write package.json: EACCES");
     expect(exitCode).toBe(1);
 
     expect(fs.readFileSync(join(dir, "package.json"), "utf8")).toBe(original);
-    expect(fs.existsSync(join(dir, "bun.lock"))).toBe(false);
   });
 });

From 8cb91a376d64ca2d8d93abee03d3d72cf41dc812 Mon Sep 17 00:00:00 2001
From: Jarred Sumner <jarred@jarredsumner.com>
Date: Mon, 17 Aug 2026 06:33:42 +0000
Subject: [PATCH 254/258] simplify: use fmt::for_terminal at the remaining
 EscapeControlChars(redacted(..)) sites

---
 src/install/PackageInstaller.rs                    |  6 +++---
 .../PackageManager/PackageManagerEnqueue.rs        |  4 ++--
 .../PackageManager/PackageManagerResolution.rs     |  9 ++++-----
 .../PackageManager/processDependencyList.rs        | 13 +++----------
 src/install/PackageManager/runTasks.rs             | 14 +++++++-------
 src/install/isolated_install.rs                    |  4 ++--
 src/install/isolated_install/Installer.rs          | 11 +++++------
 src/install/lockfile/Package/Scripts.rs            |  4 ++--
 src/install/lockfile/printer/tree_printer.rs       | 10 +++++-----
 src/install/patch_install.rs                       |  4 +---
 src/runtime/cli/pm_licenses_command.rs             |  2 +-
 11 files changed, 35 insertions(+), 46 deletions(-)

diff --git a/src/install/PackageInstaller.rs b/src/install/PackageInstaller.rs
index 526dab9db9fd..a157fd2aa722 100644
--- a/src/install/PackageInstaller.rs
+++ b/src/install/PackageInstaller.rs
@@ -1,7 +1,7 @@
 use core::sync::atomic::Ordering;
 
 use bun_collections::{ArrayHashMap, DynamicBitSet, StringHashMap};
-use bun_core::fmt::{PathSep, redacted};
+use bun_core::fmt::PathSep;
 use bun_core::{Global, Output};
 use bun_core::{ZStr, strings};
 use bun_paths::resolve_path::{dirname, join_abs_string_z, join_z_buf};
@@ -2098,9 +2098,9 @@ impl<'a> PackageInstaller<'a> {
                                             "Blocked {} scripts for: {}@{}\n",
                                             count,
                                             bstr::BStr::new(alias.slice(string_buf!())),
-                                            bun_core::fmt::EscapeControlChars(redacted(
+                                            bun_core::fmt::for_terminal(
                                                 resolution.fmt(string_buf!(), PathSep::Posix)
-                                            )),
+                                            ),
                                         );
                                     }
                                     let entry = self
diff --git a/src/install/PackageManager/PackageManagerEnqueue.rs b/src/install/PackageManager/PackageManagerEnqueue.rs
index 7c9b4b687f7a..a8b86dbf4709 100644
--- a/src/install/PackageManager/PackageManagerEnqueue.rs
+++ b/src/install/PackageManager/PackageManagerEnqueue.rs
@@ -3065,10 +3065,10 @@ fn bind_existing_peer(
                 existing_package
                     .name
                     .fmt(this.lockfile.buffers.string_bytes.as_slice()),
-                bun_fmt::EscapeControlChars(bun_fmt::redacted(existing_package.resolution.fmt(
+                bun_core::fmt::for_terminal(existing_package.resolution.fmt(
                     this.lockfile.buffers.string_bytes.as_slice(),
                     bun_fmt::PathSep::Auto
-                ))),
+                )),
             ),
         );
     }
diff --git a/src/install/PackageManager/PackageManagerResolution.rs b/src/install/PackageManager/PackageManagerResolution.rs
index dac317552e7a..cac6e787762d 100644
--- a/src/install/PackageManager/PackageManagerResolution.rs
+++ b/src/install/PackageManager/PackageManagerResolution.rs
@@ -2,7 +2,6 @@ use crate::lockfile::package::PackageColumns as _;
 use core::mem::ManuallyDrop;
 
 use bun_core::Output;
-use bun_core::fmt::redacted;
 use bun_core::strings;
 use bun_paths::PathBuffer;
 use bun_semver as semver;
@@ -373,9 +372,9 @@ impl PackageManager {
                     {
                         Output::err_generic(
                             "<b>{}<r><d> failed to resolve<r>",
-                            (bun_core::fmt::EscapeControlChars(redacted(
+                            (bun_core::fmt::for_terminal(
                                 failed_dep.version.literal.fmt(string_buf),
-                            )),),
+                            ),),
                         );
                     } else {
                         Output::err_generic(
@@ -384,9 +383,9 @@ impl PackageManager {
                                 bun_core::fmt::escape_control_chars(
                                     failed_dep.name.slice(string_buf),
                                 ),
-                                bun_core::fmt::EscapeControlChars(redacted(
+                                bun_core::fmt::for_terminal(
                                     failed_dep.version.literal.fmt(string_buf),
-                                )),
+                                ),
                             ),
                         );
                     }
diff --git a/src/install/PackageManager/processDependencyList.rs b/src/install/PackageManager/processDependencyList.rs
index 7e1004e5b57f..e3fca237d978 100644
--- a/src/install/PackageManager/processDependencyList.rs
+++ b/src/install/PackageManager/processDependencyList.rs
@@ -1,6 +1,5 @@
 use core::cell::Cell;
 
-use bun_core::fmt::redacted;
 use bun_core::{Global, Output};
 use bun_paths::dirname;
 use bun_paths::platform;
@@ -157,9 +156,7 @@ impl PackageManager {
                                     "failed to parse package.json for <b>{}<r>",
                                     format_args!(
                                         "{}",
-                                        bun_core::fmt::EscapeControlChars(redacted(
-                                            resolution.fmt_url(string_buf)
-                                        ))
+                                        bun_core::fmt::for_terminal(resolution.fmt_url(string_buf))
                                     ),
                                 );
                             }
@@ -246,9 +243,7 @@ impl PackageManager {
                         let string_buf = self.lockfile.buffers.string_bytes.as_slice();
                         bun_core::pretty_errorln!(
                             "<r><red>error:<r> expected package.json in <b>{}<r> to be a JSON file: {}\n",
-                            bun_core::fmt::EscapeControlChars(redacted(
-                                resolution.fmt_url(string_buf)
-                            )),
+                            bun_core::fmt::for_terminal(resolution.fmt_url(string_buf)),
                             err.name(),
                         );
                     }
@@ -300,9 +295,7 @@ impl PackageManager {
                                 let string_buf = self.lockfile.buffers.string_bytes.as_slice();
                                 bun_core::pretty_errorln!(
                                     "<r><red>error:<r> expected package.json in <b>{}<r> to be a JSON file: {}\n",
-                                    bun_core::fmt::EscapeControlChars(redacted(
-                                        resolution.fmt_url(string_buf)
-                                    )),
+                                    bun_core::fmt::for_terminal(resolution.fmt_url(string_buf)),
                                     err.name(),
                                 );
                             }
diff --git a/src/install/PackageManager/runTasks.rs b/src/install/PackageManager/runTasks.rs
index a3b20c7bd29e..cc4f6aef3fdd 100644
--- a/src/install/PackageManager/runTasks.rs
+++ b/src/install/PackageManager/runTasks.rs
@@ -27,7 +27,7 @@ use crate::isolated_install::installer as store_installer;
 use crate::isolated_install::store::{EntryColumns as _, NodeColumns as _};
 use crate::lifecycle_script_runner::InstallCtx;
 use crate::network_task::{Authorization, ForTarballError};
-use bun_core::fmt::{PathSep, redacted};
+use bun_core::fmt::PathSep;
 use bun_install::lockfile::Package;
 use bun_install::package_manager_task as Task;
 // Import the *module* under the `Options` name so `Options::LogLevel` resolves as a path
@@ -717,11 +717,11 @@ pub fn run_tasks<C: RunTasksCallbacks>(
                                 "{} downloading tarball <b>{}@{}<r>. Retrying {}/{}...",
                                 bstr::BStr::new(err.name().as_bytes()),
                                 bun_core::fmt::escape_control_chars(extract.name.slice()),
-                                bun_core::fmt::EscapeControlChars(redacted(
+                                bun_core::fmt::for_terminal(
                                     extract
                                         .resolution
                                         .fmt(&manager.lockfile.buffers.string_bytes, PathSep::Auto),
-                                )),
+                                ),
                                 task.retried,
                                 manager.options.max_retry_count,
                             );
@@ -789,11 +789,11 @@ pub fn run_tasks<C: RunTasksCallbacks>(
                             "{} downloading tarball <b>{}@{}<r>",
                             err.name(),
                             bun_core::fmt::escape_control_chars(extract.name.slice()),
-                            bun_core::fmt::EscapeControlChars(redacted(
+                            bun_core::fmt::for_terminal(
                                 extract
                                     .resolution
                                     .fmt(&manager.lockfile.buffers.string_bytes, PathSep::Auto),
-                            )),
+                            ),
                         );
                     } else {
                         bun_ast::add_warning_pretty!(
@@ -803,11 +803,11 @@ pub fn run_tasks<C: RunTasksCallbacks>(
                             "{} downloading tarball <b>{}@{}<r>",
                             err.name(),
                             bun_core::fmt::escape_control_chars(extract.name.slice()),
-                            bun_core::fmt::EscapeControlChars(redacted(
+                            bun_core::fmt::for_terminal(
                                 extract
                                     .resolution
                                     .fmt(&manager.lockfile.buffers.string_bytes, PathSep::Auto),
-                            )),
+                            ),
                         );
                     }
                     if manager.subcommand != Subcommand::Remove {
diff --git a/src/install/isolated_install.rs b/src/install/isolated_install.rs
index 75a376c27516..dfaed8068ee9 100644
--- a/src/install/isolated_install.rs
+++ b/src/install/isolated_install.rs
@@ -2558,9 +2558,9 @@ pub(crate) fn install_isolated_packages(
                                         "failed to enqueue tarball for download: {}@{}",
                                         (
                                             BStr::new(pkg_name.slice(string_buf)),
-                                            bun_core::fmt::EscapeControlChars(bun_fmt::redacted(
+                                            bun_core::fmt::for_terminal(
                                                 pkg_res.fmt(string_buf, bun_fmt::PathSep::Auto),
-                                            )),
+                                            ),
                                         ),
                                     );
                                     Output::flush();
diff --git a/src/install/isolated_install/Installer.rs b/src/install/isolated_install/Installer.rs
index 0632a56fea99..a7af56e5c4f8 100644
--- a/src/install/isolated_install/Installer.rs
+++ b/src/install/isolated_install/Installer.rs
@@ -3,7 +3,7 @@ use std::io::Write as _;
 
 use bun_ast::Log;
 use bun_collections::{ArrayHashMap, DynamicBitSet, StringHashMap};
-use bun_core::fmt::{EscapeControlChars, redacted};
+use bun_core::fmt::EscapeControlChars;
 use bun_core::{Environment, Global, Output};
 use bun_core::{ZStr, strings};
 use bun_paths::{self as paths, AbsPath, AutoAbsPath, AutoRelPath};
@@ -313,9 +313,9 @@ impl<'a> Installer<'a> {
                 "failed to download <b>{}@{}<r>: {}\n  <d>{}<r>",
                 (
                     bun_core::fmt::escape_control_chars(name),
-                    bun_core::fmt::EscapeControlChars(redacted(
+                    bun_core::fmt::for_terminal(
                         resolution.fmt(string_buf, bun_core::fmt::PathSep::Auto),
-                    )),
+                    ),
                     bstr::BStr::new(download_error_reason(err)),
                     EscapeControlChars(bun_core::fmt::redacted_npm_url(url)),
                 ),
@@ -380,9 +380,8 @@ impl<'a> Installer<'a> {
         let pkg_res = pkg_resolutions[pkg_id as usize];
         let pkg_name =
             bun_core::fmt::escape_control_chars(pkg_names[pkg_id as usize].slice(string_buf));
-        let pkg_res_fmt = EscapeControlChars(redacted(
-            pkg_res.fmt(string_buf, bun_core::fmt::PathSep::Auto),
-        ));
+        let pkg_res_fmt =
+            bun_core::fmt::for_terminal(pkg_res.fmt(string_buf, bun_core::fmt::PathSep::Auto));
 
         match err {
             TaskError::LinkPackage(link_err) => {
diff --git a/src/install/lockfile/Package/Scripts.rs b/src/install/lockfile/Package/Scripts.rs
index 577de10b618d..df7bb2e64128 100644
--- a/src/install/lockfile/Package/Scripts.rs
+++ b/src/install/lockfile/Package/Scripts.rs
@@ -1,7 +1,7 @@
 use bstr::BStr;
 
 use bun_core::ZBox;
-use bun_core::fmt::{EscapeControlChars, PathSep, escape_control_chars, redacted};
+use bun_core::fmt::{PathSep, escape_control_chars};
 use bun_core::strings;
 use bun_install::lockfile::Lockfile;
 use bun_install::lockfile::Scripts as LockfileScripts;
@@ -427,7 +427,7 @@ impl List {
         format_type: PrintFormat,
     ) {
         let resolution =
-            EscapeControlChars(redacted(resolution.fmt(resolution_buf, PathSep::Posix)));
+            bun_core::fmt::for_terminal(resolution.fmt(resolution_buf, PathSep::Posix));
         let needle = bun_paths::NODE_MODULES_NEEDLE;
         if let Some(i) = strings::index_of(self.cwd.as_bytes(), needle) {
             bun_core::pretty!(
diff --git a/src/install/lockfile/printer/tree_printer.rs b/src/install/lockfile/printer/tree_printer.rs
index efa78a1a0de6..769e5fb808ac 100644
--- a/src/install/lockfile/printer/tree_printer.rs
+++ b/src/install/lockfile/printer/tree_printer.rs
@@ -4,7 +4,7 @@ use bun_semver as semver;
 
 use crate::lockfile_real::package::PackageColumns as _;
 use crate::package_manager_real::TrackInstalledBin;
-use bun_core::fmt::{EscapeControlChars, PathSep, escape_control_chars, redacted};
+use bun_core::fmt::{PathSep, escape_control_chars};
 use bun_install::lockfile::{Printer, package::Meta as PackageMeta};
 use bun_install::{
     self as install, Bin, Dependency, DependencyID, DependencyVersionTag, INVALID_PACKAGE_ID,
@@ -520,7 +520,7 @@ where
     let packages_slice = this.lockfile.packages.slice();
     let resolution: Resolution = packages_slice.items_resolution()[package_id as usize];
     let name = dependency.name.slice(string_buf);
-    let version = EscapeControlChars(redacted(resolution.fmt(string_buf, PathSep::Posix)));
+    let version = bun_core::fmt::for_terminal(resolution.fmt(string_buf, PathSep::Posix));
 
     let package_name = packages_slice.items_name()[package_id as usize].slice(string_buf);
     if let Some(later_version_fmt) =
@@ -599,7 +599,7 @@ where
         writer,
         ENABLE_ANSI_COLORS,
         "<d>@{f}<r>",
-        bun_core::fmt::EscapeControlChars(redacted(resolution.fmt(string_buf, PathSep::Posix))),
+        bun_core::fmt::for_terminal(resolution.fmt(string_buf, PathSep::Posix)),
     )?;
     writer.write_str(if has_binaries {
         " with binaries:\n"
@@ -789,9 +789,9 @@ where
                 ENABLE_ANSI_COLORS,
                 " <r><b>{s}<r><d>@<b>{f}<r>\n",
                 bun_core::fmt::escape_control_chars(package_name),
-                bun_core::fmt::EscapeControlChars(redacted(
+                bun_core::fmt::for_terminal(
                     resolved[package_id as usize].fmt(string_buf, PathSep::Auto)
-                )),
+                ),
             )?;
         }
     }
diff --git a/src/install/patch_install.rs b/src/install/patch_install.rs
index 20dc0a3f153e..f4b8e403faa6 100644
--- a/src/install/patch_install.rs
+++ b/src/install/patch_install.rs
@@ -512,9 +512,7 @@ impl PatchTask {
                         &e,
                         format_args!(
                             "failed trying to open temporary dir to apply patch to package: {}",
-                            bun_core::fmt::EscapeControlChars(bun_core::fmt::redacted(BStr::new(
-                                &resolution_label
-                            )))
+                            bun_core::fmt::for_terminal(BStr::new(&resolution_label))
                         ),
                     );
                     return Ok(());
diff --git a/src/runtime/cli/pm_licenses_command.rs b/src/runtime/cli/pm_licenses_command.rs
index d449f75607dc..53d339ffce3e 100644
--- a/src/runtime/cli/pm_licenses_command.rs
+++ b/src/runtime/cli/pm_licenses_command.rs
@@ -731,7 +731,7 @@ fn print_text(entries: &[Entry], long: bool, checked: usize, summary: bool) {
                 "<d>{}<r> {}<d>@{}<r>",
                 if last { "└──" } else { "├──" },
                 BStr::new(&entry.name),
-                bun_core::fmt::EscapeControlChars(redacted(BStr::new(&entry.version)))
+                bun_core::fmt::for_terminal(BStr::new(&entry.version))
             );
             if entry.dev_only {
                 bun_core::pretty!(" <d>(dev)<r>");

From f4258455a03dd77f8be0d9338ee1614391aca37a Mon Sep 17 00:00:00 2001
From: Jarred Sumner <jarred@jarredsumner.com>
Date: Mon, 17 Aug 2026 06:34:26 +0000
Subject: [PATCH 255/258] audit fix: rewrite a matching rule in resolutions too
 when package.json has both fields (#38785 x #38811)

---
 src/install/audit_fix/package_json_edits.rs | 65 +++++++++++----------
 1 file changed, 33 insertions(+), 32 deletions(-)

diff --git a/src/install/audit_fix/package_json_edits.rs b/src/install/audit_fix/package_json_edits.rs
index 84ce16dcfee9..494569ade597 100644
--- a/src/install/audit_fix/package_json_edits.rs
+++ b/src/install/audit_fix/package_json_edits.rs
@@ -303,51 +303,52 @@ pub(super) fn override_literal(
 
 /// Visits, in file order, the value of every entry declaring `selector` for `name`, whichever of the accepted key spellings (`a>b`, `a/b`, `**/b`, `{"a": {"b": ..}}`, `{"b": {".": ..}}`) each uses.
 ///
-/// Reads `overrides`, else `resolutions`, like `OverrideMap::parse_append`; npm's `"parent": { "child": .. }` form only counts in `overrides`, where the parser accepts it.
+/// Walks both `overrides` and `resolutions`, like `OverrideMap::parse_append`; npm's `"parent": { "child": .. }` form only counts in `overrides`, where the parser accepts it.
 fn for_each_override_value(
     root: &Expr,
     name: &[u8],
     selector: &OverrideSelector,
     mut f: impl FnMut(&mut Option<Expr>),
 ) {
-    let overrides = root.get(b"overrides");
-    let nested = overrides.is_some();
-    let Some(mut rules) = overrides.or_else(|| root.get(b"resolutions")) else {
-        return;
-    };
-    let Some(object) = rules.data.e_object_mut() else {
-        return;
-    };
-    for prop in object.properties.slice_mut() {
-        let Some(key) = prop.key.as_ref().and_then(Expr::as_utf8_string_literal) else {
-            continue;
-        };
-        if !(nested && prop.value.as_ref().is_some_and(|value| value.is_object())) {
-            if parse_selector(key).is_ok_and(|r| selector.matches(name, r.parent, r.target)) {
-                f(&mut prop.value);
-            }
-            continue;
-        }
-        let Ok(parent) = parse_package_segment(key) else {
+    for (field, nested) in [(b"overrides".as_slice(), true), (b"resolutions", false)] {
+        let Some(mut rules) = root.get(field) else {
             continue;
         };
-        let Some(group) = prop.value.as_mut().and_then(|v| v.data.e_object_mut()) else {
+        let Some(object) = rules.data.e_object_mut() else {
             continue;
         };
-        for child in group.properties.slice_mut() {
-            let Some(child_key) = child.key.as_ref().and_then(Expr::as_utf8_string_literal) else {
+        for prop in object.properties.slice_mut() {
+            let Some(key) = prop.key.as_ref().and_then(Expr::as_utf8_string_literal) else {
                 continue;
             };
-            let (rule_parent, target) = match parse_selector(child_key) {
-                _ if child_key == b"." => (None, parent),
-                Ok(Selector {
-                    parent: None,
-                    target,
-                }) => (Some(parent), target),
-                _ => continue,
+            if !(nested && prop.value.as_ref().is_some_and(|value| value.is_object())) {
+                if parse_selector(key).is_ok_and(|r| selector.matches(name, r.parent, r.target)) {
+                    f(&mut prop.value);
+                }
+                continue;
+            }
+            let Ok(parent) = parse_package_segment(key) else {
+                continue;
+            };
+            let Some(group) = prop.value.as_mut().and_then(|v| v.data.e_object_mut()) else {
+                continue;
             };
-            if selector.matches(name, rule_parent, target) {
-                f(&mut child.value);
+            for child in group.properties.slice_mut() {
+                let Some(child_key) = child.key.as_ref().and_then(Expr::as_utf8_string_literal)
+                else {
+                    continue;
+                };
+                let (rule_parent, target) = match parse_selector(child_key) {
+                    _ if child_key == b"." => (None, parent),
+                    Ok(Selector {
+                        parent: None,
+                        target,
+                    }) => (Some(parent), target),
+                    _ => continue,
+                };
+                if selector.matches(name, rule_parent, target) {
+                    f(&mut child.value);
+                }
             }
         }
     }

From 40ad36d9a2ee29d7839f1d1663e0e9b5c1bef7a2 Mon Sep 17 00:00:00 2001
From: Jarred Sumner <jarred@jarredsumner.com>
Date: Mon, 17 Aug 2026 07:00:23 +0000
Subject: [PATCH 256/258] prettier

---
 .../bun-install-thread-spawn-failure.test.ts  | 65 ++++++++++---------
 1 file changed, 34 insertions(+), 31 deletions(-)

diff --git a/test/cli/install/bun-install-thread-spawn-failure.test.ts b/test/cli/install/bun-install-thread-spawn-failure.test.ts
index 17dd33ba4207..3df991d32587 100644
--- a/test/cli/install/bun-install-thread-spawn-failure.test.ts
+++ b/test/cli/install/bun-install-thread-spawn-failure.test.ts
@@ -23,36 +23,39 @@ int pthread_create(pthread_t *thread, const pthread_attr_t *attr, void *(*start)
 
 // bun-musl is statically linked, and ASAN builds carry their own pthread_create
 // interceptor in the executable, so LD_PRELOAD cannot intercept pthread_create in either.
-describe.skipIf(!isLinux || isMusl || isASAN || !cc)("bun install when the HTTP client thread cannot be started", () => {
-  test.concurrent.each([
-    // [pthread_create result, how it is reported, whether the thread-limit hint applies]
-    ["EAGAIN", "EAGAIN", true],
-    ["EPERM", "EPERM", false],
-    // A code bun has no errno name for is reported with the OS's own description.
-    ["9999", "Unknown error 9999 (os error 9999)", false],
-  ])("pthread_create returning %s exits 1 with an error naming %s", async (code, reported, hintApplies) => {
-    using dir = tempDir(`install-thread-spawn-${code}`, {
-      "shim.c": shimC(code),
-      "package.json": JSON.stringify({ name: "thread-spawn-failure", dependencies: {} }),
-    });
-    const shim = compileFixture(join(String(dir), "shim.c"));
+describe.skipIf(!isLinux || isMusl || isASAN || !cc)(
+  "bun install when the HTTP client thread cannot be started",
+  () => {
+    test.concurrent.each([
+      // [pthread_create result, how it is reported, whether the thread-limit hint applies]
+      ["EAGAIN", "EAGAIN", true],
+      ["EPERM", "EPERM", false],
+      // A code bun has no errno name for is reported with the OS's own description.
+      ["9999", "Unknown error 9999 (os error 9999)", false],
+    ])("pthread_create returning %s exits 1 with an error naming %s", async (code, reported, hintApplies) => {
+      using dir = tempDir(`install-thread-spawn-${code}`, {
+        "shim.c": shimC(code),
+        "package.json": JSON.stringify({ name: "thread-spawn-failure", dependencies: {} }),
+      });
+      const shim = compileFixture(join(String(dir), "shim.c"));
 
-    await using proc = Bun.spawn({
-      cmd: [bunExe(), "install"],
-      cwd: String(dir),
-      env: {
-        ...bunEnv,
-        BUN_INSTALL_CACHE_DIR: join(String(dir), "cache"),
-        LD_PRELOAD: [shim, bunEnv.LD_PRELOAD].filter(Boolean).join(":"),
-      },
-      stdout: "pipe",
-      stderr: "pipe",
-    });
-    const [stderr, , exitCode] = await Promise.all([proc.stderr.text(), proc.stdout.text(), proc.exited]);
+      await using proc = Bun.spawn({
+        cmd: [bunExe(), "install"],
+        cwd: String(dir),
+        env: {
+          ...bunEnv,
+          BUN_INSTALL_CACHE_DIR: join(String(dir), "cache"),
+          LD_PRELOAD: [shim, bunEnv.LD_PRELOAD].filter(Boolean).join(":"),
+        },
+        stdout: "pipe",
+        stderr: "pipe",
+      });
+      const [stderr, , exitCode] = await Promise.all([proc.stderr.text(), proc.stdout.text(), proc.exited]);
 
-    expect(stderr).toContain(`Failed to start HTTP Client thread: ${reported}`);
-    expect(stderr.includes("ulimit -u")).toBe(hintApplies);
-    expect(stderr).not.toContain("Bun has crashed");
-    expect(exitCode).toBe(1);
-  });
-});
+      expect(stderr).toContain(`Failed to start HTTP Client thread: ${reported}`);
+      expect(stderr.includes("ulimit -u")).toBe(hintApplies);
+      expect(stderr).not.toContain("Bun has crashed");
+      expect(exitCode).toBe(1);
+    });
+  },
+);

From 9f1c929446327639571065053f4464531730568c Mon Sep 17 00:00:00 2001
From: Jarred Sumner <jarred@jarredsumner.com>
Date: Mon, 17 Aug 2026 07:11:59 +0000
Subject: [PATCH 257/258] review: write the migrated package.json before the
 lockfile (#38754 contract), bunx lock next to the cache dir with O_NOFOLLOW +
 owner check, escape names in bun why / pm licenses, userconfig tests for
 #38047, strings::split lint

---
 src/install/PackageManager.rs                 |  2 +-
 .../PackageManager/install_with_manager.rs    |  4 +-
 .../PackageManager/package_json_write_back.rs | 28 ++++----------
 src/install/dependency.rs                     |  2 +-
 src/install/pnpm.rs                           |  2 +-
 src/runtime/cli/bunx_command.rs               | 37 ++++++++-----------
 src/runtime/cli/package_manager_command.rs    |  2 +-
 src/runtime/cli/pm_licenses_command.rs        |  2 +-
 src/runtime/cli/why_command.rs                |  2 +-
 .../migration/pnpm-lock-migration.test.ts     | 15 ++++++--
 test/cli/install/npmrc.test.ts                | 23 ++++++++++++
 11 files changed, 66 insertions(+), 53 deletions(-)

diff --git a/src/install/PackageManager.rs b/src/install/PackageManager.rs
index a1ff0d1e1e1d..be5b42941121 100644
--- a/src/install/PackageManager.rs
+++ b/src/install/PackageManager.rs
@@ -452,7 +452,7 @@ pub struct PackageManager {
     pub(crate) wrote_package_json: bool,
 
     // pnpm migration: what it moved into the cached root package.json. The file is only written along with the
-    // migrated lockfile (package_json_write_back::record_migrated_root); loads that are never saved leave it alone.
+    // migrated lockfile (package_json_write_back::write_migrated_root); loads that are never saved leave it alone.
     pub(crate) migrated_package_json_moves: Vec<&'static str>,
 
     // bun add: catalog references decided per target and the root entries they need; see add_catalog.rs
diff --git a/src/install/PackageManager/install_with_manager.rs b/src/install/PackageManager/install_with_manager.rs
index 1075139b9143..db9210636e8f 100644
--- a/src/install/PackageManager/install_with_manager.rs
+++ b/src/install/PackageManager/install_with_manager.rs
@@ -924,7 +924,7 @@ pub fn install_with_manager(
                 || manager.options.enable.force_save_lockfile()));
 
     if should_save_lockfile {
-        super::package_json_write_back::record_migrated_root(manager);
+        super::package_json_write_back::write_migrated_root(manager);
         save_lockfile(
             manager,
             &load_result,
@@ -2209,7 +2209,7 @@ fn save_lockfile_only(
         packages_len_before_install,
     )?;
 
-    super::package_json_write_back::record_migrated_root(manager);
+    super::package_json_write_back::write_migrated_root(manager);
     let saved = save_lockfile(
         manager,
         load_result,
diff --git a/src/install/PackageManager/package_json_write_back.rs b/src/install/PackageManager/package_json_write_back.rs
index 31a326c1aff2..492903e9eb8f 100644
--- a/src/install/PackageManager/package_json_write_back.rs
+++ b/src/install/PackageManager/package_json_write_back.rs
@@ -58,35 +58,23 @@ fn root_target() -> WorkspaceTarget {
     }
 }
 
-/// The root package.json a pnpm migration edited in memory, announced once; `None` when the load did not touch it.
-/// Only the places that save the migrated lockfile ask, so a load that is never saved leaves the file alone.
-fn take_migrated_root(manager: &mut PackageManager) -> Option<WorkspaceTarget> {
+/// Writes the root package.json a pnpm migration edited in memory, just before the migrated lockfile is saved:
+/// a package.json that cannot take the moved fields fails the command before a lockfile that depends on them exists.
+/// Only the places that save the lockfile call this, so a load that is never saved leaves the file alone.
+pub fn write_migrated_root(manager: &mut PackageManager) {
     if manager.migrated_package_json_moves.is_empty() {
-        return None;
+        return;
     }
     let moved = core::mem::take(&mut manager.migrated_package_json_moves);
+    if !write_target(manager, &root_target()) {
+        Global::exit(1);
+    }
     if !manager.options.log_level.is_silent() {
         bun_core::pretty_errorln!(
             "<d>copied {} in <r><green>package.json<r>",
             moved.join(", ")
         );
     }
-    Some(root_target())
-}
-
-/// `install_with_manager`: written by `flush` along with the command's other package.json edits.
-pub(crate) fn record_migrated_root(manager: &mut PackageManager) {
-    if let Some(root) = take_migrated_root(manager) {
-        record(manager, root, false);
-    }
-}
-
-/// `bun pm migrate` / `bun pm trust`: they save the lockfile regardless of `--dry-run` / `--no-save` (which disable
-/// `flush`), so its package.json is written directly; a write failure is reported, not fatal (the lockfile is saved).
-pub fn write_migrated_root(manager: &mut PackageManager) {
-    if let Some(root) = take_migrated_root(manager) {
-        let _ = write_target(manager, &root);
-    }
 }
 
 /// Phase 1 (before bun.lock is saved): write the resolved versions into the edited package.json entries and re-derive bun.lock's declared columns from them.
diff --git a/src/install/dependency.rs b/src/install/dependency.rs
index caf4ec43b206..575fe41046fb 100644
--- a/src/install/dependency.rs
+++ b/src/install/dependency.rs
@@ -595,7 +595,7 @@ pub(crate) fn is_safe_lockfile_package_name(name: &[u8]) -> bool {
 /// Name for a package whose package.json has none: the last component of where it came from
 /// (`../pkgs/foo`, `https://host/foo.tgz?token=x`, `https://host/user/foo` all become `foo`).
 pub(crate) fn fallback_package_name(location: &[u8]) -> &[u8] {
-    let without_query = location.split(|&b| b == b'?').next().unwrap_or(location);
+    let without_query = strings::split(location, b"?").next().unwrap_or(location);
     let basename = bun_paths::basename(without_query);
     let name = strings::without_suffix_comptime(
         strings::without_suffix_comptime(basename, b".tgz"),
diff --git a/src/install/pnpm.rs b/src/install/pnpm.rs
index 81c00250ce0e..b546829911ce 100644
--- a/src/install/pnpm.rs
+++ b/src/install/pnpm.rs
@@ -2430,7 +2430,7 @@ pub(crate) fn migrate_pnpm_workspace_config(
 }
 
 /// Copies the settings pnpm keeps in `pnpm-workspace.yaml` and the `pnpm` key into the fields bun reads, in the
-/// cached root package.json; `package_json_write_back::record_migrated_root` writes it if the lockfile is saved.
+/// cached root package.json; `package_json_write_back::write_migrated_root` writes it if the lockfile is saved.
 fn update_package_json_after_migration(
     lockfile: Option<&mut Lockfile>,
     manager: &mut PackageManager,
diff --git a/src/runtime/cli/bunx_command.rs b/src/runtime/cli/bunx_command.rs
index f08c4ab29700..e5ea9957eee0 100644
--- a/src/runtime/cli/bunx_command.rs
+++ b/src/runtime/cli/bunx_command.rs
@@ -33,42 +33,35 @@ bun_output::declare_scope!(bunx, visible);
 
 pub(crate) struct BunxCommand;
 
-/// `flock` on `<bunx cache dir>/.bunx-lock`: exclusive while installing into the shared directory,
-/// probed shared before running out of it. CLOEXEC, so exec'ing the target releases it too.
+/// `flock` on `<bunx cache dir>.lock`, next to (not inside) the shared directory so the stale-tree cleanup
+/// never unlinks it: exclusive while installing, probed shared before running out of it. CLOEXEC, so exec'ing
+/// the target releases it too.
 struct InstallLock(bun_sys::File);
 
 impl InstallLock {
     /// Zero-padded seconds, fixed width so a rewrite never has to truncate.
     const STAMP_LEN: usize = 20;
 
-    /// `None` when the lock cannot be taken, or is held elsewhere and `nonblocking`.
+    /// `None` when the lock cannot be taken (including a lock path that is a symlink or, on POSIX, not ours),
+    /// or is held elsewhere and `nonblocking`.
     fn acquire(
         bunx_cache_dir: &[u8],
         mode: bun_sys::FileLockMode,
         nonblocking: bool,
     ) -> Option<Self> {
-        let sep = bun_paths::SEP_STR.as_bytes();
-        let path = bun_core::ZBox::from_bytes([bunx_cache_dir, sep, b".bunx-lock"].concat());
-        for _ in 0..5 {
-            let fd = bun_sys::openat(Fd::cwd(), &path, O::CREAT | O::RDWR | O::CLOEXEC, 0o600);
-            let file = bun_sys::File::from_fd(fd.ok()?);
-            if !bun_sys::flock(file.fd(), mode, nonblocking).ok()? {
+        let path = bun_core::ZBox::from_bytes([bunx_cache_dir, b".lock"].concat());
+        let flags = O::CREAT | O::RDWR | O::CLOEXEC | O::NOFOLLOW;
+        let file = bun_sys::File::from_fd(bun_sys::openat(Fd::cwd(), &path, flags, 0o600).ok()?);
+        #[cfg(unix)]
+        {
+            let st = bun_sys::fstat(file.fd()).ok()?;
+            if (st.st_mode & libc::S_IFMT) != libc::S_IFREG || st.st_uid != bun_sys::c::getuid() {
                 return None;
             }
-            // The stale-tree cleanup deletes the lock file with the directory, and a lock on an
-            // unlinked file guards nothing: keep it only if the path still names the file locked.
-            let Ok(probe) = bun_sys::openat(Fd::cwd(), &path, O::RDONLY | O::CLOEXEC, 0) else {
-                continue;
-            };
-            let probe = bun_sys::File::from_fd(probe);
-            if let (Ok(held), Ok(at_path)) = (bun_sys::fstat(file.fd()), bun_sys::fstat(probe.fd()))
-            {
-                if held.st_ino == at_path.st_ino && held.st_dev == at_path.st_dev {
-                    return Some(Self(file));
-                }
-            }
         }
-        None
+        bun_sys::flock(file.fd(), mode, nonblocking)
+            .ok()?
+            .then_some(Self(file))
     }
 
     /// Whether another `bun x` is installing into `bunx_cache_dir` right now (its tree is partial).
diff --git a/src/runtime/cli/package_manager_command.rs b/src/runtime/cli/package_manager_command.rs
index 0c15f7e2f30a..7faf4d0c74cb 100644
--- a/src/runtime/cli/package_manager_command.rs
+++ b/src/runtime/cli/package_manager_command.rs
@@ -779,6 +779,7 @@ Learn more about these at <magenta>https://bun.com/docs/cli/pm<r>.\n";
                 Global::exit(1);
             }
             Self::handle_load_lockfile_errors(&load_lockfile, log_level);
+            package_json_write_back::write_migrated_root(pm);
             // Reshaped for borrowck — `save_to_disk` needs
             // `&mut Lockfile` (self) and `&LoadResult` simultaneously, but
             // `LoadResultOk.lockfile` already holds the only `&mut` into the
@@ -794,7 +795,6 @@ Learn more about these at <magenta>https://bun.com/docs/cli/pm<r>.\n";
             unsafe {
                 (*lf).save_to_disk(&load_lockfile, &(*pm_raw).options);
             }
-            package_json_write_back::write_migrated_root(pm);
             Global::exit(0);
         } else if strings::eql_comptime(subcommand, b"version") {
             let positionals: &[&[u8]] = pm.options.positionals;
diff --git a/src/runtime/cli/pm_licenses_command.rs b/src/runtime/cli/pm_licenses_command.rs
index 53d339ffce3e..30c88183cd36 100644
--- a/src/runtime/cli/pm_licenses_command.rs
+++ b/src/runtime/cli/pm_licenses_command.rs
@@ -730,7 +730,7 @@ fn print_text(entries: &[Entry], long: bool, checked: usize, summary: bool) {
             bun_core::pretty!(
                 "<d>{}<r> {}<d>@{}<r>",
                 if last { "└──" } else { "├──" },
-                BStr::new(&entry.name),
+                bun_core::fmt::escape_control_chars(&entry.name),
                 bun_core::fmt::for_terminal(BStr::new(&entry.version))
             );
             if entry.dev_only {
diff --git a/src/runtime/cli/why_command.rs b/src/runtime/cli/why_command.rs
index 72b97590059b..c068c2eaf058 100644
--- a/src/runtime/cli/why_command.rs
+++ b/src/runtime/cli/why_command.rs
@@ -476,7 +476,7 @@ impl WhyCommand {
             let target_name = pkg_names[target_version.pkg_id as usize].slice(string_bytes);
             bun_core::prettyln!(
                 "<b>{}@{}<r>",
-                BStr::new(target_name),
+                escape_control_chars(target_name),
                 for_terminal(BStr::new(&target_version.version))
             );
 
diff --git a/test/cli/install/migration/pnpm-lock-migration.test.ts b/test/cli/install/migration/pnpm-lock-migration.test.ts
index 3f53ce13e2f6..45198bf82ba2 100644
--- a/test/cli/install/migration/pnpm-lock-migration.test.ts
+++ b/test/cli/install/migration/pnpm-lock-migration.test.ts
@@ -671,11 +671,20 @@ importers:
     });
     fs.chmodSync(join(dir, "package.json"), 0o444);
 
-    // The migrated package.json is written with the command's other package.json edits, after the lockfile.
-    const { stderr, exitCode } = await runBun(dir, "install");
+    // The migrated package.json is written just before the lockfile, so nothing is saved that depends on it.
+    let { stderr, exitCode } = await runBun(dir, "install");
     expect(stderr).toContain("error: failed to write package.json: EACCES");
+    expect(stderr).not.toContain("copied pnpm");
     expect(exitCode).toBe(1);
-
     expect(fs.readFileSync(join(dir, "package.json"), "utf8")).toBe(original);
+    expect(fs.existsSync(join(dir, "bun.lock"))).toBe(false);
+
+    // Once it is writable again the same install completes the move.
+    fs.chmodSync(join(dir, "package.json"), 0o644);
+    ({ stderr, exitCode } = await runBun(dir, "install"));
+    expect(stderr).toContain(movedWorkspaces);
+    expect(exitCode).toBe(0);
+    expect(readPackageJson(dir).workspaces).toEqual(["packages/*"]);
+    await versionOfAResolvedFromB(dir);
   });
 });
diff --git a/test/cli/install/npmrc.test.ts b/test/cli/install/npmrc.test.ts
index 3e4068ed5ddd..95430e349409 100644
--- a/test/cli/install/npmrc.test.ts
+++ b/test/cli/install/npmrc.test.ts
@@ -263,6 +263,29 @@ registry = http://localhost:${registry.port}/
       expect(result).toEqual(usesRegistry(1));
     });
 
+    // npm has no user config at all when `userconfig` names a missing file; it does not go back to ~/.npmrc.
+    it.concurrent("does not fall back to $HOME/.npmrc when $NPM_CONFIG_USERCONFIG does not exist", async () => {
+      using dir = tempDir("npmrc-userconfig-missing", { ...pkg, "home/.npmrc": npmrc(1) });
+      const result = await publishDryRun(String(dir), {
+        NPM_CONFIG_USERCONFIG: join(String(dir), "elsewhere", "missing.npmrc"),
+      });
+      expect(result.stderr).toContain("missing authentication");
+      expect(result.exitCode).toBe(1);
+    });
+
+    it.concurrent("resolves a relative $NPM_CONFIG_USERCONFIG against the directory bun was started in", async () => {
+      using dir = tempDir("npmrc-userconfig-relative", {
+        "package.json": JSON.stringify({ name: "root", private: true, workspaces: ["pkg"] }),
+        ...pkg,
+        "ci.npmrc": npmrc(1),
+        "pkg/ci.npmrc": npmrc(2),
+        "home/.npmrc": npmrc(3),
+      });
+      // `publish` runs from the workspace member `pkg/`.
+      const result = await publishDryRun(String(dir), { NPM_CONFIG_USERCONFIG: "ci.npmrc" });
+      expect(result).toEqual(usesRegistry(2));
+    });
+
     it.concurrent("the project .npmrc still overrides $NPM_CONFIG_USERCONFIG", async () => {
       using dir = tempDir("npmrc-userconfig-project", {
         ...pkg,

From b99be10d2a55d99157d69f7a8bca55ed283e6aa5 Mon Sep 17 00:00:00 2001
From: Jarred Sumner <jarred@jarredsumner.com>
Date: Mon, 17 Aug 2026 08:33:50 +0000
Subject: [PATCH 258/258] review: pm migrate on a read-only package.json fails
 before bun.lock too (test), mordant findings (dependency_buf naming, one
 tag->name helper, prune init without bare bools)

---
 src/install/lockfile.rs                       |  6 +-
 src/install/prune.rs                          | 23 +++++--
 src/install/update_transitive.rs              | 27 ++++----
 .../install/migration/pnpm-lock-v9.test.ts    | 61 +++++++++----------
 4 files changed, 66 insertions(+), 51 deletions(-)

diff --git a/src/install/lockfile.rs b/src/install/lockfile.rs
index 95028009c4e4..4a3e2cc0f08c 100644
--- a/src/install/lockfile.rs
+++ b/src/install/lockfile.rs
@@ -3138,12 +3138,12 @@ impl Lockfile {
         Ok(digest)
     }
 
-    /// `version_buf` is what `version`'s tag strings were parsed against (auto-install passes a package.json's).
+    /// `dependency_buf` is what `version`'s tag strings were parsed against (auto-install passes a package.json's).
     pub(crate) fn resolve_package_from_name_and_version(
         &self,
         package_name: &[u8],
         version: &DependencyVersion,
-        version_buf: &[u8],
+        dependency_buf: &[u8],
     ) -> Option<PackageID> {
         let name_hash = SemverStringBuilder::string_hash(package_name);
         let entry = self.package_index.get(&name_hash)?;
@@ -3159,7 +3159,7 @@ impl Lockfile {
                 // folder/symlink deps share the name index with other variants.
                 let satisfies = |resolution: &Resolution| -> bool {
                     resolution.tag == ResolutionTag::Npm
-                        && npm_group.satisfies(resolution.npm().version, version_buf, buf)
+                        && npm_group.satisfies(resolution.npm().version, dependency_buf, buf)
                 };
                 match entry {
                     PackageIndexEntry::Id(id) => {
diff --git a/src/install/prune.rs b/src/install/prune.rs
index 24576718f0e3..121b1eeab0f0 100644
--- a/src/install/prune.rs
+++ b/src/install/prune.rs
@@ -663,7 +663,8 @@ enum Installed {
 }
 
 impl<'a> HoistedTree<'a> {
-    fn init(lockfile: &'a Lockfile, quiet: bool, filtered: bool) -> HoistedTree<'a> {
+    /// `quiet` and `filtered` start off; callers set them with struct update.
+    fn init(lockfile: &'a Lockfile) -> HoistedTree<'a> {
         let trees = lockfile.buffers.trees.as_slice();
         let deps = lockfile.buffers.dependencies.as_slice();
         let resolutions = lockfile.buffers.resolutions.as_slice();
@@ -712,8 +713,8 @@ impl<'a> HoistedTree<'a> {
             folders,
             paths,
             expected,
-            quiet,
-            filtered,
+            quiet: false,
+            filtered: false,
             kept_mismatched: Cell::new(false),
             verified: RefCell::new(verified),
         }
@@ -929,7 +930,11 @@ fn plan_hoisted(
         || !features.optional_dependencies
         || !features.peer_dependencies;
     let lockfile: &Lockfile = &manager.lockfile;
-    let hoisted = HoistedTree::init(lockfile, quiet, filtered);
+    let hoisted = HoistedTree {
+        quiet,
+        filtered,
+        ..HoistedTree::init(lockfile)
+    };
     let buf = lockfile.buffers.string_bytes.as_slice();
     let deps = lockfile.buffers.dependencies.as_slice();
     let trees = lockfile.buffers.trees.as_slice();
@@ -1113,8 +1118,14 @@ pub(crate) fn remove_collapsed_copies(manager: &PackageManager, before: &Lockfil
         return;
     }
     let quiet = manager.options.log_level == LogLevel::Silent;
-    let old = HoistedTree::init(before, true, false);
-    let new = HoistedTree::init(after, quiet, false);
+    let old = HoistedTree {
+        quiet: true,
+        ..HoistedTree::init(before)
+    };
+    let new = HoistedTree {
+        quiet,
+        ..HoistedTree::init(after)
+    };
     let targets = manager.filtered_link_targets.as_ref();
     let selected: Option<Vec<PackageID>> = targets.map(|targets| targets.package_ids(before));
     let importers = selected.as_ref().map(|_| tree_importers(before));
diff --git a/src/install/update_transitive.rs b/src/install/update_transitive.rs
index ca9dff7f38cb..52dfab335977 100644
--- a/src/install/update_transitive.rs
+++ b/src/install/update_transitive.rs
@@ -1145,10 +1145,8 @@ fn plan_edges(
             let Some(version) = dedupe::effective_version(lockfile, dep_id, dep) else {
                 continue;
             };
-            let names = match version.tag {
-                DependencyVersionTag::Npm => version.npm().name,
-                DependencyVersionTag::DistTag => version.dist_tag().name,
-                _ => continue,
+            let Some(names) = registry_name(&version) else {
+                continue;
             };
             if !names.eql(pkg_names[inst.pkg_id as usize], buf, buf) {
                 continue;
@@ -1453,17 +1451,15 @@ fn edges_on_instances(
                 else {
                     continue;
                 };
-                let names = match version.tag {
-                    DependencyVersionTag::Npm => version.npm().name,
-                    DependencyVersionTag::DistTag => version.dist_tag().name,
-                    _ => continue,
+                let Some(names) = registry_name(&version) else {
+                    continue;
                 };
                 let row_hash = Semver::string::Builder::string_hash(names.slice(buf));
-                let locked_id = locked_resolutions[row] as usize;
-                let res_slot = slot_of.get(locked_id).copied().unwrap_or(u32::MAX);
+                let locked_pkg_id = locked_resolutions[row] as usize;
+                let res_slot = slot_of.get(locked_pkg_id).copied().unwrap_or(u32::MAX);
                 // An optional row the loaded lockfile left unresolved snapshots as invalid.
                 let locked = pkg_res
-                    .get(locked_id)
+                    .get(locked_pkg_id)
                     .filter(|res| res.tag == ResolutionTag::Npm)
                     .map(|res| res.npm().version);
                 for (i, inst) in instances.iter().enumerate() {
@@ -1703,3 +1699,12 @@ fn later_than(
         .filter(|latest| latest.order(v, manifest_buf, manifest_buf) == Ordering::Greater);
     latest.map_or_else(Box::default, |latest| text(latest.fmt(manifest_buf)))
 }
+
+/// The name a registry row asks for (its alias target); other kinds have none.
+fn registry_name(version: &dependency::Version) -> Option<Semver::String> {
+    match version.tag {
+        DependencyVersionTag::Npm => Some(version.npm().name),
+        DependencyVersionTag::DistTag => Some(version.dist_tag().name),
+        _ => None,
+    }
+}
diff --git a/test/cli/install/migration/pnpm-lock-v9.test.ts b/test/cli/install/migration/pnpm-lock-v9.test.ts
index 1561685e47b2..4ccb28173d5b 100644
--- a/test/cli/install/migration/pnpm-lock-v9.test.ts
+++ b/test/cli/install/migration/pnpm-lock-v9.test.ts
@@ -3594,38 +3594,37 @@ catalog:
       expect(existsSync(join(String(dir), "bun.lock"))).toBe(false);
     });
 
-    // A read-only checkout still gets its bun.lock; the fields that could not be moved are named.
-    test.concurrent.skipIf(isWindows)("a read-only package.json keeps its fields and is reported", async () => {
-      const packageJson = JSON.stringify({ name: "overrides-read-only", pnpm: { overrides: { plain: "1.0.0" } } });
-      using dir = tempDir("pnpm-v9-overrides-read-only", {
-        "package.json": packageJson,
-        "pnpm-lock.yaml": overridesLockfile("  plain: 1.0.0"),
-      });
-      chmodSync(join(String(dir), "package.json"), 0o444);
-      using unprivileged = unprivilegedSpawnOptions(String(dir));
-
-      await using proc = Bun.spawn({
-        cmd: [bunExe(), "pm", "migrate"],
-        cwd: String(dir),
-        env: { ...bunEnv, BUN_INSTALL_CACHE_DIR: join(String(dir), ".bun-cache") },
-        stdout: "pipe",
-        stderr: "pipe",
-        ...unprivileged,
-      });
-      const [stdout, stderr, exitCode] = await Promise.all([proc.stdout.text(), proc.stderr.text(), proc.exited]);
+    // The copied fields are written before bun.lock, so a read-only package.json fails the migration outright
+    // rather than leaving a bun.lock whose overrides the next install cannot see in package.json.
+    test.concurrent.skipIf(isWindows)(
+      "a read-only package.json fails the migration before bun.lock is written",
+      async () => {
+        const packageJson = JSON.stringify({ name: "overrides-read-only", pnpm: { overrides: { plain: "1.0.0" } } });
+        using dir = tempDir("pnpm-v9-overrides-read-only", {
+          "package.json": packageJson,
+          "pnpm-lock.yaml": overridesLockfile("  plain: 1.0.0"),
+        });
+        chmodSync(join(String(dir), "package.json"), 0o444);
+        using unprivileged = unprivilegedSpawnOptions(String(dir));
+
+        await using proc = Bun.spawn({
+          cmd: [bunExe(), "pm", "migrate"],
+          cwd: String(dir),
+          env: { ...bunEnv, BUN_INSTALL_CACHE_DIR: join(String(dir), ".bun-cache") },
+          stdout: "pipe",
+          stderr: "pipe",
+          ...unprivileged,
+        });
+        const [stdout, stderr, exitCode] = await Promise.all([proc.stdout.text(), proc.stderr.text(), proc.exited]);
 
-      expect(stderr).toContain("failed to write package.json");
-      expect(stderr).toContain("EACCES");
-      expect(stderr).toContain("migrated lockfile from pnpm-lock.yaml");
-      expect(stdout).toBe("");
-      expect(exitCode).toBe(0);
-      expect(await Bun.file(join(String(dir), "package.json")).text()).toBe(packageJson);
-      expect(overridesSection(await bunLockOf(String(dir)))).toMatchInlineSnapshot(`
-        "  "overrides": {
-            "plain": "1.0.0",
-          },"
-      `);
-    });
+        expect(stderr).toContain("error: failed to write package.json: EACCES");
+        expect(stderr).not.toContain("copied");
+        expect(stdout).toBe("");
+        expect(exitCode).toBe(1);
+        expect(await Bun.file(join(String(dir), "package.json")).text()).toBe(packageJson);
+        expect(existsSync(join(String(dir), "bun.lock"))).toBe(false);
+      },
+    );
   });
 
   // The settings moved out of `pnpm` / pnpm-workspace.yaml are edited into package.json in memory while the