isaacs / rimraf

A `rm -rf` util for nodejs
ISC License
5.66k stars 252 forks source link

`npx rimraf -g ./**/dist ./**/node_modules` first run seems to succeed but always gives "The system cannot find the path specified." and "WARN Local package.json exists, but node_modules missing, did you mean to install?" #304

Closed JasonKleban closed 6 months ago

JasonKleban commented 6 months ago

npx rimraf -g ./**/dist ./**/node_modules first run seems to succeed but always gives "The system cannot find the path specified." and "WARN Local package.json exists, but node_modules missing, did you mean to install?"

Second run doesn't emit those messages. I tried breaking that pattern into two in both orders, but no effective change.

Is it because of chains of symlinks between various nested dist & node_module folders? Is there a way to deal with this more elegantly without hurting complexity, performance, or platform agnosticism?

isaacs commented 6 months ago

It looks like npx is trying to use your locally-installed version of rimraf. But then you're using rimraf to delete itself.

Maybe you mean this? npx rimraf -g '*/**/dist' '*/**/node_modules' That would prevent removal of ./node_modules/rimraf or ./node_modules/rimraf/dist.

isaacs commented 6 months ago

(The relevant difference is the */ to make it only start searching one level down, not in the root itself, since ** can match the empty string.)

JasonKleban commented 6 months ago

Definitely relevant, thanks! The fact that it was succeeding anyway was throwing me off, but yeah, I do want to nuke everything. Using npx rimraf@latest -g ./**/dist ./**/node_modules @latest make sure to use the remote package instead of some random locally available one.

isaacs commented 6 months ago

Ah, yes, that's another way to ensure npm runs the rimraf from an external location. Still a bit risky, since it means you have an effective dependency on *, but rimraf is about as stable a library as one could hope for, at least in the bin interface.

JasonKleban commented 5 months ago

Ripe for a supply chain attack!