chore(cli): clean up dependencies, drop tmp, pin bun 1.4.3

[tuler]

Cleans up apps/cli/package.json, pins Bun 1.4.3, and replaces tmp so the npm bundle works with that version. There is one commit per change.

1. Remove unused packages

These are never imported in src/ or tests/:

• dependencies: lookpath, progress-stream, @inquirer/type (already pulled in by @inquirer/core, input, select and confirm)
• devDependencies: @types/inquirer, @types/node-fetch, @types/prompts, @types/progress-stream, tslib (only needed when tsc emits with importHelpers; here tsc runs with noEmit)

commander stays because @commander-js/extra-typings requires it as a peer dependency.

2. Move bundled runtime packages to devDependencies

build.ts calls Bun.build without external or packages: "external", so every package is bundled into dist/index.js and into the compiled binaries. I checked the built bundle: its only imports are Node built-ins, and nothing reads node_modules at runtime. Listing these packages as dependencies made every npm i @cartesi/cli download viem, execa, listr2 and the rest, even though they are never loaded. Homebrew users get the compiled binaries, so they are not affected.

Trade-offs:

• Security reports: npm audit run by people who install the CLI no longer reports vulnerabilities in these packages. Fixes reach users only when a new version is released (true in practice already, since the code is bundled).
• Externals: if a package is ever marked external in build.ts, it has to go back into dependencies.

3. Drop exports and types

The package is a CLI exposed through bin, not a library. dist/index.d.ts is never generated, and nothing in the monorepo imports @cartesi/cli.

4. Pin Bun 1.4.3

packageManager goes to bun@1.4.3, which the CI workflows read through setup-bun. @types/bun and CLAUDE.md are updated to match.

5. Replace tmp with node:fs

Bun 1.4.1 and later, including 1.4.3, break the CommonJS tmp package when bundling to ESM. The bundler inlines the module but keeps a reference to an exports_tmp object it never defines, so dist/index.js throws ReferenceError: exports_tmp is not defined at startup (minified: Kj is not defined / sq is not defined). This affects only the ESM bundle, which is the npm package. The compiled binaries use bytecode: true, so their output is CommonJS and works. The integration tests run node dist/index.js, so they would have failed with the pin alone.

In production code, tmp was only used for one path, the buildx --metadata-file:

• That file now lives in an mkdtemp directory, which is removed in a finally once the metadata has been read.
• Before, tmpNameSync() only produced a name, and setGracefulCleanup() does not delete files that tmp did not create. So the metadata file was never deleted, and that call is now gone.
• Tests use mkdtempSync and rmSync instead, like tests/unit/commands/refund.test.ts and others already do.

A changeset (@cartesi/cli patch) is included.

Testing

Everything below used Bun 1.4.3:

• bun install --frozen-lockfile, bun run lint, tsc and the unit tests (335 pass, 0 fail) all pass.
• build.ts: node dist/index.js --version, bun dist/index.js --version and bin/cartesi-linux-x64 --version all print 2.0.0-alpha.38. The bundle imports only Node built-ins.
• buildImage: no Docker daemon was available, so I ran build() against a fake docker on PATH:
  • the metadata file is written in a fresh cartesi-buildx-* directory
  • its digest reaches docker image inspect
  • the directory is removed both when buildx succeeds and when it fails
• The Docker integration tests were not run locally. CI covers them.

🤖 Generated with Claude Code

https://claude.ai/code/session_01XGgBftPRVbzZUyL3gjvJaj

[changeset-bot]

🦋 Changeset detected

Latest commit: 12454c9

The changes in this PR will be included in the next version bump.

This PR includes changesets to release 1 package

Name	Type
@cartesi/cli	Patch

Not sure what this means? Click here to learn what changesets are.

Click here if you're a maintainer who wants to add another changeset to this PR

[github-actions]

Coverage Report

Status	Category	Percentage	Covered / Total
🟢	Lines	91% (🎯 0%)	12250 / 13462
🔵	Statements	91%	12250 / 13462
🔵	Functions	81.31%	274 / 337
🔵	Branches	0%	0 / 0

📁 File Coverage (20 files)

File	Lines	Statements	Functions	Branches	Uncovered Lines
apps/cli/src/base.ts	🔴 39.33%	🔴 39.33%	🟡 64.71%	🔴 0%	49, 70-71, 79-83, 88, 102, ...
apps/cli/src/builder/directory.ts	🟢 100%	🟢 100%	🟢 100%	🔴 0%	-
apps/cli/src/builder/docker.ts	🟢 87.12%	🟢 87.12%	🟡 66.67%	🔴 0%	77-79, 81, 114-116, 174-183
apps/cli/src/builder/empty.ts	🟢 100%	🟢 100%	🟢 100%	🔴 0%	-
apps/cli/src/builder/none.ts	🟢 100%	🟢 100%	🟢 100%	🔴 0%	-
apps/cli/src/builder/nvram.ts	🟢 96.88%	🟢 96.88%	🟢 100%	🔴 0%	27
apps/cli/src/builder/tar.ts	🟢 100%	🟢 100%	🟢 100%	🔴 0%	-
apps/cli/src/commands/foreclose.ts	🔴 49.09%	🔴 49.09%	🔴 50%	🔴 0%	69, 91-145
apps/cli/src/commands/refund.ts	🔴 38.2%	🔴 38.2%	🟡 66.67%	🔴 0%	55-109
apps/cli/src/commands/withdraw.ts	🔴 46.58%	🔴 46.58%	🟡 73.33%	🔴 0%	95-123, 277-278, 301-356, 3...
apps/cli/src/compose/anvil.ts	🟡 79.25%	🟡 79.25%	🟢 100%	🔴 0%	19-29
apps/cli/src/compose/builder.ts	🟢 99.79%	🟢 99.79%	🟢 100%	🔴 0%	228
apps/cli/src/compose/bundler.ts	🔴 4.82%	🔴 4.82%	🔴 0%	🔴 0%	8-40, 44-75, 79-92
apps/cli/src/compose/common.ts	🟢 100%	🟢 100%	🟢 100%	🔴 0%	-
apps/cli/src/compose/database.ts	🟢 100%	🟢 100%	🟢 100%	🔴 0%	-
apps/cli/src/compose/explorer.ts	🔴 6.67%	🔴 6.67%	🔴 0%	🔴 0%	10-38, 43-55, 59-72
apps/cli/src/compose/node.ts	🟢 100%	🟢 100%	🟢 100%	🔴 0%	-
apps/cli/src/compose/passkey.ts	🔴 8.33%	🔴 8.33%	🔴 0%	🔴 0%	9-18, 23-42, 46-59
apps/cli/src/compose/paymaster.ts	🔴 7.69%	🔴 7.69%	🔴 0%	🔴 0%	8-21, 25-44, 48-61
apps/cli/src/compose/proxy.ts	🟢 100%	🟢 100%	🟢 100%	🔴 0%	-

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	@​types/​bun@​1.4.2 ⏵ 1.4.3				-3

View full report