[Kewe63]

Description

• Replace the undeclared rimraf executable with Bun's built-in node:fs rmSync API.
• Keep recursive, force-enabled removal for both node_modules and src/typechain.
• Avoid adding a cleanup dependency or changing the E2E lockfile.

Motivation and Context

The E2E package exposes bun run clean, but its script invoked an executable absent from both the package manifest and lockfile. A clean install therefore left src/typechain intact and exited 127 with rimraf: command not found unless the developer happened to have a global command.

The package already requires Bun to run its scripts. Using Bun's built-in filesystem API makes the clean lifecycle self-contained and cross-platform without introducing another dependency.

Fixes #255.

An earlier revision declared rimraf@5.0.1; the current revision removes that dependency and its lockfile changes, so the prior Socket package alert no longer applies to the final diff.

How Has This Been Tested?

• Pre-fix clean boundary — exited 127 with rimraf: command not found and left src/typechain present.
• Disposable clean package with the final manifest and unchanged lockfile:
  • bun install --frozen-lockfile succeeded;
  • postinstall generated 13 TypeChain typings;
  • bun run clean exited 0 and removed both node_modules and src/typechain;
  • a second clean run also exited 0, proving missing targets are handled idempotently;
  • a second frozen install succeeded and regenerated the typings.
• Direct built-in cleanup control removed both target directories successfully.
• git diff --check — passed.
• Independent code review — passed with no blocking correctness, portability, security, quoting, scope, or test findings; the final lockfile is byte-identical to canary.
• The network/environment-dependent Canary E2E suite was not run; it requires a running deployment and populated environment and does not exercise clean-command resolution.

Types of changes (remove all unchecked types)

• Bug fix (non-breaking change which fixes an issue)

Checklist:

• I assessed documentation impact; no documentation update is required.
• I assessed deployment-script impact; no deployment script is changed.
• I verified the destructive clean lifecycle in an isolated disposable package, not the working checkout.

[socket-security]

No dependency changes detected. Learn more about Socket for GitHub.

👍 No dependency changes detected in pull request