Global node_modules binaries are preferred to local

[iiroj]

Hello,

I recently released lint-staged@16.3.0 and replaced nano-spawn with tinyexec. An issue arose where it looks like the node_modules/.bin resolution of tinyexec prefers globally-installed executables to locally installed ones: lint-staged/lint-staged#1736

Both the npx and nano-spawn have an algorithm which prefers a locally installed node_modules/.bin/eslint to a globally installed one (eg. via npm install --global eslint), so I would have assumed tinyexec works the same way.

I believe the issue is that tinyexec adds the node_modules/.bin/ entries to the end of the current PATH, instead of in front. For example, when running tinyexec my process.env.PATH looks like this when split from ::

/opt/homebrew/bin # npm install --global goes here
/usr/local/bin
/usr/bin
/bin
/usr/sbin
/sbin
/Users/iiroj/Documents/Git/lint-staged/node_modules/.bin # npm install goes here
/Users/iiroj/Documents/Git/node_modules/.bin
/Users/iiroj/Documents/node_modules/.bin
/Users/iiroj/node_modules/.bin
/Users/node_modules/.bin
/node_modules/.bin

To work like npx, it should probably look like this instead:

/Users/iiroj/Documents/Git/lint-staged/node_modules/.bin # npm install goes here
/Users/iiroj/Documents/Git/node_modules/.bin
/Users/iiroj/Documents/node_modules/.bin
/Users/iiroj/node_modules/.bin
/Users/node_modules/.bin
/node_modules/.bin
/opt/homebrew/bin # npm install --global goes here
/usr/local/bin
/usr/bin
/bin
/usr/sbin
/sbin

Would you consider changing the order directly in tinyexec?

[43081j]

you are right, we should just add the node_modules paths up front so that have higher priority.

PRs welcome or i can try get to it this week 👍

its basically this function that needs to change:

tinyexec/src/env.ts

Lines 37 to 50 in b9aa8d3

	function addNodeBinToPath(cwd: string, path: EnvPathInfo): EnvPathInfo {
	const parts = path.value.split(pathDelimiter);
	let currentPath = cwd;
	let lastPath: string;
	do {
	parts.push(resolvePath(currentPath, 'node_modules', '.bin'));
	lastPath = currentPath;
	currentPath = dirname(currentPath);
	} while (currentPath !== lastPath);
	return {key: path.key, value: parts.join(pathDelimiter)};
	}

[iiroj]

Sure, I opened PR #87 but since this is my first one, I'm not sure if it adheres to all the standards.

[iiroj]

@43081j any updates regarding this?

[43081j]

it is a bug, so i've released it in 1.0.3 👍