Update binary scripts to avoid namespace collisions

[mydea]

We have to bin scripts currently in the monorepo:

• remix: sentry-upload-sourcemaps
• profiling-node: sentry-prune-profiler-binaries

To avoid possible namespace collisions, we should instead of this make these available on the root namespace with some argument. e.g. npx @sentry/remix --upload-sourcemaps.

[linear-code]

JS-2239

[s1gr1d]

npx looks for one matching the unscoped portion of the package name (e.g. remix for @sentry/remix). So we sadly cannot scope the script name in bin to the package name.

We can use npx --package=@sentry/remix sentry-upload-sourcemaps. npm installs @sentry/remix, finds the sentry-upload-sourcemaps bin, and runs it.
The --package= prefix is always needed for scoped packages when the bin name doesn't match the unscoped package name (like in our case). That's unavoidable with npm's design.


There is an old discussion around that: npm/npm#6418

npx docs: https://docs.npmjs.com/cli/v11/commands/npx
npm docs: https://docs.npmjs.com/cli/v11/configuring-npm/package-json#bin

[isaacs]

If the package only has a single binary (either by using "bin": "./some/path.js" or a single entry in an object, like "bin": {"sentry-upload-sourcemaps-cli": "./path/to/upload-cli.js"}), then the npx command will find the default appropriately without the --package command.

So, they'll still be installed in a global (possibly colliding) namespace, but the npx command can still find it based on a scoped package name.

[s1gr1d]

Yeah this is more about a "to be safe".

I also want to reference this blog post here: https://www.alxndrsn.com/2024-08-01-npx-binary-confusion/
Ideally, we get ownership over the npm package names.

[alxndrsn]

Hi folks, happy to help where I can.