[BUG] npm i --production deletes duplicate .bin symlinks

Is there an existing issue for this?

• I have searched the existing issues

This issue exists in the latest npm version

• I am using the latest npm

Current Behavior

package.json below:

{
  "dependencies": {
    "egg-ts-helper": "1.30.3"
  },
  "devDependencies": {
    "egg-bin": "5.1.1"
  }
}

installation command:

$ npm i --production

I can't find the egg-ts-helper bin command ets in the node_modules/.bin folder.

This is because egg-bin also provides the ets command, when installation runs in production mode, npm will remove all the devDependencies paths in the node_modules folder, which includes node_modules/.bin/ets, the symlink points toegg-bin/bin/ets.js. See arborist reify here.

Expected Behavior

When running in production mode, and there are duplicated bins provided by both dependencies and devDependencies, npm should keep the dependencies bin.

In the case present above, node_modules/.bin/ets should points to egg-ts-helper/dist/bin.js.

Steps To Reproduce

1. Create a blank folder with package.json provided above;
2. Install the latest version of npm;
3. Run npm i --production;
4. Run ls -la node_modules/.bin;
5. The result should contain ets symlink which points to egg-ts-helper/dist/bin.js.

Environment

• npm: 8.13.1
• Node.js: v14.19.1
• OS Name: macOS Big Sur(version: 11.2.3)
• System Model Name:MacBook Pro (16-inch, 2019)
• npm config: the default npm config

Reproduce the issue with the package.json and npm i --production steps, then read arborist/reify.js around the linked line 244. Trace how duplicate .bin symlinks are removed in production mode. Done means node_modules/.bin/ets remains and points to egg-ts-helper/dist/bin.js rather than the devDependency target.