Reduce the file size of the @salesforce module

[RupertBarrow]

The largest module in the Salesforce sf cli is @salesforce.
When one observes the contents of the @salesforce module by size, the largest subdirectories are mostly plugins :

~/vendor/sf/cli $ du -ha --max-depth 1 /app/vendor/sf/cli/node_modules/@salesforce | sort -hr
26M     /app/vendor/sf/cli/node_modules/@salesforce
1.7M    /app/vendor/sf/cli/node_modules/@salesforce/plugin-deploy-retrieve
1.5M    /app/vendor/sf/cli/node_modules/@salesforce/plugin-packaging
1.4M    /app/vendor/sf/cli/node_modules/@salesforce/source-deploy-retrieve
1.4M    /app/vendor/sf/cli/node_modules/@salesforce/plugin-templates
1.4M    /app/vendor/sf/cli/node_modules/@salesforce/plugin-source
1.4M    /app/vendor/sf/cli/node_modules/@salesforce/plugin-org
1.4M    /app/vendor/sf/cli/node_modules/@salesforce/plugin-data
1.3M    /app/vendor/sf/cli/node_modules/@salesforce/plugin-trust
1.2M    /app/vendor/sf/cli/node_modules/@salesforce/templates
1.1M    /app/vendor/sf/cli/node_modules/@salesforce/plugin-user
1.1M    /app/vendor/sf/cli/node_modules/@salesforce/plugin-sobject
1.1M    /app/vendor/sf/cli/node_modules/@salesforce/plugin-settings
1.1M    /app/vendor/sf/cli/node_modules/@salesforce/plugin-auth
1.1M    /app/vendor/sf/cli/node_modules/@salesforce/plugin-apex
1.1M    /app/vendor/sf/cli/node_modules/@salesforce/core
996K    /app/vendor/sf/cli/node_modules/@salesforce/plugin-info
968K    /app/vendor/sf/cli/node_modules/@salesforce/plugin-telemetry
932K    /app/vendor/sf/cli/node_modules/@salesforce/plugin-limits
904K    /app/vendor/sf/cli/node_modules/@salesforce/plugin-schema
904K    /app/vendor/sf/cli/node_modules/@salesforce/plugin-marketplace
480K    /app/vendor/sf/cli/node_modules/@salesforce/telemetry
380K    /app/vendor/sf/cli/node_modules/@salesforce/packaging
372K    /app/vendor/sf/cli/node_modules/@salesforce/apex-node
280K    /app/vendor/sf/cli/node_modules/@salesforce/source-tracking
200K    /app/vendor/sf/cli/node_modules/@salesforce/sf-plugins-core
148K    /app/vendor/sf/cli/node_modules/@salesforce/ts-types
140K    /app/vendor/sf/cli/node_modules/@salesforce/kit
100K    /app/vendor/sf/cli/node_modules/@salesforce/schemas

In each of these plugins, you will find a npm-shrinkwrap.json file and an oclif.lock file. Together, these two files represent half the size of each plugin :

# npm-shrinkwrap.json
~/vendor/sfdx/cli $ ls -al /app/vendor/sfdx/cli/node_modules/@salesforce/plugin-*/npm*.json
-rwx------ 1 u33240 dyno 507305 Apr 19 18:16 /app/vendor/sfdx/cli/node_modules/@salesforce/plugin-apex/npm-shrinkwrap.json
-rwx------ 1 u33240 dyno 529231 Apr 19 18:16 /app/vendor/sfdx/cli/node_modules/@salesforce/plugin-auth/npm-shrinkwrap.json
-rwx------ 1 u33240 dyno 503980 Apr 19 18:16 /app/vendor/sfdx/cli/node_modules/@salesforce/plugin-data/npm-shrinkwrap.json
-rwx------ 1 u33240 dyno 552990 Apr 19 18:16 /app/vendor/sfdx/cli/node_modules/@salesforce/plugin-deploy-retrieve/npm-shrinkwrap.json
-rwx------ 1 u33240 dyno 517493 Apr 19 18:16 /app/vendor/sfdx/cli/node_modules/@salesforce/plugin-info/npm-shrinkwrap.json
-rwx------ 1 u33240 dyno 518677 Apr 19 18:16 /app/vendor/sfdx/cli/node_modules/@salesforce/plugin-limits/npm-shrinkwrap.json
-rwx------ 1 u33240 dyno 505963 Apr 19 18:16 /app/vendor/sfdx/cli/node_modules/@salesforce/plugin-marketplace/npm-shrinkwrap.json
-rwx------ 1 u33240 dyno 555772 Apr 19 18:16 /app/vendor/sfdx/cli/node_modules/@salesforce/plugin-org/npm-shrinkwrap.json
-rwx------ 1 u33240 dyno 522393 Apr 19 18:16 /app/vendor/sfdx/cli/node_modules/@salesforce/plugin-packaging/npm-shrinkwrap.json
-rwx------ 1 u33240 dyno 493815 Apr 19 18:16 /app/vendor/sfdx/cli/node_modules/@salesforce/plugin-schema/npm-shrinkwrap.json
-rwx------ 1 u33240 dyno 548185 Apr 19 18:16 /app/vendor/sfdx/cli/node_modules/@salesforce/plugin-settings/npm-shrinkwrap.json
-rwx------ 1 u33240 dyno 492614 Apr 19 18:16 /app/vendor/sfdx/cli/node_modules/@salesforce/plugin-sobject/npm-shrinkwrap.json
-rwx------ 1 u33240 dyno 557910 Apr 19 18:16 /app/vendor/sfdx/cli/node_modules/@salesforce/plugin-source/npm-shrinkwrap.json
-rwx------ 1 u33240 dyno 524625 Apr 19 18:16 /app/vendor/sfdx/cli/node_modules/@salesforce/plugin-telemetry/npm-shrinkwrap.json
-rwx------ 1 u33240 dyno 651766 Apr 19 18:16 /app/vendor/sfdx/cli/node_modules/@salesforce/plugin-templates/npm-shrinkwrap.json
-rwx------ 1 u33240 dyno 732737 Apr 19 18:16 /app/vendor/sfdx/cli/node_modules/@salesforce/plugin-trust/npm-shrinkwrap.json
-rwx------ 1 u33240 dyno 516714 Apr 19 18:16 /app/vendor/sfdx/cli/node_modules/@salesforce/plugin-user/npm-shrinkwrap.json

# oclif.lock
~/vendor/sfdx/cli $ ls -al /app/vendor/sfdx/cli/node_modules/@salesforce/plugin-*/*.lock   
-rwx------ 1 u33240 dyno 343362 Apr 19 18:16 /app/vendor/sfdx/cli/node_modules/@salesforce/plugin-apex/oclif.lock
-rwx------ 1 u33240 dyno 360114 Apr 19 18:16 /app/vendor/sfdx/cli/node_modules/@salesforce/plugin-auth/oclif.lock
-rwx------ 1 u33240 dyno 308885 Apr 19 18:16 /app/vendor/sfdx/cli/node_modules/@salesforce/plugin-data/oclif.lock
-rwx------ 1 u33240 dyno 374895 Apr 19 18:16 /app/vendor/sfdx/cli/node_modules/@salesforce/plugin-deploy-retrieve/oclif.lock
-rwx------ 1 u33240 dyno 356828 Apr 19 18:16 /app/vendor/sfdx/cli/node_modules/@salesforce/plugin-info/oclif.lock
-rwx------ 1 u33240 dyno 348010 Apr 19 18:16 /app/vendor/sfdx/cli/node_modules/@salesforce/plugin-limits/oclif.lock
-rwx------ 1 u33240 dyno 347792 Apr 19 18:16 /app/vendor/sfdx/cli/node_modules/@salesforce/plugin-marketplace/oclif.lock
-rwx------ 1 u33240 dyno 374310 Apr 19 18:16 /app/vendor/sfdx/cli/node_modules/@salesforce/plugin-org/oclif.lock
-rwx------ 1 u33240 dyno 356030 Apr 19 18:16 /app/vendor/sfdx/cli/node_modules/@salesforce/plugin-packaging/oclif.lock
-rwx------ 1 u33240 dyno 337270 Apr 19 18:16 /app/vendor/sfdx/cli/node_modules/@salesforce/plugin-schema/oclif.lock
-rwx------ 1 u33240 dyno 373877 Apr 19 18:16 /app/vendor/sfdx/cli/node_modules/@salesforce/plugin-settings/oclif.lock
-rwx------ 1 u33240 dyno 341869 Apr 19 18:16 /app/vendor/sfdx/cli/node_modules/@salesforce/plugin-sobject/oclif.lock
-rwx------ 1 u33240 dyno 371001 Apr 19 18:16 /app/vendor/sfdx/cli/node_modules/@salesforce/plugin-source/oclif.lock
-rwx------ 1 u33240 dyno 362566 Apr 19 18:16 /app/vendor/sfdx/cli/node_modules/@salesforce/plugin-telemetry/oclif.lock
-rwx------ 1 u33240 dyno 432199 Apr 19 18:16 /app/vendor/sfdx/cli/node_modules/@salesforce/plugin-templates/oclif.lock
-rwx------ 1 u33240 dyno 421249 Apr 19 18:16 /app/vendor/sfdx/cli/node_modules/@salesforce/plugin-trust/oclif.lock
-rwx------ 1 u33240 dyno 346887 Apr 19 18:16 /app/vendor/sfdx/cli/node_modules/@salesforce/plugin-user/oclif.lock

So out of the 26Mb of the whole @salesforce module, these npm-shrinkwrap.json and oclif.lock take up more than 15Mb.

==> There must be a way of reducing the size of this module which takes up a lot of room when it is embedded.

[mshanemc]

yep, working on that for sure.

can you try it with the newer jsforce here?
https://github.com/forcedotcom/cli/blob/main/releasenotes/README.md#2387-april-24-2024-stable-rc

[ljharb]

To be clear, you'd want to do that in your app, not in individual dependencies - postinstall scripts in dependencies are a security issue.

[mshanemc]

I think (pending some testing) that we'll do that for the plugins that we bundle in the CLI.

We need the shrinkwraps for JIT plugins otherwise npm install uses the latest dependencies and NOT the ones we tested with.

We're also removing all the lockfiles from tarballs/installers.

[ljharb]

@mshanemc when you say "JIT plugins", do you mean ones that are installed on demand?

If so, you can npm install $plugin --before=$publishDate and you WILL get the exact ones you tested with, no lockfile required.

[mshanemc]

@ljharb What?! I've never heard of such a thing. Where are the docs for that? I didn't see it in npm install --help either

[ljharb]

It’s been around since v5. It’s not exactly the same as a lockfile, but it sounds like it’d work for your purposes :-)

it accepts anything new Date does, i believe.

[RupertBarrow]

Hi @mshanemc , I just saw oclif4.9.0 : thanks !

[jshackell-sfdc]

This issue is fixed in version 2.40.7 (May 8, 2024) of the CLI. Enjoy!