Don't allow certain commands in bundle

lib/bundle.js

@@ -29,16 +29,27 @@ function bundle (args, cb_) {
             , manroot : null
             }
     conf.unshift(c)
-    if (cmd && npm.commands[cmd] === npm.commands.ls) {
-      // args.push("installed")
-      c.registry = null
+
+    if (cmd && npm.commands[cmd]) {
+      cmd = npm.commands[cmd]
+      var notAllowed =
+        [ "adduser", "publish", "link", "config", "update-dependents"
+        , "owner", "restart", "start", "stop", "tag", "unpublish", "view" ]
+      for (var i = 0, l = notAllowed.length; i < l; i ++) {
+        if (cmd === npm.commands[i]) {
+          return cb(new Error(i + " command not allowed in bundle"))
+        }
+      }
+      if (cmd === npm.commands.ls) {
+        c.registry = null
+      }
     }
 
     if (er) return cb(new Error(bundle.usage))
     mkdir(npm.dir, function(er) {
       if (er) return log.er(cb, "Error creating "+npm.dir+" for bundling")(er)
-      if (typeof npm.commands[cmd] === "function") {
-        return npm.commands[cmd](args, cb)
+      if (typeof cmd === "function") {
+        return cmd(args, cb)
       }
 
       // no command given, just install the local deps.
@@ -60,7 +71,7 @@ function install (data, location, cb) {
     , deps = depNames.map(function (d) {
         var v = data.dependencies[d]
         if (v === "*") v = ""
-        return d+"@"+v
+        return v ? d + "@" + v : d
       })
   log.verbose(deps, "bundle deps")
   npm.commands.install(deps, cb)