Regarding your first query, if you leave the dependencies in therequire section of yourcomposer.json, they will be installed. This is why it is recommended to move them to therequire-dev (other than thephp version requirement). It's also recommended to exclude unnecessary files from your built archive (so that only the Phar is included).

You can see an example of this with the Oh Dear CLI:

• The.gitattributes excludes all content other thanbuild/ohdear, and accompanyingLICENSE.md,README.md, andcomposer.json
• Thecomposer.json defines the PHP requirement for Composer, but the other dependencies are included in-dev so that they are not included when installing globally through Composer

As you have mentioned, correctly, if you specify thebin to bebuilds/foo, then it will bypass the included dependencies and files. It will only use the bundled dependencies from the Phar file.

Regarding your second query, I agree that is a bit of a weird scenario, and does seem odd to include that. However, I think in a way that makes sense as it's just a Phar file, so it has no knowledge of whether it's installed via Composer, Brew, Phive, or whatever. 🤷🏻 (Unless you do a check like you have).

I think, if you are wanting to disable theself-update command in that scenario, what you have mentioned is probably the best way. 🤷🏻