I'm sorry, maybe this is only my expectations as newbie deploying apps.
In development I love to use barryvdh/laravel-debugbar. When I use npm run dev it does what I expect, to load all the dev things. But when I do npm run build I was expecting that all the dev things were going to be left out. Then I realized npm is just for the js assets.
So, do I have to manually remove from composer.json the reference to the debugbar before building the app? Do I have to run composer install? Is there something like npm run build that I have to run for composer?
If you installed it using the command on the debugbar Github page (composer require barryvdh/laravel-debugbar --dev), it will only be installed in the require-dev section of composer.json. Then when you run composer install --no-dev on your production server, it will not be installed since it won't be in the main require section. If you installed it by hand on your local machine and didn't add the --dev flag, you can just just manually edit the composer.json and move it from one section to the other.
Additionally, as @mohamedtammam mentioned, debugbar has its own check to see what the APP_ENV value is for the current running instance; if it's set to production, it will not run at all, so just make sure your production instances are configured correctly and you will be protected.