ESM `package.json` in home directory breaks certain programs

[Hacksore]

Version

v20.12.2

Platform

Darwin eloy 23.5.0 Darwin Kernel Version 23.5.0: Wed May  1 20:12:58 PDT 2024; root:xnu-10063.121.3~5/RELEASE_ARM64_T6000 arm64

Subsystem

No response

What steps will reproduce the bug?

1. cd to your home directory
2. npm init -y
3. add "type": "module" to the new package.json
4. starting certain apps like Discord and zbirenbaum/copilot.lua will error/crash

How often does it reproduce? Is there a required condition?

constantly

What is the expected behavior? Why is that the expected behavior?

not to crash other programs?

What do you see instead?

seems those programs like Discord and nvim copilot are traversing up and finding a higher level package.json and panicking at runtime.

Additional information

zbirenbaum/copilot.lua#306
https://x.com/Hacksore/status/1790395583611474423

even got @Jarred-Sumner
https://x.com/jarredsumner/status/1790611334784278853

I'm hoping this issue can solve, "what are developers supposed to do to handle this"?

Is having an ESM package.json in your home directory forbidden by nodejs or is this an edge case that can be patched?

[avivkeller]

@nodejs/loaders Please correct me if I'm mistaken, but IMO it's the developers' responsibility to ensure their applications don't depend on package.json files from other programs, rather than Node.js's responsibility.

Based on my initial thoughts, I've optimistically added the wontfix label, but feel free to change it if necessary.

(Leaving this open for further input from @nodejs/loaders. If you agree with my perspective, feel free to close the issue.)

---

"what are developers supposed to do to handle this"?

By including a package.json file at the root of your project, you an ensure that it is used instead of another, unrelated file.

❌

.
├── package.json # {"type":"module"}
└── other-package
    ├── index.js # This file will be treated as a ESM file

✅

.
├── package.json # {"type":"module"}
└── other-package
    ├── index.js # This file will be treated as a CommonJS file
    └── package.json # {"type":"commonjs"}

[Hacksore]

Indeed it might not be something node has to fix but education for developers is the general reason for this issue.

So if someone is loading cjs code, like how discord loads ~/Library/Application Support/discord/0.0.317 what do they do to stop me in userland from creating a package.json in my home directory with "type": "module"?

This might be able to be solved in electron for the discord like issue but the similar behavior is seen in zbirenbaum/copilot.lua#306 (comment)

[START][2024-08-03 11:32:06] LSP logging initiated
[ERROR][2024-08-03 11:32:06] .../vim/lsp/rpc.lua:770	"rpc"	"node"	"stderr"	"file:///Users/hacksore/.local/share/nvim/lazy/copilot.lua/copilot/index.js:3
global.__rootDirectory = __dirname + '/dist/';
                         ^

ReferenceError: __dirname is not defined in ES module scope
This file is being treated as an ES module because it has a '.js' file extension and '/Users/hacksore/package.json' contains \"type\": \"module\". To treat it as a CommonJS script, rename it to use the '.cjs' file extension.
    at file:///Users/hacksore/.local/share/nvim/lazy/copilot.lua/copilot/index.js:3:26
    at ModuleJob.run (node:internal/modules/esm/module_job:222:25)
    at async ModuleLoader.import (node:internal/modules/esm/loader:323:24)
    at async loadESM (node:internal/process/esm_loader:28:7)
    at async handleMainPromise (node:internal/modules/run_main:113:12)

Node.js v20.12.2

Hopefully we can get figure out a proper solution for all, thanks!

[avivkeller]

So if someone is loading cjs code, like how discord loads ~/Library/Application Support/discord/0.0.317 what do they do to stop me in userland from creating a package.json in my home directory with "type": "module"?

As I mentioned earlier, By including a package.json file at the root of your project, you an ensure that it is used instead of another, unrelated file.

This might be able to be solved in electron for the discord like issue but the similar behavior is seen in zbirenbaum/copilot.lua#306 (comment)

The same answer. The maintainers can resolve this issue by including a package.json file at the root of their project (or at least the copilot/ directory, but I'm not trying to provide support for a specific project).

[Hacksore]

@redyetidev yep you're right, the best way for vendors is to ship a package.json at the top most place they expect to load code from.

If they do not then unintended behavior can happen, this all makes sense now!

Appreciate the help on this one.

[ljharb]

Separately, it's best not to have package.json or node_modules in $HOME (or in any directory that might contain unrelated projects) for this reason.