fix: prevent crash when expanding directories.bin without filesystem path (#164)

MaxBlack-dev · Max Black · web-flow · commit 57952b808317 · 2025-11-18T14:35:09.000-08:00
Fixes npm/cli#8722 When normalizing a package manifest fetched from a registry (without a filesystem path), attempting to expand 'directories.bin' would crash with ERR_INVALID_ARG_TYPE because pkg.path is undefined. This adds a check to only expand directories.bin when pkg.path exists, preventing the crash while maintaining correct behavior for packages with a filesystem location. **Impact:** - Affects users with custom/private registries (GitLab, Artifactory, etc.) that don't pre-calculate the 'bin' field - The npm public registry pre-calculates this field, which is why the issue isn't visible there - Multiple users have reported this issue in npm/cli#8722 **Testing:** - All existing tests pass - The fix is minimal and non-breaking: it simply skips the binDir expansion when no filesystem path is available --------- Co-authored-by: Max Black <husivm@google.com>
diff --git a/lib/normalize.js b/lib/normalize.js
@@ -474,7 +474,7 @@ async function asyncSteps (pkg, { steps, root, changes }) {
   }
 
   // expand "directories.bin"
-  if (steps.includes('binDir') && data.directories?.bin && !data.bin) {
+  if (steps.includes('binDir') && data.directories?.bin && !data.bin && pkg.path) {
     const binPath = secureAndUnixifyPath(data.directories.bin)
     const bins = await lazyLoadGlob()('**', { cwd: path.resolve(pkg.path, binPath) })
     data.bin = bins.reduce((acc, binFile) => {
diff --git a/test/normalize.js b/test/normalize.js
@@ -172,6 +172,20 @@ for (const [name, testNormalize] of Object.entries(testMethods)) {
       t.strictSame(content.bin, { echo: 'bin/echo' })
     })
 
+    t.test('directories.bin without filesystem path', async t => {
+      const p = new Pkg()
+      p.fromContent({
+        name: 'registry-test',
+        version: '1.0.0',
+        directories: {
+          bin: './bin',
+        },
+      })
+      await p.normalize({ steps: Pkg.normalizeSteps })
+      t.notOk(p.content.bin, 'bin should not be expanded without filesystem path')
+      t.ok(p.content.directories.bin, 'directories.bin should be preserved')
+    })
+
     t.test('dedupe optional deps out of regular deps', async t => {
       t.test('choose optional deps in conflict, removing empty dependencies', async t => {
         const { content } = await testNormalize(t, ({

Original file line number	Diff line number	Diff line change
`@@ -474,7 +474,7 @@ async function asyncSteps (pkg, { steps, root, changes }) {`
`474`	`474`	`}`
`475`	`475`
`476`	`476`	`// expand "directories.bin"`
`477`		`- if (steps.includes('binDir') && data.directories?.bin && !data.bin) {`
	`477`	`+ if (steps.includes('binDir') && data.directories?.bin && !data.bin && pkg.path) {`
`478`	`478`	`const binPath = secureAndUnixifyPath(data.directories.bin)`
`479`	`479`	`const bins = await lazyLoadGlob()('**', { cwd: path.resolve(pkg.path, binPath) })`
`480`	`480`	`data.bin = bins.reduce((acc, binFile) => {`