fix: write fallback package.json for codebase mode nsjail

[rubenfiszel]

Summary

• Fix ERR_INVALID_PACKAGE_CONFIG error when running codebase mode scripts with nsjail sandboxing
• When nsjail mounts a file with mandatory: false and the source doesn't exist, it creates an empty 0-byte file at the destination. For codebase mode, no package.json was written to the job directory, so nsjail created an empty /tmp/nodejs/package.json that Node.js couldn't parse as JSON
• Write a valid fallback {} package.json for codebase mode before TAR extraction — if the codebase TAR includes its own package.json, extraction overwrites it

Test plan

• CJS TAR codebase + nsjail: passes (was failing with ERR_INVALID_PACKAGE_CONFIG)
• ESM TAR codebase + nsjail: passes
• ESM TAR codebase with node_modules deps + nsjail: passes
• Normal (non-codebase) bundled bun script + nsjail: passes

🤖 Generated with Claude Code

[claude]

Claude finished @rubenfiszel's task in 1m 4s —— View job

---

PR Review: fix: write fallback package.json for codebase mode nsjail

• Gather context and read changed files
• Review code changes
• Post review feedback

Review

LGTM — this is a clean, minimal fix for a real nsjail edge case.

What the change does: When running codebase mode scripts under nsjail, no package.json was written to the job directory. Since the nsjail mount config uses mandatory: false, nsjail creates an empty 0-byte file at the mount destination. Node.js then fails to parse this empty file as JSON (ERR_INVALID_PACKAGE_CONFIG). The fix writes a valid fallback {} before TAR extraction, which gets overwritten if the codebase TAR includes its own package.json.

Code quality: The change follows the existing pattern at bun_executor.rs:1037-1038 — same write_file call, same let _ = error handling. The comment is well-written and explains the why clearly.

Logic correctness: Looking at the branch conditions at lines 1035-1045:

1. !codebase.is_some() && !has_bundle_cache → writes main.ts (non-codebase, non-cached)
2. !annotation.native && codebase.is_none() → writes package.json with "type": "module" (non-native, non-codebase with bundle cache)
3. codebase.is_some() → writes fallback package.json with {} (new)

One minor note: condition 1 uses !codebase.is_some() while condition 3 uses codebase.is_some(). Since these are in an if/else if chain, condition 3 only triggers when !has_bundle_cache is false (i.e., has_bundle_cache is true) AND either annotation.native is true OR codebase.is_some() — the latter being what's tested. This is correct: codebase mode with bundle cache gets the fallback package.json. The existing !codebase.is_some() in condition 1 could be codebase.is_none() for consistency, but that's a pre-existing style issue, not part of this PR.

No concerns on security, performance, or correctness. The fallback {} is the most minimal valid JSON object and is correctly placed before TAR extraction.

---

Testing instructions

To verify this fix, you need a Windmill instance with nsjail sandboxing enabled and a codebase mode TypeScript/JavaScript script. Create a codebase TAR (CJS or ESM) without a package.json in the archive, deploy it as a codebase mode bun script, and run it under nsjail. Previously this would fail with ERR_INVALID_PACKAGE_CONFIG; with this fix it should succeed. Also verify that a codebase TAR that does include a package.json still works (the TAR extraction should overwrite the fallback).

[cloudflare-workers-and-pages]

Deploying windmill with    Cloudflare Pages

Latest commit:	a573d9f
Status:	✅  Deploy successful!
Preview URL:	https://458ebd77.windmill.pages.dev
Branch Preview URL:	https://esm-module-error.windmill.pages.dev

View logs