linter: v1.17.0 `PATH must not contain ".."` when using `asdf` node version manager

[mattp0123]

I ran

pnpm dlx oxlint@1.17.0

then got this error:

Error: /Users/matt/Library/Caches/pnpm/dlx/1e2430b28d42b533917a000eabdc641827bf46fca4b507e8dae2b8bf27773122/1997add85b7-d0c0/node_modules/.bin/../.pnpm/oxlint@1.17.0/node_modules/oxlint/bin/oxlint
: PATH must not contain ".."

1.16.0 works fine.

[camc314]

can you try running pnpm with verbose log level and provide the logs?

do you have any custom pnpm settings, and are you running in a pnpm repo or a different package manager repo?

[mattp0123]

@camc314 no other additional messages from the verbose level logging. i ran the command in a pnpm repo. no custom pnpm settings.

[overlookmotel]

Why don't we allow .. in paths anyway? I assume idea is to prevent linting files outside of current directory. But disallowing a path which has any .. segments seems unnecessarily restrictive. Shouldn't paths like this be acceptable?

./foo/bar/qux/../../boom.js

[camc314]

yeah it's to dissalow linting files outside the current directory.

Shouldn't paths like this be acceptable?

./foo/bar/qux/../../boom.js

I can't see why anyone would write the path like that - why not just ./foo/boom.js

[camc314]

@mattp0123 do you have a custom node installation, or are you using a different JS runtime and how is node installed?

[camc314]

for reference, i added some debug logs, and i see the following:

DEBUG=* pnpm dlx oxlint@1.17.0
  corepack Checking /Users/cameron/github/Boshen/oxc/apps/oxfmt/package.json +0ms
  corepack Checking /Users/cameron/github/Boshen/oxc/apps/package.json +1ms
  corepack Checking /Users/cameron/github/Boshen/oxc/package.json +0ms
  corepack Checking /Users/cameron/github/Boshen/oxc/.corepack.env +1ms
  corepack No env file found at /Users/cameron/github/Boshen/oxc/.corepack.env +0ms
  corepack /Users/cameron/github/Boshen/oxc/package.json defines pnpm@10.17.0 as local package manager +0ms
  corepack Using pnpm@10.17.0 as defined in project manifest /Users/cameron/github/Boshen/oxc/package.json +0ms
  corepack Reusing pnpm@10.17.0 found in /Users/cameron/.cache/node/corepack/v1/pnpm/10.17.0 +3ms
[apps/oxlint/src/run.rs:70:5] &args = ArgsOs {
    inner: [
        "node",
        "/Users/cameron/Library/Caches/pnpm/dlx/1e2430b28d42b533917a000eabdc641827bf46fca4b507e8dae2b8bf27773122/1997badd030-12070/node_modules/.bin/../.pnpm/oxlint@1.17.0/node_modules/oxlint/bin/oxlint",
    ],
}

Inside the linter:
https://github.com/Boshen/oxc/blob/a34918ab6969f66cc747b9dc5a5253012056371c/apps/oxlint/src/run.rs#L72
we skip the first two args if the first arg is node, but if for some reason, it's not node, we wouldn't skip it and we would end up thinking you wanted to lint this file path: /Users/matt/Library/Caches/pnpm/dlx/1e2430b28d42b533917a000eabdc641827bf46fca4b507e8dae2b8bf27773122/1997add85b7-d0c0/node_modules/.bin/../.pnpm/oxlint@1.17.0/node_modules/oxlint/bin/oxlint

[mattp0123]

@camc314 I use asdf as the node version manager

[camc314]

with asdf, i managed to repro this:

DEBUG=* pnpm dlx oxlint@1.17.0
# rust side
[apps/oxlint/src/run.rs:70:5] &args = ArgsOs {
    inner: [
        "/Users/cameron/.asdf/installs/nodejs/24.8.0/bin/node",
        "/Users/cameron/Library/Caches/pnpm/dlx/1e2430b28d42b533917a000eabdc641827bf46fca4b507e8dae2b8bf27773122/1997badd030-12070/node_modules/.bin/../.pnpm/oxlint@1.17.0/node_modules/oxlint/bin/oxlint",
    ],
}
Error: /Users/cameron/Library/Caches/pnpm/dlx/1e2430b28d42b533917a000eabdc641827bf46fca4b507e8dae2b8bf27773122/1997badd030-12070/node_modules/.bin/../.pnpm/oxlint@1.17.0/node_modules/oxlint/bin/oxlint
: PATH must not contain ".."
# js side
process.argv [
  '/Users/cameron/.asdf/installs/nodejs/24.8.0/bin/node',
  '/Users/cameron/Library/Caches/pnpm/dlx/1e2430b28d42b533917a000eabdc641827bf46fca4b507e8dae2b8bf27773122/1997badd030-12070/node_modules/.pnpm/oxlint@1.17.0/node_modules/oxlint/bin/oxlint'
]

[overlookmotel]

I can't see why anyone would write the path like that - why not just ./foo/boom.js

Yes, no sane person would do that! But my guess was that pnpm might be concatenating paths which due to symlinks or something ended up producing a path like /a/b/c/../../d/e. Seems something like that's causing the problem here.

[camc314]

yeah that part shouldn't be an issue. the issue is we can't tell where the args to node end, and the args to oxlint being.

[Stanzilla]

We're using Yarn v1 and only seem to have this problem with Windows users

[overlookmotel]

Is this too simplistic?

1. Is 1st arg node?
2. Does 1st arg end with /node?

If yes to either, discard the first 2 args.