Spurious ${LOCALAPPDATA} folder created when hovering a dependency name in package.json

[Septh]

Type: Bug

1. Open any folder with a package.json file.
2. Hover any dependency name in package.json to display the package's details.
3. An extra folder named ${LOCALAPPDATA} appears in the same directory where the package.json file resides.

It appears from the logs in that folder that vscode launches npm view to get the package details:

So I tried the same command from the shell:

npm view --json -- eslint description dist-tags.latest homepage version time

The extra folder was not created.

VS Code version: Code 1.89.0 (b58957e, 2024-05-01T02:09:22.859Z)
OS version: Windows_NT x64 10.0.22631
Modes:

System Info

Item	Value
CPUs	12th Gen Intel(R) Core(TM) i7-12700K (20 x 3610)
GPU Status	2d_canvas: enabled canvas_oop_rasterization: enabled_on direct_rendering_display_compositor: disabled_off_ok gpu_compositing: enabled multiple_raster_threads: enabled_on opengl: enabled_on rasterization: enabled raw_draw: disabled_off_ok skia_graphite: disabled_off video_decode: enabled video_encode: enabled vulkan: disabled_off webgl: enabled webgl2: enabled webgpu: enabled
Load (avg)	undefined
Memory (System)	31.75GB (17.10GB free)
Process Argv	--disable-extensions . --crash-reporter-id 365a2674-a228-4abd-82c2-408321056497
Screen Reader	no
VM	0%

Extensions disabled

[aiday-mar]

Not sure who to assign this to. I was wondering @joaomoreno if you would know?

[Septh]

I did some digging and it turns out that this may well be a bug in Node's execFile API.
EDIT: this is not a bug, only execFile missing environment information.

The following script is a stripped down version of the npmView() method in the VSCode's builtin npm extension.

import { execFile } from 'node:child_process'
import which from 'which'

const npmCommandPath = await which(process.platform === 'win32' ? 'npm.cmd' : 'npm')
const pack = 'eslint'

const result = await new Promise((resolve, _reject) => {
    const args = ['view', '--json', '--', pack, 'description', 'dist-tags.latest', 'homepage', 'version', 'time']
    const cwd = process.cwd()

    // corepack npm wrapper would automatically update package.json. disable that behavior.
    // COREPACK_ENABLE_AUTO_PIN disables the package.json overwrite, and
    // COREPACK_ENABLE_PROJECT_SPEC makes the npm view command succeed
    //   even if packageManager specified a package manager other than npm.
    const env = { COREPACK_ENABLE_AUTO_PIN: "0", COREPACK_ENABLE_PROJECT_SPEC: "0" }
    execFile(npmCommandPath, args, { cwd, env, shell: true }, (error, stdout) => {
        if (!error) {
            try {
                const content = JSON.parse(stdout)
                const version = content['dist-tags.latest'] || content['version']
                resolve({
                    description: content['description'],
                    version,
                    time: content.time?.[version],
                    homepage: content['homepage']
                })
                return
            } catch (e) {
                // ignore
            }
        }
        resolve(undefined)
    })
}).catch(e => null)

console.log(result)

When run from the command line, the script creates the ${LOCALAPPDATA} folder, just like VSCode does. However, if I remove the env option object in the call to execFile(), then the folder is not created. I confirmed this with the latest versions of Node 21, 20, 18 and 16.

The env object was added in #210601.

Not sure where to go from here.

One last remark: the shell: true option is now mandatory to run .cmd files on Windows with execFile() - this is something to keep in mind when upgrading the version of Electron used in VSCode.

[frankli0324]

should be resolved by #213306

[aeschli]

#213306 fixes the issue