install: reject an empty root package.json instead of deleting the lockfile

src/install/PackageManager/install_with_manager.rs

@@ -1858,7 +1858,20 @@ fn root_package_json_source(
         root_package_json_path.as_bytes(),
         Default::default(),
     ) {
-        WorkspacePackageJsonCacheResult::Entry(entry) => return Ok(entry.source.clone()),
+        WorkspacePackageJsonCacheResult::Entry(entry) => {
+            // The parser turns an empty file into `{}`, which would delete the lockfile.
+            if entry.source.contents.is_empty() {
+                Output::err_generic(
+                    "failed to parse '{}': file is empty",
+                    (bstr::BStr::new(root_package_json_path.as_bytes()),),
+                );
+                bun_core::note!(
+                    "Restore package.json, or write {{}} to it to start without dependencies"
+                );
+                Global::exit(1);
+            }
+            return Ok(entry.source.clone());
+        }
         WorkspacePackageJsonCacheResult::ReadErr(err) => ("read", err),
         WorkspacePackageJsonCacheResult::ParseErr(err) => ("parse", err),
     };

test/cli/install/bun-install.test.ts

@@ -5221,14 +5221,20 @@ describe.concurrent("bun-install", () => {
       });
       const [stdout, stderr, exitCode] = await Promise.all([proc.stdout.text(), proc.stderr.text(), proc.exited]);
       expect(stdout).toStartWith("bun install v1.");
-      return { stderr: normalizeBunSnapshot(stderr, String(dir)), exitCode };
+      return {
+        stderr: normalizeBunSnapshot(stderr, String(dir)),
+        exitCode,
+        lockfileKept: await exists(join(String(dir), "bun.lock")),
+      };
     }
 
     const unparseable = (packageJsonPath: string) => writeFile(packageJsonPath, "foo");
     const unreadable = async (packageJsonPath: string) => {
       await rm(packageJsonPath);
       await mkdir(packageJsonPath);
     };
+    // What a writer that died between truncating and writing leaves behind.
+    const empty = (packageJsonPath: string) => writeFile(packageJsonPath, "");
 
     for (const [lockfile, withLockfile] of [
       ["with a bun.lock", true],
@@ -5253,6 +5259,20 @@ describe.concurrent("bun-install", () => {
         expect(stderr).toBe("EISDIR: failed to read '<dir>/package.json'");
         expect(exitCode).toBe(1);
       });
+
+      // An empty file parses as `{}` elsewhere. For the root that would mean "no
+      // dependencies", and bun install would delete the lockfile.
+      it(`rejects an empty file and keeps the lockfile ${lockfile}`, async () => {
+        const result = await installWithBrokenRootPackageJson(withLockfile, empty);
+        expect(result).toEqual({
+          stderr: [
+            "error: failed to parse '<dir>/package.json': file is empty",
+            "note: Restore package.json, or write {} to it to start without dependencies",
+          ].join("\n"),
+          exitCode: 1,
+          lockfileKept: withLockfile,
+        });
+      });
     }
   });
 

test/cli/install/migration/pnpm/version-number-dot/package.json

@@ -0,0 +1 @@
+{}