Turbopack Error: Using a package with bun link forbidden due to filesystem root restrictions

[FranciscoMoretti]

Precents using a package compiled in another repo, and then linked to the dependencies with bun link.

Bun link mechanisms I've tried https://bun.com/docs/pm/cli/link

  "streamdown": "link:streamdown"

Or in the terminal with:

  bun link streamdown

Turbopack version: 142b08bf
Next.js version: 0.0.0

Error message:

Failed to write app endpoint /(chat)/chat/[id]/page

Caused by:
- [project]/app/globals.css [app-client] (css)
- FileSystemPath("").join("../streamdown/packages/streamdown/dist/index.js") leaves the filesystem root

Debug info:
- Execution of get_written_endpoint_with_issues_operation failed
- Execution of endpoint_write_to_disk failed
- Execution of <AppEndpoint as Endpoint>::output failed
- Failed to write app endpoint /(chat)/chat/[id]/page
- Execution of AppEndpoint::output failed
- Execution of AppProject::app_module_graphs failed
- Execution of *<AppEndpoint as Endpoint>::additional_entries failed
- Execution of *ModuleGraph::from_graphs failed
- Execution of SingleModuleGraph::new_with_entries_visited_intern failed
- [project]/app/globals.css [app-client] (css)
- Execution of primary_chunkable_referenced_modules failed
- Execution of <CssModuleAsset as Module>::references failed
- Execution of parse_css failed
- Execution of <PostCssTransformedAsset as Asset>::content failed
- Execution of PostCssTransformedAsset::process failed
- FileSystemPath("").join("../streamdown/packages/streamdown/dist/index.js") leaves the filesystem root

[Mr-Nilarnab]

Let’s break it down 👇

---

💥 The error

Using a package with bun link forbidden due to filesystem root restrictions
FileSystemPath("").join("../streamdown/packages/streamdown/dist/index.js") leaves the filesystem root

Translation:

• You’re linking a local package (streamdown) using bun link.

• Turbopack is refusing to read outside the current project directory for safety reasons.

• It detects that ../streamdown/... goes outside your Next.js app’s root — so it blocks it entirely.

This is new in Turbopack and doesn’t affect Webpack builds (yet).

---

⚙️ Why it happens

Turbopack runs your app inside a restricted file sandbox, similar to how Vercel deployments are isolated.

It forbids resolving imports that:

• Use relative paths to escape the project root (../something-outside).

• Or are linked via local symlinks like bun link, npm link, or yarn link that point outside.

This restriction ensures builds are deterministic and safe for caching/distribution — but it breaks local monorepo links today.

---

✅ Fix / Workarounds

Option 1: Use workspace: instead of bun link

If you’re using a monorepo (with Bun or npm workspaces), define your dependency in package.json like:

{
  "dependencies": {
    "streamdown": "workspace:*"
  }
}

Then make sure both repos are in the same workspace root with a root package.json:

{
  "private": true,
  "workspaces": ["apps/*", "packages/*"]
}

This is the preferred solution — Turbopack supports workspace dependencies safely.

---

Option 2: Copy the built package locally

If streamdown is an external package you’re building elsewhere:

cd ../streamdown
bun build

Then copy its dist folder into your Next.js app’s node_modules manually or via script:

cp -r ../streamdown/packages/streamdown/dist ./node_modules/streamdown/

(Not ideal, but quick and works.)

---

Option 3: Use Webpack instead of Turbopack

If you need bun link for now:

next dev --no-turbo

Webpack doesn’t enforce this restriction.

---

Option 4: Package & install from tarball

cd ../streamdown
bun pack
cd ../your-next-app
bun add ../streamdown/streamdown-vx.x.x.tgz

This way, it’s treated as a normal dependency inside the filesystem root.

---

🪲 Track the upstream issue

This exact limitation is discussed here:
👉 vercel/next.js#85798

They’re working on allowing safe local linking or a configuration flag to loosen the sandbox.

---

✅ TL;DR

Cause	Fix
Turbopack blocks linked packages outside project root	Use workspace:* deps instead of bun link
Temporary need to link	Run next dev --no-turbo
Want a stable fix	Watch Next.js issue #85798

---

Would you like me to show you exactly how to restructure your project into a workspace layout so Turbopack accepts your linked package automatically?

This one’s a great catch — and it points to a **security restriction in Turbopack’s new file system sandbox**.

Let’s break it down 👇

---

💥 The error

Using a package with bun link forbidden due to filesystem root restrictions
FileSystemPath("").join("../streamdown/packages/streamdown/dist/index.js") leaves the filesystem root

Translation:

• You’re linking a local package (streamdown) using bun link.
• Turbopack is refusing to read outside the current project directory for safety reasons.
• It detects that ../streamdown/... goes outside your Next.js app’s root — so it blocks it entirely.

This is new in Turbopack and doesn’t affect Webpack builds (yet).

---

⚙️ Why it happens

Turbopack runs your app inside a restricted file sandbox, similar to how Vercel deployments are isolated.

It forbids resolving imports that:

• Use relative paths to escape the project root (../something-outside).
• Or are linked via local symlinks like bun link, npm link, or yarn link that point outside.

This restriction ensures builds are deterministic and safe for caching/distribution — but it breaks local monorepo links today.

---

✅ Fix / Workarounds

Option 1: Use workspace: instead of bun link

If you’re using a monorepo (with Bun or npm workspaces), define your dependency in package.json like:

{
  "dependencies": {
    "streamdown": "workspace:*"
  }
}

Then make sure both repos are in the same workspace root with a root package.json:

{
  "private": true,
  "workspaces": ["apps/*", "packages/*"]
}

This is the preferred solution — Turbopack supports workspace dependencies safely.

---

Option 2: Copy the built package locally

If streamdown is an external package you’re building elsewhere:

cd ../streamdown
bun build

Then copy its dist folder into your Next.js app’s node_modules manually or via script:

cp -r ../streamdown/packages/streamdown/dist ./node_modules/streamdown/

(Not ideal, but quick and works.)

---

Option 3: Use Webpack instead of Turbopack

If you need bun link for now:

next dev --no-turbo

Webpack doesn’t enforce this restriction.

---

Option 4: Package & install from tarball

cd ../streamdown
bun pack
cd ../your-next-app
bun add ../streamdown/streamdown-vx.x.x.tgz

This way, it’s treated as a normal dependency inside the filesystem root.

---

🪲 Track the upstream issue

This exact limitation is discussed here:
👉 [vercel/next.js#85798](#85798)

They’re working on allowing safe local linking or a configuration flag to loosen the sandbox.

---

✅ TL;DR

Cause	Fix
Turbopack blocks linked packages outside project root	Use workspace:* deps instead of bun link
Temporary need to link	Run next dev --no-turbo
Want a stable fix	Watch [Next.js issue #85798](#85798)

---

Would you like me to show you exactly how to restructure your project into a workspace layout so Turbopack accepts your linked package automatically?

[elijah629]

This is a sad excuse of an AI generated response, it even linked to THIS VERY SAME ISSUE.

[FranciscoMoretti]

Would it be able to support this similarly to workspace dependencies?

{
  "dependencies": {
    "streamdown": "link:streamdown"
  }
}

[elijah629]

Interestingly enough, I have this same issue WITH the same package. I believe the issue roots in the fact that streamdown is a monorepo and bun is trying to import it from the root monorepo project (which doesn't auto direct to the child package).