From d8fdf8fcd383b5a3c64f2e54fbdb3b90d8fd0ac7 Mon Sep 17 00:00:00 2001 From: Goon Date: Mon, 18 May 2026 15:58:57 +0700 Subject: [PATCH] fix(packages): install sanitized npm tarballs Avoid npm global symlinks to temporary fallback directories by repacking rewritten workspace dependency packages before install. --- internal/skills/npm_workspace_fallback.go | 13 +++++++++++-- 1 file changed, 11 insertions(+), 2 deletions(-) diff --git a/internal/skills/npm_workspace_fallback.go b/internal/skills/npm_workspace_fallback.go index f6ae060e..5bed0c98 100644 --- a/internal/skills/npm_workspace_fallback.go +++ b/internal/skills/npm_workspace_fallback.go @@ -75,8 +75,17 @@ func installNpmPackageWithWorkspaceRewrite(ctx context.Context, target string) ( return packOut, errors.New("npm workspace fallback found no workspace dependencies to rewrite") } - installOut, err := runNpmInstall(ctx, packageDir) - return appendNpmFallbackOutput(packOut, installOut), err + repackDir := filepath.Join(tmpDir, "repack") + if err := os.MkdirAll(repackDir, 0o750); err != nil { + return packOut, fmt.Errorf("npm workspace fallback repack dir: %w", err) + } + sanitizedTarball, repackOut, err := npmPackTarball(ctx, packageDir, repackDir) + if err != nil { + return appendNpmFallbackOutput(packOut, repackOut), err + } + + installOut, err := runNpmInstall(ctx, sanitizedTarball) + return appendNpmFallbackOutput(packOut, repackOut, installOut), err } func npmPackTarball(ctx context.Context, target, destination string) (string, []byte, error) {