From 462716170dca59fa2a0dd1b754b8644ed64462c4 Mon Sep 17 00:00:00 2001 From: Dotta Date: Fri, 30 Oct 2026 14:07:56 -0500 Subject: [PATCH] fix(cloud): reject aggregate dependency inventory targets Co-Authored-By: Paperclip --- server/src/__tests__/cloud-bundled-package-digest.test.ts | 8 ++++++++ server/src/services/cloud-bundled-package-digest.ts | 4 ++++ 2 files changed, 12 insertions(+) diff --git a/server/src/__tests__/cloud-bundled-package-digest.test.ts b/server/src/__tests__/cloud-bundled-package-digest.test.ts index 67491571762..7978c46795e 100644 --- a/server/src/__tests__/cloud-bundled-package-digest.test.ts +++ b/server/src/__tests__/cloud-bundled-package-digest.test.ts @@ -63,6 +63,14 @@ describe("bounded current-image package dependency inventory", () => { expect(cloudBundledPackageDigest(image.provider, { catalogRoot: image.catalogRoot })).toBe(first); }); + it.each(["", ".pnpm", ".pnpm/node_modules"])("rejects aggregate image dependency targets: %s", (aggregate) => { + const image = fixture(); + const target = path.join(image.root, "node_modules", aggregate); + fs.mkdirSync(target, { recursive: true }); + link(target, path.join(image.sdk, "node_modules", "aggregate")); + expect(() => cloudBundledPackageDigest(image.provider, { catalogRoot: image.catalogRoot })).toThrow("select an individual package"); + }); + it("accepts the shipped provider's observed entry class", () => { const image = fixture(); const directory = path.join(image.provider, "many"); fs.mkdirSync(directory); diff --git a/server/src/services/cloud-bundled-package-digest.ts b/server/src/services/cloud-bundled-package-digest.ts index 47d3f209353..40cacb3fa11 100644 --- a/server/src/services/cloud-bundled-package-digest.ts +++ b/server/src/services/cloud-bundled-package-digest.ts @@ -41,6 +41,10 @@ export function cloudBundledPackageDigest(packageRoot: string, options: { catalo logical(target); if (imageNodeModules) { const relative = path.relative(imageNodeModules, target).split(path.sep); + if ((relative.length === 1 && relative[0] === "") + || (relative[0] === ".pnpm" && (relative.length === 1 || (relative.length === 2 && relative[1] === "node_modules")))) { + throw new Error("Image dependency must select an individual package"); + } if (relative[0] === ".pnpm" && relative.length > 2 && relative[1] && relative[1] !== "node_modules") { walk(path.join(imageNodeModules, ".pnpm", relative[1])); return;