fix(cloud-workers): install bundle deps after the integrity check, hash the vendor tree

steipete · steipete · commit 553c2459619f · 2026-07-13T11:00:03.000-07:00
The bundle install verifier walks the staged tree and compares its hash to
the expected bundle hash. Two live-E2E bugs: (1) it never walked vendor/,
so vendored workspace packages failed the hash; (2) npm install ran before
the check, so node_modules (intentionally hash-excluded) polluted the tree.
Verify the pristine bundle including vendor/, then run the production
npm install. Proven locally: VERIFY_INSTALL_JS returns 0 on the extracted
tarball and the worker entry resolves every module post-install.
diff --git a/src/gateway/worker-environments/bootstrap.ts b/src/gateway/worker-environments/bootstrap.ts
@@ -200,6 +200,16 @@ try {
     readNpmInventory();
   } else if (install === "bundle") {
     walk("dist");
+    // Vendored workspace packages ship inside the bundle and are part of its hash;
+    // node_modules is installed after verification and never walked here.
+    const vendorPath = path.join(root, "vendor");
+    const vendorStats = fs.existsSync(vendorPath) ? fs.lstatSync(vendorPath) : undefined;
+    if (vendorStats) {
+      if (vendorStats.isSymbolicLink() || !vendorStats.isDirectory()) {
+        fail("unsafe worker vendor directory");
+      }
+      walk("vendor");
+    }
   } else {
     fail("invalid worker install channel");
   }
@@ -429,11 +439,6 @@ case "$install" in
       exit 2
     fi
     tar -xzf "$upload" -C "$staging"
-    if ! command -v npm >/dev/null 2>&1; then
-      printf '%s\n' '${NPM_MISSING_MARKER}' >&2
-      exit ${NPM_MISSING_EXIT_CODE}
-    fi
-    OPENCLAW_DISABLE_PLUGIN_REGISTRY_MIGRATION=1 npm install --prefix "$staging" --ignore-scripts --omit=dev --no-audit --no-fund
     ;;
   npm)
     if ! command -v npm >/dev/null 2>&1; then
@@ -470,6 +475,15 @@ if ! node -e '${VERIFY_INSTALL_JS}' "$staging" "$hash" "$install"; then
   printf '%s\n' 'worker install content does not match the expected bundle hash' >&2
   exit 2
 fi
+# Materialize production dependencies only after the pristine bundle passed its
+# integrity check; npm install writes node_modules the hash intentionally excludes.
+if [ "$install" = bundle ]; then
+  if ! command -v npm >/dev/null 2>&1; then
+    printf '%s\n' '${NPM_MISSING_MARKER}' >&2
+    exit ${NPM_MISSING_EXIT_CODE}
+  fi
+  OPENCLAW_DISABLE_PLUGIN_REGISTRY_MIGRATION=1 npm install --prefix "$staging" --ignore-scripts --omit=dev --no-audit --no-fund >&2
+fi
 printf '%s\n' "$receipt_json" > "$staging/${BOOTSTRAP_RECEIPT}"
 chmod 600 "$staging/${BOOTSTRAP_RECEIPT}"
 rm -rf "$install_dir"
