install: fix isolated installer hang on tarball integrity failure

[robobun]

Closes #29646.

Repro

Advertise one tarball's SHA-512 in the registry manifest while serving a different tarball's bytes. The isolated-linker install hangs indefinitely (no output past "Created store"); hoisted errors out.

error: Integrity check failed for tarball: pkg
Resolved, downloaded and extracted [4]
error: IntegrityCheckFailed extracting tarball from pkg
Clean lockfile: 2 packages - 2 packages in 281.7us
Resolved peers [842.2us]
Created store [85.1us]
<hang>

Cause

Partially fixed by #29611 for HTTP 4xx/5xx responses. The extract-task failure branch in src/install/PackageManager/runTasks.zig was missed.

When the streaming extractor sets task.err = error.IntegrityCheckFailed and task.status = .fail, the resolve-phase runTasks (which passes onPackageDownloadError = {}) fell into the void-callback else that only logged the error and continued — never removing the entry from network_dedupe_map or draining its task_queue list.

Install-phase Store.Installer then called enqueuePackageForDownload for the failed package, hit task_queue.found_existing == true at PackageManagerEnqueue.zig:258, returned early without scheduling a new network task, and the isolated installer waited forever on pendingTaskCount() == 0.

Fix

Mirror the 4xx/5xx cleanup symmetrically for extract failures in runTasks.zig:

• Drop the network_dedupe_map entry up front, before the callback branch, so the Store.Installer path (which continues from the callback) is also covered. Store.Installer.onPackageDownloadError drains task_queue itself but doesn't touch the dedupe map.
• In the void-callback fallback, also drain the task_queue entry, matching the existing HTTP-error branch.

network_dedupe_map.remove is a no-op for local_tarball tasks (they never populate the map).

Verification

Extended test/cli/install/bun-install-tarball-integrity.test.ts with a new describe.each(["hoisted", "isolated"]) block that builds a tarball whose advertised SHA-512 doesn't match the served bytes. Without the fix, isolated times out at 5s; with the fix, both linkers surface Integrity check failed and exit non-zero.

[robobun]

^{Updated 4:11 PM PT - Apr 23rd, 2026}

❌ @robobun, your commit 6728b9f has 1 failures in Build #47590 (All Failures):

• test/js/bun/net/socket.test.ts - code 1 on 🪟 2019 x64
• test/js/bun/net/socket.test.ts - code 1 on 🪟 2019 x64-baseline

---

🧪   To try this PR locally:

bunx bun-pr 29649

That installs a local version of the PR into your bun-29649 executable, so you can run:

bun-29649 --bun

[github-actions]

Found 3 issues this PR may fix:

1. Bun install hangs when failing to fetch a dependency and in isolated linker mode #26341 - Isolated linker hangs when a dependency fetch fails (401), same root cause: failed task not cleaned from dedupe map
2. Regression in v1.2.19: Waiting for 5 tasks until timeout then IntegrityCheckFailed extracting tarball when installing #21493 - "Waiting for 5 tasks" timeout then IntegrityCheckFailed, exactly the symptom of extract tasks not draining from task queue
3. bun i randomly hangs without lockfile #13256 - Random hang without lockfile showing "waiting for 5 tasks" repeating indefinitely, consistent with dedupe map cleanup bug

If this is helpful, copy the block below into the PR description to auto-close these issues on merge.

Fixes #26341
Fixes #21493
Fixes #13256

🤖 Generated with Claude Code

[coderabbitai]

Walkthrough

Aligns tarball extraction failure handling with HTTP error handling by clearing network dedupe state, invoking download-error callbacks when present, and cleaning up task queue entries to prevent deadlocks. Adds a regression test that reproduces and verifies behavior for integrity-mismatch tarballs.

Changes

Cohort / File(s)	Summary
Tarball extraction error handling src/install/PackageManager/runTasks.zig	Adjusted extraction-failure control flow to clear network_dedupe_map for the failed task_id, invoke callbacks.onPackageDownloadError when provided (and continue), and on the void-callback path remove/deinitialize the related task_queue entry to avoid later deadlocks.
Regression test for integrity mismatch test/cli/install/bun-install-tarball-integrity.test.ts	Added a parameterized test (hoisted/isolated) that serves a tarball with mismatched bytes vs advertised SHA-512, asserting bun install prints "Integrity check failed", exits non-zero, and does not hang or report success.

Possibly related PRs

• fail instead of hanging when tarball download returns 4xx/5xx #29611: Closely related fixes to runTasks error handling—clearing network dedupe state and cleaning task queue entries on tarball/HTTP failures to prevent hangs.

🚥 Pre-merge checks | ✅ 4

✅ Passed checks (4 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title clearly and specifically summarizes the main change: fixing a hang in the isolated installer when tarball integrity checks fail.
Description check	✅ Passed	The description fully addresses the template with comprehensive explanations of what the PR does and how it was verified through testing.
Linked Issues check	✅ Passed	The changes directly address issue #29646 by fixing the tarball integrity failure hang in the isolated linker through proper cleanup of dedupe_map and task_queue entries.
Out of Scope Changes check	✅ Passed	All changes are scoped to fixing the integrity-check hang: modifications to runTasks.zig handle extract failures, and test additions verify the fix for both linkers.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

---

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[robobun]

Thanks. Looking at each:

• Bun install hangs when failing to fetch a dependency and in isolated linker mode #26341 — 401 Unauthorized, HTTP 4xx branch. That path is already fixed by fail instead of hanging when tarball download returns 4xx/5xx #29611 (which I build on here); my change is for the orthogonal extract-task branch. Not claiming.
• Regression in v1.2.19: Waiting for 5 tasks until timeout then IntegrityCheckFailed extracting tarball when installing #21493 — IntegrityCheckFailed extracting tarball matches the symptom exactly, but the issue doesn't specify linker = "isolated". My fix only removes the hang for isolated (hoisted already fails cleanly in both before/after). Too ambiguous to claim without repro confirmation.
• bun i randomly hangs without lockfile #13256 — from 1.1.22 (pre-isolated linker as default), no integrity-failure signal in the log. Too speculative.

Staying conservative with just Closes #29646.

[coderabbitai]

Actionable comments posted: 1

🤖 Prompt for all review comments with AI agents

Verify each finding against the current code and only fix it if needed.

Inline comments:
In `@test/cli/install/bun-install-tarball-integrity.test.ts`:
- Around line 495-507: Change the test matrix runner from
describe.concurrent.each to describe.each for the "tarball integrity mismatch
(%s)" block (the top-level describe that wraps the it("should fail (not hang)
when tarball bytes don't match manifest SHA-512") test) so the hoisted/isolated
variants run sequentially; keep the rest of the test (including the timeout:
60_000 and test body) unchanged to avoid CPU/IO contention and timing flakiness.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: ASSERTIVE

Plan: Pro

Run ID: 33ced23d-df21-4154-b1d4-9c86be76618e

📥 Commits

Reviewing files that changed from the base of the PR and between 48595f9 and 6728b9f.

📒 Files selected for processing (1)

• test/cli/install/bun-install-tarball-integrity.test.ts

[claude]

LGTM — extract-failure cleanup now mirrors the existing HTTP-error branches, and the test was strengthened per earlier feedback.

Extended reasoning...

Overview

This PR fixes an isolated-installer hang when tarball extraction fails (e.g., integrity check mismatch). It touches two files: src/install/PackageManager/runTasks.zig (the extract-task failure branch in the resolve-task loop) and test/cli/install/bun-install-tarball-integrity.test.ts (a new parameterized regression test for hoisted/isolated linkers).

The Zig change is a direct mirror of the cleanup pattern already established by #29611 for the two adjacent failure branches in the same function (metadata == null and status_code > 399): remove the network_dedupe_map entry before dispatching the error, and in the void-callback fallback also fetchRemove + deinit the task_queue entry. The if/else → if-continue-fallthrough refactor is mechanical and preserves the original addErrorFmt behavior on the fallback path.

Security risks

None. This is error-path cleanup in the package manager's task loop — no auth, crypto, permissions, or untrusted-input parsing changes. The integrity check itself is unchanged; only the post-failure bookkeeping is fixed.

Level of scrutiny

Moderate. runTasks.zig is a core install loop, but the change is small (~20 LOC of logic), copies an existing pattern verbatim from two sibling branches in the same function, and is well-explained in the PR description. The network_dedupe_map.remove is documented as a no-op for local_tarball tasks, and the task_queue drain matches the other branches exactly, so there's no double-free or ordering concern.

Other factors

I previously left an inline nit that the regression test wouldn't catch the hang (all assertions passed even when the spawn timeout killed the process). The author addressed this in commit 6728b9f by adding expect(proc.signalCode).toBeNull() as the load-bearing assertion, with a clear comment explaining why. No CODEOWNERS apply to src/install/. The bug-hunting system found no issues on the current revision.