From ece30df76e8eed30a76cf8e7c30080e5e47d159c Mon Sep 17 00:00:00 2001
From: Sonarly Claude Code <claude-code@sonarly.com>
Date: Sat, 2 May 2026 16:16:58 +0000
Subject: [PATCH] fix: include yarn.lock in buildFileList for app install file
 uploads
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

https://sonarly.com/issue/33547?type=bug

When a third-party application is installed via the marketplace, the `buildFileList` method in `ApplicationInstallService` does not include `yarn.lock` in the files uploaded to S3, causing the yarn install Lambda to run without a lockfile and resolve all dependencies from scratch, which exceeds the 1024MB memory limit.

Fix: Added `yarn.lock` to the `buildFileList` method in `ApplicationInstallService`.

When commit `f3e0c12ce6a` ("Fix app install file upload #18593") refactored the file upload logic from a dynamic pattern-matching approach to an explicit manifest-based list, it accidentally dropped `yarn.lock` from the files uploaded to S3 during third-party app installation. The original code had:

```typescript
const FILE_FOLDER_MAPPING: Record<string, FileFolder> = {
  'package.json': FileFolder.Dependencies,
  'yarn.lock': FileFolder.Dependencies,  // ← This was lost
};
```

The refactored code only included `package.json`:

```typescript
files.push(
  { relativePath: 'package.json', fileFolder: FileFolder.Dependencies },
  { relativePath: 'manifest.json', fileFolder: FileFolder.Source },
);
```

The fix adds `yarn.lock` back to the list:

```typescript
files.push(
  { relativePath: 'package.json', fileFolder: FileFolder.Dependencies },
  { relativePath: 'yarn.lock', fileFolder: FileFolder.Dependencies },
  { relativePath: 'manifest.json', fileFolder: FileFolder.Source },
);
```

Without this, when a logic function from an installed app is executed, the Lambda driver's `copyDependenciesInMemory` finds no `yarn.lock` in S3, falls back to an empty lockfile stub, and the yarn install Lambda must resolve all dependencies from scratch — exceeding the 1024MB memory limit and crashing with `Runtime.OutOfMemory`.

**Note:** Workspaces that already have installed apps with missing `yarn.lock` files will need to re-install those apps for the fix to take effect. The `copyDependenciesInMemory` fallback (empty lockfile stub) will continue to be hit for already-installed apps until they are re-installed or upgraded.
---
 .../application-install/application-install.service.ts           | 1 +
 1 file changed, 1 insertion(+)

diff --git a/packages/twenty-server/src/engine/core-modules/application/application-install/application-install.service.ts b/packages/twenty-server/src/engine/core-modules/application/application-install/application-install.service.ts
index 55ada635feb..71b0f8f9ce4 100644
--- a/packages/twenty-server/src/engine/core-modules/application/application-install/application-install.service.ts
+++ b/packages/twenty-server/src/engine/core-modules/application/application-install/application-install.service.ts
@@ -482,6 +482,7 @@ export class ApplicationInstallService {
 
     files.push(
       { relativePath: 'package.json', fileFolder: FileFolder.Dependencies },
+      { relativePath: 'yarn.lock', fileFolder: FileFolder.Dependencies },
       { relativePath: 'manifest.json', fileFolder: FileFolder.Source },
     );