bug: Sharp 0.35 fails in dev after external symlink targets dist directory #4511

Provide environment information

System:
OS: macOS 26.5.2
CPU: (12) arm64 Apple M2 Pro
Memory: 102.86 MB / 16.00 GB
Shell: 5.9 - /bin/zsh

Binaries:
Node: 24.15.0
npm: 11.12.1
pnpm: 11.10.0
bun: 1.3.14

Describe the bug

When trigger dev processes a task importing sharp@0.35.3, automatic external detection creates the generated worker's node_modules/sharp symlink pointing to Sharp's dist directory instead of its package root.

This bypasses Sharp's root package.json, which defines its dist/index.mjs and dist/index.cjs entry points. Node consequently looks for sharp/index.js, which does not exist, and task indexing fails with ERR_MODULE_NOT_FOUND.

Importing the same Sharp installation directly outside Trigger.dev works correctly.

Expected behavior: the task is indexed and the local worker becomes ready.

Reproduction repo

http://github.com/benpixel/trigger-sharp-035-repro

To reproduce

1. Clone and install the reproduction:

   git clone http://github.com/benpixel/trigger-sharp-035-repro.git
   cd trigger-sharp-035-repro
   pnpm install

2. Authenticate the Trigger.dev CLI and provide a valid project ref:

   TRIGGER_PROJECT_REF=proj_your_project_ref pnpm dev

3. Task indexing fails with:

   Error: Could not import trigger/sharp-task.ts
   
   Error: Cannot find package '.../node_modules/sharp/index.js'
   imported from '.../trigger/sharp-task.mjs'
   
   Did you mean to import "sharp/dist/index.cjs"?
   

Additional information

Confirmed with:

• trigger.dev@4.5.9
• @trigger.dev/sdk@4.5.9
• sharp@0.35.3
• Node.js 24.15.0
• pnpm 11.10.0

The generated symlink was inspected while trigger dev was running:

.trigger/tmp/build-*/node_modules/sharp
  -> node_modules/.pnpm/sharp@0.35.3_*/node_modules/sharp/dist

Importing Sharp directly succeeds:

node --input-type=module -e 'const { default: sharp } = await import("sharp"); console.log(sharp.versions.sharp)'

0.35.3

Controls:

• Pinning Sharp to 0.34.5 allows the local worker to become ready.
• Setting build.autoDetectExternal to false also avoids the failure, but disables automatic externalization globally.
• The minimal reproduction contains no Next.js dependency.

The relevant external-linking implementation appears to be here:

http://github.com/triggerdotdev/trigger.dev/blob/v4.5.9/packages/cli-v3/src/build/externals.ts#L30-L78