The `patches` attribute was being applied inside the npmDeps fixed-output derivation where patch runs interactively and fails. sourceRoot also caused the deps fetcher to hash a different tree than expected. Now: - postUnpack cds into the subdir for both the fetcher and main build - postPatch applies the mining-pool patch only in the main build - npmDepsHash values remain placeholders (lib.fakeHash)