fix(server): install registry plugins under npm 12

npm 12 rejects the reviewed tarball URL by default. Allow remote
artifacts only at the staging root while preserving the reviewed
version, URL and integrity checks. Read npm pack filenames so the
fixture registry supports the npm 12 output shape.

Closes #7794

Co-authored-by: 3ae3ae <ogyshjsm@naver.com>

packages/server/src/server/plugins/managed-source.posix.test.ts

@@ -522,7 +522,9 @@ it("installs and updates only the npm artifacts pinned by the plugin registry",
   const { resolveNpm } = await import("./managed-source/npm.js");
   const npm = await startNpmRegistry(npmPluginPackages());
   const previous = process.env.npm_config_userconfig;
+  const previousAllowRemote = process.env.npm_config_allow_remote;
   process.env.npm_config_userconfig = npm.userconfig;
+  process.env.npm_config_allow_remote = "none";
   const home = await mkdtemp(path.join(tmpdir(), "paseo-registry-npm-"));
   roots.push(home);
   const intents: Array<string | string[] | undefined> = [];
@@ -573,5 +575,7 @@ it("installs and updates only the npm artifacts pinned by the plugin registry",
     await npm.close();
     if (previous === undefined) delete process.env.npm_config_userconfig;
     else process.env.npm_config_userconfig = previous;
+    if (previousAllowRemote === undefined) delete process.env.npm_config_allow_remote;
+    else process.env.npm_config_allow_remote = previousAllowRemote;
   }
 }, 30_000);

packages/server/src/server/plugins/managed-source/npm.ts

@@ -57,6 +57,7 @@ export async function acquireNpm(source: string, installRoot: string, target?: N
     [
       "install",
       "--ignore-scripts",
+      "--allow-remote=root",
       "--legacy-peer-deps",
       "--no-audit",
       "--no-fund",

scripts/test-support/npm-registry.mts

@@ -71,12 +71,12 @@ export async function startNpmRegistry(packages: FixturePackage[]) {
     // Pack all fixtures in one npm process instead of paying startup once per package.
     const { stdout } = await execCommand(
       "npm",
-      ["pack", "--ignore-scripts", "--json", ...prepared.map(({ directory }) => directory)],
+      ["pack", "--ignore-scripts", ...prepared.map(({ directory }) => directory)],
       { cwd: root },
     );
-    const packed: Array<{ filename: string }> = JSON.parse(stdout);
+    const packed = stdout.trim().split(/\r?\n/);
     for (const { manifest, pkg, index } of prepared) {
-      const artifact = await readFile(path.join(root, packed[index].filename));
+      const artifact = await readFile(path.join(root, packed[index]));
       const artifactPath = `/artifacts/${index}.tgz`;
       artifacts.set(artifactPath, artifact);
       const published = {