From c6d1822e2be5082691ebc45d50ea0eb54c674910 Mon Sep 17 00:00:00 2001
From: "paseo-bot[bot]" <266920839+paseo-bot[bot]@users.noreply.github.com>
Date: Mon, 2 Nov 2026 07:24:18 +0000
Subject: [PATCH] fix(server): install registry plugins under npm 12

npm 12 rejects the reviewed tarball URL by default. Allow remote
artifacts only at the staging root while preserving the reviewed
version, URL and integrity checks. Read npm pack filenames so the
fixture registry supports the npm 12 output shape.

Closes #7794

Co-authored-by: 3ae3ae <ogyshjsm@naver.com>
---
 .../server/src/server/plugins/managed-source.posix.test.ts  | 4 ++++
 packages/server/src/server/plugins/managed-source/npm.ts    | 1 +
 scripts/test-support/npm-registry.mts                       | 6 +++---
 3 files changed, 8 insertions(+), 3 deletions(-)

diff --git a/packages/server/src/server/plugins/managed-source.posix.test.ts b/packages/server/src/server/plugins/managed-source.posix.test.ts
index 7b694f1ef3..0a514bb687 100644
--- a/packages/server/src/server/plugins/managed-source.posix.test.ts
+++ b/packages/server/src/server/plugins/managed-source.posix.test.ts
@@ -522,7 +522,9 @@ it("installs and updates only the npm artifacts pinned by the plugin registry",
   const { resolveNpm } = await import("./managed-source/npm.js");
   const npm = await startNpmRegistry(npmPluginPackages());
   const previous = process.env.npm_config_userconfig;
+  const previousAllowRemote = process.env.npm_config_allow_remote;
   process.env.npm_config_userconfig = npm.userconfig;
+  process.env.npm_config_allow_remote = "none";
   const home = await mkdtemp(path.join(tmpdir(), "paseo-registry-npm-"));
   roots.push(home);
   const intents: Array<string | string[] | undefined> = [];
@@ -573,5 +575,7 @@ it("installs and updates only the npm artifacts pinned by the plugin registry",
     await npm.close();
     if (previous === undefined) delete process.env.npm_config_userconfig;
     else process.env.npm_config_userconfig = previous;
+    if (previousAllowRemote === undefined) delete process.env.npm_config_allow_remote;
+    else process.env.npm_config_allow_remote = previousAllowRemote;
   }
 }, 30_000);
diff --git a/packages/server/src/server/plugins/managed-source/npm.ts b/packages/server/src/server/plugins/managed-source/npm.ts
index 315bbc981e..9f1aa29e99 100644
--- a/packages/server/src/server/plugins/managed-source/npm.ts
+++ b/packages/server/src/server/plugins/managed-source/npm.ts
@@ -57,6 +57,7 @@ export async function acquireNpm(source: string, installRoot: string, target?: N
     [
       "install",
       "--ignore-scripts",
+      "--allow-remote=root",
       "--legacy-peer-deps",
       "--no-audit",
       "--no-fund",
diff --git a/scripts/test-support/npm-registry.mts b/scripts/test-support/npm-registry.mts
index 5640487049..774ac7d1d8 100644
--- a/scripts/test-support/npm-registry.mts
+++ b/scripts/test-support/npm-registry.mts
@@ -71,12 +71,12 @@ export async function startNpmRegistry(packages: FixturePackage[]) {
     // Pack all fixtures in one npm process instead of paying startup once per package.
     const { stdout } = await execCommand(
       "npm",
-      ["pack", "--ignore-scripts", "--json", ...prepared.map(({ directory }) => directory)],
+      ["pack", "--ignore-scripts", ...prepared.map(({ directory }) => directory)],
       { cwd: root },
     );
-    const packed: Array<{ filename: string }> = JSON.parse(stdout);
+    const packed = stdout.trim().split(/\r?\n/);
     for (const { manifest, pkg, index } of prepared) {
-      const artifact = await readFile(path.join(root, packed[index].filename));
+      const artifact = await readFile(path.join(root, packed[index]));
       const artifactPath = `/artifacts/${index}.tgz`;
       artifacts.set(artifactPath, artifact);
       const published = {