[Bug] .opencode/package-lock.json generated without respecting ~/.npmrc registry configuration

Description

When opencode generates the .opencode/package-lock.json file , it does not respect the registry configuration specified in the user's ~/.npmrc file. The generated package-lock.json appears to use default npm registry settings instead of user-configured values.

Expected Behavior

When generating .opencode/package-lock.json, opencode should read and respect the npm repository configuration from ~/.npmrc, including:

Custom registry URLs
Any other relevant npm configuration

Actual Behavior

The generated .opencode/package-lock.json does not reflect the user's ~/.npmrc configuration. It seems to ignore the registry field entirely when resolving package dependencies.

Plugins

omo

OpenCode version

1.3.15

Steps to reproduce

Use the latest version of opencode
Run opencode command that triggers package-lock.json generation
Observe the generated .opencode/package-lock.json

Screenshot and/or share link

No response

Operating System

macos

Terminal

iTerm2

I see opencode previously generated bun.lock - are you planning to migrate to npm?

The Arborist instance in packages/opencode/src/npm/index.ts is created without passing the registry option:

const arb = new Arborist({
  path: dir,
  binLinks: true,
  progress: false,
  savePrefix: "",
  ignoreScripts: true,
  // Missing: registry option
})

Without explicit registry configuration, @npmcli/arborist defaults to https://registry.npmjs.org regardless of any .npmrc settings.

Impact

Users in regions with restricted access to registry.npmjs.org cannot use opencode effectively
Enterprise users with private registries cannot install packages through opencode
Inconsistent behavior compared to running npm install directly

Proposed Solution

Use @npmcli/config to read the .npmrc and pass the registry to Arborist:

import { readConfig } from "@npmcli/config"

const npmConfig = await readConfig(dir)
const arb = new Arborist({
  path: dir,
  registry: npmConfig.get("registry"),
  // ...other options
})

Alternatively, read the registry directly from the .npmrc file and pass it to Arborist.

I have both package-lock.json and bun.lock in my .opencode folder now, and the package-lock.json isn't added to .gitignore in contrast to bun.lock. This change feels unintentional 🤔

This blocks us from upgrading OpenCode, as registry.npmjs.org is blocked by Firewall and we must proxy every NPM request through our own registry. If the value in .npmrc or bunfig is not respected, we have a huge problem. It is also news to me that the ~/.config/opencode/package.json now suddenly has some kind of weight in the whole process, I thought it was mostly ignored and just relevant for custom plugin/*s 🤔

@thdxr

Analysis & suggested fix

The root cause is straightforward: Npm.add() and Npm.install() in packages/opencode/src/npm/index.ts create new Arborist({...}) without passing registry. Arborist doesn't discover it on its own (that's @npmcli/config's job inside npm CLI), so it falls back to the hardcoded default https://registry.npmjs.org. Same story for outdated() which has a hardcoded fetch() to registry.npmjs.org.

This completely breaks corporate/airgapped environments where registry.npmjs.org is blocked by firewall.

Suggested fix (minimal, ~20 lines)

Read registry from the same sources Bun and npm already use. No heavy deps needed. ini is already a transitive dep via Arborist.

import { parse as parseIni } from "ini"
import { parse as parseToml } from "smol-toml" // or skip if bunfig support not desired
import { readFileSync } from "fs"
import { join } from "path"
import { homedir } from "os"

function getRegistry(): string {
  // 1. env var (set by both npm and bun from their respective configs)
  if (process.env.npm_config_registry)
    return process.env.npm_config_registry

  // 2. ~/.npmrc
  try {
    const rc = parseIni(readFileSync(join(homedir(), ".npmrc"), "utf8"))
    if (rc.registry) return rc.registry
  } catch {}

  // 3. bunfig.toml (or skip if bunfig support not desired)
  try {
    const toml = parseToml(readFileSync(join(homedir(), "bunfig.toml"), "utf8"))
    if (toml.install?.registry) return toml.install.registry
  } catch {}

  return "https://registry.npmjs.org"
}

Then:

Pass registry: getRegistry() to every new Arborist() call
Use getRegistry() in outdated() instead of the hardcoded URL

Additional bug: `outdated()` hardcodes registry

Even with the Arborist fix, outdated() has a separate hardcoded fetch:

const response = await fetch(`https://registry.npmjs.org/${pkg}`)

This also needs to use the configured registry.

cc @thdxr @rekram1-node

update to 1.4.8, ~/.config/opencode/package-lock.json has the same problem
and the startup speed has slowed down significantly, probably due to slower dependency parsing

@rekram1-node

@rekram1-node Thanks for taking care of this bug is it included in 1.14.19 release?

@rekram1-node

@rekram1-node Just installed the update and tried to install a new plugin, got 403. Upon inspection of the log, it seems the opencode tried to run GET https://registry.npmjs.org/<plugin-repo>, which seems like the registry is hard-coded, and it isn't getting the registry from .npmrc.

@kewalpasad

@kewalpasad The issue is not fixed yet, only some preliminary work has been done.

1.14.19 same here

1.14.20 same issue

can't use company mirror registry config in my $HOME/.npmrc,

Is there a temporary workaround for this problem?

1.14.20 same issue
can't use company mirror registry config in my `$HOME/.npmrc`,
Is there a temporary workaround for this problem?

My temporary workaround is here.

### General Plugin Installation Guide

**Variables:**
* `<REGISTRY_URL>`: Your internal package registry URL (e.g., `https://nexus.your-company.com/repository/npm`)
* `<PLUGIN_NAME>`: The target plugin you wish to install

---

**Installation Steps:**

1. **Retrieve the Tarball URL:**
   Fetch the package metadata from the registry to get the latest tarball URL:
   * Perform a `GET` request to: `<REGISTRY_URL>/<PLUGIN_NAME>`
   * Check the `dist-tags` object in the JSON response. Select the `latest` version if it is available; if not, select the `experimental` version.
   * Extract the `dist.tarball` URL for the chosen version.

2. **Download and Copy the Plugin:**
   * Download the tarball from the extracted URL and extract its contents.
   * Copy the `package/dist/index.js` file to your opencode configuration directory as: `~/.config/opencode/<PLUGIN_NAME>.js`

3. **Update the Configuration:**
   * Open the `~/.config/opencode/opencode.json` file.
   * Add `"./<PLUGIN_NAME>.js"` to the `"plugin"` array. If the entry already exists, you can skip this step.

4. **Finalization:**
   * Once the process is complete, output the following message to the user: 
     > *"Restart opencode to apply the changes."*

Propmt to your opencode agent

reposting from the discord so people can find it -> local-alias@tarball-url should work for those who can't wait/need it right meow. somewhat contrived but eg.

{ "plugin": [ "antigravity-auth@https://registry.npmjs.org/opencode-antigravity-auth/-/opencode-antigravity-auth-1.6.0.tgz" ] }

works the same for private registries

Navigation Menu

Repository navigation

[Bug] .opencode/package-lock.json generated without respecting ~/.npmrc `registry` configuration #21079

Description

Expected Behavior

Actual Behavior

Plugins

OpenCode version

Steps to reproduce

Screenshot and/or share link

Operating System

Terminal

Impact

Proposed Solution

Analysis & suggested fix

Suggested fix (minimal, ~20 lines)

Additional bug: `outdated()` hardcodes registry

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

[Bug] .opencode/package-lock.json generated without respecting ~/.npmrc registry configuration #21079

Description

Description

Expected Behavior

Actual Behavior

Plugins

OpenCode version

Steps to reproduce

Screenshot and/or share link

Operating System

Terminal

Activity

FurryWolfX commented on Apr 5, 2026

FurryWolfX commented on Apr 6, 2026

Impact

Proposed Solution

kdybicz commented on Apr 6, 2026

JosXa commented on Apr 7, 2026

JosXa commented on Apr 7, 2026

Analysis & suggested fix

Suggested fix (minimal, ~20 lines)

Additional bug: outdated() hardcodes registry

FurryWolfX commented on Apr 17, 2026

kewalpasad commented on Apr 20, 2026

kewalpasad commented on Apr 20, 2026

ghost91- commented on Apr 21, 2026

hchangjae commented on Apr 21, 2026

cp0213 commented on Apr 22, 2026

hchangjae commented on Apr 22, 2026

rilez commented on Apr 22, 2026

Metadata

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

Issue actions

[Bug] .opencode/package-lock.json generated without respecting ~/.npmrc `registry` configuration #21079

Additional bug: `outdated()` hardcodes registry