Npm.outdated() and @npmcli/arborist in src/npm/index.ts ignore user's npm registry config — plugin install hanging in some area #21324

Description

Desc

PR #4958 fixed the hardcoded registry in installation/index.ts (opencode upgrade), but the same problem exists in packages/opencode/src/npm/index.ts — the Npm module used for plugin dependency installation and package outdated checks.
This causes opencode serve to take 5-12 minutes to start when .opencode/plugins/ contains local plugins, because npm package resolution bypasses the user's configured registry (e.g. China mirror) and hits registry.npmjs.org directly.

Affected code

1. Npm.outdated() — hardcoded registry (same as #4830)

// packages/opencode/src/npm/index.ts
export async function outdated(pkg: string, cachedVersion: string): Promise<boolean> {
  const response = await fetch(`https://registry.npmjs.org/${pkg}`)  // ← hardcoded
  ...
}

2. Npm.add() and Npm.install() — @npmcli/arborist without registry option

const arborist = new Arborist({
  path: dir,
  binLinks: true,
  progress: false,
  savePrefix: "",
  ignoreScripts: true,
  // ← no `registry` option — does not respect ~/.npmrc in all environments
})

@npmcli/arborist can read ~/.npmrc in some cases, but in practice it does not pick up the user's registry config when invoked from within the opencode Bun process. Users who set registry=https://registry.npmmirror.com/ in ~/.npmrc still see requests going to registry.npmjs.org.

Impact

• Any user behind a slow/blocked connection to registry.npmjs.org (common in China, corporate firewalls) experiences 5-12 min startup delay when using plugins
• GET /global/health returns healthy: true immediately, making it appear the server is ready when it isn't — downstream tools that rely on health checks enter a broken state
• This affects both local plugins (.opencode/plugins/) and npm plugins ("plugin": [...] in config)

Suggested fix

1. Npm.outdated(): Read user's registry config (same approach as PR fix: respect npm registry #4958):

   import { execSync } from "child_process"
   
   function getRegistryUrl(): string {
     try {
       return execSync("npm config get registry", { encoding: "utf-8" }).trim()
     } catch {
       return "https://registry.npmjs.org"
     }
   }

2. Npm.add() / Npm.install(): Pass registry to Arborist constructor:

   const registry = getRegistryUrl()
   const arborist = new Arborist({
     path: dir,
     registry,       // ← respect user config
     ...
   })

• opencode upgrade has hardcoded registry #4830 — same hardcoded registry problem in installation/index.ts (fixed by PR fix: respect npm registry #4958)

Plugins

No response

OpenCode version

1.3.17

Steps to reproduce

1. Configure npm mirror in ~/.npmrc:

   registry=https://registry.npmmirror.com/
   

2. Create a workspace with a local plugin:

   mkdir -p ~/test-workspace/.opencode/plugins
   cat > ~/test-workspace/.opencode/plugins/hello.js << 'EOF'
   export default async (ctx) => {
     console.log("Hello plugin loaded");
     return {};
   };
   EOF

3. Start opencode:

   cd ~/test-workspace && opencode serve --port 4096

4. In another terminal, monitor the SSE stream:

   curl -N http://localhost:4096/event

5. Observe: server.connected event takes 5-12 minutes to appear. During this time GET /global/health returns { healthy: true }, but all other API endpoints are blocked.
6. Workaround: If you pre-install dependencies manually before starting opencode, it starts in ~10 seconds:

   cd ~/test-workspace/.opencode
   echo '{"dependencies":{"@opencode-ai/plugin":"1.3.17"}}' > package.json
   npm install && npm install --package-lock-only
   # Now opencode serve starts in ~10s

Screenshot and/or share link

Operating System

macOS arm64

Terminal

ghostty