Repository navigation
Updater ignores configured npm registry #854
Description
Short description
Update checker ignores configured npm registry
What happened?
Magic Context’s background update checker contacts registry.npmjs.org directly despite a configured npm mirror. Normal npm/Bun queries through that mirror work, but the plugin’s check fails when public npm is blocked.
Reproduced with Magic Context 0.33.1 and OpenCode 1.18.33. The same checker succeeds when its internal registry override points at the mirror. The published 0.49.35 package still has the public-registry default.
Please respect the configured npm registry and provide a consistent way to disable checks. In the legacy hook, auto_update: false still performs the request; the inspected OpenCode 2 implementation skips its checker when disabled.
Diagnostics
Plugin version
0.33.1
OpenCode version
1.18.33
Platform
Linux x86-64
Client
OpenCode TUI (CLI)
Log output (optional)
Reacted by magic-alfonso
Activity
Oscar-Williams commentedon Nov 6, 2026
Picking this up. Two parts, both scoped to
packages/plugin/src/hooks/auto-update-checker:NPM_REGISTRY_URL. I'll resolve the registry the standard npm way:process.env.npm_config_registryfirst (bun/npm both export it to child processes), then the.npmrcchain (project → user), falling back to the default. No new dependencies — the INI read is a few lines.auto_update: falsethe hook currently still performs the npm request (autoUpdateonly gates the auto-install step after the fetch). I'll skip the whole checker when the operator disabled updates, matching the OpenCode 2 updater behavior you inspected.Both get focused tests in
checker.test.ts/index.test.tsfollowing the existing patterns.Oscar-Williams commentedon Nov 6, 2026
Draft PR: #870 — ready for review whenever the design looks right. Scope recap: registry resolution (env → project .npmrc → user .npmrc → default, fail-open) and
auto_update: falseskipping the checker entirely (matching the OpenCode 2 updater behavior noted above). 8 focused tests on the resolver, the disabled-hook path is pinned in index.test.ts, and no new dependencies — the INI read is a few lines. Harness coverage: the checker only exists on the OpenCode plugin surface (Pi/OMP/Rust marked N/A in the PR).magic-alfonso commentedon Nov 6, 2026
Thanks for picking this up, @Oscar-Williams. The registry part is already covered by #855, which is in review: the update checker resolves the registry from
npm_config_registryand the user's~/.npmrc, and expands${VAR}only within that user file. Project-level.npmrcfiles are deliberately not read. A project folder could otherwise send the update check, and any token in that file, to a registry the user never chose.The second part of your plan isn't in #855: with
auto_update: false, the OpenCode 1 hook still makes the npm request. A small separate PR that skips the whole check when updates are disabled, matching the OpenCode 2 updater, would be welcome. Please base it on #855's branch, or keep it to the disable path so the two don't conflict.