Magic Context’s update checker fetches directly from public npm even when
the host is configured to use another registry. This breaks update checks
on networks where packages must be fetched through a mirror.
Reuse the CLI doctor’s registry resolver across:
The legacy OpenCode update hook.
The shared checker used by OpenCode 2.
The CLI’s pinned-plugin schema metadata lookup.
Honor npm_config_registry, then NPM_CONFIG_REGISTRY. Preserve explicit
per-check overrides and public npm as the default when unconfigured.
A failed mirror check does not retry against public npm.
The registry is selected as npm would: environment, then project .npmrc, then user .npmrc, then public npm, with a @cortexkit:registry entry taking priority. Only registry keys are read. npmrc authentication and updater enable/disable behaviour are unchanged. Tarball downloads stay on the selected registry.
Harness coverage (required)
OpenCode 1: covered by legacy-hook and checker regressions.
OpenCode 2: covered by the shared checker and notification-hook tests.
Pi: no equivalent plugin self-update surface; shared CLI checks covered.
OMP: no equivalent plugin self-update surface; shared CLI checks covered.
Rust module: not applicable; no matching npm update-check surface found.
Verification
51 updater/registry tests pass.
Four OpenCode 2 notification tests pass.
Two focused CLI registry/tarball tests pass.
Five routing regressions fail against stock upstream code.
Plugin and CLI typechecks and changed-file Biome checks pass.
A real check on a workstation with public npm blocked succeeded through
its configured mirror. Strace showed HTTPS only to that mirror.
The broader CLI tests pass 60/63 on both upstream and this branch, with the same three failures.
Summary by cubic
Update checks now honor the npm registry environment and user .npmrc instead of always querying public npm, so they work on networks that require a mirror.
Reuses the CLI doctor's registry resolver, now a shared module, across the legacy OpenCode update hook, the OpenCode 2 shared checker, and the CLI's pinned-plugin schema metadata lookup.
Resolves the registry as npm does: npm_config_registry or NPM_CONFIG_REGISTRY, then the user .npmrc (NPM_CONFIG_USERCONFIG or ~/.npmrc), then public npm. A @scope:registry entry takes priority, blank values are ignored, and explicit per-check overrides win.
A project .npmrc and npm's global config are never read, so a cloned repo can't choose where checks go. ${VAR} expansion and inline comment stripping apply only to the user .npmrc, preventing opened repositories from leaking environment secrets.
Pinned-plugin tarball downloads stay on the selected registry: upstream tarball URLs are moved onto it, tarballs from other hosts are refused, and an HTTPS registry is never downgraded to HTTP.
A failed mirror check does not retry against public npm. Only registry keys are read; npmrc authentication and updater enable/disable behavior are unchanged.
Confidence Score: 5/5
The PR appears safe to merge; no new actionable issues were found.
Summary
Update checks share a registry resolver that reads environment settings and user .npmrc settings. Explicit overrides still win, and failed mirror checks do not retry public npm.
OpenCode and CLI update checks use the registry configured by the host.
Pinned-plugin schema checks fetch package data through the selected registry.
