[Cedric Vidal (cedricvidal)]

Summary

Ordinary npm package proxies were being assigned to both NPM_CONFIG_REGISTRY and COREPACK_NPM_REGISTRY. That treated packument/package endpoints as though they also implemented Corepack's metadata protocol, producing malformed or unsupported per-version URLs. When Corepack failed, the pinned npm fallback reused the same endpoint, coupling both bootstrap paths to one failure domain.

This layer:

• centralizes pinned pnpm 10.29.1 bootstrap behavior in scripts/bootstrap-pnpm.sh and uses it consistently across every Node Docker image;
• keeps NPM_CONFIG_REGISTRY for ordinary npm/pnpm package resolution, while COREPACK_NPM_REGISTRY is unset by default and used only when explicitly configured with a Corepack-compatible endpoint;
• clears COREPACK_NPM_REGISTRY for the pinned npm fallback, so an incompatible Corepack metadata endpoint cannot trap the fallback;
• normalizes trailing slashes, rejects credential-bearing/query/fragment URLs, and logs only sanitized endpoint origins rather than secret-bearing URLs;
• preserves authenticated/private package registry support through standard npm authentication configuration without baking credentials into image history or build output; and
• leaves every pnpm install invocation unwrapped, preserving pnpm's built-in package-fetch retries and actionable exhausted-retry diagnostics.

Stack context: this is layer 3 of the native-stack series. The draft PR targets cedricvidal-harden-agent-registration (#1602), currently at be95df38c8325b05124f386695952d46a7aeedf8. This PR's head is 9406483ab1acc86d0a5386ab2d424348d6291bd9.

Demos

N/A — Docker build configuration only.

Before

N/A

After

N/A

Testing

• PASS — pnpm exec vitest run scripts/bootstrap-pnpm.test.ts scripts/docker-compose.test.ts --reporter=default (2 files, 8 tests). Covers public defaults, an ordinary package proxy that is not a Corepack registry, trailing-slash normalization, explicit Corepack override, npm fallback independence, secret-safe rejection/diagnostics, all Node Dockerfiles using the shared contract, and no pnpm retry-policy overrides.
• PASS — sh -n scripts/bootstrap-pnpm.sh scripts/dev-compose.sh.
• PASS — NPM_CONFIG_REGISTRY=https://packages.example.test/npm/ COREPACK_NPM_REGISTRY=https://corepack.example.test/ docker compose --profile copilot config --format json, with assertions that both api and coder-acp-copilot receive the distinct build arguments.
• PASS — docker build --target deps -f apps/portal/Dockerfile --build-arg NPM_CONFIG_REGISTRY=https://packagefeedproxy.microsoft.io/npm/ .. In the restricted development network, Corepack's default public fetch failed, then the pinned npm fallback installed pnpm through the ordinary Microsoft package proxy and the normal pnpm install completed successfully. This directly exercises the separated failure domains.
• EXPECTED NETWORK LIMITATION — the same representative build with NPM_CONFIG_REGISTRY=https://registry.npmjs.org/ could not establish a TLS connection to the public registry from this environment; both Corepack and npm reported network failures. The proxy-backed build above provides the representative networked image validation.
• PASS — pnpm headers:check after synchronizing the updated lower layer (966/966 in-scope files).
• PASS — git diff --check origin/cedricvidal-harden-agent-registration...HEAD.
• PASS — final-base CI run 41752955751: License Headers, Third-party NOTICE, Unit Tests (Node 22), Integration Tests (Copilot ACP, Claude Code ACP, and queue recovery), Lint Code, Build Applications, Windows Worker Build, CLI Bundle Integration Tests, gitleaks, CLA, and CI Summary all succeeded. Gateway and LLM Evals were skipped by change detection.

Documentation and compatibility

Updated .env.example and ENV_VARIABLES.md with the supported one-command package-registry override, explicit Corepack-compatible override semantics, credential-safe URL requirements, fallback isolation, and preserved pnpm retry behavior.

No dependency manifests, runtime APIs, Portal/CLI behavior, database schemas, or production deployment contracts changed. Existing private package proxy selection remains supported through NPM_CONFIG_REGISTRY; COREPACK_NPM_REGISTRY is now an explicit opt-in for compatible metadata endpoints. No migration or upgrade step is required unless an environment intentionally needs a custom Corepack registry, in which case it must export COREPACK_NPM_REGISTRY separately.

Checklist

• N/A — Portal features did not change; no CLI parity work required.
• N/A — Portal components did not change; no Storybook updates required.
• N/A — No database changes or migrations.
• N/A — No dependencies or lockfile changes; NOTICE regeneration is not required.
• N/A — No user-visible behavior requiring a before video.
• N/A — No user-visible behavior requiring an after video.

[github-actions]

Test Results (Node.js 22)

test: Run #445

Tests 📝	Passed ✅	Failed ❌	Skipped ⏭️	Pending ⏳	Other ❓	Flaky 🍂	Duration ⏱️
3245	3245	0	0	0	0	0	1m1s

🎉 All tests passed!

Github Test Reporter

[github-actions]

Test Results (Node.js 22)

test: Run #453

Tests 📝	Passed ✅	Failed ❌	Skipped ⏭️	Pending ⏳	Other ❓	Flaky 🍂	Duration ⏱️
3245	3245	0	0	0	0	0	1m32s

🎉 All tests passed!

Github Test Reporter

[github-actions]

Test Results (Node.js 22)

test: Run #459

Tests 📝	Passed ✅	Failed ❌	Skipped ⏭️	Pending ⏳	Other ❓	Flaky 🍂	Duration ⏱️
3245	3245	0	0	0	0	0	1m2s

🎉 All tests passed!

Github Test Reporter

[github-actions]

Test Results (Node.js 22)

test: Run #478

Tests 📝	Passed ✅	Failed ❌	Skipped ⏭️	Pending ⏳	Other ❓	Flaky 🍂	Duration ⏱️
3245	3245	0	0	0	0	0	1m32s

🎉 All tests passed!

Github Test Reporter

[github-actions]

Test Results (Node.js 22)

test: Run #495

Tests 📝	Passed ✅	Failed ❌	Skipped ⏭️	Pending ⏳	Other ❓	Flaky 🍂	Duration ⏱️
3245	3245	0	0	0	0	0	1m28s

🎉 All tests passed!

Github Test Reporter