From f69d9155742168053aae46392c96e72baf2e6515 Mon Sep 17 00:00:00 2001
From: awhite0030 <290751558+awhite0030@users.noreply.github.com>
Date: Fri, 11 Sep 2026 14:38:51 +0000
Subject: [PATCH] fix(coding-agent): add allow-remote overrides for self-update
 on npm 12

---
 .../.changes/fix-npm12-self-update.md         |  1 +
 packages/coding-agent/src/config.ts           | 19 +++++++++--
 .../coding-agent/src/package-manager-cli.ts   |  1 +
 .../2163-npm12-self-update.test.ts            | 32 +++++++++++++++++++
 4 files changed, 50 insertions(+), 3 deletions(-)
 create mode 100644 packages/coding-agent/.changes/fix-npm12-self-update.md
 create mode 100644 packages/coding-agent/test/suite/regressions/2163-npm12-self-update.test.ts

diff --git a/packages/coding-agent/.changes/fix-npm12-self-update.md b/packages/coding-agent/.changes/fix-npm12-self-update.md
new file mode 100644
index 0000000000..8234ff2d48
--- /dev/null
+++ b/packages/coding-agent/.changes/fix-npm12-self-update.md
@@ -0,0 +1 @@
+- Fixed self-update failing under npm 12 by applying the same policy overrides (`allow-remote=all`, `allow-scripts=<tarball>`) used by the installer when fetching the release artifact ([#2163](https://github.com/PrimeIntellect-ai/prime-agent/issues/2163)).
diff --git a/packages/coding-agent/src/config.ts b/packages/coding-agent/src/config.ts
index 596d468d1a..5b0954fd44 100644
--- a/packages/coding-agent/src/config.ts
+++ b/packages/coding-agent/src/config.ts
@@ -48,6 +48,8 @@ interface SelfUpdateCommandStep {
 	command: string;
 	args: string[];
 	display: string;
+
+	env?: Record<string, string>;
 }
 
 export interface SelfUpdateCommand extends SelfUpdateCommandStep {
@@ -74,11 +76,16 @@ function makeSelfUpdateCommand(
 	};
 }
 
-function makeSelfUpdateCommandStep(command: string, args: string[]): SelfUpdateCommandStep {
+function makeSelfUpdateCommandStep(
+	command: string,
+	args: string[],
+	env?: Record<string, string>,
+): SelfUpdateCommandStep {
 	return {
 		command,
 		args,
 		display: [command, ...args].map((arg) => (/\s/.test(arg) ? `"${arg}"` : arg)).join(" "),
+		...(env ? { env } : {}),
 	};
 }
 
@@ -150,7 +157,7 @@ function getDefaultUpdatePackageName(installedPackageName: string, updateSpec: s
 	return updateSpec;
 }
 
-function getSelfUpdateCommandForMethod(
+export function getSelfUpdateCommandForMethod(
 	method: InstallMethod,
 	installedPackageName: string,
 	updateSpec = installedPackageName,
@@ -190,7 +197,13 @@ function getSelfUpdateCommandForMethod(
 			const [command = "npm", ...npmArgs] = npmCommand ?? [];
 			const inferred = npmCommand?.length ? undefined : getInferredNpmInstall();
 			const prefixArgs = [...npmArgs, ...(inferred ? ["--prefix", inferred.prefix] : [])];
-			const installStep = makeSelfUpdateCommandStep(command, [...prefixArgs, "install", "-g", updateSpec]);
+			const env: Record<string, string> | undefined = isDirectPackageArtifactSpec(updateSpec)
+				? {
+						npm_config_allow_remote: "all",
+						npm_config_allow_scripts: updateSpec,
+					}
+				: undefined;
+			const installStep = makeSelfUpdateCommandStep(command, [...prefixArgs, "install", "-g", updateSpec], env);
 			const uninstallStep =
 				updatePackageName === installedPackageName
 					? undefined
diff --git a/packages/coding-agent/src/package-manager-cli.ts b/packages/coding-agent/src/package-manager-cli.ts
index adec93e9ae..003134f3c2 100644
--- a/packages/coding-agent/src/package-manager-cli.ts
+++ b/packages/coding-agent/src/package-manager-cli.ts
@@ -468,6 +468,7 @@ async function runSelfUpdate(command: SelfUpdateCommand): Promise<void> {
 			const child = spawn(step.command, step.args, {
 				stdio: "inherit",
 				shell: shouldUseWindowsShell(step.command),
+				env: step.env ? { ...process.env, ...step.env } : process.env,
 			});
 			child.on("error", (error) => {
 				reject(error);
diff --git a/packages/coding-agent/test/suite/regressions/2163-npm12-self-update.test.ts b/packages/coding-agent/test/suite/regressions/2163-npm12-self-update.test.ts
new file mode 100644
index 0000000000..9dab60f053
--- /dev/null
+++ b/packages/coding-agent/test/suite/regressions/2163-npm12-self-update.test.ts
@@ -0,0 +1,32 @@
+import { describe, expect, it } from "vitest";
+import { getSelfUpdateCommandForMethod } from "../../../src/config.js";
+
+describe("issue #2163 self-update npm 12 allow-remote", () => {
+	it("adds allow-remote and allow-scripts to env for direct package artifacts", () => {
+		const artifactUrl =
+			"https://github.com/PrimeIntellect-ai/prime-agent/releases/download/v0.9.4/prime-agent-0.9.4.tgz";
+		const command = getSelfUpdateCommandForMethod("npm", "prime-agent", artifactUrl, ["npm"], "prime-agent");
+
+		expect(command).toBeDefined();
+		if (!command) throw new Error("Expected command to be defined");
+
+		// For an update where package name matches, the command itself is the install step
+		const installStep = command.steps ? command.steps[0] : command;
+
+		expect(installStep.env).toBeDefined();
+		expect(installStep.env).toEqual({
+			npm_config_allow_remote: "all",
+			npm_config_allow_scripts: artifactUrl,
+		});
+	});
+
+	it("does not add env for registry specs", () => {
+		const command = getSelfUpdateCommandForMethod("npm", "prime-agent", "prime-agent@latest", ["npm"], "prime-agent");
+
+		expect(command).toBeDefined();
+		if (!command) throw new Error("Expected command to be defined");
+
+		const installStep = command.steps ? command.steps[0] : command;
+		expect(installStep.env).toBeUndefined();
+	});
+});