fix(coding-agent): apply allow-remote overrides for self-update via npm 12

packages/coding-agent/.changes/fix-npm12-self-update.md

@@ -0,0 +1 @@
+- Fixed self-update failing under npm 12 by applying the same policy overrides (`allow-remote=all`, `allow-scripts=<tarball>`) used by the installer when fetching the release artifact ([#2163](https://github.com/PrimeIntellect-ai/prime-agent/issues/2163)).

packages/coding-agent/src/config.ts

@@ -48,6 +48,8 @@ interface SelfUpdateCommandStep {
 	command: string;
 	args: string[];
 	display: string;
+
+	env?: Record<string, string>;
 }
 
 export interface SelfUpdateCommand extends SelfUpdateCommandStep {
@@ -74,11 +76,16 @@ function makeSelfUpdateCommand(
 	};
 }
 
-function makeSelfUpdateCommandStep(command: string, args: string[]): SelfUpdateCommandStep {
+function makeSelfUpdateCommandStep(
+	command: string,
+	args: string[],
+	env?: Record<string, string>,
+): SelfUpdateCommandStep {
 	return {
 		command,
 		args,
 		display: [command, ...args].map((arg) => (/\s/.test(arg) ? `"${arg}"` : arg)).join(" "),
+		...(env ? { env } : {}),
 	};
 }
 
@@ -150,7 +157,7 @@ function getDefaultUpdatePackageName(installedPackageName: string, updateSpec: s
 	return updateSpec;
 }
 
-function getSelfUpdateCommandForMethod(
+export function getSelfUpdateCommandForMethod(
 	method: InstallMethod,
 	installedPackageName: string,
 	updateSpec = installedPackageName,
@@ -190,7 +197,13 @@ function getSelfUpdateCommandForMethod(
 			const [command = "npm", ...npmArgs] = npmCommand ?? [];
 			const inferred = npmCommand?.length ? undefined : getInferredNpmInstall();
 			const prefixArgs = [...npmArgs, ...(inferred ? ["--prefix", inferred.prefix] : [])];
-			const installStep = makeSelfUpdateCommandStep(command, [...prefixArgs, "install", "-g", updateSpec]);
+			const env: Record<string, string> | undefined = isDirectPackageArtifactSpec(updateSpec)
+				? {
+						npm_config_allow_remote: "all",
+						npm_config_allow_scripts: updateSpec,
+					}
+				: undefined;
+			const installStep = makeSelfUpdateCommandStep(command, [...prefixArgs, "install", "-g", updateSpec], env);
 			const uninstallStep =
 				updatePackageName === installedPackageName
 					? undefined

packages/coding-agent/src/package-manager-cli.ts

@@ -468,6 +468,7 @@ async function runSelfUpdate(command: SelfUpdateCommand): Promise<void> {
 			const child = spawn(step.command, step.args, {
 				stdio: "inherit",
 				shell: shouldUseWindowsShell(step.command),
+				env: step.env ? { ...process.env, ...step.env } : process.env,
 			});
 			child.on("error", (error) => {
 				reject(error);

packages/coding-agent/test/suite/regressions/2163-npm12-self-update.test.ts

@@ -0,0 +1,32 @@
+import { describe, expect, it } from "vitest";
+import { getSelfUpdateCommandForMethod } from "../../../src/config.js";
+
+describe("issue #2163 self-update npm 12 allow-remote", () => {
+	it("adds allow-remote and allow-scripts to env for direct package artifacts", () => {
+		const artifactUrl =
+			"https://github.com/PrimeIntellect-ai/prime-agent/releases/download/v0.9.4/prime-agent-0.9.4.tgz";
+		const command = getSelfUpdateCommandForMethod("npm", "prime-agent", artifactUrl, ["npm"], "prime-agent");
+
+		expect(command).toBeDefined();
+		if (!command) throw new Error("Expected command to be defined");
+
+		// For an update where package name matches, the command itself is the install step
+		const installStep = command.steps ? command.steps[0] : command;
+
+		expect(installStep.env).toBeDefined();
+		expect(installStep.env).toEqual({
+			npm_config_allow_remote: "all",
+			npm_config_allow_scripts: artifactUrl,
+		});
+	});
+
+	it("does not add env for registry specs", () => {
+		const command = getSelfUpdateCommandForMethod("npm", "prime-agent", "prime-agent@latest", ["npm"], "prime-agent");
+
+		expect(command).toBeDefined();
+		if (!command) throw new Error("Expected command to be defined");
+
+		const installStep = command.steps ? command.steps[0] : command;
+		expect(installStep.env).toBeUndefined();
+	});
+});