acp: Allow resolving older npm package versions by benbrandt · Pull Request #55770 · zed-industries/zed

benbrandt · 2026-05-05T13:48:23Z

Lots of people are using min-release-age in their .npmrc files these days.

I saw two options:

Force min-release-age=0 so we can always install the latest
Be more lenient in what we allow

I opted for 2, which means we convert package@0.1.2 to package@<=0.1.2. This means npm can find the latest version we can that meets the user's requirements.

The downside is, the registry args/env may or may not work with the resolved version, but that should at least surface better thanks to #55757

There is also the issue that npm will cache package metadata and an older version it has cached would still resolve. However, once the metadata is updated, npm does use the newer tarball at least, so it will update eventually.

It's a tradeoff, but I'd rather start with this until we have a better solution on the ACP registry, rather than have users be upset becaue we installed packages in a way they didn't want.

Self-Review Checklist:

I've reviewed my own diff for quality, security, and reliability
Unsafe blocks (if any) have justifying comments
The content is consistent with the UI/UX checklist
Tests cover the new/changed behavior
Performance impact has been considered and is acceptable

Closes agentclientprotocol/claude-agent-acp#516

Release Notes:

acp: Better support min-release-age settings for npx-based agents from the registry

Replace fallback command retries with bounded npm package specs when building local registry agent commands, and remove the unused fallback command path from ACP and proto APIs.

benbrandt · 2026-05-05T13:58:35Z

/cherry-pick preview

zed-zippy · 2026-05-05T14:17:57Z

🍒💥 Cherry-pick did not succeed
https://github.com/zed-industries/zed/actions/runs/25381899514

Lots of people are using `min-release-age` in their .npmrc files these days. I saw two options: 1. Force min-release-age=0 so we can always install the latest 2. Be more lenient in what we allow I opted for 2, which means we convert `package@0.1.2` to `package@<=0.1.2`. This means npm can find the latest version we can that meets the user's requirements. The downside is, the registry args/env may or may not work with the resolved version, but that should at least surface better thanks to #55757 There is also the issue that npm will cache package metadata and an older version it has cached would still resolve. However, once the metadata is updated, npm does use the newer tarball at least, so it will update eventually. It's a tradeoff, but I'd rather start with this until we have a better solution on the ACP registry, rather than have users be upset becaue we installed packages in a way they didn't want. Self-Review Checklist: - [x] I've reviewed my own diff for quality, security, and reliability - [x] Unsafe blocks (if any) have justifying comments - [x] The content is consistent with the [UI/UX checklist](https://github.com/zed-industries/zed/blob/main/CONTRIBUTING.md#uiux-checklist) - [x] Tests cover the new/changed behavior - [x] Performance impact has been considered and is acceptable Closes agentclientprotocol/claude-agent-acp#516 Release Notes: - acp: Better support min-release-age settings for npx-based agents from the registry

… to preview) (#55775) Cherry-pick of #55770 to preview ---- Lots of people are using `min-release-age` in their .npmrc files these days. I saw two options: 1. Force min-release-age=0 so we can always install the latest 2. Be more lenient in what we allow I opted for 2, which means we convert `package@0.1.2` to `package@<=0.1.2`. This means npm can find the latest version we can that meets the user's requirements. The downside is, the registry args/env may or may not work with the resolved version, but that should at least surface better thanks to #55757 There is also the issue that npm will cache package metadata and an older version it has cached would still resolve. However, once the metadata is updated, npm does use the newer tarball at least, so it will update eventually. It's a tradeoff, but I'd rather start with this until we have a better solution on the ACP registry, rather than have users be upset becaue we installed packages in a way they didn't want. Self-Review Checklist: - [x] I've reviewed my own diff for quality, security, and reliability - [x] Unsafe blocks (if any) have justifying comments - [x] The content is consistent with the [UI/UX checklist](https://github.com/zed-industries/zed/blob/main/CONTRIBUTING.md#uiux-checklist) - [x] Tests cover the new/changed behavior - [x] Performance impact has been considered and is acceptable Closes agentclientprotocol/claude-agent-acp#516 Release Notes: - acp: Better support min-release-age settings for npx-based agents from the registry Co-authored-by: Ben Brandt <benjamin.j.brandt@gmail.com>

Lots of people are using `min-release-age` in their .npmrc files these days. I saw two options: 1. Force min-release-age=0 so we can always install the latest 2. Be more lenient in what we allow I opted for 2, which means we convert `package@0.1.2` to `package@<=0.1.2`. This means npm can find the latest version we can that meets the user's requirements. The downside is, the registry args/env may or may not work with the resolved version, but that should at least surface better thanks to zed-industries#55757 There is also the issue that npm will cache package metadata and an older version it has cached would still resolve. However, once the metadata is updated, npm does use the newer tarball at least, so it will update eventually. It's a tradeoff, but I'd rather start with this until we have a better solution on the ACP registry, rather than have users be upset becaue we installed packages in a way they didn't want. Self-Review Checklist: - [x] I've reviewed my own diff for quality, security, and reliability - [x] Unsafe blocks (if any) have justifying comments - [x] The content is consistent with the [UI/UX checklist](https://github.com/zed-industries/zed/blob/main/CONTRIBUTING.md#uiux-checklist) - [x] Tests cover the new/changed behavior - [x] Performance impact has been considered and is acceptable Closes agentclientprotocol/claude-agent-acp#516 Release Notes: - acp: Better support min-release-age settings for npx-based agents from the registry

Qard · 2026-05-06T16:54:25Z

@benbrandt I noticed the github copilot plugin also has the same issue. Perhaps the solution could be made more generic to fix that too?

Self-Review Checklist: - [x] I've reviewed my own diff for quality, security, and reliability - [x] Unsafe blocks (if any) have justifying comments - [x] The content is consistent with the [UI/UX checklist](https://github.com/zed-industries/zed/blob/main/CONTRIBUTING.md#uiux-checklist) - [x] Tests cover the new/changed behavior - [x] Performance impact has been considered and is acceptable #55770 changed the npm package version spec to `package@<=1.2.3`. On Windows this fails with `The system cannot find the file specified.` because: - `npm` resolves to `npm.cmd`, a batch file. Windows runs `.cmd` files via cmd.exe, which parses the invocation and treats unquoted `<` as input redirection. - The single quotes our shell builder emits around args are PowerShell string-literal syntax that PS strips during parsing. PS only re-adds CRT-style transport quotes around native command args containing whitespace, so `package@<=0.25.3` reaches `npm.cmd` bare and cmd.exe fails before the batch body even runs. Switch to npm's hyphen-range syntax (`0.0.0 - <version>`, equivalent to `<=<version>`), which has no `<`. Closes #55921 Release Notes: - Fixed ACP agents failing to launch on Windows with "The system cannot find the file specified"

…o stable) (#55947) Cherry-pick of #55938 to stable ---- Self-Review Checklist: - [x] I've reviewed my own diff for quality, security, and reliability - [x] Unsafe blocks (if any) have justifying comments - [x] The content is consistent with the [UI/UX checklist](https://github.com/zed-industries/zed/blob/main/CONTRIBUTING.md#uiux-checklist) - [x] Tests cover the new/changed behavior - [x] Performance impact has been considered and is acceptable #55770 changed the npm package version spec to `package@<=1.2.3`. On Windows this fails with `The system cannot find the file specified.` because: - `npm` resolves to `npm.cmd`, a batch file. Windows runs `.cmd` files via cmd.exe, which parses the invocation and treats unquoted `<` as input redirection. - The single quotes our shell builder emits around args are PowerShell string-literal syntax that PS strips during parsing. PS only re-adds CRT-style transport quotes around native command args containing whitespace, so `package@<=0.25.3` reaches `npm.cmd` bare and cmd.exe fails before the batch body even runs. Switch to npm's hyphen-range syntax (`0.0.0 - <version>`, equivalent to `<=<version>`), which has no `<`. Closes #55921 Release Notes: - Fixed ACP agents failing to launch on Windows with "The system cannot find the file specified" Co-authored-by: Agus Zubiaga <agus@zed.dev>

…o preview) (#55946) Cherry-pick of #55938 to preview ---- Self-Review Checklist: - [x] I've reviewed my own diff for quality, security, and reliability - [x] Unsafe blocks (if any) have justifying comments - [x] The content is consistent with the [UI/UX checklist](https://github.com/zed-industries/zed/blob/main/CONTRIBUTING.md#uiux-checklist) - [x] Tests cover the new/changed behavior - [x] Performance impact has been considered and is acceptable #55770 changed the npm package version spec to `package@<=1.2.3`. On Windows this fails with `The system cannot find the file specified.` because: - `npm` resolves to `npm.cmd`, a batch file. Windows runs `.cmd` files via cmd.exe, which parses the invocation and treats unquoted `<` as input redirection. - The single quotes our shell builder emits around args are PowerShell string-literal syntax that PS strips during parsing. PS only re-adds CRT-style transport quotes around native command args containing whitespace, so `package@<=0.25.3` reaches `npm.cmd` bare and cmd.exe fails before the batch body even runs. Switch to npm's hyphen-range syntax (`0.0.0 - <version>`, equivalent to `<=<version>`), which has no `<`. Closes #55921 Release Notes: - Fixed ACP agents failing to launch on Windows with "The system cannot find the file specified" Co-authored-by: Agus Zubiaga <agus@zed.dev>

Self-Review Checklist: - [x] I've reviewed my own diff for quality, security, and reliability - [x] Unsafe blocks (if any) have justifying comments - [x] The content is consistent with the [UI/UX checklist](https://github.com/zed-industries/zed/blob/main/CONTRIBUTING.md#uiux-checklist) - [x] Tests cover the new/changed behavior - [x] Performance impact has been considered and is acceptable zed-industries#55770 changed the npm package version spec to `package@<=1.2.3`. On Windows this fails with `The system cannot find the file specified.` because: - `npm` resolves to `npm.cmd`, a batch file. Windows runs `.cmd` files via cmd.exe, which parses the invocation and treats unquoted `<` as input redirection. - The single quotes our shell builder emits around args are PowerShell string-literal syntax that PS strips during parsing. PS only re-adds CRT-style transport quotes around native command args containing whitespace, so `package@<=0.25.3` reaches `npm.cmd` bare and cmd.exe fails before the batch body even runs. Switch to npm's hyphen-range syntax (`0.0.0 - <version>`, equivalent to `<=<version>`), which has no `<`. Closes zed-industries#55921 Release Notes: - Fixed ACP agents failing to launch on Windows with "The system cannot find the file specified"

Lots of people are using `min-release-age` in their .npmrc files these days. I saw two options: 1. Force min-release-age=0 so we can always install the latest 2. Be more lenient in what we allow I opted for 2, which means we convert `package@0.1.2` to `package@<=0.1.2`. This means npm can find the latest version we can that meets the user's requirements. The downside is, the registry args/env may or may not work with the resolved version, but that should at least surface better thanks to zed-industries#55757 There is also the issue that npm will cache package metadata and an older version it has cached would still resolve. However, once the metadata is updated, npm does use the newer tarball at least, so it will update eventually. It's a tradeoff, but I'd rather start with this until we have a better solution on the ACP registry, rather than have users be upset becaue we installed packages in a way they didn't want. Self-Review Checklist: - [x] I've reviewed my own diff for quality, security, and reliability - [x] Unsafe blocks (if any) have justifying comments - [x] The content is consistent with the [UI/UX checklist](https://github.com/zed-industries/zed/blob/main/CONTRIBUTING.md#uiux-checklist) - [x] Tests cover the new/changed behavior - [x] Performance impact has been considered and is acceptable Closes agentclientprotocol/claude-agent-acp#516 Release Notes: - acp: Better support min-release-age settings for npx-based agents from the registry

Self-Review Checklist: - [x] I've reviewed my own diff for quality, security, and reliability - [x] Unsafe blocks (if any) have justifying comments - [x] The content is consistent with the [UI/UX checklist](https://github.com/zed-industries/zed/blob/main/CONTRIBUTING.md#uiux-checklist) - [x] Tests cover the new/changed behavior - [x] Performance impact has been considered and is acceptable zed-industries#55770 changed the npm package version spec to `package@<=1.2.3`. On Windows this fails with `The system cannot find the file specified.` because: - `npm` resolves to `npm.cmd`, a batch file. Windows runs `.cmd` files via cmd.exe, which parses the invocation and treats unquoted `<` as input redirection. - The single quotes our shell builder emits around args are PowerShell string-literal syntax that PS strips during parsing. PS only re-adds CRT-style transport quotes around native command args containing whitespace, so `package@<=0.25.3` reaches `npm.cmd` bare and cmd.exe fails before the batch body even runs. Switch to npm's hyphen-range syntax (`0.0.0 - <version>`, equivalent to `<=<version>`), which has no `<`. Closes zed-industries#55921 Release Notes: - Fixed ACP agents failing to launch on Windows with "The system cannot find the file specified"

Lots of people are using `min-release-age` in their .npmrc files these days. I saw two options: 1. Force min-release-age=0 so we can always install the latest 2. Be more lenient in what we allow I opted for 2, which means we convert `package@0.1.2` to `package@<=0.1.2`. This means npm can find the latest version we can that meets the user's requirements. The downside is, the registry args/env may or may not work with the resolved version, but that should at least surface better thanks to zed-industries#55757 There is also the issue that npm will cache package metadata and an older version it has cached would still resolve. However, once the metadata is updated, npm does use the newer tarball at least, so it will update eventually. It's a tradeoff, but I'd rather start with this until we have a better solution on the ACP registry, rather than have users be upset becaue we installed packages in a way they didn't want. Self-Review Checklist: - [x] I've reviewed my own diff for quality, security, and reliability - [x] Unsafe blocks (if any) have justifying comments - [x] The content is consistent with the [UI/UX checklist](https://github.com/zed-industries/zed/blob/main/CONTRIBUTING.md#uiux-checklist) - [x] Tests cover the new/changed behavior - [x] Performance impact has been considered and is acceptable Closes agentclientprotocol/claude-agent-acp#516 Release Notes: - acp: Better support min-release-age settings for npx-based agents from the registry

Self-Review Checklist: - [x] I've reviewed my own diff for quality, security, and reliability - [x] Unsafe blocks (if any) have justifying comments - [x] The content is consistent with the [UI/UX checklist](https://github.com/zed-industries/zed/blob/main/CONTRIBUTING.md#uiux-checklist) - [x] Tests cover the new/changed behavior - [x] Performance impact has been considered and is acceptable zed-industries#55770 changed the npm package version spec to `package@<=1.2.3`. On Windows this fails with `The system cannot find the file specified.` because: - `npm` resolves to `npm.cmd`, a batch file. Windows runs `.cmd` files via cmd.exe, which parses the invocation and treats unquoted `<` as input redirection. - The single quotes our shell builder emits around args are PowerShell string-literal syntax that PS strips during parsing. PS only re-adds CRT-style transport quotes around native command args containing whitespace, so `package@<=0.25.3` reaches `npm.cmd` bare and cmd.exe fails before the batch body even runs. Switch to npm's hyphen-range syntax (`0.0.0 - <version>`, equivalent to `<=<version>`), which has no `<`. Closes zed-industries#55921 Release Notes: - Fixed ACP agents failing to launch on Windows with "The system cannot find the file specified"

benbrandt added 2 commits May 5, 2026 15:21

Implement fallback retry

c3d0c54

Bound npm package versions in agent commands

943bfa7

Replace fallback command retries with bounded npm package specs when building local registry agent commands, and remove the unused fallback command path from ACP and proto APIs.

cla-bot Bot added the cla-signed The user has signed the Contributor License Agreement label May 5, 2026

zed-community-bot Bot added the staff Pull requests authored by a current member of Zed staff label May 5, 2026

benbrandt requested a review from bennetbo May 5, 2026 13:50

bennetbo approved these changes May 5, 2026

View reviewed changes

benbrandt enabled auto-merge May 5, 2026 13:58

benbrandt added this pull request to the merge queue May 5, 2026

Merged via the queue into main with commit cdbab19 May 5, 2026
42 checks passed

benbrandt deleted the npm-fallback branch May 5, 2026 14:17

zed-zippy Bot mentioned this pull request May 5, 2026

acp: Allow resolving older npm package versions (#55770) (cherry-pick to preview) #55775

Merged

5 tasks

This was referenced May 5, 2026

claude-acp agent server not registered after every Zed restart #50807

Closed

@agentclientprotocol/claude-agent-acp@0.25.3 referenced in registry does not exist on npm agentclientprotocol/registry#221

Closed

davidhewitt mentioned this pull request May 6, 2026

Claude agent: "server shut down unexpectedly" gives no actionable info when claude-agent-acp fails to install #52294

Closed

This was referenced May 6, 2026

Revert "acp: Allow resolving older npm package versions" #55930

Closed

acp: Fix npm version spec breaking on Windows #55938

Merged

This was referenced May 6, 2026

acp: Fix npm version spec breaking on Windows (#55938) (cherry-pick to preview) #55946

Merged

acp: Fix npm version spec breaking on Windows (#55938) (cherry-pick to stable) #55947

Merged

This was referenced May 8, 2026

Review upstream Zed v1.1.6 neozed-industries/neo-zed#18

Closed

Review upstream Zed v1.2.3 neozed-industries/neo-zed#26

Closed

Navigation Menu

Uh oh!

Uh oh!

acp: Allow resolving older npm package versions - #55770

acp: Allow resolving older npm package versions#55770
benbrandt merged 2 commits into
mainfrom
npm-fallback

benbrandt commented May 5, 2026 •

edited

Loading

Uh oh!

benbrandt commented May 5, 2026

Uh oh!

Uh oh!

zed-zippy Bot commented May 5, 2026

Uh oh!

Qard commented May 6, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

Uh oh!

Uh oh!

Conversation

benbrandt commented May 5, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

benbrandt commented May 5, 2026

Uh oh!

Uh oh!

zed-zippy Bot commented May 5, 2026

Uh oh!

Qard commented May 6, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

benbrandt commented May 5, 2026 •

edited

Loading