@superblocksteam/vite-plugin-file-sync 2.0.137 → 2.0.138-next.0

package/dist/ai-service/app-interface/npm-registry.js

@@ -26,6 +26,23 @@ const noControlChars = (s) => !/[\x00-\x1f]/.test(s);
 // Mirrors the server's npm scope grammar: must start with `@`, then a
 // lowercase letter/digit, then up to 254 lowercase letters/digits/`._-`.
 const NPM_SCOPE_RE = /^@[a-z0-9][a-z0-9._-]{0,254}$/;
+/**
+ * Test-only escape hatch that mirrors the server's `httpRegistryUrlAllowed()`
+ * (see `packages/server/src/routes/api/v1/organization/npmRegistry.ts`). The
+ * private-registry Playwright tests point the dev server at a local registry
+ * that only serves http. The server POST controller and the admin UI form
+ * already relax their https check behind this same env var, and the CLI's
+ * response schema has to match. Otherwise the fetched config fails to parse,
+ * `getConfig()` returns `unreachable`, the `~/.superblocks/npmrc` file is
+ * never written, and the first install quietly falls back to public npm. It
+ * is read on every `getConfig()` call so it follows the dev server's env, and
+ * it is unset in production, where https stays required. The dev server
+ * subprocess inherits it because the CLI's process spawner merges
+ * `process.env` (see `SuperblocksCli.customizedEnv` in cli-system-tests).
+ */
+function httpRegistryUrlAllowedForE2E() {
+    return process.env.SUPERBLOCKS_E2E_ALLOW_HTTP_NPM_REGISTRY === "true";
+}
 const registryEntrySchema = z.object({
     id: z.string().uuid(),
     scope: z
@@ -38,24 +55,14 @@ const registryEntrySchema = z.object({
         .url()
         .refine(noControlChars, "registryUrl contains a C0 control character")
         .refine((s) => s.startsWith("https://") ||
-        (process.env.SUPERBLOCKS_E2E_ALLOW_HTTP_NPM_REGISTRY === "true" &&
-            s.startsWith("http://")), "registryUrl must be https"),
-    // Matches the server's `OrgNpmRegistryDto.token` (see
-    // `packages/server/src/controllers/v1/orgNpmRegistry/handlers.ts`),
-    // which is documented as `string | null` but in practice may also be
-    // omitted from the wire payload entirely on older server builds.
-    // `.nullish()` accepts `null` AND missing/undefined; the transform
-    // coalesces both to `null` so downstream code keeps the canonical
-    // `NpmRegistryEntry.token: string | null` shape and never sees
-    // `undefined`. An absent token is a legitimate "unauthenticated
-    // registry" state, NOT wire-shape drift — treating it as drift would
-    // route through `serveStaleOrUnconfigured` and brick the install
-    // path on orgs whose registry intentionally has no token.
-    token: z
-        .string()
-        .refine(noControlChars, "token contains a C0 control character")
-        .nullish()
-        .transform((v) => v ?? null),
+        (s.startsWith("http://") && httpRegistryUrlAllowedForE2E()), "registryUrl must be https"),
+    // No token on the wire. `registryUrl` is the Superblocks npm proxy URL the
+    // server rewrites each row to (see the server's `/npm-registry/config`
+    // route); the CLI authenticates to the proxy with the machine's own login
+    // token, which it stamps in locally (see `registriesToConfig`). The
+    // customer's upstream registry password is held only on the server. Any
+    // `token` field an older server still emits is ignored: this schema strips
+    // unknown keys rather than rejecting them.
 });
 const registryListSchema = z.object({
     registries: z.array(registryEntrySchema),
@@ -81,16 +88,6 @@ const envelopeSchema = z
     data: z.unknown(),
 })
     .passthrough();
-/**
- * Scopes whose existing `<scope>:registry=` lines in a project / pod `.npmrc`
- * must survive `writeNpmrc` calls. Shared between AppShell, TemplateRenderer,
- * and any other call site so a new scope only needs to be added in one place.
- *
- * `setup-template.sh` bakes
- * `@superblocksteam:registry=https://npm.pkg.github.com/` into the template
- * `.npmrc` for ephemeral environments; we must not clobber it.
- */
-export const PRESERVE_NPMRC_SCOPES = ["@superblocksteam"];
 /**
  * Resolves the org `allow_install_scripts` policy from a `prepareForPrivateRegistry`
  * (or `maybeWriteNpmrcForDir`) result. `false` means "the org has explicitly
@@ -106,11 +103,12 @@ export function shouldIgnoreInstallScripts(result) {
     return result?.config.allowInstallScripts === false;
 }
 /**
- * Map a fresh `getConfig` fetch result to the `config.lookup_total` outcome
- * (APPS-4378): a populated `configured` result is a cache `miss`; an empty
- * `not-configured` is `not_configured`; `stale` / `unreachable` (served during
- * an outage, or no usable cache) are `error`. Hard-fail throws are recorded as
- * `error` at the call site, and in-TTL cache hits as `hit`.
+ * Map a fresh `getConfig` fetch result to the `config.lookup_total` outcome: a
+ * populated `configured` result is a cache `miss`; an empty `not-configured`
+ * is `not_configured`; `stale` (still serving the cached registry during an
+ * outage) is its own `stale` result; `unreachable` (no usable cache during an
+ * outage) is `error`. Throws that hard-fail are recorded as `error` at the
+ * call site, and cache hits within the TTL as `hit`.
  */
 function configLookupFromFetch(result) {
     switch (result.source) {
@@ -119,6 +117,7 @@ function configLookupFromFetch(result) {
         case "not-configured":
             return "not_configured";
         case "stale":
+            return "stale";
         case "unreachable":
             return "error";
         default: {
@@ -137,6 +136,14 @@ function configLookupFromFetch(result) {
  * `NpmRegistryConfig`. Centralised so `writeNpmrc`, tests, and any future
  * consumer all interpret the wire shape the same way.
  *
+ * `authToken` is the machine's own Superblocks login token. The server's
+ * `/config` route points every `registryUrl` at the Superblocks npm proxy and
+ * returns no upstream password, so the same login token authenticates every
+ * proxied registry. It is stamped onto each entry here (rather than threaded
+ * through `writeNpmrc` / the package-lookup path) so those consumers keep
+ * reading `config.*.token` unchanged. Omitted only in tests that render URLs
+ * without auth.
+ *
  * Multiple `scope === null` entries should never happen — the server's
  * UNIQUE (organization_id, scope) constraint forbids it — but we are
  * defensive: the FIRST default wins, subsequent ones are logged and
@@ -146,7 +153,62 @@ function configLookupFromFetch(result) {
  * Duplicate scoped entries (same `scope` string) follow the same rule:
  * first wins.
  */
-export function registriesToConfig(entries, allowInstallScripts) {
+/**
+ * Path the server mounts the npm proxy under for an org. Mirrors the server's
+ * `npmProxyUrlPrefix`
+ * (`packages/server/src/controllers/v1/orgNpmRegistry/proxy.ts`): every
+ * `registryUrl` the `/config` route returns lives at
+ * `<external server URL>/api/v1/organizations/<orgId>/npm-proxy` (default) or
+ * a `…/npm-proxy/_scope/<scope>` sub-path. A server-side path change is a
+ * coordinated server+client change; until then this is the one client-side
+ * source of truth for "is this URL our proxy?".
+ */
+function superblocksNpmProxyPathPrefix(organizationId) {
+    return `/api/v1/organizations/${organizationId}/npm-proxy`;
+}
+/**
+ * True only when `registryUrl` is genuinely the Superblocks npm proxy for THIS
+ * org on THIS server (matching origin AND the org-scoped `/npm-proxy` path).
+ *
+ * The client stamps the machine's own Superblocks login token onto every row
+ * `/config` returns. That is only safe if every row really is our proxy: a
+ * version-skewed or misconfigured server could return a customer's upstream
+ * registry URL (or a broken one built from an empty external-server URL), and
+ * blindly stamping the login token onto that would leak a Superblocks
+ * credential to a third-party host. So the client proves the proxy invariant
+ * before stamping and fails closed when it does not hold.
+ *
+ * Compares parsed origin + pathname (not a raw string prefix) so trailing
+ * slashes and default ports can't cause a false negative, and requires a path
+ * boundary so a lookalike like `…/npm-proxyEVIL` can't slip through. Also
+ * rejects anything the canonical proxy URL never carries — embedded
+ * userinfo (`https://user:pass@host/…` shares the host's `origin` but is not
+ * our proxy URL) and any query/fragment — so a crafted URL can't satisfy the
+ * origin check while smuggling something else into `.npmrc`.
+ */
+export function isSuperblocksNpmProxyUrl(registryUrl, baseUrl, organizationId) {
+    let registry;
+    let base;
+    try {
+        registry = new URL(registryUrl);
+        base = new URL(baseUrl);
+    }
+    catch {
+        return false;
+    }
+    if (registry.origin !== base.origin) {
+        return false;
+    }
+    if (registry.username || registry.password) {
+        return false;
+    }
+    if (registry.search || registry.hash) {
+        return false;
+    }
+    const prefix = superblocksNpmProxyPathPrefix(organizationId);
+    return (registry.pathname === prefix || registry.pathname.startsWith(`${prefix}/`));
+}
+export function registriesToConfig(entries, allowInstallScripts, authToken) {
     if (entries.length === 0) {
         return {
             configured: false,
@@ -158,7 +220,7 @@ export function registriesToConfig(entries, allowInstallScripts) {
     for (const entry of entries) {
         const value = {
             url: entry.registryUrl,
-            ...(entry.token ? { token: entry.token } : {}),
+            ...(authToken ? { token: authToken } : {}),
         };
         if (entry.scope === null) {
             if (defaultReg) {
@@ -430,21 +492,41 @@ export class NpmRegistryClient {
     /**
      * Resolve the current npm registry configuration for the active org. See
      * the class docstring for the full state machine.
+     *
+     * `forceRefresh` bypasses the TTL cache-hit return below so a just-in-time
+     * caller (the `.npmrc` writer before an install, a package lookup, the
+     * home-npmrc sync) observes an admin clearing or changing the registry
+     * immediately instead of waiting out the TTL. `forceRefreshMaxAgeMs` lets a
+     * high-frequency caller (the package lookup) keep a small freshness floor so
+     * a tight sequential batch collapses onto one fetch; left at 0 (install /
+     * home sync) a forced read always re-fetches. It does NOT touch the cache
+     * before fetching: `serveStaleOrUnconfigured` still needs the last-known-good
+     * entries to fall back to during a 5xx/network outage. The flag-off
+     * short-circuit, inflight dedup, and all hard-fail branches behave
+     * identically.
      */
-    async getConfig() {
+    async getConfig(options = {}) {
         // Captured up front so every config.lookup emit carries the time getConfig
         // spent resolving (~0 for a cache hit, the network round-trip for a miss).
         const start = this.deps.now();
+        const forceRefresh = options.forceRefresh === true;
         if (!this.deps.isFlagEnabled()) {
             // Short-circuit BEFORE inspecting the cache: a flag flip to "off"
             // must not keep serving from a previously-fetched config. The
             // ticket explicitly calls this out ("Flag off → return
-            // {configured: false} immediately, no server call").
-            npmRegistryEmitter.recordConfigLookup("not_configured", this.deps.now() - start);
+            // {configured: false} immediately, no server call"). `forceRefresh`
+            // does not change this: flag off means no config regardless.
+            npmRegistryEmitter.recordConfigLookup("not_configured", this.deps.now() - start, forceRefresh);
             return NOT_CONFIGURED;
         }
         const now = this.deps.now();
-        if (this.cache && now - this.cache.fetchedAt < this.deps.ttlMs) {
+        // A forced read may still be served from the cache if it is younger than
+        // the caller's freshness floor (default 0 = always re-fetch). An unforced
+        // read uses the full TTL.
+        const maxAgeMs = forceRefresh
+            ? (options.forceRefreshMaxAgeMs ?? 0)
+            : this.deps.ttlMs;
+        if (this.cache && now - this.cache.fetchedAt < maxAgeMs) {
             // A cached empty list (from a prior 404 or `registries: []` response)
             // must surface as `not-configured` on every hit within the TTL, not
             // `configured` with `config.configured: false`. The discriminator's
@@ -454,15 +536,12 @@ export class NpmRegistryClient {
             // alongside the not-configured result so AppShell can honor
             // `--ignore-scripts` even when there are no registry rows.
             if (this.cache.entries.length === 0) {
-                npmRegistryEmitter.recordConfigLookup("not_configured", this.deps.now() - start);
+                npmRegistryEmitter.recordConfigLookup("not_configured", this.deps.now() - start, forceRefresh);
                 return notConfigured(this.cache.npmAllowInstallScripts);
             }
             await this.markPolicyConfigured();
-            npmRegistryEmitter.recordConfigLookup("hit", this.deps.now() - start);
-            return {
-                source: "configured",
-                config: registriesToConfig(this.cache.entries, this.cache.npmAllowInstallScripts),
-            };
+            npmRegistryEmitter.recordConfigLookup("hit", this.deps.now() - start, forceRefresh);
+            return this.renderConfigured(this.cache.entries, this.cache.npmAllowInstallScripts);
         }
         // Deduplicate concurrent cache-miss callers onto a single network
         // request so we don't multiply 401-refresh storms or lose last-known-
@@ -475,13 +554,13 @@ export class NpmRegistryClient {
             // Cache miss → fresh fetch. configured ⇒ miss; empty/404 ⇒
             // not_configured; stale/unreachable ⇒ error. Deduped concurrent
             // callers share this single emit, so the counter tracks fetch rate.
-            npmRegistryEmitter.recordConfigLookup(configLookupFromFetch(result), this.deps.now() - start);
+            npmRegistryEmitter.recordConfigLookup(configLookupFromFetch(result), this.deps.now() - start, forceRefresh);
             return result;
         })
             .catch((err) => {
             // Hard-fail throws (double-401, refresh reject, other-4xx, schema
             // parse) surface as `error`.
-            npmRegistryEmitter.recordConfigLookup("error", this.deps.now() - start);
+            npmRegistryEmitter.recordConfigLookup("error", this.deps.now() - start, forceRefresh);
             throw err;
         })
             .finally(() => {
@@ -584,6 +663,7 @@ export class NpmRegistryClient {
             // survives independently of the registry credentials it rode in
             // with, and reading from cache alone would clobber it back to
             // `undefined` here.
+            this.signalPolicyFallback(this.cache?.npmAllowInstallScripts, "not_configured_404");
             const preservedPolicy = this.cache?.npmAllowInstallScripts ?? this.lastKnownPolicy;
             this.cache = {
                 entries: [],
@@ -666,6 +746,25 @@ export class NpmRegistryClient {
         }
         const entries = parsed.data.registries;
         const npmAllowInstallScripts = parsed.data.npmAllowInstallScripts;
+        // Prove every row is genuinely our proxy before trusting the payload.
+        // `renderConfig` stamps the machine's Superblocks login token onto each
+        // row's URL; if a version-skewed or misconfigured server returned a
+        // customer's upstream registry URL (or a broken one) we'd leak that login
+        // token to a third-party host. A row that fails the invariant means the
+        // payload is untrustworthy, so we treat it like a schema failure: don't
+        // cache it, and fail closed through `serveStaleOrUnconfigured` (serves
+        // last-known-good if we have it, else `unreachable`).
+        const nonProxyEntry = entries.find((entry) => !isSuperblocksNpmProxyUrl(entry.registryUrl, this.deps.baseUrl, this.deps.organizationId));
+        if (nonProxyEntry) {
+            const invariantError = new Error(`[npm-registry] server returned a registryUrl that is not the Superblocks npm proxy for this org (org ${this.deps.organizationId}); refusing to stamp the login token onto it`);
+            getLogger().error(invariantError.message, {
+                error: {
+                    kind: "NpmRegistryProxyInvariantViolated",
+                    message: invariantError.message,
+                },
+            });
+            return this.serveStaleOrUnconfigured(invariantError);
+        }
         this.cache = {
             entries,
             npmAllowInstallScripts,
@@ -676,10 +775,7 @@ export class NpmRegistryClient {
             return notConfigured(npmAllowInstallScripts);
         }
         await this.markPolicyConfigured();
-        return {
-            source: "configured",
-            config: registriesToConfig(entries, npmAllowInstallScripts),
-        };
+        return this.renderConfigured(entries, npmAllowInstallScripts);
     }
     /**
      * One full fetch attempt with the current JWT. Throws on getJwt failure
@@ -688,7 +784,12 @@ export class NpmRegistryClient {
     async attempt() {
         const jwt = await this.deps.getJwt();
         const base = this.deps.baseUrl.replace(/\/$/, "");
-        const url = `${base}/api/v1/organizations/${encodeURIComponent(this.deps.organizationId)}/npm-registry`;
+        // `/config` returns each registry row with its `registryUrl` rewritten to
+        // the Superblocks npm proxy. No upstream tokens cross the wire anymore;
+        // the caller stamps the machine's own login token onto every row to auth
+        // against the proxy. Restricted to superblocks_jwt + access_token callers;
+        // the plain list route is redacted-only and serves the dashboard.
+        const url = `${base}/api/v1/organizations/${encodeURIComponent(this.deps.organizationId)}/npm-registry/config`;
         return await this.deps.fetch(url, {
             method: "GET",
             headers: {
@@ -697,22 +798,89 @@ export class NpmRegistryClient {
             },
         });
     }
+    /**
+     * Signal when `lastKnownPolicy` supplied the install-scripts policy that the
+     * in-memory cache could not (`cachePolicy == null && lastKnownPolicy !=
+     * null`). That combination means an earlier auth-failure or 4xx branch wiped
+     * the cache and we fell back to the surviving policy, which is a sign
+     * something went wrong. Emit a WARN (with `orgId` and which branch ran) plus
+     * a low-cardinality counter so it can be alerted on from a dashboard without
+     * digging through logs or traces. `cachePolicy` is passed in (not re-read)
+     * because the 404 branch overwrites `this.cache` before this runs.
+     */
+    signalPolicyFallback(cachePolicy, branch) {
+        if (cachePolicy == null && this.lastKnownPolicy != null) {
+            getLogger().warn("[npm-registry] fell back to the last known install-scripts policy because the cache had been cleared by an earlier auth or 4xx failure", { orgId: this.deps.organizationId, branch });
+            npmRegistryEmitter.recordPolicyFallback(branch);
+        }
+    }
+    /**
+     * Render cached/fetched entries into a config, stamping the machine's current
+     * Superblocks login token onto every proxied registry (`registryUrl` is the
+     * proxy URL the server rewrote each row to). Read fresh each call so the
+     * `.npmrc` the caller writes right after carries a current token. `getJwt()`
+     * resolves immediately when a token is already primed, so this stays cheap on
+     * the cache-hit fast path; it throws only when no token is available, in
+     * which case there is no way to build a working proxy `.npmrc`.
+     */
+    async renderConfig(entries, allowInstallScripts) {
+        const authToken = await this.deps.getJwt();
+        return registriesToConfig(entries, allowInstallScripts, authToken);
+    }
+    /**
+     * Build a `configured` result, but route a JWT-read failure through the same
+     * fail-closed path as `serveStaleOrUnconfigured`. `renderConfig` reads the
+     * login token via `getJwt()`, which can reject (no token primed). A missing
+     * token is the same "we can't build a working proxy `.npmrc`" condition the
+     * stale path already treats as `unreachable`, so both the cache-hit and the
+     * fresh-fetch success paths must resolve it the same way rather than throwing
+     * out of `getConfig()`. With a warm cache this serves last-known-good; with
+     * no usable cache it reports `unreachable`.
+     */
+    async renderConfigured(entries, allowInstallScripts) {
+        let config;
+        try {
+            config = await this.renderConfig(entries, allowInstallScripts);
+        }
+        catch (jwtError) {
+            return this.serveStaleOrUnconfigured(jwtError);
+        }
+        return { source: "configured", config };
+    }
     async serveStaleOrUnconfigured(error) {
         if (this.cache && this.cache.entries.length > 0) {
             const ageMs = this.deps.now() - this.cache.fetchedAt;
-            getLogger().warn("[npm-registry] server unreachable; serving last-known-good config", {
-                ageMs,
-                error: error instanceof Error ? error.message : String(error),
-            });
-            // APPS-4370: stale serves a known-configured org, so refresh the
-            // disk marker too. A long outage that spans a pod recycle would
-            // otherwise lose the signal: the next cold-boot would see `unreachable`
-            // with no marker and proceed instead of failing closed.
-            await this.markPolicyConfigured();
-            return {
-                source: "stale",
-                config: registriesToConfig(this.cache.entries, this.cache.npmAllowInstallScripts),
-            };
+            // Render before logging "serving last-known-good": the proxy config
+            // needs the machine's login token stamped onto every row, and that
+            // read can fail (no JWT). A tokenless proxy `.npmrc` is useless —
+            // every install would 401 against the proxy — so on that failure we
+            // fail closed by falling through to the unreachable path below rather
+            // than handing back a config that can't authenticate.
+            let config;
+            try {
+                config = await this.renderConfig(this.cache.entries, this.cache.npmAllowInstallScripts);
+            }
+            catch (jwtError) {
+                getLogger().warn("[npm-registry] server unreachable and no login token available to render last-known-good config; treating as unreachable", {
+                    ageMs,
+                    error: jwtError instanceof Error ? jwtError.message : String(jwtError),
+                });
+            }
+            if (config) {
+                getLogger().warn("[npm-registry] server unreachable; serving last-known-good config", {
+                    ageMs,
+                    error: error instanceof Error ? error.message : String(error),
+                });
+                // APPS-4370: stale serves a known-configured org, so refresh the
+                // disk marker too. A long outage that spans a pod recycle would
+                // otherwise lose the signal: the next cold-boot would see `unreachable`
+                // with no marker and proceed instead of failing closed.
+                await this.markPolicyConfigured();
+                return {
+                    source: "stale",
+                    config,
+                };
+            }
         }
         // No usable cache: either nothing was ever fetched successfully (cold
         // start) or the only successful fetch returned an empty list. Both
@@ -730,6 +898,7 @@ export class NpmRegistryClient {
         // above — the policy survives independently of the registry
         // credentials it rode in with.
         getLogger().warn("[npm-registry] server unreachable and no usable cached config; treating as unreachable", { error: error instanceof Error ? error.message : String(error) });
+        this.signalPolicyFallback(this.cache?.npmAllowInstallScripts, "unreachable");
         const base = unreachable(this.cache?.npmAllowInstallScripts ?? this.lastKnownPolicy);
         // APPS-4370: consult the disk-backed marker so AppShell can decide
         // whether to fail closed. Only attach the field when a store is
@@ -798,14 +967,6 @@ function normalizeRegistryUrl(registryUrl) {
  *     does not validate scope names.
  *   - https-only registry URLs: npm itself accepts http.
  *
- * When `preserveScopeLines` is provided, any existing `<scope>:registry=`
- * keys for those scopes are preserved (so EE-baked
- * `@superblocksteam:registry=https://npm.pkg.github.com/` survives) UNLESS
- * the same scope is explicitly overridden in `config.scopes`. The
- * preserved value is read via `ini.parse` from the existing file, so
- * `ini`'s own quoting rules apply (rather than our older line-grep that
- * could mis-handle quoted values).
- *
  * Idempotent: rewrites the file in full each call. Writes are atomic (tmp +
  * rename) and the file mode is restricted to 0600 because the file may carry
  * an auth token.
@@ -833,144 +994,6 @@ export async function writeNpmrc(targetPath, config, options = {}) {
     // layer (all keys are top-level), so `ini.stringify` on a flat object
     // produces the exact wire format npm expects.
     const obj = {};
-    const preserveScopes = options.preserveScopeLines ?? [];
-    if (preserveScopes.length > 0) {
-        let existing;
-        try {
-            existing = await readFile(targetPath, "utf-8");
-        }
-        catch (error) {
-            // ENOENT is the expected case on first write — every other code
-            // (EACCES, EISDIR, EIO) we surface as a warning rather than throw
-            // because preserve-scope is a best-effort fallback and we'd rather
-            // emit a fresh `.npmrc` than fail the whole install path. The
-            // tradeoff: a transient read error could silently lose a baked
-            // `@superblocksteam:registry=` line (the exact failure class APPS-2053
-            // was meant to prevent).
-            const code = error?.code;
-            if (code !== "ENOENT") {
-                getLogger().warn("[npm-registry] failed to read existing .npmrc for scope preservation; proceeding without preserve", {
-                    path: targetPath,
-                    code,
-                    error: error instanceof Error ? error.message : String(error),
-                });
-            }
-        }
-        if (existing) {
-            // `ini.parse` skips lines it cannot decode rather than throwing
-            // (CRLF artifacts, partial writes, hand-edits with stray bytes —
-            // see ini@6 `decode`'s regex-or-continue loop). Guard with try/catch
-            // for future versions that may throw, and treat any unrecognised
-            // result as "no preserved value" — but warn so an operator can repair
-            // a malformed `.npmrc` instead of silently shipping without the
-            // EE-baked `@superblocksteam:registry=` line.
-            let parsedExisting = {};
-            try {
-                parsedExisting = ini.parse(existing);
-            }
-            catch (err) {
-                getLogger().warn("[npm-registry] failed to parse existing .npmrc for scope preservation; proceeding without preserve", {
-                    path: targetPath,
-                    error: err instanceof Error ? err.message : String(err),
-                });
-            }
-            for (const scope of preserveScopes) {
-                // Skip preservation if config explicitly overrides this scope —
-                // the override will be written below and we don't want to emit
-                // two `<scope>:registry=` lines (or have the preserved value
-                // shadow the explicit one). The override-wins symmetry also
-                // applies to the auth-family lines for the old origin: dropping
-                // the registry line while keeping a `//old-origin/:_authToken=`
-                // around would leave a dangling secret pointed at no registry
-                // entry in the rendered file.
-                if (config.scopes && config.scopes[scope]) {
-                    continue;
-                }
-                const key = `${scope}:registry`;
-                const value = parsedExisting[key];
-                if (typeof value === "string") {
-                    obj[key] = value;
-                    // Also preserve every auth-family key keyed on the same
-                    // `//<origin>/` prefix as the preserved registry URL. Without
-                    // this, EE-baked `.npmrc` files that ship both
-                    // `@superblocksteam:registry=https://npm.pkg.github.com/` AND
-                    // `//npm.pkg.github.com/:_authToken=<ghpr-token>` lose the
-                    // token on the first `writeNpmrc` call, and every
-                    // `@superblocksteam/*` install 401s against GHPR (APPS-4300).
-                    //
-                    // npm/pnpm support multiple auth shapes against the same
-                    // origin: bearer (`_authToken`), Basic (`_password` +
-                    // `username` + `email`), and the legacy base64 (`_auth`).
-                    // We preserve all of them so a future EE image change that
-                    // swaps from bearer to Basic doesn't silently regress to the
-                    // same failure mode.
-                    //
-                    // `always-auth` is deliberately NOT preserved: npm removed it
-                    // as a recognized key in npm 7+, and npm 11 (the dev-server's
-                    // pinned version) emits `npm warn Unknown user config
-                    // "always-auth" … This will stop working in the next major
-                    // version of npm` on every invocation that reads it — auth
-                    // still attaches from the sibling `_authToken`, so carrying it
-                    // forward is a no-op that only generates stderr noise today and
-                    // risks a hard error once we move to npm 12. Dropping it from
-                    // the preserve set means a customer `.npmrc` that happens to
-                    // carry `//origin/:always-auth` simply loses a dead key (APPS-4430).
-                    //
-                    // Each `parsedExisting[copyKey]` returns the same `unknown`
-                    // shape as the registry line above; only string values are
-                    // safe to round-trip back through `ini.stringify`. Non-string
-                    // values follow the same drop+warn handling.
-                    const preservedAuthOrigin = toNpmAuthOrigin(value);
-                    if (preservedAuthOrigin) {
-                        const authFamilyKeys = [
-                            "_authToken",
-                            "_password",
-                            "username",
-                            "email",
-                            "_auth",
-                        ];
-                        for (const authKey of authFamilyKeys) {
-                            const copyKey = `${preservedAuthOrigin}:${authKey}`;
-                            const authValue = parsedExisting[copyKey];
-                            // `ini.parse` coerces a bare `true`/`false`/numeric value to
-                            // its JS primitive equivalent. The auth-family keys above are
-                            // all string-valued, but coerce back to a string defensively
-                            // so `ini.stringify` emits a valid line (it accepts strings,
-                            // booleans, and numbers, but our internal `obj` map is typed
-                            // `Record<string, string>` for the registry/auth lines
-                            // elsewhere in this writer, so the cast is contained).
-                            if (typeof authValue === "string" ||
-                                typeof authValue === "boolean" ||
-                                typeof authValue === "number") {
-                                obj[copyKey] = String(authValue);
-                            }
-                            else if (authValue !== undefined) {
-                                getLogger().warn("[npm-registry] preserve-scope auth-family key parsed to unsupported type; dropping", {
-                                    path: targetPath,
-                                    scope,
-                                    authKey,
-                                    valueType: typeof authValue,
-                                });
-                            }
-                        }
-                    }
-                }
-                else if (value !== undefined) {
-                    // Key parsed but value is not a string — e.g. a bare key (`true`),
-                    // a section header above it, or a quoted value whose `JSON.parse`
-                    // failed inside `ini`. We're about to silently drop the preserve
-                    // target, so surface so the operator can repair the file.
-                    getLogger().warn("[npm-registry] preserve-scope key parsed to non-string; dropping", {
-                        path: targetPath,
-                        scope,
-                        valueType: typeof value,
-                    });
-                }
-                // value === undefined is the normal case when the existing .npmrc
-                // simply doesn't list this scope — silent on that.
-            }
-        }
-    }
     if (config.default) {
         const normalizedDefaultUrl = normalizeRegistryUrl(config.default.url);
         obj["registry"] = normalizedDefaultUrl;
@@ -1862,11 +1885,17 @@ export async function ensureNpmrcGitignored(dir) {
  * Returns the resolved fetch result so callers can branch on `source` for
  * observability, or `undefined` when no client was provided.
  */
-export async function maybeWriteNpmrcForDir(dir, options = {}, client) {
+export async function maybeWriteNpmrcForDir(dir, client) {
     if (!client) {
         return undefined;
     }
-    const result = await client.getConfig();
+    // Force-refresh: this is the `.npmrc` synthesis / install write boundary,
+    // so it must observe an admin clearing or changing the registry
+    // immediately rather than waiting out the TTL. A cleared
+    // registry resolves fresh as `not-configured`, which the branch below
+    // tears down the project `.npmrc` for. The last-known-good fallback on a
+    // server outage still applies — only the cache-hit read is bypassed.
+    const result = await client.getConfig({ forceRefresh: true });
     if (result.source === "unreachable") {
         // Transient cold-cache outage. We do NOT know the org's current
         // registry state, so we refuse to act on this signal — neither
@@ -1887,15 +1916,13 @@ export async function maybeWriteNpmrcForDir(dir, options = {}, client) {
             // Even without registry rows the org policy disallows install
             // scripts.  Bake `ignore-scripts=true` into the project `.npmrc`
             // so any npm/pnpm invocation (patch-package, husky, ad-hoc
-            // `bash npm install`) honours the policy.  `writeNpmrc` with a
-            // policy-only config preserves existing scope lines (e.g. the
-            // EE-baked `@superblocksteam:registry=`) via `preserveScopeLines`.
+            // `bash npm install`) honours the policy.
             //
             // Skip `snapshotInitialNpmrc`: on a repeated sync the target
             // already contains our policy file; snapshotting it would poison
             // the backup so a later flip to allowInstallScripts=true could
             // never restore the original baked content.
-            await writeNpmrc(npmrcPath, result.config, options);
+            await writeNpmrc(npmrcPath, result.config);
         }
         else {
             // Clean up a stale policy-only `.npmrc` left by a previous call
@@ -1955,7 +1982,7 @@ export async function maybeWriteNpmrcForDir(dir, options = {}, client) {
     // Snapshot AFTER the gitignore check (we don't need a backup if we're
     // refusing to write).
     await snapshotInitialNpmrc(npmrcPath, backupPath);
-    await writeNpmrc(npmrcPath, result.config, options);
+    await writeNpmrc(npmrcPath, result.config);
     return result;
 }
 /**
@@ -1991,11 +2018,11 @@ export async function maybeWriteNpmrcForDir(dir, options = {}, client) {
  * can branch on `source` for observability), or `undefined` when no client
  * was provided. The lockfile strip happens in both cases.
  */
-export async function prepareForPrivateRegistry(dir, options = {}, client) {
+export async function prepareForPrivateRegistry(dir, client) {
     return withNpmRegistrySpan(NPM_REGISTRY_SPAN.PREPARE_FOR_PRIVATE_REGISTRY, client?.organizationId
         ? { [NPM_REGISTRY_SPAN_ATTR.ORG_ID]: client.organizationId }
         : {}, async (span) => {
-        const result = await maybeWriteNpmrcForDir(dir, options, client);
+        const result = await maybeWriteNpmrcForDir(dir, client);
         await stripResolvedFromLockfile(dir);
         if (result) {
             span.setAttributes({