[Bug] .opencode/package-lock.json generated without respecting ~/.npmrc `registry` configuration

[FurryWolfX]

Description

When opencode generates the .opencode/package-lock.json file , it does not respect the registry configuration specified in the user's ~/.npmrc file. The generated package-lock.json appears to use default npm registry settings instead of user-configured values.

Expected Behavior

When generating .opencode/package-lock.json, opencode should read and respect the npm repository configuration from ~/.npmrc, including:

• Custom registry URLs
• Any other relevant npm configuration

Actual Behavior

The generated .opencode/package-lock.json does not reflect the user's ~/.npmrc configuration. It seems to ignore the registry field entirely when resolving package dependencies.

Plugins

omo

OpenCode version

1.3.15

Steps to reproduce

1. Use the latest version of opencode
2. Run opencode command that triggers package-lock.json generation
3. Observe the generated .opencode/package-lock.json

Screenshot and/or share link

No response

Operating System

macos

Terminal

iTerm2

[FurryWolfX]

I see opencode previously generated bun.lock - are you planning to migrate to npm?

[FurryWolfX]

The Arborist instance in packages/opencode/src/npm/index.ts is created without passing the registry option:

const arb = new Arborist({
  path: dir,
  binLinks: true,
  progress: false,
  savePrefix: "",
  ignoreScripts: true,
  // Missing: registry option
})

Without explicit registry configuration, @npmcli/arborist defaults to https://registry.npmjs.org regardless of any .npmrc settings.

Impact

• Users in regions with restricted access to registry.npmjs.org cannot use opencode effectively
• Enterprise users with private registries cannot install packages through opencode
• Inconsistent behavior compared to running npm install directly

Proposed Solution

Use @npmcli/config to read the .npmrc and pass the registry to Arborist:

import { readConfig } from "@npmcli/config"

const npmConfig = await readConfig(dir)
const arb = new Arborist({
  path: dir,
  registry: npmConfig.get("registry"),
  // ...other options
})

Alternatively, read the registry directly from the .npmrc file and pass it to Arborist.

[kdybicz]

I have both package-lock.json and bun.lock in my .opencode folder now, and the package-lock.json isn't added to .gitignore in contrast to bun.lock. This change feels unintentional 🤔