Description

NpmrcAuth::from_url_scoped_env (pacquet) only applies URL-scoped env vars that match credential
suffixes, so URL-scoped TLS settings like //host/:cafile, :certfile, and :keyfile provided via
npm_config_//… / pnpm_config_//… are silently ignored. The JS config reader imports arbitrary
//… env keys (except tokenHelper) and getNetworkConfigs actively interprets TLS keys, so pnpm
and pacquet can diverge in environments that rely on env-provided CA/client cert configuration.

Code

pacquet/crates/config/src/npmrc_auth.rs[R179-206]

+    /// Only the four credential fields (`_authToken`, `_auth`, `username`,
+    /// `_password`) are honored — the same set [`split_creds_key`] recognises.
+    /// Values are used verbatim (no `${VAR}` re-expansion): they already come
+    /// resolved from the environment.
+    pub fn from_url_scoped_env<Sys: EnvVar>() -> Self {
+        // Merge into one map keyed by the URL-scoped key so each key is applied
+        // once. `pnpm_config_` is extended last so it wins over `npm_config_`.
+        let mut npm_scoped: HashMap<String, String> = HashMap::new();
+        let mut pnpm_scoped: HashMap<String, String> = HashMap::new();
+        for (name, value) in Sys::vars() {
+            if value.is_empty() {
+                continue;
+            }
+            if let Some((is_pnpm, key)) = parse_url_scoped_env_name(&name) {
+                let target = if is_pnpm { &mut pnpm_scoped } else { &mut npm_scoped };
+                target.insert(key.to_owned(), value);
+            }
+        }
+        npm_scoped.extend(pnpm_scoped);
+
+        let mut auth = NpmrcAuth::default();
+        for (key, value) in npm_scoped {
+            if let Some((uri, suffix)) = split_creds_key(&key) {
+                let entry = auth.creds_by_uri.entry(uri.to_owned()).or_default();
+                apply_creds_field(entry, suffix, value);
+            }
+        }
+        auth

Evidence

JS reads any //… env key (dropping only :tokenHelper) and later parses TLS keys; pacquet’s env
reader explicitly limits itself to the four credential fields despite having TLS key parsing helpers
for .npmrc files.

config/reader/src/loadNpmrcFiles.ts[160-193]
config/reader/src/getNetworkConfigs.ts[31-40]
config/reader/src/getNetworkConfigs.ts[94-113]
pacquet/crates/config/src/npmrc_auth.rs[167-207]
pacquet/crates/config/src/npmrc_auth.rs[879-910]

Agent prompt

The issue below was found during a code review. Follow the provided context and guidance below and implement a solution

## Issue description
`pacquet` supports parsing URL-scoped TLS keys from `.npmrc` (e.g. `//host/:cafile`, `//host/:certfile`, `//host/:keyfile`, and inline `:ca/:cert/:key`), but the new URL-scoped env-var reader only imports credential fields. This creates a behavior gap vs pnpm’s JS config reader, which will honor URL-scoped TLS keys from the env layer.
## Issue Context
- JS path: URL-scoped env vars are merged into `rawConfig` without restricting suffixes (except `tokenHelper`), and `getNetworkConfigs()` parses TLS suffixes and loads file contents / expands `\\n`.
- Rust path: `from_url_scoped_env` only looks at `split_creds_key`, ignoring TLS keys despite having TLS parsing support elsewhere.
## Fix Focus Areas
- pacquet/crates/config/src/npmrc_auth.rs[167-207]
- pacquet/crates/config/src/npmrc_auth.rs[879-910]
- config/reader/src/loadNpmrcFiles.ts[160-193]
- config/reader/src/getNetworkConfigs.ts[31-40]

ⓘ Copy this prompt and use it to remediate the issue with your preferred AI generation tools

Description

In parse_url_scoped_env_name, byte-index string slicing (name[..prefix.len()] /
name[prefix.len()..]) can panic if an environment variable name contains non-ASCII characters such
that prefix.len() is not a UTF-8 boundary, crashing config loading.

Code

pacquet/crates/config/src/npmrc_auth.rs[R835-840]

+fn parse_url_scoped_env_name(name: &str) -> Option<(bool, &str)> {
+    for (prefix, is_pnpm) in [("pnpm_config_", true), ("npm_config_", false)] {
+        if name.len() > prefix.len() && name[..prefix.len()].eq_ignore_ascii_case(prefix) {
+            let rest = &name[prefix.len()..];
+            if rest.starts_with("//") {
+                return Some((is_pnpm, rest));

Evidence

The implementation performs direct byte-index slicing on name, which is a &str from
std::env::vars(); such slicing can panic at runtime if the index is not a UTF-8 boundary.

pacquet/crates/config/src/npmrc_auth.rs[830-845]

Agent prompt

The issue below was found during a code review. Follow the provided context and guidance below and implement a solution

## Issue description
`parse_url_scoped_env_name()` slices a `&str` using byte indices (`name[..prefix.len()]` and `name[prefix.len()..]`). In Rust this can panic when the slice boundary is not a UTF-8 character boundary, which is possible for env var names containing non-ASCII characters.
### Issue Context
This code runs while enumerating the full process environment (`Sys::vars()`), so a single oddly-named env var can crash config resolution.
### Fix Focus Areas
- pacquet/crates/config/src/npmrc_auth.rs[835-842]
### Suggested fix
Avoid manual slicing and use safe prefix handling, e.g.:
- `if let Some(rest) = name.strip_prefix(prefix).or_else(|| name.get(..prefix.len()).filter(...)) { ... }`
- Prefer `strip_prefix` with `eq_ignore_ascii_case` by checking via `name.get(..prefix.len())` (returns `Option<&str>`), then slicing only after confirming boundaries.
One simple pattern:
- Use `name.get(..prefix.len())` for the case-insensitive compare.
- Use `name.get(prefix.len()..)` to obtain `rest` without panicking.
- Proceed only when both are `Some(...)` and `rest.starts_with("//")`.

ⓘ Copy this prompt and use it to remediate the issue with your preferred AI generation tools

Description

readUrlScopedEnvConfig imports any //… key from npm_config_//… / pnpm_config_//… into
rawConfig, so a //…:tokenHelper env var will be included in pnpmConfig.authConfig.
getConfig() then throws TOKEN_HELPER_IN_PROJECT_CONFIG unless the key/value also exists in
userConfig, incorrectly rejecting trusted env-provided tokenHelper values (and potentially
breaking environments that already export such vars).

Code

config/reader/src/loadNpmrcFiles.ts[R160-183]

+// Matches `npm_config_//…` and `pnpm_config_//…` env var names. The prefix is
+// matched case-insensitively (as npm does), but the captured key keeps its
+// original case because URL-scoped keys are case-sensitive (e.g. `:_authToken`).
+const URL_SCOPED_ENV_RE = /^p?npm_config_(\/\/.+)$/i
+
+// Collect URL-scoped settings (keys beginning with `//host…`, such as
+// `//registry.npmjs.org/:_authToken`) from `npm_config_//…` and `pnpm_config_//…`
+// environment variables. These are host-scoped by construction — the registry
+// the value applies to is part of the variable name — so they are safe to honor
+// from the trusted environment without a config file. When the same key is set
+// through both prefixes, `pnpm_config_` wins.
+function readUrlScopedEnvConfig (env: Record<string, string | undefined>): Record<string, unknown> {
+  const npmScoped: Record<string, string> = {}
+  const pnpmScoped: Record<string, string> = {}
+  for (const envKey of Object.keys(env)) {
+    const value = env[envKey]
+    if (value == null || value === '') continue
+    const match = URL_SCOPED_ENV_RE.exec(envKey)
+    if (match == null) continue
+    const target = envKey.slice(0, 5).toLowerCase() === 'pnpm_' ? pnpmScoped : npmScoped
+    target[match[1]] = value
+  }
+  return { ...npmScoped, ...pnpmScoped }
+}

Evidence

The new env reader captures any URL-scoped key and merges it into the raw/trusted configs; because
INI config allows any key beginning with //, a //…:tokenHelper env var will flow into
pnpmConfig.authConfig. The existing tokenHelper guard only permits values that are present in
userConfig, so the env-provided value will fail that check and throw.

config/reader/src/loadNpmrcFiles.ts[116-147]
config/reader/src/loadNpmrcFiles.ts[160-183]
config/reader/src/localConfig.ts[189-199]
config/reader/src/index.ts[343-352]

Agent prompt

The issue below was found during a code review. Follow the provided context and guidance below and implement a solution

## Issue description
URL-scoped env vars (`npm_config_//…` / `pnpm_config_//…`) currently accept any `//…` key, including `//…:tokenHelper`. After this PR, such env-provided tokenHelper entries become part of `pnpmConfig.authConfig`, but `getConfig()` only allows tokenHelper values originating from `userConfig`, so it throws `TOKEN_HELPER_IN_PROJECT_CONFIG` even though the PR explicitly treats the env-scoped layer as trusted.
## Issue Context
- `readUrlScopedEnvConfig()` returns all `//…` keys from env and merges them into `rawConfig`/`trustedConfig`.
- `pickIniConfig()` includes all keys starting with `//`.
- The tokenHelper safety check in `getConfig()` currently compares only against `npmrcResult.userConfig`.
## Fix Focus Areas
- config/reader/src/loadNpmrcFiles.ts[160-183]
- config/reader/src/loadNpmrcFiles.ts[116-147]
- config/reader/src/index.ts[343-352]
## Suggested fix approach
Either:
1) Tighten `readUrlScopedEnvConfig()` to only admit the intended safe URL-scoped auth keys (e.g. `:_authToken`, `:_auth`, `:username`, `:_password`, `:cert`, `:key`, `:ca`, `:cafile`, etc.) and explicitly exclude `:tokenHelper`, **or**
2) Update the tokenHelper validation to treat `envScopedConfig` as a trusted source (e.g., validate tokenHelper against `trustedAuthConfig` / `npmrcResult.trustedConfig` rather than only `userConfig`, while still rejecting values that originate from the workspace `.npmrc`).
Add/adjust a test to cover `pnpm_config_//…/:tokenHelper` behavior based on the intended policy.

ⓘ Copy this prompt and use it to remediate the issue with your preferred AI generation tools

Description

readUrlScopedEnvConfig skips URL-scoped env vars whose value is '', so an explicitly-empty env
var cannot override/clear the same URL-scoped key coming from a workspace .npmrc or other layer.
This diverges from the existing pnpm_config_* env parsing (which accepts empty strings) and from
.npmrc parsing (which does not drop empty values).

Code

config/reader/src/loadNpmrcFiles.ts[R171-177]

+function readUrlScopedEnvConfig (env: Record<string, string | undefined>): Record<string, unknown> {
+  const npmScoped: Record<string, string> = {}
+  const pnpmScoped: Record<string, string> = {}
+  for (const envKey of Object.keys(env)) {
+    const value = env[envKey]
+    if (value == null || value === '') continue
+    const match = URL_SCOPED_ENV_RE.exec(envKey)

Evidence

The new env reader explicitly filters out empty strings, whereas the existing env parser only
filters out null/undefined, and .npmrc parsing keeps the parsed value without an empty-string
skip. Therefore URL-scoped env vars behave differently and cannot be used to intentionally clear a
key.

config/reader/src/loadNpmrcFiles.ts[171-177]
config/reader/src/env.ts[42-53]
config/reader/src/loadNpmrcFiles.ts[235-275]

Agent prompt

The issue below was found during a code review. Follow the provided context and guidance below and implement a solution

## Issue description
URL-scoped env config currently ignores empty-string values (`value === ''`). This prevents users from explicitly overriding/clearing a URL-scoped key via env, and makes the semantics inconsistent with other env parsing paths in the config reader.
## Issue Context
- `parseEnvVars()` accepts empty strings (it only skips null/undefined).
- `.npmrc` parsing stores values as-is (including empty strings).
## Fix Focus Areas
- config/reader/src/loadNpmrcFiles.ts[171-181]
- config/reader/src/env.ts[42-53]
- config/reader/test/index.ts[983-1045]
## Suggested fix approach
Remove the `value === ''` exclusion (keep only `value == null`), and add a test demonstrating the desired behavior (e.g. env `npm_config_//host/:_authToken=''` overrides a workspace `.npmrc` token to empty / disables it). If empty auth values should be rejected, implement explicit validation at the point of use rather than silently ignoring the env var.

ⓘ Copy this prompt and use it to remediate the issue with your preferred AI generation tools

Walkthrough

This PR adds support for configuring URL-scoped registry authentication via environment variables using npm_config_//… and pnpm_config_//…. The code extracts these vars, merges them into the config/auth precedence (pnpm_ wins over npm_, env wins over project .npmrc), marks them trusted, and adds unit/tests and a changeset.

Changes

URL-scoped environment configuration

Sequence Diagram(s)

sequenceDiagram
  participant loadNpmrcConfig as loadNpmrcConfig
  participant EnvProvider as EnvVar::vars()
  participant Parser as readUrlScopedEnvConfig
  participant Merger as mergedConfig/trustedConfig/rawConfig
  loadNpmrcConfig->>EnvProvider: request env variables
  EnvProvider->>Parser: provide (name,value) list
  Parser->>Parser: match npm_config_//… / pnpm_config_//…, filter, merge pnpm_ over npm_
  Parser-->>loadNpmrcConfig: envScopedConfig
  loadNpmrcConfig->>Merger: prepend env-scoped source into merge chain
  Merger->>Merger: fold env-scoped before project/auth.ini/user sources

Estimated code review effort

🎯 4 (Complex) | ⏱️ ~45 minutes

Possibly related issues

• feat(config,network): per-registry TLS overrides (//host:cafile, //host:ca, //host:cert, //host:key) pacquet#497: Related — touches the same config/npmrc auth parsing and EnvVar enumeration code paths.
• Support npm-style auth tokens and scoped registries from .npmrc pacquet#250: Related — overlaps in handling npmrc auth/credentials and scoped registries.

Possibly related PRs

• pnpm/pnpm#11730: Related refactor of the Host/EnvVar seam that this PR extends with EnvVar::vars and URL-scoped env parsing.

Poem

🐰 I sniff the env where tokens hide,
pnpm_ hops ahead with bounding stride,
Keys parsed neat from names that start with //,
Trusted and high, they leap past .npmrc,
A carrot cheer for smooth registry glide.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

• X
• Mastodon
• Reddit
• LinkedIn

• Support URL-scoped registry auth via npm_config_//… and pnpm_config_//… env vars
• Merge env-scoped credentials as trusted config above workspace .npmrc but below CLI
• Add tests for env parsing, precedence, and workspace override behavior

The following are alternative approaches to this PR:

Recommendation: The PR’s approach (only //-scoped env keys, merged above workspace .npmrc and included in trustedConfig) is the best tradeoff: it enables file-free auth while keeping credentials host-bound by construction and avoiding redirect attacks. The broader/unscoped alternatives add UX convenience but significantly increase credential exfiltration risk.

loadNpmrcFiles.ts Merge URL-scoped env config into npmrc load pipeline +39/-4

Merge URL-scoped env config into npmrc load pipeline

• Adds parsing of 'npm_config_//…' and 'pnpm_config_//…' environment variables into a URL-scoped config object, preserving key case while matching prefixes case-insensitively. Integrates this env-scoped layer into 'mergedConfig', 'rawConfig', and 'trustedConfig' with precedence between workspace '.npmrc' and CLI options, and defines 'pnpm_config_' as the winner when both are set.

config/reader/src/loadNpmrcFiles.ts

---

index.ts Test env-scoped auth parsing and precedence rules +64/-0

Test env-scoped auth parsing and precedence rules

• Adds tests covering reading URL-scoped auth from both 'npm_config_//…' and 'pnpm_config_//…', the precedence of 'pnpm_config_' over 'npm_config_', and env-scoped auth overriding a workspace '.npmrc' token for the same host.

config/reader/test/index.ts

---

quick-registries-env-auth.md Add changeset for URL-scoped auth env vars +13/-0

Add changeset for URL-scoped auth env vars

• Introduces a changeset announcing minor bumps for '@pnpm/config.reader' and 'pnpm'. Documents the new 'npm_config_//…' and 'pnpm_config_//…' env var support, including precedence and trust rationale.

.changeset/quick-registries-env-auth.md

---

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.