[Bug]: Updating the providers has a [warn] message from npm

[youssef3698]

Before submitting

• I searched existing issues and did not find a duplicate.
• I included enough detail to reproduce or investigate the problem.

Area

Not sure

Steps to reproduce

1- Start the app
2- Click on the update button next to the provider name in the "Providers" tab
3- Paste the copied command in the terminal
4- Run

Expected behavior

The update should begin with no warnings from npm

Actual behavior

npm warn Unknown cli config "--allow-scripts". This will stop working in the next major version of npm.

Impact

Minor bug or occasional failure

Version or commit

stable @ 0.0.42

Environment

Windows 11

Logs or stack traces

PS C:\windows\system32> npm install -g --prefix C:\Users\Youssef\AppData\Roaming\npm --allow-scripts=opencode-ai opencode-ai@latest
npm warn Unknown cli config "--allow-scripts". This will stop working in the next major version of npm.

changed 3 packages in 1m
PS C:\windows\system32> npm install -g --prefix C:\Users\Youssef\AppData\Roaming\npm --allow-scripts=@openai/codex @openai/codex@latest
npm warn Unknown cli config "--allow-scripts". This will stop working in the next major version of npm.

Screenshots, recordings, or supporting files

No response

Workaround

No response

[juliusmarminge]

Thanks for the report — this is expected on npm 10 and older, and the update itself succeeded.

The Providers tab copies the npm-global update command from providerMaintenance.ts. We pass --allow-scripts=<package> on purpose: npm 12 blocks install scripts by default, still exits 0, and can leave a provider CLI broken (see #5627, fixed in #5646). The flag is scoped to the one package being updated.

npm 11+ understands allow-scripts. Older npm treats the flag as unknown CLI config, prints exactly the warning you saw, and continues. Your logs match that path (changed 3 packages).

You can ignore the warning, omit --allow-scripts=… when pasting on npm 10, or upgrade npm to 11+. We are not changing the command: dropping the flag would re-break npm 12 updates.

Closing as a known compatibility warning, not a failed update.