From 08a9983984a477c01f73781c6a4875a47f2ed8c9 Mon Sep 17 00:00:00 2001
From: Vishesh 'ironeagle' Bangotra <aetoskia@gmail.com>
Date: Wed, 21 Oct 2026 01:09:23 +0530
Subject: [PATCH] Fix npm .npmrc: fold NPM_HOST into the same shell as its use

Drone runs each command list item in a separate shell, so a
standalone NPM_HOST= line is empty when the next item references it,
writing //:_auth= (wrong host) and causing a registry 401. Compute
NPM_HOST in the same | block that writes .npmrc.
---
 standards/mcp/templates/drone/npm-lib.yaml | 33 +++++++++++-----------
 standards/src/templates/drone/npm-lib.yaml | 33 +++++++++++-----------
 2 files changed, 34 insertions(+), 32 deletions(-)

diff --git a/standards/mcp/templates/drone/npm-lib.yaml b/standards/mcp/templates/drone/npm-lib.yaml
index 9513b61..2ab3a5b 100644
--- a/standards/mcp/templates/drone/npm-lib.yaml
+++ b/standards/mcp/templates/drone/npm-lib.yaml
@@ -22,18 +22,17 @@ steps:
         from_secret: NPM_PASSWORD
     commands:
       - apk add --no-cache curl
-      - PACKAGE_NAME=$(node -p "require('./package.json').name")
-      - VERSION=$(node -p "require('./package.json').version")
       - |
+        PACKAGE_NAME=$(node -p "require('./package.json').name")
+        VERSION=$(node -p "require('./package.json').version")
         if [ "$DRONE_TAG" != "$VERSION" ]; then
           echo "Tag '$DRONE_TAG' does not match package.json version '$VERSION'; refusing to publish."
           exit 1
         fi
-      - NPM_HOST=$(echo "$NPM_REPO_URL" | sed -E 's|^[a-z]+://||; s|/*$||')
-      - echo "registry=$NPM_REPO_URL" > /tmp/.npmrc
-      - echo "//$NPM_HOST/:_auth=$(echo -n "$NPM_USERNAME:$NPM_PASSWORD" | base64 | tr -d '\n')" >> /tmp/.npmrc
-      - echo "Checking if $PACKAGE_NAME@$VERSION exists on $NPM_REPO_URL ..."
-      - |
+        NPM_HOST=$(echo "$NPM_REPO_URL" | sed -E 's|^[a-z]+://||; s|/*$||')
+        echo "registry=$NPM_REPO_URL" > /tmp/.npmrc
+        echo "//$NPM_HOST/:_auth=$(echo -n "$NPM_USERNAME:$NPM_PASSWORD" | base64 | tr -d '\n')" >> /tmp/.npmrc
+        echo "Checking if $PACKAGE_NAME@$VERSION exists on $NPM_REPO_URL ..."
         if npm view "$PACKAGE_NAME@$VERSION" version --userconfig /tmp/.npmrc >/dev/null 2>&1; then
           echo "$PACKAGE_NAME@$VERSION already exists; skipping build."
           exit 78
@@ -56,9 +55,9 @@ steps:
           echo "NPM_REPO_URL / NPM_USERNAME / NPM_PASSWORD are not set" >&2
           exit 1
         fi
-      - NPM_HOST=$(echo "$NPM_REPO_URL" | sed -E 's|^[a-z]+://||; s|/*$||')
-      - echo "registry=$NPM_REPO_URL" > .npmrc
-      - echo "//$NPM_HOST/:_auth=$(echo -n "$NPM_USERNAME:$NPM_PASSWORD" | base64 | tr -d '\n')" >> .npmrc
+        NPM_HOST=$(echo "$NPM_REPO_URL" | sed -E 's|^[a-z]+://||; s|/*$||')
+        echo "registry=$NPM_REPO_URL" > .npmrc
+        echo "//$NPM_HOST/:_auth=$(echo -n "$NPM_USERNAME:$NPM_PASSWORD" | base64 | tr -d '\n')" >> .npmrc
       - npm install
       - echo "Running quality gate..."
       - npm run quality-gate
@@ -81,9 +80,10 @@ steps:
       NPM_PASSWORD:
         from_secret: NPM_PASSWORD
     commands:
-      - NPM_HOST=$(echo "$NPM_REPO_URL" | sed -E 's|^[a-z]+://||; s|/*$||')
-      - echo "registry=$NPM_REPO_URL" > .npmrc
-      - echo "//$NPM_HOST/:_auth=$(echo -n "$NPM_USERNAME:$NPM_PASSWORD" | base64 | tr -d '\n')" >> .npmrc
+      - |
+        NPM_HOST=$(echo "$NPM_REPO_URL" | sed -E 's|^[a-z]+://||; s|/*$||')
+        echo "registry=$NPM_REPO_URL" > .npmrc
+        echo "//$NPM_HOST/:_auth=$(echo -n "$NPM_USERNAME:$NPM_PASSWORD" | base64 | tr -d '\n')" >> .npmrc
       - echo "Publishing to private npm at $NPM_REPO_URL ..."
       - npm publish --access restricted
 
@@ -120,9 +120,10 @@ steps:
         from_secret: NPM_PASSWORD
     commands:
       - apk add --no-cache git
-      - NPM_HOST=$(echo "$NPM_REPO_URL" | sed -E 's|^[a-z]+://||; s|/*$||')
-      - echo "registry=$NPM_REPO_URL" > /tmp/.npmrc
-      - echo "//$NPM_HOST/:_auth=$(echo -n "$NPM_USERNAME:$NPM_PASSWORD" | base64 | tr -d '\n')" >> /tmp/.npmrc
+      - |
+        NPM_HOST=$(echo "$NPM_REPO_URL" | sed -E 's|^[a-z]+://||; s|/*$||')
+        echo "registry=$NPM_REPO_URL" > /tmp/.npmrc
+        echo "//$NPM_HOST/:_auth=$(echo -n "$NPM_USERNAME:$NPM_PASSWORD" | base64 | tr -d '\n')" >> /tmp/.npmrc
       - |
         set -e
 
diff --git a/standards/src/templates/drone/npm-lib.yaml b/standards/src/templates/drone/npm-lib.yaml
index 9513b61..2ab3a5b 100644
--- a/standards/src/templates/drone/npm-lib.yaml
+++ b/standards/src/templates/drone/npm-lib.yaml
@@ -22,18 +22,17 @@ steps:
         from_secret: NPM_PASSWORD
     commands:
       - apk add --no-cache curl
-      - PACKAGE_NAME=$(node -p "require('./package.json').name")
-      - VERSION=$(node -p "require('./package.json').version")
       - |
+        PACKAGE_NAME=$(node -p "require('./package.json').name")
+        VERSION=$(node -p "require('./package.json').version")
         if [ "$DRONE_TAG" != "$VERSION" ]; then
           echo "Tag '$DRONE_TAG' does not match package.json version '$VERSION'; refusing to publish."
           exit 1
         fi
-      - NPM_HOST=$(echo "$NPM_REPO_URL" | sed -E 's|^[a-z]+://||; s|/*$||')
-      - echo "registry=$NPM_REPO_URL" > /tmp/.npmrc
-      - echo "//$NPM_HOST/:_auth=$(echo -n "$NPM_USERNAME:$NPM_PASSWORD" | base64 | tr -d '\n')" >> /tmp/.npmrc
-      - echo "Checking if $PACKAGE_NAME@$VERSION exists on $NPM_REPO_URL ..."
-      - |
+        NPM_HOST=$(echo "$NPM_REPO_URL" | sed -E 's|^[a-z]+://||; s|/*$||')
+        echo "registry=$NPM_REPO_URL" > /tmp/.npmrc
+        echo "//$NPM_HOST/:_auth=$(echo -n "$NPM_USERNAME:$NPM_PASSWORD" | base64 | tr -d '\n')" >> /tmp/.npmrc
+        echo "Checking if $PACKAGE_NAME@$VERSION exists on $NPM_REPO_URL ..."
         if npm view "$PACKAGE_NAME@$VERSION" version --userconfig /tmp/.npmrc >/dev/null 2>&1; then
           echo "$PACKAGE_NAME@$VERSION already exists; skipping build."
           exit 78
@@ -56,9 +55,9 @@ steps:
           echo "NPM_REPO_URL / NPM_USERNAME / NPM_PASSWORD are not set" >&2
           exit 1
         fi
-      - NPM_HOST=$(echo "$NPM_REPO_URL" | sed -E 's|^[a-z]+://||; s|/*$||')
-      - echo "registry=$NPM_REPO_URL" > .npmrc
-      - echo "//$NPM_HOST/:_auth=$(echo -n "$NPM_USERNAME:$NPM_PASSWORD" | base64 | tr -d '\n')" >> .npmrc
+        NPM_HOST=$(echo "$NPM_REPO_URL" | sed -E 's|^[a-z]+://||; s|/*$||')
+        echo "registry=$NPM_REPO_URL" > .npmrc
+        echo "//$NPM_HOST/:_auth=$(echo -n "$NPM_USERNAME:$NPM_PASSWORD" | base64 | tr -d '\n')" >> .npmrc
       - npm install
       - echo "Running quality gate..."
       - npm run quality-gate
@@ -81,9 +80,10 @@ steps:
       NPM_PASSWORD:
         from_secret: NPM_PASSWORD
     commands:
-      - NPM_HOST=$(echo "$NPM_REPO_URL" | sed -E 's|^[a-z]+://||; s|/*$||')
-      - echo "registry=$NPM_REPO_URL" > .npmrc
-      - echo "//$NPM_HOST/:_auth=$(echo -n "$NPM_USERNAME:$NPM_PASSWORD" | base64 | tr -d '\n')" >> .npmrc
+      - |
+        NPM_HOST=$(echo "$NPM_REPO_URL" | sed -E 's|^[a-z]+://||; s|/*$||')
+        echo "registry=$NPM_REPO_URL" > .npmrc
+        echo "//$NPM_HOST/:_auth=$(echo -n "$NPM_USERNAME:$NPM_PASSWORD" | base64 | tr -d '\n')" >> .npmrc
       - echo "Publishing to private npm at $NPM_REPO_URL ..."
       - npm publish --access restricted
 
@@ -120,9 +120,10 @@ steps:
         from_secret: NPM_PASSWORD
     commands:
       - apk add --no-cache git
-      - NPM_HOST=$(echo "$NPM_REPO_URL" | sed -E 's|^[a-z]+://||; s|/*$||')
-      - echo "registry=$NPM_REPO_URL" > /tmp/.npmrc
-      - echo "//$NPM_HOST/:_auth=$(echo -n "$NPM_USERNAME:$NPM_PASSWORD" | base64 | tr -d '\n')" >> /tmp/.npmrc
+      - |
+        NPM_HOST=$(echo "$NPM_REPO_URL" | sed -E 's|^[a-z]+://||; s|/*$||')
+        echo "registry=$NPM_REPO_URL" > /tmp/.npmrc
+        echo "//$NPM_HOST/:_auth=$(echo -n "$NPM_USERNAME:$NPM_PASSWORD" | base64 | tr -d '\n')" >> /tmp/.npmrc
       - |
         set -e