Load npm config as part of fix (#674)

Author: jdalton

package-lock.json

@@ -90,6 +90,7 @@
     "@eslint/compat": "1.3.1",
     "@eslint/js": "9.29.0",
     "@npmcli/arborist": "9.1.2",
+    "@npmcli/config": "10.3.0",
     "@octokit/graphql": "9.0.1",
     "@octokit/openapi-types": "25.1.0",
     "@octokit/request-error": "7.0.0",
@@ -119,6 +120,7 @@
     "@types/mock-fs": "4.13.4",
     "@types/node": "24.0.4",
     "@types/npmcli__arborist": "6.3.1",
+    "@types/npmcli__config": "6.0.3",
     "@types/proc-log": "3.0.4",
     "@types/semver": "7.7.0",
     "@types/which": "3.0.4",

package.json

@@ -1,9 +1,21 @@
+import { realpathSync } from 'node:fs'
+import path from 'node:path'
+
+import NpmConfig from '@npmcli/config'
+import {
+  definitions as npmConfigDefinitions,
+  flatten as npmConfigFlatten,
+  shorthands as npmConfigShorthands,
+  // @ts-ignore
+} from '@npmcli/config/lib/definitions'
+
 import { debugFn, isDebug } from '@socketsecurity/registry/lib/debug'
 
 import { agentFix } from './agent-fix.mts'
 import { getCiEnv, getOpenPrsForEnvironment } from './fix-env-helpers.mts'
 import { getActualTree } from './get-actual-tree.mts'
 import { getAlertsMapOptions } from './shared.mts'
+import constants from '../../constants.mts'
 import {
   Arborist,
   SAFE_ARBORIST_REIFY_OPTIONS_OVERRIDES,
@@ -57,9 +69,27 @@ export async function npmFix(
         getAlertsMapOptions({ limit: Math.max(limit, openPrs.length) }),
       )
     } else {
+      const npmPath = path.resolve(
+        realpathSync(pkgEnvDetails.agentExecPath),
+        '../..',
+      )
+      const config = new NpmConfig({
+        argv: [],
+        cwd: process.cwd(),
+        definitions: npmConfigDefinitions,
+        // Lazily access constants.execPath.
+        execPath: constants.execPath,
+        env: process.env,
+        flatten: npmConfigFlatten,
+        npmPath,
+        platform: process.platform,
+        shorthands: npmConfigShorthands,
+      })
+      await config.load()
       const arb = new Arborist({
         path: pkgEnvDetails.pkgPath,
         ...SAFE_ARBORIST_REIFY_OPTIONS_OVERRIDES,
+        config,
       })
       actualTree = await arb.reify()
       // Calling arb.reify() creates the arb.diff object, nulls-out arb.idealTree,