Profound Logic package registry

CoderFlow's npm packages are published to Profound Logic's own npm registry, https://npm.profoundlogic.com/, instead of the public npm registry. This page explains the move, the one npm setting a self-hosted server needs, and the one-time manual upgrade for servers running CoderFlow 0.16.0 or earlier.

:::tip Hosted by Profound Logic If your CoderFlow instance is hosted by Profound Logic on coderflow.ai, you need do nothing. Profound Logic manages its updates. :::

What changed

Publishing to the public npm registry, registry.npmjs.org, is suspended for Profound Logic's account pending review, so new CoderFlow versions cannot be published there. Profound Logic now hosts the whole @profoundlogic scope itself, at npm.profoundlogic.com:

• New versions of @profoundlogic packages, including @profoundlogic/coderflow-server and @profoundlogic/coderflow-cli, are published only to npm.profoundlogic.com.
• Every version published before the move was copied from registry.npmjs.org with identical integrity values, so existing installations and lockfiles stay valid.
• registry.npmjs.org keeps the versions published before the move but receives no new ones. The newest official CoderFlow server release there is 0.16.0.
• Packages outside the @profoundlogic scope, including every third-party dependency, still come from registry.npmjs.org. npm.profoundlogic.com does not serve or proxy them.

For a self-hosted server this means:

• CoderFlow 0.16.0 and earlier check registry.npmjs.org for updates. They keep reporting that the server is up to date and cannot offer later versions. Upgrade such a server once by hand; see First upgrade.
• Later versions check npm.profoundlogic.com, and their built-in update command installs from it directly. After the first upgrade, Check for Updates and Update Server on Server Administration → Health work as before.
• npm commands you run yourself need the scope setting below. Without it, npm keeps installing the old versions from registry.npmjs.org.

Configure npm

Run this as the account that runs CoderFlow (the service account), not as root or as your personal account:

npm config set @profoundlogic:registry https://npm.profoundlogic.com/

It adds one line to that account's ~/.npmrc:

@profoundlogic:registry=https://npm.profoundlogic.com/

The line affects only @profoundlogic packages. Downloads need no account, token or other credentials.

Set it wherever npm installs @profoundlogic packages:

• On the server, for the CoderFlow service account. Manual npm install -g commands and a custom Update Command rely on it.
• On developer machines that install the CLI.
• In Dockerfiles, configuration management, CI jobs and other scripts that install CoderFlow; see Custom update commands and operator-managed installs.

CoderFlow's own update check, its built-in Update Command and Install from file… do not need the line, because they pass the registry explicitly (see What CoderFlow does itself). Set it on the server anyway, so that manual commands there do not install old versions.

Check the setting

As the same account:

npm config get @profoundlogic:registry
npm view @profoundlogic/coderflow-server dist-tags

The first command prints https://npm.profoundlogic.com/, or your mirror (see Mirrors and air-gapped sites). undefined means the line is missing. The second command reads the release channels through that setting: latest is the current official release and dev the prerelease channel. If latest is 0.16.0 although the release notes list a later version, npm is still reading registry.npmjs.org.

On CoderFlow versions after 0.16.0, also open Server Administration → Health and click Check for Updates. It reads npm.profoundlogic.com, or your override, and reports the same latest. If the registry cannot be reached, the error names the registry host.

Pin the version

Every install command on this page names a version. Replace <version> with the version to install, for example the latest version that npm view prints or the version Check for Updates shows.

An unpinned npm install -g @profoundlogic/coderflow-server on an account without the scope line silently installs 0.16.0 from registry.npmjs.org, which downgrades a newer server. A pinned version that exists only on npm.profoundlogic.com fails with ETARGET (no matching version) instead, which shows that the scope line is missing. Do not reuse unpinned commands from older notes, scripts or documentation.

First upgrade from 0.16.0 or earlier

CoderFlow 0.16.0 and earlier read registry.npmjs.org for updates, and that copy stops at 0.16.0. On those versions Check for Updates reports no newer version, and Update Server cannot install one. Install the first later version by hand once. From then on, Health reads npm.profoundlogic.com, and later updates work from Server Administration → Health as before, even without ~/.npmrc.

Use the SSH steps for your installation type. Use Install from file only when you cannot sign in to the host. Plan a short maintenance window: the restart briefly disconnects signed-in users. The server needs outbound HTTPS to both npm.profoundlogic.com and registry.npmjs.org (see Server Requirements).

Installer-based servers (systemd)

The installer creates the account coderflow unless you chose another name with --user. Replace coderflow below if you did.

1. Switch to the service account:

   sudo -iu coderflow

2. Check that npm is the account's NVS installation:

   command -v npm

   It should print the full path of ~/.nvs/default/bin/npm, for example /home/coderflow/.nvs/default/bin/npm. If it prints another path or nothing, run export PATH="$HOME/.nvs/default/bin:$PATH", the path the service uses, and check again.

3. Set the scope line:

   npm config set @profoundlogic:registry https://npm.profoundlogic.com/

4. Install the new version, replacing <version>:

   npm install -g @profoundlogic/coderflow-server@<version>

   npm 11 may print install scripts not yet covered by allowScripts; see Install the Server.

5. Return to your own account and restart the service:

   exit
   sudo systemctl restart coderflow

6. Check the installation as the service account:

   sudo -iu coderflow
   coder-server doctor
   exit

Then open Server Administration → Health. Server Version shows the new version, and Check for Updates now reads npm.profoundlogic.com.

Older servers managed with PM2

Older manual installations often run under the account coder with PM2. Replace coder with your account name:

sudo -iu coder
command -v npm
npm config set @profoundlogic:registry https://npm.profoundlogic.com/
npm install -g @profoundlogic/coderflow-server@<version>
pm2 restart coderflow --update-env
exit

Check the command -v npm output as in step 2 above. PM2 runs under the service account, so restart it before exit. If the server uses the built-in daemon mode instead of PM2, run coder-server restart in place of the pm2 command. Then run coder-server doctor as the account and check Server Version on Health.

Without SSH: Install from file

:::caution Secondary path Use the SSH steps above when you can. Install from file runs npm inside the running server and is harder to repair if it fails. If anything goes wrong, recover with the SSH steps. :::

You need CoderFlow 0.15.1 or later, Server Admin access, and both Enable Web Updates and Allow local package installation turned on in Server Settings → Update Management.

1. On a machine with internet access, download the package. It is public; no sign-in is needed.

   curl --fail --location --proto '=https' -o coderflow-server-<version>.tgz \
     https://npm.profoundlogic.com/@profoundlogic/coderflow-server/-/coderflow-server-<version>.tgz

2. Check its SHA-512 against the integrity value the registry publishes. Both commands must print the same sha512-… value:

   npm view --@profoundlogic:registry=https://npm.profoundlogic.com/ @profoundlogic/coderflow-server@<version> dist.integrity
   echo "sha512-$(openssl dgst -sha512 -binary coderflow-server-<version>.tgz | openssl base64 -A)"

   If they differ, delete the file and do not install it.

3. Open Server Administration → Health, choose Install from file…, select the file and click Upload and inspect. Check that the uploaded package is @profoundlogic/coderflow-server at the version you downloaded, and that its package SHA-256 equals the SHA-256 of the file you checked in step 2:

   sha256sum coderflow-server-<version>.tgz

   On macOS, use shasum -a 256 instead. A registry download has no deployment checksum attachment; this comparison takes its place. Then click Install inspected package. See Install a downloaded server package for each screen.

4. When the restart confirmation opens, choose Restart Now. Keep the page open until it confirms the new version is running.

The installation runs npm on your current version, which installs the package's dependencies with the service account's npm settings. If it fails with ETARGET or E404 for an @profoundlogic package, that account needs the scope line: use the SSH steps.

After this upgrade, later updates from Health need no SSH. Set the scope line the next time you are on the host anyway, for manual commands.

:::note How to recover If the installation fails, or the server does not come back after the restart, sign in to the host and follow the SSH steps for your installation type. Installing the pinned version again with npm usually repairs a partial installation. The service log shows why the server did not start; on an installer-based server, run sudo journalctl -u coderflow.service --since today. :::

Custom update commands and operator-managed installs

CoderFlow adds the registry only to its built-in Update Command: the default, saved copies of it, and the older default without install flags. It runs any other command exactly as entered. If you use a custom Update Command, or install CoderFlow with Docker, Ansible or other tooling, add the scope line for the account where that npm runs, or pass the registry on the command line:

npm install -g --@profoundlogic:registry=https://npm.profoundlogic.com/ @profoundlogic/coderflow-server@<version>

In a custom Update Command, keep {version} where this example has <version>. A Dockerfile does not see the host's ~/.npmrc: set the registry in the image before installing, for example with RUN npm config set --location=global @profoundlogic:registry https://npm.profoundlogic.com/, or pass the flag. Pin the version in every case.

New installations

The current installer downloads CoderFlow from registry.npmjs.org. It therefore installs 0.16.0, and --version cannot select a later release. After installing, upgrade once with the steps for installer-based servers. Do not pass --registry https://npm.profoundlogic.com/: --registry replaces npm's registry for every dependency, and npm.profoundlogic.com serves only the @profoundlogic scope.

For a manual installation, set the scope line before installing and pin the version.

What CoderFlow does itself

CoderFlow releases after 0.16.0 use the registry as follows:

• Check for Updates, on Health and in the About dialog, reads the release channels from npm.profoundlogic.com. It does not fall back to registry.npmjs.org, which would report old versions as current. If the registry cannot be reached, the error names its host.
• The install command shown with an available update includes the registry, so it also works on a host without the scope line: npm install -g --@profoundlogic:registry=https://npm.profoundlogic.com/ @profoundlogic/coderflow-server@<version>.
• The built-in Update Command, Install from file…, and installs of a server package from a deployment task pass --@profoundlogic:registry= with the registry, so they do not depend on ~/.npmrc.
• When an update is available, the About dialog's Release notes link opens the CoderFlow release notes.

The environment variable CODERFLOW_PROFOUNDLOGIC_REGISTRY replaces npm.profoundlogic.com in all of these; see Mirrors and air-gapped sites. It is set only in the server process's environment; there is no Settings field for it. Other npm commands use the service account's npm settings.

Mirrors and air-gapped sites

If your servers get npm packages through an internal mirror, such as Artifactory, Nexus Repository or Verdaccio:

1. Proxy the scope. Add a proxy (remote) npm repository for https://npm.profoundlogic.com/, and make sure @profoundlogic packages resolve only from it, not from your registry.npmjs.org proxy. Everything else keeps coming from registry.npmjs.org through your existing proxy. In Verdaccio, for example:

   uplinks:
     npmjs:
       url: https://registry.npmjs.org/
     profoundlogic:
       url: https://npm.profoundlogic.com/
   packages:
     '@profoundlogic/*':
       access: $all
       proxy: profoundlogic
     '**':
       access: $all
       proxy: npmjs

   List '@profoundlogic/*' before any '@*/*' or '**' entry. If your mirror combines several upstreams in one group or virtual repository, check that npm view @profoundlogic/coderflow-server dist-tags through the mirror shows the same latest as npm.profoundlogic.com.

2. Point CoderFlow at the mirror. Set CODERFLOW_PROFOUNDLOGIC_REGISTRY in the server process's environment to the mirror URL that serves the scope. It must be an https:// URL without credentials, query or fragment. If the value is not valid, CoderFlow logs a warning and uses https://npm.profoundlogic.com/. On an installer-based server, add a systemd drop-in:

   sudo systemctl edit coderflow

   [Service]
   Environment=CODERFLOW_PROFOUNDLOGIC_REGISTRY=https://npm-mirror.example.com/repository/profoundlogic/

   Then run sudo systemctl restart coderflow. A drop-in leaves the installer's unit file unchanged. With PM2, export the variable in the service account's shell, then run pm2 restart coderflow --update-env and pm2 save.

   CoderFlow's update check reads the mirror without credentials, so the mirror must allow anonymous reads of the package's metadata. Click Check for Updates to confirm: errors name the mirror's host.

3. Point the account's npm at the mirror. For manual commands, set the service account's scope line to the same URL:

   npm config set @profoundlogic:registry https://npm-mirror.example.com/repository/profoundlogic/

   If your mirror needs credentials for npm, configure them as its documentation describes. They belong in ~/.npmrc, never in CODERFLOW_PROFOUNDLOGIC_REGISTRY.

:::warning A mirror in ~/.npmrc alone is bypassed CoderFlow's own update commands pass the registry with an explicit --@profoundlogic:registry= flag, which takes precedence over ~/.npmrc. If you configure the mirror only in ~/.npmrc, CoderFlow's updates still go directly to npm.profoundlogic.com. Set CODERFLOW_PROFOUNDLOGIC_REGISTRY as well. :::

Air-gapped sites. A host with no route to npm.profoundlogic.com can be updated with Install from file…. Download and check the package on a connected machine as in Install from file, transfer it, and install it from Health. Installation still runs npm for the package's dependencies, so the host needs an internal mirror that has all of them:

• For @profoundlogic dependencies, point CODERFLOW_PROFOUNDLOGIC_REGISTRY and the service account's scope line at the mirror, as above. These two settings cover only the @profoundlogic scope.
• For third-party dependencies, also point the service account's default npm registry at the mirror's proxy of registry.npmjs.org, for example npm config set registry https://npm-mirror.example.com/repository/npm/.

Keep the scope line as a separate setting. Never replace it with a default registry that points at npm.profoundlogic.com, which serves only the @profoundlogic scope.

Security FAQ

What is npm.profoundlogic.com?

It is Profound Logic's own npm package registry. It serves the @profoundlogic-scoped packages that make up CoderFlow: the server, CLI, aitool, codermake and the RAS client. It also serves the other packages under that scope. Profound Logic owns and operates it in a dedicated AWS account, under its own domain.

Why did CoderFlow move?

Publishing to the public npm registry under Profound Logic's account is suspended pending review, so new CoderFlow releases could not be published there. Hosting the scope itself removes that dependency.

How is it hosted?

Downloads are static files in Amazon S3, served through Amazon CloudFront over HTTPS; plain HTTP requests are redirected to HTTPS. The certificate is issued by Amazon. When checked in November 2026, the registry accepted TLS 1.2 and TLS 1.3 and refused older TLS versions. Downloads need no account or credentials. Package metadata and tarballs use npm's own format, and every version carries the same SHA-512 integrity value that npm records.

Who can publish?

Only Profound Logic. Publishing goes through a separate service that requires a restricted API key, which is rotated every 90 days. Profound Logic is notified by email of every publish, dist-tag change and deprecation. Releases are built by Profound Logic's release pipeline, which runs the product's tests before publishing.

Are packages signed?

No. npm.profoundlogic.com does not provide npm provenance attestations or registry signatures. npm checks every download against the package's SHA-512 integrity value, and lockfiles record those values. To check a downloaded package by hand, see step 2 of Install from file.

What about dependencies?

Only @profoundlogic packages come from npm.profoundlogic.com. Every third-party dependency still comes from registry.npmjs.org, with npm's security advisories, npm audit and npm's malware scanning unchanged. npm.profoundlogic.com does not proxy or cache third-party packages.

Are existing versions the same?

Yes. Every @profoundlogic version published before the move was copied from registry.npmjs.org, and the shasums and integrity values match. Lockfiles keep their integrity values, and npm verifies every download against them, whichever registry served it.

What do we need to allow?

Outbound HTTPS to npm.profoundlogic.com, in addition to registry.npmjs.org. The only npm setting is @profoundlogic:registry=https://npm.profoundlogic.com/, which affects only the @profoundlogic scope.

Can we mirror it?

Yes. Proxy the @profoundlogic scope from npm.profoundlogic.com in your Artifactory, Nexus or Verdaccio instance, then set CoderFlow's registry override, CODERFLOW_PROFOUNDLOGIC_REGISTRY, to your mirror. See Mirrors and air-gapped sites.