feat(extension): add npm registry support for extension installation

- Add new npm extension installation channel via scoped packages (@scope/name)
- Implement npm.ts module with registry resolution, authentication, and download logic
- Support version pinning, dist-tags (latest, beta), and custom registries
- Handle private registry auth via NPM_TOKEN env var and .npmrc _authToken entries
- Update CLI install command with --registry flag for npm extensions
- Add comprehensive tests for npm package parsing and registry operations
- Update documentation for releasing and installing from npm registries
- Integrate npm updates into extension manager and update checking flow

This enables teams using npm for package distribution to publish Qwen Code extensions through their existing infrastructure, with full support for private registries and access control.

Co-authored-by: Qwen-Coder <qwen-coder@alibabacloud.com>

packages/cli/src/commands/extensions/install.ts

@@ -27,6 +27,7 @@ interface InstallArgs {
   autoUpdate?: boolean;
   allowPreRelease?: boolean;
   consent?: boolean;
+  registry?: string;
 }
 
 export async function handleInstall(args: InstallArgs) {
@@ -35,7 +36,8 @@ export async function handleInstall(args: InstallArgs) {
 
     if (
       installMetadata.type !== 'git' &&
-      installMetadata.type !== 'github-release'
+      installMetadata.type !== 'github-release' &&
+      installMetadata.type !== 'npm'
     ) {
       if (args.ref || args.autoUpdate) {
         throw new Error(
@@ -46,6 +48,22 @@ export async function handleInstall(args: InstallArgs) {
       }
     }
 
+    if (installMetadata.type === 'npm' && args.ref) {
+      throw new Error(
+        t(
+          '--ref is not applicable for npm extensions. Use @version suffix instead (e.g. @scope/package@1.2.0).',
+        ),
+      );
+    }
+
+    if (installMetadata.type !== 'npm' && args.registry) {
+      throw new Error(t('--registry is only applicable for npm extensions.'));
+    }
+
+    if (installMetadata.type === 'npm' && args.registry) {
+      installMetadata.registryUrl = args.registry;
+    }
+
     const requestConsent = args.consent
       ? () => Promise.resolve()
       : requestConsentOrFail.bind(null, requestConsentNonInteractive);
@@ -83,7 +101,7 @@ export async function handleInstall(args: InstallArgs) {
 export const installCommand: CommandModule = {
   command: 'install <source>',
   describe: t(
-    'Installs an extension from a git repository URL, local path, or claude marketplace (marketplace-url:plugin-name).',
+    'Installs an extension from a git repository URL, local path, scoped npm package (@scope/name), or claude marketplace (marketplace-url:plugin-name).',
   ),
   builder: (yargs) =>
     yargs
@@ -106,6 +124,10 @@ export const installCommand: CommandModule = {
         describe: t('Enable pre-release versions for this extension.'),
         type: 'boolean',
       })
+      .option('registry', {
+        describe: t('Custom npm registry URL (only for npm extensions).'),
+        type: 'string',
+      })
       .option('consent', {
         describe: t(
           'Acknowledge the security risks of installing an extension and skip the confirmation prompt.',
@@ -126,6 +148,7 @@ export const installCommand: CommandModule = {
       autoUpdate: argv['auto-update'] as boolean | undefined,
       allowPreRelease: argv['pre-release'] as boolean | undefined,
       consent: argv['consent'] as boolean | undefined,
+      registry: argv['registry'] as string | undefined,
     });
   },
 };