patch-cloud

Opt-in npm-compatible registry. When a mapped package's upstream build is failing (light dark) and a fixed fork is packaged, installs get the fork under the same package name. When upstream is OK (light lit), traffic is proxied to registry.npmjs.org. A package can also carry a clearly labeled manual: fix available switch that serves the fork while the light stays lit — the light is never faked.

Safety / opt-in only

You must point npm at this host explicitly (--registry or project .npmrc). It is never the default.
Only packages listed below with a packaged fork are ever rewritten — while their light is dark, or while they carry the labeled manual: fix available switch.
Only the fork's version is replaced; every other version of the package still comes from the public registry.
Everything else (including scoped packages like @types/node) is proxied unchanged to the public registry.
Publish is disabled (PUT/POST/DELETE → 405). This registry is read-only; only npm's audit POSTs are proxied to the public registry.
Lockfiles: rewritten tarballs have different integrity hashes. Existing package-lock.json / npm ci will fail until you regenerate the lockfile while opted in — or opt out and use upstream.

Opt in (one-liner)

npm install <pkg> --registry https://patch-cloud-production.up.railway.app

Or add a project .npmrc:

registry=https://patch-cloud-production.up.railway.app/

Opt out

npm config delete registry
# or remove the registry= line from .npmrc, then reinstall

Status

6 rewrite active 1 manual: fix available 9 forks packaged dark lights board · /health

Light repo	npm	Status	Note
`local/broken-demo`	`broken-demo`	Fork available — download via patch-cloud upstream build: failing · checked 2026-10-12T03:56:31.769Z	Demo package: light dark → fork, light lit → upstream.
`react/react`	`react`	Upstream OK — normal npm upstream build: passing · checked 2026-10-18T15:39:16.438Z	Annotated upstream react; no code changes yet. While dark, serves upstream react@19.3.0 annotated with fork metadata (runtime identical to upstream); while lit, proxies registry.npmjs.org.
`vercel/next.js`	`next`	Upstream OK — normal npm upstream build: passing · checked 2026-10-18T15:39:16.878Z	CI-only fix (Rspack test manifests). While dark, serves upstream next@16.4.0 annotated with fork/PR metadata (runtime identical to upstream); while lit, proxies registry.npmjs.org.
`ZJONSSON/node-unzipper`	`unzipper`	Fork available — download via patch-cloud upstream build: failing · checked 2026-10-18T15:39:16.210Z	unzipper@0.12.5 with PR #331 by @zachstence: @aws-sdk/client-s3 moved to dependencies so Open.s3_v3 works after a normal install (issue #330). Trade-off: also installs the AWS SDK v3 S3 client. Light is dark from a Pages coverage-deploy job, not from this bug.
`jimp-dev/jimp`	`jimp`	Fork available — download via patch-cloud upstream build: failing · checked 2026-10-18T15:39:15.964Z	jimp@1.6.1 with the real browser bundle: the npm release shipped a 98-byte stub at dist/browser/index.js, so bundlers using the "browser" condition got no exports (issue #1402). Fork fixes the turbo build order that caused it; Node builds are byte-identical to upstream.
`vercel/ms`	`ms`	Fork available — download via patch-cloud upstream build: failing · checked 2026-10-18T15:39:15.971Z	ms@2.1.3 where format() no longer emits scientific notation that parse() cannot read (ports PR #299 by @Pitchfork-and-Torch; issue #284), plus the opt-in decimal option from PR #125 by @almandsky. Ordinary output is unchanged. 2.1.3 already caps parse() input at 100 chars (the #291 ReDoS mitigation). Only ms@2.1.3 is replaced; other ms versions come from npm.
`prebuild/prebuild-install`	`prebuild-install`	Fork available — download via patch-cloud upstream build: failing · checked 2026-10-18T15:39:15.943Z	prebuild-install@7.1.3 requiring tar-fs ^2.1.4 (PR #214 by @alichtman) so vulnerable tar-fs (CVE-2025-59343 / GHSA-vj76-c3g6-qr5v) cannot satisfy it, e.g. from a stale lockfile (issue #213).
`ajv-validator/ajv`	`ajv`	Upstream build failing — no fork yet upstream build: failing · checked 2026-10-18T15:39:16.076Z	Not rewritten. PR #2591 (v6 build script scripts/compile-dots.js) could not be verified as a ReDoS fix: the original regexes show no super-linear behaviour on adversarial input, and as written the PR changes the generated validator code. A corrected branch (output byte-identical to ajv@6.15.0) is on the fork for review; nothing is served.
`cli-table/cli-table3`	`cli-table3`	Fork available — download via patch-cloud upstream build: failing · checked 2026-10-18T15:39:15.943Z	cli-table3@0.6.5 with PR #359 by @spokodev: a rowSpan past the last row is clamped instead of throwing "Cannot read properties of undefined (reading 'length')".
`iamkun/dayjs`	`dayjs`	Fork available (manual: fix waiting upstream) upstream build: passing · checked 2026-10-18T15:39:16.466Z manual: fix available — Upstream CI is green but the timezone-plugin performance fix (PR #2019, open since 2022) is unmerged; CI does not measure performance. (since 2026-10-11)	dayjs@1.11.23 with a cached Intl.DateTimeFormat in the timezone plugin (ports PR #2019 by @logeyG):.tz() about 5x faster, identical results. Upstream CI is green, so this is served via the labeled manual switch, not a dark light.

What gets rewritten?

Currently packaged:

broken-demo ← local/broken-demo (active now)
react ← react/react
next ← vercel/next.js
unzipper ← ZJONSSON/node-unzipper (active now)
jimp ← jimp-dev/jimp (active now)
ms ← vercel/ms (active now)
prebuild-install ← prebuild/prebuild-install (active now)
cli-table3 ← cli-table/cli-table3 (active now)
dayjs ← iamkun/dayjs (active now — manual: fix available)

Active-low lights from greenlight-computer · cache 5 min · service read-only