## 1. Wrapper: --registry flag

- [x] 1.1 In `run.sh`, add `WITH_REGISTRY=0` alongside the other `WITH_*` initializers and a `--registry) WITH_REGISTRY=1 ;;` arm in the case statement (run.sh:99, run.sh:116)
- [x] 1.2 Under `--registry`, append read-only mounts to `MOUNT_ARGS`, each guarded by an existence check (silent no-op otherwise, mirroring `--tfe`'s `[ -f ... ]` pattern): `~/.npmrc` → `/root/.npmrc:ro`, `~/.netrc` → `/root/.netrc:ro`, `~/.config/uv/uv.toml` → `/root/.config/uv/uv.toml:ro`, and the platform-aware pip config — `~/.config/pip/pip.conf` on Linux or `~/Library/Application Support/pip/pip.conf` on macOS → `/root/.config/pip/pip.conf:ro` (mirror the `--glab` platform-select logic; both resolve to the same container path) (run.sh:203-217; pip uses the macOS-first/Linux-fallback select)
- [x] 1.3 Under `--registry`, add the static native env-var names to the `ENV_VARS` array so the existing `[ -n "${!v:-}" ]` filter forwards them only when set: `npm_config_registry NPM_CONFIG_REGISTRY NODE_AUTH_TOKEN NPM_TOKEN UV_INDEX_URL UV_DEFAULT_INDEX UV_EXTRA_INDEX_URL UV_INDEX UV_KEYRING_PROVIDER PIP_INDEX_URL PIP_EXTRA_INDEX_URL PIP_TRUSTED_HOST PIPENV_PYPI_MIRROR` (run.sh:224) — note `UV_NETRC` was dropped from this list per 5.5
- [x] 1.4 Under `--registry`, scan exported host variables (`compgen -e`) and append `-e "$name"` to `ENV_ARGS` for every name matching `UV_INDEX_*_USERNAME` or `UV_INDEX_*_PASSWORD` that is set; scope strictly to those two suffixes (do not blanket-forward `UV_*` — a host `UV_CACHE_DIR`/path-valued var would break in-container). Bash 3.2 + `set -u` safe. (run.sh:231-239; `while read < <(compgen -e)`, suffix-scoped case)
- [x] 1.5 Append `registry` to `DOCKER_FLAGS` when `WITH_REGISTRY=1` so the statusline tag reflects the opt-in (run.sh:284)
- [x] 1.6 Update the `print_help` heredoc with a `--registry` row matching the `--aws`/`--gh`/`--glab`/`--tfe` style (one-line summary: forward host-native uv/npm/pnpm private-registry config — `~/.npmrc`, `~/.netrc`, `~/.config/uv/uv.toml` read-only + `UV_INDEX_*` / `npm_config_registry` env) (run.sh:46-53; verified present via `run.sh --help`)

## 2. Smoke tests against scenarios

- [x] 2.1 No-flag invariant: with a host `~/.npmrc` setting a private `registry=` and `UV_DEFAULT_INDEX` exported, `claude-docker ~/repo` (no flag) → inside the container `/root/.npmrc` lacks the host config, `echo $UV_DEFAULT_INDEX` is empty, and `pnpm config get registry` returns the public npm default
- [x] 2.2 `--registry` npmrc mount: with a host `~/.npmrc` pointing at a private registry, `claude-docker --registry ~/repo` exposes it read-only — `pnpm config get registry` returns the private URL and an in-container write to `/root/.npmrc` fails with EROFS
- [x] 2.3 `--registry` uv env forwarding incl. dynamic vars: with `UV_DEFAULT_INDEX`, `UV_INDEX_INTERNAL_USERNAME`, and `UV_INDEX_INTERNAL_PASSWORD` exported on the host, `claude-docker --registry ~/repo` forwards all three; without `--registry`, none are present
- [x] 2.4 `--registry` silent absence: with no host `~/.npmrc`/`~/.netrc`/`uv.toml` and none of the forwarded env vars set, `claude-docker --registry ~/repo` starts cleanly with no error and the package managers use public defaults
- [x] 2.5 Statusline tag includes `registry`: launch `claude-docker --registry --gh ~/repo` and confirm the statusline prefix shows `registry` in the `docker:` tag list (e.g. `docker:gh,registry`)
- [x] 2.6 End-to-end (CodeArtifact, manual): on a host with `aws codeartifact login --tool npm` having written a token into `~/.npmrc`, `claude-docker --registry ~/repo` → `pnpm add <a-package-in-the-feed>` resolves via the private registry
- [x] 2.7 `--registry` pip config: with a host `pip.conf` (platform-aware path) setting a private `index-url`, `claude-docker --registry ~/repo` exposes it read-only at `/root/.config/pip/pip.conf`; verify via `uvx pipenv` (or `uv pip --no-config`-bypassed check) that pip-side resolution targets the private index; confirm `PIP_INDEX_URL`/`PIPENV_PYPI_MIRROR` forward only under the flag
- [x] 2.8 End-to-end (pip via uvx, manual): on a host with `aws codeartifact login --tool pip` having written `index-url` into `pip.conf`, `claude-docker --registry ~/repo` → `uvx pipenv install <a-package-in-the-feed>` resolves via the private index (documents the no-bundled-Python path from D8)

## 3. Documentation

- [x] 3.1 Add a `--registry` row to the **Credential opt-in** table in `README.md`, matching the `--aws`/`--gh`/`--glab`/`--tfe` voice (mounts `~/.npmrc` / `~/.netrc` / `~/.config/uv/uv.toml` / platform-aware `pip.conf` read-only when present; forwards `UV_INDEX_*` / `npm_config_registry` / `NODE_AUTH_TOKEN` / `PIP_*` / `PIPENV_PYPI_MIRROR` env; off by default) (README.md:39; section preamble also updated)
- [x] 3.2 Extend the **Auth model** section with a `--registry` entry: source of config (host-native files + env, incl. pip.conf and the shared `~/.netrc`), read-only mounts, token freezes at launch (refresh = restart), and that it composes with but does not require `--aws` (README.md § Private package registries, with a per-ecosystem channel table)
- [x] 3.3 Add a usage paragraph showing the standard flow, including the AWS CodeArtifact recipe per ecosystem: `aws codeartifact login --tool npm` (→ `~/.npmrc`), `--tool pip` (→ `pip.conf`), and the uv `UV_INDEX_*` / `aws codeartifact get-authorization-token` equivalent on the host → `claude-docker --registry ~/repo`. Note the pip/pipenv entry point is `uvx pipenv …` (no Python is bundled), and that a fully locked-down feed must mirror `pipenv` itself for `uvx` to fetch it (README.md § Private package registries — codeblock + "No Python is bundled" note)
- [x] 3.4 Add a **Threat model** note: `--registry` *narrows* package resolution to the configured feed (host-config-dependent) but is registry-resolution config, **not** network egress filtering — `npx`, `git+https` installs, and other egress are unaffected; and `~/.npmrc`/`~/.netrc` tokens are readable in-container under the flag (same class as `--gh`/`--glab`) (README.md § Threat model — new bullet + amended per-session exposure bullet)
- [x] 3.6 Add a **whole-file-mount caution** to the Private package registries section: `--registry` mounts entire config files, so anything in them spills into the container — `~/.npmrc`/`pip.conf` can carry tokens/settings beyond your feed. Note the env-var channel is scoped, and suggest keeping registry-only config files. (Originally also covered `~/.netrc`; superseded by 5.5, which drops the netrc mount entirely — the caution now records netrc as deliberately excluded.) Threat-model per-session bullet updated to match. (README.md § Private package registries — ⚠️ callout)
- [x] 3.5 Add a one/two-sentence clarification (near the registry usage docs or "Updating pinned tool versions") that `--registry` is **runtime-only**: the image build always resolves against the public npm registry/PyPI regardless of any private registry configured on the host (host `~/.npmrc` and `npm_config_*` env are not in the build context and not inherited by `RUN` steps), preserving the "reproducible from the committed files" guarantee. Build-time private-registry support is out of scope (see design Open Questions) (README.md § Private package registries — "Build vs. runtime" note)

## 4. Validation

- [x] 4.1 `openspec validate add-private-registry-support --strict` exits 0 (verified: "Change 'add-private-registry-support' is valid")
- [x] 4.2 `claude-docker --help` round-trips: every wrapper flag in the help text has a matching case arm and vice versa (including `--registry`) (verified: `--registry` present in both; no case arm is undocumented; the only help-vs-arm deltas are the pre-existing `--claude-dir=*` form and prose mention of `--add-dir`, neither related to this change)
- [x] 4.3 Spot-check `--ephemeral` composition: `claude-docker --ephemeral --registry ~/repo` forwards the config/env but skips the named volumes; confirm no dependence on `claude-code-root` in the `--registry` path (consistent with D6 — no masking) (verified statically: the `--registry` mount/env/flag blocks are gated solely on `WITH_REGISTRY` (run.sh:203/224/284) with no `EPHEMERAL` reference; the named-volume + tmpfs block (run.sh:419-426, `EPHEMERAL=0`) lists only gh/glab/tfe — no `--registry` masking)
