5 repliesProblem3h ago
Index
Feed
✓ Fastest verified fix
Two workable paths. Preferred: make the registry reachable from the sandbox — public DNS for the registry host, sandbox environment allowlists the domain, auth token injected as a secret, install pinned to the setup phase. If your registry can't be exposed at all, vendor your scoped dependencies so npm never leaves the repo.
✓ What worked
Stood up a read-through mirror of our Artifactory on a public hostname with token auth, allowed the domain in the environment, moved npm ci into setup. 40+ cloud runs since, zero install failures.
sadiq.dev · 4w ago
For a client who wouldn't expose anything: committed a vendor/npm store for the 9 scoped packages. Ugly, adds 30MB to the repo, works everywhere including the sandbox.
tessellate · 4w ago
✕ What did not work
The agent tried HTTP_PROXY tricks for a full hour of billed time. There is no route; no proxy env var invents one. Also it edited .npmrc four different ways, which broke the local dev setup when the branch merged.
mateohq · 4w ago
| Agent | Version | Model | OS | Framework | Outcome | × |
|---|---|---|---|---|---|---|
| Codex | 0.45.1 | GPT-5.5 Codex | Codex cloud sandbox | — | Reproduced | 7 |
| Codex | 0.44.0 | — | Codex cloud sandbox | — | Reproduced | 3 |
| Codex | 0.45.1 | — | Codex cloud sandbox | — | Not reproduced | 2 |
Sign in to add your report — every count here is backed by a named account.
# environment setup script
npm config set @acme:registry https://npm.acme-public.example.com/
npm config set //npm.acme-public.example.com/:_authToken "$ACME_NPM_TOKEN"npm ci --prefer-offline 2>&1 | tail -20# .npmrc (committed)
@acme:registry=file:./vendor/npm
Related records
Strong evidence gets promoted into the record above.
Healthcare here — exposing a mirror, even token-gated, was a non-starter for compliance. Vendoring was the only viable path, and honestly it's been fine. npm ci is even faster from the file store. The 30MB repo tax is real but git handles it.
One subtlety for the fix block: put the token in the environment's secrets, not vars. Secrets are only available during the setup phase and redacted after; vars persist into the agent's context where it can (and will) echo them into logs. Learned by reading our own transcripts.
Correct and important, edited the fix to say 'environment secret' explicitly. Redaction-after-setup is the whole reason this is safe to do at all.
Sign in to join the discussion, vote, and verify fixes.
Cost warning: before I understood this, the agent spent a 55-minute cloud run heroically debugging DNS. Billed in full. If your install can fail for environmental reasons, say so in the brief or it will burn the whole budget on it.