Private npm registry
Install OpenCode and npm tooling, and the seed app's runtime dependencies, from a private npm registry - Nexus, Artifactory, or Verdaccio - instead of the public npmjs.org.
Configure
Set these variables in env/dev/env.d/autograph.pkg.proxy.env.
| Variable | Purpose | Example |
|---|---|---|
AUGR_PROXY_NPM_REGISTRY_URL | Registry URL for agent image builds and seed app pnpm at runtime | https://nexus.example.com/repository/npm-group/ |
AUGR_PROXY_NPM_REGISTRY_TOKEN | Auth token, only if the registry requires it | (a token string) |
AUGR_PROXY_NPM_REGISTRY_URL=https://nexus.example.com/repository/npm-group/AUGR_PROXY_NPM_REGISTRY_URL=https://artifactory.example.com/artifactory/api/npm/npm/
AUGR_PROXY_NPM_REGISTRY_TOKEN=<your-token>Apply
Regenerate the aggregated configuration, then rebuild the agent image. Validate the dev agent before rolling the shared image to metalab:
task augr:build
task augr:pkg:agent:rebuild
# Validate the dev agent before continuing
task augr:pkg:metalab:reup
task app:up
task app:init Start the stack with task augr:up before the app. The app's prepare step writes registry configuration under env/dev/services/app/npmrc, mounted read-only as ~/.npmrc in front and playground. These containers use it for pnpm install through augr-proxy. The registry variables remain in the proxy package env file, not the AUGR_NET_* block.
Package tasks still require Compose v2; see the v1 limitation before using these commands on a v1 workstation.
Verify
Check the output of the Apply steps:
task augr:pkg:agent:rebuildcompletes: the agent image downloads OpenCode and its npm tooling from the registry.task app:upprints[app:prepare] npm registry for the app containers: ...: the app containers install their dependencies from it.
Use a registry URL without embedded credentials. For the agent image build, the token is passed as a BuildKit secret, not a build arg. At runtime, however, the seed app's ~/.npmrc contains the token when one is configured. Code running inside front or playground, including agent-written code, can read it. This is a temporary accepted exception pending a registry credential mechanism; it is not build-only secret isolation. See Security.