i want agents to use the same private packages as the rest of the team.
i do not want to share my personal token with them.
i also do not want to keep npm tokens inside every repository.
with omni line, i create a separate personal access token for each workflow.
an agent that only installs packages gets registry:read.
a release workflow that publishes packages gets registry:read and registry:write.
the token does not bypass the user’s role.
a reader cannot publish just because the token includes registry:write.
this keeps access simple.
developers, ci, and agents use the same npm registry URL.
they use the same npm commands.
what changes is the token and the permission behind it.
i store each token in the project or deployment secret manager.
i do not commit it to the repository.
when a workflow no longer needs access, i revoke its token.
the agent gets access to the packages it needs.
the team keeps control over who can install, publish, and manage the registry.
Top comments (0)