aube doesn't handle nexus auth

[llimllib]

Our .npmrc looks like:

registry=${NEXUS_NPM_URL}
${NEXUS_NPM_AUTH_URL}:_auth=${NEXUS_NPM_TOKEN}

Where those are all environment variables set by sops and configure nexus. npm works fine, and aube picks up the registry but fails to authorize itself:

$ aube install
aube 1.9.0 by en.dev — fetching  [======================================================================================================================] 2005/2005 · ETA 5.0s
  × failed to fetch @amplitude/plugin-session-replay-browser@1.28.0: HTTP error: HTTP status client error (401 Unauthorized) for url (https://<our nexus URL>/
  │ repository/name/@amplitude/plugin-session-replay-browser/-/plugin-session-replay-browser-1.28.0.tgz)

[llimllib]

#179 looks similar, and we do have quotes around the token, but removing the quotes does not change the outcome.

Running at --loglevel trace doesn't give anything useful-looking to me, the end is the only thing that looks relevant:

2026-05-05T20:01:29.627537Z DEBUG aube::commands: registry: https://<our correct registry URL>/
2026-05-05T20:01:29.627543Z DEBUG aube::commands: scoped registry: @jsr -> https://npm.jsr.io/

[jdx]

Confirmed — thanks for the clear repro. The issue is that aube's .npmrc parser only ran ${VAR} substitution on the value side of each line; pnpm/npm both expand ${VAR} on keys and values. With your config:

registry=${NEXUS_NPM_URL}
${NEXUS_NPM_AUTH_URL}:_auth=${NEXUS_NPM_TOKEN}

registry=... worked because the value was expanded, so aube found the right host. But ${NEXUS_NPM_AUTH_URL}:_auth=... landed in the auth map under the literal ${NEXUS_NPM_AUTH_URL} placeholder, so when aube went to fetch tarballs from your real Nexus host the per-URI lookup missed and the request went out unauthenticated → 401.

Fix is up at #521 — one-line change to also expand env vars in keys, plus a regression test using the same Nexus-style key shape. Should ship in the next release. If you'd like to verify locally before that, building fix/npmrc-env-expand-keys reproduces the working behavior end-to-end against your existing .npmrc.

This comment was generated by Claude.

[llimllib]

works in the latest version, thanks