Build: `@quantum-l9/llm-router` install fails without NODE_AUTH_TOKEN — node_modules can't be installed in agent/dev sandboxes

[cryptoxdog]

Problem

npm install fails in any environment that lacks a GitHub Packages token:

npm error code E401
npm error 401 Unauthorized - GET https://npm.pkg.github.com/@quantum-l9%2fllm-router - unauthenticated: User cannot be authenticated with the token provided.

package.json depends on @quantum-l9/llm-router, which is published to GitHub Packages (npm.pkg.github.com, scope @quantum-l9). The repo's .npmrc points that scope at GitHub Packages and expects an auth token in the NODE_AUTH_TOKEN environment variable. When that token is absent, the scoped package returns 401 and node_modules cannot be installed at all — the whole install aborts on the private dependency.

Impact

• Coding agents, fresh clones, and contributors without a PAT cannot install deps, so they cannot run tsc --noEmit, vitest, or npm run verify:all locally.
• CI succeeds only because .github/workflows/ci.yml injects NODE_AUTH_TOKEN from a secret at the setup-node/install step.
• Concretely: PRs fix(api): authenticate and harden the operator API surface #15 and fix(scheduler): make per-client fan-out idempotent (no duplicate outreach on retry) #16 were authored without a local typecheck/test run for exactly this reason — validation was deferred to CI.

Where the token should live (recommendation)

• GitHub org-level secret NODE_AUTH_TOKEN (a fine-grained PAT or app token with read:packages on the org) so every repo that consumes @quantum-l9/* inherits it with no per-repo duplication. ci.yml already reads NODE_AUTH_TOKEN, so an org secret is the least-effort fix.
• Dev / agent sandboxes: provision the same read-only read:packages token as NODE_AUTH_TOKEN in the devcontainer / agent environment so npm install works outside CI.
• Document the local step in RUNBOOK.md / CONTRIBUTING.md: export a read:packages PAT as NODE_AUTH_TOKEN before npm install.

Repro

unset NODE_AUTH_TOKEN
npm install --no-audit --no-fund   # -> E401 on @quantum-l9/llm-router

Filed from a code-audit session; see PRs #15/#16 which note the same limitation.