[BUG] Claude Code on the web session blocks registry.tiptap.dev — private npm registries fail with host_not_allowed

Preflight Checklist

• [x] I have searched existing issues and this hasn't been reported yet
• [x] This is a single bug report (please file separate reports for different bugs)
• [x] I am using the latest version of Claude Code

What's Wrong?

In a Claude Code on the web session (https://claude.ai/code), npm install fails when a workspace depends on packages hosted on a private npm registry (in our case registry.tiptap.dev for @tiptap-pro/*). The sandbox's policy blocks the host before the request reaches the registry.

What Should Happen?

In Claude Code web session, we should be allowed to install from private npm registry. In this case, tiptap pro requires installing from private npm registry https://tiptap.dev/docs/guides/pro-extensions

Error Messages/Logs

Steps to Reproduce

Start a Claude Code on the web session in a repo whose package.json depends on @tiptap-pro/* packages.
The repo's install command configures the registry and auth token:
npm config set "@tiptap-pro:registry" https://registry.tiptap.dev/
npm config set "//registry.tiptap.dev/:_authToken" "$TIPTAP_REGISTRY_TOKEN"
npm ci
TIPTAP_REGISTRY_TOKEN is present in the env.
Run npm install (or npm run build, which depends on it).

Claude Model

Opus

Is this a regression?

I don't know

Last Working Version

_No response_

Claude Code Version

2.1.123

Platform

Anthropic API

Operating System

Other

Terminal/Shell

Terminal.app (macOS)

Additional Information

_No response_