Configure proxy, certificates, DNS, and browser behavior for Qoder CLI CN
Qoder CLI CN needs network access for authentication, model inference, web search/fetching, and more. In corporate intranets, proxied environments, or restricted networks, you may need to configure a proxy, certificates, or custom DNS behavior for it. This page covers the relevant environment variables and configuration.Most network settings are controlled by standard environment variables, so you can carry over the network configuration habits you already have in your terminal.
The proxy is read at startup; restart Qoder CLI CN after changes.
Both cases (e.g. HTTPS_PROXY and https_proxy) are recognized; some tools require the lowercase form.
With the sandbox enabled, proxy settings are forwarded into the sandbox environment so requests inside the sandbox also go through the proxy.
When qoderclicn is launched through the Agent SDK or a desktop integration, these environment variables do not control qoderclicn's own outbound requests. Set the SDK proxy option explicitly in the host integration instead. If that option is omitted, integrated qoderclicn connects directly. Inherited proxy environment variables remain available to Agent tools and child processes.
In networks using self-signed certificates or corporate root certificates, specify additional trusted certificates via the standard Node.js environment variables:
Variable
Description
NODE_EXTRA_CA_CERTS
Path to an additional CA certificate file (PEM format).
If certificate verification fails (such as unable to verify the first certificate), you usually need to point the variables above at the correct root certificate.
For environments with special DNS resolution order requirements, set the resolution order with the advanced.dnsResolutionOrder setting (such as preferring IPv4 or following the system order). This setting requires a restart after changes.
Flows such as sign-in authentication try to open a browser to complete the callback by default. The CLI automatically detects environments without a graphical interface and skips launching the browser, printing a link you can copy manually instead — an environment is treated as headless if any of the following holds:
CI is set;
BROWSER=www-browser;
DEBIAN_FRONTEND=noninteractive;
inside an SSH session (SSH_CONNECTION);
on Linux, none of DISPLAY, WAYLAND_DISPLAY, or MIR_SOCKET is set.
So no extra configuration is needed in SSH remote sessions, containers, or CI environments. For authentication details, see Sign-in and Authentication.
When the sandbox is enabled, it does not allow network access by default (tools.sandboxNetworkAccess defaults to false). To access the network inside the sandbox, enable that setting explicitly. Proxy-related environment variables are forwarded into the sandbox.
Connection timeouts or unreachable: confirm the proxy variables are set correctly and NO_PROXY doesn't miss required internal domains.
Certificate errors: configure NODE_EXTRA_CA_CERTS to point at the corporate root certificate.
Browser won't open during sign-in: in headless environments the CLI automatically skips launching the browser and prints the login link — copy it into a browser manually; you can also switch to Personal Access Token authentication.
