[jdx]

Summary

Embeds the aube package manager into the npm: backend so mise handles npm: tools without needing node or a package-manager CLI installed — version metadata is fetched from the registry over HTTP, and packages are installed in-process. node is only needed to run installed tools (and their lifecycle scripts), not to install them.

This supersedes the inline npm registry client from #11147 and replaces the aube add --global / npm install -g subprocess. It's the mise half of a cross-repo effort; the enabling upstream work is aubepkg/aube#1068 (MSRV 1.91 + backend-agnostic library crates), aubepkg/aube#1069 (embeddable aube crate: publish/DNS/TLS feature-gated), and aubepkg/aube#1079 (host-supplied node runtime for lifecycle scripts), released as aube 1.32.

What changed

Version metadata → aube-registry (HTTP). mise ls-remote npm:* and latest resolution query the registry directly through the published aube-registry crate (replacing the ~500-line inline port from #11147). npmrc/scoped-registry/auth semantics live in one maintained place. Honors mise's offline() / prefer_offline() via NetworkMode.

Installs → aube::embed::add (in-process). The tool's install dir doubles as a throwaway project (seed package.json + .npmrc); aube installs into node_modules, and its bin shims are exposed on PATH via list_bin_paths → node_modules/.bin (the shims resolve relative to their own location). auto now always resolves to the embedded aube (it's compiled in), so get_dependencies drops the aube/npm edges — default npm: installs depend only on node. minimum_release_age, trust_policy_excludes, and allow_builds flow through the seed package.json/.npmrc that aube's resolver reads.

Lifecycle scripts run on mise's node. For allow_builds installs, mise passes its dependency node's bin dir to the embedded installer via aube 1.32's node_bin_dir, so dependency lifecycle scripts find node even when it isn't on the ambient PATH (restoring what the old subprocess got via prepend_path).

Setting consolidation. The unreleased npm.use_npm_view is replaced by npm.shell_out (MISE_NPM_SHELL_OUT), which routes both metadata (npm view) and installs (npm install -g) through the npm CLI — for setups that rely on npm-only config (cafile, client certs, token helpers). Only affects the auto path; explicit npm.package_manager = bun|pnpm|npm still shells out to that tool.

Dependencies

aube and aube-registry are pulled with default-features = false, features = ["rustls"]: their defaults also enable hickory-dns, which — via cargo feature unification — would flip the default DNS resolver for every reqwest client in the mise binary. rustls is already in mise's tree; no new TLS stack is added. sigstore's publish/signing stack is excluded via aube's publish feature gate (aubepkg/aube#1069).

Behavior parity & validation

• ls-remote output is byte-identical (same versions, same semver-ascending order) vs. the previous inline client for npm:prettier, npm:@angular/cli (582 versions incl. backported patch lines), and npm:left-pad, with node/npm absent.
• Install validated with only node on PATH (no aube/npm binary): mise x npm:cowsay@1.6.0 -- cowsay.
• Lifecycle scripts validated with no node on the ambient PATH: npm:esbuild@0.21.5 + allow_builds runs its node install.js postinstall and produces a working binary.
• 46 npm unit tests pass; test_npm_aube, test_npm_package_manager, test_backend_missing_deps, and test_npm_shim_recursion_system_dir e2e updated for the embedded model and pass.

🤖 Generated with Claude Code

Summary by CodeRabbit

• Improvements

  • Enhanced npm version discovery, including more reliable latest dist-tag resolution and improved semver ordering.
  • Reduced redundant registry work by removing packument caching and simplifying registry interactions.
  • Updated embedded aube npm installs to run in-process, with updated tool locations (preferring node_modules/.bin when embedded).

• Configuration / Docs

  • Replaced npm.use_npm_view with npm.shell_out (MISE_NPM_SHELL_OUT) to control when the npm CLI is required for metadata and installs.

• Tests

  • Updated e2e tests to use MISE_NPM_SHELL_OUT and to assert the new embedded install layout and messages.

[coderabbitai]

📝 Walkthrough

Walkthrough

The npm backend replaces its bespoke registry client and cached packument state with aube-registry, routes metadata queries through shared cached helpers, and installs packages through embedded aube unless npm CLI shell-out is enabled. Configuration, documentation, and tests are updated accordingly.

Changes

NPM backend integration

Layer / File(s)	Summary
Registry client and metadata queries Cargo.toml, src/backend/npm_registry.rs	Adds aube-registry and aube, initializes shared cached registry access, and exposes semver-ordered version and latest dist-tag queries.
Backend routing and embedded installation src/backend/npm.rs	Routes metadata operations by shell-out mode, embeds aube for installation, updates dependency handling, and selects installation bin paths.
Shell-out configuration and documentation settings.toml, schema/mise.json, docs/dev-tools/backends/npm.md, e2e/backend/*	Replaces use_npm_view with shell_out and documents the embedded-aube and npm CLI paths.
Installation behavior tests src/backend/npm.rs, e2e/backend/*	Validates embedded-aube dependencies, bin-path precedence, generated project files, build allowlists, package-manager behavior, and updated environment handling.

Estimated code review effort: 4 (Complex) | ~45 minutes

Sequence Diagram(s)

sequenceDiagram
  participant NPMBackend
  participant npm_registry
  participant aube
  participant npm
  NPMBackend->>npm_registry: Query metadata when shell_out is disabled
  npm_registry-->>NPMBackend: Return versions or latest dist-tag
  NPMBackend->>aube: Install package in-process by default
  NPMBackend->>npm: Shell out for metadata and installation when enabled

Loading

Possibly related PRs

• jdx/mise#11126: Uses the changed embedded-aube allowBuilds installation behavior.
• jdx/mise#11147: Related npm registry client and packument flow changes.

Poem

I’m a rabbit with packages bright,
Aube installs them snugly just right.
Registry tags hop through the cache,
Shell-out paths run when users ask—
New npm settings guide the flight.

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Docstring Coverage	✅ Passed	Docstring coverage is 100.00% which is sufficient. The required threshold is 80.00%.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly matches the main change: embedding aube for npm version resolution and installs without a package-manager CLI.

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[greptile-apps]

Greptile Summary

This PR embeds aube and aube-registry directly into mise so npm: tools install without needing any npm/aube binary on PATH — only node is required to run the installed tools. npm_registry.rs is reduced from ~680 lines to ~100 by delegating all packument-fetching logic to aube-registry, and installs go through aube::embed::add in-process instead of shelling out to aube add --global.

• npm.use_npm_view is replaced by npm.shell_out (covers both metadata and installs); node_modules/.bin is now the primary bin-path for embedded-aube installs, with the list_bin_paths logic updated accordingly.
• Cargo.toml adds aube and aube-registry at version 1.32 with default-features = false to exclude hickory-dns and the sigstore publish stack.
• E2e tests, schema, and docs are all updated to reflect the new layout and renamed setting.

Confidence Score: 4/5

Safe to merge for the common embedded-aube path; one edge case in get_dependencies needs attention before the shell_out/explicit-npm-installer paths are used to install npm:npm.

The old get_dependencies had an explicit early return for tool_name == npm that prevented npm from ever appearing as a dependency of itself. That guard was removed. Now when installer == NpmPackageManager::Npm the generic circular-dep check fires for npm:npm, returning node and npm and potentially creating a real cycle. The default embedded-aube path is unaffected.

src/backend/npm.rs — the get_dependencies function lost the npm:npm bootstrap guard; the circular-dep check now incorrectly fires for npm:npm when the npm CLI is the resolved installer.

Important Files Changed

Filename	Overview
src/backend/npm.rs	Core npm backend rewritten to use embedded aube for in-process installs; get_dependencies removes the npm:npm special-case guard, causing a circular dep regression when shell_out=true or package_manager=npm is set.
src/backend/npm_registry.rs	Dramatically simplified — ~650 lines of inline registry client replaced with a thin wrapper around aube-registry; logic is straightforward and correct.
settings.toml	Renames npm.use_npm_view to npm.shell_out (with new MISE_NPM_SHELL_OUT env var); straightforward rename of an unreleased setting.
Cargo.toml	Adds aube and aube-registry at version 1.32 with default-features = false, features = ["rustls"] to avoid pulling in hickory-dns and the sigstore/publish stack.
docs/dev-tools/backends/npm.md	Documentation updated to reflect embedded aube as the default installer; npm.shell_out and npm.package_manager usage clearly described.
e2e/backend/test_npm_aube	Updated to verify the new embedded-aube layout without needing an aube binary on PATH.
e2e/backend/test_backend_missing_deps	Correctly migrates MISE_NPM_USE_NPM_VIEW to MISE_NPM_SHELL_OUT.
e2e/backend/test_npm_package_manager	Removes the conditional aube binary setup and verifies the node_modules layout and aube_args warning.
schema/mise.json	Schema updated to rename use_npm_view to shell_out with the correct new description.

_{Reviews (4): Last reviewed commit: "feat(npm): run embedded-aube lifecycle s..." | Re-trigger Greptile}

[coderabbitai]

Actionable comments posted: 1

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@src/backend/npm_registry.rs`:
- Around line 40-49: Update fetch_packument so the blocking
crate::file::create_dir_all call runs inside tokio::task::spawn_blocking, await
the task, and propagate both filesystem and join errors before invoking
fetch_packument_with_time_cached.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Central YAML (base), Organization UI (inherited)

Review profile: CHILL

Plan: Pro Plus

Run ID: 770f0897-a58d-4de3-8a05-ac0b7dff516e

📥 Commits

Reviewing files that changed from the base of the PR and between 62e4e92 and a947e77.

⛔ Files ignored due to path filters (1)

• Cargo.lock is excluded by !**/*.lock

📒 Files selected for processing (3)

• Cargo.toml
• src/backend/npm.rs
• src/backend/npm_registry.rs

[github-actions]

Hyperfine Performance

mise x -- echo

Command	Mean [ms]	Min [ms]	Max [ms]	Relative
mise-2026.7.11 x -- echo	20.2 ± 2.0	17.2	32.7	1.00
mise x -- echo	21.3 ± 1.2	18.9	27.1	1.06 ± 0.12

mise env

Command	Mean [ms]	Min [ms]	Max [ms]	Relative
mise-2026.7.11 env	18.6 ± 1.0	17.0	23.3	1.00
mise env	20.3 ± 1.0	18.3	24.7	1.09 ± 0.08

mise hook-env

Command	Mean [ms]	Min [ms]	Max [ms]	Relative
mise-2026.7.11 hook-env	19.5 ± 0.9	17.9	23.5	1.00
mise hook-env	21.3 ± 1.0	19.5	26.3	1.09 ± 0.07

mise ls

Command	Mean [ms]	Min [ms]	Max [ms]	Relative
mise-2026.7.11 ls	16.6 ± 0.9	15.1	22.7	1.00
mise ls	17.9 ± 1.0	15.7	22.3	1.08 ± 0.08

xtasks/test/perf

Command	mise-2026.7.11	mise	Variance
install (cached)	160ms	175ms	-8%
ls (cached)	59ms	62ms	-4%
bin-paths (cached)	62ms	64ms	-3%
task-ls (cached)	130ms	134ms	-2%

[coderabbitai]

Actionable comments posted: 1

Caution

Some comments are outside the diff and can’t be posted inline due to platform limitations.

⚠️ Outside diff range comments (1)

src/backend/npm.rs (1)

488-511: 🎯 Functional Correctness | 🟠 Major | ⚡ Quick win

Windows list_bin_paths is missing the ToolRequest::System short-circuit that unix has.

The unix branch explicitly returns Ok(vec![]) for ToolRequest::System { .. } before computing bin paths, but the windows branch runs bin_paths_for_install_path(&tv.install_path()) unconditionally. For a --system npm install on Windows this can surface an unintended/garbage path (since bin_paths_for_install_path falls back to returning the bare install path when neither node_modules/.bin nor bin exists) instead of contributing no PATH entries, unlike the unix behavior.

Proposed fix

 #[cfg(windows)]
 async fn list_bin_paths(
     &self,
     _config: &Arc<Config>,
     tv: &crate::toolset::ToolVersion,
 ) -> eyre::Result<Vec<std::path::PathBuf>> {
+    if matches!(tv.request, ToolRequest::System { .. }) {
+        return Ok(vec![]);
+    }
     Ok(Self::bin_paths_for_install_path(&tv.install_path())
         .into_iter()
         .map(|path| runtime_path_for_install_path(tv, path))
         .collect())
 }

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@src/backend/npm.rs` around lines 488 - 511, Update the Windows list_bin_paths
implementation to return Ok(vec![]) when tv.request matches ToolRequest::System
{ .. }, before calling bin_paths_for_install_path. Preserve the existing
runtime_path_for_install_path mapping for non-system requests and keep the Unix
behavior unchanged.

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@src/backend/npm.rs`:
- Around line 846-918: Update install_via_aube_embed to apply tv.install_env()
before invoking aube::embed::add, ensuring embedded installs inherit registry,
authentication, and other npm configuration values. Use the existing environment
setup mechanism used by the other install branches and preserve the current aube
options and error handling.

---

Outside diff comments:
In `@src/backend/npm.rs`:
- Around line 488-511: Update the Windows list_bin_paths implementation to
return Ok(vec![]) when tv.request matches ToolRequest::System { .. }, before
calling bin_paths_for_install_path. Preserve the existing
runtime_path_for_install_path mapping for non-system requests and keep the Unix
behavior unchanged.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Central YAML (base), Organization UI (inherited)

Review profile: CHILL

Plan: Pro Plus

Run ID: 9950f0dd-0ccc-4a6b-9c72-570292449bbf

📥 Commits

Reviewing files that changed from the base of the PR and between a947e77 and 5e095cb.

⛔ Files ignored due to path filters (1)

• Cargo.lock is excluded by !**/*.lock

📒 Files selected for processing (7)

• Cargo.toml
• docs/dev-tools/backends/npm.md
• e2e/backend/test_backend_missing_deps
• e2e/backend/test_npm_shim_recursion_system_dir
• schema/mise.json
• settings.toml
• src/backend/npm.rs

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	cargo/​aube@​1.32.0
	cargo/​aube-registry@​1.32.0

View full report

[cursor]

Cursor Bugbot has reviewed your changes and found 1 potential issue.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit 23f9bab. Configure here.}

[coderabbitai]

🧹 Nitpick comments (1)

e2e/backend/test_npm_package_manager (1)

117-123: 📐 Maintainability & Code Quality | 🔵 Trivial | 💤 Low value

Prefer portable shell commands over GNU-specific find flags.

The -quit flag in find is not POSIX-compliant and is unavailable in environments like Alpine Linux (using BusyBox find) or OpenBSD, which could cause CI failures in those environments.

Consider using a path glob with ls to verify the directory structure reliably across platforms without relying on non-standard find flags.

♻️ Proposed fix to use a portable glob

-assert_succeed "find '$tiny_install_dir' -type d -name node_modules -print -quit | grep -q ."
+assert_succeed "ls -d '$tiny_install_dir'/*/node_modules >/dev/null 2>&1"

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@e2e/backend/test_npm_package_manager` around lines 117 - 123, Replace the
non-portable `find ... -quit` check in the npm package-manager test with a
portable directory-glob check, such as the suggested `ls`-based approach, while
preserving verification that `tiny_install_dir` contains a `node_modules`
directory.

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Nitpick comments:
In `@e2e/backend/test_npm_package_manager`:
- Around line 117-123: Replace the non-portable `find ... -quit` check in the
npm package-manager test with a portable directory-glob check, such as the
suggested `ls`-based approach, while preserving verification that
`tiny_install_dir` contains a `node_modules` directory.

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Central YAML (base), Organization UI (inherited)

Review profile: CHILL

Plan: Pro Plus

Run ID: 9daa25f7-f16b-49cd-9b14-d03885b74bf9

📥 Commits

Reviewing files that changed from the base of the PR and between 5e095cb and 23f9bab.

📒 Files selected for processing (4)

• e2e/backend/test_npm_aube
• e2e/backend/test_npm_package_manager
• src/backend/npm.rs
• src/backend/npm_registry.rs

🚧 Files skipped from review as they are similar to previous changes (2)

• src/backend/npm_registry.rs
• src/backend/npm.rs