[jdx]

Summary

• track whether a tool version was actually resolved from mise.lock
• treat a matching npm lockfile pin as approval for aube's low-download popularity gate
• apply the exemption to both embedded aube and aube_cli, scoped to the requested package only
• keep first-time unlocked installs and OSV malicious-package checks unchanged

Context

This fixes the hidden embedded prompt reported in #11375 without requiring every locked npm tool to repeat allow_low_downloads = true in configuration.

The corresponding aube behavior for native npm project lockfiles is in aubepkg/aube#1143.

Validation

• mise run lint
• mise run test:unit -- backend::npm::tests::test_write_aube_
• mise run test:unit -- toolset::tool_version::tests::

AI-assisted — Tool: Codex; model: unavailable/unavailable; version: unavailable.

---

Note

^{Cursor Bugbot is generating a summary for commit 2406f88. Configure here.}

Summary by CodeRabbit

• New Features

  • Lockfile-pinned npm tools are now automatically trusted during low-download-count checks.
  • Reproducing an existing lockfile no longer requires allow_low_downloads.

• Bug Fixes

  • First-time unlocked installs continue to require explicit approval through allow_low_downloads.

• Documentation

  • Clarified when allow_low_downloads is required and when lockfile resolution provides automatic approval.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Central YAML (base), Organization UI (inherited)

Review profile: CHILL

Plan: Pro Plus

Run ID: 0820626a-5291-4eb7-924c-15a3e861f3ab

📥 Commits

Reviewing files that changed from the base of the PR and between 26a6404 and 2406f88.

📒 Files selected for processing (3)

• docs/dev-tools/backends/npm.md
• src/backend/npm.rs
• src/toolset/tool_version.rs

---

📝 Walkthrough

Walkthrough

ToolVersion now records lockfile provenance. npm Aube installation paths pass that state to project writers, which emit allowedUnpopularPackages for lockfile-resolved tools or explicitly approved low-download installs. Tests and documentation cover the behavior.

Changes

npm lockfile trust

Layer / File(s)	Summary
Track lockfile resolution provenance src/toolset/tool_version.rs	ToolVersion records whether it was created from a lockfile, exposes the state internally, and tests locked and unlocked cases.
Pass provenance into Aube writers src/backend/npm.rs	Embedded and CLI Aube installation paths pass resolved_from_lockfile() to their project writers.
Generate trusted-package npm configuration src/backend/npm.rs, docs/dev-tools/backends/npm.md	Aube writers emit allowedUnpopularPackages when low-download approval or lockfile resolution applies; tests and documentation describe the behavior.

Estimated code review effort: 3 (Moderate) | ~20 minutes

Sequence Diagram(s)

sequenceDiagram
  participant ToolVersion
  participant NPMBackend
  participant AubeProjectWriter
  participant npmrc
  ToolVersion->>NPMBackend: resolved_from_lockfile()
  NPMBackend->>AubeProjectWriter: pass lockfile provenance
  AubeProjectWriter->>npmrc: emit allowedUnpopularPackages when applicable

Loading

Possibly related PRs

• jdx/mise#11149: Touches the embedded Aube install path and generated .npmrc behavior.
• jdx/mise#11305: Modifies the same low-download allowedUnpopularPackages behavior.
• jdx/mise#11357: Introduces the related standalone Aube CLI flow.

Suggested reviewers: risu729

Poem

I’m a rabbit guarding locks,
Trusting pins inside the box.
Aube writes the npm clue,
Low-download gates know what to do.
No unlocked install slips by—
Hop, hop, tests reply!

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly matches the main change: npm now trusts packages pinned in mise lockfiles.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[greptile-apps]

Greptile Summary

This PR tracks lockfile-derived tool versions and uses that provenance to exempt only the requested npm package from aube’s low-download gate.

• Adds distinct resolved_from_lockfile provenance to ToolVersion.
• Applies the scoped exemption to embedded aube and aube_cli.
• Documents the lockfile behavior and adds focused unit coverage.

Confidence Score: 5/5

The PR appears safe to merge, with the lockfile exemption correctly limited to the matching npm package and aube’s popularity check.

Lockfile provenance is set only by the lockfile-resolution constructor, remains distinct from other locked states, reaches both aube installation paths unchanged, and produces a package-specific exemption.

Important Files Changed

Filename	Overview
src/toolset/tool_version.rs	Adds lockfile-resolution provenance without conflating it with the existing general-purpose locked state.
src/backend/npm.rs	Uses lockfile provenance in both aube installation paths to exempt only the resolved npm package from the popularity gate.
docs/dev-tools/backends/npm.md	Accurately documents that lockfile pins satisfy the download-count approval while first-time unlocked installs still require explicit approval.

_{Reviews (1): Last reviewed commit: "fix(npm): trust packages pinned in mise ..." | Re-trigger Greptile}

[github-actions]

Hyperfine Performance

mise x -- echo

Command	Mean [ms]	Min [ms]	Max [ms]	Relative
mise-2026.7.14 x -- echo	20.2 ± 1.2	17.1	29.3	1.00
mise x -- echo	21.2 ± 1.5	18.1	28.8	1.05 ± 0.10

mise env

Command	Mean [ms]	Min [ms]	Max [ms]	Relative
mise-2026.7.14 env	18.9 ± 1.3	16.2	27.9	1.00
mise env	20.4 ± 1.7	17.5	38.4	1.08 ± 0.12

mise hook-env

Command	Mean [ms]	Min [ms]	Max [ms]	Relative
mise-2026.7.14 hook-env	19.7 ± 1.2	16.6	26.8	1.00
mise hook-env	21.4 ± 1.5	18.2	27.2	1.09 ± 0.10

mise ls

Command	Mean [ms]	Min [ms]	Max [ms]	Relative
mise-2026.7.14 ls	17.5 ± 1.2	14.2	24.7	1.00
mise ls	19.1 ± 1.4	16.3	26.9	1.09 ± 0.11

xtasks/test/perf

Command	mise-2026.7.14	mise	Variance
install (cached)	171ms	184ms	-7%
ls (cached)	64ms	67ms	-4%
bin-paths (cached)	65ms	66ms	-1%
task-ls (cached)	93ms	98ms	-5%