[jdx]

Summary

• bump the embedded aube and aube-registry crates from 1.34 to 1.35
• attach a mise-owned prompt handler to embedded aube installs
• preserve the security context for low-download, similar-name, and newly registered package confirmations
• default confirmations to No and rely on mise's attended-terminal detection

Why

Embedded aube previously owned stdin directly while mise owned the progress renderer. That could leave unattended installs waiting for input, and interactive warnings could be overwritten by progress output.

Aube 1.35 includes the host prompt API from aubepkg/aube#1154. This PR wires it into the shared mise prompt path added by #11421, so mise now owns TTY detection, prompt rendering, input, and progress suspension.

This addresses the broader behavior discussed in #11375 and the overwritten prompt reported in #11417.

Validation

• mise run format
• mise run test:unit — 2,094 passed
• mise run test:e2e e2e/backend/test_npm_aube

AI-assisted — Tool: Codex; model: unavailable/unavailable; version: unavailable.

---

Note

Medium Risk
Changes npm install behavior for embedded aube when confirmations are required—now tied to mise’s attended-terminal rules—but scope is limited to prompt routing and a dependency bump, not resolver or trust policy logic.

Overview
Embedded npm installs now hand aube’s confirmation prompts to mise instead of letting aube read stdin directly. The embedded aube / aube-registry crates are bumped from 1.34 to 1.35 so the host prompt API is available.

On the npm backend, InstallControl gains AubePromptHandler, which implements aube’s InstallPromptHandler and calls confirm_with_default(..., false). That reuses mise’s TTY detection and progress suspension, so CI/non-interactive runs fail closed rather than hanging, and interactive typosquat / low-download / new-package warnings are not drawn under the progress spinner.

User-facing text for those three prompt kinds is built in aube_prompt_message; other prompt variants get a generic fallback. Unit tests lock in the security wording.

^{Reviewed by Cursor Bugbot for commit 944e28d. Bugbot is set up for automated code reviews on this repo. Configure here.}

Summary by CodeRabbit

• New Features

  • Added confirmation prompts for embedded package installations, including warnings for low downloads, similar package names, and newly registered packages.
  • Prompts are automatically declined when running unattended.

• Updates

  • Updated the Aube package integration to version 1.35.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Central YAML (base), Organization UI (inherited)

Review profile: CHILL

Plan: Pro Plus

Run ID: 83df2f2c-d5f5-4a2a-9810-9493bb3b7e1e

📥 Commits

Reviewing files that changed from the base of the PR and between 8bd923e and 944e28d.

⛔ Files ignored due to path filters (1)

• Cargo.lock is excluded by !**/*.lock

📒 Files selected for processing (2)

• Cargo.toml
• src/backend/npm.rs

---

📝 Walkthrough

Walkthrough

Aube and aube-registry are upgraded to 1.35. Embedded npm installs now route Aube confirmations through mise’s prompt UI, translate prompt variants into messages, fail closed by default, and test selected message output.

Changes

Embedded Aube prompt integration

Layer / File(s)	Summary
Prompt adapter and dependency update Cargo.toml, src/backend/npm.rs	Aube dependencies use version 1.35, while AubePromptHandler routes confirmations through mise and maps InstallPrompt variants to prompt text.
Install wiring and prompt validation src/backend/npm.rs	Embedded installation registers the prompt handler, and tests verify exact messages for selected prompt variants.

Estimated code review effort: 3 (Moderate) | ~20 minutes

Possibly related PRs

• jdx/mise#11149: Earlier embedded-aube implementation changes in the same npm backend path.
• jdx/mise#11308: Related embedded-aube event and progress integration.
• jdx/mise#11419: Related handling of Aube confirmation prompts during embedded installs.

Suggested reviewers: risu729

Sequence Diagram(s)

sequenceDiagram
  participant InstallControl
  participant AubePromptHandler
  participant MisePromptUI
  InstallControl->>AubePromptHandler: Request confirmation
  AubePromptHandler->>MisePromptUI: Render translated message with default false
  MisePromptUI-->>AubePromptHandler: Return confirmation result
  AubePromptHandler-->>InstallControl: Continue or reject installation

Loading

Poem

I’m a bunny with prompts in my paws,
Routing Aube through mise without flaws.
“Low downloads?” I ask with care,
Safe defaults waiting there.
Hop, confirm, or gently pause!

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly summarizes the main change of routing aube prompts through mise.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	cargo/​aube@​1.34.0 ⏵ 1.35.0
	cargo/​aube-registry@​1.34.0 ⏵ 1.35.0

View full report

[greptile-apps]

Greptile Summary

This PR routes embedded aube confirmations through mise’s shared prompt UI.

• Upgrades the aube crate family from 1.34 to 1.35.
• Adds a mise-owned prompt handler with fail-closed confirmation defaults.
• Preserves package-risk details in prompts for similar, low-download, and newly registered packages.
• Adds unit coverage for the security-context messages.

Confidence Score: 5/5

The PR appears safe to merge, with no concrete changed-code failure identified.

The prompt handler is attached to the embedded aube install control, defaults confirmations to No, delegates terminal handling to mise’s shared prompt path, and retains the relevant warning context for each current security prompt.

Important Files Changed

Filename	Overview
src/backend/npm.rs	Attaches the new aube prompt handler to embedded installs and translates all current security prompts into mise confirmation messages without an identified defect.
Cargo.toml	Updates the direct aube dependencies to the required 1.35 release.
Cargo.lock	Refreshes the locked aube crate family and associated transitive resolutions; the reported vulnerable packages were already present and are unaffected by this PR.

_{Reviews (1): Last reviewed commit: "fix(npm): route aube prompts through mis..." | Re-trigger Greptile}

[github-actions]

Instruction counts

benchmark	trend	instructions	Δ	wall (min)	Δ
env	▁▂▆▅▃▅▅▅▃▇▅▆▇▄▂▇▄▆██	84,470,193 → 84,480,968	+0.01%	21.20 → 20.38ms	-3.87%
hook-env	▁▂▃▃▃▃▃▃▃▃▃▃▃▆▅▆▂█▇█	87,267,089 → 87,299,705	+0.04%	22.04 → 24.27ms	+10.11%
ls	▁▂▅▆▅▆▆▃▃▄▄▅▄▃▄▄▂▆▇█	76,541,047 → 76,559,012	+0.02%	17.27 → 25.68ms	+48.67%
registry	▇▇▇▇███▃▃▄▃▃▄▁▁▄▂▅▄▄	50,072,051 → 50,073,620	+0.00%	12.57 → 16.61ms	+32.09%
startup	▅▄▅▅▄▄▅▃▃▃▃▃▂▁▁▄▂███	15,744,403 → 15,746,969	+0.02%	9.35 → 9.56ms	+2.25%

No instruction-count regression above 1%.

_{Only instruction counts gate. Wall clock is shown for context — on identical hardware it moves 4-20% run to run.}

_{Measured by tak — instruction-counted CLI benchmarks, stored in this repository's git notes.}

_{944e28d42959 vs 8bd923ec8524 · measured on the runner, not pushed to the history.}