[jdx]

https://entire.io/gh/jdx/mise/trails/649

Discussion #14276 reports this bug. Suppose a project with a lockfile installs an npm tool. mise builds that install from the locked dependency graph and stores it as <version>~aube~<digest>. Another config that asks for the same tool as latest without a lockfile (typically the global config) resolves latest to the newest installed version. It used that private directory name as the version:

PS (global)> mise ls
Tool            Version                              Source                      Requested
prettier        3.9.9 (missing) [prettier-djym7d3g]  ~\.config\mise\config.toml  latest
prettier        3.9.9 [prettier-zk2ialuk]
mise WARN  missing: prettier@3.9.9~aube~b9c537a2e2590f84
PS (global)> prettier -h
mise ERROR Tool not installed for shim: prettier

With install_layout = "identity", the suffixed name was hashed into an installation identity that nothing has. The tool showed as missing and its shims failed even though it was installed. With the legacy layout the tool still ran, but the private name leaked into mise current, env and warnings as if it were the version.

Now, when latest resolves to an installed version, mise uses the npm version (3.9.9) and keeps pointing at the installation it found. This is the same normalization mise lock got in #13542. In the identity layout the found name is a compatibility link, so the installation is looked up through that link rather than by re-hashing the name. Pinning prettier@3.9.9 in the global config was the workaround and is no longer needed.

Validation

• New e2e backend/test_npm_aube_unlocked_latest: installs npm:inflight@latest from a lockfile in one directory, then resolves latest without a lockfile in another. It checks mise current, ls --missing, ls and env show no ~aube~ name or missing tool, and where points at the graph install. It runs under both layouts. Before the fix it failed in both (identity layout: 1.0.6 (missing) [inflight-jfo7ej4u]). With the compatibility-link lookup removed, the identity-layout where check fails.
• test_npm_aube*, cli/test_install_layout*, and the tool_version/lockfile/install_layout/npm unit tests pass. One tool_version unit test, has_linked_version_ignores_mise_managed_absolute_targets, fails in this sandbox with and without this change. cargo clippy --workspace --all-features --all-targets -- -D warnings passes.

🤖 Generated with Claude Code

AI-assisted — Tool: Claude Code; model: anthropic/claude-opus-5-5; version: 2.1.295.

---

Note

Medium Risk
Touches core version resolution and install-path lookup for npm latest and aube-suffixed installs; behavior change is targeted but affects tool selection and shims globally when those installs exist.

Overview
Fixes unlocked latest for npm tools when the newest on-disk install is a lockfile graph directory named \<version\>~aube~\<digest\>. mise now strips that private suffix to the real npm version and keeps the resolved install path, instead of treating the directory name as the version (missing tools, broken shims under identity layout, ~aube~ leaking into current / ls / warnings elsewhere).

strip_install_path_identity resolves the install directory via physical_dir in the identity layout so a compatibility link name is not re-hashed into a nonexistent identity. resolve_version applies the same normalization when latest picks latest_installed_version.

Adds e2e test_npm_aube_unlocked_latest (locked vs unlocked configs, both install layouts).

^{Reviewed by Cursor Bugbot for commit aa615ea. Bugbot is set up for automated code reviews on this repo. Configure here.}

Summary by CodeRabbit

• Bug Fixes
  • Fixed version reporting for tools installed with identity-based layouts when an unlocked project uses latest. The detected version and resolved install path now match the installed tool, and commands no longer incorrectly report it as missing.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

• Configuration used: Repository YAML (base), Central YAML (inherited), Organization UI (inherited)
• Review profile: CHILL
• Plan: Advanced
• Run ID: bcd8e8ef-1f40-4ebf-887d-0dd6bedc7f7d

---

📥 Commits

Reviewing files that changed from the base of the PR and between 4251fe8 and aa615ea.

---

📒 Files selected for processing (2)

• e2e/backend/test_npm_aube_unlocked_latest
• src/toolset/tool_version.rs

---

Included review availability: This review used your included allowance. Your plan provides up to 10 included reviews per hour; 1 remain after this review.

---

---

📝 Walkthrough

Walkthrough

The latest installed-version path now removes the private install identity suffix and restores the physical install directory. An end-to-end test covers npm:inflight in identity and legacy install layouts.

Changes

npm latest install paths

Layer / File(s)	Summary
Normalize latest versions and verify install paths src/toolset/tool_version.rs, e2e/backend/test_npm_aube_unlocked_latest	The latest installed-version shortcut strips install-path identity before returning the version. The regression test checks the reported version, missing status, displayed name, resolved path, and environment output in both layouts.

Priority: ⬇️ Low

Estimated code review effort: 2 (Simple) | ~10 minutes

Change: Bug fix

Suggested reviewers: risu729

---

Merge Risk: ⚪ Minimal · up to aa615

The change makes an unlocked latest request for an npm tool installed from a lockfile report the real npm version instead of the private install directory suffix. No actionable merge-blocking risk remains.

Pre-merge checks | 4 | 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Docstring Coverage		Docstring coverage is 50.00% which is insufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff. Analyzed 2 functions across 1 files. (1 skipped: 1…	Write docstrings for the functions missing them to satisfy the coverage threshold.

✅ Passed checks (4 passed)

Check name	Status	Explanation
Description Check		Check skipped - CodeRabbit’s high-level summary is enabled.
Title check		The title clearly and concisely describes the main change: resolving an unlocked npm latest request to the version from a graph-locked installation.
Linked Issues check		Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check		Check skipped because no linked issues were found for this pull request.

---

Full details: Docstring Coverage

Explanation

Docstring coverage is 50.00% which is insufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff. Analyzed 2 functions across 1 files. (1 skipped: 1 unsupported.)

---

• Fix all pre-merge checks with AI

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

---

_{Comment @coderabbitai help to get the list of available commands.}

[greptile-apps]

Confidence Score: 5/5

[Medium impact] The PR appears safe to merge; no actionable defects were found.

Summary

Fixes unlocked latest requests that select an installed npm tool with a graph-specific directory name.

• Unlocked npm latest uses the package version and its graph install.

_{Reviews (1) · Last reviewed commit: "fix(npm): resolve unlocked latest to the..." · Reviewed by Greptile}

[github-actions]

Instruction counts

Nothing was compared, and so nothing was gated. No series appears on both sides: either the base has no measurements recorded, or the two were measured on different runner classes, which are deliberately not comparable — counts shift between machine types by more than a real regression does.

New, nothing to compare against: env on jdx-perf-v1-ubuntu24.04-x64-mise-rust1.97.1-img5263c143, hook-env on jdx-perf-v1-ubuntu24.04-x64-mise-rust1.97.1-img5263c143, ls on jdx-perf-v1-ubuntu24.04-x64-mise-rust1.97.1-img5263c143, registry on jdx-perf-v1-ubuntu24.04-x64-mise-rust1.97.1-img5263c143, startup on jdx-perf-v1-ubuntu24.04-x64-mise-rust1.97.1-img5263c143

_{Only instruction counts gate. Wall clock is shown for context — on identical hardware it moves 4-20% run to run.}

_{Measured by tak — instruction-counted CLI benchmarks, stored in this repository's git notes.}

_{aa615ea7cc10 vs 4251fe8c04c1 · measured on the runner, not pushed to the history.}