Codestin Search App

jdx · 2026-03-21T13:21:15Z

Summary

In --locked mode, trust the lockfile URL for aqua tools without re-validating it against the registry's expected asset patterns, preventing unnecessary GitHub API calls
If no lockfile URL is found in --locked mode, fail immediately with a clear error instead of falling through to API calls that will fail anyway
Fixes `mise install --locked` / `MISE_LOCKED=1` still calls GH API for aqua tools despite lockfile having pre-resolved URLs #8677

Context

When using mise install --locked, the aqua backend was validating lockfile URLs against the registry's expected asset filenames. If validation failed (e.g., registry format changed since lock was generated), the code fell through to github::get_release() which requires API access — defeating the purpose of --locked mode.

Test plan

Verify mise install --locked works for aqua tools without GitHub token when lockfile has pre-resolved URLs
Verify non-locked mode behavior is unchanged (validation still occurs)
Verify mise install --locked fails clearly when no lockfile URL exists

🤖 Generated with Claude Code

Note

Medium Risk
Changes aqua install URL selection logic in --locked mode, which can affect whether installs succeed/fail and when network/GitHub API calls occur. Low security risk, but moderate behavioral impact for locked installs that previously fell back to refresh behavior.

Overview
In the aqua backend install path, --locked mode now trusts lockfile-provided asset URLs without re-validating them against registry asset patterns, preventing fallthrough into GitHub API lookups when registries change.

If --locked is enabled but the lockfile has no pre-resolved URL for the current platform, installation now fails immediately with a clear error instead of attempting to resolve via remote calls.

^{Written by Cursor Bugbot for commit d0f14bc. This will update automatically on new commits. Configure here.}

When `mise install --locked` is used and a lockfile URL exists, the aqua backend was still validating the URL against the registry's expected asset patterns. If the validation failed (e.g., registry format changed), it fell through to a code path that calls `github::get_release()`, causing API rate limit errors in environments without a GitHub token. Now in locked mode, the lockfile URL is trusted without validation, and if no lockfile URL is found, the code errors out immediately instead of attempting API calls. Fixes #8677 Co-Authored-By: Claude Opus 4.6 (1M context) <[email protected]>

gemini-code-assist · 2026-03-21T13:22:25Z

Summary of Changes

Hello, I'm Gemini Code Assist¹! I'm currently reviewing this pull request and will post my feedback shortly. In the meantime, here's a summary to help you and other reviewers quickly get up to speed!

This pull request enhances the --locked mode for aqua tools by preventing unnecessary GitHub API calls and improving error handling when no lockfile URL is available. It ensures that in --locked mode, the lockfile URL is trusted without re-validation, while maintaining the existing validation behavior in non-locked mode.

Highlights

Locked Mode Enhancement: In --locked mode, the PR skips GitHub API calls for aqua tools by trusting the lockfile URL, avoiding re-validation against the registry's expected asset patterns.
Error Handling: The PR introduces immediate failure with a clear error message when no lockfile URL is found in --locked mode, preventing fallback to API calls.
Validation Logic: The PR ensures that validation still occurs in non-locked mode, maintaining existing behavior.

Using Gemini Code Assist

The full guide for Gemini Code Assist can be found on our documentation page, here are some quick tips.

Invoking Gemini

You can request assistance from Gemini at any point by creating a comment using either /gemini <command> or @gemini-code-assist <command>. Below is a summary of the supported commands on the current page.

Feature	Command	Description
Code Review	`/gemini review`	Performs a code review for the current pull request in its current state.
Pull Request Summary	`/gemini summary`	Provides a summary of the current pull request in its current state.
Comment	@gemini-code-assist	Responds in comments when explicitly tagged, both in pull request comments and review comments.
Help	`/gemini help`	Displays a list of available commands.

Customization

To customize Gemini Code Assist for GitHub experience, repository maintainers can create a configuration file and/or provide a custom code review style guide (such as PEP-8 for Python) by creating and adding files to a .gemini/ folder in the base of the repository. Detailed instructions can be found here.

Limitations & Feedback

Gemini Code Assist may make mistakes. Please leave feedback on any instances where its feedback is incorrect or counter productive. You can react with 👍 and 👎 on @gemini-code-assist comments. If you're interested in giving your feedback about your experience with Gemini Code Assist for GitHub and other Google products, sign up here.

Review the Privacy Notices, Generative AI Prohibited Use Policy, Terms of Service, and learn how to configure Gemini Code Assist in GitHub here. Gemini can make mistakes, so double check it and use code with caution. ↩

greptile-apps · 2026-03-21T13:23:02Z

Greptile Summary

This PR fixes a bug where mise install --locked for aqua-backed tools would silently fall through to github::get_release() API calls — defeating the purpose of --locked mode — when lockfile URL validation failed due to a registry format change.

Key changes in src/backend/aqua.rs:

When ctx.locked is true and a lockfile URL exists (existing_platform is Some), skip filename validation against the registry's expected asset patterns and use the lockfile URL directly. This prevents any GitHub API call in the happy path.
When ctx.locked is true but no lockfile URL exists (validated_url is None), bail! immediately with a descriptive error instead of falling through to the get_url() / github::get_release() code path that would fail anyway without network access.

The fix is minimal, targeted, and logically correct. The two touch points (validated_url assignment at line 345 and the new else if ctx.locked arm at line 403) cover all relevant code paths without affecting non-locked mode behavior. No tests were added alongside the fix, but the test plan items in the PR description are straightforward to verify manually.

Confidence Score: 5/5

Safe to merge — minimal, targeted fix with correct logic and no regressions to non-locked behavior.
Both new code paths are logically correct: trusting the lockfile URL in locked mode avoids unnecessary validation and API calls, and the early bail! provides a clear failure when the lockfile is incomplete. Non-locked behavior is entirely unchanged. No new API surface introduced. The only minor gap is the absence of automated tests, but the fix is simple enough that the manual test plan in the PR description is sufficient.
No files require special attention.

Important Files Changed

Filename	Overview
src/backend/aqua.rs	Two-line fix that correctly short-circuits lockfile URL validation and API-call fallback for `--locked` mode; logic is sound with no issues found.

Flowchart

%%{init: {'theme': 'neutral'}}%%
flowchart TD
    A[install_version_] --> B{existing_platform\nin lockfile?}
    B -- Yes --> C[Skip get_version_tags API call]
    B -- No --> D[Call get_version_tags API]
    D --> E[...]
    C --> F{ctx.locked\nOR non-GithubRelease?}
    F -- Yes\n'NEW' --> G[validated_url = existing_platform\nTrust lockfile, no API call]
    F -- No --> H[Validate filename vs registry\nasset pattern]
    H -- Match --> I[validated_url = existing_platform]
    H -- No match --> J[validated_url = None\nwarn: refreshing]
    G --> K{validated_url = Some?}
    I --> K
    J --> K
    K -- Yes --> L[Use URL directly\ndownload + verify + install]
    K -- No --> M{ctx.locked?\n'NEW'}
    M -- Yes --> N[bail! with clear error\nNEW BEHAVIOR]
    M -- No --> O[Call github::get_release\nAPI to resolve URL]
    O --> L

_{Last reviewed commit: "fix(install): skip G..."}

gemini-code-assist

Code Review

This pull request effectively addresses the issue of unnecessary GitHub API calls and unclear error messages when using mise install --locked with Aqua tools. The changes ensure that in --locked mode, the lockfile URL is trusted without re-validation, preventing redundant network requests. Furthermore, if a lockfile URL is not found in --locked mode, the installation now fails immediately with a clear and informative error message, improving the user experience. The modifications are precise and directly implement the described objectives, enhancing the reliability and efficiency of locked installations for Aqua tools.

github-actions · 2026-03-21T13:39:47Z

Hyperfine Performance

`mise x -- echo`

Command	Mean [ms]	Min [ms]	Max [ms]	Relative
`mise-2026.3.10 x -- echo`	23.8 ± 0.3	23.3	28.0	1.00 ± 0.02
`mise x -- echo`	23.8 ± 0.2	23.1	24.7	1.00

`mise env`

Command	Mean [ms]	Min [ms]	Max [ms]	Relative
`mise-2026.3.10 env`	23.4 ± 0.7	22.7	30.3	1.01 ± 0.03
`mise env`	23.3 ± 0.4	22.4	26.7	1.00

`mise hook-env`

Command	Mean [ms]	Min [ms]	Max [ms]	Relative
`mise-2026.3.10 hook-env`	24.2 ± 1.5	23.4	47.7	1.01 ± 0.06
`mise hook-env`	24.0 ± 0.3	23.5	28.6	1.00

`mise ls`

Command	Mean [ms]	Min [ms]	Max [ms]	Relative
`mise-2026.3.10 ls`	23.2 ± 0.6	22.4	28.7	1.00 ± 0.03
`mise ls`	23.1 ± 0.2	22.6	24.8	1.00

`xtasks/test/perf`

Command	mise-2026.3.10	mise	Variance
install (cached)	152ms	151ms	+0%
ls (cached)	84ms	84ms	+0%
bin-paths (cached)	86ms	86ms	+0%
task-ls (cached)	850ms	825ms	+3%

…s integrity data (#8688) ## Summary Skip provenance verification (GitHub attestations, SLSA, cosign, minisign) when the lockfile already has integrity data, avoiding redundant API calls on repeated installs. Provenance only needs to be verified once — subsequent installs are protected by the lockfile checksum. ### Backend-specific behavior - **aqua/github**: Skip when lockfile has both `checksum` and `provenance` for the platform. Still check that the recorded provenance type's setting is enabled (disabling attestation settings with a provenance-bearing lockfile is detected as a downgrade attack). - **vfox**: Skip when lockfile has `provenance` (vfox doesn't populate `PlatformInfo.checksum`). Only skip attestation when the plugin also provides sha256/sha512 checksums, ensuring at least one integrity check always runs. Downgrade detection is preserved via discriminant comparison after install. ### Key design decisions - Provenance re-verification is skipped in both `--locked` and non-locked modes when integrity data exists - `ensure_provenance_setting_enabled()` catches downgrades where settings are disabled after lockfile was created - vfox's `checksum_verified` field reflects actual verification (only set when a file was downloaded and checksums were present), not just plugin declarations - github backend errors explicitly on unexpected provenance types (Cosign/Minisign) rather than silently passing Follows up on #8679 which skipped asset URL resolution API calls in locked mode. Ref: #8677 (reply in thread) ## Test plan - [ ] Verify repeated `mise install` skips attestation API calls for aqua/github tools with lockfile integrity data - [ ] Verify first install (no lockfile entry) still performs full provenance verification - [ ] Verify disabling attestation settings with a provenance-bearing lockfile triggers downgrade error - [ ] Verify vfox plugins without sha256/sha512 still run attestation on repeated installs - [ ] Verify vfox plugins that remove attestation config are caught as downgrades 🤖 Generated with [Claude Code](https://claude.com/claude-code)  --- > [!NOTE] > **Medium Risk** > Touches install-time security verification paths (checksums/attestations) across multiple backends; while it preserves downgrade protections, mistakes could reduce provenance enforcement or skip required verification in some scenarios. > > **Overview** > Avoids **redundant provenance re-verification** on repeated installs when the lockfile already contains integrity data. > > For `aqua` and `github` backends, provenance checks (attestations/SLSA/etc.) are skipped when the lockfile already has both `checksum` and `provenance` for the platform, but the code now **errors if the corresponding verification setting is disabled** to prevent downgrade-by-config. > > For `vfox`, adds `Vfox.skip_verification` and an `InstallResult.checksum_verified` signal so attestation verification can be skipped only when a lockfile provenance entry exists *and* the plugin verified a strong checksum (sha256/sha512), while still enforcing lockfile provenance type expectations. > > <sup>Written by [Cursor Bugbot](https://cursor.com/dashboard?tab=bugbot) for commit fa47516. This will update automatically on new commits. Configure [here](https://cursor.com/dashboard?tab=bugbot).</sup>  --------- Co-authored-by: Claude Opus 4.6 (1M context) <[email protected]>

@jdx

### 🚀 Features - **(github)** read tokens from gh CLI hosts.yml config by @jdx in [#8692](#8692) - **(task)** support optional `args` and `env` fields in `run` entries by @jdx in [#8687](#8687) - **(task)** add --skip-tools flag to mise run by @jdx in [#8699](#8699) - **(vfox)** add try_get, try_head, try_download_file to Lua HTTP module by @jdx in [#8697](#8697) ### 🐛 Bug Fixes - **(config)** recognize SSH and other non-HTTPS URLs in get_repo_url by @modestman in [#8666](#8666) - **(docs)** add dark mode support to favicon by @jdx in [#8678](#8678) - **(env)** support multiple --env/-E flags by @jdx in [#8686](#8686) - **(github)** rename_exe renames correct binary when archive contains multiple executables by @jdx in [#8700](#8700) - **(implode)** include system data dir in implode cleanup by @jdx in [#8696](#8696) - **(install)** skip GitHub API calls for aqua tools in --locked mode by @jdx in [#8679](#8679) - **(install)** skip redundant provenance verification when lockfile has integrity data by @jdx in [#8688](#8688) - **(lock)** respect existing platforms in lockfile when running `mise lock` by @jdx in [#8708](#8708) - **(lock)** skip global config lockfile by default by @jdx in [#8707](#8707) - **(node)** expand tilde in default_packages_file path by @jdx in [#8709](#8709) - **(shell)** error when no version specified instead of silent no-op by @jdx in [#8693](#8693) - **(shim)** detect shims by checking shims directory instead of binary name by @jdx in [#8694](#8694) - **(task)** inherit task_config.dir for included TOML and file tasks by @jdx in [#8689](#8689) - **(task)** strip inline args when validating run.tasks references by @jdx in [#8701](#8701) - **(task)** include idiomatic version files in monorepo task toolset by @jdx in [#8702](#8702) - **(task)** improve error message when task files are not executable by @jdx in [#8705](#8705) - **(test)** update vfox provenance test for checksum-backed skip by @jdx in [#8703](#8703) - improve usage spec element support in tasks by @nkakouros in [#8623](#8623) - make env plugin (Module) vars available in Tera template context by @victor-founder in [#8682](#8682) - respect MISE_COLOR=0 for color_eyre error output by @jdx in [#8690](#8690) - add windows support for usage tool registry by @jdx in [#8713](#8713) ### 📚 Documentation - **(task)** clarify interactive task blocking behavior by @jdx in [#8685](#8685) - improve visibility of install_before setting by @jdx in [#8712](#8712) ### 📦 Registry - add rtk ([github:rtk-ai/rtk](https://github.com/rtk-ai/rtk)) by @bricelalu in [#8683](#8683) ### New Contributors - @victor-founder made their first contribution in [#8682](#8682) - @modestman made their first contribution in [#8666](#8666) - @bricelalu made their first contribution in [#8683](#8683)

gemini-code-assist Bot reviewed Mar 21, 2026

View reviewed changes

jdx merged commit d20956b into main Mar 21, 2026
38 checks passed

jdx deleted the fix/aqua-locked-skip-api-calls branch March 21, 2026 15:06

mise-en-dev mentioned this pull request Mar 21, 2026

chore: release 2026.3.11 #8676

Merged

jdx mentioned this pull request Mar 21, 2026

fix(install): skip redundant provenance verification when lockfile has integrity data #8688

Merged

5 tasks

palootcenas-outreach mentioned this pull request Mar 26, 2026

fix(ci): use locked mode to eliminate GitHub API calls from mise getoutreach/devbase#1118

Open

This was referenced May 9, 2026

fix(lock): cache unavailable github attestations #9741

Merged

fix(python): skip redundant lockfile provenance verification #9739

Merged

AllDmeat mentioned this pull request Jun 22, 2026

fix(swift): opt out of --locked URL check #10575

Merged

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

fix(install): skip GitHub API calls for aqua tools in --locked mode#8679

fix(install): skip GitHub API calls for aqua tools in --locked mode#8679
jdx merged 1 commit into
mainfrom
fix/aqua-locked-skip-api-calls

jdx commented Mar 21, 2026 •

edited by cursor Bot

Loading

Uh oh!

gemini-code-assist Bot commented Mar 21, 2026

Uh oh!

greptile-apps Bot commented Mar 21, 2026

Uh oh!

gemini-code-assist Bot left a comment

Uh oh!

github-actions Bot commented Mar 21, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Uh oh!

Conversation

jdx commented Mar 21, 2026 • edited by cursor Bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary

Context

Test plan

Uh oh!

gemini-code-assist Bot commented Mar 21, 2026

Summary of Changes

Highlights

Footnotes

Uh oh!

greptile-apps Bot commented Mar 21, 2026

Greptile Summary

Confidence Score: 5/5

Important Files Changed

Flowchart

Uh oh!

gemini-code-assist Bot left a comment

Choose a reason for hiding this comment

Code Review

Uh oh!

github-actions Bot commented Mar 21, 2026

Hyperfine Performance

mise x -- echo

mise env

mise hook-env

mise ls

xtasks/test/perf

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

jdx commented Mar 21, 2026 •

edited by cursor Bot

Loading

`mise x -- echo`

`mise env`

`mise hook-env`

`mise ls`

`xtasks/test/perf`