[jdx]

https://entire.io/gh/jdx/mise/trails/510

Fixes #14068. Recreates #14072 by @tfournet, who found and fixed the bug.

With npm.shell_out, mise latest npm:<pkg> could run a mise shim from another data dir as npm. That happens when an outer mise's shims are on PATH while HOME or MISE_DATA_DIR point elsewhere, as in test runners and CI. The shim re-entered mise, which ran npm view again for every latest npm tool. The process count grew at every level until the machine ran out of memory.

npm view now resolves npm from the child PATH itself and skips any candidate that is the running mise binary. If a mise shim was the only npm, mise stops with an error instead of spawning it:

npm.shell_out needs npm, but the only npm on PATH is a mise shim (/outer/shims/npm); running it would re-enter mise. Install node first (`mise install node`) or disable npm.shell_out.

If a real npm exists later on PATH, it is used. If there is no npm at all, the behavior and error are unchanged. Windows is unchanged.

Changes from #14072:

• A hard link to the mise binary is now detected by device and inode. file::same_file compares paths, so it missed hard links.
• An empty PATH entry resolves to an absolute path. A bare npm made the child search PATH again and find the shim that was just skipped.
• A directory named npm is no longer picked over a real npm later on PATH.
• The e2e test's process cap counts threads, since RLIMIT_NPROC counts them. It is also no longer executable, as the repo requires.

Unit tests cover the foreign shim, shim-only, no-npm, hard-link, directory and empty-entry cases. e2e/backend/test_npm_shell_out_foreign_shim fails with a fork storm without the fix and passes with it.

AI-assisted — Tool: Claude Code; model: anthropic/claude-sonnet-5-5; version: claude-code_2-1-289_agent.

🤖 Generated with Claude Code

---

Note

Medium Risk
Changes how npm is resolved for shell-out metadata lookups on Unix; wrong detection could block valid npm or still recurse, but scope is limited to npm.shell_out and includes regression tests.

Overview
Fixes a fork storm when npm.shell_out is on and a foreign mise shim (e.g. another install’s shims on PATH while HOME/MISE_DATA_DIR differ) is the first npm on the child PATH. mise latest npm:* could re-enter mise and repeat npm view for every tool (#14068).

On Unix, npm view now picks the executable explicitly from the dependency PATH: skip known mise shim directories, treat symlink/hard-link copies of the running mise binary as shims, resolve empty/relative PATH entries to absolute paths, and ignore a directory named npm. If only a mise shim remains, mise errors with a clear message instead of spawning it; a real npm later on PATH is used; missing npm behavior is unchanged. Windows still uses the prior spawn path. The npm view invocation also sets NPM_CONFIG_UPDATE_NOTIFIER=false.

Adds unit tests for shim skipping, hard links, empty PATH, and dirs named npm, plus an e2e regression with an outer npm shim and a process cap so a recurrence fails fast.

^{Reviewed by Cursor Bugbot for commit e8dcb2c. Bugbot is set up for automated code reviews on this repo. Configure here.}

Summary by CodeRabbit

• Bug Fixes
  • Improved npm tool lookup when the system path includes a mise shim from another data directory. Lookup now avoids repeatedly invoking mise and provides a clear error when no real npm executable can be found.
  • npm version queries now handle relative and empty path entries more reliably, while preserving the existing behavior when npm is unavailable.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

• Configuration used: Repository YAML (base), Central YAML (inherited), Organization UI (inherited)
• Review profile: CHILL
• Plan: Advanced
• Run ID: 31818b01-f3df-4d74-a8ba-6af51ce6d11b

📥 Commits

Reviewing files that changed from the base of the PR and between 65511b3 and e8dcb2c.

📒 Files selected for processing (2)

• e2e/backend/test_npm_shell_out_foreign_shim
• src/backend/npm.rs

Included review availability: This review used your included allowance. Your plan provides up to 10 included reviews per hour; 1 remain after this review.

---

📝 Walkthrough

Walkthrough

Unix npm.shell_out metadata queries now resolve npm from the child PATH while skipping mise shims. Unit and end-to-end tests cover shim detection, PATH edge cases, and lookup behavior.

Changes

npm shell-out resolution

Layer / File(s)	Summary
Resolve npm without mise shims src/backend/npm.rs	Unix resolution searches PATH while skipping mise dispatch directories and candidates matching the running mise binary. Tests cover hard links, empty and relative PATH entries, directories named npm, and fallback behavior.
Use resolved npm for metadata queries src/backend/npm.rs, e2e/backend/test_npm_shell_out_foreign_shim	npm_view uses the Unix resolver and disables npm’s update notifier. Windows retains its existing lookup. The end-to-end test checks behavior with a foreign npm shim.

Priority: ➖ Normal

Estimated code review effort: 3 (Moderate) | ~20 minutes

Change: Bug fix · Severity of issue fixed: Medium

Suggested reviewers: risu729

Merge Risk: ⚪ Minimal · up to e8dcb

No concrete issue remains that should prevent merging after normal checks.

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly and concisely identifies the primary fix: preventing npm view from recursively re-entering mise through a foreign shim.
Linked Issues check	✅ Passed	Issue #14068 requires the npm.shell_out metadata path to avoid recursive dispatch through a mise shim and to stop when a shim is the only npm candidate. The PR resolves npm from the child PATH on Unix…
Out of Scope Changes check	✅ Passed	The changes stay within issue #14068. The source changes are limited to npm.shell_out npm resolution and its update-notifier environment. The added unit and e2e tests verify foreign-shim prevention an…
Docstring Coverage	✅ Passed	Docstring coverage is 94.12% which is sufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff. Analyzed 17 functions across 1 files. (1 skipped: 1 …

• Autopilot · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[cursor]

Stale Bugbot comment from a previous run.

[greptile-apps]

Confidence Score: 5/5

[High risk] Fixes infinite recursion in npm dependency resolution.

The PR appears safe to merge; no blocking issue remains.

Summary

On Unix, npm view skips links to the running mise binary and uses a real npm later on PATH. If only a mise shim exists, it returns a clear error.

• Adds focused tests for shim selection, hard links, directories, and empty PATH entries.
• The latest change counts Linux threads through /proc instead of ps and increases the test’s allowance.
• Rechecked all four earlier, unnumbered findings. Windows no longer calls the Unix helper; Docker honors the non-root marker; the empty-entry test checks an absolute path; and mapfile is gone.
• No new actionable issues or repository-rule violations were found.

_{Reviews (3) · Last reviewed commit: "test(npm): count threads from /proc inst..." · Reviewed by Greptile}

[cursor]

Stale Bugbot comment from a previous run.

[cursor]

Cursor Bugbot has reviewed your changes and found 1 potential issue.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit 2266bc4. Configure here.}

[github-actions]

Instruction counts

Nothing was compared, and so nothing was gated. No series appears on both sides: either the base has no measurements recorded, or the two were measured on different runner classes, which are deliberately not comparable — counts shift between machine types by more than a real regression does.

New, nothing to compare against: env on jdx-perf-v1-ubuntu24.04-x64-mise-rust1.97.1-img5263c143, hook-env on jdx-perf-v1-ubuntu24.04-x64-mise-rust1.97.1-img5263c143, ls on jdx-perf-v1-ubuntu24.04-x64-mise-rust1.97.1-img5263c143, registry on jdx-perf-v1-ubuntu24.04-x64-mise-rust1.97.1-img5263c143, startup on jdx-perf-v1-ubuntu24.04-x64-mise-rust1.97.1-img5263c143

_{Only instruction counts gate. Wall clock is shown for context — on identical hardware it moves 4-20% run to run.}

_{Measured by tak — instruction-counted CLI benchmarks, stored in this repository's git notes.}

_{e8dcb2c93380 vs 65511b3b34f8 · measured on the runner, not pushed to the history.}