fix(vfox-plugin): support Git URL with commit hash for mise.toml by Oyami-Srk · Pull Request #9099 · jdx/mise

Oyami-Srk · 2026-04-15T07:27:47Z

The ensure_installed method of the vfox backend is very different from the asdf backend; it's a simplified version and behaves differently from the install method of vfox itself.

This PR fixes this by reusing the plugin install logic to make them consistent.

Before this fix, a Git URL with a commit hash for mise.toml would not work when using mise install to install the tools (because in that case, the ensure_installed method will be invoked to handle the tools with specified plugins).

An example of a failure use case:

[plugins]
"vfox:something" = "https://github.com/org/repo#commit_hash"

[tools]
"vfox:something" = "1.0.0"

P.S.: mise plugin install would still work, because it invokes the install method instead of the ensure_installed method.

greptile-apps · 2026-04-15T07:31:37Z

Greptile Summary

This PR fixes a bug in VfoxPlugin::ensure_installed where Git URLs with a commit-hash fragment (e.g. https://github.com/org/repo#abc1234) were silently ignored. The old implementation cloned the repo using a plain CloneOptions::default() call, which never parsed the #ref portion; the new implementation delegates to self.install() (which calls PluginSource::parse → Git::split_url_and_ref) so the commit reference is correctly resolved.

As a side effect, the new code also aligns ensure_installed with asdf_plugin: it now adds a community-plugin trust prompt that was previously missing, and it honours the force parameter (previously marked _force and completely ignored).

Confidence Score: 5/5

Safe to merge — the fix is correct and all remaining observations are P2 quality-of-life notes.

The delegation to install() correctly threads the Url (fragment preserved by url::Url::as_str) through PluginSource::parse and Git::split_url_and_ref, fixing the reported bug. The community-trust guard and lock-file logic are faithful copies of AsdfPlugin::ensure_installed. normalize_remote strips the fragment before comparing against the registry, so the trust check is not broken by the #ref suffix. No P0/P1 issues found.

No files require special attention.

Important Files Changed

Filename	Overview
src/plugins/vfox_plugin.rs	ensure_installed now delegates to install(), correctly handling #ref fragments; logic mirrors asdf_plugin closely, community trust check and lock-file handling are correct

Sequence Diagram

sequenceDiagram
    participant U as mise install
    participant EI as ensure_installed (vfox)
    participant I as install()
    participant PS as PluginSource::parse
    participant G as Git

    U->>EI: ensure_installed(config, mpr, force, dry_run)
    alt already installed && !force
        EI-->>U: Ok(()) (early return)
    end
    alt !settings.yes && repo_url is None
        EI->>EI: get_repo_url() → check community trust
        alt paranoid mode
            EI-->>U: bail! error
        end
        alt user declines
            EI-->>U: PluginNotInstalled error
        end
    end
    EI->>EI: lock_file::get(plugin_path, force)
    EI->>I: self.install(config, pr)
    I->>I: get_repo_url() → Url with #fragment preserved
    I->>PS: PluginSource::parse(url_string)
    PS->>PS: Git::split_url_and_ref → extracts commit hash
    PS-->>I: Git { url, git_ref: Some("abc1234") }
    I->>G: git.clone(url)
    I->>G: git.update(Some("abc1234"))
    G-->>I: checked out at commit hash
    I-->>EI: Ok(())
    EI->>EI: warn_if_env_plugin_shadows_registry
    EI-->>U: Ok(())

_{Reviews (1): Last reviewed commit: "fix: correct install vfox plugin" | Re-trigger Greptile}

greptile-apps · 2026-04-15T07:31:40Z

+        if !dry_run {
+            let _lock = lock_file::get(&self.plugin_path, force)?;
+            self.install(config, pr.as_ref()).await?;
+            warn_if_env_plugin_shadows_registry(&self.name, &self.plugin_path);
+        }
        Ok(())


install() error not returned from ensure_installed

asdf_plugin::ensure_installed returns the result of install() directly (self.install(...).await), so any install error is the function's return value. The new vfox code uses ? to propagate the error and then calls warn_if_env_plugin_shadows_registry, which is correct — but the two branches are asymmetric in their return style. Consider matching asdf's pattern for clarity, even though the observable behavior is the same:

Suggested change

if !dry_run {

let _lock = lock_file::get(&self.plugin_path, force)?;

self.install(config, pr.as_ref()).await?;

warn_if_env_plugin_shadows_registry(&self.name, &self.plugin_path);

}

Ok(())

if !dry_run {

let _lock = lock_file::get(&self.plugin_path, force)?;

self.install(config, pr.as_ref()).await?;

warn_if_env_plugin_shadows_registry(&self.name, &self.plugin_path);

}

Ok(())

(This is already what the PR has — the note is just that the warn_if_env_plugin_shadows_registry call is a vfox-only addition not present in asdf's version, which is intentional and correct for vfox env-plugins.)

Note: If this suggestion doesn't match your team's coding style, reply to this and let me know. I'll remember it for next time!

gemini-code-assist

Code Review

This pull request updates the vfox_plugin.rs to implement a trust-based installation flow for plugins. It adds checks for community-developed plugins, introduces a confirmation prompt for untrusted sources, and supports a 'paranoid' mode to block such installations. The update also includes file locking to handle concurrent installations and refactors the cloning logic into a dedicated install method. I have no feedback to provide.

@mariusvniekerk

### 🐛 Bug Fixes - **(go)** honor install_before for module versions by @mariusvniekerk in [#9097](#9097) - **(vfox-plugin)** support Git URL with commit hash for mise.toml by @Oyami-Srk in [#9099](#9099) - `MISE_FETCH_REMOTE_VERSIONS_CACHE` not respected by @mcncl in [#9096](#9096) ### 📦️ Dependency Updates - unblock cargo-deny advisories check by @jdx in [#9112](#9112) ### New Contributors - @mariusvniekerk made their first contribution in [#9097](#9097) - @mcncl made their first contribution in [#9096](#9096) - @Oyami-Srk made their first contribution in [#9099](#9099)

@mariusvniekerk

### 🐛 Bug Fixes - **(go)** honor install_before for module versions by @mariusvniekerk in [#9097](#9097) - **(schema)** support os arch filters by @risu729 in [#9095](#9095) - **(vfox-plugin)** support Git URL with commit hash for mise.toml by @Oyami-Srk in [#9099](#9099) - `MISE_FETCH_REMOTE_VERSIONS_CACHE` not respected by @mcncl in [#9096](#9096) ### 📦️ Dependency Updates - unblock cargo-deny advisories check by @jdx in [#9112](#9112) ### New Contributors - @mariusvniekerk made their first contribution in [#9097](#9097) - @mcncl made their first contribution in [#9096](#9096) - @Oyami-Srk made their first contribution in [#9099](#9099)

@jdx

## [2026.4.14](https://github.com/jdx/mise/compare/v2026.4.13..v2026.4.14) - 2026-04-15 ### Chore - bump sigstore-verification by @jdx in [#9128](jdx/mise#9128) ## [2026.4.13](https://github.com/jdx/mise/compare/v2026.4.12..v2026.4.13) - 2026-04-15 ### 🐛 Bug Fixes - **(go)** honor install_before for module versions by @mariusvniekerk in [#9097](jdx/mise#9097) - **(vfox-plugin)** support Git URL with commit hash for mise.toml by @Oyami-Srk in [#9099](jdx/mise#9099) - `MISE_FETCH_REMOTE_VERSIONS_CACHE` not respected by @mcncl in [#9096](jdx/mise#9096) ### 📦️ Dependency Updates - unblock cargo-deny advisories check by @jdx in [#9112](jdx/mise#9112) ### New Contributors - @mariusvniekerk made their first contribution in [#9097](jdx/mise#9097) - @mcncl made their first contribution in [#9096](jdx/mise#9096) - @Oyami-Srk made their first contribution in [#9099](jdx/mise#9099) ## [2026.4.12](https://github.com/jdx/mise/compare/v2026.4.11..v2026.4.12) - 2026-04-15 ### 🚀 Features - **(npm)** use --min-release-age for npm 11.10.0+ supply chain protection by @webkaz in [#9072](jdx/mise#9072) - **(registry)** add openfga by @mnm364 in [#9084](jdx/mise#9084) - **(task)** allow to set confirmation default by @roele in [#9089](jdx/mise#9089) - support os/arch compound syntax in tool os filtering by @RobertDeRose in [#9088](jdx/mise#9088) ### 🐛 Bug Fixes - **(activate)** export __MISE_EXE and resolve bare ARGV0 to absolute path by @fru1tworld in [#9081](jdx/mise#9081) - **(install)** support aliased installs sharing a backend by @jdx in [#9093](jdx/mise#9093) - **(shim)** use which_no_shims when resolving mise binary in reshim and doctor by @kevinswiber in [#9071](jdx/mise#9071) - filter empty segments in colon-separated env var parsing by @baby-joel in [#9076](jdx/mise#9076) ### 📚 Documentation - fix wrong file reference to forgejo backend implemenation by @roele in [#9090](jdx/mise#9090) - fix cli token command for token resolution by @roele in [#9077](jdx/mise#9077)

fix: correct install vfox plugin

67e0d90

greptile-apps Bot reviewed Apr 15, 2026

View reviewed changes

gemini-code-assist Bot reviewed Apr 15, 2026

View reviewed changes

jdx merged commit db75c91 into jdx:main Apr 15, 2026
35 checks passed

mise-en-dev mentioned this pull request Apr 15, 2026

chore: release 2026.4.13 #9114

Merged

mise-en-dev mentioned this pull request Apr 15, 2026

chore: release 2026.4.14 #9115

Merged

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

fix(vfox-plugin): support Git URL with commit hash for mise.toml#9099

fix(vfox-plugin): support Git URL with commit hash for mise.toml#9099
jdx merged 1 commit intojdx:mainfrom
Oyami-Srk:fix/vfox-backend-url

Oyami-Srk commented Apr 15, 2026

Uh oh!

greptile-apps Bot commented Apr 15, 2026

Uh oh!

greptile-apps Bot Apr 15, 2026

Uh oh!

gemini-code-assist Bot left a comment

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Uh oh!

Conversation

Oyami-Srk commented Apr 15, 2026

Uh oh!

greptile-apps Bot commented Apr 15, 2026

Greptile Summary

Confidence Score: 5/5

Important Files Changed

Sequence Diagram

Uh oh!

greptile-apps Bot Apr 15, 2026

Choose a reason for hiding this comment

Uh oh!

gemini-code-assist Bot left a comment

Choose a reason for hiding this comment

Code Review

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants