Skip to content

fix(backend): reject bare package backend names#9608

Merged
jdx merged 2 commits intojdx:mainfrom
risu729:fix/bare-backend-names-error
May 5, 2026
Merged

fix(backend): reject bare package backend names#9608
jdx merged 2 commits intojdx:mainfrom
risu729:fix/bare-backend-names-error

Conversation

@risu729
Copy link
Copy Markdown
Contributor

@risu729 risu729 commented May 5, 2026

Summary

  • stop resolving bare package-backend names like cargo and gem as implicit cargo:cargo / gem:gem tools
  • keep explicit package backend syntax such as cargo:ripgrep and gem:bashly working
  • preserve real registry shorthands such as npm

Fixes #5517

Tests

  • cargo test backend_arg
  • mise run test:e2e e2e/backend/test_bare_backend_names
  • mise run lint

Copy link
Copy Markdown
Contributor

@gemini-code-assist gemini-code-assist Bot left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Code Review

This pull request prevents bare backend names, such as 'cargo' or 'gem', from being incorrectly identified as implicit tools. The logic in BackendArg and install_state.rs was updated to use split_once(':'), ensuring that a backend type is only recognized when a colon separator is present. New E2E and unit tests were added to verify these changes. I have no feedback to provide.

@greptile-apps
Copy link
Copy Markdown
Contributor

greptile-apps Bot commented May 5, 2026

Greptile Summary

This PR fixes a long-standing implicit-resolution bug where bare backend names like cargo and gem were silently treated as cargo:cargo / gem:gem. The fix is applied in two places — backend_arg.rs and install_state.rs — by replacing an unconditional prefix extraction with split_once(':'), so only colon-qualified names trigger package-backend resolution.

  • backend_arg.rs: backend_type() now skips the parse branch entirely when the resolved full string contains no colon, falling through to BackendType::Unknown for bare names. Real registry shorthands like npm are unaffected because the registry expands them to npm:npm.
  • install_state.rs: Identical narrowing applied to the install-state backend_type() lookup, preventing a previously-stored bare full value from being guessed as a package backend.
  • Tests: A new e2e test asserts the expected error for cargo and gem, and a new unit test covers both bare names (→ Unknown) and colon-qualified names (→ correct type), including the npm registry shorthand.

Confidence Score: 5/5

The change is safe to merge — it narrows an over-eager implicit resolution and is well-guarded by both unit and e2e tests.

The logic change is minimal and symmetric across both call sites, directly mirroring the existing BackendType::guess contract. Existing installed tools whose stored full value already contains a colon are unaffected; only bare names that should never have matched now correctly fall through to BackendType::Unknown.

No files require special attention — the changed surface is small and the new tests cover the critical paths.

Reviews (2): Last reviewed commit: "Merge branch 'main' into fix/bare-backen..." | Re-trigger Greptile

@risu729
Copy link
Copy Markdown
Contributor Author

risu729 commented May 5, 2026

CI has finished. The remaining failures look unrelated to this PR's bare backend-name parsing change:

  • e2e-1 failed in shell/test_xonsh while installing uv@0.11.9 / aqua:astral-sh/uv@latest; GitHub artifact attestation verification reported the expected astral-sh/uv/.github/workflows/release.yml workflow certificate/provenance was missing.
  • e2e-4 failed in cli/test_activate_multiple_xonsh and sync/test_sync_python_uv with the same aqua:astral-sh/uv@latest artifact attestation verification error. The new backend/test_bare_backend_names e2e test passed in this tranche.
  • e2e-5 failed in cli/test_deactivate_xonsh with the same uv attestation error. It also failed cli/test_tool_depends because the first mise install unexpectedly succeeded; that test intentionally depends on parallel install ordering without a dependency edge, so it can pass if dummy happens to finish before needs-dummy. This is unrelated to the backend-name parsing change.
  • test-ci failed as the aggregate result of the e2e failures above.

Greptile completed successfully and did not leave any review threads or requested changes.

This comment was generated by an AI coding assistant.

@risu729 risu729 marked this pull request as ready for review May 5, 2026 10:20
@jdx jdx merged commit d873ba0 into jdx:main May 5, 2026
34 checks passed
@risu729 risu729 deleted the fix/bare-backend-names-error branch May 5, 2026 20:24
mise-en-dev added a commit that referenced this pull request May 7, 2026
### 🚀 Features

- **(aqua)** support registry libc variants by @jdx in
[#9652](#9652)
- **(bin-paths)** add executable names output by @risu729 in
[#9617](#9617)

### 🐛 Bug Fixes

- **(aqua)** preserve configured file extensions by @risu729 in
[#9611](#9611)
- **(aqua)** support registry file links by @risu729 in
[#9610](#9610)
- **(backend)** reject bare package backend names by @risu729 in
[#9608](#9608)
- **(backend)** apply inline tool option overrides by @risu729 in
[#9306](#9306)
- **(backend)** skip versions host for local tool opts by @risu729 in
[#9568](#9568)
- **(github)** chmod explicit archive bin by @risu729 in
[#9609](#9609)
- **(install)** skip remote-versions refresh in prefer-offline mode by
@jdx in [#9627](#9627)
- **(lock)** scope targets to active project root by @risu729 in
[#9319](#9319)
- **(lockfile)** respect existing platforms during auto-lock by @jdx in
[#9621](#9621)
- **(pipx)** filter yanked pypi releases by @risu729 in
[#9607](#9607)
- **(pipx)** declare python as a backend dependency by @jdx in
[#9678](#9678)
- **(schema)** update refs to $defs in mise-registry-tool.json by
@risu729 in [#9671](#9671)
- **(task)** terminate parallel siblings on failure via process groups
by @jdx in [#9655](#9655)
- **(task)** stable MISE_PROJECT_ROOT for monorepo tasks, add
MISE_MONOREPO_ROOT by @jdx in
[#9657](#9657)
- **(trust)** run enter hooks after trusting config by @risu729 in
[#9634](#9634)
- **(ui)** stop clearing screen for prompts by @jdx in
[#9619](#9619)
- use /bin/cp on macos by @pdehlke in
[#9656](#9656)

### 🚜 Refactor

- **(aqua)** store aqua var defaults as strings by @risu729 in
[#9645](#9645)
- **(config)** support structured TOML values in registry backend
options by @risu729 in [#9584](#9584)
- **(deps)** remove serde_derive dependency by @risu729 in
[#9670](#9670)
- **(deps)** remove anyhow dependency by @risu729 in
[#9661](#9661)
- **(deps)** use std::sync::LazyLock instead of once_cell::Lazy by
@risu729 in [#9668](#9668)
- **(schema)** generate task schema from mise schema by @risu729 in
[#9581](#9581)
- **(schema)** reuse task props with unevaluatedProperties by @risu729
in [#9582](#9582)
- **(schema)** reuse registry common types by @risu729 in
[#9648](#9648)
- **(schema)** reuse plugin script config by @risu729 in
[#9647](#9647)
- **(schema)** use $defs in schema files by @risu729 in
[#9646](#9646)

### 📚 Documentation

- **(node)** add tips for enabling node idiomatic by @fu050409 in
[#9675](#9675)

### 🧪 Testing

- **(cli)** remove nondeterministic tool depends assertion by @risu729
in [#9633](#9633)
- **(e2e)** pin uv to 0.11.8 around astral-sh/uv#19278 by @jdx in
[#9618](#9618)
- **(e2e)** wait for docker env cleanup by @risu729 in
[#9631](#9631)
- **(zig)** use official zig instead of mach mirror by @jdx in
[#9659](#9659)

### 📦️ Dependency Updates

- fall through to hash check when providers have no outputs by @jdx in
[#9622](#9622)
- bump Cargo.lock by @jdx in
[#9625](#9625)

### 📦 Registry

- remove registry depends by @risu729 in
[#9571](#9571)
- add code-review-graph (pipx:code-review-graph) by @chautruonglong in
[#9673](#9673)

### Chore

- **(ci)** split large registry test-tool changes by @risu729 in
[#9628](#9628)
- **(ci)** make perf script robust to runner noise by @jdx in
[#9635](#9635)
- **(ci)** skip hyperfine comments without permission by @risu729 in
[#9629](#9629)

### New Contributors

- @chautruonglong made their first contribution in
[#9673](#9673)
- @pdehlke made their first contribution in
[#9656](#9656)

## 📦 Aqua Registry Updates

### New Packages (5)

-
[`anthropics/anthropic-cli`](https://github.com/anthropics/anthropic-cli)
- [`crates.io/wasmi_cli`](https://github.com/wasmi-labs/wasmi)
- [`openclaw/gogcli`](https://github.com/openclaw/gogcli)
- `racket-lang.org/racket-minimal`
- [`runs-on/cli`](https://github.com/runs-on/cli)

### Updated Packages (13)

- [`UpCloudLtd/upcloud-cli`](https://github.com/UpCloudLtd/upcloud-cli)
- [`aristocratos/btop`](https://github.com/aristocratos/btop)
- [`dprint/dprint`](https://github.com/dprint/dprint)
- [`j178/prek`](https://github.com/j178/prek)
- [`jdx/hk`](https://github.com/jdx/hk)
- [`jdx/mise`](https://github.com/jdx/mise)
- [`jdx/usage`](https://github.com/jdx/usage)
- [`jreleaser/jreleaser`](https://github.com/jreleaser/jreleaser)
-
[`jreleaser/jreleaser/standalone`](https://github.com/jreleaser/jreleaser)
- [`pnpm/pnpm`](https://github.com/pnpm/pnpm)
- [`suzuki-shunsuke/cmdx`](https://github.com/suzuki-shunsuke/cmdx)
- [`suzuki-shunsuke/ghir`](https://github.com/suzuki-shunsuke/ghir)
- [`twpayne/chezmoi`](https://github.com/twpayne/chezmoi)
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants