npm backend: aube failure surfaces as user aborted when no prompt was ever shown

[lunetics]

Summary

mise install npm:@n8n/cli@0.18.0 fails after ~1.5 s with:

mise ✗ npm:@n8n/cli@0.18.0  1.5s · failed: aube install failed: user aborted `mise add @n8n/cli`
mise ERROR Failed to install npm:@n8n/cli@0.18.0: aube install failed: user aborted `mise add @n8n/cli`

No prompt is ever displayed. This happens in an interactive TTY just as it does with stdin closed, so nothing was aborted by a user. The message also names a mise add command that is not a subcommand.

The misleading wording is the actual reason I am filing this: it sent our diagnosis in the wrong direction across three separate sessions. We documented "needs an interactive confirmation" as the cause and recommended running it by hand in a real terminal — which then failed the same way in 1.5 s without asking anything.

Reproduction

mise install -- 'npm:@n8n/cli@0.18.0'          # fails
mise install --yes -- 'npm:@n8n/cli@0.19.0'    # fails identically

Reproduced on mise 2026.9.5, and previously on 2026.9.3 and 2026.8.6 with the same message.

Control: aube itself works

mise install -- 'npm:cowsay@1.6.0'             # succeeds, rc=0

Four other npm: tools were upgraded through the default aube path on the same day without any issue: @google/gemini-cli, @moonshot-ai/kimi-code, @fission-ai/openspec, backlog.md. So this is specific to @n8n/cli, not a general aube failure.

Ruled out

• Interactive confirmation — fails in a real TTY in 1.5 s with no prompt shown, and identically with </dev/null. --yes / MISE_YES=1 make no difference.
• Release-age on transitive dependencies — plausible given that the npm backend docs state it forwards minimum_release_age to transitive resolution, but MISE_MINIMUM_RELEASE_AGE=0 changes nothing (still fails, 615 ms). Moot anyway: the only dependency is @oclif/core: ^4.5.2, whose newest version was 11 days old at the time of testing.
• Package-side install hooks — npm registry metadata for @n8n/cli@0.18.0 shows bin: {"n8n-cli": "bin/n8n-cli.mjs"}, no preinstall/postinstall, a single runtime dependency, and no os/cpu constraints.

Workaround

Shelling out to npm works:

MISE_NPM_SHELL_OUT=1 mise install -- 'npm:@n8n/cli@0.18.0'
# → added 39 packages in 2s, installed in 1.7s
MISE_NPM_SHELL_OUT=1 mise upgrade --bump -- 'npm:@n8n/cli'

Note the resulting layouts differ: the aube install produces aube-lock.yaml + node_modules/ with an aube-bin-shim v2, the npm install produces bin/ + lib/.

Verbose output

INFO  npm:@n8n/cli@0.18.0                 [1/3] install
INFO  npm:@n8n/cli@0.18.0                 [1/3] checking package
DEBUG Loaded 124 CA root certificates from the system
Error:
   0: Failed to install npm:@n8n/cli@0.18.0: aube install failed: user aborted `mise add @n8n/cli`
Location:
   src/toolset/toolset_install.rs:493

It fails during "checking package", before any download progress appears.

Request

Surface aube's real failure reason rather than attributing it to the user. A cancellation nobody triggered is worse than a plain error, because it looks like a settled explanation and stops the investigation.

I noticed #12273 made exactly this distinction for mise's own confirmation prompts (Confirmation { Yes, No, Unavailable }). This path appears not to be covered by it — happy to test a patch or provide more diagnostics.

mise doctor

Trimmed: the installed toolset list (70+ entries) is omitted for privacy. Happy to provide any specific part on request.

version: 2026.9.5 linux-x64 (2026-09-10)
activated: yes
shims_on_path: yes
self_update_available: yes

build_info:
  Target: x86_64-unknown-linux-gnu
  Features: openssl, rustls-native-roots, self_update
  Built: Thu, 10 Sep 2026 23:12:28 +0000
  Rust Version: rustc 1.94.0 (4a4ef493e 2026-03-02)
  Profile: release

shell:
  /usr/bin/zsh
  zsh 5.9 (x86_64-ubuntu-linux-gnu)

dirs:
  cache: ~/.cache/mise
  config: ~/.config/mise
  data: ~/.local/share/mise
  shims: ~/.local/share/mise/shims
  state: ~/.local/state/mise

config_files:
  ~/.config/mise/config.toml

env_files: (none)
ignored_config_files: (none)

relevant tool entry:
  "npm:@n8n/cli" = "0.17.0"   (at the time of the failure)

No problems reported by mise doctor.

[jdx]

Thanks for the detailed report — I confirmed both symptoms.

The hidden failure was an aube reputation check. At the time of reproduction, @n8n/cli had 569 weekly downloads against the default threshold of 1000. Mise used the old boolean embedding callback, so EOF or an unavailable prompt became false; aube then treated that as an explicit refusal and produced the misleading user aborted mise add message. Separately, mise install --yes was not propagated into the embedded aube prompt handler.

The long-term fix is split across aube #1530 and mise #13123:

• aube now exposes Accept, Decline, and Unavailable decisions and preserves structured safety-gate diagnostics;
• mise maps real prompt outcomes without inventing a refusal, translates the diagnostic to native mise configuration, and honors mise install --yes as a transient approval.

With the PR build, a non-interactive install reports the measured low-download reason and its remedy. An explicit No reports a decline, while this now installs without prompting:

mise install --yes npm:@n8n/cli@0.18.0

For a persistent, exact-package approval, use:

[tools]
"npm:@n8n/cli" = { version = "0.18.0", allow_low_downloads = true }

Despite the historical setting name, this approves aube reputation gates for that exact package (download count, package age, and similar-name checks). It does not bypass malicious-package advisories. Your MISE_NPM_BACKEND_MODE=shell_out workaround remains valid in released mise until these changes land.

If you are able to test the build from mise #13123, reports from the terminal setup where no prompt appeared would be especially useful.

AI-assisted — Tool: Codex; model: unavailable/unavailable; version: unavailable.