npm backend: install from a tarball URL (pkg.pr.new previews)

[kjanat]

pkg.pr.new publishes preview npm packages for every push to a PR and posts install commands as tarball URLs (example comment):

npm i https://pkg.pr.new/kjanat/actionlint/@kjanat/actionlint@343

I'd like to install such a URL with the npm backend. Every form I tried fails on mise 2026.11.3:

$ mise ls-remote 'npm:https://pkg.pr.new/kjanat/actionlint/@kjanat/actionlint@343'
Error: invalid package name: "https://pkg.pr.new/kjanat/actionlint/"

$ mise install 'npm:actionlint@https://pkg.pr.new/kjanat/actionlint/@kjanat/actionlint@343'
error: invalid value '...' for '[TOOL@VERSION]...': invalid prefix: https

# mise ERROR invalid tool version request: https://pkg.pr.new/...
"npm:actionlint" = "https://pkg.pr.new/kjanat/actionlint/@kjanat/actionlint@343"

Proposal

Accept an https:// tarball URL as an npm source, the way #14044 added git sources:

[tools]
"npm:https://pkg.pr.new/kjanat/actionlint/@kjanat/actionlint@343" = { version = "latest", allow_exotic_deps = true }

• The URL becomes the root dependency, aliased to the name in the tarball's package.json.
• The URL has no version list. latest means the tarball the URL serves now; @343 serves the newest push to PR 343.
• The tarball's optionalDependencies are pkg.pr.new URLs pinned to the commit ("@kjanat-actionlint/actionlint-linux-x64": "https://pkg.pr.new/.../actionlint-linux-x64@7fb70dc5..."), so they still go through allow_exotic_deps.
• mise.lock can record the tarball's integrity as it does for git and registry sources.

#14896 rejects URLs in the version field to keep untrusted values out of package specs. A URL in the tool name is declared the same way a git source is.

Workaround

The http backend installs the per-platform binary package directly:

[tools."http:actionlint"]
version          = "343"
url              = 'https://pkg.pr.new/kjanat/actionlint/@kjanat-actionlint/actionlint-{{ os(macos="darwin", windows="win32") }}-{{ arch() }}@{{ version }}'
format           = "tar.gz"
strip_components = 1
bin_path         = "bin"

This only works for packages that ship one binary per platform, and the URL template has to repeat the package's platform naming.

[jdx]

Good idea, and it fits the git-source model. I opened #15461.

An https:// tarball URL is now accepted as an npm tool name:

[tools."npm:https://pkg.pr.new/kjanat/actionlint/@kjanat/actionlint@343"]
version = "latest"
allow_exotic_deps = true

Since the URL has no version list, latest resolves to a prefix of the tarball's SHA-256. mise.lock pins that, and mise up picks up a new push to the PR. A pinned version fails to install if the URL now serves different content. http:// and checksum are refused.

One difference from your proposal: the package is installed under the last path segment of the URL (actionlint) rather than the name in the tarball's package.json, which would need a download before the name is known. That shouldn't change the commands it installs. I haven't tested it against a real pkg.pr.new package yet, so if you try the PR build, I'd like to hear how it goes.

AI-assisted — Tool: Claude Code; model: anthropic/claude-sonnet-5-5; version: 2.1.317.

[jdx]

Update after review and testing against the real kjanat/actionlint@343 preview in #15461. Three things in my earlier reply were wrong or changed:

• Installing now downloads the tarball once, checks it against the version, and installs that file, so the package keeps the name in its own package.json (not a URL-derived alias). The platform packages install and actionlint -version runs.
• mise lock does not work with a tarball URL yet. aube resolves a URL root without reading the tarball's optionalDependencies, so the locked graph lacked the platform packages. mise lock now refuses it with a message instead of writing a broken graph.
• The CLI split …/actionlint@343 at the @; that is fixed, so the command from your post works as written.

AI-assisted — Tool: Claude Code; model: anthropic/claude-sonnet-5-5; version: 2.1.317.

[jdx]

One more correction to my last comment: mise lock no longer refuses a tarball URL. With lockfile = true, #15461 now records the tarball's digest as the locked version and no aube dependency graph (the graph would lack the platform packages), and install --locked works with the real actionlint preview. Tasks can declare one too: tools = { "npm:https://…" = "latest" }.

AI-assisted — Tool: Claude Code; model: anthropic/claude-sonnet-5-5; version: 2.1.317.