fix(server): keep mise-owned npm packages manual-only

[juliusmarminge]

Problem

The Linux mise variant reported in #8051 still selects the wrong updater after #9325. Mise's npm backend places a package inside mise/installs/<tool>/<version>/lib/node_modules/, which T3 mistakes for an npm-owned global prefix. The offered command installs a newer package into that existing mise version directory.

Change

Leave these mise-owned packages manual-only instead of offering npm. Ordinary npm globals, including globals under mise's node installation, retain their existing updater. Standalone Codex still uses its own updater and shared home.

This is a separate wrong-owner guard, not automatic mise support. Kristoffer's existing proposal #9225 identified the mise layouts and remains untouched. This change adds no mise invocation, wrapper parsing, cwd/configuration change, or installer execution.

Before and after

Tested through the actual disabled CodexDriver resolver with disposable Linux files and executable symlinks. The process spawner and HTTP client fail if invoked.

On main 2fb99a7a, the initial six-fixture probe produced one failure and five passes. The final eight-fixture regression suite produced two failures and six passes: both the explicit npm backend and an npm-backed tool alias incorrectly offered npm install -g --prefix <mise-tool-version> ....

After the fix, all 32 focused driver and maintenance tests pass on latest main df8e0eb4, committed September 5, 2026 at 04:52:21 UTC. Both mise npm fixtures now return update: null. Standalone/shared-home, ordinary npm, mise-managed Node globals, direct mise, wrapper, and missing-executable controls pass.

cd apps/server
vp test run src/provider/Drivers/CodexDriver.test.ts src/provider/providerMaintenance.test.ts --maxWorkers 2

Server typecheck, targeted lint, formatting, and diff checks pass on the final base. Typecheck emits existing suggestions in unrelated files but exits successfully. This is resolver behavior, so screenshots would not demonstrate the fix. No installer or provider command was run.

Limits

This recognizes conventional paths containing mise/installs. Custom MISE_DATA_DIR roots with a different basename are not inferred. Native Windows, its separate shim/optional-package failures, and native macOS have not been tested. Native wrapper precedence is unchanged. This PR does not close the whole report or choose an automatic mise-update policy.

GPT 6 Astra via Codex in T3 Code.

---

Note

Medium Risk
Changes executable ownership detection for one-click provider updates; a mistake could suppress valid npm updates or still target the wrong install path, though the guard is narrowly scoped to conventional mise/installs paths.

Overview
Stops treating mise npm-backend installs as npm-owned globals so provider maintenance no longer offers npm install -g --prefix <mise-tool-version> for Codex (and similar) living under mise/installs/<tool>/<version>/lib/node_modules/.

npmGlobalPrefixFromCommandPath now returns no prefix when the path sits under mise/installs for any tool except node, so globals under mise-managed Node still get the existing npm updater while ordinary npm prefixes are unchanged.

CodexDriver maintenance tests add disposable Linux fixtures (symlinked binaries, direct mise paths, wrapper scripts) asserting mise npm-backend and alias layouts stay manual-only (update: null) and that true npm-owned layouts still resolve the expected npm install command.

^{Reviewed by Cursor Bugbot for commit f3c6218. Bugbot is set up for automated code reviews on this repo. Configure here.}

Note

Fix npmGlobalPrefixFromCommandPath to skip mise-owned non-Node npm packages

Previously, global-looking package paths under mise-managed non-Node tools (e.g. mise npm-backend, mise aliases) were incorrectly treated as npm-global, leading to unwanted npm update commands. The function now returns null when the prefix preceding lib/node_modules ends in a mise installation for a tool other than node, leaving those packages manual-only. Mise-managed Node installations and ordinary npm globals continue to resolve their npm prefix as before. Adds Unix-only tests in CodexDriver.test.ts covering mise npm-backend, mise tool-alias, mise Node, ordinary npm-global, direct mise, and wrapper mise layouts.

^{Macroscope summarized f3c6218.}

[github-actions]

Thread transfer impact

✅ Thread transfer remains within every enforced ceiling.

Provider	Metric	Main baseline	This PR	Impact	PR ceiling
Codex	Total thread wire	13.5 KiB	13.6 KiB	+57 B (+0.4%)	15.1 KiB	✅
Codex	Thread snapshot wire	7.0 KiB	7.0 KiB	+4 B (+0.1%)	7.3 KiB	✅
Codex	Live turn WebSocket wire	6.5 KiB	6.6 KiB	+53 B (+0.8%)	7.8 KiB	✅
Codex	Live turn WebSocket decoded	57.0 KiB	57.0 KiB	+44 B (+0.1%)	66.4 KiB	✅
Codex	Live turn messages	8	9	+1 (+12.5%)	21	✅
Claude	Total thread wire	13.6 KiB	13.5 KiB	−7 B (−0.1%)	15.1 KiB	✅
Claude	Thread snapshot wire	7.0 KiB	7.0 KiB	+7 B (+0.1%)	7.3 KiB	✅
Claude	Live turn WebSocket wire	6.5 KiB	6.5 KiB	−14 B (−0.2%)	7.8 KiB	✅
Claude	Live turn WebSocket decoded	57.8 KiB	57.8 KiB	−44 B (−0.1%)	66.4 KiB	✅
Claude	Live turn messages	9	8	−1 (−11.1%)	21	✅

Baseline: df8e0eb · PR result: f3c6218 · Source CI: success

Scenario and decoded snapshot size

10 historical turns, 5 command tools per turn, 878.9 KiB retained MCP result per historical turn, and a 1.05 MiB retained result in the measured turn.

• Codex decoded thread snapshot: 113.8 KiB
• Claude decoded thread snapshot: 114.5 KiB

Updated in place by a trusted workflow. PR artifacts are strictly validated and never executed.

[macroscopeapp]

Approvability

Verdict: Approved at f3c6218

Macroscope's review found this PR approvable — This is a narrowly scoped server bug fix that prevents mise-owned non-Node packages from being offered an incorrect npm updater while preserving ordinary and mise-Node npm updates. Regression tests cover the changed and preserved behaviors, with no product-default or static-analysis configuration changes.

^{You can add or adjust custom eligibility rules. Learn more.}