From 4b9a64d01dcb1c10fab590960adbf27b76b935dd Mon Sep 17 00:00:00 2001 From: Nate Vick Date: Wed, 12 Aug 2026 12:09:14 -0700 Subject: [PATCH 1/2] fix: pin npm:@endevco/aube to 1.33.1 to stop mise recursion OOM Resolving "latest" for an npm-backend tool makes mise shell out to `npm view @endevco/aube dist-tags --json`. In that child, `npm` resolves to the mise shim, which re-enters tool resolution and issues the same call again. On 2026-08-12 that recursed 2,829 levels deep, ~5,100 processes and 127,799 threads, exhausting 60Gi of RAM and all swap. It OOM'd the box twice; the second time it went down hard. Evidence: a snapshot taken mid-storm shows 2,828 of 2,829 `npm view` processes have another `npm view` as their parent, rooted at a `mise install ruby@2.6.10`. All 2,839 matching processes were the `dist-tags` (latest-version) call; not one was the `versions` call. An exact pin needs no registry lookup, so the seed cannot be issued. Verified failed-then-passed: `mise outdated` on a cold cache emitted the dist-tags call before this change and zero after, with the run still healthy (no error short-circuit). aube still resolves and runs 1.33.1. Residual, stated rather than hidden: `mise outdated`/`ls-remote` still make a `versions` call, since querying the registry is what those commands are for. No observed recursion used that path, and it cannot be triggered by `mise install`, which is what rooted this. The underlying mise bug is unfixed upstream here -- mise is 2026.2.17, six months stale. Co-Authored-By: Claude Opus 5 (1M context) Claude-Session: https://claude.ai/code/session_01ARNZyPcAj3K2LhupCDn5gQ --- home/dot_config/mise/conf.d/cli-tools.toml.tmpl | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/home/dot_config/mise/conf.d/cli-tools.toml.tmpl b/home/dot_config/mise/conf.d/cli-tools.toml.tmpl index afac29f..6543549 100644 --- a/home/dot_config/mise/conf.d/cli-tools.toml.tmpl +++ b/home/dot_config/mise/conf.d/cli-tools.toml.tmpl @@ -21,7 +21,10 @@ helix = "latest" bottom = "latest" # `btm` — lighter, narrow-friendly; used by the cmux dock Host panel zig = "0.15.2" # cmux builds GhosttyKit.xcframework; ghostty pins minimum_zig_version {{- if eq .chezmoi.os "linux" }} -"npm:@endevco/aube" = "latest" # aube — our Node package manager (jdx, same author as mise); verified v1.33.1 +# PINNED, do not restore "latest": resolving it runs `npm view`, and in that +# child `npm` hits the mise shim and re-enters resolution — 2,829-deep recursion +# OOM'd the box twice on 2026-08-12. An exact version needs no registry call. +"npm:@endevco/aube" = "1.33.1" # aube — our Node package manager (jdx, same author as mise) "github:aristocratos/btop" = "latest" # btop via github backend (aqua asset-match is broken, ubi deprecated); Linux release binaries only {{- end }} {{- end }} From 04caf0c774badfd70ed11b0ebbfeaab4bd733cc7 Mon Sep 17 00:00:00 2001 From: Nate Vick Date: Wed, 12 Aug 2026 12:13:19 -0700 Subject: [PATCH 2/2] docs: note mise >= 2026.8.2 fixes the recursion class upstream The pin alone reads as the fix; it isn't. jdx/mise#8475 ("strip mise shims from dependency_env PATH to prevent fork bomb") fixes the class, and this box was on 2026.2.17, six months before it. mise has since been self-updated to 2026.8.5 here, above the MISE_MIN this repo declares. The pin stays as belt-and-braces: an exact version needs no registry lookup, so the seed cannot be issued even if a future mise regresses. Co-Authored-By: Claude Opus 5 (1M context) Claude-Session: https://claude.ai/code/session_01ARNZyPcAj3K2LhupCDn5gQ --- home/dot_config/mise/conf.d/cli-tools.toml.tmpl | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/home/dot_config/mise/conf.d/cli-tools.toml.tmpl b/home/dot_config/mise/conf.d/cli-tools.toml.tmpl index 6543549..468e104 100644 --- a/home/dot_config/mise/conf.d/cli-tools.toml.tmpl +++ b/home/dot_config/mise/conf.d/cli-tools.toml.tmpl @@ -21,9 +21,9 @@ helix = "latest" bottom = "latest" # `btm` — lighter, narrow-friendly; used by the cmux dock Host panel zig = "0.15.2" # cmux builds GhosttyKit.xcframework; ghostty pins minimum_zig_version {{- if eq .chezmoi.os "linux" }} -# PINNED, do not restore "latest": resolving it runs `npm view`, and in that -# child `npm` hits the mise shim and re-enters resolution — 2,829-deep recursion -# OOM'd the box twice on 2026-08-12. An exact version needs no registry call. +# Pinned as belt-and-braces: "latest" made mise 2026.2.17 shell out to `npm view`, +# whose child re-entered the shim — 2,829-deep recursion, two OOMs on 2026-08-12. +# mise >= 2026.8.2 fixes the class (jdx/mise#8475); an exact version needs no lookup. "npm:@endevco/aube" = "1.33.1" # aube — our Node package manager (jdx, same author as mise) "github:aristocratos/btop" = "latest" # btop via github backend (aqua asset-match is broken, ubi deprecated); Linux release binaries only {{- end }}