v2026.5.18

A focused release that teaches hooks to accept script arrays, ships an `npm install -g mise` package, and tightens lock identity across several backends so `mise.lock` entries can no longer be reused for option combinations that resolve to a different artifact set.

## Added
- **(config)** Hooks now accept `script`/`scripts` arrays for current-shell hooks ([#9836](https://github.com/jdx/mise/pull/9836) by @risu729):

  ```toml
  [hooks.enter]
  shell = "bash"
  script = [
    "source completions.sh",
    "export PROJECT_READY=1",
  ]
  ```

  Note that `run` is still string-only — to spawn multiple inline commands, use a list of `{ run = "..." }` entries or one multiline `run` string.

## Fixed
- **(env)** PATH entries under mise's installs directory are now treated as mise-managed during `hook-env` reactivation, so an inactive install path like `installs/node/24/bin` inherited from a parent shell can no longer sit ahead of the active project's `installs/node/22.17.1/bin` ([#10162](https://github.com/jdx/mise/pull/10162) by @risu729).
- **(config)** `.miserc.toml` discovery now stops at raw `MISE_CEILING_PATHS` entries (without recursing through the lazy fallback), preventing a parent `.miserc.toml` above the ceiling from injecting `MISE_ENV` ([#10165](https://github.com/jdx/mise/pull/10165) by @risu729).
- **(task)** `mise tasks ls --json`, `tasks info --json`, and the MCP tasks resource now serialize full `run` entries — including single task refs and task groups — instead of script-only strings ([#10163](https://github.com/jdx/mise/pull/10163) by @risu729).
- **(task)** Bump `usage-lib` to 3.4.0 and update the zsh completion to read `display<TAB>insert` pairs from `usage complete-word`, restoring task completions after the `usage-cli` 3.4.0 output change ([#10181](https://github.com/jdx/mise/pull/10181) by @jdx).
- **(installer)** Add the missing `warn` helper used by the standalone installer's checksum fallback paths ([#10157](https://github.com/jdx/mise/pull/10157) by @risu729, recreating @olfway's original fix).

### Lock identity

A batch of fixes ensures `mise lock` selects entries by an identity that actually reflects the installed result, so toggling an option no longer silently reuses a stale lock entry:

- **(conda)** Include the conda channel — the same `tool@version` resolved against `conda-forge`, `bioconda`, or a private channel can produce entirely different builds and checksums ([#9984](https://github.com/jdx/mise/pull/9984) by @risu729).
- **(rust)** Include rustup `profile`, `components`, and `targets`, read from both tool options and `rust-toolchain.toml`, with stable sorting ([#9988](https://github.com/jdx/mise/pull/9988) by @risu729).
- **(github)** Include target artifact selectors (`api_url`, `version_prefix`, per-platform `asset_pattern`, direct `url`, `no_app`) for GitHub, GitLab, and Forgejo backends, resolved per target platform ([#9985](https://github.com/jdx/mise/pull/9985) by @risu729).
- **(python)** Include non-default `patch_sysconfig = false` (the interpreter tree differs after install); `virtualenv` stays out as an activation-only overlay ([#10161](https://github.com/jdx/mise/pull/10161) by @risu729).

## Changed
- **(npm)** mise is now published to npm under the unscoped `mise` package, so `npm install -g mise` and `npx mise` work directly. The legacy `@jdxcode/mise` scoped package continues to be published, and the new wrapper reuses the existing `@jdxcode/mise-<os>-<arch>` platform tarballs ([#10183](https://github.com/jdx/mise/pull/10183) by @jdx).

**Full Changelog**: https://github.com/jdx/mise/compare/v2026.5.17...v2026.5.18

## 💚 Sponsor mise

mise is built by [@jdx](https://github.com/jdx) under [**en.dev**](https://en.dev) — an independent studio making developer tooling (mise, [aube](https://aube.en.dev/), and more). Development is funded by sponsors.

If mise saves you or your team time, please consider sponsoring at [en.dev](https://en.dev). Individual and company sponsorships keep mise fast, free, and independent.