v2026.7.16

This release expands the experimental task output cache with per-run controls, a configurable cache directory, and command-derived cache inputs, and lays the groundwork for monorepo-aware task workspaces starting with Node discovery. It also teaches `mise mcp` to expose each command's read/write/destructive effect to agents, consolidates dotfiles management under `mise bootstrap`, and lands a broad batch of fixes across brew, npm, tasks, config rewriting, and OCI pushes.

## Highlights
- The experimental task output cache gains per-run controls (`--task-cache` / `MISE_TASK_CACHE`), a configurable `task.cache_dir`, and `cache.command_inputs` so cache keys can fold in runtime state like compiler versions.
- New experimental workspace project graph model with Node monorepo discovery (npm, pnpm, Yarn, Bun) via Aube, the foundation for monorepo-aware affected-project and task inference.
- `mise mcp` can now tell agents what a command does: the new `list_commands` tool returns each command's read/write/destructive effect so agents can reason about safety before running anything.

## Added
- **task:** per-run cache controls via `--task-cache <mode>` and `MISE_TASK_CACHE`, supporting `read-write` (default), `read-only`, `write-only`, `off`, and `local-only`. Read-only lets untrusted CI jobs consume existing results without publishing misses, write-only warms the cache without consuming entries, and `off` gives a clean diagnostic path while preserving normal `sources` freshness. Honored by `mise run` and bootstrap/naked task entry points. ([#11396](https://github.com/jdx/mise/pull/11396) by @jdx)
- **task:** experimental `task.cache_dir` setting and `MISE_TASK_CACHE_DIR` to place task output artifacts on dedicated volumes or project-specific locations without relocating mise's entire cache. `mise cache clear` and `mise cache prune` cover the custom location. ([#11399](https://github.com/jdx/mise/pull/11399) by @jdx)
- **task:** experimental `cache.command_inputs` so cacheable tasks invalidate on command-derived state (like `node --version` or a generated config fingerprint) that isn't captured by source files. Each command runs in the task directory with the resolved tool environment, and its text plus stdout/stderr hashes fold into the cache key. ([#11381](https://github.com/jdx/mise/pull/11381) by @jdx)

  ```toml
  [tasks.build]
  run = "..."
  sources = ["src/**/*.rs"]
  outputs = ["dist/app"]
  cache = { enabled = true, command_inputs = ["rustc --version"] }
  ```
- **task:** experimental workspace project graph model and provider interface, the ecosystem-neutral foundation for Node, Cargo, uv, and Go monorepo discovery, plus Node workspace discovery for npm, pnpm, Yarn, and Bun monorepos powered by Aube's shared manifest parsing and workspace-confined scanning. ([#11400](https://github.com/jdx/mise/pull/11400), [#11418](https://github.com/jdx/mise/pull/11418), [#11420](https://github.com/jdx/mise/pull/11420), [#11422](https://github.com/jdx/mise/pull/11422), [#11424](https://github.com/jdx/mise/pull/11424), [#11427](https://github.com/jdx/mise/pull/11427), [#11430](https://github.com/jdx/mise/pull/11430), [#11445](https://github.com/jdx/mise/pull/11445) by @jdx)
- **mcp:** new `list_commands` tool exposing mise's command tree with each command's declared effect (`read`, `write`, `destructive`, or unclassified), help text, and hidden status, so agents can see what a command does before invoking it. An optional `include_hidden` controls visibility, and unclassified is explicitly treated as unknown rather than safe. ([#11389](https://github.com/jdx/mise/pull/11389) by @jdx)
- **cargo:** `cargo.binstall_native` graduates from experimental and can now discover conventionally named GitHub release artifacts from a crate's linked repository when `package.metadata.binstall` is absent, so more precompiled binaries install without crate-specific configuration. It also works under the default `locked = true` path. ([#11433](https://github.com/jdx/mise/pull/11433) by @jdx)
- **dotfiles:** new `mise bootstrap dotfiles unapply` (with hidden `mise dotfiles unapply` compatibility alias) to remove managed symlinks, copies, templates, and edit blocks while preserving unmanaged content. Supports target filters, `--dry-run`, `--yes`, and requires `--force` for modified or ambiguous content. ([#11437](https://github.com/jdx/mise/pull/11437) by @jdx)
- **bootstrap:** dotfiles management is now consolidated under `mise bootstrap dotfiles` (`add`, `edit`, `apply`, `status`), which runs `pre-dotfiles`/`post-dotfiles` hooks correctly. The top-level `mise dotfiles` command is hidden and deprecated (warnings in 2027.2.0, removal in 2028.2.0) but still works. ([#11436](https://github.com/jdx/mise/pull/11436) by @jdx)
- **bootstrap:** added `bs` as a visible shorthand alias for `mise bootstrap`. ([#11439](https://github.com/jdx/mise/pull/11439) by @jdx)
- **spm:** new `install_command` option for source installs runs a custom command from the checked-out package, and fails the install when the command exits successfully but installs nothing into `bin/` (protecting against scripts that swallow build failures). ([#11369](https://github.com/jdx/mise/pull/11369) by @Marukome0743)

## Fixed
- **backend:** a network failure while listing remote versions is now reported as a fetch failure instead of a misleading "no versions found matching date filter". The failure is memoized per process to avoid redundant HTTP retries, cutting duplicate warning spam and install time roughly in half in the failing case. ([#11391](https://github.com/jdx/mise/pull/11391) by @jdx)
- **config:** `mise use`, `mise up --bump`, and `mise set` now preserve trailing inline comments when rewriting `mise.toml`, matching the existing behavior for comments above a line and for `.tool-versions`. ([#11415](https://github.com/jdx/mise/pull/11415) by @JamBalaya56562)
- **oci:** chunked `mise oci push` now accepts `201 Created` on the chunk `PATCH`, fixing large-layer pushes to AWS ECR that previously failed with `blob chunk upload failed: 201`. ([#11376](https://github.com/jdx/mise/pull/11376) by @fire-ant)
- **npm:** tools resolved from a `mise.lock` pin are now trusted through aube's low-download popularity gate for the requested package, so reproducing an existing lockfile no longer requires `allow_low_downloads`. First-time unlocked installs and OSV malicious-package checks are unchanged. ([#11384](https://github.com/jdx/mise/pull/11384) by @jdx)
- **npm:** aube confirmation prompts are now routed through mise's shared prompt path. ([#11441](https://github.com/jdx/mise/pull/11441) by @jdx)
- **pipx:** no longer suggests `uv` when `uvx` is disabled for the package. ([#11373](https://github.com/jdx/mise/pull/11373) by @JamBalaya56562)
- **dotfiles:** `symlink-each` now prunes stale mise-managed symlinks left behind when a source file is deleted (reporting them as drift in `mise dotfiles status`), collapses emptied directories, and gains `exclude` glob patterns for directory-walking modes, while leaving unmanaged files and user links untouched. ([#11388](https://github.com/jdx/mise/pull/11388) by @jdx)
- **brew:** maintain linked-keg compatibility records ([#11371](https://github.com/jdx/mise/pull/11371) by @benjaminwestern), adopt existing cask completion links ([#11383](https://github.com/jdx/mise/pull/11383) by @jdx), and use the download client for artifacts ([#11428](https://github.com/jdx/mise/pull/11428) by @jdx).
- **aqua:** preserve legacy root binary layouts so tools that expect binaries at the install root keep working. ([#11397](https://github.com/jdx/mise/pull/11397) by @jdx)
- **shim:** missing executables are now attributed to the configured tool that should provide them. ([#11398](https://github.com/jdx/mise/pull/11398) by @jdx)
- **bootstrap:** the generated install script honors `MISE_VERSION` and `MISE_INSTALL_PATH` ([#11401](https://github.com/jdx/mise/pull/11401) by @JamBalaya56562), and mise-managed `mas` is now detected ([#11429](https://github.com/jdx/mise/pull/11429) by @jdx).
- **generate:** git pre-commit hooks respect quiet flags ([#11310](https://github.com/jdx/mise/pull/11310)), use the current env directive syntax ([#11311](https://github.com/jdx/mise/pull/11311)), and resolve hooks correctly in git worktrees ([#11313](https://github.com/jdx/mise/pull/11313)) — all by @Marukome0743.
- **task:** support mixed file task dependencies ([#11382](https://github.com/jdx/mise/pull/11382) by @jdx), deduplicate equivalent task sources ([#11204](https://github.com/jdx/mise/pull/11204) by @risu729), support multi-line arrays in file task headers ([#11412](https://github.com/jdx/mise/pull/11412) by @Marukome0743), allow `false` to override script headers ([#11112](https://github.com/jdx/mise/pull/11112) by @risu729), and treat a missing content-hash baseline as stale ([#11447](https://github.com/jdx/mise/pull/11447) by @JamBalaya56562).
- **link:** reject selector-style link requests. ([#11218](https://github.com/jdx/mise/pull/11218) by @risu729)
- progress output no longer repaints over interactive confirmation prompts; the shared renderer is now suspended while a prompt owns the terminal. ([#11421](https://github.com/jdx/mise/pull/11421) by @jdx)

## Documentation
- Documented external cache inputs ([#11395](https://github.com/jdx/mise/pull/11395) by @jdx) and how packagers can disable self-update ([#11446](https://github.com/jdx/mise/pull/11446) by @JamBalaya56562).
- Replaced the dead Taobao Node mirror example with npmmirror ([#11217](https://github.com/jdx/mise/pull/11217) by @Bartok9) and fixed a redactions glob example using removed nested syntax ([#11448](https://github.com/jdx/mise/pull/11448) by @Marukome0743).

## Registry
- Added micro ([#11378](https://github.com/jdx/mise/pull/11378) by @Jai-JAP), tealdeer ([#11390](https://github.com/jdx/mise/pull/11390) by @Jai-JAP), and aws-cdk ([#11394](https://github.com/jdx/mise/pull/11394) by @garysassano).

## New Contributors
* @Jai-JAP made their first contribution in [#11390](https://github.com/jdx/mise/pull/11390)
* @fire-ant made their first contribution in [#11376](https://github.com/jdx/mise/pull/11376)
* @benjaminwestern made their first contribution in [#11371](https://github.com/jdx/mise/pull/11371)

**Full Changelog**: https://github.com/jdx/mise/compare/v2026.7.15...v2026.7.16

## 💚 Sponsor mise

mise is maintained by [@jdx](https://github.com/jdx), an open source developer for [**entire.io**](https://entire.io), the title sponsor of the [jdx.dev](https://jdx.dev) open source tools. Development is funded by sponsors.

If mise saves you or your team time, please consider sponsoring at [jdx.dev](https://jdx.dev/sponsors.html). Individual and company sponsorships keep mise fast, free, and independent.