…ilable platforms (#6200)

- Improve error when no 'url' and no matching platform URL
- Show available platforms detected from options
- Helper moved to backend/static_helpers.rs and reused

This enhances UX by pointing users to valid platform keys when the
current platform is unsupported.

Fixes incorrect conversion of platform key underscores to dashes in flat
keys.\n\n- Preserves arch underscores (e.g., x86_64) while still
normalizing os_arch to os-arch.\n- Adds unit test to prevent
regression.\n\nThis resolves mismatches with expected platform keys and
improves suggestion accuracy.

…e mirror url (#5972)

I was trying to use in Alpine the following build:


https://unofficial-builds.nodejs.org/download/release/v24.5.0/node-v24.5.0-linux-x64-musl.tar.gz

So I set:

```sh
export MISE_NODE_MIRROR_URL=https://unofficial-builds.nodejs.org/download/release/
export MISE_NODE_FLAVOR=musl
export MISE_NODE_COMPILE=false

# and/or

mise settings set node.mirror_url https://unofficial-builds.nodejs.org/download/release/
mise settings set node.flavor musl
mise settings set node.compile 0
```

But `mise install` would **always** fail trying to download
`https://unofficial-builds.nodejs.org/download/release/v24.5.0/node-v24.5.0.tar.gz`
that don't exist.

The main issue was that my `settings.node.compile false` was being
overridden by the distro `all_compile` override, and it would then try
to download the source code for compilation, and fail, took me a long
while to figure that out. The real fix was just avoiding the
`all_compile` override if `node.compile` was set by the user manually.
Added a `info` log to avoid future issues with not understand where this
behavior came from.

The rest of the changes in `plugins/core/node.rs` are not necessary to
solve the bug, but I would like to try pushing too:
- I made a `fetch_binary` to reuse/deduplicate code for posix and
windows, while at it made the logic about Ok explicit and about the
NotFound case too; (_while the diff looks horrible, imho the final code
is clearer to reason and safer now, for someone new to the codebase_)
- it now makes explicitly clear when "precompiled node archive not found
and compilation is disabled" happens.
- Renamed `install_compiled` to `install_compiling` to make the intent
of the method really clear, the first time I read the code I was
confusing `install_compiled` and `install_precompiled`
- Made the unarchiving logic reusable, I was thinking in moving to
another place to let other packages use something like this, but it's
just that for now;
- ~~Made sure the errors where not encapsulated by using `Report::from`
(I had a bug because of it while testing stuff that shouldn't ever
happen, making an `Ok(())` be tested and treated as 404 somehow, but the
previous flow allowed it when I made my broken test changes, so this
could eventually cause a bug to some bad change in the future)~~ removed
by autofix
- Added 2 `info` logs that would've been crucial to understand this
issue.
- Added more `debug` logging around the areas that eventually led me to
discover the issue, and areas I was under the impression could be
potential troublemakers.
 
 
The new install_precompiled and install_windows method bodies here for
faster reading than the diff, just to try to defend my "unnecessary"
changes easier 😆:
 ```rust
    async fn install_precompiled(
        &self,
        ctx: &InstallContext,
        tv: &mut ToolVersion,
        opts: &BuildOpts,
    ) -> Result<()> {
        match self
            .fetch_binary(ctx, tv, opts, || {
                self.extract_tarball(
                    &opts.binary_tarball_path,
                    &opts.install_path,
                    ctx,
                    1, // strip_components for binary tarball
                )
            })
            .await?
        {
            FetchOutcome::Downloaded => Ok(()),
            FetchOutcome::NotFound => {
                if Settings::get().node.compile != Some(false) {
                    self.install_compiling(ctx, tv, opts).await
                } else {
bail!("precompiled node archive not found and compilation is disabled")
                }
            }
        }
    }

    async fn install_windows(
        &self,
        ctx: &InstallContext,
        tv: &mut ToolVersion,
        opts: &BuildOpts,
    ) -> Result<()> {
        match self
            .fetch_binary(ctx, tv, opts, || self.extract_zip(opts, ctx))
            .await?
        {
            FetchOutcome::Downloaded => Ok(()),
FetchOutcome::NotFound => bail!("precompiled node archive not found
(404)"),
        }
    }
```

---------

Co-authored-by: autofix-ci[bot] <114827586+autofix-ci[bot]@users.noreply.github.com>

The behavior and docs for env._.path predates config_root as well as
config files outside of the root like `.config/mise.toml`. This has been
a bug and should have been fixed when support was added for files
outside the project root but was not. This change modifies the behavior
of env._.path to behave the same as other parts of mise that are
relative to config_root and not the parent directory of the config file
making mise behave consistently in regards to relative paths.

Fixes #6203

BREAKING CHANGE: env._.path directories are now relative to the
config_root and not the parent directory of the config file. This only
affects config files that use env._.path that are outside the
config_root (e.g.: `.config/mise.toml` will use `.` and not `.config`
like before). To retain compatibility with earlier mise releases, be
explicit with `env._.path = "{{config_root}}/bin"` which will behave the
same in old and new releases.

---------

Co-authored-by: autofix-ci[bot] <114827586+autofix-ci[bot]@users.noreply.github.com>

## Summary
- Fixed hanging/infinite loop when tasks have multiple `depends_post`
entries
- The bug was caused by `resolve_depends` incorrectly iterating through
ALL tasks instead of just using the current task's dependencies
- Added comprehensive e2e test and unit test to prevent regression

## The Problem
Previously, when a task had multiple `depends_post` entries like:
```toml
[tasks.baz]
run = "echo baz"
depends_post = ["foo", "bar"]
```

The task would hang indefinitely due to circular dependencies being
created in the dependency graph.

## The Fix
Changed `resolve_depends` in `src/task/mod.rs` to use only
`self.depends_post` instead of iterating through all `tasks_to_run`.
This ensures each task only uses its own post-dependencies, preventing
circular dependencies.

## Test plan
- [x] Added e2e test `test_task_depends_post_multiple` that reproduces
the issue
- [x] Added unit test to verify the fix  
- [x] Verified existing `test_task_depends_post` test still passes
- [x] All task-related tests pass

Fixes: #4398

🤖 Generated with [Claude Code](https://claude.ai/code)

---------

Co-authored-by: Claude <noreply@anthropic.com>

This is a bug fix for the issue mentioned in
#6205 (comment)

Co-authored-by: Karim Elkholy <kareemelk96@gmail.com>

## What

This PR enables backends other than npm to correctly parse package
inputs with scopes and versions, such as '@antfu/ni@1.0.0'.

## Why

I was attempting to add a bun backend via a custom plugin, but
discovered that the current parser only handles this format correctly
for the npm backend. This change resolves that limitation, allowing
other package managers to parse scoped packages properly.

---------

Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>

- Support string and regex-based URL replacements via url_replacements
setting
- Enable protocol, hostname, and path modifications for HTTP(S)
downloads
- Configure replacements in mise.toml or globally in settings

## What problem does this feature solve?

- mise has no inbuilt registry it downloads artifacts from.
- Instead it reads remote registry manifests.
- Those manifests contain URLs with where to download tools from.
- In some environments (enterprise, DMZs, ...) those URLs are not
directly accessible but mostly by a proxy.
- mise currently has no configuration for a general URL redirection to
that proxy.
- This is exactly what this feature provides.
- It is a mechanism where you can tell mise to replace/modify any URL
request as desired.

Solves #5660

---

# Full Documentation

**... as from the update mise docs:**

## `url_replacements`

- Type: `object` (optional)
- Env: `MISE_URL_REPLACEMENTS`
- Default: `None`

Map of URL patterns to replacement URLs. This feature supports both
simple hostname replacements
and advanced regex-based URL transformations for download mirroring and
custom registries.

### Configuration Examples

Environment variable (JSON format):
```bash
# Simple hostname replacement
export MISE_URL_REPLACEMENTS='
{
  "github.com": "myregistry.net", 
  "releases.hashicorp.com": "mirror.example.com"
}'

# Regex pattern (note the escaped backslashes in JSON)
export MISE_URL_REPLACEMENTS='
{
  "regex:https://github\.com/([^/]+)/([^/]+)/releases/download/(.+)":
  "https://mirror.corp.com/github/$1/$2/$3"
}'
```

In mise.toml:
```toml
[settings]
# Simple hostname replacement
url_replacements = { 
  "github.com" = "myregistry.net", 
  "releases.hashicorp.com" = "mirror.example.com" 
}

# Regex patterns
url_replacements = { 
  "regex:^http://(.+)" = "https://$1",
  "regex:https://github\\.com/([^/]+)/([^/]+)/releases/download/(.+)" = 
    "https://mirror.corp.com/github/$1/$2/$3"
}
```

### Simple Hostname Replacement

For simple hostname-based mirroring, the key is the original
hostname/domain to replace,
and the value is the replacement string. The replacement happens by
searching and replacing
the pattern anywhere in the full URL string (including protocol,
hostname, path, and query parameters).

Examples:
- `github.com` -> `myregistry.net` replaces GitHub hostnames
- `https://github.com` -> `https://myregistry.net` with protocol
excludes e.g. 'api.github.com'
- `https://github.com` -> `https://proxy.corp.com/github-mirror`
replaces GitHub with corporate proxy
- `http://host.net` -> `https://host.net` replaces protocol from HTTP to
HTTPS

### Advanced Regex Replacement

For more complex URL transformations, you can use regex patterns. When a
key starts with `regex:`,
it is treated as a regular expression pattern that can match and
transform any part of the URL.
The value can use capture groups from the regex pattern.

#### Regex Examples

**1. Protocol Conversion (HTTP to HTTPS)**
```toml
[settings]
url_replacements = { 
  "regex:^http://(.+)" = "https://$1" 
}
```
This converts any HTTP URL to HTTPS by capturing everything after
"http://" and replacing it with "https://".

**2. GitHub Release Mirroring with Path Restructuring**
```toml
[settings]
url_replacements = { 
  "regex:https://github\\.com/([^/]+)/([^/]+)/releases/download/(.+)" = 
    "https://mirror.corp.com/github/$1/$2/$3" 
}
```
Transforms
`https://github.com/owner/repo/releases/download/v1.0.0/file.tar.gz`
to `https://mirror.corp.com/github/owner/repo/v1.0.0/file.tar.gz`

**3. Subdomain to Path Conversion**
```toml
[settings]
url_replacements = { 
  "regex:https://([^.]+)\\.cdn\\.example\\.com/(.+)" = 
    "https://unified-cdn.com/$1/$2" 
}
```
Converts subdomain-based URLs to path-based URLs on a unified CDN.

**4. Multiple Replacement Patterns (processed in order)**
```toml
[settings]
url_replacements = { 
  "regex:https://github\\.com/microsoft/(.+)" = 
    "https://internal-mirror.com/microsoft/$1",
  "regex:https://github\\.com/(.+)" = 
    "https://public-mirror.com/github/$1",
  "releases.hashicorp.com" = "hashicorp-mirror.internal.com"
}
```
First regex catches Microsoft repositories specifically, second catches
all other GitHub URLs,
and the simple replacement handles HashiCorp.

### Use Cases

1. **Corporate Mirrors**: Replace public download URLs with internal
corporate mirrors
2. **Custom Registries**: Redirect package downloads to custom or
private registries
3. **Geographic Optimization**: Route downloads to geographically closer
mirrors
4. **Protocol Changes**: Convert HTTP URLs to HTTPS or vice versa

### Regex Syntax

mise uses Rust regex engine which supports:
- `^` and `$` for anchors (start/end of string)
- `(.+)` for capture groups (use `$1`, `$2`, etc. in replacement)
- `[^/]+` for character classes (matches any character except `/`)
- `\\.` for escaping special characters (note: double backslash required
in TOML)
- `*`, `+`, `?` for quantifiers
- `|` for alternation

You can check on regex101.com if your regex works (see
[example](https://regex101.com/r/rmcIE1/1)).
Full regex syntax documentation:
<https://docs.rs/regex/latest/regex/#syntax>

### Precedence and Matching

- Regex patterns (keys starting with `regex:`) are processed first, in
the order they appear
- Simple hostname replacements are processed second
- The first matching pattern is used; subsequent patterns are ignored
for that URL
- If no patterns match, the original URL is used unchanged

### Security Considerations

When using regex patterns, ensure your replacement URLs point to trusted
sources,
as this feature can redirect tool downloads to arbitrary locations.

---

- This change has been created with heavy use of AI tools
(<https://opencode.ai>, <https://claude.ai> Sonnet 4,
<https://github.com/oraios/serena>)
- However every line of code (configuration and docs) was reviewed and
optimized by a human (me, @ThomasSteinbach)
- Despite using AI I spent hours into optimizing and testing this change
to deliver the highest quality possible
- I hope this change is (almost) ready to be merged :)

Kudos to this project <3

---------

Co-authored-by: autofix-ci[bot] <114827586+autofix-ci[bot]@users.noreply.github.com>

### 🚀 Features

- **(backend)** improve http error when platform url missing; list
available platforms by @jdx in
[#6200](#6200)

### 🐛 Bug Fixes

- **(backend)** preserve arch underscores in platform keys by @jdx in
[#6202](#6202)
- **(task)** resolve hanging issue with multiple depends_post by @jdx in
[#6206](#6206)
- couldn't download node binary in Alpine, even if it exists in the
mirror url by @Hazer in [#5972](#5972)
- **breaking** use config_root for env._.path by @jdx in
[#6204](#6204)
- bugfix for paths that include spaces by @karim-elkholy in
[#6210](#6210)

### 📚 Documentation

- improve release notes generation by @jdx in
[#6197](#6197)
- fix release changelog contributor reporting by @jdx in
[#6201](#6201)

### Chore

- use fine-grained gh token by @jdx in
[#6208](#6208)
- use settings.local.json for claude config by @jdx in
[fd0fba9](fd0fba9)

### New Contributors

- @karim-elkholy made their first contribution in
[#6210](#6210)
- @Hazer made their first contribution in
[#5972](#5972)

### Chore

- fix git-cliff on release by @jdx in
[3c388f2](3c388f2)

Co-authored-by: mise-en-dev <release@mise.jdx.dev>