mise use -g npm:@opencode-ai/browser-control --verbose
DEBUG ARGS: /home/arafays/.local/bin/mise use -g npm:@opencode-ai/browser-control --verbose
DEBUG [vfox] Getting metadata for yarn
DEBUG config: ~/projects/case-studies-monorepo/mise.toml
DEBUG config: ~/.config/mise/config.toml
DEBUG [vfox] Getting metadata for yarn
DEBUG Loaded 127 CA root certificates from the system
DEBUG Loaded 127 CA root certificates from the system
INFO npm:@opencode-ai/browser-control@0.3.2 [1/3] install
DEBUG Loaded 127 CA root certificates from the system
DEBUG Loaded 127 CA root certificates from the system
DEBUG Loaded 127 CA root certificates from the system
@opencode-ai/browser-control is newly registered (first published 2026-07-19T16:23:20.646Z; minimum age: 43200 minutes). Continue adding @opencode-ai/browser-control? Yes
@opencode-ai/browser-control looks suspicious: 195 downloads last week (threshold: 1000). Continue adding @opencode-ai/browser-control? Yes
DEBUG Loaded 127 CA root certificates from the system
DEBUG Loaded 127 CA root certificates from the system
DEBUG Loaded 127 CA root certificates from the system
DEBUG Loaded 127 CA root certificates from the system
DEBUG aube: Resolving @opencode-ai/browser-control@0.3.2...
DEBUG aube: + @opencode-ai/browser-control@0.3.2 (specifier: 0.3.2)
INFO npm:@opencode-ai/browser-control@0.3.2 [1/3] resolving
DEBUG read: "/home/arafays/.local/share/aube/store/v1/index/68bd36f900240d50/@opencode-ai__browser-control@0.3.2.json"
INFO npm:@opencode-ai/browser-control@0.3.2 [1/3] resolving 1/1 pkgs
DEBUG [vfox] Getting metadata for yarn
DEBUG config: ~/projects/case-studies-monorepo/mise.toml
DEBUG config: ~/.config/mise/config.toml
Error:
0: Failed to install npm:@opencode-ai/browser-control@latest: aube install failed: failed to resolve dependencies
caused by: trust downgrade for @effect/platform-node@4.0.0-beta.97 (trustPolicy=no-downgrade): earlier published version 0.101.2 had trusted publisher but this version has provenance attestation
This is a supply-chain trust failure, not an ordinary version-resolution error. An earlier release had stronger trust evidence than the selected release. This can indicate a compromised or tampered release; it can also happen when a maintainer manually publishes, backports outside the trusted workflow, skips provenance for convenience, or uses a registry that strips metadata.
Before bypassing, inspect the package's npm release, source tag/commit, publisher identity, and tarball; compare the metadata with npmjs.org. Confirm the release is expected and nothing appears tampered with, then report inconsistent evidence to the relevant upstream owner. Package-release drift belongs with the maintainer; metadata present on npmjs.org but missing from a proxy or mirror belongs with that registry operator.
Only after review, add the narrowest affected `<package>@<version>` to `trust_policy_excludes` for this tool, e.g.:
"npm:@opencode-ai/browser-control" = { version = "latest", trust_policy_excludes = ["<package>@<version>"] }
A bare package name exempts every version. `mise settings npm.shell_out=true` uses the npm CLI and bypasses this check entirely, so it should be a last resort.
Investigation guide and known exceptions: https://aube.jdx.dev/security#trust-policy
Location:
src/toolset/toolset_install.rs:263
Version:
2026.7.17 linux-x64 (2026-07-30)
Backtrace omitted. Run with RUST_BACKTRACE=1 environment variable to display it.
Run with RUST_BACKTRACE=full to include source snippets.
DEBUG exiting with code: 1
