This release makes config trust smarter across git worktrees and monorepos, and fixes npm-backed tools on npm 12. Added

• Trust is shared across git worktrees. Trust records are keyed by absolute path, so every new git worktree add checkout used to re-prompt for the same config. A config inside a linked worktree is now trusted automatically when the equivalent path in the repository's main checkout is trusted — trusting a repo once covers all of its worktrees. This is especially helpful for workflows that spin up many short-lived worktrees (e.g. AI-agent worktrees under .claude/worktrees/). Sharing flows one way, from main checkout to worktrees; an explicit --ignore still wins, and paranoid mode is excluded since its trust is tied to per-file content hashes. mise untrust inside a worktree now warns that the main checkout still trusts the config (#10890 by @jdx).
• mise trust --all now trusts nested subdirectory configs. Previously --all only trusted config files in the current directory and its parents. It now also walks subdirectories and trusts each nested config root it finds, so a monorepo's nested configs can be trusted with one explicit command. The walk respects .gitignore, skips hidden directories, and skips node_modules, vendor, target, dist, and build so vendored configs are left untrusted. Each nested config gets its own trust record, so a config added later in a new subdirectory still prompts (#10889 by @jdx).

Fixed

• npm: support npm 12 output. npm 12 wraps npm view --json responses in a single-item array, which broke version listing and latest-version detection for npm-backed tools. mise now normalizes both the legacy object shape and the new wrapped shape, and tolerates missing time metadata (#10888 by @jdx).

Changed

• registry: the codex shorthand now prefers npm:@openai/codex over the aqua GitHub asset. The aqua asset for recent releases shipped only the main codex binary and omitted codex-code-mode-host, which broke tool calling; the npm package installs the full vendor bundle. Aqua remains available as an explicit or fallback backend (#10893 by @jdx).

💚 Sponsor mise mise is maintained by @jdx, an open source developer for entire.io, the title sponsor of the jdx.dev open source tools. Development is funded by sponsors. If mise saves you or your team time, please consider sponsoring at jdx.dev. Individual and company sponsorships keep mise fast, free, and independent.