fix: install Yarn Berry via mise HTTP client instead of curl/wget

[doraemonkeys]

Fixes the Windows Yarn 2+ install failure reported in jdx/mise#10561.

Problem

mise use -g yarn@4 fails on Windows with Failed to download Yarn v2+. The PostInstall hook downloads yarn.js by shelling out to curl/wget via os.execute, which is unreliable: mise sanitizes the os.execute environment so neither is guaranteed to be on PATH, and stderr is redirected to NUL so the real error is lost.

Fix

• Download yarn.js with the built-in http.download_file (mise's own HTTP client, with retry) and check the returned err. It must be called directly — it is an async host function, and wrapping it in pcall fails with attempt to yield across a metamethod/C-call boundary.
• Build paths with file.join_path so separators are correct on Windows, and quote paths passed to mkdir/chmod.
• Include the URL and underlying error in the failure message.

No mise core change is required; bin/ is still created via shell built-in mkdir, so this works with released mise.

Verified

Windows 11, mise 2026.7.1, plugin loaded via mise plugins link:

$ mise install yarn@4     # succeeds
$ yarn --version
4.17.0

Notes for maintainers

• mise vendors this plugin at crates/vfox/embedded-plugins/vfox-yarn/, so after merging, the embedded copy needs a sync + mise release before users see the fix.
• Conflicts with feat: support yarn 6+ #4 in post_install.lua (both rewrite the Berry download path). This PR is a small fix for a current failure, so it probably makes sense to merge first and let feat: support yarn 6+ #4 rebase — its new v6+ path downloads via the same curl/wget shell-out and should switch to http.download_file as well.

[gemini-code-assist]

Code Review

This pull request refactors the post-installation hook in hooks/post_install.lua to use the built-in file and http modules instead of shelling out to external tools like curl or wget. It also improves path handling by using file.join_path and quoting paths in shell commands. Feedback highlights that http.download_file returns an error string rather than raising an exception, meaning the current pcall wrapper will silently ignore download failures. Additionally, it is suggested to check if the bin directory already exists using file.exists before executing the mkdir command.

Important

The consumer version of Gemini Code Assist on GitHub is being sunset. Starting June 18, 2026, new organization installations will be blocked, and all code review activity will officially cease on July 17, 2026.
For more details on the timeline and next steps, please review the Help Documentation.