chore(wsl): exclude resend from the npm trust policy

[risu729]

Summary

• allow npm:resend-cli to install despite resend losing npm provenance, by adding trust_policy_excludes = ["resend@>=6.18.1"] to the global mise config
• no version is bumped here; the resend-cli upgrade is left to Renovate

Why

Lock file maintenance (#3990) bumps resend-cli 2.10.0 -> 2.15.0, which pins resend at 6.21.0. That fails the WSL installer test:

mise ERROR Failed to install npm:resend-cli@latest: aube install failed: failed to resolve dependencies
  caused by: trust downgrade for resend@6.21.0 (trustPolicy=no-downgrade):
  earlier published version 6.17.1 had trusted publisher but this version has no trust evidence

This is not a compromise. resend briefly published through CI:

version	published	publisher	provenance
6.17.0	2026-07-03	gabrielmfern	no
6.17.1	2026-07-03	GitHub Actions	yes
6.18.0	2026-07-21	GitHub Actions	yes
6.18.1	2026-07-28	cisneiros	no
6.19.0 - 6.22.0	2026-08-10 onward	maintainers	no

That window is resend/resend-node#999 (feat: tegami release process, merged 2026-07-03), reverted by resend/resend-node#1033 (merged 2026-07-27) because it "was a bit of an internal experiment" with unresolved prerelease details. 6.18.1 is the first release after the revert.

The same trust failure was already reported upstream as resend/resend-node#1061, and a maintainer confirmed it is expected "for a while in the following new versions, while we are reworking our automation release processes".

Scope of the exclude

resend@>=6.18.1 rather than a single pinned version, so a future resend-cli bump that pulls 6.22.0 or later does not reintroduce the failure. Versions up to 6.18.0 keep their provenance requirement, and no other package is affected.

Verification

Installed npm:resend-cli into an isolated MISE_DATA_DIR:

config	result
no exclude, resend-cli 2.15.0	fails, reproduces the CI error
resend@>=6.18.1, resend-cli 2.15.0	installs
resend@>=6.18.1, resend-cli 2.10.0 (current pin)	installs

mise run check --lint passes.

Notes

• the mise.lock options entry is updated to match, since mise records install-time options there
• this may conflict with chore(deps): lock file maintenance #3990; that PR is recreated on each lock file maintenance run, so it should resolve itself

Summary by Sourcery

Exclude newer resend releases from the npm trust policy so resend-cli installation continues to work while the package’s release provenance is being reworked.

Bug Fixes:

• Allow the WSL environment to install resend-cli despite missing npm provenance on newer resend releases.

Enhancements:

• Scope the trust-policy exception to resend@>=6.18.1 while preserving provenance checks for earlier versions.

Chores:

• Update the mise lockfile to reflect the new install options.

[sourcery-ai]

Reviewer's guide (collapsed on small PRs)

Reviewer's Guide

Updates the WSL mise configuration so npm:resend-cli can be installed despite resend losing npm provenance, by adding a targeted trust policy exclusion and aligning the lock file options entry.

Sequence diagram for the resend-cli installation trust policy

sequenceDiagram
    participant Mise
    participant Aube
    participant Npm
    Mise->>Aube: install npm:resend-cli@latest
    Aube->>Npm: resolve resend dependency
    alt resend@>=6.18.1 is excluded
        Aube-->>Mise: install succeeds
    else no trust_policy_excludes
        Aube-->>Mise: trust downgrade error
    end

Loading

File-Level Changes

Change	Details	Files
Allow npm:resend-cli installation under aube’s no-downgrade trust policy by excluding resend versions without provenance from the trust policy while keeping other packages unaffected.	Add trust_policy_excludes entry for resend versions >= 6.18.1 in the global mise config for npm:resend-cli Document the provenance and trust-policy context for resend and link to the upstream issue in a comment above the resend-cli config Ensure the trust policy exclusion is scoped only to resend and does not relax provenance for other packages	wsl/home/.config/mise/config.toml
Align the mise lock file with the updated resend-cli installation options so future installs use the configured trust policy exclusion.	Update the npm:resend-cli options entry in the lock file to include the new trust_policy_excludes setting Keep version pins unchanged so Renovate continues to own resend-cli upgrades	wsl/home/.config/mise/mise.lock

---

Tips and commands

Interacting with Sourcery

• Trigger a new review: Comment @sourcery-ai review on the pull request.
• Continue discussions: Reply directly to Sourcery's review comments.
• Generate a GitHub issue from a review comment: Ask Sourcery to create an
  issue from a review comment by replying to it. You can also reply to a
  review comment with @sourcery-ai issue to create an issue from it.
• Generate a pull request title: Write @sourcery-ai anywhere in the pull
  request title to generate a title at any time. You can also comment
  @sourcery-ai title on the pull request to (re-)generate the title at any time.
• Generate a pull request summary: Write @sourcery-ai summary anywhere in
  the pull request body to generate a PR summary at any time exactly where you
  want it. You can also comment @sourcery-ai summary on the pull request to
  (re-)generate the summary at any time.
• Generate reviewer's guide: Comment @sourcery-ai guide on the pull
  request to (re-)generate the reviewer's guide at any time.
• Resolve all Sourcery comments: Comment @sourcery-ai resolve on the
  pull request to resolve all Sourcery comments. Useful if you've already
  addressed all the comments and don't want to see them anymore.
• Dismiss all Sourcery reviews: Comment @sourcery-ai dismiss on the pull
  request to dismiss all existing Sourcery reviews. Especially useful if you
  want to start fresh with a new review - don't forget to comment
  @sourcery-ai review to trigger a new review!

Customizing Your Experience

Access your dashboard to:

• Enable or disable review features such as the Sourcery-generated pull request
  summary, the reviewer's guide, and others.
• Change the review language.
• Add, remove or edit custom review instructions.
• Adjust other review settings.

Getting Help

• Contact our support team for questions or feedback.
• Visit our documentation for detailed guides and information.
• Keep in touch with the Sourcery team by following us on X/Twitter, LinkedIn or GitHub.

[sourcery-ai]

Hey - I've found 1 issue

Prompt for AI Agents

Please address the comments from this code review:

## Individual Comments

### Comment 1
<location path="wsl/home/.config/mise/config.toml" line_range="85-87" />
<code_context>
+# resend dropped npm provenance from 6.18.1 onward while its release automation is
+# reworked, which trips aube's no-downgrade trust policy.
+# ref: https://github.com/resend/resend-node/issues/1061
+"npm:resend-cli" = { version = "latest", allow_builds = ["esbuild"], trust_policy_excludes = [
+	"resend@>=6.18.1",
+] }

 # ai agents
</code_context>
<issue_to_address>
**issue (bug_risk):** The multiline array is placed inside a TOML inline table, but standard TOML inline tables cannot contain newlines. mise therefore fails to parse this configuration before it can install any tools.

**Suggested fix:** Keep the inline table on one line, or move the `resend-cli` options into a TOML table form that supports multiline values.

```suggestion
"npm:resend-cli" = { version = "latest", allow_builds = ["esbuild"], trust_policy_excludes = ["resend@>=6.18.1"] }
```
</issue_to_address>

Sourcery assessment

Needs a human reviewer. 1 finding to address first, and this changes the npm trust boundary by exempting all resend versions at or above 6.18.1 from the provenance/no-downgrade policy, so a compromised or unexpectedly released package could be accepted without the usual trust signal. Reverting prevents future exemptions, but it cannot undo code that an already-installed package executed or data it may have accessed.

Blocking findings: wsl/home/.config/mise/config.toml:87

---

Sourcery is free for open source - if you like our reviews please consider sharing them ✨

• X
• Mastodon
• LinkedIn
• Facebook

_{Help me be more useful! Please click 👍 or 👎 on each comment and I'll use the feedback to improve your reviews.}

[sourcery-ai]

issue (bug_risk): The multiline array is placed inside a TOML inline table, but standard TOML inline tables cannot contain newlines. mise therefore fails to parse this configuration before it can install any tools.

Suggested fix: Keep the inline table on one line, or move the resend-cli options into a TOML table form that supports multiline values.

Suggested change

	"npm:resend-cli" = { version = "latest", allow_builds = ["esbuild"], trust_policy_excludes = [
	"resend@>=6.18.1",
	] }
	"npm:resend-cli" = { version = "latest", allow_builds = ["esbuild"], trust_policy_excludes = ["resend@>=6.18.1"] }