From c51c877fa354ef86cc49bd39ecad74659c4e5272 Mon Sep 17 00:00:00 2001
From: John Vandenberg <jayvdb@gmail.com>
Date: Mon, 13 Jul 2026 09:24:22 +0800
Subject: [PATCH] Use cargo:open

---
 .github/actions/install-mise-tools/action.yaml    |  7 +++++++
 .mise/config.toml                                 |  1 +
 CLAUDE.md                                         | 15 +++++++++++++++
 Dockerfile.nanoserver                             |  5 +++--
 Dockerfile.windows                                |  3 ++-
 config/conftest/policy/mise/mise.rego             |  8 +++++++-
 .../mise-cargo-backend-allowlist.schema.json      |  1 +
 utilities/cli/src/deployment_types/mise.rs        |  4 ++++
 .../output/facility-security-scenario/mise.toml   |  3 +++
 9 files changed, 43 insertions(+), 4 deletions(-)

diff --git a/.github/actions/install-mise-tools/action.yaml b/.github/actions/install-mise-tools/action.yaml
index f18d88a2..81ad4ae2 100644
--- a/.github/actions/install-mise-tools/action.yaml
+++ b/.github/actions/install-mise-tools/action.yaml
@@ -26,6 +26,13 @@ inputs:
 runs:
   using: composite
   steps:
+    # No cargo: tool installs on the Windows lane right now -- cargo-binstall fails to execute there (os error 193).
+    # open-o2's opener isn't needed in CI, so skip cargo:open rather than let the install fail.
+    - name: Skip cargo:open on Windows
+      if: runner.os == 'Windows'
+      shell: bash --noprofile --norc -euo pipefail {0}
+      run: echo "MISE_DISABLE_TOOLS=cargo:open" >> "$GITHUB_ENV"
+
     - name: Install mise binary
       uses: ./.github/actions/install-mise
       with:
diff --git a/.mise/config.toml b/.mise/config.toml
index b41ba60d..e7a534d7 100644
--- a/.mise/config.toml
+++ b/.mise/config.toml
@@ -63,6 +63,7 @@ action-validator = { version = "latest", os = ["linux", "macos"] }
 ast-grep = "latest"
 cargo-binstall = "latest"
 "cargo:cargo-expand" = { version = "latest", os = ["linux", "macos"] }
+"cargo:open" = "latest"
 "cargo:wasm-opt" = { version = "latest", os = ["linux", "macos"] }
 "github:nextest-rs/nextest" = "latest"
 taplo = "latest"
diff --git a/CLAUDE.md b/CLAUDE.md
index efa38702..7ea517cc 100644
--- a/CLAUDE.md
+++ b/CLAUDE.md
@@ -614,6 +614,21 @@ If no msvc prebuilt exists either, use a different backend (aqua/github/http, or
 pattern), or os-scope the tool off Windows and provide coverage another way (as `dart-typegen` does via
 `http:dart-typegen`).
 
+As of mise 2026.7.1 the `cargo:` backend is broken on the Windows lane in a further way: `cargo-binstall` itself
+fails to execute, so the source-build fallbacks above never even get a chance. `cargo:open` (a low-dep pure-Rust
+opener with no prebuilt anywhere) surfaced it:
+
+    mise ERROR Failed to install cargo:open@latest: failed to execute command: <mise>\shims\cargo-binstall
+    -y open@5.3.6 --locked --root <mise>\installs\cargo-open\5.3.6: %1 is not a valid Win32 application. (os error 193)
+
+os error 193 is ERROR_BAD_EXE_FORMAT -- the staged cargo-binstall is not a runnable Win32 image (a mise
+install-path / shim fault, not an `open`-specific one), so right now no `cargo:` tool installs on Windows at all.
+Until mise fixes it, keep new `cargo:` tools off the Windows lane -- os-scope them to `["linux", "macos"]` where
+Windows never needs them, or add the tool to `MISE_DISABLE_TOOLS` on every Windows surface that runs `mise install`.
+The `install-mise-tools` composite action sets it for the CI jobs, and the Windows Dockerfiles carry it in their own
+`MISE_DISABLE_TOOLS`. `cargo:open` takes the latter route: its open-o2 opener is a known Windows gap until the
+backend works again.
+
 ## Adding a new `upstream-cache` entry
 
 When upstream has no prebuilt binary for a platform we target (the case the "Tools must work on every OS" rule
diff --git a/Dockerfile.nanoserver b/Dockerfile.nanoserver
index 0d3de215..d8066d8e 100644
--- a/Dockerfile.nanoserver
+++ b/Dockerfile.nanoserver
@@ -328,12 +328,13 @@ RUN (if exist C:\token\gh_token set /p GITHUB_TOKEN=<C:\token\gh_token) & `
 # elsewhere; dropping them here just keeps the image lean.
 # `cargo:dart-typegen` is os-scoped to non-Windows in config.dart.toml --
 # the Windows lane (incl. Nano) uses `http:dart-typegen` from the
-# upstream-cache release instead.
+# upstream-cache release instead. `cargo:open` can't install on Windows at
+# all (cargo-binstall fails, os error 193), so it is disabled here too.
 # Two intermediate ARGs so each line stays short without a backslash continuation
 # continuations (Dockerfile ENV doesn't support comment-aware joining and
 # the value is too long for a single line otherwise). The ARGs don't
 # persist into the runtime env; only the joined ENV does.
-ARG MISE_DT_BASE=conda:m2-gnupg,lychee,pipx:cowsay,pipx:cpplint,pipx:flawfinder,pipx:semgrep
+ARG MISE_DT_BASE=cargo:open,conda:m2-gnupg,lychee,pipx:cowsay,pipx:cpplint,pipx:flawfinder,pipx:semgrep
 ARG MISE_DT_DOTNET=dotnet:roslynator.dotnet.cli
 ARG MISE_DT_PY=pipx:componentize-py,pipx:datamodel-code-generator,pipx:openapi-python-client,pipx:pytest,pipx:torch
 ENV MISE_DISABLE_TOOLS=${MISE_DT_BASE},${MISE_DT_DOTNET},${MISE_DT_PY}
diff --git a/Dockerfile.windows b/Dockerfile.windows
index 952a52c8..05e4da0d 100644
--- a/Dockerfile.windows
+++ b/Dockerfile.windows
@@ -158,7 +158,8 @@ ENV MISE_ENV=${MISE_ENV}
 # - pipx:torch ships ~1 GB of CUDA-less wheels we don't exercise in the
 #   docker lane (the torch-inference test is gated on
 #   mise_env_includes(Language::Python) -- it'll skip cleanly).
-ENV MISE_DISABLE_TOOLS=dotnet:roslynator.dotnet.cli,pipx:torch
+# - cargo:open can't install on Windows (cargo-binstall fails, os error 193); its open-o2 opener isn't used here.
+ENV MISE_DISABLE_TOOLS=cargo:open,dotnet:roslynator.dotnet.cli,pipx:torch
 RUN (if exist C:\token\gh_token set /p GITHUB_TOKEN=<C:\token\gh_token) & `
     mise install
 
diff --git a/config/conftest/policy/mise/mise.rego b/config/conftest/policy/mise/mise.rego
index 8f3ccd0d..dde3791e 100644
--- a/config/conftest/policy/mise/mise.rego
+++ b/config/conftest/policy/mise/mise.rego
@@ -102,7 +102,13 @@ second_tier_platform := {"linux/arm64", "macos/x64"}
 # cargo:action-validator has no aqua/github Windows build, so config.windows.toml installs it via cargo.
 # cargo-binstall pulls the cargo-quickinstall x86_64-pc-windows-msvc prebuilt (verified present), routed via
 # the msvc install_env there -- a prebuilt fetch, not a source build.
-allowed_cargo_no_prebuilt := {"cargo:action-validator", "cargo:cargo-expand", "cargo:dart-typegen", "cargo:wasm-opt"}
+allowed_cargo_no_prebuilt := {
+	"cargo:action-validator",
+	"cargo:cargo-expand",
+	"cargo:dart-typegen",
+	"cargo:open",
+	"cargo:wasm-opt",
+}
 
 cargo_scoped_to_second_tier(spec) if {
 	is_object(spec)
diff --git a/config/taplo/mise-cargo-backend-allowlist.schema.json b/config/taplo/mise-cargo-backend-allowlist.schema.json
index 501bd022..ab1ac332 100644
--- a/config/taplo/mise-cargo-backend-allowlist.schema.json
+++ b/config/taplo/mise-cargo-backend-allowlist.schema.json
@@ -15,6 +15,7 @@
               "cargo:cargo-expand",
               "cargo:dart-typegen",
               "cargo:findutils",
+              "cargo:open",
               "cargo:ryl",
               "cargo:wasm-opt"
             ]
diff --git a/utilities/cli/src/deployment_types/mise.rs b/utilities/cli/src/deployment_types/mise.rs
index c563fd1b..824710ba 100644
--- a/utilities/cli/src/deployment_types/mise.rs
+++ b/utilities/cli/src/deployment_types/mise.rs
@@ -81,6 +81,10 @@ pub fn generate_mise_deployment(cluster: &ClusterInput, output_dir: &Path) -> Re
 
     let _previous: Option<Value> = root.insert("tasks".to_string(), Value::Table(tasks));
 
+    let mut tools = Table::new();
+    let _previous: Option<Value> = tools.insert("cargo:open".to_string(), Value::String("latest".to_string()));
+    let _previous: Option<Value> = root.insert("tools".to_string(), Value::Table(tools));
+
     let content = toml::to_string(&Value::Table(root))?;
     fs::write(&output_path, content)?;
 
diff --git a/verification/local/output/facility-security-scenario/mise.toml b/verification/local/output/facility-security-scenario/mise.toml
index fdd728a1..6fe2ea06 100644
--- a/verification/local/output/facility-security-scenario/mise.toml
+++ b/verification/local/output/facility-security-scenario/mise.toml
@@ -26,3 +26,6 @@ cargo run
 [tasks.ws-server.env]
 OTLP_AUTH_PASSWORD = "1234"
 OTLP_AUTH_USERNAME = "root@example.com"
+
+[tools]
+"cargo:open" = "latest"