mistralai/cli cli/v0.9.0

mistral CLI v0.9.0

Repository: mistralai/cli

Tag: cli/v0.9.0

Published: 2026-10-20T07:05:09Z

Prerelease: no

Release notes:

Breaking

• mistral apps reads a private registry's token only from

MISTRAL_REGISTRY_TOKEN or NODE_AUTH_TOKEN. It no longer reads GEMFURY_DEPLOY_TOKEN or GEMFURY_PULL_TOKEN, or token files such as .env.registry and .env.gemfury: export MISTRAL_REGISTRY_TOKEN instead.

• A private Python index is now authenticated as the user in

MISTRAL_REGISTRY_USER, token by default. For an index that needs another user, such as a Gemfury account name, set MISTRAL_REGISTRY_USER.

• Scope lines the CLI writes to an app's bunfig.toml for a private registry

name $NODE_AUTH_TOKEN, as the registry templates do. An app whose line names another variable is rewritten the next time the CLI updates its registry config.

Added

• The installer asks to install bun 1.4.0 when bun is not on your PATH, since mistral apps needs it. Set MISTRAL_INSTALL_BUN=1 to install it without asking, or MISTRAL_INSTALL_BUN=0 to skip it.
• mistral apps deploy gives a workflow worker the app's managed database, with

the same POSTGRES_* settings as the services, and creates the database for an app that has a worker but no service.

• mistral apps deploy --from-disk deploys the app from the working directory

instead of a pushed commit, by uploading each module's build context. It is experimental and cannot deploy workers yet.

• mistral apps init --from starts a project from the code an app

deployed from disk runs in production, bound to the same app, so you can pick up an app someone else deployed. It is experimental and only works when every service builds from the app directory.

• mistral upgrade upgrades the CLI to the latest release in place, keeping

the install directory it runs from. --dry-run prints the install command instead. mistral-internal upgrade does the same for internal builds.

• mistral apps list lists the apps in the workspace you are logged in to,

with each app's modules, address and Studio link. Like deploy, it needs a feature flag.

• mistral apps logs [module] reads an app's build and runtime logs, with

--follow to stream them and --json for one object per line. Like deploy, it needs a feature flag.

• mistral apps deploy checks that your GitHub connection can read the commit

before it creates anything, and on a terminal opens the GitHub page that fixes it and waits.

• mistral apps install restores the managed capabilities recorded in

.mistral/capabilities.json, for example after a fresh clone. Browsing and adding capabilities from an organization's managed registry needs a feature flag.

• mistral apps capability publish publishes a capability version to

your organization's managed registry, and --all [] publishes every version the registry does not list yet, for example from CI. It packs the folder minus what .gitignore excludes and checks it before uploading. It needs the same feature flag as browsing the managed registry.

Changed

• The binaries are built with bun 1.4.0 (was 1.3.5), and mistral apps registry init pins bun 1.4.0 in new registries.
• The update notice is one line on STDERR pointing at mistral upgrade, and

stays quiet for 24 hours once shown for a version. It is no longer printed for --json output or when CI is set.

• apps init no longer needs bun on your PATH. Without it, init installs with

the Bun built into mistral and warns that running the app locally still needs bun. The new app can be deployed with apps deploy without installing bun. If one of the app's install scripts runs mistral meanwhile, init runs it as the CLI rather than as Bun, and warns.

• apps init and apps capability add/select/remove record official capabilities

requested, installed, added and removed in telemetry; other registries are only counted.

• Telemetry treats the official registry installed from Cloudsmith

(https://npm.cloudsmith.io/mistral-ai/sdk-distribution/) as official, in place of Gemfury: its capabilities are named, and capabilities installed from Gemfury are only counted.

• A failed mistral apps deploy says why each module's run failed and points

at mistral apps logs --run , which prints the run's error when it wrote no logs. The --json report gains a per-module error.

• mistral apps init names the capabilities it installs, such as

workflows, apps (core included), in both its progress and summary lines, instead of two capability counts that did not match.

Fixed

• A gated mistral apps command (list, deploy, logs, publish,

unpublish) that your organization does not have now says it is not enabled and names its feature flag, instead of Unknown subcommand. Typing one that the cached flags hide re-checks your organization's flags first, so a newly enabled command works without signing in again. This can make macOS ask for keychain access, as on a first run. --help on a hidden command now shows its help and exits 0, where it used to exit 1; it never refreshes flags. When the organization is not in the rollout, each attempt can cost up to two flag fetches of at most 3 seconds each.

• mistral apps init and mistral apps capability list authenticate to a

private registry with the token in MISTRAL_REGISTRY_TOKEN or NODE_AUTH_TOKEN, instead of failing with a 401 unless ~/.npmrc held a valid token. The token goes only to registries you trust: Mistral's Cloudsmith registry and its Python index, MISTRAL_APPS_REGISTRY_URL, and, for the rest of the command, the --registry-url you pass along with the sources its descriptor declares. Nothing in an app's repository can add to that set, and public npm and PyPI never get the token. MISTRAL_REGISTRY_TOKEN takes precedence over a NODE_AUTH_TOKEN set for another registry, and a descriptor fetched without --registry-package is sent MISTRAL_REGISTRY_TOKEN only.

• When your .npmrc or bunfig binds NODE_AUTH_TOKEN to another registry,

the CLI leaves that variable alone and warns, naming the host, instead of failing with a bare 401.

• --help on a command, such as mistral apps deploy --help, and commands that

need no sign-in, such as mistral apps init, no longer read the sign-in from the keychain, so macOS stops asking for keychain access.

• mistral apps capability update [] moves the

capability's Python pin in pyproject.toml to the same version as its npm package, an explicit...