mistralai/cli cli/v0.15.0

mistral CLI v0.15.0

Repository: mistralai/cli

Tag: cli/v0.15.0

Published: 2026-10-29T17:15:17Z

Prerelease: no

Release notes:

Breaking

• mistral login no longer saves your sign-in to a plain-text file when no OS

keychain is available. It fails instead: pass --insecure-storage to allow the file, or set MISTRAL_API_KEY. A sign-in already saved to a file keeps working.

• mistral apps registry update no longer applies anything off a terminal

without --yes. It used to apply an update that only refreshes vendored files or moves the registry pin when no one could answer the confirmation, as in CI, echo n | mistral apps registry update or `` starts from the code a worker deployed from disk runs, so it also works for an app whose only module is a worker.

• mistral upgrade can install from a mirror of the release binaries, for

networks that cannot reach GitHub. Set MISTRAL_DOWNLOAD_BASE_URL, or downloadBaseUrl in the CLI's config.json, and it downloads the binary and checksums.txt from there, checks the SHA-256 and replaces itself instead of running the install script. MISTRAL_LATEST_VERSION_URL (or latestVersionUrl) names a URL that returns the latest version as plain text, and MISTRAL_DOWNLOAD_AUTH (a bearer token) or ~/.netrc authenticates to a private mirror. A failed download or checksum stops the upgrade with an error naming the URL, and --dry-run prints the URLs it would fetch.

• MISTRAL_UPDATE_CHECK_TIMEOUT_MS sets how long the CLI waits when it checks

for a newer version.

Fixed

• mistral init, mistral apps registry add and mistral apps registry update

on a git registry no longer fail with no registry descriptor found at registry.json when the registry checkout they keep in the system temp folder was partly deleted. macOS removes temp files nobody opened for three days and leaves the emptied folders behind, which the CLI took for a usable checkout. It now checks the checkout is complete and checks it out again when it is not.

• Output piped to another program is no longer cut off at 64 KiB:

mistral apps capability list --json | jq stopped at byte 65,536 and failed to parse, and long tables were cut the same way. Redirecting to a file was not affected.

• mistral apps init, capability add and registry update write the

envVars of a capability that ships no template files to .env again on an npm registry. database/bucket lost all its INGESTION_* storage settings, so the app's ingestion did not use the bucket.

• mistral apps registry update updates a git-mode app whose history was

squashed, such as an app squash-merged or copied into another repository. git subtree pull used to refuse it, saying the registry subtree was never added. The update now first records the subtree at the commit .mistral/registries.json pins it to, then pulls as usual. When that file pins no commit, the update stops before changing anything and says how to record it.

• mistral apps registry update and mistral apps capability update warn

when they install a capability package from an npm registry that the app patches with bun patch at another version: the patchedDependencies entry in package.json is keyed on that version, so bun skips it without a word. The plan and the summary name each patch file with its version and the one the update installs, and the bun patch @ command that re-targets it. --json lists them as stalePatches, each { package, patch, from, to }.

• mistral apps registry update and mistral apps capability update on an app

whose node_modules is missing (a fresh clone) run bun install first, at the versions package.json pins, then plan the update as usual. They used to keep every vendored file as it was ("its installed version is not on disk") and skip every template change. When that bun install fails, the update stops before changing the app's source files and says to run bun install, then retry.

• mistral apps init naming an internal npm mirror with --registry-url or

MISTRAL_APPS_REGISTRY_URL keeps bootstrapping the default @mistralai-capabilities/registry package instead of fetching the bare URL as a registry descriptor and failing with SyntaxError: JSON Parse error: Unexpected EOF. Only a URL whose path ends in .json is still treated as a direct descriptor fetch. BUN_CONFIG_REGISTRY is now also honored as a registry-URL fallback, so the @mistralai-capabilities scope in a generated bunfig.toml follows the same mirror as Bun's own install registry.

• A check for a newer version that timed out was remembered as "no update" for

24 hours. It is now tried again on the next command.