{"record":{"id":"13a7fb1a3ff32916","repo":"jdx/mise","slug":"paranoid-mode-is-enabled-refusing-to-install-comm-13a7fb","errorCode":null,"errorMessage":"Paranoid mode is enabled, refusing to install community-developed plugin","messagePattern":"Paranoid mode is enabled, refusing to install community-developed plugin","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"src/plugins/vfox_plugin.rs","lineNumber":296,"sourceCode":"            return Ok(());\n        }\n\n        let settings = Settings::try_get()?;\n        if !force {\n            if self.is_installed() {\n                return Ok(());\n            }\n            if !settings.yes && self.repo_url.lock().unwrap().is_none() {\n                let url = self.get_repo_url(config)?;\n                let url_string = url.to_string();\n                if !registry::is_trusted_plugin(self.name(), &url_string) {\n                    warn!(\n                        \"⚠️ {} is a community-developed plugin – {}\",\n                        style(&self.name).blue(),\n                        style(&url_string.trim_end_matches(\".git\")).yellow()\n                    );\n                    if settings.paranoid {\n                        bail!(\n                            \"Paranoid mode is enabled, refusing to install community-developed plugin\"\n                        );\n                    }\n                    if !prompt::confirm_with_all(format!(\n                        \"Would you like to install {}?\",\n                        self.name\n                    ))?\n                    .is_yes()\n                    {\n                        Err(PluginNotInstalled(self.name.clone()))?\n                    }\n                }\n            }\n        }\n\n        let prefix = format!(\"plugin:{}\", style(&self.name).blue().for_stderr());\n        let pr = mpr.add_with_options(&prefix, dry_run);\n        if !dry_run {","sourceCodeStart":278,"sourceCodeEnd":314,"githubUrl":"https://github.com/jdx/mise/blob/afd2eddd3a50c16190efc1c7e94404b48f72af57/src/plugins/vfox_plugin.rs#L278-L314","documentation":"mise's paranoid mode blocks installation of community-developed (third-party) vfox/asdf plugins. Because community plugins execute arbitrary install hooks and shell code, paranoid mode refuses to install them automatically instead of just warning. The check fires in ensure_installed after the plugin URL warning is printed, before the interactive confirmation prompt.","triggerScenarios":"Running any command that needs a plugin not shipped as a core/backend builtin (e.g. `mise use vfox:some/plugin`, `mise install`) while the `paranoid` setting is enabled, and the plugin resolves to a community-developed plugin rather than a trusted source.","commonSituations":"Users who enabled `settings.paranoid = true` in global config for supply-chain safety then try to install a tool whose backend is an external community plugin; CI environments with paranoid mode set that encounter a project .mise.toml/.tool-versions referencing a third-party plugin, where the interactive confirm prompt can never be answered.","solutions":["If you trust the plugin, disable paranoid mode: `mise settings set paranoid false` (or unset it if set via MISE_PARANOID env var).","Prefer a non-plugin backend for the tool (aqua:, github:, npm:, cargo:, or a core backend) so no community plugin install is required.","Vet the plugin source URL, then install it explicitly once with paranoid off, and re-enable paranoid mode afterwards.","In CI, pre-install the plugin in a setup step with paranoid mode disabled instead of relying on the prompt."],"exampleFix":"// before (mise.toml referencing a community plugin, paranoid on)\n[tools]\nmytool = \"vfox:community/mytool\" // refuses under paranoid mode\n\n// after: use a trusted backend instead\n[tools]\nmytool = \"github:community/mytool-repo\"","handlingStrategy":"validation","validationCode":"// bash: fail fast in CI if paranoid mode would block a plugin install\nif [ \"$(mise settings get paranoid)\" = \"true\" ]; then\n  mise ls-remote --plugin vfox:community/mytool >/dev/null 2>&1 && \\\n    echo 'paranoid mode on: pre-install the plugin in a setup step' && exit 1\nfi","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Check `mise settings get paranoid` before relying on community plugins.","Prefer first-party backends (aqua:, github:, npm:, core) over vfox/asdf community plugins.","Pre-install plugins in CI setup steps rather than during task execution.","Vet plugin sources and keep an allowlist of trusted plugin URLs."],"tags":["security","plugins","config","rust"],"backgroundTag":"insufficient-permissions","analyzedSha":"afd2eddd3a50c16190efc1c7e94404b48f72af57","analyzedAt":"2026-09-09T01:38:25.179Z","contentChangedAt":"2026-09-09T01:38:25.179Z","schemaVersion":2},"datasetVersion":"2026-09-14T05:17:10.506Z"}