{"record":{"id":"2c978f90b3e4a732","repo":"jdx/mise","slug":"err","errorCode":null,"errorMessage":"{} {err}","messagePattern":"\\{\\} \\{err\\}","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"src/cli/exec.rs","lineNumber":411,"sourceCode":"    };\n    if crate::file::is_active_mise_shim(std::path::Path::new(&program)) {\n        return Err(eyre::eyre!(\n            \"recursive shim invocation detected: {}\",\n            program.to_string_lossy()\n        ));\n    }\n    env::remove_var(env::MISE_SHIM_PATH_ENV);\n    // Apply sandbox (Landlock/seccomp on Linux, sandbox-exec on macOS)\n    let args_str: Vec<String> = args\n        .iter()\n        .map(|a| a.to_string_lossy().into_owned())\n        .collect();\n    if let Some(sandboxed) = sandbox.apply(&program.to_string_lossy(), &args_str).await? {\n        // macOS: exec through sandbox-exec\n        let err = exec::Command::new(&sandboxed.program)\n            .args(&sandboxed.args)\n            .exec();\n        bail!(\"{} {err}\", sandboxed.program);\n    }\n\n    let err = exec::Command::new(program.clone()).args(&args).exec();\n    let mut msg = format!(\"{:?} {err}\", program.to_string_lossy());\n    // The bin never resolved on PATH. If an installed-but-unconfigured tool\n    // would have provided it, say so instead of leaving the user with a bare\n    // ENOENT (discussion #4407).\n    if resolution_failed && let Some(hint) = crate::shims::exec_resolution_hint(&program_name).await\n    {\n        msg.push_str(\"\\n\\n\");\n        msg.push_str(&hint);\n    }\n    bail!(\"{msg}\")\n}\n\n/// The opaque `cannot find binary path`, plus an explanation when an\n/// installed-but-unconfigured tool would have provided the bin. `mise install`\n/// writes to no config file, so its tool dirs never join the PATH `mise exec`","sourceCodeStart":393,"sourceCodeEnd":429,"githubUrl":"https://github.com/jdx/mise/blob/6f52dcdf99e282ef7a7db68c81301fa4618d0f79/src/cli/exec.rs#L393-L429","documentation":"On macOS, `mise exec --sandbox` re-execs the command through `sandbox-exec`. This error means the `exec(2)` of that sandbox wrapper itself failed — `Command::exec()` only returns on failure — and the message pairs the sandboxed program path with the OS error (ENOENT for a missing sandbox-exec, EACCES, E2BIG, ...). The intended program never ran; this is the sandbox plumbing failing, not your command.","triggerScenarios":"`mise exec --sandbox -- <cmd>` on macOS where `sandbox.apply()` produced a sandbox-exec invocation but `exec::Command::new(&sandboxed.program).exec()` returns an error: the sandbox-exec binary is absent from PATH, the sandboxed program string points somewhere non-executable, or the accumulated environment/argv exceeds OS limits (E2BIG).","commonSituations":"Minimal macOS CI images or containers where `/usr/bin/sandbox-exec` is stripped; PATH reordered by mise so the wrapper resolves badly; extremely long argument lists or environments; a sandboxed program path with characters the wrapper mishandles.","solutions":["Read the OS error suffix: ENOENT → ensure `/usr/bin/sandbox-exec` exists and is on PATH; EACCES → fix execute permissions; E2BIG → trim env/args","Retry without `--sandbox` to confirm the command and PATH are otherwise fine, then re-enable sandboxing","Remember this branch is macOS-only — on Linux mise uses Landlock/seccomp in-process, so do not chase sandbox-exec there","Inspect the sandboxed.program string printed in the message if the wrapper path itself looks wrong"],"exampleFix":"# before\n$ mise x --sandbox -- my-tool --flag\nError: /usr/bin/sandbox-exec ... (No such file or directory)\n\n# after\n$ mise x -- my-tool --flag   # confirm the binary runs, then fix sandbox-exec availability","handlingStrategy":"try-catch","validationCode":"# macOS: confirm sandbox-exec exists before sandboxed runs\ncommand -v sandbox-exec >/dev/null || { echo 'sandbox-exec missing' >&2; exit 2; }","typeGuard":null,"tryCatchPattern":"mise x --sandbox -- cmd 2>err.log || { grep -q 'sandbox' err.log && mise x -- cmd; } # fall back to unsandboxed only if policy allows","preventionTips":["Pin --sandbox usage to machines that ship sandbox-exec","Keep exec env/args modest to avoid E2BIG under the wrapper","Log the full error string — the OS errno suffix is the actionable part"],"tags":["mise","exec","sandbox","macos","exec-syscall"],"backgroundTag":"command-exec-failure","analyzedSha":"6f52dcdf99e282ef7a7db68c81301fa4618d0f79","analyzedAt":"2026-08-22T10:14:23.840Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-08T15:18:49.778Z"}