{"record":{"id":"c28b89117472d7ef","repo":"jdx/mise","slug":"changed-requires-trusted-configuration","errorCode":null,"errorMessage":"--changed requires trusted configuration: {}","messagePattern":"--changed requires trusted configuration: (.+?)","errorType":"console","errorClass":null,"httpStatus":null,"severity":"error","filePath":"src/cli/dotfiles/add.rs","lineNumber":134,"sourceCode":"\n    async fn run_inner(mut self, mode: FileMode) -> Result<()> {\n        let config = Config::get().await?;\n        let secrets = system::secrets::resolve(&config, self.prompt_secrets)?;\n        let managed = system::files::files_from_config(&config)?;\n        if self.changed {\n            for req in &managed {\n                if req.mode == FileMode::Copy\n                    && req.target.is_file()\n                    && !req.target.is_symlink()\n                    && !req.source.is_dir()\n                    && matches!(\n                        system::files::check(&config, req, &secrets)?,\n                        system::files::FileState::Differs(_)\n                    )\n                {\n                    if !is_global_config(&req.origin.config) && !is_path_trusted(&req.origin.config)\n                    {\n                        bail!(\n                            \"--changed requires trusted configuration: {}\",\n                            req.origin.config.display_user()\n                        );\n                    }\n                    self.targets.push(req.target_raw.clone());\n                }\n            }\n            if self.targets.is_empty() {\n                super::warn_if_dotfiles_ignored();\n                info!(\"dotfiles: no changed copy-mode files\");\n                return Ok(());\n            }\n        }\n        let config_path = resolve_target_config_path(ConfigPathOptions {\n            global: self.global || !self.local,\n            path: self.path.clone(),\n            env: None,\n            cwd: None,","sourceCodeStart":116,"sourceCodeEnd":152,"githubUrl":"https://github.com/jdx/mise/blob/533346cc374382b41ec5ff70536252b2e96e725c/src/cli/dotfiles/add.rs#L116-L152","documentation":"When `mise dotfiles add --changed` detects files whose content differs, it adds them as targets — but only if the config file that recorded them is trusted. Untrusted (unverified) config files are refused in run_inner to prevent untrusted code or paths from silently redirecting your dotfiles; the error names the offending config path.","triggerScenarios":"Running `mise dotfiles add --changed` where a differing file's request originates from a config that is neither the global config nor in the trusted set (is_global_config / is_path_trusted both false) in run_inner.","commonSituations":"Cloning a dotfiles repo with a project mise config and running --changed before trusting it; a config moved to a new path losing its trusted status; working in CI where trust was never granted.","solutions":["Trust the configuration file: `mise trust <path-to-config>` shown in the error message.","Verify the config path is what you expect before trusting (it determines which changed files get added).","Run the command against the global config, or move the relevant entries into the trusted global config."],"exampleFix":"// before\n$ mise dotfiles add --changed\nError: --changed requires trusted configuration: ~/work/project/mise.toml\n\n// after\n$ mise trust ~/work/project/mise.toml\n$ mise dotfiles add --changed","handlingStrategy":"try-catch","validationCode":"# ensure the originating config is trusted before --changed\nmise dotfiles add --changed || mise trust <config-path-from-error>","typeGuard":null,"tryCatchPattern":"match result {\n    Err(e) if e.to_string().contains(\"requires trusted configuration\") => {\n        let path = extract_config_path(&e);\n        verify_and_trust(&path)?; // inspect the file, then `mise trust`\n        result = run_add_changed();\n    }\n    other => other?,\n}","preventionTips":["Run `mise trust` immediately after cloning repos with mise configs.","Inspect untrusted config files before trusting them.","In CI, pre-trust known-good config paths during image build."],"tags":["dotfiles","trust","security","cli"],"backgroundTag":"authentication-required","analyzedSha":"533346cc374382b41ec5ff70536252b2e96e725c","analyzedAt":"2026-09-17T13:35:38.149Z","contentChangedAt":"2026-09-17T13:35:38.149Z","schemaVersion":2},"datasetVersion":"2026-09-23T08:17:48.524Z"}