{"record":{"id":"c28b89117472d7ef","repo":"jdx/mise","slug":"changed-requires-trusted-configuration","errorCode":null,"errorMessage":"--changed requires trusted configuration: {}","messagePattern":"--changed requires trusted configuration: (.+?)","errorType":"console","errorClass":null,"httpStatus":null,"severity":"error","filePath":"src/cli/dotfiles/add.rs","lineNumber":129,"sourceCode":"    }\n\n    async fn run_inner(mut self, mode: FileMode) -> Result<()> {\n        let config = Config::get().await?;\n        let managed = system::files::files_from_config(&config)?;\n        if self.changed {\n            for req in &managed {\n                if req.mode == FileMode::Copy\n                    && req.target.is_file()\n                    && !req.target.is_symlink()\n                    && !req.source.is_dir()\n                    && matches!(\n                        system::files::check(&config, req)?,\n                        system::files::FileState::Differs(_)\n                    )\n                {\n                    if !is_global_config(&req.origin.config) && !is_path_trusted(&req.origin.config)\n                    {\n                        bail!(\n                            \"--changed requires trusted configuration: {}\",\n                            req.origin.config.display_user()\n                        );\n                    }\n                    self.targets.push(req.target_raw.clone());\n                }\n            }\n            if self.targets.is_empty() {\n                super::warn_if_dotfiles_ignored();\n                info!(\"dotfiles: no changed copy-mode files\");\n                return Ok(());\n            }\n        }\n        let config_path = resolve_target_config_path(ConfigPathOptions {\n            global: self.global || !self.local,\n            path: self.path.clone(),\n            env: None,\n            cwd: None,","sourceCodeStart":111,"sourceCodeEnd":147,"githubUrl":"https://github.com/jdx/mise/blob/afd2eddd3a50c16190efc1c7e94404b48f72af57/src/cli/dotfiles/add.rs#L111-L147","documentation":"`--changed` lets `dotfiles add` skip explicit targets by inspecting which files differ from their tracked state. Because that inspection reads managed-file requirements defined in a config file, mise requires the config that declares those dotfiles to be trusted (global config is implicitly trusted; local/path configs must be explicitly trusted via `mise trust`). run_inner bails when a differing requirement originates from an untrusted, non-global config.","triggerScenarios":"Running `mise bootstrap dotfiles add --changed` (or with --changed plus other targets) where the differing tracked requirement comes from a config file that is neither the global config nor in mise's trusted path set. Typical right after cloning a repo with a mise.toml containing [dotfiles] entries.","commonSituations":"Fresh clones of dotfiles repositories; CI environments where config files were never trusted; switching machines before running `mise trust`.","solutions":["Run `mise trust` (or `mise trust <config path>`) on the config file declaring the dotfiles, then re-run the command.","Pass the target explicitly instead of using --changed so no trust check is needed.","Move the [dotfiles] entries into the global config, which is implicitly trusted."],"exampleFix":"# before\nmise bootstrap dotfiles add --changed\n# after\nmise trust ~/projects/dotfiles/mise.toml\nmise bootstrap dotfiles add --changed","handlingStrategy":"validation","validationCode":"// ensure trust before using --changed\nimport { execSync } from 'node:child_process';\nexecSync('mise trust', { stdio: 'inherit' }); // idempotent for already-trusted configs\nexecSync('mise bootstrap dotfiles add --changed');","typeGuard":null,"tryCatchPattern":"try {\n  execSync('mise bootstrap dotfiles add --changed');\n} catch (e) {\n  if (String(e.stderr).includes('--changed requires trusted configuration')) {\n    execSync('mise trust');\n    execSync('mise bootstrap dotfiles add --changed');\n  } else throw e;\n}","preventionTips":["Run `mise trust` right after cloning any repo containing mise.toml with [dotfiles].","Keep dotfiles entries in the global config when scripts must run unattended without trust prompts.","Prefer explicit targets over --changed in CI."],"tags":["cli","dotfiles","security","trust"],"backgroundTag":"authentication-required","analyzedSha":"afd2eddd3a50c16190efc1c7e94404b48f72af57","analyzedAt":"2026-09-09T01:38:25.179Z","contentChangedAt":"2026-09-09T01:38:25.179Z","schemaVersion":2},"datasetVersion":"2026-09-14T05:17:10.506Z"}