{"record":{"id":"eee6d32e28fd8a06","repo":"jdx/mise","slug":"refusing-unsafe-change-to-bootstrap-user-ins","errorCode":null,"errorMessage":"refusing unsafe change to bootstrap user '{}'; inspect `mise bootstrap plan`","messagePattern":"refusing unsafe change to bootstrap user '(.+?)'; inspect `mise bootstrap plan`","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"src/system/accounts.rs","lineNumber":546,"sourceCode":"                groups.iter().cloned().collect::<Vec<_>>().join(\",\")\n            ));\n        }\n        if let Some(home) = &self.home {\n            parts.push(format!(\"home {}\", home.display()));\n        }\n        if let Some(shell) = &self.shell {\n            parts.push(format!(\"shell {}\", shell.display()));\n        }\n        if let Some(comment) = &self.comment {\n            parts.push(format!(\"comment {comment}\"));\n        }\n        parts.join(\"; \")\n    }\n\n    fn action(&self) -> Result<Option<AccountAction>> {\n        match self.plan().action {\n            ResourceAction::Noop => Ok(None),\n            ResourceAction::Unknown => bail!(\n                \"refusing unsafe change to bootstrap user '{}'; inspect `mise bootstrap plan`\",\n                self.name\n            ),\n            ResourceAction::Create => Ok(Some(AccountAction::CreateUser {\n                name: self.name.clone(),\n                uid: self.uid,\n                group: self\n                    .group\n                    .clone()\n                    .expect(\"present user has a primary group\"),\n                groups: self\n                    .groups\n                    .as_ref()\n                    .map(|groups| groups.iter().cloned().collect())\n                    .unwrap_or_default(),\n                home: self.home.clone(),\n                shell: self.shell.clone(),\n                comment: self.comment.clone(),","sourceCodeStart":528,"sourceCodeEnd":564,"githubUrl":"https://github.com/jdx/mise/blob/533346cc374382b41ec5ff70536252b2e96e725c/src/system/accounts.rs#L528-L564","documentation":"When applying bootstrap changes, if the computed plan for a user yields ResourceAction::Unknown, mise refuses to proceed rather than guess at a destructive change. 'Unknown' means the live system state could not be reconciled with the declaration (e.g. ambiguous user state), so the safe behavior is to bail and ask the operator to inspect the plan.","triggerScenarios":"Running `mise bootstrap apply` (or similar) when a declared user's computed plan action is Unknown — typically due to inconsistent or unverifiable live system state for that account.","commonSituations":"Manual edits to /etc/passwd leaving a user in a state mise cannot classify; a user declared absent but detected present with unmanaged attributes; partially failed prior bootstrap runs.","solutions":["Run `mise bootstrap plan` and read the reported action for the offending user.","Reconcile the live account state manually (userdel/usermod) so the plan becomes Create/Remove/Noop.","Align the declaration (state and attributes) with the actual system state, then re-apply."],"exampleFix":null,"handlingStrategy":"try-catch","validationCode":"const plan = await mise.bootstrap.plan(config);\nconst unsafe = plan.users.filter((u) => u.action === 'unknown');\nif (unsafe.length) throw new Error(`Unsafe plan for users: ${unsafe.map((u) => u.name).join(', ')}`);","typeGuard":null,"tryCatchPattern":"try {\n  await mise.bootstrap.apply(config);\n} catch (e) {\n  if (String(e).includes('refusing unsafe change to bootstrap user')) {\n    console.error('Inspect `mise bootstrap plan`, reconcile the live account, then retry.');\n  } else throw e;\n}","preventionTips":["Always run `mise bootstrap plan` before apply.","Avoid hand-editing /etc/passwd on hosts managed by bootstrap.","Re-run plan after any manual account changes."],"tags":["bootstrap","safety","plan"],"backgroundTag":"invalid-state-transition","analyzedSha":"533346cc374382b41ec5ff70536252b2e96e725c","analyzedAt":"2026-09-17T13:35:38.149Z","contentChangedAt":"2026-09-17T13:35:38.149Z","schemaVersion":2},"datasetVersion":"2026-09-23T08:17:48.524Z"}