{"record":{"id":"ef392a4a18b65cd6","repo":"jdx/mise","slug":"privileged-path-inspection-returned-an-unexpected","errorCode":null,"errorMessage":"privileged path inspection returned an unexpected result count","messagePattern":"privileged path inspection returned an unexpected result count","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"src/system/managed_files.rs","lineNumber":1050,"sourceCode":"    if privileged.is_empty() {\n        return Ok(());\n    }\n    let input = serde_json::to_vec(&PrivilegedInspectionPlan { paths: privileged })?;\n    let executable = std::env::current_exe()?.to_string_lossy().to_string();\n    let output = crate::system::sudo::run_with_input_output(\n        &executable,\n        &[\n            \"--no-config\".to_string(),\n            \"--no-env\".to_string(),\n            \"--no-hooks\".to_string(),\n            \"bootstrap\".to_string(),\n            \"__inspect-system-files\".to_string(),\n        ],\n        &input,\n    )?;\n    let inspections: Vec<PathInspection> = serde_json::from_slice(&output)?;\n    if inspections.len() != targets.len() {\n        bail!(\"privileged path inspection returned an unexpected result count\");\n    }\n    for (target, inspection) in targets.into_iter().zip(inspections) {\n        match target {\n            Target::File(index) => files[index].inspection = Some(inspection),\n            Target::Directory(index) => directories[index].inspection = Some(inspection),\n        }\n    }\n    Ok(())\n}\n\nfn plan_directory(request: &ManagedDirectoryRequest) -> Result<ResourcePlan> {\n    let desired = match request.state {\n        ManagedState::Present => desired_metadata(\n            \"directory\",\n            request.mode,\n            request.owner.as_deref(),\n            request.group.as_deref(),\n        ),","sourceCodeStart":1032,"sourceCodeEnd":1068,"githubUrl":"https://github.com/jdx/mise/blob/9dcfcaa0dc8747a2577d3270b69bb9d8313b2807/src/system/managed_files.rs#L1032-L1068","documentation":"When mise must elevate to inspect managed paths, it re-executes itself as a privileged helper (<exe> --no-config --no-env --no-hooks bootstrap __inspect-system-files) and parses stdout as JSON, expecting exactly one PathInspection record per requested target. This error means the helper returned a different record count than targets, so results cannot be zipped onto requests; mise aborts rather than associate metadata with the wrong paths.","triggerScenarios":"sudo PATH/secure_path resolution picks a different (older or newer) mise binary than the invoking one; a wrapper script or shim intercepts the elevated exec and alters output; truncated or corrupted stdout from the helper; a modified build emitting a different record count.","commonSituations":"mise installed twice (e.g. /usr/bin/mise and ~/.local/bin/mise) and sudo secure_path resolves the stale one after an upgrade; a root-only wrapper in PATH rewrites mise output.","solutions":["Verify the same binary gets elevated: compare mise --version with sudo \"$(command -v mise)\" --version and make them match","Remove the duplicate mise install or fix sudo secure_path / PATH so root resolves the identical mise","Re-run the bootstrap after fixing binary pairing","If versions match and it still fails, run sudo \"$(command -v mise)\" --no-config --no-env --no-hooks bootstrap __inspect-system-files manually with the JSON input to inspect output, then report a bug with both versions"],"exampleFix":"# before: sudo may resolve a different mise from PATH\nsudo mise bootstrap\n\n# after: elevate the exact same binary the user runs\nsudo \"$(command -v mise)\" bootstrap","handlingStrategy":"retry","validationCode":"// before invoking the privileged flow, confirm root sees the same binary\nuse std::process::Command;\nlet mine = std::env::current_exe()?;\nlet out = Command::new(\"sudo\").arg(&mine).arg(\"--version\").output()?;\nif !out.status.success() {\n    return Err(eyre::eyre!(\"cannot elevate {:?} to verify version parity\", mine));\n}","typeGuard":null,"tryCatchPattern":"match inspect_privileged(&targets).await {\n    Err(e) if e.to_string().contains(\"unexpected result count\") => {\n        // verify mise binary pairing (mise --version vs sudo mise --version),\n        // fix PATH/secure_path, then retry the bootstrap once\n    }\n    other => other,\n}","preventionTips":["Keep exactly one mise install per machine","After upgrading mise, confirm sudo resolves the same binary path","Avoid wrappers or shims that rewrite mise output for root"],"tags":["subprocess","privilege-elevation","invariant","json","bootstrap"],"backgroundTag":"subprocess-output-mismatch","analyzedSha":"9dcfcaa0dc8747a2577d3270b69bb9d8313b2807","analyzedAt":"2026-08-17T14:28:50.624Z","schemaVersion":2},"datasetVersion":"2026-08-21T18:17:14.833Z"}