{name} is not installed beside the Astrid CLI; refusing a PA

Error message

{name} is not installed beside the Astrid CLI; refusing a PATH provider for a security-sensitive mount

What it means

find_coinstalled_companion_binary deliberately does NOT consult PATH. For security-sensitive mounts it only accepts a companion binary that sits in the same directory as the running astrid CLI executable (directory.join(name + EXE_SUFFIX)); anything else could be a hijacked PATH entry. If the sibling file is missing, it bails with this message. This is stricter than find_companion_binary by design.

Source

Thrown at crates/astrid-cli/src/bootstrap.rs:120

         or available in PATH."
    )
}

/// Locate a security-sensitive companion only in the authenticated install set.
///
/// Unlike developer-oriented companion discovery, this deliberately refuses a
/// `PATH` fallback. A storage provider controls what filesystem the operator
/// sees, so the executable must be co-installed beside this CLI.
pub(crate) fn find_coinstalled_companion_binary(name: &str) -> Result<std::path::PathBuf> {
    let executable = std::env::current_exe().context("resolve the Astrid CLI executable")?;
    let directory = executable
        .parent()
        .context("the Astrid CLI executable has no installation directory")?;
    let candidate = directory.join(format!("{name}{}", std::env::consts::EXE_SUFFIX));
    if candidate.is_file() {
        return Ok(candidate);
    }
    anyhow::bail!(
        "{name} is not installed beside the Astrid CLI; refusing a PATH provider for a security-sensitive mount"
    )
}

/// Run the legacy `astrid build` companion binary, used both by the
/// hidden top-level `Build` alias and the new `astrid capsule build`.
pub(crate) fn run_build_companion(
    path: Option<&str>,
    output: Option<&str>,
    project_type: Option<&str>,
    from_mcp_json: Option<&str>,
) -> Result<ExitCode> {
    let build_bin = find_companion_binary("astrid-build")?;
    let mut cmd = std::process::Command::new(build_bin);
    if let Some(p) = path {
        cmd.arg(p);
    }
    if let Some(o) = output {

View on GitHub (pinned to affd8760f4)

Solutions

Copy or symlink the companion binary into the same directory as the astrid CLI executable.
Install the complete distribution into one prefix so all binaries are co-located.
Run the astrid CLI from its installed location rather than via cargo run / ad-hoc build output.
If packaging splits binaries, patch the locator to consult your package's libexec directory.

Example fix

# before: astrid in ~/.local/bin, companion elsewhere
$ which astrid-mount && ls ~/.local/bin/astrid-secure-mount
~/.local/bin/astrid-mount: ok
ls: ~/.local/bin/astrid-secure-mount: No such file

# after: co-install the companion
$ ln -s /opt/astrid/bin/astrid-secure-mount ~/.local/bin/astrid-secure-mount

Defensive patterns

Strategy: validation

Validate before calling

let exe = std::env::current_exe()?;
let dir = exe.parent().context("no install dir")?;
let name = "astrid-secure-mount";
if !dir.join(format!("{name}{}", std::env::consts::EXE_SUFFIX)).is_file() {
    eprintln!("{name} must sit beside the astrid executable for secure mounts");
}

Type guard

fn coinstalled(name: &str) -> bool {
    std::env::current_exe().ok()
        .and_then(|p| p.parent().map(|d| d.join(format!("{name}{}", std::env::consts::EXE_SUFFIX)).is_file()))
        .unwrap_or(false)
}

Try / catch

match find_coinstalled_companion_binary("astrid-secure-mount") {
    Ok(p) => { /* use p */ }
    Err(e) if e.to_string().contains("refusing a PATH provider") => {
        eprintln!("co-install the companion next to the astrid binary");
    }
    Err(e) => return Err(e),
}

Prevention

Co-locate all astrid binaries in one directory at install time.
Do not rely on PATH for security-sensitive companions — that is intentionally unsupported.
Avoid running via `cargo run` for secure-mount flows; run the installed binary.
In packages (deb/nix), keep companions in the same libexec prefix the CLI resolves.

When it happens

Trigger: Calling find_coinstalled_companion_binary when the companion binary is available via PATH but not physically located in the astrid CLI executable's parent directory (or the CLI itself is run from a temp/cargo target path).

Common situations: User symlinked only the astrid binary into ~/.local/bin but companions live elsewhere; running astrid via cargo run where companions aren't co-installed; Nix/distro packaging splitting binaries into different directories; a mount-security code path that intentionally rejects PATH resolution.

Related errors

AI-assisted analysis of astrid-runtime/astrid@affd8760f4 (2026-09-09). Data as JSON: /api/errors/eeb6c9953ecb1ede. Report an issue: GitHub.