bootstrap user '{name}' {field} must not contain ':', CR, or

Error message

bootstrap user '{name}' {field} must not contain ':', CR, or LF

What it means

`validate_account_path` rejects `home`/`shell` paths containing `:`, CR, or LF. The colon is the field separator in `/etc/passwd`, and newlines would corrupt the account database (and the privileged JSON/stdin plan), so any such character in a user path is a config error. The check is done on the lossy string form of the path.

Source

Thrown at src/system/accounts.rs:734

        });
    if !valid {
        bail!(
            "invalid bootstrap {kind} name '{name}': use at most 32 ASCII letters, digits, '_' or '-', with an optional trailing '$'"
        );
    }
    Ok(())
}

fn validate_account_path(name: &str, field: &str, path: &std::path::Path) -> Result<()> {
    if !path.is_absolute() {
        bail!("bootstrap user '{name}' {field} must be an absolute path");
    }
    if path
        .to_string_lossy()
        .chars()
        .any(|character| character == ':' || character == '\n' || character == '\r')
    {
        bail!("bootstrap user '{name}' {field} must not contain ':', CR, or LF");
    }
    Ok(())
}

pub fn plans(requests: &AccountRequests) -> Vec<ResourcePlan> {
    requests
        .groups
        .iter()
        .map(GroupRequest::plan)
        .chain(requests.users.iter().map(UserRequest::plan))
        .collect()
}

pub fn apply(requests: &AccountRequests, dry_run: bool, yes: bool) -> Result<bool> {
    let mut actions = vec![];
    let mut unknown = vec![];
    for group in requests
        .groups

View on GitHub (pinned to 9dcfcaa0dc)

Solutions

Remove `:`, CR, and LF characters from the `home`/`shell` value; use a plain absolute path like `/home/mise`.
If the file was edited on Windows, re-save with LF line endings (`.gitattributes` `* text=auto eol=lf` or editor setting) and re-check the quoted values.
Re-run `mise bootstrap accounts status` to confirm parsing succeeds.

Example fix

# before
[bootstrap.users.ci]
group = "ci"
home = "/home/ci:builder"

# after
[bootstrap.users.ci]
group = "ci"
home = "/home/ci-builder"

Defensive patterns

Strategy: validation

Validate before calling

// reject ':' and control characters (CR/LF) before invoking accounts commands
fn path_chars_ok(p: &std::path::Path) -> bool {
    !p.to_string_lossy().chars().any(|c| c == ':' || c.is_control())
}

Prevention

Keep mise.toml saved with LF line endings, especially when edited on Windows.
Never build home/shell paths by concatenating user-supplied strings that may contain ':' or newlines.

When it happens

Trigger: A `[bootstrap.users.<name>]` entry sets `home = "/home/a:b"`, `shell = "/bin/sh\n"`, or a path that picked up a carriage return (e.g. edited on Windows without newline normalization). `UserRequest::from_toml` bails during config parsing with the offending user name and field.

Common situations: Windows-authored mise.toml with CRLF line endings embedding `\r` into quoted strings; creative home directory names containing colons; copy-paste from a spreadsheet or chat that introduced a line break inside the value.

Related errors

AI-assisted analysis of jdx/mise@9dcfcaa0dc (2026-08-17). Data as JSON: /api/errors/8df2f6056b5c0075. Report an issue: GitHub.