jdx/mise · error

brew-cask:{}: invalid {kind} {field} path {}

Error message

brew-cask:{}: invalid {kind} {field} path {}

What it means

After parsing a cask move/rename path (base + path), the path string is validated by validate_flight_relative_path: it must be a safe relative path (no absolute paths, no `..` traversal components when based on staged_path). This error fires when the path value fails that validation.

Source

Thrown at src/system/packages/brew/cask/artifacts.rs:1083

            "brew-cask:{}: unsupported {kind} {field} metadata format",
            cask.token
        )
    })?;
    let base = match object.get("base").and_then(Value::as_str) {
        Some("staged_path") => FlightPathBase::StagedPath,
        Some(base) => bail!(
            "brew-cask:{}: unsupported {kind} {field} base {}",
            cask.token,
            base
        ),
        None => bail!("brew-cask:{}: unsupported {kind} {field} base", cask.token),
    };
    let path = object
        .get("path")
        .and_then(Value::as_str)
        .ok_or_else(|| eyre!("brew-cask:{}: unsupported {kind} {field} path", cask.token))?;
    if validate_flight_relative_path(path).is_err() {
        bail!(
            "brew-cask:{}: invalid {kind} {field} path {}",
            cask.token,
            path
        )
    }
    Ok(FlightPath {
        base,
        path: path.to_string(),
    })
}

pub(super) fn collect_pkg_receipt_ids(value: &Value, pkg_ids: &mut Vec<String>) {
    let Some(object) = value.as_object() else {
        return;
    };
    let Some(metadata) = object.get("uninstall") else {
        return;
    };

View on GitHub (pinned to afd2eddd3a)

Solutions

1. Change the path to a relative path within the staged cask directory (no leading `/`, no `..` segments).
2. If an absolute destination is truly needed, express it via the appropriate base + relative path rather than an absolute string.
3. Inspect the cask for accidental path mangling (spaces, escaped slashes) and correct it.
4. Treat this as a red flag for untrusted taps: verify the cask source before trusting its move targets.

Example fix

// before
{ "base": "staged_path", "path": "/Applications/Foo.app" }
// after
{ "base": "staged_path", "path": "Foo.app" }

function isSafeRelativePath(p) {
  return typeof p === "string" && !p.startsWith("/") && !p.split("/").includes("..");
}

function isSafeFlightPath(p: string): p is string {
  return !p.startsWith("/") && !p.split("/").includes("..");
}

try {
  installCask(token);
} catch (e) {
  if (String(e).includes("invalid") && String(e).includes("path")) {
    console.warn(`Cask ${token} move path failed validation — refusing untrusted path`);
  } else throw e;
}

When it happens

Trigger: A cask path like "/Applications/Foo.app" (absolute) or "../Foo.app" (parent-directory traversal), or a non-sensical relative path, passed in a move/rename path object.

Common situations: Casks moving staged files to absolute destinations (which Homebrew handles differently), malicious or mis-edited casks attempting traversal outside the staging area, and paths with stray leading slashes or `.` components the validator rejects.

Understand the failure class

Background: "Invalid ... format", "must be in format X", "does not look like a ..." — invalid argument format errors across CLI tools and libraries — this error's family across 17 libraries.

Related errors

• brew-cask: binary target '{}' must be under {}
• brew-cask:{}: unsupported {kind} run guard platform
• brew-cask:{}: unsupported {kind} run guard condition {}
• brew-cask:{}: unsupported {kind} run guard condition
• brew-cask:{}: unsupported {kind} {field} base {}

AI-assisted analysis of jdx/mise@afd2eddd3a (2026-09-09). Data as JSON: /api/errors/4397af13e9fa600c. Report an issue: GitHub.