What causes "cannot nest relay sessions" in jdx/mise?

Drop the `--relay-session` flag when already inside a relay session.

cannot nest relay sessions

Error message

cannot nest relay sessions

What it means

`mise ssh` (src/cli/ssh.rs:155) forbids opening a relay session from inside another relay session. When `--relay-session <socket>` is given and a relay `scope` is already active (inherited from an enclosing relayed command), nesting would create ambiguous socket/log routing, so run_inner bails.

Source

Thrown at src/cli/ssh.rs:155

                self.repository_dry_run,
            )?;
            return Ok(());
        }
        let scope = crate::github_relay::Scope::from_flags(
            self.github_relay_read_only,
            &self.github_relay_repo,
            self.github_relay_all_repos,
        )?;
        let scope = crate::github_relay::configure(
            scope,
            self.github_relay_log_requests,
            self.github_relay_no_log_requests,
            self.github_relay_log_format.as_deref(),
            self.github_relay_max_duration.as_deref(),
        )?;
        if let Some(socket) = self.relay_session {
            if scope.is_some() {
                bail!("cannot nest relay sessions");
            }
            #[cfg(unix)]
            {
                crate::ui::ctrlc::exit_on_ctrl_c(false);
                let mut command = self.command;
                if let Some(first) = self.destination {
                    command.insert(0, first);
                }
                return crate::system::remote::interruptible(crate::github_relay::unix::session(
                    &socket, command,
                ))
                .await;
            }
            #[cfg(not(unix))]
            bail!("GitHub relay requires a POSIX target: {}", socket.display());
        }
        let destination = self
            .destination

View on GitHub (pinned to afd2eddd3a)

Solutions

Drop the `--relay-session` flag when already inside a relay session.
Run the nested command directly (outside the relayed environment) instead.
Guard wrapper scripts to only add `--relay-session` when no relay scope is active.

Example fix

// before
mise ssh host --relay-session /tmp/relay.sock  # run inside an existing relay session

// after
mise ssh host  # relay flag omitted inside an active relay scope

Defensive patterns

Strategy: validation

Validate before calling

# skip relay flag when already inside a relay scope
if [ -z "$MISE_RELAY_SCOPE" ]; then EXTRA=(--relay-session /tmp/relay.sock); fi

Prevention

Only pass --relay-session at the outermost command.
Detect an active relay scope in wrappers before adding the flag.
Avoid recursive mise ssh invocations over relay.

When it happens

Trigger: Running `mise ssh --relay-session <socket> ...` from within a command already executed under a relay scope, i.e. passing the relay-session flag while `scope` is Some.

Common situations: Shell profiles or wrappers that always inject `--relay-session` running inside an already-relayed SSH command; manually re-running a relayed command copy-pasted from a relayed shell; automation invoking mise ssh recursively over relay.

Understand the failure class

Background: "Invalid state transition" errors: "status must be X, actually Y", "already rejected/charging/uninstalled", "cannot ... while running" — what they mean when a library rejects your call — this error's family across 31 libraries.

Related errors

AI-assisted analysis of jdx/mise@afd2eddd3a (2026-09-09). Data as JSON: /api/errors/7434f00d1e1b8ad0. Report an issue: GitHub.