jdx/mise · error · ShimUnsupportedError

cask uses `# `, which mise's cask shim does not support

Error message

cask uses `#{feature}`, which mise's cask shim does not support

What it means

After resolving a remote task's Git checkout, mise validates that the requested path (including symlink resolution via canonicalize) still lies inside the checkout root. If the canonicalized path escapes the checkout — e.g. through a symlink pointing outside — mise refuses to read it, preventing a remote task from pulling in arbitrary local files.

Solutions

Fix the remote task URL to point at a real path inside the repository (not a symlink escaping it).
Remove or replace out-of-tree symlinks in the remote task repository.
If you need files from another repo, reference that repo as its own remote task source.

Example fix

// before
tasks = ["github:org/repo#/tasks/link-to-etc-passwd"]

// after
tasks = ["github:org/repo#/tasks/build.sh"]

Defensive patterns

Strategy: validation

Validate before calling

// Before referencing a remote task path, confirm the repo path is a real in-tree file
git ls-tree -r --name-only HEAD | grep '^tasks/build.sh$'

Try / catch

// Treat as a security rejection — do not retry with workarounds
match err {
    Err(e) if e.to_string().contains("escapes its Git checkout") => warn_user_and_abort(e),
    _ => continue,
}

Prevention

Never point remote task URLs at symlinked paths.
Audit remote task repositories for symlinks that escape the checkout.
Pin remote task sources to a specific revision you have reviewed.

When it happens

Trigger: Installing/resolving a remote task (remote_task_git provider) where the requested sub-path resolves (via symlink or `..` traversal after canonicalization) outside the cloned repository; validate_remote_git_path is called from resolve_git_url_to_path and prepare_remote_path.

Common situations: A remote task URL pointing at a path that is a symlink to another location; a malicious or misconfigured remote task repository containing symlinks out of the checkout; typos in the in-repo path combined with a symlink named similarly.

Understand the failure class

Background: Path traversal blocked: "path escapes the workspace" and "outside site root" errors when a path will not stay inside its allowed directory — this error's family across 26 libraries.

Related errors

AI-assisted analysis of jdx/mise@533346cc37 (2026-09-17). Data as JSON: /api/errors/4fe068c1bae2bdb7. Report an issue: GitHub.

Appendix: source

Thrown at src/system/packages/brew/cask_shim.rb:51

end

MISE_BREW_CASK_FILE = Pathname.new(ENV.fetch("MISE_BREW_CASK_FILE"))
MISE_BREW_CASK_TOKEN = ENV.fetch("MISE_BREW_CASK_TOKEN")
MISE_BREW_CASK_VERSION = ENV.fetch("MISE_BREW_CASK_VERSION")
MISE_BREW_CASK_STAGED_PATH = Pathname.new(ENV.fetch("MISE_BREW_CASK_STAGED_PATH"))
MISE_BREW_CASK_APPDIR = Pathname.new(ENV.fetch("MISE_BREW_CASK_APPDIR"))
MISE_BREW_PREFIX = Pathname.new(ENV.fetch("MISE_BREW_PREFIX"))
MISE_BREW_CASK_HOOK = ENV.fetch("MISE_BREW_CASK_HOOK")

def odie(message)
  $stderr.puts "Error: #{message}"
  exit 1
end

class ShimUnsupportedError < StandardError; end

def shim_unsupported!(feature)
  raise ShimUnsupportedError,
        "cask uses `#{feature}`, which mise's cask shim does not support"
end

module OS
  def self.mac?
    RbConfig::CONFIG["host_os"].include?("darwin")
  end

  def self.linux?
    RbConfig::CONFIG["host_os"].include?("linux")
  end
end

class MacOSVersion
  include Comparable

  SYMBOLS = {
    tahoe: "26", sequoia: "15", sonoma: "14", ventura: "13",

View on GitHub (pinned to 533346cc37)