jdx/mise · error

--changed requires trusted configuration

Error message

--changed requires trusted configuration: {}

What it means

When `mise dotfiles add --changed` detects files whose content differs, it adds them as targets — but only if the config file that recorded them is trusted. Untrusted (unverified) config files are refused in run_inner to prevent untrusted code or paths from silently redirecting your dotfiles; the error names the offending config path.

Solutions

1. Trust the configuration file: `mise trust <path-to-config>` shown in the error message.
2. Verify the config path is what you expect before trusting (it determines which changed files get added).
3. Run the command against the global config, or move the relevant entries into the trusted global config.

Example fix

// before
$ mise dotfiles add --changed
Error: --changed requires trusted configuration: ~/work/project/mise.toml

// after
$ mise trust ~/work/project/mise.toml
$ mise dotfiles add --changed

# ensure the originating config is trusted before --changed
mise dotfiles add --changed || mise trust <config-path-from-error>

match result {
    Err(e) if e.to_string().contains("requires trusted configuration") => {
        let path = extract_config_path(&e);
        verify_and_trust(&path)?; // inspect the file, then `mise trust`
        result = run_add_changed();
    }
    other => other?,
}

When it happens

Trigger: Running `mise dotfiles add --changed` where a differing file's request originates from a config that is neither the global config nor in the trusted set (is_global_config / is_path_trusted both false) in run_inner.

Common situations: Cloning a dotfiles repo with a project mise config and running --changed before trusting it; a config moved to a new path losing its trusted status; working in CI where trust was never granted.

Related errors

• a glob is required
• `--all` needs `--to
• at least one target or --changed is required
• cannot apply
• cannot connect a setup repository

AI-assisted analysis of jdx/mise@533346cc37 (2026-09-17). Data as JSON: /api/errors/c28b89117472d7ef. Report an issue: GitHub.

Appendix: source

Thrown at src/cli/dotfiles/add.rs:134

    async fn run_inner(mut self, mode: FileMode) -> Result<()> {
        let config = Config::get().await?;
        let secrets = system::secrets::resolve(&config, self.prompt_secrets)?;
        let managed = system::files::files_from_config(&config)?;
        if self.changed {
            for req in &managed {
                if req.mode == FileMode::Copy
                    && req.target.is_file()
                    && !req.target.is_symlink()
                    && !req.source.is_dir()
                    && matches!(
                        system::files::check(&config, req, &secrets)?,
                        system::files::FileState::Differs(_)
                    )
                {
                    if !is_global_config(&req.origin.config) && !is_path_trusted(&req.origin.config)
                    {
                        bail!(
                            "--changed requires trusted configuration: {}",
                            req.origin.config.display_user()
                        );
                    }
                    self.targets.push(req.target_raw.clone());
                }
            }
            if self.targets.is_empty() {
                super::warn_if_dotfiles_ignored();
                info!("dotfiles: no changed copy-mode files");
                return Ok(());
            }
        }
        let config_path = resolve_target_config_path(ConfigPathOptions {
            global: self.global || !self.local,
            path: self.path.clone(),
            env: None,
            cwd: None,

View on GitHub (pinned to 533346cc37)