jdx/mise · error

--changed requires trusted configuration: {}

Error message

--changed requires trusted configuration: {}

What it means

`--changed` lets `dotfiles add` skip explicit targets by inspecting which files differ from their tracked state. Because that inspection reads managed-file requirements defined in a config file, mise requires the config that declares those dotfiles to be trusted (global config is implicitly trusted; local/path configs must be explicitly trusted via `mise trust`). run_inner bails when a differing requirement originates from an untrusted, non-global config.

Source

Thrown at src/cli/dotfiles/add.rs:129

    }

    async fn run_inner(mut self, mode: FileMode) -> Result<()> {
        let config = Config::get().await?;
        let managed = system::files::files_from_config(&config)?;
        if self.changed {
            for req in &managed {
                if req.mode == FileMode::Copy
                    && req.target.is_file()
                    && !req.target.is_symlink()
                    && !req.source.is_dir()
                    && matches!(
                        system::files::check(&config, req)?,
                        system::files::FileState::Differs(_)
                    )
                {
                    if !is_global_config(&req.origin.config) && !is_path_trusted(&req.origin.config)
                    {
                        bail!(
                            "--changed requires trusted configuration: {}",
                            req.origin.config.display_user()
                        );
                    }
                    self.targets.push(req.target_raw.clone());
                }
            }
            if self.targets.is_empty() {
                super::warn_if_dotfiles_ignored();
                info!("dotfiles: no changed copy-mode files");
                return Ok(());
            }
        }
        let config_path = resolve_target_config_path(ConfigPathOptions {
            global: self.global || !self.local,
            path: self.path.clone(),
            env: None,
            cwd: None,

View on GitHub (pinned to afd2eddd3a)

Solutions

1. Run `mise trust` (or `mise trust <config path>`) on the config file declaring the dotfiles, then re-run the command.
2. Pass the target explicitly instead of using --changed so no trust check is needed.
3. Move the [dotfiles] entries into the global config, which is implicitly trusted.

Example fix

# before
mise bootstrap dotfiles add --changed
# after
mise trust ~/projects/dotfiles/mise.toml
mise bootstrap dotfiles add --changed

// ensure trust before using --changed
import { execSync } from 'node:child_process';
execSync('mise trust', { stdio: 'inherit' }); // idempotent for already-trusted configs
execSync('mise bootstrap dotfiles add --changed');

try {
  execSync('mise bootstrap dotfiles add --changed');
} catch (e) {
  if (String(e.stderr).includes('--changed requires trusted configuration')) {
    execSync('mise trust');
    execSync('mise bootstrap dotfiles add --changed');
  } else throw e;
}

When it happens

Trigger: Running `mise bootstrap dotfiles add --changed` (or with --changed plus other targets) where the differing tracked requirement comes from a config file that is neither the global config nor in mise's trusted path set. Typical right after cloning a repo with a mise.toml containing [dotfiles] entries.

Common situations: Fresh clones of dotfiles repositories; CI environments where config files were never trusted; switching machines before running `mise trust`.

Related errors

• [dotfiles]."{}": target is not a safe OCI path
• --changed does not accept target arguments
• at least one target or --changed is required
• --source can only be used with one target
• `--mode track` tracks a file where it is and takes no source

AI-assisted analysis of jdx/mise@afd2eddd3a (2026-09-09). Data as JSON: /api/errors/c28b89117472d7ef. Report an issue: GitHub.