choose --github-relay-repo OWNER/REPO or --github-relay-all-

Error message

choose --github-relay-repo OWNER/REPO or --github-relay-all-repos, not both

What it means

from_flags enforces mutual exclusivity of the two relay scope selections: `all != repositories.is_empty()` means exactly one of --github-relay-all-repos and --github-relay-repo must be given. Passing both (or, after the earlier check, neither) bails with this message.

Source

Thrown at src/github_relay.rs:29

    repositories: std::collections::BTreeSet<String>,
    #[cfg(any(unix, test))]
    all: bool,
}

impl Scope {
    pub(crate) fn from_flags(
        enabled: bool,
        repositories: &[String],
        all: bool,
    ) -> Result<Option<Self>> {
        if !enabled {
            if all || !repositories.is_empty() {
                bail!("repository scope requires --github-relay-read-only");
            }
            return Ok(None);
        }
        if all != repositories.is_empty() {
            bail!("choose --github-relay-repo OWNER/REPO or --github-relay-all-repos, not both");
        }
        let repositories: std::collections::BTreeSet<String> = repositories
            .iter()
            .map(|repo| repository(repo))
            .collect::<Result<_>>()?;
        #[cfg(not(any(unix, test)))]
        let _ = repositories;
        Ok(Some(Self {
            #[cfg(unix)]
            options: Options::default(),
            #[cfg(any(unix, test))]
            repositories,
            #[cfg(any(unix, test))]
            all,
        }))
    }

    #[cfg(any(unix, test))]

View on GitHub (pinned to afd2eddd3a)

Solutions

Use only --github-relay-all-repos if you want every repository relayed.
Or list explicit repos with repeated --github-relay-repo OWNER/REPO flags and drop --github-relay-all-repos.
If flags come from an alias/script, audit where each flag is appended and keep a single scope source.

Example fix

// before
mise --github-relay-read-only --github-relay-all-repos --github-relay-repo owner/repo exec -- npm i
// after
mise --github-relay-read-only --github-relay-repo owner/repo exec -- npm i

Defensive patterns

Strategy: validation

Validate before calling

# shell: exactly one scope source
scope_count=$(( ${RELAY_ALL:+1} + ${RELAY_REPOS:+1} ))
[[ $scope_count -le 1 ]] || { echo "use all-repos OR repo list, not both" >&2; exit 1; }

Type guard

fn scope_is_exclusive(all: bool, repos: &[String]) -> bool {
    all != !repos.is_empty()
}

Try / catch

match Scope::from_flags(enabled, repos, all) {
    Err(e) if e.to_string().contains("not both") => {
        // drop one of the flags and retry
    }
    r => r,
}

Prevention

Build the scope from a single source of truth (one flag-setter in scripts).
If repo lists may be empty, decide explicitly between all-repos and empty scope before flag assembly.
Review shell aliases/CI templates that hardcode --github-relay-all-repos alongside per-repo flags.

When it happens

Trigger: Invoking from_flags (via the CLI) with both --github-relay-all-repos and one or more --github-relay-repo values set while the relay is enabled.

Common situations: Composing relay options from multiple config layers or shell aliases that each append a scope flag; script templates where repo lists are optionally expanded into both flags.

Understand the failure class

Background: "mutually exclusive" flag errors: what "can't supply both nx and xx", "--raw is not compatible with -i" and "cannot be used with" mean, and how to fix them — this error's family across 29 libraries.

Related errors

AI-assisted analysis of jdx/mise@afd2eddd3a (2026-09-09). Data as JSON: /api/errors/3ff04c54893d9766. Report an issue: GitHub.