What causes "`ref` must not start with `-`" in jdx/mise?

Use an actual branch, tag, or SHA for `ref` (e.g. `ref = "v1.2.0"`)

`ref` must not start with `-`

Error message

`ref` must not start with `-`

What it means

Like url, an explicit `ref` must not begin with `-`: git would parse it as an option instead of a revision (argument-injection risk). from_toml validates this after trimming, before any git command is built.

Solutions

Use an actual branch, tag, or SHA for `ref` (e.g. `ref = "v1.2.0"`)
Move any desired git options out of the config into git config or the invoking environment
Remove stray leading whitespace/dash characters from the ref value

Example fix

// before
"~/src/dotfiles" = { url = "https://github.com/jdx/dotfiles.git", ref = "--depth=1" }
// after
"~/src/dotfiles" = { url = "https://github.com/jdx/dotfiles.git", ref = "main" }

Defensive patterns

Strategy: validation

Validate before calling

function validateRefSafe(entry) {
  if ('ref' in entry && entry.ref.trim().startsWith('-')) {
    throw new Error('ref must not start with -');
  }
}

Prevention

Use only branch names, tags, or SHAs in `ref`
Never place git flags in `ref`; they are rejected by design
Validate refs with `git rev-parse --verify <ref>` before committing them to config

When it happens

Trigger: Setting `ref = "--depth=1"` or any value starting with `-` in a `[bootstrap.repos]` entry.

Common situations: Confusing git CLI flags with ref names; trying to pass extra fetch options via ref; copy/paste that picked up a leading dash.

Understand the failure class

Background: "Must be a positive integer", "Invalid value", "Unsupported": the invalid-argument-value error family, when a library rejects the value you pass — this error's family across 35 libraries.

Related errors

AI-assisted analysis of jdx/mise@533346cc37 (2026-09-17). Data as JSON: /api/errors/aaeedfb784f09444. Report an issue: GitHub.

Appendix: source

Thrown at src/system/repos.rs:135

                if let Component::Normal(segment) = component {
                    resolved.push(segment);
                }
            }
            resolved
        };
        let Some(url) = config.url.map(|s| s.trim().to_string()) else {
            bail!("must set `url`");
        };
        if url.is_empty() {
            bail!("must set a non-empty `url`");
        }
        if url.starts_with('-') {
            bail!("`url` must not start with `-`");
        }
        let git_ref = config.git_ref.map(|s| s.trim().to_string());
        let git_ref = match git_ref {
            Some(git_ref) if git_ref.is_empty() => bail!("`ref` must not be empty"),
            Some(git_ref) if git_ref.starts_with('-') => bail!("`ref` must not start with `-`"),
            other => other,
        };
        Ok(Self {
            path_raw,
            path,
            url,
            git_ref,
        })
    }
}

impl std::fmt::Display for RepoRequest {
    fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
        write!(f, "{}", file::display_path(&self.path))
    }
}

pub(crate) async fn status(requests: &[RepoRequest]) -> Result<Vec<RepoStatus>> {

View on GitHub (pinned to 533346cc37)