jdx/mise · error

`url` must not start with `-`

Error message

`url` must not start with `-`

What it means

A url beginning with `-` would be interpreted by git as a command-line option rather than a repository argument (argument-injection risk), so from_toml rejects it before constructing any git command. URLs must start with a real remote designator like `https://`, `git@`, `ssh://`, or a filesystem path.

Solutions

1. Remove the leading `-` and supply a proper git remote URL
2. Put intended git options in the correct git configuration or command context, not in `url`
3. Prefix file-based remotes with `file://` or an absolute path instead of dash-like shorthand

Example fix

// before
"~/src/dotfiles" = { url = "--depth=1 https://github.com/jdx/dotfiles.git" }
// after
"~/src/dotfiles" = { url = "https://github.com/jdx/dotfiles.git" }

function validateUrlSafe(entry) {
  const url = entry.url.trim();
  if (url.startsWith('-')) throw new Error('url must not start with -');
  if (!/^(https?:\/\/|ssh:\/\/|git@|[\w.~-]+@)/.test(url)) throw new Error('url is not a git remote');
}

When it happens

Trigger: Setting `url = "--upload-pack=..."` or any value whose first character after trimming is `-` in a `[bootstrap.repos]` entry.

Common situations: Mistakenly pasting git CLI flags into the url field; attempting to smuggle extra git options through the config (blocked by design); stray dash from a broken copy/paste.

Understand the failure class

Background: "Must be a positive integer", "Invalid value", "Unsupported": the invalid-argument-value error family, when a library rejects the value you pass — this error's family across 35 libraries.

Related errors

• `ref` must not start with `-`
• invalid repository origin
• setup repository URL must be nonempty and must not start…
• cask uses `# `, which mise's cask shim does not support
• incoming history.origin is machine-local configuration…

AI-assisted analysis of jdx/mise@533346cc37 (2026-09-17). Data as JSON: /api/errors/7002b492bd214b80. Report an issue: GitHub.

Appendix: source

Thrown at src/system/repos.rs:130

            // Join only the Normal segments so `./foobar` resolves to
            // `<root>/foobar` rather than `<root>/./foobar` — a `.` component
            // survives `Path::join` and leaks into every displayed path.
            let mut resolved = root.to_path_buf();
            for component in path.components() {
                if let Component::Normal(segment) = component {
                    resolved.push(segment);
                }
            }
            resolved
        };
        let Some(url) = config.url.map(|s| s.trim().to_string()) else {
            bail!("must set `url`");
        };
        if url.is_empty() {
            bail!("must set a non-empty `url`");
        }
        if url.starts_with('-') {
            bail!("`url` must not start with `-`");
        }
        let git_ref = config.git_ref.map(|s| s.trim().to_string());
        let git_ref = match git_ref {
            Some(git_ref) if git_ref.is_empty() => bail!("`ref` must not be empty"),
            Some(git_ref) if git_ref.starts_with('-') => bail!("`ref` must not start with `-`"),
            other => other,
        };
        Ok(Self {
            path_raw,
            path,
            url,
            git_ref,
        })
    }
}

impl std::fmt::Display for RepoRequest {
    fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {

View on GitHub (pinned to 533346cc37)