field `provision[%d].path` can only be set when mode is %#q,

Error message

field `provision[%d].path` can only be set when mode is %#q, or %#q

What it means

`path` names the target file for data-mode (file write) and yq-mode (YAML edit) provision entries only. Script modes do not take a target path, so Validate() rejects `path` on entries whose mode is neither "data" nor "yq". The rendered message lists `"data"` and `"yq"` as the allowed modes.

Source

Thrown at pkg/limayaml/validate.go:249

			// FillDefaults makes sure that p.Permissions is not nil
			if _, err := strconv.ParseInt(*p.Permissions, 8, 64); err != nil {
				errs = errors.Join(errs, fmt.Errorf("field `provision[%d].permissions` must be an octal number: %w", i, err))
			}
		default:
			if (p.Script == nil || *p.Script == "") && p.Mode != limatype.ProvisionModeAnsible {
				errs = errors.Join(errs, fmt.Errorf("field `provision[%d].script` must not be empty", i))
			}
			if p.Content != nil {
				errs = errors.Join(errs, fmt.Errorf("field `provision[%d].content` can only be set when mode is %#q", i, limatype.ProvisionModeData))
			}
			if p.Overwrite != nil {
				errs = errors.Join(errs, fmt.Errorf("field `provision[%d].overwrite` can only be set when mode is %#q", i, limatype.ProvisionModeData))
			}
			if p.Owner != nil {
				errs = errors.Join(errs, fmt.Errorf("field `provision[%d].owner` can only be set when mode is %#q", i, limatype.ProvisionModeData))
			}
			if p.Path != nil {
				errs = errors.Join(errs, fmt.Errorf("field `provision[%d].path` can only be set when mode is %#q, or %#q", i, limatype.ProvisionModeData, limatype.ProvisionModeYQ))
			}
			if p.Permissions != nil {
				errs = errors.Join(errs, fmt.Errorf("field `provision[%d].permissions` can only be set when mode is %#q, or %#q", i, limatype.ProvisionModeData, limatype.ProvisionModeYQ))
			}
			if p.Format != nil {
				errs = errors.Join(errs, fmt.Errorf("field `provision[%d].format` can only be set when mode is %#q", i, limatype.ProvisionModeYQ))
			}
		}
		if p.Playbook != "" {
			if p.Mode != limatype.ProvisionModeAnsible {
				errs = errors.Join(errs, fmt.Errorf("field `provision[%d].playbook can only be set when mode is %#q", i, limatype.ProvisionModeAnsible))
			}
			if p.Script != nil && *p.Script != "" {
				errs = errors.Join(errs, fmt.Errorf("field `provision[%d].script must be empty if playbook is set", i))
			}
			playbook := p.Playbook
			if _, err := os.Stat(playbook); err != nil {
				errs = errors.Join(errs, fmt.Errorf("field `provision[%d].playbook` refers to an inaccessible path: %#q: %w", i, playbook, err))

View on GitHub (pinned to dd909d0973)

Solutions

Set `mode: data` or `mode: yq` if the entry targets a file at `path`
Delete the `path` field from script entries (use `script`/`playbook` instead)
For ansible, move the value to the `playbook` field

Example fix

# before
provision:
  - mode: boot
    path: /etc/rc.local
    script: exit 0
# after
provision:
  - mode: boot
    script: exit 0

Defensive patterns

Strategy: validation

Validate before calling

// Go: path requires data or yq mode
for i, p := range cfg.Provision {
    mode := limatype.ProvisionModeSystem
    if p.Mode != nil { mode = *p.Mode }
    if p.Path != nil && mode != limatype.ProvisionModeData && mode != limatype.ProvisionModeYQ {
        return fmt.Errorf("provision[%d]: path requires mode data or yq", i)
    }
}

Type guard

func pathAllowed(p limatype.Provision) bool {
    if p.Path == nil { return true }
    return p.Mode != nil && (*p.Mode == limatype.ProvisionModeData || *p.Mode == limatype.ProvisionModeYQ)
}

Prevention

Set path only together with content (data) or expression (yq)
For ansible playbooks use `playbook`, not `path`
Validate configs after mode changes

When it happens

Trigger: A provision entry with mode system/user/boot/dependency/ansible (or unset) that sets `path`, during create/start/restart/edit/apply/template validation.

Common situations: Mixing data and script entry templates; leaving `path` on an entry after switching from data mode to a script; confusion with `playbook` (ansible) needing a path-like value — playbook is a separate field.

Related errors

AI-assisted analysis of lima-vm/lima@dd909d0973 (2026-09-01). Data as JSON: /api/errors/eeb464c4a5f65868. Report an issue: GitHub.