Skip to content

fix(installer): error if MISE_INSTALL_PATH is a directory#8468

Merged
jdx merged 1 commit intomainfrom
fix/install-path-directory-guard
Mar 4, 2026
Merged

fix(installer): error if MISE_INSTALL_PATH is a directory#8468
jdx merged 1 commit intomainfrom
fix/install-path-directory-guard

Conversation

@jdx
Copy link
Copy Markdown
Owner

@jdx jdx commented Mar 4, 2026

Summary

  • Detect when MISE_INSTALL_PATH points to an existing directory and exit with a clear error message instead of silently wiping it out
  • Switch rm -rf to rm -f since the path is now confirmed to not be a directory

Problem

Setting MISE_INSTALL_PATH=~/tmp (a directory) instead of ~/tmp/mise (a file path) caused the installer to run rm -rf ~/tmp, silently deleting everything in that directory. This was discovered when someone ran:

curl https://mise.run | MISE_VERSION=v2026.2.2 MISE_INSTALL_PATH=~/tmp sh

Fix

Added a guard before the rm that errors out early with a helpful message:

MISE_INSTALL_PATH '/home/user/tmp' is a directory. Please set it to a file path, e.g. '/home/user/tmp/mise'.

🤖 Generated with Claude Code


Note

Low Risk
Small, localized change to the installer that adds a safety guard and narrows deletion behavior; low likelihood of regressions aside from users previously (incorrectly) pointing MISE_INSTALL_PATH at a directory now receiving an error.

Overview
Prevents accidental data loss in the standalone installer by adding a preflight check that errors out when MISE_INSTALL_PATH resolves to an existing directory, with a clear message suggesting a file path like .../mise.

Replaces the prior rm -rf "$install_path" behavior with rm -f so the installer only removes an existing file at the target path before moving the new binary into place.

Written by Cursor Bugbot for commit 7b763b8. This will update automatically on new commits. Configure here.

Previously, setting MISE_INSTALL_PATH to an existing directory (e.g.
~/tmp instead of ~/tmp/mise) would silently wipe out the directory due
to `rm -rf "$install_path"`. Now we detect this early and emit a clear
error message. Also switched from `rm -rf` to `rm -f` since the path
is confirmed to not be a directory.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
@gemini-code-assist
Copy link
Copy Markdown
Contributor

Summary of Changes

Hello, I'm Gemini Code Assist1! I'm currently reviewing this pull request and will post my feedback shortly. In the meantime, here's a summary to help you and other reviewers quickly get up to speed!

This pull request enhances the robustness of the mise installer by addressing a critical issue where setting MISE_INSTALL_PATH to an existing directory could lead to silent and unintended deletion of its contents. The changes introduce a preventative check and refine the file removal process, ensuring a safer installation experience and providing clearer feedback to users.

Highlights

  • Installer Safety: Implemented a check to detect if MISE_INSTALL_PATH points to an existing directory, preventing accidental data loss by exiting with a clear error message.
  • Refined Removal Command: Switched the rm -rf command to rm -f for the installation path, as the path is now confirmed not to be a directory, making the operation safer and more precise.
Changelog
  • packaging/standalone/install.envsubst
    • Added a conditional check to verify if MISE_INSTALL_PATH is a directory before proceeding with installation.
    • Introduced an error message to guide users if MISE_INSTALL_PATH is incorrectly set to a directory.
    • Modified the file removal command from rm -rf to rm -f for the installation path.
Activity
  • A user reported an issue where setting MISE_INSTALL_PATH to an existing directory resulted in silent data deletion, prompting this fix.
Using Gemini Code Assist

The full guide for Gemini Code Assist can be found on our documentation page, here are some quick tips.

Invoking Gemini

You can request assistance from Gemini at any point by creating a comment using either /gemini <command> or @gemini-code-assist <command>. Below is a summary of the supported commands on the current page.

Feature Command Description
Code Review /gemini review Performs a code review for the current pull request in its current state.
Pull Request Summary /gemini summary Provides a summary of the current pull request in its current state.
Comment @gemini-code-assist Responds in comments when explicitly tagged, both in pull request comments and review comments.
Help /gemini help Displays a list of available commands.

Customization

To customize Gemini Code Assist for GitHub experience, repository maintainers can create a configuration file and/or provide a custom code review style guide (such as PEP-8 for Python) by creating and adding files to a .gemini/ folder in the base of the repository. Detailed instructions can be found here.

Limitations & Feedback

Gemini Code Assist may make mistakes. Please leave feedback on any instances where its feedback is incorrect or counter productive. You can react with 👍 and 👎 on @gemini-code-assist comments. If you're interested in giving your feedback about your experience with Gemini Code Assist for Github and other Google products, sign up here.

You can also get AI-powered code generation, chat, as well as code reviews directly in the IDE at no cost with the Gemini Code Assist IDE Extension.

Footnotes

  1. Review the Privacy Notices, Generative AI Prohibited Use Policy, Terms of Service, and learn how to configure Gemini Code Assist in GitHub here. Gemini can make mistakes, so double check it and use code with caution.

Copy link
Copy Markdown
Contributor

@gemini-code-assist gemini-code-assist bot left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Code Review

This pull request addresses a critical issue in the installer script that could lead to accidental data deletion if MISE_INSTALL_PATH was set to an existing directory. The fix introduces a check to validate the path and errors out if it's a directory, which is a solid approach. I've included one suggestion to move this new check earlier in the script to allow it to fail faster, improving the user experience by avoiding unnecessary downloads if the configuration is invalid.

Comment on lines +267 to +269
if [ -d "$install_path" ]; then
error "MISE_INSTALL_PATH '$install_path' is a directory. Please set it to a file path, e.g. '$install_path/mise'."
fi
Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

medium

This check is a great addition to prevent accidental data loss. For a better user experience and to avoid unnecessary network operations, consider moving this validation logic to earlier in the install_mise function. A good place would be right after install_path is defined (around line 248), so the script can fail fast before it downloads and verifies the tarball.

@greptile-apps
Copy link
Copy Markdown
Contributor

greptile-apps bot commented Mar 4, 2026

Greptile Summary

This PR fixes a destructive data-loss bug in the standalone installer where setting MISE_INSTALL_PATH to an existing directory (instead of a file path) caused the installer to silently run rm -rf on that directory. The fix adds a POSIX-compatible [ -d "$install_path" ] guard that exits with a clear, actionable error message before proceeding. The code also tightens rm -rf to rm -f now that a directory at the target path is guaranteed not to exist.

Key changes:

  • Added a pre-rm directory check that aborts with a helpful error and example path when MISE_INSTALL_PATH resolves to a directory.
  • Changed rm -rf "$install_path"rm -f "$install_path" to eliminate any residual risk of recursive deletion (correct given the new guard).

The fix is minimal, safe, and uses standard POSIX shell constructs.

Confidence Score: 5/5

  • This PR is safe to merge — it exclusively adds a safety guard for a destructive operation with no risk of regression.
  • The change is minimal (3 lines added, 1 changed), targets a single clear bug, uses standard POSIX shell constructs, and the error() helper is already proven to exit cleanly with code 1. The directory check correctly prevents a data-loss scenario by catching user misconfiguration early.
  • No files require special attention.

Flowchart

%%{init: {'theme': 'neutral'}}%%
flowchart TD
    A["User runs installer<br/>MISE_INSTALL_PATH set"] --> B["Resolve OS, arch, version"]
    B --> C["Construct tarball URL"]
    C --> D["Download tarball"]
    D --> E["Verify checksum"]
    E --> F{Is install_path<br/>a directory?}
    F -->|Yes| G["❌ Error: MISE_INSTALL_PATH is a directory<br/>exit 1"]
    F -->|No| H["Create install_dir"]
    H --> I["Remove old install_path if exists"]
    I --> J["Extract tarball"]
    J --> K["Move mise binary to install_path"]
    K --> L["✅ Success: mise installed"]
    G --> M["User sees clear error message<br/>and example correct path"]
Loading

Last reviewed commit: 7b763b8

@jdx jdx enabled auto-merge (squash) March 4, 2026 22:31
@jdx jdx merged commit 882f068 into main Mar 4, 2026
38 checks passed
@jdx jdx deleted the fix/install-path-directory-guard branch March 4, 2026 22:41
@github-actions
Copy link
Copy Markdown

github-actions bot commented Mar 4, 2026

Hyperfine Performance

mise x -- echo

Command Mean [ms] Min [ms] Max [ms] Relative
mise-2026.3.3 x -- echo 27.0 ± 0.8 24.6 33.1 1.03 ± 0.05
mise x -- echo 26.1 ± 1.1 23.8 37.9 1.00

mise env

Command Mean [ms] Min [ms] Max [ms] Relative
mise-2026.3.3 env 25.3 ± 1.3 22.8 35.7 1.00
mise env 26.3 ± 0.7 24.0 30.6 1.04 ± 0.06

mise hook-env

Command Mean [ms] Min [ms] Max [ms] Relative
mise-2026.3.3 hook-env 25.8 ± 1.0 23.7 28.6 1.00
mise hook-env 26.6 ± 1.2 23.6 33.5 1.03 ± 0.06

mise ls

Command Mean [ms] Min [ms] Max [ms] Relative
mise-2026.3.3 ls 26.2 ± 0.9 23.1 28.4 1.04 ± 0.06
mise ls 25.1 ± 1.1 22.7 34.1 1.00

xtasks/test/perf

Command mise-2026.3.3 mise Variance
install (cached) 162ms 158ms +2%
ls (cached) 91ms 88ms +3%
bin-paths (cached) 93ms 93ms +0%
task-ls (cached) 876ms 857ms +2%

mise-en-dev added a commit that referenced this pull request Mar 7, 2026
### 🚀 Features

- **(github)** keep exe extensions on Windows by @iki in
[#8424](#8424)
- **(task)** add `interactive` field for exclusive terminal access by
@jdx in [#8491](#8491)
- add header comment to generated lockfiles by @ivy in
[#8481](#8481)
- runtime musl/glibc detection for correct libc variant selection by
@jdx in [#8490](#8490)

### 🐛 Bug Fixes

- **(github)** use registry platform options during install by @jdx in
[#8492](#8492)
- **(http)** store tool opts as native TOML to fix platform switching by
@jdx in [#8448](#8448)
- **(installer)** error if MISE_INSTALL_PATH is a directory by @jdx in
[#8468](#8468)
- **(prepare)** resolve sources/outputs relative to `dir` when set by
@jdx in [#8472](#8472)
- **(ruby)** fetch precompiled binary by release tag instead of listing
all releases by @jdx in [#8488](#8488)
- **(schema)** support structured objects in task depends by @risu729 in
[#8463](#8463)
- **(task)** replace println!/eprintln! with calm_io in task output
macros by @vmaleze in [#8485](#8485)
- handle scoped npm package names without backend prefix by @jdx in
[#8477](#8477)

### 📦️ Dependency Updates

- update ghcr.io/jdx/mise:copr docker digest to c485c4c by
@renovate[bot] in [#8484](#8484)
- update ghcr.io/jdx/mise:alpine docker digest to 8118bc7 by
@renovate[bot] in [#8483](#8483)

### 📦 Registry

- disable sd version test by @jdx in
[#8489](#8489)

### New Contributors

- @ivy made their first contribution in
[#8481](#8481)
- @iki made their first contribution in
[#8424](#8424)

## 📦 Aqua Registry Updates

#### New Packages (5)

- [`datadog-labs/pup`](https://github.com/datadog-labs/pup)
- [`k1LoW/mo`](https://github.com/k1LoW/mo)
- [`rtk-ai/rtk`](https://github.com/rtk-ai/rtk)
-
[`suzuki-shunsuke/docfresh`](https://github.com/suzuki-shunsuke/docfresh)
- [`yashikota/exiftool-go`](https://github.com/yashikota/exiftool-go)

#### Updated Packages (6)

- [`cloudflare/cloudflared`](https://github.com/cloudflare/cloudflared)
- [`mozilla/sccache`](https://github.com/mozilla/sccache)
- [`owenlamont/ryl`](https://github.com/owenlamont/ryl)
- [`spinel-coop/rv`](https://github.com/spinel-coop/rv)
-
[`technicalpickles/envsense`](https://github.com/technicalpickles/envsense)
- [`weaviate/weaviate`](https://github.com/weaviate/weaviate)
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant