fix(schema): add missing config fields by risu729 · Pull Request #9044 · jdx/mise

risu729 · 2026-04-11T07:13:04Z

Summary

add missing task sandbox fields to the mise task schemas
add top-level env_file/dotenv/env_path schema entries and mark them deprecated as legacy shortcuts
allow env age directive options, tighten complex age option nesting, and cover the schema fixture
keep sandbox fields in a task-only schema overlay so they validate for [tasks.*] but do not leak into [task_templates.*], whose Rust type does not deserialize/apply them

Context

The renderer builds both task and task_template schemas from task_props. The new taskOnlyProps overlay is for fields accepted by Task but not TaskTemplate; this mirrors the existing task-only treatment for extends.
env_file, dotenv, and env_path are still accepted by current serde parsing, but they are legacy top-level shortcuts. env: use mise.file/mise.path config #1361 marked env_file/env_path deprecated in favor of env.mise.file/env.mise.path; env: resolve env vars in order #1519 later rewrote env parsing and kept accepting env_file, alias dotenv, and env_path without a runtime deprecation warning. The schema keeps them valid but marks them deprecated to point users at [env] _.file / _.path.
Task sandbox config fields were introduced with process sandboxing in feat(exec): add process sandboxing for mise x and mise run #8845; allow_env wildcard semantics were later expanded in feat(sandbox): support wildcard patterns in allow_env #8974.
Age env directives, including flattened EnvDirectiveOptions on age values, were introduced in feat(age): support age encrypted env vars in mise.toml files #6463. This PR now mirrors the Rust variants more closely: top-level age options are allowed with age = "...", while complex age = { value = ... } options must be nested inside the age object.

Verification

bun xtasks/render/schema.ts
jq empty schema/mise.json schema/mise-task.json schema/miserc.json
git diff --check
mise run test:e2e e2e/config/test_schema_tombi

greptile-apps · 2026-04-11T07:16:53Z

Greptile Summary

This PR fills schema gaps: sandbox task fields (deny_all, deny_read, deny_write, deny_net, deny_env, allow_read, allow_write, allow_net, allow_env) are added to tasks-only via a new taskOnlyProps overlay so they validate for [tasks.*] but are correctly excluded from [task_templates.*]; top-level env_file/dotenv/env_path shortcuts are added as deprecated properties; and the age env directive schema is restructured to support both the simple ({ age = \"string\", tools = true }) and complex ({ age = { value = \"string\", tools = true } }) inline formats.

Confidence Score: 5/5

Safe to merge — schema-only additions that correctly mirror the Rust types, with positive and negative e2e coverage.

All sandbox fields match the Rust Task struct and are correctly absent from TaskTemplate; the age directive restructuring matches the Val::AgeComplex/Val::AgeWithOptions deserialization branches; deprecated top-level fields are accurately modelled. The one open item (no negative test for sandbox fields on task_templates) is a P2 coverage gap that does not affect runtime correctness.

No files require special attention.

Important Files Changed

Filename	Overview
xtasks/render/schema.ts	Adds `taskOnlyProps` object with all nine sandbox fields and spreads it into the task object variant only; `task_template` correctly keeps its existing properties without sandbox fields.
schema/mise.json	Sandbox fields added to task object variant only (not task_template); deprecated `env_file`/`dotenv`/`env_path` top-level properties added; age directive oneOf restructured to support simple-string and complex-object variants with correct property placement.
schema/mise-task.json	Task definition updated with sandbox fields matching Rust `Task` struct; age directive schema updated via schema.ts copy; no sandbox fields leak into task_template definition.
e2e/config/test_schema_tombi	New `mise-age.toml` positive case and `mise-bad-age.toml` negative case added; `deny_env`/`allow_read` added to the task fixture; deprecated `env_file`/`env_path` included in the top-level fixture.

Flowchart

%%{init: {'theme': 'neutral'}}%%
flowchart TD
    A[schema.ts runs] --> B[Read mise.json base schema]
    B --> C[Build taskOnlyProps\ndeny_all/deny_read/deny_write\ndeny_net/deny_env/allow_read\nallow_write/allow_net/allow_env]
    B --> D[Read taskProps from task_props def]
    D --> E[task_template schema\ntaskProps only\nadditionalProperties: false]
    D --> F[task object variant\ntaskProps + taskOnlyProps + extends\nadditionalProperties: false]
    F --> G[Write mise.json\nwith env_file/dotenv/env_path deprecated]
    E --> G
    G --> H[Copy task + task_template defs\nto mise-task.json]
    G --> I[Write miserc.json\nrc=true settings only]

_{Reviews (3): Last reviewed commit: "fix(schema): tighten age directive optio..." | Re-trigger Greptile}

gemini-code-assist

Code Review

This pull request introduces sandbox-related properties (deny/allow for reads, writes, network, and environment) to tasks and adds new environment configuration options such as env_file, env_path, and redact. It also updates the schema generation script to handle these new task-specific properties. Feedback suggests tightening the age directive schema to match the Rust implementation's nesting requirements and improving the JSON schema structure by including task-specific properties in the common $defs.task_props definition to avoid redundancy.

@jdx

### 🐛 Bug Fixes - **(docs)** upgrade esbuild to 0.28.0 with es2022 build target by @jdx in [#9047](#9047) - **(env)** skip tools=true module hooks in dependency_env by @jdx in [#9011](#9011) - **(lockfile)** resolve SLSA provenance URLs deterministically for all platforms by @cameronbrill in [#8982](#8982) - **(registry)** test of docuum in registry by @jylenhof in [#8996](#8996) - **(release)** publish extracted mise.exe alongside Windows zip by @zeitlinger in [#8997](#8997) - **(schema)** add missing config fields by @risu729 in [#9044](#9044) - **(task)** support sandbox fields in task templates by @risu729 in [#9046](#9046) - **(tasks)** respect env precedence for task config by @risu729 in [#9039](#9039) - prevent implicit enabling of `self_update` when rustls features are enabled by @salim-b in [#9040](#9040) - allow installing bun and others when downloads folder is on a different mount by @bgeron in [#9032](#9032) ### 📚 Documentation - discourage direnv compatibility PRs and remove issue suggestions by @jdx in [ca78346](ca78346) - tighten direnv compatibility language by @jdx in [ab140c8](ab140c8) - add Tera tip for unsupported version files by @risu729 in [#9048](#9048) ### 📦️ Dependency Updates - update ghcr.io/jdx/mise:deb docker digest to 49fa8a4 by @renovate[bot] in [#8999](#8999) - update ghcr.io/jdx/mise:copr docker digest to 61ba7b6 by @renovate[bot] in [#8998](#8998) - update ghcr.io/jdx/mise:copr docker digest to fa351ff by @renovate[bot] in [#9002](#9002) - update ghcr.io/jdx/mise:alpine docker digest to f3bb475 by @renovate[bot] in [#9001](#9001) - update ghcr.io/jdx/mise:rpm docker digest to d45af2d by @renovate[bot] in [#9005](#9005) - update ghcr.io/jdx/mise:deb docker digest to d7463ac by @renovate[bot] in [#9004](#9004) - update jdx/mise-action digest to 5228313 by @renovate[bot] in [#9007](#9007) - update rust docker digest to e8e2bb5 by @renovate[bot] in [#9008](#9008) - update taiki-e/install-action digest to 97a5807 by @renovate[bot] in [#9010](#9010) - update autofix-ci/action action to v1.3.3 by @renovate[bot] in [#9015](#9015) - update ubuntu:24.04 docker digest to 84e77de by @renovate[bot] in [#9012](#9012) - update actions/checkout action to v4.3.1 by @renovate[bot] in [#9014](#9014) - update ubuntu:26.04 docker digest to cc925e5 by @renovate[bot] in [#9013](#9013) - update rust crate tokio to v1.51.1 by @renovate[bot] in [#9018](#9018) - update rust crate zip to v8.5.1 by @renovate[bot] in [#9019](#9019) - update rust crate ctor to 0.9 by @renovate[bot] in [#9024](#9024) - update ubuntu docker tag to resolute-20260404 by @renovate[bot] in [#9020](#9020) - update dependency vitepress-plugin-tabs to ^0.8.0 by @renovate[bot] in [#9023](#9023) - update rust crate indexmap to v2.14.0 by @renovate[bot] in [#9025](#9025) - update rust crate nix to 0.31 by @renovate[bot] in [#9030](#9030) - update taiki-e/install-action digest to 7a4939c by @renovate[bot] in [#9027](#9027) - update dependency esbuild to v0.28.0 by @renovate[bot] in [#9022](#9022) - update rust crate rand to 0.10 by @renovate[bot] in [#9031](#9031) - update rust crate digest to 0.11.0 by @renovate[bot] in [#9028](#9028) - update rust crate confique to 0.4 by @renovate[bot] in [#9026](#9026) - update rust crate rattler to 0.40 by @renovate[bot] in [#9034](#9034) - lock file maintenance by @renovate[bot] in [#8416](#8416) - disable renovate for aws-config/aws-sdk-* crates by @jdx in [#9052](#9052) - update swatinem/rust-cache digest to e18b497 by @renovate[bot] in [#9009](#9009) ### 📦 Registry - remove broken tool tests by @jdx in [#9017](#9017) - update granted aqua backend repo by @risu729 in [#9033](#9033) - fix atlas-community test expected output by @jdx in [#9054](#9054) ### Chore - use deprecated_at! macro for ubi backend deprecation by @jdx in [#9049](#9049) ### Security - **(ci)** run test-tool inside Docker container by @jdx in [#9055](#9055) - **(ci)** avoid exposing MISE_GH_TOKEN to test-tool scripts by @jdx in [#9053](#9053) ### New Contributors - @bgeron made their first contribution in [#9032](#9032) - @salim-b made their first contribution in [#9040](#9040) ## 📦 Aqua Registry Updates #### Updated Packages (2) - [`cloudnative-pg/cloudnative-pg/kubectl-cnpg`](https://github.com/cloudnative-pg/cloudnative-pg/kubectl-cnpg) - [`gleam-lang/gleam`](https://github.com/gleam-lang/gleam)

fix(schema): add missing config fields

45e5b6a

gemini-code-assist Bot reviewed Apr 11, 2026

View reviewed changes

Comment thread schema/mise.json Outdated

Comment thread xtasks/render/schema.ts

risu729 marked this pull request as draft April 11, 2026 07:47

risu729 added 2 commits April 11, 2026 18:48

fix(schema): mark legacy env shortcuts deprecated

6664dd4

fix(schema): tighten age directive options

9ead6cc

risu729 marked this pull request as ready for review April 11, 2026 09:43

jdx merged commit 2564823 into jdx:main Apr 11, 2026
35 checks passed

mise-en-dev mentioned this pull request Apr 11, 2026

chore: release 2026.4.9 #9000

Merged

risu729 deleted the fix/schema-config-drift branch April 11, 2026 11:59

BrewTestBot mentioned this pull request Apr 11, 2026

mise 2026.4.9 Homebrew/homebrew-core#277170

Merged

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

fix(schema): add missing config fields#9044

fix(schema): add missing config fields#9044
jdx merged 3 commits intojdx:mainfrom
risu729:fix/schema-config-drift

risu729 commented Apr 11, 2026 •

edited

Loading

Uh oh!

greptile-apps Bot commented Apr 11, 2026 •

edited

Loading

Uh oh!

gemini-code-assist Bot left a comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Uh oh!

Conversation

risu729 commented Apr 11, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary

Context

Verification

Uh oh!

greptile-apps Bot commented Apr 11, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Greptile Summary

Confidence Score: 5/5

Important Files Changed

Flowchart

Uh oh!

gemini-code-assist Bot left a comment

Choose a reason for hiding this comment

Code Review

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

risu729 commented Apr 11, 2026 •

edited

Loading

greptile-apps Bot commented Apr 11, 2026 •

edited

Loading