Summary

Fixes the mise install regression where a non-root user gets Permission denied while rebuilding runtime symlinks against a read-only system installs dir (typical Docker pattern: root populates /usr/local/share/mise/installs/ at build time, non-root user runs mise install at runtime). Reported in #8596 and addressed by #9408 — this PR is an alternative.

Root cause

rebuild_symlinks_in_dir always called remove_all + make_symlink_or_file on every existing runtime symlink, because the "stale runtime dir" branch fired for symlinks too:

if from.exists() {
    if is_runtime_symlink(&from) && file::resolve_symlink(&from)?.unwrap_or_default() != to {
        // Branch 1 — only fires when the symlink target is wrong
        ...
    } else if from.file_name() != to.file_name() && !concrete_installs.contains(&from_name) {
        // Branch 2 — fires for ANY symlink because file_name("latest") != file_name("22.5.0")
        file::remove_all(&from)?;
    }
    ...
}

For a perfectly healthy latest -> ./22.5.0:

• Branch 1 fails (target == to).
• Branch 2 enters because from.file_name() ("latest") differs from to.file_name() ("22.5.0") and concrete_installs doesn't include "latest".
• remove_all then runs on a healthy symlink — wasted I/O on every install in the common case, hard failure when the dir is read-only.

Fix

• Branch 1 now handles all runtime-symlink cases: rewrite if target differs, otherwise continue.
• Branch 2 only fires for non-symlink stale dirs (its actual purpose — cleanup for the 2026.4 regression that created real latest/ directories).
• Drop the position-based permission tolerance added in fix(install): create runtime symlinks in system/shared install directories #8722. With healthy symlinks taking the no-op path, read-only system dirs aren't touched at all. If a write IS genuinely required and can't happen, fail loudly so the user knows to fix permissions rather than silently ending up with a stale latest after mise install --system.

Why not #9408

That PR replaces position-based tolerance with category-based tolerance (any non-Local dir gets permission errors swallowed) and silently skips system/shared installs from user shims. Both:

• Mask the real bug (the false-positive remove_all above) instead of fixing it. Even with category-based tolerance the install does I/O it shouldn't, just hidden under a debug!.
• Trade one form of silent behavior for another. Reviewers (greptile, gemini) flagged the shims change as a regression for the "root installs once, all users get shims" pattern.
• Don't match the maintainer's stated policy: if mise install doesn't touch system tools, it should work fine; if it does and the dir isn't writable, it should fail loudly. This PR achieves both via a delta-based no-op rather than tolerance.

Tests

• e2e/cli/test_install_system_readonly — sets up tiny@1.0.0 in user dir, tiny@2.1.0 in a fake system dir, chmod -R a-w the system dir, then runs mise install --force tiny@1.0.0 and mise install dummy@1.0.0. Asserts both succeed AND that the skipping symlink update / Permission denied / failed rm warnings do NOT appear in output. Verified to fail before this fix (with WARN skipping symlink update for ...: failed rm -rf ... Permission denied) and pass after.

Test plan

• cargo test --bin mise — 774 pass
• mise run lint-fix — clean
• mise run test:e2e test_install_system_readonly — pass
• mise run test:e2e test_install_system test_shared_install_dirs test_install_before_ignores_stale_latest_dirs test_upgrade_latest_stale test_reshim_with_shims_on_path test_uninstall test_install_before test_install_short_ignores_full_backend_config test_install_dry_run test_install_concurrent_via_exec — all pass

🤖 Generated with Claude Code