fix(task): require trust for remote metadata

e2e/helpers/scripts/git_http_backend_server.py

@@ -14,8 +14,9 @@
 from pathlib import Path
 
 class GitHTTPHandler(http.server.BaseHTTPRequestHandler):
-    def __init__(self, *args, repo_dir=None, upload_pack_count_file=None, **kwargs):
+    def __init__(self, *args, repo_dir=None, request_log=None, upload_pack_count_file=None, **kwargs):
         self.repo_dir = repo_dir
+        self.request_log = request_log
         self.upload_pack_count_file = upload_pack_count_file
         super().__init__(*args, **kwargs)
 
@@ -26,6 +27,10 @@ def do_POST(self):
         self.handle_git_request()
 
     def handle_git_request(self):
+        if self.request_log:
+            with open(self.request_log, 'a') as log:
+                log.write(f'{self.command} {self.path}\n')
+
         # Set up environment for git-http-backend
         env = os.environ.copy()
         env['GIT_PROJECT_ROOT'] = str(self.repo_dir)
@@ -111,7 +116,7 @@ def handle_git_request(self):
         except Exception as e:
             self.send_error(500, f"Server error: {str(e)}")
 
-def create_test_repo(repo_path):
+def create_test_repo(repo_path, server_port):
     """Create a minimal test repository"""
     # Create a regular (non-bare) repository
     subprocess.run(['git', 'init', repo_path], check=True)
@@ -128,6 +133,15 @@ def create_test_repo(repo_path):
     remote_task_file.write_text('#!/usr/bin/env bash\necho "remote task executed"\n')
     remote_task_file.chmod(0o755)
 
+    remote_task_dir = Path(repo_path) / 'xtasks' / 'remote'
+    remote_task_dir.mkdir(parents=True)
+    nested_remote_file = remote_task_dir / 'nested'
+    nested_remote_file.write_text(
+        '#!/usr/bin/env bash\n'
+        'echo "nested remote task executed"\n'
+    )
+    nested_remote_file.chmod(0o755)
+
     snapshot_root = Path(repo_path) / 'xtasks' / 'snapshot'
     snapshot_parent = snapshot_root / 'parent' / 'snapshot_parent'
     snapshot_parent.parent.mkdir(parents=True)
@@ -165,6 +179,9 @@ def create_test_repo(repo_path):
         '[toml_table_task]\n'
         'run = "echo toml_table_task executed"\n'
         'description = "TOML task with table form"\n'
+        '\n'
+        '[nested_remote]\n'
+        f'file = "git::http://localhost:{server_port}/repo.git//xtasks/remote/nested"\n'
     )
 
     # A standalone toml file in a sibling directory to test the
@@ -203,18 +220,21 @@ def start_server(port=0):
     repo_path = temp_dir / 'repo'
     upload_pack_count_path = os.environ.get('MISE_GIT_HTTP_UPLOAD_PACK_COUNT_FILE')
     upload_pack_count_file = Path(upload_pack_count_path) if upload_pack_count_path else None
+    request_log_path = os.environ.get('MISE_GIT_HTTP_REQUEST_LOG')
+    request_log = Path(request_log_path) if request_log_path else None
     if upload_pack_count_file is not None:
         upload_pack_count_file.parent.mkdir(parents=True, exist_ok=True)
         upload_pack_count_file.write_text('')
-
-    print(f"Creating test repository at {repo_path}")
-    create_test_repo(str(repo_path))
+    if request_log is not None:
+        request_log.parent.mkdir(parents=True, exist_ok=True)
+        request_log.write_text('')
 
     # Create handler with repo directory
     def handler(*args, **kwargs):
         return GitHTTPHandler(
             *args,
             repo_dir=temp_dir,
+            request_log=request_log,
             upload_pack_count_file=upload_pack_count_file,
             **kwargs,
         )
@@ -223,6 +243,8 @@ def handler(*args, **kwargs):
     # This avoids race conditions between finding and binding
     with socketserver.TCPServer(("", port), handler) as httpd:
         actual_port = httpd.server_address[1]
+        print(f"Creating test repository at {repo_path}")
+        create_test_repo(str(repo_path), actual_port)
         print(f"Git HTTP server running on port {actual_port}")
         print(f"Repository URL: http://localhost:{actual_port}/repo.git")
 
@@ -254,6 +276,8 @@ def handler(*args, **kwargs):
             ready_file.unlink(missing_ok=True)
             if upload_pack_count_file is not None:
                 upload_pack_count_file.unlink(missing_ok=True)
+            if request_log is not None:
+                request_log.unlink(missing_ok=True)
 
 if __name__ == '__main__':
     port = int(sys.argv[1]) if len(sys.argv) > 1 else 0

e2e/helpers/scripts/http_test_server.py

@@ -34,6 +34,20 @@ def do_GET(self):
             self.end_headers()
             content = '#!/usr/bin/env bash\necho "running mytask"\n'
             self.wfile.write(content.encode('utf-8'))
+        elif self.path == '/test/remote-template':
+            if marker := os.environ.get('MISE_HTTP_REQUEST_MARKER'):
+                Path(marker).touch()
+            self.send_response(200)
+            self.send_header('Content-Type', 'text/plain')
+            self.end_headers()
+            content = (
+                '#!/usr/bin/env bash\n'
+                '#MISE description="{{ exec(command=\'touch $MISE_REMOTE_TEMPLATE_MARKER\') }}"\n'
+                '#MISE depends=["remote_dep"]\n'
+                '#USAGE flag "--remote-flag" help="Remote usage flag"\n'
+                'echo "remote template task ran"\n'
+            )
+            self.wfile.write(content.encode('utf-8'))
         elif self.path == '/test/remote-changing':
             TestFileHandler.changing_remote_revision += 1
             revision = TestFileHandler.changing_remote_revision

e2e/tasks/test_task_remote_git_includes

@@ -8,15 +8,17 @@ PORT_FILE="$TMPDIR/mise_git_http_port"
 READY_FILE="$TMPDIR/mise_git_http_ready"
 INFO_FILE="$TMPDIR/mise_git_http_info"
 UPLOAD_PACK_COUNT_FILE="$TMPDIR/mise_git_http_upload_pack_count"
+REQUEST_LOG="$TMPDIR/mise_git_http_requests"
 
 # Clean up any previous server files
-rm -f "$PORT_FILE" "$READY_FILE" "$INFO_FILE" "$UPLOAD_PACK_COUNT_FILE"
+rm -f "$PORT_FILE" "$READY_FILE" "$INFO_FILE" "$UPLOAD_PACK_COUNT_FILE" "$REQUEST_LOG"
 
 # Start local git HTTP server with OS-assigned port to avoid race conditions
 MISE_GIT_HTTP_PORT_FILE="$PORT_FILE" \
   MISE_GIT_HTTP_READY_FILE="$READY_FILE" \
   MISE_GIT_HTTP_INFO_FILE="$INFO_FILE" \
   MISE_GIT_HTTP_UPLOAD_PACK_COUNT_FILE="$UPLOAD_PACK_COUNT_FILE" \
+  MISE_GIT_HTTP_REQUEST_LOG="$REQUEST_LOG" \
   python3 "${TEST_ROOT}/helpers/scripts/git_http_backend_server.py" 0 &
 SERVER_PID=$!
 
@@ -52,7 +54,7 @@ git init
 # Ensure cleanup on exit
 cleanup() {
   kill "$SERVER_PID" 2>/dev/null || true
-  rm -f "$PORT_FILE" "$READY_FILE" "$INFO_FILE" "$UPLOAD_PACK_COUNT_FILE"
+  rm -f "$PORT_FILE" "$READY_FILE" "$INFO_FILE" "$UPLOAD_PACK_COUNT_FILE" "$REQUEST_LOG"
 }
 trap cleanup EXIT
 
@@ -67,6 +69,11 @@ includes = [
 ]
 EOF
 
+# Safe-mode parsing must reject an untrusted remote include before cloning it.
+: >"$REQUEST_LOG"
+assert_fail "env -u CI -u GITHUB_ACTION -u GITHUB_ACTIONS MISE_SAFE=1 MISE_TRUSTED_CONFIG_PATHS=$TMPDIR/not-trusted MISE_YES=0 mise tasks ls" "fetching remote task include git::"
+assert_fail "test -s '$REQUEST_LOG'"
+
 # The xtasks/lint directory contains multiple task files
 # We should be able to see and run them
 assert_contains "mise tasks" "remote-task"
@@ -164,6 +171,18 @@ assert_contains "mise tasks" "toml_table_task"
 assert_contains "mise run toml_task" "toml_task executed"
 assert_contains "mise run toml_table_task" "toml_table_task executed"
 
+# A remote TOML include may declare another remote file task. Preserve the
+# local config as trust provenance through both remote layers.
+NESTED_ARTIFACT_TMPDIR="$TMPDIR/nested-remote-git-artifacts"
+mkdir -p "$NESTED_ARTIFACT_TMPDIR"
+assert_contains "TMPDIR=$NESTED_ARTIFACT_TMPDIR MISE_TASK_REMOTE_NO_CACHE=true mise run nested_remote" "nested remote task executed"
+assert_directory_empty "$NESTED_ARTIFACT_TMPDIR"
+
+PROVENANCE_STATE_DIR="$TMPDIR/remote-git-provenance-state"
+mkdir -p "$PROVENANCE_STATE_DIR"
+assert_contains "MISE_STATE_DIR=$PROVENANCE_STATE_DIR MISE_TRUSTED_CONFIG_PATHS='' MISE_YES=1 mise run nested_remote" "nested remote task executed"
+assert "find '$PROVENANCE_STATE_DIR/trusted-configs' -mindepth 1 \\( -type f -o -type l \\) 2>/dev/null | wc -l | tr -d ' '" "1"
+
 mise cache clear # Clear cache to force redownload
 
 #################################################################################

e2e/tasks/test_task_remote_metadata_trust

@@ -0,0 +1,112 @@
+#!/usr/bin/env bash
+
+# Remote task discovery must trust the defining config before it fetches or
+# renders metadata, including through explicitly included task files.
+
+HTTP_PORT_FILE="$TMPDIR/mise_http_test_port"
+MARKER="$TMPDIR/remote-template-executed"
+REQUEST_MARKER="$TMPDIR/remote-template-requested"
+MISE_HTTP_TEST_PORT_FILE="$HTTP_PORT_FILE" \
+  MISE_HTTP_REQUEST_MARKER="$REQUEST_MARKER" \
+  python3 "${TEST_ROOT}/helpers/scripts/http_test_server.py" 0 &
+HTTP_SERVER_PID=$!
+
+cleanup() {
+  kill "$HTTP_SERVER_PID" 2>/dev/null || true
+}
+trap cleanup EXIT
+
+wait_for_file "$HTTP_PORT_FILE" "HTTP test server port file" 30 "$HTTP_SERVER_PID"
+HTTP_PORT=$(cat "$HTTP_PORT_FILE")
+
+UNTRUSTED_ENV="env -u CI -u GITHUB_ACTION -u GITHUB_ACTIONS MISE_PARANOID=1 MISE_TRUSTED_CONFIG_PATHS=$TMPDIR/not-trusted MISE_YES=0 MISE_REMOTE_TEMPLATE_MARKER=$MARKER"
+
+cat <<EOF >mise.toml
+[tasks.remote_template]
+file = "http://localhost:${HTTP_PORT}/test/remote-template"
+
+[tasks.remote_dep]
+run = "echo remote dependency"
+EOF
+
+# Both gates report which one refused, so the assertions below can tell a
+# blocked fetch apart from a blocked render.
+REMOTE_URL="http://localhost:${HTTP_PORT}/test/remote-template"
+FETCH_REFUSED="fetching remote task $REMOTE_URL requires its defining config to be trusted"
+RENDER_REFUSED="remote task metadata from $REMOTE_URL requires its defining config to be trusted"
+
+# Safe mode is a code-execution boundary, not a network one: an untrusted
+# config can already download arbitrary URLs there through the HTTP-based
+# backends, so the fetch is allowed. Rendering the fetched header is what must
+# still require trust.
+assert_fail "$UNTRUSTED_ENV MISE_SAFE=1 mise tasks ls" "$RENDER_REFUSED"
+[[ -e $REQUEST_MARKER ]] || fail "safe mode should still fetch the remote task"
+# belt and braces: in safe mode the tera exec stub would also stop this
+[[ ! -e $MARKER ]] || fail "safe-mode remote metadata template rendered without trust"
+rm -f "$REQUEST_MARKER"
+
+# Outside paranoid mode a plain-tasks config body parses trust-exempt, so these
+# failures come from the fetch gate rather than a parse-time trust check. The
+# safe-mode run above populated the remote-task cache, so force no-cache to
+# keep "no request was made" meaningful.
+NON_PARANOID_UNTRUSTED_ENV="env -u CI -u GITHUB_ACTION -u GITHUB_ACTIONS MISE_TRUSTED_CONFIG_PATHS=$TMPDIR/not-trusted MISE_YES=0 MISE_TASK_REMOTE_NO_CACHE=true MISE_REMOTE_TEMPLATE_MARKER=$MARKER"
+assert_fail "$NON_PARANOID_UNTRUSTED_ENV mise tasks ls" "$FETCH_REFUSED"
+assert_fail "$NON_PARANOID_UNTRUSTED_ENV mise tasks info remote_template" "$FETCH_REFUSED"
+assert_fail "$NON_PARANOID_UNTRUSTED_ENV mise tasks validate remote_template" "$FETCH_REFUSED"
+assert_fail "$NON_PARANOID_UNTRUSTED_ENV mise tasks deps remote_template" "$FETCH_REFUSED"
+# Cache inspection is passive discovery too and must honor the same gate.
+assert_fail "$NON_PARANOID_UNTRUSTED_ENV mise cache task remote_template" "$FETCH_REFUSED"
+[[ ! -e $REQUEST_MARKER ]] || fail "remote task was fetched despite the untrusted fetch gate"
+[[ ! -e $MARKER ]] || fail "remote metadata template executed despite the untrusted fetch gate"
+
+# Passive discovery authorizes, it must not acquire: even under MISE_YES=1 a
+# listing must not persist trust for the whole config root.
+YES_STATE_DIR="$TMPDIR/yes-trust-state"
+mkdir -p "$YES_STATE_DIR"
+assert_fail "env -u CI -u GITHUB_ACTION -u GITHUB_ACTIONS MISE_TRUSTED_CONFIG_PATHS=$TMPDIR/not-trusted MISE_YES=1 MISE_STATE_DIR=$YES_STATE_DIR MISE_TASK_REMOTE_NO_CACHE=true mise tasks ls" "$FETCH_REFUSED"
+assert "find '$YES_STATE_DIR/trusted-configs' -mindepth 1 2>/dev/null | wc -l | tr -d ' '" "0"
+
+# watch expands task dependencies (fetching remote tasks) before any run is
+# spawned, so safe mode must refuse it before discovery starts.
+assert_fail "$UNTRUSTED_ENV MISE_SAFE=1 MISE_TASK_REMOTE_NO_CACHE=true mise watch remote_template" "disabled in safe mode"
+[[ ! -e $REQUEST_MARKER ]] || fail "safe-mode watch fetched an untrusted remote task"
+
+# no-cache so this re-fetches rather than reusing the safe-mode download above
+assert_succeed "$UNTRUSTED_ENV mise trust mise.toml"
+assert_succeed "$UNTRUSTED_ENV MISE_TASK_REMOTE_NO_CACHE=true mise tasks ls"
+[[ -e $REQUEST_MARKER ]] || fail "trusted passive discovery did not fetch the remote task"
+[[ -e $MARKER ]] || fail "trusted remote metadata template did not render"
+
+# Trust gets the header past the render gate, but safe mode still refuses the
+# code execution inside it, exactly as it does for a local task template.
+assert_fail "$UNTRUSTED_ENV MISE_SAFE=1 mise tasks ls" "exec() is disabled in safe mode"
+assert_succeed "$UNTRUSTED_ENV mise untrust mise.toml"
+
+# A template-free remote task is inert once fetched, so safe mode can list it
+# without trust.
+PLAIN_DIR="$TMPDIR/plain-remote"
+mkdir -p "$PLAIN_DIR"
+cat <<EOF >"$PLAIN_DIR/mise.toml"
+[tasks.remote_plain]
+file = "http://localhost:${HTTP_PORT}/test/mytask"
+EOF
+assert_contains "cd '$PLAIN_DIR' && $UNTRUSTED_ENV MISE_SAFE=1 mise tasks ls" "remote_plain"
+
+# A trusted config vouches for an explicitly included task file even when that
+# file is outside the config's trust root. Preserve that provenance when the
+# include declares a remote task, including for temporary no-cache snapshots.
+INCLUDED_TASK_DIR="$TMPDIR/included-remote-tasks"
+mkdir -p "$INCLUDED_TASK_DIR"
+cat <<EOF >"$INCLUDED_TASK_DIR/tasks.toml"
+[included_remote_template]
+file = "http://localhost:${HTTP_PORT}/test/remote-template"
+EOF
+cat <<EOF >mise.toml
+[task_config]
+includes = ["$INCLUDED_TASK_DIR/tasks.toml"]
+EOF
+
+assert_succeed "$UNTRUSTED_ENV mise trust mise.toml"
+assert_contains "$UNTRUSTED_ENV mise tasks info included_remote_template" "remote_dep"
+assert_contains "$UNTRUSTED_ENV MISE_TASK_REMOTE_NO_CACHE=true mise tasks info included_remote_template" "remote_dep"
+assert_succeed "$UNTRUSTED_ENV mise untrust mise.toml"

src/cli/cache/task.rs

@@ -129,6 +129,7 @@ pub(super) async fn resolve_tasks(task_spec: &str) -> Result<(Arc<Config>, Vec<T
         bail!("Task not found: {task_spec}, use `mise tasks ls --all --hidden` to list all tasks");
     }
     TaskFetcher::new(false)
+        .require_trust_before_fetch()
         .fetch_tasks(&config, &mut tasks)
         .await?;
     Ok((config, tasks))

src/cli/tasks/deps.rs

@@ -142,7 +142,7 @@ impl TasksDeps {
     /// ```
     ///
     async fn print_deps_tree(&self, config: &Arc<Config>, tasks: Vec<Task>) -> Result<()> {
-        let deps = Deps::new(config, tasks.clone()).await?;
+        let deps = Deps::new_for_display(config, tasks.clone()).await?;
         // filter out nodes that are not selected
         let start_indexes = deps.graph.node_indices().filter(|&idx| {
             let task = &deps.graph[idx];
@@ -181,7 +181,7 @@ impl TasksDeps {
     /// ```
     //
     async fn print_deps_dot(&self, config: &Arc<Config>, tasks: Vec<Task>) -> Result<()> {
-        let deps = Deps::new(config, tasks).await?;
+        let deps = Deps::new_for_display(config, tasks).await?;
         miseprintln!(
             "{:?}",
             Dot::with_attr_getters(

src/cli/tasks/info.rs

@@ -51,6 +51,7 @@ impl TasksInfo {
             // always pass no_cache=false as the command doesn't take no-cache argument
             // MISE_TASK_REMOTE_NO_CACHE env var is still respected if set
             TaskFetcher::new(false)
+                .require_trust_before_fetch()
                 .fetch_tasks(&config, &mut tasks)
                 .await?;
             let task = &tasks[0];

src/cli/tasks/ls.rs

@@ -158,6 +158,7 @@ impl TasksLs {
         // always pass no_cache=false as the command doesn't take no-cache argument
         // MISE_TASK_REMOTE_NO_CACHE env var is still respected if set
         TaskFetcher::new(false)
+            .require_trust_before_fetch()
             .fetch_tasks(&config, &mut tasks)
             .await?;
 

src/cli/tasks/validate.rs

@@ -70,6 +70,7 @@ impl TasksValidate {
         // always no_cache=false as the command doesn't take no-cache argument
         // MISE_TASK_REMOTE_NO_CACHE env var is still respected if set
         TaskFetcher::new(false)
+            .require_trust_before_fetch()
             .fetch_tasks(&config, &mut resolved_tasks)
             .await?;
         let all_tasks: BTreeMap<String, Task> = resolved_tasks

src/cli/watch.rs

@@ -2,7 +2,7 @@ use crate::Result;
 use crate::cli::Cli;
 use crate::cli::args::BackendArg;
 use crate::cmd;
-use crate::config::Config;
+use crate::config::{Config, Settings};
 use crate::dirs;
 use crate::env;
 use crate::request_exit;
@@ -66,6 +66,8 @@ impl Watch {
                 return Ok(());
             }
         }
+        Settings::ensure_not_safe("running tasks")?;
+
         let config = Config::get().await?;
         let ts = ToolsetBuilder::new().build(&config).await?;
         if let Err(err) = which::which("watchexec") {