macOS: tap metadata sandbox prevents Ruby 4.0.6 startup (rb_check_realpath_internal / EPERM)

[soodoh]

Problem

On mise 2026.9.2, bootstrap packages upgrade --dry-run fails while starting Ruby inside the third-party tap metadata sandbox. The same Ruby binary starts normally outside the sandbox.

Environment

• macOS 26.6.2 (25G83), Apple Silicon.
• mise 2026.9.2 macos-arm64, standalone release binary.
• mise-managed Ruby 4.0.6, precompiled arm64-darwin23 build.
• Bash 3.2.57; Ruby and mise explicitly on PATH, without shell activation.
• vjeantet/tap/alerter 26.5 already installed through Homebrew. This matters because upgrade skips missing packages.

Reproduction

Minimal mise.toml:

[settings]
experimental = true

[tools]
ruby = "4.0.6"

[bootstrap.packages]
"brew:vjeantet/tap/alerter" = { version = "latest", os = "macos" }

With Ruby installed and on PATH:

ruby --version
mise --verbose bootstrap packages upgrade --dry-run brew:vjeantet/tap/alerter

Expected: resolve the metadata and report an upgrade/no-op decision.

Actual: mise exits 1. Relevant output (<REPRO> replaces the temporary root):

<REPRO>/data/installs/ruby/4.0.6/bin/ruby: Operation not permitted @ rb_check_realpath_internal - <REPRO>/data/installs/ruby/4.0.6/bin/ruby (Errno::EPERM)
   1: failed to evaluate Formula/alerter.rb
   2: sandbox-exec exited with non-zero status: exit code 1

The tap's API JSON returns 404, but fetching its Ruby definition succeeds. This reproduces with temporary HOME/config/data directories under /private/tmp, empty global/system configs, and a copy of the complete mise-installed Ruby prefix. The existing Homebrew installation was only inspected; no system packages were changed.

Investigation

Running only puts RUBY_VERSION under the exact sandbox profile emitted by mise produces the same error. Adding this rule makes that startup-only probe succeed:

(allow file-read-metadata (literal "/") (literal "/private"))

This suggests ancestor-directory metadata access is involved. It is not a verified production fix; I have not patched mise or tested other Ruby/macOS versions. Could this be a sandbox permissions issue, or am I missing required setup?

Related: sandbox discussion #8878 and tap support PR #12774. I can provide the full sandbox profile and diagnostic comparison if useful.

mise doctor

Full output from the isolated reproduction, with paths redacted. The activation warning reflects the explicit-PATH setup above.

mise doctor output (exit 1)

version: 2026.9.2 macos-arm64 (2026-09-07)
activated: no
shims_on_path: no
self_update_available: yes

build_info:
  Target: aarch64-apple-darwin
  Features: openssl, rustls-native-roots, self_update
  Built: Mon, 7 Sep 2026 21:08:41 +0000
  Rust Version: rustc 1.98.1 (48a229cea 2026-09-01)
  Profile: release

shell:
  /bin/bash
  GNU bash, version 3.2.57(1)-release (arm64-apple-darwin25)
  Copyright (C) 2007 Free Software Foundation, Inc.

aqua:
  baked in registry: aquaproj/aqua-registry@66fcd35225f63e49cd7f9522e96ed645390bdc28
  baked in registry tools: 2290

dirs:
  cache: <REPRO>/cache
  config: <REPRO>
  data: <REPRO>/data
  shims: <REPRO>/data/shims
  system_shims: /usr/local/share/mise/shims
  state: <REPRO>/state

config_files:
  <REPRO>/system.toml
  <REPRO>/global.toml
  <REPRO>/mise.toml

env_files:
  (none)

ignored_config_files: (none)

backends:
  aqua
  asdf
  cargo
  conda
  core
  dotnet
  forgejo
  gem
  github
  gitlab
  go
  npm
  packslip
  pipx
  pkgx
  spm
  http
  s3
  ubi
  vfox

plugins:

toolset:
  core:ruby@4.0.6

path:
  <REPRO>/data/installs/ruby/4.0.6/bin
  <REPRO>/bin
  /usr/bin
  /bin
  /usr/sbin
  /sbin

system_packages:
  brew: 1 requested, 0 missing

env_vars:
  MISE_DATA_DIR=<REPRO>/data
  MISE_CACHE_DIR=<REPRO>/cache
  MISE_STATE_DIR=<REPRO>/state
  MISE_CONFIG_DIR=<REPRO>
  MISE_GLOBAL_CONFIG_FILE=<REPRO>/global.toml
  MISE_SYSTEM_CONFIG_FILE=<REPRO>/system.toml
  MISE_TRUSTED_CONFIG_PATHS=<REPRO>
  MISE_COLOR=0

settings:
  experimental  true <REPRO>/mise.toml

1 problem found:

1. mise is not activated, run mise help activate or
   read documentation at https://mise.jdx.dev for activation instructions.
   Alternatively, add the shims directory <REPRO>/data/shims to PATH.
   Using the shims directory is preferred for non-interactive setups.

AI-assisted — Tool: Pi; model: openai-codex/gpt-6-astra; version: 0.85.1.

[jdx]

Thanks for the detailed reproduction—the diagnosis was correct. I reproduced the failure on macOS 26.6.2 with the mise precompiled Ruby 4.0.6. The portable build uses --enable-load-relative, so Ruby resolves its executable path during startup. The Seatbelt profile allowed /private/tmp but denied the metadata lookup on its parent /private, which produced the rb_check_realpath_internal EPERM before the tap formula ran.

I opened #12940 with a narrow fix: allow file-read-metadata on the literal /private directory. It does not allow reading or listing /private or its descendants. The regression test verifies that stat /private succeeds while ls /private remains denied.

AI-assisted — Tool: Codex; model: openai/gpt-5; version: unavailable.