How to remove unencrypted file from git history

[agriffis]

I accidentally added a file unencrypted, now I'm stuck:

▶ mdot sync
mise ERROR cannot publish: encrypted path home/.pi/agent/auth.json has an
unencrypted or invalid version in commit
6a6bf9a30e8149178b67e894fb74e165cf2ad654; encrypting the latest version does not
erase earlier plaintext. Review and explicitly rewrite or replace that history
before connecting it to origin; mise will not rewrite it automatically

My origin repo is private (self-hosted) so it's not a major concern, but I'd like to know what the best/current workflow is to repair this.

I tried using git log -p in ~/.local/state/mise/history/repo.git to find the commit before the one that added the file, and then git reset --hard but it didn't work because this isn't actually a checked out tree.

[jdx]

You found the right boundary. Since mise owns a bare repository, the equivalent of resetting its checked-out branch is to move refs/heads/main with git update-ref.

First rotate anything usable from auth.json, stop the history watcher, and make a secure backup of ~/.local/state/mise/history/repo.git (the backup still contains the plaintext). If the bad commit was never published and it is okay to discard it and every checkpoint after it:

repo="${MISE_STATE_DIR:-${XDG_STATE_HOME:-$HOME/.local/state}/mise}/history/repo.git"
old="$(git --git-dir="$repo" rev-parse refs/heads/main)"
safe="<commit immediately before 6a6bf9a>"

git --git-dir="$repo" merge-base --is-ancestor "$safe" "$old"
git --git-dir="$repo" update-ref -m "remove plaintext history" \
  refs/heads/main "$safe" "$old"
mise dot save ~/.pi/agent/auth.json \
  --description "save encrypted credentials"
mise dot sync

Passing $old makes the ref update fail safely if another checkpoint appeared after inspection. The explicit save rebuilds mise's derived index and records the current live file using its encryption policy.

If the plaintext commit already reached the self-hosted origin, the local repair is not enough: pause every connected machine, replace the origin branch with the reviewed history using a direct Git force-with-lease push, and make every other machine adopt that exact replacement. mise intentionally never force-pushes, because a stale clone could otherwise reintroduce the exposed commit. If later local checkpoints need to retain their individual history, use git-filter-repo on a separate secure copy instead of truncating at $safe.

I opened #13175 to add this workflow, including the published-origin and retention caveats, to the history guide.

AI-assisted — Tool: Codex; model: unavailable; version: unavailable.

[jdx]

You're right—the watcher is not involved here, and my earlier diagnosis was wrong. --adopt itself was capturing files declared by the existing config.toml before it performed the incoming-tree preflight. With the history directory removed, that capture created a new local root, which was then correctly rejected as unrelated to the recreated origin. --force-dotfiles runs too late to affect that ancestry check.

I opened #13182 to fix fresh adoption so it compares existing live files with the incoming setup without first creating local ancestry. For the machine B sequence you showed, ordinary adoption should then work:

mise bootstrap --adopt ssh://git@nuthatch.scampernet:30143/aron/dot.git --yes --force-dotfiles

The PR also adds an explicit escape hatch for the separate case where a machine genuinely still has unrelated local history that should be discarded:

mise bootstrap --adopt <url> --replace-history --yes

That replacement is one-shot, supports --dry-run, keeps ordinary sync non-destructive, and restores the previous local branch/state if the incoming setup cannot be applied completely.

AI-assisted — Tool: Codex; model: openai/gpt-5; version: unavailable.

[jdx]

To unblock machine B before #13182 is merged/released, move both the failed adoption store and the active config.toml aside, then adopt again. Moving config.toml is the important part: it prevents the released code from discovering the old declarations and capturing a new local root before adoption.

url='ssh://git@nuthatch.scampernet:30143/aron/dot.git'
state="${MISE_STATE_DIR:-${XDG_STATE_HOME:-$HOME/.local/state}/mise}"
config_dir="${MISE_CONFIG_DIR:-${XDG_CONFIG_HOME:-$HOME/.config}/mise}"
recovery="$state/adopt-recovery-$(date +%Y%m%d-%H%M%S)"

mkdir -p "$recovery"
[ ! -e "$state/history" ] || mv "$state/history" "$recovery/history"
[ ! -e "$config_dir/config.toml" ] || \
  mv "$config_dir/config.toml" "$recovery/config.toml"

mise bootstrap --adopt "$url" --yes --force-dotfiles

The adopted repository should write its reviewed config.toml back into place. Keep $recovery until mise dot status, the restored files, and a sync all look correct; compare $recovery/config.toml with the adopted copy if useful. Do not copy the old config back over the adopted one.

If adoption reports that a live file needs a decision, it was not overwritten: use mise dot status, then either move that file aside and retry or explicitly choose it with mise dot pull --take-remote <path> / --keep-local <path>. --force-dotfiles only affects the later bootstrap dotfile application; it does not resolve history-adoption conflicts.

Once #13182 is available, moving config.toml is no longer necessary for a fresh store. --replace-history is only for a store that intentionally retains genuinely unrelated local history.

AI-assisted — Tool: Codex; model: openai/gpt-5; version: unavailable.

[agriffis]

Thank you, moving .config/mise/config.toml aside did the trick to allow adoption to complete successfully.

[agriffis]

I'd like to choose something as the "answer" but there are lots of pieces, so here is the rollup:

• If you track something that exposes secrets, and sync that to a remote origin, and then on to other machines, then unwinding that is non-trivial. The workflow, with caveats, is documented via feat(dotfiles): allow opting out of plaintext history checks #13175

• If you can invalidate what you exposed, then you can enable encryption for the affected file without needing to clean it from git, thanks to --allow-plaintext-history in feat(dotfiles): allow opting out of plaintext history checks #13175

• If you need to clean git, then it might be easier to start over with a new repo, if it's okay to lose the historical record. Follow these steps but beware that you need to move .config/mise/config.toml aside on machine B (and C, D, etc) per this comment; alternatively, wait for feat(dotfiles): add safe history replacement during adoption #13182.

Thanks for all your help, @jdx.