feat(bootstrap): expose resource provenance (#12100)

Author: jdx

docs/bootstrap/files.md

@@ -97,3 +97,11 @@ change.
 `mise bootstrap plan` includes these resources and automatically orders a
 managed file after its managed parent directory. Removal reverses that
 dependency so children are removed before their parent.
+
+The JSON output from `mise bootstrap plan`, `mise bootstrap status`, and
+`mise bootstrap files status` includes an `origin` object for managed files
+and directories. It identifies the declaring config, that config's
+`config_root`, any configuration environment encoded by its filename, and a
+resolved source path when the file uses `source`.
+Paths are ordinary strings when they are valid UTF-8. On Unix, a path containing
+non-UTF-8 bytes uses `mise:path-bytes:<base64url>` so provenance remains lossless.

docs/dotfiles.md

@@ -59,6 +59,14 @@ that declares the entry, so a global `~/.config/mise/config.toml` can manage
 dotfiles kept next to it, and a project config can ship machine setup from
 the repo.
 
+`mise bootstrap dotfiles status --json` includes an `origin` object for every
+entry. It reports the declaring config, its `config_root`, any configuration
+environment encoded by that config filename, and the resolved source path.
+Paths are ordinary strings when they are valid UTF-8. On Unix, a path containing
+non-UTF-8 bytes uses `mise:path-bytes:<base64url>` so provenance remains lossless.
+This makes layered dotfile declarations inspectable without reconstructing
+their precedence by hand.
+
 Use `content` to declare a literal whole file inline instead of keeping a
 separate source file. Inline content is written as a private regular file
 (`0600` on Unix) and cannot be combined with `source`, `mode`, or `exclude`:

e2e/cli/test_bootstrap_secrets

@@ -8,18 +8,20 @@ fi
 secret_value="mise-bootstrap-secret-7f9d3a"
 secret_env="MISE_BOOTSTRAP_TEST_SECRET"
 managed_file="$PWD/secret.conf"
+template_source="$PWD/secret.conf.tmpl"
 static_file="$PWD/static.conf"
 static_dir="$PWD/static-dir"
 managed_owner="$(id -un)"
 managed_group="$(id -gn)"
 
 unset "$secret_env"
+echo 'token={{ secret(name="cache_token") }}' >"$template_source"
 cat <<EOF >mise.toml
 [bootstrap.secrets]
 cache_token = { env = "$secret_env", description = "Cache token" }
 
 [bootstrap.files."$managed_file"]
-content = 'token={{ secret(name="cache_token") }}'
+source = "secret.conf.tmpl"
 template = true
 owner = "$managed_owner"
 group = "$managed_group"
@@ -56,6 +58,8 @@ assert_contains "mise bootstrap plan" "$managed_file"
 assert_contains "mise bootstrap plan" "$static_file"
 assert_contains "mise bootstrap plan" "$static_dir"
 assert_contains "mise bootstrap plan" "unknown"
+assert_succeed "mise bootstrap plan --json | jq -e '.resources[] | select(.id.name == \"$managed_file\") | .origin.source == \"$template_source\"'"
+assert_succeed "mise bootstrap files status --json | jq -e '.[] | select(.id.name == \"$managed_file\") | .origin.source == \"$template_source\"'"
 assert_fail "mise bootstrap plan --detailed-exitcode"
 assert_succeed "mise bootstrap --only repos --dry-run"
 

e2e/cli/test_bootstrap_system_files

@@ -51,6 +51,8 @@ assert "cat $managed_file" "first"
 assert "stat -c %a $managed_nested" "750"
 assert_succeed "mise bootstrap files status --missing"
 assert_succeed "mise bootstrap files status --json | jq -e . >/dev/null"
+assert_succeed "mise bootstrap files status --json | jq -e '.[] | select(.id.kind == \"file\") | .origin.config == \"$PWD/mise.toml\" and .origin.config_root == \"$PWD\"'"
+assert_succeed "mise bootstrap plan --json | jq -e '.resources[] | select(.id.kind == \"file\") | .origin.config == \"$PWD/mise.toml\" and .origin.config_root == \"$PWD\"'"
 assert_contains "mise bootstrap status --json" '"files"'
 
 # Applying the same declarations again is a no-op.

e2e/cli/test_dotfiles_files

@@ -27,6 +27,13 @@ EOF
 assert_contains "mise bootstrap dotfiles status" "missing"
 assert_contains "MISE_EXPERIMENTAL=0 mise dotfiles status" "missing"
 assert_fail "mise dotfiles status --missing"
+assert_succeed "mise dotfiles status --json | jq -e '.files[] | select(.target == \"~/.gitconfig\") | .origin.config == \"$PWD/mise.toml\" and .origin.config_root == \"$PWD\" and .origin.source == \"$PWD/dotfiles/gitconfig\"'"
+
+cat <<EOF >mise.dev.toml
+[dotfiles]
+"~/.dev-origin" = { content = "dev" }
+EOF
+assert_succeed "MISE_ENV=dev mise dotfiles status --json | jq -e '.files[] | select(.target == \"~/.dev-origin\") | .origin.environment == [\"dev\"]'"
 
 # system commands do not manage dotfiles
 assert_succeed "mise bootstrap packages apply --yes"

src/cli/bootstrap.rs

@@ -1939,13 +1939,21 @@ impl BootstrapPlan {
         } else if output.resources.is_empty() {
             info!("nothing configured for bootstrap planning");
         } else {
-            let mut table = MiseTable::new(false, &["Action", "Resource", "Current", "Desired"]);
+            let mut table = MiseTable::new(
+                false,
+                &["Action", "Resource", "Current", "Desired", "Config"],
+            );
             for resource in &output.resources {
                 table.add_row(vec![
                     resource.action.to_string(),
                     resource.id.to_string(),
                     resource.current.clone(),
                     resource.desired.clone(),
+                    resource
+                        .origin
+                        .as_ref()
+                        .map(|origin| origin.config.display_user())
+                        .unwrap_or_default(),
                 ]);
             }
             table.print()?;
@@ -2138,13 +2146,20 @@ impl BootstrapFilesStatus {
         } else if resources.is_empty() {
             info!("no system files or directories configured");
         } else {
-            let mut table = MiseTable::new(false, &["Action", "Resource", "Current", "Desired"]);
+            let mut table = MiseTable::new(
+                false,
+                &["Action", "Resource", "Current", "Desired", "Config"],
+            );
             for resource in resources {
                 table.add_row(vec![
                     resource.action.to_string(),
                     resource.id.to_string(),
                     resource.current,
                     resource.desired,
+                    resource
+                        .origin
+                        .map(|origin| origin.config.display_user())
+                        .unwrap_or_default(),
                 ]);
             }
             table.print()?;

src/cli/dotfiles/add.rs

@@ -392,6 +392,12 @@ impl PlannedAdd {
                 .parent()
                 .unwrap_or(std::path::Path::new("."))
                 .to_path_buf(),
+            origin: crate::system::resources::ResourceOrigin {
+                config: config_path.to_path_buf(),
+                config_root: crate::config::config_file::config_root::config_root(config_path),
+                environment: crate::config::environments_for_config_path(config_path),
+                source: Some(self.source.clone()),
+            },
         }
     }
 }

src/cli/dotfiles/status.rs

@@ -58,6 +58,7 @@ impl DotfilesStatus {
                     "source": (req.mode != system::files::FileMode::Content)
                         .then(|| req.source.display_user()),
                     "mode": req.mode.name(),
+                    "origin": &req.origin,
                     "state": match &state {
                         FileState::Applied => "applied",
                         FileState::Missing => "missing",
@@ -74,6 +75,7 @@ impl DotfilesStatus {
                     } else {
                         req.source.display_user()
                     },
+                    req.origin.config.display_user(),
                     state_str,
                 ]);
             }
@@ -113,6 +115,7 @@ impl DotfilesStatus {
                 json_edits.push(json!({
                     "path": req.path_raw,
                     "edit": req.describe_op(),
+                    "origin": &req.origin,
                     "state": match &state {
                         FileState::Applied => "applied",
                         FileState::Missing => "missing",
@@ -121,7 +124,12 @@ impl DotfilesStatus {
                     },
                 }));
             } else {
-                edit_rows.push(vec![req.path_raw.clone(), req.describe_op(), state_str]);
+                edit_rows.push(vec![
+                    req.path_raw.clone(),
+                    req.describe_op(),
+                    req.origin.config.display_user(),
+                    state_str,
+                ]);
             }
         }
 
@@ -143,14 +151,15 @@ impl DotfilesStatus {
                 info!("nothing configured in [dotfiles]");
             }
             if !file_rows.is_empty() {
-                let mut table = MiseTable::new(false, &["Target", "Mode", "Source", "State"]);
+                let mut table =
+                    MiseTable::new(false, &["Target", "Mode", "Source", "Config", "State"]);
                 for row in file_rows {
                     table.add_row(row);
                 }
                 table.print()?;
             }
             if !edit_rows.is_empty() {
-                let mut table = MiseTable::new(false, &["File", "Edit", "State"]);
+                let mut table = MiseTable::new(false, &["File", "Edit", "Config", "State"]);
                 for row in edit_rows {
                     table.add_row(row);
                 }

src/config/mod.rs

@@ -1721,6 +1721,25 @@ pub(crate) fn config_paths_in_dir(dir: &Path) -> Vec<PathBuf> {
     config_paths_in_dir_with_filenames(dir, &DEFAULT_CONFIG_FILENAMES)
 }
 
+/// Return the active configuration environment encoded in a loaded config
+/// filename. A vector matches the ordered MISE_ENV model and leaves room for
+/// future config forms that represent more than one environment.
+pub(crate) fn environments_for_config_path(path: &Path) -> Vec<String> {
+    let Some(filename) = path.file_name().and_then(|name| name.to_str()) else {
+        return vec![];
+    };
+    env::MISE_ENV_WITH_AUTO
+        .iter()
+        .filter(|environment| {
+            ["config", "mise", ".mise"].into_iter().any(|prefix| {
+                filename == format!("{prefix}.{environment}.toml")
+                    || filename == format!("{prefix}.{environment}.local.toml")
+            })
+        })
+        .cloned()
+        .collect()
+}
+
 fn config_paths_in_dir_with_filenames(dir: &Path, filenames: &[String]) -> Vec<PathBuf> {
     let config_paths: Vec<PathBuf> = filenames
         .iter()

src/system/edits.rs

@@ -34,6 +34,7 @@ use crate::config::{Config, ConfigMap};
 use crate::file;
 use crate::path::PathExt;
 use crate::system::files::FileState;
+use crate::system::resources::ResourceOrigin;
 use crate::ui::prompt;
 
 /// one `[dotfiles]` edit entry as written in mise.toml. Operations stay loosely typed so configs using operations
@@ -107,6 +108,7 @@ pub struct EditRequest {
     pub base: PathBuf,
     /// config file that declared this edit
     pub config_path: PathBuf,
+    pub origin: ResourceOrigin,
 }
 
 impl EditRequest {
@@ -228,6 +230,12 @@ fn resolve_entry(
             "\"{path_raw}\".{id:?}: ids may only contain letters, digits, '_', '-', and '.', ignoring entry"
         );
     }
+    let mut origin = ResourceOrigin {
+        config: config_path.to_path_buf(),
+        config_root: crate::config::config_file::config_root::config_root(config_path),
+        environment: crate::config::environments_for_config_path(config_path),
+        source: None,
+    };
     let entry = match entry {
         EditTomlEntry::Block(inline) => EditTomlTable {
             block: Some(inline),
@@ -260,11 +268,13 @@ fn resolve_entry(
                 (Some(inline), None) => BlockSource::Inline(inline),
                 (None, Some(src)) => {
                     let src = file::replace_path(&src);
-                    BlockSource::File(if src.is_relative() {
+                    let src = if src.is_relative() {
                         base.join(src)
                     } else {
                         src
-                    })
+                    };
+                    origin.source = Some(src.clone());
+                    BlockSource::File(src)
                 }
                 (None, None) => unreachable!("is_block"),
             };
@@ -305,6 +315,7 @@ fn resolve_entry(
         op,
         base: base.to_path_buf(),
         config_path: config_path.to_path_buf(),
+        origin,
     })
 }