{"record":{"id":"27cbf35d03f71bd7","repo":"openai/codex","slug":"config-defines-permissions-profiles-but-does-n","errorCode":null,"errorMessage":"config defines `[permissions]` profiles but does not set `default_permissions`","messagePattern":"config defines `\\[permissions\\]` profiles but does not set `default_permissions`","errorType":"validation","errorClass":"std::io::Error","httpStatus":null,"severity":"error","filePath":"codex-rs/core/src/config/mod.rs","lineNumber":3386,"sourceCode":"            persisted_permission_profile_id.as_deref()\n        };\n        let effective_permission_selection = resolve_effective_permission_selection(\n            cfg.permissions.as_ref(),\n            default_permissions_override.as_deref(),\n            persisted_permission_profile_id,\n            cfg.default_permissions.as_deref(),\n            requirements_toml,\n            &mut startup_warnings,\n        )?;\n        if effective_permission_selection.has_profiles()\n            && !matches!(\n                permission_config_syntax,\n                Some(PermissionConfigSyntax::Legacy)\n            )\n            && effective_permission_selection.selected_profile_id.is_none()\n            && !effective_permission_selection.requirements_force_profile_selection\n        {\n            return Err(std::io::Error::new(\n                std::io::ErrorKind::InvalidInput,\n                \"config defines `[permissions]` profiles but does not set `default_permissions`\",\n            ));\n        }\n\n        let memories_config: MemoriesConfig = cfg.memories.clone().unwrap_or_default().into();\n        let memories_root = memory_root(&codex_home);\n\n        let profiles_are_active = effective_permission_selection.profiles_are_active(\n            default_permissions_override.as_deref(),\n            permission_config_syntax,\n        );\n        let explicit_permission_profile_mode = effective_permission_selection\n            .persisted_profile_id_was_provided\n            || default_permissions_override.is_some()\n            || matches!(\n                permission_config_syntax,\n                Some(PermissionConfigSyntax::Profiles)","sourceCodeStart":3368,"sourceCodeEnd":3404,"githubUrl":"https://github.com/openai/codex/blob/339751715c64496cb86246bfb3935f40e309dd3d/codex-rs/core/src/config/mod.rs#L3368-L3404","documentation":"Under the profiles-based permission syntax, defining profiles in `[permissions]` obliges the config to select one. Config computes the effective selection from the `[permissions]` profiles, any default_permissions override, the top-level default_permissions key, and the selection persisted in codex home. If profiles exist, the syntax is not legacy, nothing got selected, and requirements do not force a selection, loading fails with InvalidInput instead of guessing permissions.","triggerScenarios":"config.toml defines `[permissions]` with profile entries (e.g. `[permissions.profiles.dev]`) but no `default_permissions` is set anywhere, no permission-profile/default-permissions override is passed at startup, and no selection was persisted from a previous interactive pick.","commonSituations":"Partial migration to permission profiles where the selector was forgotten; copying a `[permissions]` block from docs or teammates minus the default line; fresh machines or cleared codex-home where the persisted selection is missing; renaming a profile without updating the default.","solutions":["Set `default_permissions = \"dev\"` (naming one of the defined profile ids) in the config that defines the profiles.","Or pass an explicit permission-profile / default-permissions override when starting Codex.","Or select a profile once interactively so the choice persists in codex home.","If the profiles are unused, delete the `[permissions]` profiles block entirely."],"exampleFix":"# before - profiles defined, nothing selected\n[permissions.profiles.dev]\n# ...profile body...\n\n# after - select the default\ndefault_permissions = \"dev\"\n\n[permissions.profiles.dev]\n# ...profile body...","handlingStrategy":"validation","validationCode":"# Pre-flight check before launching codex\nimport tomllib, sys\ncfg = tomllib.load(open(\"config.toml\", \"rb\"))\nperms = cfg.get(\"permissions\", {})\nhas_profiles = bool(perms.get(\"profiles\"))\nselected = cfg.get(\"default_permissions\") or perms.get(\"default_permissions\")\nif has_profiles and not selected:\n    sys.exit(\"[permissions] profiles require a default_permissions selection\")","typeGuard":null,"tryCatchPattern":"match config_result {\n    Err(ref e) if e.kind() == std::io::ErrorKind::InvalidInput\n        && e.to_string().contains(\"does not set `default_permissions`\") => {\n        // prompt the user to pick a profile, write default_permissions, retry\n    }\n    other => other,\n}","preventionTips":["Always pair a [permissions] profiles block with a default_permissions selector in the same file","Validate config.toml against core's config.schema.json in CI","After renaming a profile id, update default_permissions to match","Ship the complete [permissions] section when sharing configs"],"tags":["codex","permissions","config","toml","validation"],"backgroundTag":"missing-required-config-key","analyzedSha":"339751715c64496cb86246bfb3935f40e309dd3d","analyzedAt":"2026-08-25T05:35:09.876Z","schemaVersion":2},"datasetVersion":"2026-08-25T06:17:31.827Z"}