{"record":{"id":"35379c0cab13a177","repo":"openai/codex","slug":"filesystem-glob-subpath-subpath-only-supports","errorCode":null,"errorMessage":"filesystem glob subpath `{subpath}` only supports `deny` access","messagePattern":"filesystem glob subpath `(.+?)` only supports `deny` access","errorType":"validation","errorClass":"io::Error","httpStatus":null,"severity":"error","filePath":"codex-rs/core/src/config/permissions.rs","lineNumber":651,"sourceCode":"        return Ok(special);\n    }\n\n    let subpath = parse_relative_subpath(subpath)?;\n    let base = parse_absolute_path(path)?;\n    let path = AbsolutePathBuf::resolve_path_against_base(&subpath, base.as_path());\n    Ok(path.into())\n}\n\nfn compile_scoped_filesystem_pattern(\n    path: &str,\n    subpath: &str,\n    access: FileSystemAccessMode,\n) -> io::Result<String> {\n    // Pattern entries currently mean deny-read only. Supporting broader access\n    // modes here would imply glob-based read/write allow semantics that the\n    // sandbox policy does not express yet.\n    if access != FileSystemAccessMode::Deny {\n        return Err(io::Error::new(\n            io::ErrorKind::InvalidInput,\n            format!(\"filesystem glob subpath `{subpath}` only supports `deny` access\"),\n        ));\n    }\n    let subpath = parse_relative_subpath(subpath)?;\n\n    match parse_special_path(path) {\n        Some(FileSystemSpecialPath::ProjectRoots { .. }) => {\n            // Keep `:workspace_roots` glob patterns symbolic until the active\n            // workspace roots are known, then materialize them for cwd and any\n            // runtime/profile-added workspace roots together.\n            Ok(project_roots_glob_pattern(&subpath))\n        }\n        Some(_) => Err(io::Error::new(\n            io::ErrorKind::InvalidInput,\n            format!(\"filesystem path `{path}` does not support nested entries\"),\n        )),\n        None => {","sourceCodeStart":633,"sourceCodeEnd":669,"githubUrl":"https://github.com/openai/codex/blob/339751715c64496cb86246bfb3935f40e309dd3d/codex-rs/core/src/config/permissions.rs#L633-L669","documentation":"Error \"filesystem glob subpath `{subpath}` only supports `deny` access\" thrown in openai/codex.","triggerScenarios":"Thrown at codex-rs/core/src/config/permissions.rs:651 when the library encounters an invalid state.","commonSituations":"See trigger scenarios.","solutions":["Use `deny` access for the glob subpath `{subpath}`."],"exampleFix":null,"handlingStrategy":null,"validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":[],"backgroundTag":null,"analyzedSha":"339751715c64496cb86246bfb3935f40e309dd3d","analyzedAt":"2026-08-25T05:35:09.876Z","schemaVersion":2},"datasetVersion":"2026-08-25T06:17:31.827Z"}