{"record":{"id":"4e7dc967e2d27b3b","repo":"openai/codex","slug":"bypass-hook-trust-override-must-be-a-boolean","errorCode":null,"errorMessage":"`bypass_hook_trust` override must be a boolean","messagePattern":"`bypass_hook_trust` override must be a boolean","errorType":"validation","errorClass":"std::io::Error","httpStatus":null,"severity":"error","filePath":"codex-rs/app-server/src/config_manager.rs","lineNumber":218,"sourceCode":"            request_overrides,\n            typesafe_overrides,\n            cwd,\n        )\n        .await\n    }\n\n    #[instrument(level = \"trace\", skip_all)]\n    pub(crate) async fn load_with_cli_overrides(\n        &self,\n        cli_overrides: &[(String, TomlValue)],\n        request_overrides: Option<HashMap<String, serde_json::Value>>,\n        mut typesafe_overrides: ConfigOverrides,\n        fallback_cwd: Option<PathBuf>,\n    ) -> std::io::Result<Config> {\n        let mut request_overrides = request_overrides.unwrap_or_default();\n        if let Some(value) = request_overrides.remove(\"bypass_hook_trust\") {\n            typesafe_overrides.bypass_hook_trust = Some(value.as_bool().ok_or_else(|| {\n                std::io::Error::new(\n                    std::io::ErrorKind::InvalidData,\n                    \"`bypass_hook_trust` override must be a boolean\",\n                )\n            })?);\n        }\n        let merged_cli_overrides = cli_overrides\n            .iter()\n            .cloned()\n            .chain(\n                request_overrides\n                    .into_iter()\n                    .map(|(key, value)| (key, json_to_toml(value))),\n            )\n            .collect::<Vec<_>>();\n        let mut config = codex_core::config::ConfigBuilder::default()\n            .codex_home(self.codex_home.clone())\n            .cli_overrides(merged_cli_overrides)\n            .loader_overrides(self.loader_overrides.clone())","sourceCodeStart":200,"sourceCodeEnd":236,"githubUrl":"https://github.com/openai/codex/blob/339751715c64496cb86246bfb3935f40e309dd3d/codex-rs/app-server/src/config_manager.rs#L200-L236","documentation":"compile_denylist_globset builds the deny side of the domain policy with GlobalWildcard::Reject: a bare \"*\" — or any pattern that expands to one after normalization, such as \"**\" or \"*.\" with an empty domain — is refused. The allowlist side compiles under GlobalWildcard::Allow and may carry \"*\" when the caller explicitly enables it; a global deny wildcard would silently defeat the allowlist, so the config is rejected up front with a pointer to scoped forms.","triggerScenarios":"config.toml with [network.domains] containing \"*\" = \"deny\" (or degenerate variants like \"**\" = \"deny\" or \"*.\" = \"deny\"); compile_denylist_globset runs while the proxy builds its allow/deny globsets and bails before serving.","commonSituations":"Writing a global deny expecting default-deny semantics; not realizing limited mode is already deny-by-default with an allowlist; assuming * is a harmless shorthand for 'everything I did not allow'.","solutions":["Replace \"*\" = \"deny\" with explicit hosts or scoped wildcards: \"*.example.com\" matches subdomains only, \"**.example.com\" matches the apex and subdomains","For block-everything-except-a-few, keep network mode limited and list the allows instead — deny is already the default","Do not reach for a global wildcard at all; enumerate the hosts you actually want denied"],"exampleFix":"# config.toml — before\n[network.domains]\n\"*\" = \"deny\"\n\n# after\n[network.domains]\n\"*.tracker.example\" = \"deny\"\n\"**.ads.example\" = \"deny\"\n\"api.github.com\" = \"allow\"","handlingStrategy":"validation","validationCode":"fn deny_patterns_compilable(patterns: &[String]) -> bool {\n    patterns.iter().all(|p| {\n        let t = p.trim();\n        !(t == \"*\" || t == \"**\" || t == \"*.\" || t == \"**.\")\n    })\n}\nlet denied: Vec<String> = collect_deny_patterns(&config);\nif !deny_patterns_compilable(&denied) {\n    return Err(anyhow!(\"global wildcard not allowed on the deny side\"));\n}","typeGuard":"fn is_global_wildcard(pattern: &str) -> bool {\n    matches!(pattern.trim(), \"*\" | \"**\" | \"*.\" | \"**.\")\n}","tryCatchPattern":null,"preventionTips":["Use scoped wildcards (*.domain, **.domain) instead of * in deny lists","Remember limited network mode is already deny-by-default — express exceptions as allows","Lint [network.domains] for global wildcards on the deny side in CI"],"tags":["rust","network-proxy","wildcard","glob","policy","config-validation"],"backgroundTag":"invalid-wildcard-pattern","analyzedSha":"339751715c64496cb86246bfb3935f40e309dd3d","analyzedAt":"2026-08-25T05:35:09.876Z","schemaVersion":2},"datasetVersion":"2026-08-25T06:17:31.827Z"}