{"record":{"id":"8341f8d1acfd5a6f","repo":"openai/codex","slug":"filesystem-subpath-must-be-a-descendant-path","errorCode":null,"errorMessage":"filesystem subpath `{}` must be a descendant path without `.` or `..` components","messagePattern":"filesystem subpath `(.+?)` must be a descendant path without `\\.` or `\\.\\.` components","errorType":"validation","errorClass":"io::Error","httpStatus":null,"severity":"error","filePath":"codex-rs/core/src/config/permissions.rs","lineNumber":875,"sourceCode":"fn is_windows_drive_absolute_path(path: &str) -> bool {\n    let bytes = path.as_bytes();\n    bytes.len() >= 3\n        && bytes[0].is_ascii_alphabetic()\n        && bytes[1] == b':'\n        && matches!(bytes[2], b'\\\\' | b'/')\n}\n\nfn parse_relative_subpath(subpath: &str) -> io::Result<PathBuf> {\n    let path = Path::new(subpath);\n    if !subpath.is_empty()\n        && path\n            .components()\n            .all(|component| matches!(component, Component::Normal(_)))\n    {\n        return Ok(path.to_path_buf());\n    }\n\n    Err(io::Error::new(\n        io::ErrorKind::InvalidInput,\n        format!(\n            \"filesystem subpath `{}` must be a descendant path without `.` or `..` components\",\n            path.display()\n        ),\n    ))\n}\n\nfn push_warning(startup_warnings: &mut Vec<String>, message: String) {\n    tracing::warn!(\"{message}\");\n    startup_warnings.push(message);\n}\n\nfn missing_filesystem_entries_warning(profile_name: &str) -> String {\n    format!(\n        \"Permissions profile `{profile_name}` does not define any recognized filesystem entries for this version of Codex. Filesystem access will remain restricted. Upgrade Codex if this profile expects filesystem permissions.\"\n    )\n}","sourceCodeStart":857,"sourceCodeEnd":893,"githubUrl":"https://github.com/openai/codex/blob/339751715c64496cb86246bfb3935f40e309dd3d/codex-rs/core/src/config/permissions.rs#L857-L893","documentation":"Error \"filesystem subpath `{}` must be a descendant path without `.` or `..` components\" thrown in openai/codex.","triggerScenarios":"Thrown at codex-rs/core/src/config/permissions.rs:875 when the library encounters an invalid state.","commonSituations":"See trigger scenarios.","solutions":["Use a descendant subpath without `.` or `..` components."],"exampleFix":null,"handlingStrategy":null,"validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":[],"backgroundTag":null,"analyzedSha":"339751715c64496cb86246bfb3935f40e309dd3d","analyzedAt":"2026-08-25T05:35:09.876Z","schemaVersion":2},"datasetVersion":"2026-08-25T06:17:31.827Z"}