{"record":{"id":"c2c4181dbaff22b7","repo":"openai/codex","slug":"filesystem-glob-path-path-only-supports-deny","errorCode":null,"errorMessage":"filesystem glob path `{path}` only supports `deny` access; use an exact path or trailing `/**` for `{access}` subtree access","messagePattern":"filesystem glob path `(.+?)` only supports `deny` access; use an exact path or trailing `/\\*\\*` for `(.+?)` subtree access","errorType":"validation","errorClass":"io::Error","httpStatus":null,"severity":"error","filePath":"codex-rs/core/src/config/permissions.rs","lineNumber":686,"sourceCode":"        )),\n        None => {\n            let base = parse_absolute_path(path)?;\n            Ok(base.join(&subpath).to_string_lossy().to_string())\n        }\n    }\n}\n\nfn compile_read_write_glob_path(path: &str, access: FileSystemAccessMode) -> io::Result<&str> {\n    if !contains_glob_chars(path) {\n        return Ok(path);\n    }\n\n    let path_without_trailing_glob = remove_trailing_glob_suffix(path);\n    if !contains_glob_chars(path_without_trailing_glob) {\n        return Ok(path_without_trailing_glob);\n    }\n\n    Err(io::Error::new(\n        io::ErrorKind::InvalidInput,\n        format!(\n            \"filesystem glob path `{path}` only supports `deny` access; use an exact path or trailing `/**` for `{access}` subtree access\"\n        ),\n    ))\n}\n\nfn unsupported_read_write_glob_paths(filesystem: &FilesystemPermissionsToml) -> Vec<String> {\n    let mut patterns = Vec::new();\n    for (path, permission) in &filesystem.entries {\n        match permission {\n            FilesystemPermissionToml::Access(access) => {\n                if *access != FileSystemAccessMode::Deny\n                    && contains_glob_chars(remove_trailing_glob_suffix(path))\n                {\n                    patterns.push(path.clone());\n                }\n            }","sourceCodeStart":668,"sourceCodeEnd":704,"githubUrl":"https://github.com/openai/codex/blob/339751715c64496cb86246bfb3935f40e309dd3d/codex-rs/core/src/config/permissions.rs#L668-L704","documentation":"Error \"filesystem glob path `{path}` only supports `deny` access; use an exact path or trailing `/**` for `{access}` subtree access\" thrown in openai/codex.","triggerScenarios":"Thrown at codex-rs/core/src/config/permissions.rs:686 when the library encounters an invalid state.","commonSituations":"See trigger scenarios.","solutions":["Use `deny` access for the glob path, or use an exact path or trailing `/**` for `{access}` subtree access."],"exampleFix":null,"handlingStrategy":null,"validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":[],"backgroundTag":null,"analyzedSha":"339751715c64496cb86246bfb3935f40e309dd3d","analyzedAt":"2026-08-25T05:35:09.876Z","schemaVersion":2},"datasetVersion":"2026-08-25T06:17:31.827Z"}