{"record":{"id":"d114f3dcb5ad75f9","repo":"xai-org/grok-build","slug":"invalid-deny-glob-glob-e","errorCode":null,"errorMessage":"invalid deny glob {glob:?}: {e}","messagePattern":"invalid deny glob (.+?): (.+?)","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"crates/codegen/xai-grok-sandbox/src/deny/glob.rs","lineNumber":145,"sourceCode":"        }\n        if cc.get(j) == Some(&']') {\n            anyhow::bail!(\"deny glob {glob:?}: a literal ']' as first class member is unsupported\");\n        }\n        while j < cc.len() && cc[j] != ']' {\n            if cc[j] == '[' {\n                anyhow::bail!(\n                    \"deny glob {glob:?}: nested '[' / POSIX '[[:…:]]' classes are unsupported\"\n                );\n            }\n            j += 1;\n        }\n        // Unterminated class: let the globset build below report it uniformly.\n        i = if j < cc.len() { j + 1 } else { cc.len() };\n    }\n    globset::GlobBuilder::new(glob)\n        .literal_separator(true)\n        .build()\n        .map_err(|e| anyhow::anyhow!(\"invalid deny glob {glob:?}: {e}\"))?;\n    Ok(())\n}\n\n/// Push `c` as a regex literal, escaping it when it is a regex metacharacter.\n#[cfg(all(feature = \"enforce\", target_os = \"macos\"))]\nfn push_escaped_regex_literal(out: &mut String, c: char) {\n    if matches!(\n        c,\n        '.' | '+' | '*' | '?' | '(' | ')' | '[' | ']' | '{' | '}' | '^' | '$' | '|' | '\\\\'\n    ) {\n        out.push('\\\\');\n    }\n    out.push(c);\n}\n\n/// Regex-escape every character of a literal path segment.\n#[cfg(all(feature = \"enforce\", target_os = \"macos\"))]\nfn escape_regex_literal_str(s: &str) -> String {","sourceCodeStart":127,"sourceCodeEnd":163,"githubUrl":"https://github.com/xai-org/grok-build/blob/bc7f02eddd3d84085849dc19ed216f11c23b0571/crates/codegen/xai-grok-sandbox/src/deny/glob.rs#L127-L163","documentation":"`validate_deny_glob` compiles each deny glob with `globset::GlobBuilder` (literal_separator enabled) and returns this error if the pattern is syntactically invalid. This is an input-validation error: the sandbox refuse deny rules it cannot compile, since an uncompilable glob could silently fail to deny writes. The error names the offending glob and the globset parse error.","triggerScenarios":"A deny glob in config or CLI flags contains invalid syntax such as an unterminated `[` character class, malformed `{a,b}` alternation, or a dangling escape.","commonSituations":"Typo in ~/.grok/sandbox.toml or .grok/sandbox.toml write_deny patterns; hand-written globs like `/tmp/[abc` ; shell-style patterns copied that globset rejects; escaping mistakes with `\\` in TOML strings.","solutions":["Read the inner `{e}` to see the exact position and nature of the glob syntax error.","Fix the pattern — commonly close the `[...]` character class or remove the stray bracket.","Test the corrected glob against expected paths with globset (or a quick unit test) before redeploying.","Quote backslashes properly in TOML (use single-quoted literal strings '...') to avoid escape mangling."],"exampleFix":"// before\nwrite_deny = ['/tmp/[abc', '**/secrets']\n// after\nwrite_deny = ['/tmp/[abc]*', '**/secrets'] // closed character class","handlingStrategy":"validation","validationCode":"fn check_deny_globs(globs: &[String]) -> Result<(), String> {\n    for g in globs {\n        globset::GlobBuilder::new(g)\n            .literal_separator(true)\n            .build()\n            .map_err(|e| format!(\"invalid deny glob {g:?}: {e}\"))?;\n    }\n    Ok(())\n}\n// run at startup/config load, before applying the sandbox","typeGuard":null,"tryCatchPattern":"match validate_deny_glob(glob) {\n    Ok(()) => {}\n    Err(e) if e.to_string().starts_with(\"invalid deny glob\") => {\n        eprintln!(\"Fix the pattern in sandbox.toml: {e:#}\");\n        std::process::exit(2); // config error, not runtime\n    }\n    Err(e) => return Err(e),\n}","preventionTips":["Validate all deny globs at config load time, before sandbox application.","Use single-quoted TOML strings ('...') for patterns containing backslashes.","Lint character classes for unterminated [ before committing patterns.","Write unit tests for every deny glob against representative paths."],"tags":["rust","glob","validation","sandbox","config"],"backgroundTag":"invalid-glob-pattern","analyzedSha":"bc7f02eddd3d84085849dc19ed216f11c23b0571","analyzedAt":"2026-08-31T04:59:42.031Z","schemaVersion":2},"datasetVersion":"2026-08-31T09:17:48.483Z"}