{"record":{"id":"ee5a36c859fabfd7","repo":"openai/codex","slug":"permissions-profile-profile-name-cannot-extend","errorCode":null,"errorMessage":"permissions profile `{profile_name}` cannot extend unsupported built-in profile `{parent_profile_name}`","messagePattern":"permissions profile `(.+?)` cannot extend unsupported built-in profile `(.+?)`","errorType":"validation","errorClass":"PermissionProfileResolutionError","httpStatus":null,"severity":"error","filePath":"codex-rs/config/src/permissions_toml.rs","lineNumber":132,"sourceCode":"    pub description: Option<String>,\n    pub extends: Option<String>,\n    pub workspace_roots: Option<WorkspaceRootsToml>,\n    pub filesystem: Option<FilesystemPermissionsToml>,\n    pub network: Option<NetworkToml>,\n}\n\n#[derive(Debug, Clone, PartialEq, Eq, Error)]\npub enum PermissionProfileResolutionError {\n    #[error(\"default_permissions refers to undefined profile `{profile_name}`\")]\n    UndefinedProfile { profile_name: String },\n    #[error(\n        \"permissions profile `{profile_name}` extends undefined profile `{parent_profile_name}`\"\n    )]\n    UndefinedParent {\n        profile_name: String,\n        parent_profile_name: String,\n    },\n    #[error(\n        \"permissions profile `{profile_name}` cannot extend unsupported built-in profile `{parent_profile_name}`\"\n    )]\n    UnsupportedBuiltInParent {\n        profile_name: String,\n        parent_profile_name: String,\n    },\n    #[error(\n        \"permissions profile inheritance cycle detected: {}\",\n        cycle.join(\" -> \")\n    )]\n    Cycle { cycle: Vec<String> },\n    #[error(\"failed to serialize permissions profile while resolving inheritance: {source}\")]\n    SerializeProfileToml {\n        #[source]\n        source: toml::ser::Error,\n    },\n    #[error(\n        \"failed to deserialize merged permissions profile while resolving inheritance: {source}\"","sourceCodeStart":114,"sourceCodeEnd":150,"githubUrl":"https://github.com/openai/codex/blob/339751715c64496cb86246bfb3935f40e309dd3d/codex-rs/config/src/permissions_toml.rs#L114-L150","documentation":"Profile names starting with ':' are reserved for built-in profiles supplied by the loader's parent_profile closure. When extends targets such a colon-prefixed name that the installed version does not provide, resolve_profile reports UnsupportedBuiltInParent instead of the generic undefined-parent error. It separates 'you extended a built-in we no longer know' from ordinary typos.","triggerScenarios":"`[permissions.x] extends = \":read_only\"` when the built-in is spelled differently (e.g. ':read-only') or was removed/renamed in this codex version — the closure returns None for the name and the ':' prefix selects this variant.","commonSituations":"Underscore vs hyphen spelling mistakes; examples copied from a different codex release; naming a custom profile with a leading ':' (reserved namespace).","solutions":["Use the built-in name exactly as documented for the installed version (check spelling: hyphens vs underscores)","If you meant a custom profile, drop the leading ':' and extend a profile defined in the permissions table","If the built-in disappeared in an upgrade, pin the working version or replace it with an explicit profile definition"],"exampleFix":"# before — misspelled built-in\n[permissions.safe]\nextends = \":read_only\"\n\n# after — exact built-in name for the installed version\n[permissions.safe]\nextends = \":read-only\"","handlingStrategy":"validation","validationCode":"// The caller controls which built-ins it passes to resolve_profile; validate\n// colon-prefixed extends targets against that same list up front.\nconst SUPPORTED_BUILTINS: &[&str] = &[\n    /* exact names from the installed version's docs, ':' prefix included */\n];\n\nfn builtin_parents_are_supported(permissions: &codex_config::PermissionsToml) -> Result<(), String> {\n    for (name, profile) in &permissions.entries {\n        if let Some(parent) = profile.extends.as_deref()\n            && parent.starts_with(':')\n            && !SUPPORTED_BUILTINS.contains(&parent)\n        {\n            return Err(format!(\"`{name}` extends unsupported built-in `{parent}`\"));\n        }\n    }\n    Ok(())\n}","typeGuard":"// ':'-prefixed names claim the built-in namespace; check them against the\n// list you will hand to resolve_profile's parent_profile closure.\nfn is_supported_builtin(parent: &str, supported: &[&str]) -> bool {\n    !parent.starts_with(':') || supported.contains(&parent)\n}","tryCatchPattern":"match permissions.resolve_profile(name, builtin_lookup) {\n    Err(PermissionProfileResolutionError::UnsupportedBuiltInParent { profile_name, parent_profile_name }) => {\n        // `parent_profile_name` is ':'-prefixed but unknown: fix its spelling\n        // to the documented built-in, or drop the ':' and extend a defined profile.\n    }\n    Err(e) => return Err(e.into()),\n    Ok(profile) => { /* ... */ }\n}","preventionTips":["Never start custom profile names with ':' — that namespace is reserved for built-ins","Copy built-in names verbatim from the docs of the version you run; hyphen/underscore differences matter","Re-validate profiles after upgrading codex; the built-in set can change"],"tags":["permissions","config","profile","builtin","namespace","rust"],"backgroundTag":"unsupported-builtin-reference","analyzedSha":"339751715c64496cb86246bfb3935f40e309dd3d","analyzedAt":"2026-08-25T05:35:09.876Z","schemaVersion":2},"datasetVersion":"2026-08-25T06:17:31.827Z"}