{"record":{"id":"f952af31baec8140","repo":"openai/codex","slug":"default-permissions-refers-to-undefined-profile","errorCode":null,"errorMessage":"default_permissions refers to undefined profile `{profile_name}`","messagePattern":"default_permissions refers to undefined profile `(.+?)`","errorType":"validation","errorClass":"PermissionProfileResolutionError","httpStatus":null,"severity":"error","filePath":"codex-rs/config/src/permissions_toml.rs","lineNumber":123,"sourceCode":"                .try_fold(profile, merge_permission_profiles)?;\n            return Ok(profile);\n        }\n    }\n}\n\n#[derive(Serialize, Deserialize, Debug, Clone, Default, PartialEq, Eq, JsonSchema)]\n#[schemars(deny_unknown_fields)]\npub struct PermissionProfileToml {\n    pub description: Option<String>,\n    pub extends: Option<String>,\n    pub workspace_roots: Option<WorkspaceRootsToml>,\n    pub filesystem: Option<FilesystemPermissionsToml>,\n    pub network: Option<NetworkToml>,\n}\n\n#[derive(Debug, Clone, PartialEq, Eq, Error)]\npub enum PermissionProfileResolutionError {\n    #[error(\"default_permissions refers to undefined profile `{profile_name}`\")]\n    UndefinedProfile { profile_name: String },\n    #[error(\n        \"permissions profile `{profile_name}` extends undefined profile `{parent_profile_name}`\"\n    )]\n    UndefinedParent {\n        profile_name: String,\n        parent_profile_name: String,\n    },\n    #[error(\n        \"permissions profile `{profile_name}` cannot extend unsupported built-in profile `{parent_profile_name}`\"\n    )]\n    UnsupportedBuiltInParent {\n        profile_name: String,\n        parent_profile_name: String,\n    },\n    #[error(\n        \"permissions profile inheritance cycle detected: {}\",\n        cycle.join(\" -> \")","sourceCodeStart":105,"sourceCodeEnd":141,"githubUrl":"https://github.com/openai/codex/blob/339751715c64496cb86246bfb3935f40e309dd3d/codex-rs/config/src/permissions_toml.rs#L105-L141","documentation":"PermissionsToml::resolve_profile looks up the profile named by default_permissions in the permissions table, then asks the loader-supplied parent_profile closure for built-ins. If neither can supply the name, it returns UndefinedProfile: the configuration selects a permission profile that is defined nowhere. Profile names are case-sensitive TOML keys.","triggerScenarios":"config.toml sets `default_permissions = \"strict\"` but no `[permissions.strict]` table exists and \"strict\" is not a built-in the loader provides (the parent_profile closure returns None). Fires at config load / first permissions resolution.","commonSituations":"Typo or casing mismatch (Strict vs strict); the profile lives in a project-local layer that is disabled because the directory is untrusted; an upgrade renamed/removed the profile while default_permissions kept the old name.","solutions":["Define the missing profile: add a `[permissions.<name>]` table with the intended network/filesystem settings","Or correct default_permissions to an existing profile name, matched exactly (case-sensitive)","Or remove default_permissions to fall back to the default permission set"],"exampleFix":"# before\ndefault_permissions = \"strict\"\n\n[permissions.read_only]\nnetwork = { enabled = false }\n\n# after — define the referenced profile (or point at one that exists)\ndefault_permissions = \"strict\"\n\n[permissions.strict]\nextends = \"read_only\"\nnetwork = { enabled = false }","handlingStrategy":"type-guard","validationCode":null,"typeGuard":"// PermissionsToml flattens profiles as top-level entries of the permissions table.\nfn profile_is_defined(\n    permissions: &toml::Value,\n    name: &str,\n    is_builtin: impl Fn(&str) -> bool,\n) -> bool {\n    permissions.get(name).is_some() || is_builtin(name)\n}\n\n// Gate before honoring a config-supplied default_permissions:\nlet name = config.default_permissions.as_deref().unwrap_or(\"default\");\nif !profile_is_defined(&permissions, name, |n| builtin_profiles().contains(&n)) {\n    return Err(format!(\"default_permissions refers to undefined profile `{name}\"));\n}","tryCatchPattern":"match permissions.resolve_profile(name, builtin_lookup) {\n    Err(PermissionProfileResolutionError::UndefinedProfile { profile_name }) => {\n        // Either define [permissions.<profile_name>] or fix the reference;\n        // falling back to a known-good default profile is also acceptable.\n    }\n    Err(e) => return Err(e.into()),\n    Ok(profile) => { /* compile to runtime permissions */ }\n}","preventionTips":["Treat default_permissions like a foreign key: define the profile in the same change that references it","Profile names are case-sensitive TOML keys — match casing exactly","Watch upgrades: a renamed or removed profile breaks a leftover default_permissions reference","Project-local layers can be disabled for untrusted directories; don't define the default profile there"],"tags":["permissions","config","profile","reference","rust"],"backgroundTag":"undefined-config-reference","analyzedSha":"339751715c64496cb86246bfb3935f40e309dd3d","analyzedAt":"2026-08-25T05:35:09.876Z","schemaVersion":2},"datasetVersion":"2026-08-25T06:17:31.827Z"}