denoland/deno · error

{} permissions were found in the config file. Did you mean t

Error message

{} permissions were found in the config file. Did you mean to run with `-P` or a permission flag?
    at {}

What it means

For subcommands whose permissions come from flags rather than the graph (compile, test, bench, desktop), Deno refuses to silently apply a permissions block found in the config file. If such a block exists and -P / permission flags were not passed, argument parsing bails with this hint, naming the subcommand category and the config file location.

Source

Thrown at cli/args/mod.rs:1302

      if !self.flags.has_permission() {
        let set_config_permission_name = match &self.flags.subcommand {
          DenoSubcommand::Bench(_) => dir
            .to_bench_permissions_config()?
            .filter(|permissions| !permissions.permissions.is_empty())
            .map(|permissions| ("Bench", &permissions.base)),
          DenoSubcommand::Compile(_) | DenoSubcommand::Desktop(_) => dir
            .to_compile_permissions_config()?
            .filter(|permissions| !permissions.permissions.is_empty())
            .map(|permissions| ("Compile", &permissions.base)),
          DenoSubcommand::Test(_) => dir
            .to_test_permissions_config()?
            .filter(|permissions| !permissions.permissions.is_empty())
            .map(|permissions| ("Test", &permissions.base)),
          _ => None,
        };
        if let Some((name, config_file_url)) = set_config_permission_name {
          // prevent people from wasting time wondering why benches/tests are failing
          bail!(
            "{} permissions were found in the config file. Did you mean to run with `-P` or a permission flag?\n    at {}",
            name,
            config_file_url
          );
        }
      }

      None
    };
    Ok(config_permissions)
  }

  fn augment_import_permissions(&self, options: &mut PermissionsOptions) {
    // do not add if the user specified --allow-all or --allow-import
    if options.allow_import.is_none() {
      options.allow_import = Some(self.implicit_allow_import());
    }
  }

View on GitHub (pinned to 9ad36f7a2c)

Solutions

1. Pass -P / --permissions to explicitly opt into the config-file permissions for this subcommand
2. Or pass the needed permission flags directly (--allow-read, --allow-net, ...)
3. Or scope the permissions block so test/bench/compile don't see it (separate config via --config)

Example fix

# before
deno test
# deno.json: { "permissions": { "read": true } }

# after
deno test -P
# or: deno test --allow-read

# Detect the conflict before running the subcommand
if grep -q '"permissions"' deno.json 2>/dev/null; then
  # test/bench/compile need explicit opt-in
  deno test -P
else
  deno test
fi

When it happens

Trigger: Running deno test, deno bench, deno compile (or desktop) while deno.json contains a "permissions" object, without -P and without any permission flag on the command line.

Common situations: Sharing one deno.json between deno run (which honors config permissions) and deno test/compile (which require opt-in); CI scripts that start failing after permissions were added to the shared config; Deno upgrades that tightened this behavior.

Related errors

• invalid doc test hashbang: {} ({reason})
• BenchContext::end() has already been invoked
• Expected the second argument to assertSnapshot() to be an op
• Snapshot serializer must return a string
• Missing snapshot file.

AI-assisted analysis of denoland/deno@9ad36f7a2c (2026-08-20). Data as JSON: /api/errors/29e9f0e5e8f965b0. Report an issue: GitHub.