kovidgoyal/kitty · warning

Ignoring geninclude directive for security

Error message

Ignoring geninclude directive for security

What it means

A `geninclude` directive (run a program that generates config lines) appeared in a config file parsed with allow_geninclude=False — typically an included file — so kitty refuses to execute it.

Source

Thrown at kitty/conf/utils.py:319

        elif key == 'envinclude':
            from fnmatch import fnmatchcase

            for x in os.environ:
                if fnmatchcase(x, val):
                    with currently_parsing.set_file(f'<env var: {x}>'):
                        _parse(
                            NamedLineIterator(os.path.join(base_path_for_includes, ''), iter(os.environ[x].splitlines())),
                            parse_conf_item,
                            ans,
                            memory,
                            accumulate_bad_lines,
                            effective_config_lines,
                            allow_geninclude=allow_geninclude,
                        )
            return
        elif key == 'geninclude':
            if not allow_geninclude:
                log_error('Ignoring geninclude directive for security')
                return
            if not os.path.isabs(val):
                val = os.path.join(base_path_for_includes, val)
            if not memory.seen(val):
                try:
                    lines = geninclude(val)
                except FileNotFoundError as e:
                    if e.filename == val:
                        log_error(f'Could not find the geninclude file: {val}, ignoring')
                    else:
                        raise
                else:
                    with currently_parsing.set_file(f'<get: {val}>'):
                        _parse(
                            NamedLineIterator(os.path.join(base_path_for_includes, ''), iter(lines)),
                            parse_conf_item,
                            ans,
                            memory,

View on GitHub (pinned to 6d5d0c4406)

Solutions

1. Move the geninclude directive to the top-level kitty.conf
2. Use static `include`/`globinclude` for sub-files

Example fix

# in included file (blocked)
geninclude my-gen.py
# instead put in kitty.conf
geninclude my-gen.py

if directive == 'geninclude' and not is_top_level_config(path): skip_with_warning()

When it happens

Trigger: Putting geninclude in a file pulled in via include/globinclude, or in any context where generated includes are disallowed for security.

Common situations: Users trying to share a generated config through includes; geninclude only works in the top-level kitty.conf with a compiled-in kitty.

Related errors

• Passwords are not allowed to start with hyphens, ignoring th
• Could not find the geninclude file: {val}, ignoring
• This should be run as kitten broadcast
• Incorrect owner on pwfile: uid={shm.stats.st_uid} gid={shm.s
• Incorrect permissions on pwfile: 0o{mode:03o}

AI-assisted analysis of kovidgoyal/kitty@6d5d0c4406 (2026-08-27). Data as JSON: /api/errors/27f51fad2da4f1eb. Report an issue: GitHub.