microsoft/aspire · error · ArgumentException

The value ' ' cannot contain a comma. Deno separates values…

Error message

The value '{value}' cannot contain a comma. Deno separates {flag} values with commas and provides no way to escape them, so this value would be interpreted as multiple permissions. Pass each value as a separate argument.

What it means

Deno CLI permission flags accept comma-separated values and provide no escaping, so a value containing a comma (e.g. "/a,/b") would silently be interpreted as two separate permissions. The library throws ArgumentException to force each value to be passed as its own argument.

Solutions

Split the string on ',' and pass each piece as a separate argument: WithDenoAllow(kind, list.Split(',')).
In config, keep values as a real list (JSON array / repeated keys) rather than a comma-joined string.
If a path legitimately contains a comma, verify Deno supports it via another mechanism — there is no escape; restructure (e.g. allow the parent directory).

Example fix

// before
resource.WithDenoAllow(DenoPermissionKind.Read, "/tmp,/var");
// after
resource.WithDenoAllow(DenoPermissionKind.Read, "/tmp", "/var");

Defensive patterns

Strategy: validation

Validate before calling

if (values.Any(v => v.Contains(','))) throw new ArgumentException("Pass each Deno permission value as a separate argument; commas are not escapable.");

Try / catch

try { resource.WithDenoAllow(kind, values); } catch (ArgumentException ex) when (ex.ParamName == "values") { /* split values and retry or report */ }

Prevention

Never pre-join Deno permission values with commas
Model multi-value permissions as arrays in configuration
Document that Deno commas are value separators, not data

When it happens

Trigger: Calling WithDenoAllow/WithDenoDeny with a value string containing a comma, e.g. WithDenoAllow(DenoPermissionKind.Read, "/tmp,/var") instead of passing "/tmp" and "/var" separately.

Common situations: Passing a pre-joined comma-separated list from config or CLI args directly into the API; concatenating paths with ',' when building values programmatically.

Understand the failure class

Background: "Invalid ... format", "must be in format X", "does not look like a ..." — invalid argument format errors across CLI tools and libraries — this error's family across 17 libraries.

Related errors

AI-assisted analysis of microsoft/aspire@25830f84bd (2026-09-16). Data as JSON: /api/errors/ae5d6c3df84914c2. Report an issue: GitHub.

Appendix: source

Thrown at src/Aspire.Hosting.JavaScript/DenoHostingExtensions.cs:82

        // comma silently becomes several permissions. Verified on Deno 2.9.0: `--allow-read=data,secret` intended as
        // one directory named "data,secret" instead grants `data` and `secret` separately, so the requested path is
        // denied while unrelated paths are granted. Reject it here rather than emit a command line that means
        // something other than what the caller asked for.
        //
        // An empty params array intentionally emits an unscoped flag, but an individual null or empty value emits
        // `--allow-read=` (or the equivalent permission) and Deno 2.9 rejects it. Do not trim values: Deno accepts
        // whitespace as a permission value.
        foreach (var value in snapshot)
        {
            if (string.IsNullOrEmpty(value))
            {
                throw new ArgumentException("Deno permission values cannot be null or empty.", nameof(values));
            }

            if (value.Contains(','))
            {
                var flag = permission.Deny ? $"--deny-{permission.Name}" : $"--allow-{permission.Name}";
                throw new ArgumentException($"The value '{value}' cannot contain a comma. Deno separates {flag} values with commas and provides no way to escape them, so this value would be interpreted as multiple permissions. Pass each value as a separate argument.", nameof(values));
            }
        }

        var annotation = GetOrAddDenoAnnotation(builder);
        annotation.Permissions.Add(permission);
        return builder;
    }

    // ---- Blanket permission -----------------------------------------------------------------

    /// <summary>
    /// Controls the blanket <c>-A</c>/<c>--allow-all</c> grant.
    /// </summary>
    /// <param name="builder">The Deno app resource builder.</param>
    /// <param name="enabled">
    /// Whether to emit <c>-A</c>/<c>--allow-all</c>. Pass <see langword="false"/> to grant only permissions
    /// configured with <see cref="WithDenoAllow"/>.
    /// </param>

View on GitHub (pinned to 25830f84bd)