openai/codex · error · PermissionProfileResolutionError

default_permissions refers to undefined profile `{profile_na

Error message

default_permissions refers to undefined profile `{profile_name}`

What it means

PermissionsToml::resolve_profile looks up the profile named by default_permissions in the permissions table, then asks the loader-supplied parent_profile closure for built-ins. If neither can supply the name, it returns UndefinedProfile: the configuration selects a permission profile that is defined nowhere. Profile names are case-sensitive TOML keys.

Source

Thrown at codex-rs/config/src/permissions_toml.rs:123

                .try_fold(profile, merge_permission_profiles)?;
            return Ok(profile);
        }
    }
}

#[derive(Serialize, Deserialize, Debug, Clone, Default, PartialEq, Eq, JsonSchema)]
#[schemars(deny_unknown_fields)]
pub struct PermissionProfileToml {
    pub description: Option<String>,
    pub extends: Option<String>,
    pub workspace_roots: Option<WorkspaceRootsToml>,
    pub filesystem: Option<FilesystemPermissionsToml>,
    pub network: Option<NetworkToml>,
}

#[derive(Debug, Clone, PartialEq, Eq, Error)]
pub enum PermissionProfileResolutionError {
    #[error("default_permissions refers to undefined profile `{profile_name}`")]
    UndefinedProfile { profile_name: String },
    #[error(
        "permissions profile `{profile_name}` extends undefined profile `{parent_profile_name}`"
    )]
    UndefinedParent {
        profile_name: String,
        parent_profile_name: String,
    },
    #[error(
        "permissions profile `{profile_name}` cannot extend unsupported built-in profile `{parent_profile_name}`"
    )]
    UnsupportedBuiltInParent {
        profile_name: String,
        parent_profile_name: String,
    },
    #[error(
        "permissions profile inheritance cycle detected: {}",
        cycle.join(" -> ")

View on GitHub (pinned to 339751715c)

Solutions

1. Define the missing profile: add a `[permissions.<name>]` table with the intended network/filesystem settings
2. Or correct default_permissions to an existing profile name, matched exactly (case-sensitive)
3. Or remove default_permissions to fall back to the default permission set

Example fix

# before
default_permissions = "strict"

[permissions.read_only]
network = { enabled = false }

# after — define the referenced profile (or point at one that exists)
default_permissions = "strict"

[permissions.strict]
extends = "read_only"
network = { enabled = false }

// PermissionsToml flattens profiles as top-level entries of the permissions table.
fn profile_is_defined(
    permissions: &toml::Value,
    name: &str,
    is_builtin: impl Fn(&str) -> bool,
) -> bool {
    permissions.get(name).is_some() || is_builtin(name)
}

// Gate before honoring a config-supplied default_permissions:
let name = config.default_permissions.as_deref().unwrap_or("default");
if !profile_is_defined(&permissions, name, |n| builtin_profiles().contains(&n)) {
    return Err(format!("default_permissions refers to undefined profile `{name}"));
}

match permissions.resolve_profile(name, builtin_lookup) {
    Err(PermissionProfileResolutionError::UndefinedProfile { profile_name }) => {
        // Either define [permissions.<profile_name>] or fix the reference;
        // falling back to a known-good default profile is also acceptable.
    }
    Err(e) => return Err(e.into()),
    Ok(profile) => { /* compile to runtime permissions */ }
}

When it happens

Trigger: config.toml sets `default_permissions = "strict"` but no `[permissions.strict]` table exists and "strict" is not a built-in the loader provides (the parent_profile closure returns None). Fires at config load / first permissions resolution.

Common situations: Typo or casing mismatch (Strict vs strict); the profile lives in a project-local layer that is disabled because the directory is untrusted; an upgrade renamed/removed the profile while default_permissions kept the old name.

Related errors

• permissions profile `{profile_name}` extends undefined profi
• permissions profile `{profile_name}` cannot extend unsupport
• permissions profile inheritance cycle detected: {}
• remote control URL cannot be a base
• AWS profile must be configured

AI-assisted analysis of openai/codex@339751715c (2026-08-25). Data as JSON: /api/errors/f952af31baec8140. Report an issue: GitHub.