openai/codex · error · io::Error

filesystem subpath `{}` must be a descendant path without `.

Error message

filesystem subpath `{}` must be a descendant path without `.` or `..` components

What it means

Error "filesystem subpath `{}` must be a descendant path without `.` or `..` components" thrown in openai/codex.

Source

Thrown at codex-rs/core/src/config/permissions.rs:875

fn is_windows_drive_absolute_path(path: &str) -> bool {
    let bytes = path.as_bytes();
    bytes.len() >= 3
        && bytes[0].is_ascii_alphabetic()
        && bytes[1] == b':'
        && matches!(bytes[2], b'\\' | b'/')
}

fn parse_relative_subpath(subpath: &str) -> io::Result<PathBuf> {
    let path = Path::new(subpath);
    if !subpath.is_empty()
        && path
            .components()
            .all(|component| matches!(component, Component::Normal(_)))
    {
        return Ok(path.to_path_buf());
    }

    Err(io::Error::new(
        io::ErrorKind::InvalidInput,
        format!(
            "filesystem subpath `{}` must be a descendant path without `.` or `..` components",
            path.display()
        ),
    ))
}

fn push_warning(startup_warnings: &mut Vec<String>, message: String) {
    tracing::warn!("{message}");
    startup_warnings.push(message);
}

fn missing_filesystem_entries_warning(profile_name: &str) -> String {
    format!(
        "Permissions profile `{profile_name}` does not define any recognized filesystem entries for this version of Codex. Filesystem access will remain restricted. Upgrade Codex if this profile expects filesystem permissions."
    )
}

View on GitHub (pinned to 339751715c)

Solutions

1. Use a descendant subpath without `.` or `..` components.

When it happens

Trigger: Thrown at codex-rs/core/src/config/permissions.rs:875 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of openai/codex@339751715c (2026-08-25). Data as JSON: /api/errors/8341f8d1acfd5a6f. Report an issue: GitHub.