openai/codex · error · std::io::Error

requirements.toml default_permissions must be set unless all

Error message

requirements.toml default_permissions must be set unless allowed_permission_profiles allows both `:workspace` and `:read-only`

What it means

Error "requirements.toml default_permissions must be set unless allowed_permission_profiles allows both `:workspace` and `:read-only`" thrown in openai/codex.

Source

Thrown at codex-rs/core/src/config/mod.rs:4600

}

fn resolve_default_permissions<'a>(
    default_permissions_override: Option<&'a str>,
    configured_default_permissions: Option<&'a str>,
    requirements_toml: &'a ConfigRequirementsToml,
    startup_warnings: &mut Vec<String>,
) -> std::io::Result<Option<&'a str>> {
    let selected_permissions = default_permissions_override.or(configured_default_permissions);
    let Some(allowed_permission_profiles) = requirements_toml.allowed_permission_profiles.as_ref()
    else {
        return Ok(selected_permissions);
    };
    let Some(fallback_permissions) = requirements_toml
        .default_permissions
        .as_deref()
        .or_else(|| implicit_default_permissions(allowed_permission_profiles))
    else {
        return Err(std::io::Error::new(
            ErrorKind::InvalidInput,
            "requirements.toml default_permissions must be set unless allowed_permission_profiles allows both `:workspace` and `:read-only`",
        ));
    };

    match selected_permissions {
        None => Ok(Some(fallback_permissions)),
        Some(selected_permissions)
            if is_permission_allowed(allowed_permission_profiles, selected_permissions) =>
        {
            Ok(Some(selected_permissions))
        }
        Some(selected_permissions) => {
            startup_warnings.push(format!(
                "Configured value for `permission_profile` is disallowed by requirements; falling back from `{selected_permissions}` to required value `{fallback_permissions}`."
            ));
            Ok(Some(fallback_permissions))
        }

View on GitHub (pinned to 339751715c)

Solutions

1. Set requirements.toml default_permissions, or widen allowed_permission_profiles to allow both `:workspace` and `:read-only`.

When it happens

Trigger: Thrown at codex-rs/core/src/config/mod.rs:4600 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of openai/codex@339751715c (2026-08-25). Data as JSON: /api/errors/a2d4e8cfd7deb1d1. Report an issue: GitHub.