openai/codex · error · anyhow::Error

unsupported global wildcard domain pattern "*"; use exact ho

Error message

unsupported global wildcard domain pattern "*"; use exact hosts or scoped wildcards like *.example.com or **.example.com

What it means

Error "unsupported global wildcard domain pattern "*"; use exact hosts or scoped wildcards like *.example.com or **.example.com" thrown in openai/codex.

Source

Thrown at codex-rs/network-proxy/src/policy.rs:201

}

pub(crate) fn compile_allowlist_globset(patterns: &[String]) -> Result<GlobSet> {
    compile_globset_with_policy(patterns, GlobalWildcard::Allow)
}

pub(crate) fn compile_denylist_globset(patterns: &[String]) -> Result<GlobSet> {
    compile_globset_with_policy(patterns, GlobalWildcard::Reject)
}

fn compile_globset_with_policy(
    patterns: &[String],
    global_wildcard: GlobalWildcard,
) -> Result<GlobSet> {
    let mut builder = GlobSetBuilder::new();
    let mut seen = HashSet::new();
    for pattern in patterns {
        if global_wildcard == GlobalWildcard::Reject && is_global_wildcard_domain_pattern(pattern) {
            bail!(
                "unsupported global wildcard domain pattern \"*\"; use exact hosts or scoped wildcards like *.example.com or **.example.com"
            );
        }
        let pattern = normalize_pattern(pattern);
        // Supported domain patterns:
        // - "example.com": match the exact host
        // - "*.example.com": match any subdomain (not the apex)
        // - "**.example.com": match the apex and any subdomain
        // - "*": match every host when explicitly enabled for allowlist compilation
        for candidate in expand_domain_pattern(&pattern) {
            if !seen.insert(candidate.clone()) {
                continue;
            }
            let glob = GlobBuilder::new(&candidate)
                .case_insensitive(true)
                .build()
                .with_context(|| format!("invalid glob pattern: {candidate}"))?;
            builder.add(glob);

View on GitHub (pinned to 339751715c)

When it happens

Trigger: Thrown at codex-rs/network-proxy/src/policy.rs:201 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of openai/codex@339751715c (2026-08-25). Data as JSON: /api/errors/39247403d1538403. Report an issue: GitHub.