deny glob {glob:?} uses unsupported metacharacter '{c}' (bra

Error message

deny glob {glob:?} uses unsupported metacharacter '{c}' (brace alternation and backslash-escapes are not supported; use separate deny entries)

What it means

validate_deny_glob rejects deny globs in sandbox.toml that contain `{`, `}`, or `\`. Brace alternation and backslash escapes behave differently between the Linux globset matcher and the macOS regex matcher, so the library fails closed on both platforms to guarantee identical enforcement semantics.

Source

Thrown at crates/codegen/xai-grok-sandbox/src/deny/glob.rs:79

}

/// Validate a deny glob on BOTH platforms so a given pattern is interpreted
/// IDENTICALLY everywhere or rejected everywhere (never silently under-enforced
/// on macOS). Two checks, run before the macOS regex translation and the Linux
/// globset expansion alike:
///
/// 1. Reject `{`/`}`/`\`: globset honors brace alternation and backslash-escapes,
///    but Seatbelt's runtime regex (sourced from globset's own `.regex()` mis-
///    enforces `**/` for root-level paths, so we hand-roll the regex instead and
///    cannot faithfully reproduce those forms — rejecting them on both platforms
///    keeps the two backends in agreement. A user wanting alternation writes
///    separate deny entries.
/// 2. Compile through `globset` (the Linux matcher) so a malformed glob (`a**b`,
///    unterminated `[`) fails closed identically on both platforms.
#[cfg(all(feature = "enforce", unix))]
pub(crate) fn validate_deny_glob(glob: &str) -> anyhow::Result<()> {
    if let Some(c) = glob.chars().find(|&c| matches!(c, '{' | '}' | '\\')) {
        anyhow::bail!(
            "deny glob {glob:?} uses unsupported metacharacter '{c}' \
             (brace alternation and backslash-escapes are not supported; \
             use separate deny entries)"
        );
    }
    // `**` must be a whole path component (gitignore semantics). A non-component
    // `**` (e.g. `a**b`) would translate to `.*` on macOS but collapse to `*` in
    // globset — reject it on both platforms so they never diverge. Empty
    // segments (`a//*`) drift the same way: globset keeps `//` literally while
    // the macOS regex collapses it.
    for (index, segment) in glob.split('/').enumerate() {
        if segment.is_empty() && !(index == 0 && glob.starts_with('/')) {
            anyhow::bail!(
                "deny glob {glob:?}: empty path segment (a doubled '//' or \
                 trailing '/'); remove the extra slash in sandbox.toml"
            );
        }
        // `.`/`..` would let a relative glob scan outside the workspace on

View on GitHub (pinned to bc7f02eddd)

Solutions

Rewrite the glob without braces: use separate deny entries for each alternative.
Remove backslash escapes; express spaces/special chars without `\` (quote the TOML string normally, escape nothing in the glob itself).
Re-run the command — the glob compiles through globset identically on both platforms once sanitized.

Example fix

// before (sandbox.toml)
deny = ["/usr/{bin,sbin}/tool"]
// after
deny = ["/usr/bin/tool", "/usr/sbin/tool"]

Defensive patterns

Strategy: validation

Validate before calling

fn deny_glob_valid(glob: &str) -> bool {
    !glob.chars().any(|c| matches!(c, '{' | '}' | '\\'))
}
for g in &deny_globs {
    assert!(deny_glob_valid(g), "unsupported metacharacter in deny glob: {g}");
}

Prevention

Never use `{a,b}` alternation in sandbox.toml deny globs — write one entry per alternative.
Never backslash-escape characters in deny globs.
Lint sandbox.toml deny entries in CI with the same metacharacter check.

When it happens

Trigger: Adding a deny glob entry in sandbox.toml containing brace alternation like `/usr/{bin,sbin}/x` or a backslash escape like `/usr/bin/foo\ bar`, then applying deny globs (apply_deny_globs_to_capability_set / expand_deny_globs).

Common situations: Porting shell-style or gitignore-brace patterns into sandbox.toml; escaping spaces in paths with backslashes; copying deny rules from other tooling that supports braces.

Related errors

AI-assisted analysis of xai-org/grok-build@bc7f02eddd (2026-08-31). Data as JSON: /api/errors/4186a38b24c34245. Report an issue: GitHub.