Profile '{name}' extends '{base_name}', but custom profiles

Error message

Profile '{name}' extends '{base_name}', but custom profiles cannot extend other custom profiles (only built-ins)

What it means

This error fires when a custom profile tries to extend another custom profile. Extension is restricted to built-in base profiles so the inheritance chain is at most one level deep and fully deterministic; chaining custom profiles would require recursive resolution the resolver intentionally does not do.

Source

Thrown at crates/codegen/xai-grok-sandbox/src/profiles.rs:490

                         [profiles.{name}]\n\
                         extends = \"workspace\"\n\
                         read_only = [\"/data\"]\n"
                    )
                })?;

                // Start from the base profile if `extends` is set
                let (base, mut profile) = if let Some(base_name) = &profile_config.extends {
                    let base: ProfileName = base_name.parse().map_err(|e: String| {
                        anyhow::anyhow!("Profile '{name}' extends invalid base: {e}")
                    })?;
                    if matches!(base, Self::Off) {
                        anyhow::bail!(
                            "Profile '{name}' extends '{base_name}', but 'off'/'none' \
                             is not a valid base profile"
                        );
                    }
                    if matches!(base, Self::Custom(_)) {
                        anyhow::bail!(
                            "Profile '{name}' extends '{base_name}', but custom profiles \
                             cannot extend other custom profiles (only built-ins)"
                        );
                    }
                    let resolved = base.resolve(workspace, config)?;
                    (base, resolved)
                } else {
                    (Self::Workspace, Self::Workspace.resolve(workspace, config)?)
                };

                profile.name = name.clone();

                // Apply overrides from the custom config
                if let Some(restrict_net) = profile_config.restrict_network {
                    profile.restrict_network = restrict_net;
                }

                for path_str in &profile_config.read_only {

View on GitHub (pinned to bc7f02eddd)

Solutions

Change the profile's `extends` to point at a built-in profile instead of another custom profile
Inline the settings from the custom base profile into the extending profile and drop `extends`
Merge the two custom profiles into one, or promote the base to a shared built-in

Example fix

# before
[profiles.b]
extends = "a"  # 'a' is a custom profile

# after
[profiles.b]
extends = "minimal"

Defensive patterns

Strategy: validation

Validate before calling

fn validate_extends_target(cfg: &ProfileConfig, builtin_names: &[&str]) -> Result<(), String> {
    if let Some(base) = &cfg.extends {
        if !builtin_names.contains(&base.as_str()) {
            return Err(format!("profile '{}' must extend a built-in, not '{base}'", cfg.name));
        }
    }
    Ok(())
}

Try / catch

match ProfileName::resolve(name, &workspace, &config) {
    Ok(p) => apply(p),
    Err(e) if e.to_string().contains("cannot extend other custom profiles") => {
        eprintln!("config error: {e}; extend a built-in instead");
        std::process::exit(2);
    }
    Err(e) => return Err(e),
}

Prevention

Only extend built-in profile names (keep a whitelist handy)
Flatten custom-on-custom inheritance by inlining the base's settings
Promote widely reused bases into shared built-ins rather than chaining

When it happens

Trigger: A config profile sets `extends` to the name of another user-defined custom profile (anything that parses to ProfileName::Custom) and resolve is called on it.

Common situations: Layering a team-shared custom profile on top of a personal one; generated configs referencing other profiles in the same file; refactoring where a former built-in was replaced by a custom profile of the same name.

Related errors

AI-assisted analysis of xai-org/grok-build@bc7f02eddd (2026-08-31). Data as JSON: /api/errors/eac20ccf25ef9e12. Report an issue: GitHub.