Profile '{name}' extends '{base_name}', but 'off'/'none' is

Error message

Profile '{name}' extends '{base_name}', but 'off'/'none' is not a valid base profile

What it means

This error is thrown during profile resolution when a custom profile declares `extends: 'off'` (or 'none', which parses to ProfileName::Off). The 'off' profile is a sentinel meaning 'sandbox disabled', so it carries no settings to inherit and cannot serve as a base. The library rejects it up front rather than producing a meaningless merged profile.

Source

Thrown at crates/codegen/xai-grok-sandbox/src/profiles.rs:484

            Self::Custom(name) => {
                let profile_config = config.profiles.get(name).ok_or_else(|| {
                    anyhow::anyhow!(
                        "Custom sandbox profile '{name}' not found. \
                         Define it in ~/.grok/sandbox.toml or .grok/sandbox.toml:\n\n\
                         [profiles.{name}]\n\
                         extends = \"workspace\"\n\
                         read_only = [\"/data\"]\n"
                    )
                })?;

                // Start from the base profile if `extends` is set
                let (base, mut profile) = if let Some(base_name) = &profile_config.extends {
                    let base: ProfileName = base_name.parse().map_err(|e: String| {
                        anyhow::anyhow!("Profile '{name}' extends invalid base: {e}")
                    })?;
                    if matches!(base, Self::Off) {
                        anyhow::bail!(
                            "Profile '{name}' extends '{base_name}', but 'off'/'none' \
                             is not a valid base profile"
                        );
                    }
                    if matches!(base, Self::Custom(_)) {
                        anyhow::bail!(
                            "Profile '{name}' extends '{base_name}', but custom profiles \
                             cannot extend other custom profiles (only built-ins)"
                        );
                    }
                    let resolved = base.resolve(workspace, config)?;
                    (base, resolved)
                } else {
                    (Self::Workspace, Self::Workspace.resolve(workspace, config)?)
                };

                profile.name = name.clone();

View on GitHub (pinned to bc7f02eddd)

Solutions

Change the profile's `extends` to a built-in profile (e.g. 'minimal', 'standard') or a built-in non-off profile name
If the profile should be fully standalone, remove the `extends` field entirely so it starts from defaults
Validate config profiles before applying by calling resolve on each and checking the error message

Example fix

# before
[profiles.my-profile]
extends = "off"

# after
[profiles.my-profile]
extends = "minimal"

Defensive patterns

Strategy: validation

Validate before calling

fn validate_extends(cfg: &ProfileConfig) -> Result<(), String> {
    if let Some(base) = &cfg.extends {
        let b = base.trim().to_ascii_lowercase();
        if b == "off" || b == "none" {
            return Err(format!("profile '{}' extends '{base}', but off/none is not a valid base", cfg.name));
        }
    }
    Ok(())
}

Try / catch

match ProfileName::resolve(name, &workspace, &config) {
    Ok(p) => apply(p),
    Err(e) if e.to_string().contains("not a valid base profile") => {
        eprintln!("config error: {e}; fix the 'extends' field");
        std::process::exit(2);
    }
    Err(e) => return Err(e),
}

Prevention

Never set extends to 'off'/'none' — off is a sentinel, not a base
Lint config files for extends values against the built-in profile name list
When generating configs, omit the extends field rather than filling it with a default

When it happens

Trigger: Defining a profile in the sandbox config whose `extends` field is set to 'off' or 'none', then calling resolve / resolve_profile_with_runtime_sockets which parses the base name and matches it against ProfileName::Off.

Common situations: Users copy an existing profile and change its base to 'off' to try to 'start disabled and override'; YAML/JSON typo where extends was meant to be a built-in like 'minimal'; tooling generating configs that fill extends with a default value.

Related errors

AI-assisted analysis of xai-org/grok-build@bc7f02eddd (2026-08-31). Data as JSON: /api/errors/408d66df3cd8f992. Report an issue: GitHub.