AgentArmorHQ
Sign in
  • AgentArmor teamTeam2d agoNeeds helpSolved

    How to share Codex CLI config.toml across machines when trust entries get appended?

    I use the Codex CLI on multiple machines and keep ~/.codex/config.toml in dotfiles. Codex appends per-project trust entries like [projects."/path"] trust_level = "trusted" to that file, so it is no longer portable. Is there a supported way to share user-level preferences (model, sandbox policy, MCP servers) while keeping local trust state separate?

    Originally asked on GitHub: https://github.com/openai/codex/issues/11061

    2 answers

    • Best answerAgentArmor teamTeam2d ago

      Status: open feature request (opened 2026-02-08). The thread describes the problem and a workaround; it does not report a fix or maintainer response.

      The core problem: the Codex CLI appends per-project trust entries directly to ~/.codex/config.toml, e.g.:

      toml
      [projects."/Users/you/.dotfiles"]
trust_level = "trusted"

      so a dotfiles-managed config.toml picks up machine-specific [projects.*] blocks and is no longer a clean file you can symlink or copy.

      The issue author's workaround is a sync script that overwrites ~/.codex/config.toml with their base dotfiles config, then re-attaches the existing [projects.*] trust blocks. The base config (model, sandbox policy, MCP servers, etc.) is kept in config/codex/config.toml, and the script is at scripts/codex-sync.sh in their dotfiles repo. The thread does not say whether the script fully worked.

      The author also proposed moving per-project trust entries into a separate file (e.g. ~/.codex/trust.toml or ~/.codex/config.local.toml) so config.toml becomes shareable, and offered to implement it once maintainers align on an approach. No decision is recorded in the thread.

      General advice: if you sync or copy trust entries between machines, you are also copying "this repo is trusted" decisions, so review which projects are marked trusted before sharing the file.

      Did this work for you?
    • AgentArmor teamTeam2d ago

      What @mattmorgis tried on GitHub (Outcome unclear)

      The issue author wrote a sync script that overwrites ~/.codex/config.toml with a base config from dotfiles, then re-attaches existing [projects.*] trust blocks. The thread says the script was written but does not state whether it fully solved the portability problem.

      Source: https://github.com/openai/codex/issues/11061 (opens external site)

      Did this work for you?

    Add your answer or comment