Persist Codex approval settings

Author: ngs

rc.d/codex/config.toml

@@ -0,0 +1,51 @@
+model = "gpt-5.5"
+model_reasoning_effort = "xhigh"
+approval_policy = "never"
+approvals_reviewer = "user"
+sandbox_mode = "danger-full-access"
+
+[projects."/Users/nagase/src/dtp-career-journey-backend"]
+trust_level = "trusted"
+
+[projects."/Users/nagase/src/think"]
+trust_level = "trusted"
+
+[projects."/Users/nagase/src/color.recipes"]
+trust_level = "trusted"
+
+[projects."/private/tmp"]
+trust_level = "trusted"
+
+[projects."/Users/nagase/src/ccskill-gptimage"]
+trust_level = "trusted"
+
+[projects."/Users/nagase/src/agent-san-nikki"]
+trust_level = "trusted"
+
+[projects."/Users/nagase/src/kinsoku"]
+trust_level = "trusted"
+
+[projects."/Users/nagase/src/dtp-career-journey-webapp"]
+trust_level = "trusted"
+
+[projects."/Users/nagase/src/bumblebee"]
+trust_level = "trusted"
+
+[plugins."github@openai-curated"]
+enabled = true
+
+[plugins."google-drive@openai-curated"]
+enabled = true
+
+[tui]
+status_line = ["model-with-reasoning", "current-dir", "git-branch"]
+status_line_use_colors = true
+
+[tui.model_availability_nux]
+"gpt-5.5" = 4
+
+[apps.connector_76869538009648d5b282a4bb21c3d157.tools."github.create_pull_request"]
+approval_mode = "approve"
+
+[notice]
+hide_full_access_warning = true

setup.d/dotfiles.sh

@@ -48,7 +48,7 @@ resolve_os_name() {
 
 for f in $DOTFILES/rc.d/*; do
   BASENAME=$(basename $f)
-  if [ $BASENAME != 'subversion' ] && [ $BASENAME != 'sbt' ] && [ $BASENAME != 'ssh' ] && [ $BASENAME != 'cmus' ] && [ $BASENAME != 'karabiner' ] && [ $BASENAME != 'claude' ] && [ $BASENAME != 'gh' ] && [ $BASENAME != 'gnupg' ]; then
+  if [ $BASENAME != 'subversion' ] && [ $BASENAME != 'sbt' ] && [ $BASENAME != 'ssh' ] && [ $BASENAME != 'cmus' ] && [ $BASENAME != 'karabiner' ] && [ $BASENAME != 'claude' ] && [ $BASENAME != 'gh' ] && [ $BASENAME != 'gnupg' ] && [ $BASENAME != 'codex' ]; then
     resolve_os_name "$BASENAME" || continue
     rm -rf "${HOME}/${LINKNAME}"
     symlink "$f" "${HOME}/.${LINKNAME}"
@@ -91,7 +91,9 @@ for f in $DOTFILES/rc.d/claude/*; do
 done
 ## Codex
 # Keep runtime state, auth, logs, and caches in ~/.codex, but manage reusable
-# command approval rules from dotfiles.
+# config and command approval rules from dotfiles.
+ensure_directory "${HOME}/.codex"
+symlink "${DOTFILES}/rc.d/codex/config.toml" "${HOME}/.codex/config.toml"
 ensure_directory "${HOME}/.codex/rules"
 for f in "$DOTFILES/rc.d/codex/rules"/*; do
   [ -e "$f" ] || continue