chore(mise): trust agent worktree roots

Author: altaywtf

chezmoi/private_dot_config/mise/config.toml

@@ -8,3 +8,4 @@ go = "1.26.2"
 
 [settings]
 idiomatic_version_file_enable_tools = ["java"]
+trusted_config_paths = ["~/.codex/worktrees", "~/.claude/worktrees"]

docs/bootstrap.md

@@ -118,9 +118,10 @@ installing the Codex app, open its settings and set:
 uses ChatGPT subscription access instead of API-key billing. It does not manage
 Codex auth tokens, sessions, approvals, or app state.
 
-The same install step also runs the agent worktree mise trust helper. Use the
-matching task in [Mise tasks](mise.md#task-namespaces) to refresh that local
-trust after new worktrees are created.
+The same install step applies mise's trusted Codex and Claude worktree roots
+and runs the agent worktree mise trust helper. Use the matching task in
+[Mise tasks](mise.md#task-namespaces) to refresh local trust after new
+worktrees are created.
 
 Remote Codex connections are also manual user config. If the machine should use
 them, ask the human to add this to `~/.codex/config.toml`:

docs/mise.md

@@ -5,8 +5,9 @@ This repo uses mise in two different scopes:
 - `.mise/tasks/` defines repo tasks for humans and agents.
 - Root `mise.toml` is the repo-level mise config and documents that task
   entrypoints live in `.mise/tasks/`.
-- `chezmoi/private_dot_config/mise/config.toml` defines machine runtime and
-  tool versions applied into `~/.config/mise/config.toml`.
+- `chezmoi/private_dot_config/mise/config.toml` defines machine runtime pins,
+  tool versions, and trusted generated worktree roots applied into
+  `~/.config/mise/config.toml`.
 
 Do not mix those scopes. A repo command belongs in `.mise/tasks/`; a shared
 machine runtime pin belongs in the chezmoi-managed home config.
@@ -93,9 +94,10 @@ Bootstrap helpers:
 mise run bootstrap:trust-agent-worktrees
 ```
 
-This trusts existing `mise.toml` and `.mise.toml` files near the roots of
-Codex and Claude generated worktrees. It is also called by
-`scripts/bootstrap/install.sh`.
+The shared machine config trusts Codex and Claude generated worktree roots:
+`~/.codex/worktrees` and `~/.claude/worktrees`. The helper also refreshes trust
+for existing `mise.toml` and `.mise.toml` files near those roots, and is called
+by `scripts/bootstrap/install.sh`.
 
 ## Runtime Pins