Keep Codex Config in Sync Across Machines

I keep my dotfiles in a repo so I can use the same setup on multiple machines.

This works well until Codex trusts a new directory.

It writes the machine-specific path directly into ~/.codex/config.toml:

[projects."/home/vincent.huang/projects"]
trust_level = "trusted"

That is annoying when config.toml is synced, because every machine has different paths.

It is also an open issue in the Codex repository:

Prevent Configuration Pollution: Separate `projects.xxxx.trusted_level` from `config.toml` #14601

The Workaround Link to heading

Codex supports profiles. Keep the shared settings in config.toml, then add an alias to your shell configuration, such as .zshrc:

alias codex='codex --profile local'

Now Codex loads config.toml first and overlays local.config.toml. Trusted directories are saved to the local profile instead of the synced config:

[projects."/home/user/Projects/blog"]
trust_level = "trusted"

The local profile stays on the machine, while the shared config.toml remains clean and portable.

This is not a perfect solution, but it works for now.