# Codex CLI config template - copy to .codex/config.toml
#
# Key differences from Claude Code:
# - This file enables the hooks engine with the current Codex feature flag
# - Filesystem allow/deny policy uses Codex permission profiles, not Claude's
#   settings.json permissions.allow/permissions.deny syntax
# - Hook registrations live in .codex/hooks.json for goat-flow installs
# - The shipped codex-hooks.json template registers Bash-matched guardrail hooks
# - Command deny policy still lives in those PreToolUse hooks because
#   Codex permission profiles describe filesystem/network access, not shell
#   command pattern denies like git push or sudo
default_permissions = "goat-flow"

[features]
hooks = true

[permissions.goat-flow]
description = "goat-flow workspace editing with secret-path read denies."
extends = ":workspace"

[permissions.goat-flow.filesystem]
glob_scan_max_depth = 3

[permissions.goat-flow.filesystem.":workspace_roots"]
# Codex deny rules win over same-profile read rules. Unlike Claude settings,
# Codex cannot re-allow recursive sample env reads behind a broad filename
# deny, so .env.example is intentionally denied here to keep .env* variants
# protected consistently across agents.
"**/.env*" = "deny"
"**/secrets/**" = "deny"
"**/.ssh/**" = "deny"
"**/.aws/**" = "deny"
"**/.docker/**" = "deny"
"**/.gnupg/**" = "deny"
"**/.kube/**" = "deny"
"**/credentials*" = "deny"
"**/.npmrc" = "deny"
"**/.pypirc" = "deny"
"**/*.pem" = "deny"
"**/*.key" = "deny"
"**/*.pfx" = "deny"
