codex mutable config

modules/applications/codex/config.toml

@@ -0,0 +1,13 @@
+model = "gpt-5.6-terra"
+model_reasoning_effort = "medium"
+
+approval_policy = "on-request"
+approvals_reviewer = "auto_review"
+sandbox_mode = "workspace-write"
+web_search = "cached"
+
+[sandbox_workspace_write]
+network_access = false
+
+[projects."/home/moons/dotfiles"]
+trust_level = "trusted"

modules/applications/codex/home.nix

@@ -1,32 +1,30 @@
 {
+  config,
   inputs,
+  lib,
   pkgs,
   ...
 }:
+let
+  source = "${config.home.homeDirectory}/dotfiles/modules/applications/codex/config.toml";
+in
 {
   programs.codex = {
     enable = true;
     package = inputs.llm-agents.packages.${pkgs.stdenv.hostPlatform.system}.codex;
 
-    # Home Manager writes this as CODEX_HOME/config.toml.  Keep only general
-    # client defaults here; custom agents, hooks, and global instructions are
-    # intentionally not configured.
-    settings = {
-      model = "gpt-5.6-terra";
-      model_reasoning_effort = "medium";
-
-      approval_policy = "on-request";
-      approvals_reviewer = "auto_review";
-      sandbox_mode = "workspace-write";
-      sandbox_workspace_write.network_access = false;
-      web_search = "cached";
-    };
-
-    # `grill-me` delegates to the reusable `grilling` primitive, so both are
-    # installed even though `/grill-me` is the user-facing entry point.
+    # `grill-me` invokes the reusable `grilling` skill.
     skills = {
       grill-me = inputs.skills + "/skills/productivity/grill-me";
       grilling = inputs.skills + "/skills/productivity/grilling";
     };
   };
+
+  home.file = lib.mkIf (!config.home.preferXdgDirectories) {
+    ".codex/config.toml".source = config.lib.file.mkOutOfStoreSymlink source;
+  };
+
+  xdg.configFile = lib.mkIf config.home.preferXdgDirectories {
+    "codex/config.toml".source = config.lib.file.mkOutOfStoreSymlink source;
+  };
 }