Easily share user preferences across machines

What variant of Codex are you using?

CLI

What feature would you like to see?

I use Codex on multiple machines and want consistent user-level preferences (model, sandbox policy, MCP servers, etc.).

Today ~/.codex/config.toml mixes user preferences with local trust entries, which makes it non-portable when managed via dotfiles.

Example:
My base config that I sync to ~/.codex/config.toml on all of my machines:
https://github.com/mattmorgis/.dotfiles/blob/main/config/codex/config.toml

But Codex appends per repo trust entries to ~/.codex/config.toml:

[projects."/Users/matt/.dotfiles"]
trust_level = "trusted"

Instead of being able to symlink or copy the file cleanly when I update it, I ended up writing a sync script that overwrites the base config and re-attaches [projects.*] blocks:
https://github.com/mattmorgis/.dotfiles/blob/main/scripts/codex-sync.sh

Would it be possible to make user-level preferences portable across machines?

One easy way to achieve this behavior would be to move the per-project trust entries into a separate file (e.g. ~/.codex/trust.toml or ~/.codex/config.local.toml)? That would make config.toml sharable across machines.

Happy to help implement the preferred approach once there is alignment.

Additional information

_No response_