-c config override for projects.<path>.trust_level is not ephemeral and can persist the opposite value to ~/.codex/config.toml

What version of Codex CLI is running?

codex-cli 0.121.0

What subscription do you have?

N/A

Which model were you using?

_No response_

What platform is your computer?

Darwin 24.6.0 arm64 arm

What terminal emulator and version are you using (if applicable)?

Apple Terminal 2.14 (455.1)

What issue are you seeing?

Passing -c to override project trust at startup mutates ~/.codex/config.toml, even though --help describes -c as a runtime override of values loaded from that file. In this case, codex even persisted the opposite value from the cli argument.

What steps can reproduce the bug?

$ cat ~/.codex/config.toml 
# ...

[tui]
show_tooltips = false
theme = "ansi"

[features]
unified_exec = true

$ codex -c "projects={\"$PWD\"={trust_level=\"untrusted\"}}"

codex opens, no prompt is shown.

$ cat ~/.codex/config.toml
# ...

[tui]
show_tooltips = false
theme = "ansi"

[features]
unified_exec = true

[projects."/Users/a/b/c"]
trust_level = "trusted"

-c should not add anything to the config.toml (?) and certainly not the opposite of what it received via cli args.

What is the expected behavior?

• -c should not persist changes into ~/.codex/config.toml.
• If the override is accepted, the effective value for that session should be untrusted, not trusted.

Additional information

_No response_