Version 0.131.0 broke config exclude patterns

What version of Codex CLI is running?

0.131.0

What subscription do you have?

N/A

Which model were you using?

_No response_

What platform is your computer?

_No response_

What terminal emulator and version are you using (if applicable)?

_No response_

Codex doctor report

What issue are you seeing?

Error loading configuration: filesystem glob path `**/.aws/**` only supports `none` access; use an exact path or trailing `/**` for `none` subtree access

This error is now happening. Previously the config worked just fine, upgrading to 0.131.0 broke it.

[permissions.locked.filesystem.":project_roots"]
"." = "write"
".env" = "none"
".env.*" = "none"
"*/.env" = "none"
"*/.env.*" = "none"
"*/*.pem" = "none"
"*/*.key" = "none"
"*/.aws/**" = "none"
"*/.ssh/**" = "none"
"*/id_rsa" = "none"
"*/id_ed25519" = "none"
"*/*secret*" = "none"
"*/*token*" = "none"
"secrets/dev" = "none"
"secrets/prod" = "none"
"*/secrets" = "none"
"*-secret.yaml" = "none"
"*-secrets.yaml" = "none"

This did not work, changing to:

[permissions.locked.filesystem.":project_roots"]
"." = "write"
".env" = "none"
"**/secrets/**" = "none"
"**/.ssh/**" = "none"
"**/.aws/**" = "none"
"**/.env/**" = "none"
"**/id_rsa" = "none"
"**/id_ed25519" = "none"

Also did NOT work

What steps can reproduce the bug?

Try one of the above config snippets, codex will not start and error

What is the expected behavior?

Codex should start and block the paths as it previously did.

Additional information

_No response_