Permission profile rejects the documented TOML table syntax for :workspace_roots

What version of the Codex App are you using (From “About Codex” dialog)?

26.810.52044

What subscription do you have?

Plus

What platform is your computer?

Darwin 24.6.0 arm64 arm

What issue are you seeing?

Codex App fails to load config.toml when a permission profile uses the documented TOML table syntax for :workspace_roots, as shown in the “Extend a profile” documentation.

Error message

Codex reports the following error for the filesystem.":workspace_roots" table in the configuration from the reproduction steps:

data did not match any variant of untagged enum FilesystemPermissionToml

Workaround

Replacing that nested TOML table with the equivalent inline-table syntax makes the configuration load successfully. The bundled Codex CLI (0.148.0-alpha.9) then reports:

config.toml parse ok

What steps can reproduce the bug?

1. Add this documented configuration to ~/.codex/config.toml

default_permissions = "workspace-with-git"

[permissions.workspace-with-git]
extends = ":workspace"

[permissions.workspace-with-git.filesystem.":workspace_roots"]
".git" = "write"

1. Restart Codex App or reopen a thread.
2. Codex App refuses to load the configuration with the error above.
3. Replace the nested table with this inline equivalent:

default_permissions = "workspace-with-git"

[permissions.workspace-with-git]
extends = ":workspace"
filesystem = { ":workspace_roots" = { ".git" = "write" } }

1. Restart Codex App or run codex doctor.
2. The configuration parses successfully.

What is the expected behavior?

The documented nested-table syntax and the equivalent inline-table syntax should both be accepted. If the nested-table form is not supported by the bundled Codex App parser, the permission-profile documentation should be updated to show only supported syntax.

Additional information

_No response_