Permission profile rejects the documented TOML table syntax for :workspace_roots

What version of the Codex App are you using (From “About Codex” dialog)?

26.810.52044

What subscription do you have?

Plus

What platform is your computer?

Darwin 24.6.0 arm64 arm

What issue are you seeing?

Codex App fails to load config.toml when a permission profile uses the documented TOML table syntax for :workspace_roots, as shown in the “Extend a profile” documentation.

Error message

Codex reports the following error for the filesystem.":workspace_roots" table in the configuration from the reproduction steps:

data did not match any variant of untagged enum FilesystemPermissionToml

Workaround

Replacing that nested TOML table with the equivalent inline-table syntax makes the configuration load successfully. The bundled Codex CLI (0.148.0-alpha.9) then reports:

config.toml parse ok

What steps can reproduce the bug?

1. Add this documented configuration to ~/.codex/config.toml

default_permissions = "workspace-with-git"

[permissions.workspace-with-git]
extends = ":workspace"

[permissions.workspace-with-git.filesystem.":workspace_roots"]
".git" = "write"

2. Restart Codex App or reopen a thread.
3. Codex App refuses to load the configuration with the error above.
4. Replace the nested table with this inline equivalent:

default_permissions = "workspace-with-git"

[permissions.workspace-with-git]
extends = ":workspace"
filesystem = { ":workspace_roots" = { ".git" = "write" } }

5. Restart Codex App or run codex doctor.
6. The configuration parses successfully.

What is the expected behavior?

The documented nested-table syntax and the equivalent inline-table syntax should both be accepted. If the nested-table form is not supported by the bundled Codex App parser, the permission-profile documentation should be updated to show only supported syntax.

Additional information

No response

Start by reproducing the documented nested-table configuration in ~/.codex/config.toml and compare it with the inline-table workaround; run codex doctor to verify parsing. Inspect the permission-profile parsing path used by the bundled Codex CLI, or the linked Extend a profile documentation if parser support is unavailable. Done means both documented forms load successfully, or the documentation shows only supported syntax.