Show warning/hint if you have a project `.codex/config.toml` but project does not have a trust setting

[lgo]

What version of Codex is running?

codex-cli 0.93.0

What subscription do you have?

Pro

Which model were you using?

No response

What platform is your computer?

Darwin 24.6.0 x86_64 i386

What terminal emulator and version are you using (if applicable)?

No response

What issue are you seeing?

While working on a project, I found that I had added .codex/config.toml (alongside rules and other items), and it confusingly wasn't working. It took a few reads of the config documentation to realize this was because the project wasn't a trusted project. (As an aside: I believe I observed .codex/rules were being used still, which I'm not sure is inconsistent with the project trust)

While I may have been prompted for it initially on the project, there was no entry in my ~/.codex/config.toml for the directory.

This would have been far less confusing if there was a warning on start when there was no trust setting (untrusted or trusted) for the directory when there was a configuration there that would otherwise not be respected.

What steps can reproduce the bug?

• Add .codex/config.toml to project directory
• Start project w/o trust setting

I wasn't sure why I was not getting a prompt re: trust.

What is the expected behavior?

No response

Additional information

No response

[etraut-openai]

Thanks for the bug report.

Version 0.93 of the CLI includes a warning if you attempt to start a conversation in an untrusted project with a project-local config.toml. Can you double check that you're not seeing the warning? It should say:

Project config.toml files are disabled in the following folders.
Settings in those files are ignored, but skills and exec policies still load.

We do allow loading of project-local rules and skills even if the project isn't trusted.

[lgo]

Ah, yea, definitely error in chair 🤦

I realized that I had experimental settings on and just became blind to the warnings (which, their warning shows up after the codex info modal vs. before for the trusted project setting). Last I recall from the earlier versions, it would prompt to mark the project as trust explicitly versus just a warning so between both of these I hadn't realized it wasn't showing.

One thing that I think specifically led me to this was usually that I find I'm always resuming the same session indefinitely, where it also won't show these warnings again.