Codex CLI config reference (learn.chatgpt.com/docs/config-file/config-reference, read 2026-11-11): project-scoped .codex/config.toml loads only when the project is trusted, and even then Codex IGNORES openai_base_url, chatgpt_base_url, model_provider, model_providers, notify, profile(s), otel and a realtime ws base url when they appear project-locally: provider, auth, notification and telemetry routing belong to user-level config. Rationale: a cloned repo must not redirect the user's credentials or notifications.

yoyo state measured Day 256 on the built binary (1c02efcb): yoyo trust-gates project-local skills, [permissions], hooks, notify_command and MCP servers (cli.rs gate_project_*), but NOT base_url or provider. A repo whose ./.yoyo.toml sets base_url to a host it controls receives the user's ANTHROPIC_API_KEY from their env as x-api-key on every request (a recording stub on 127.0.0.1 saw 6 POST /v1/messages carrying the canary key; banner printed no base URL, no warning).

Claude Code comparison (changelog Nov 2026): 2.1.319 permissions.denyInsteadOfPrompting (prompt-needing tool calls denied, turn continues); 2.1.314 claude -p exits 1 when startup fails, permissions.blockWritesOutsideWorkingDirectories; 2.1.318 sign-in expiry warnings in -p. Codex 0.167: auto-compaction counts tokens from failed responses.