Extract claude and codex configs into separate profiles

src/config.rs

@@ -290,6 +290,8 @@ pub struct FileConfig {
     pub options: Options,
     #[serde(default)]
     pub profile: HashMap<String, Options>,
+    #[serde(rename = "default-profile", default)]
+    pub default_profile: Option<String>,
     // Collects unrecognized keys; deny_unknown_fields is incompatible with flatten.
     #[serde(flatten)]
     _unknown: HashMap<String, toml::Value>,
@@ -322,7 +324,7 @@ impl FileConfig {
     }
 
     fn resolve_profile(&self, name: Option<&str>) -> Result<Options, SandboxError> {
-        match name {
+        match name.or(self.default_profile.as_deref()) {
             Some(n) => self
                 .profile
                 .get(n)
@@ -879,6 +881,65 @@ mod tests {
         assert!(!config.hardened);
     }
 
+    #[test]
+    fn build_default_profile_used_when_cli_absent() {
+        let file_config = FileConfig {
+            default_profile: Some("auto".into()),
+            profile: HashMap::from([(
+                "auto".into(),
+                Options {
+                    hardened: Some(true),
+                    ..Options::default()
+                },
+            )]),
+            ..FileConfig::default()
+        };
+        let config = build(args_with_command(), Some(file_config)).unwrap();
+        assert!(config.hardened);
+    }
+
+    #[test]
+    fn build_cli_profile_overrides_default_profile() {
+        let file_config = FileConfig {
+            default_profile: Some("auto".into()),
+            profile: HashMap::from([
+                (
+                    "auto".into(),
+                    Options {
+                        hardened: Some(true),
+                        ..Options::default()
+                    },
+                ),
+                (
+                    "other".into(),
+                    Options {
+                        hardened: Some(false),
+                        ..Options::default()
+                    },
+                ),
+            ]),
+            ..FileConfig::default()
+        };
+        let args = Args {
+            profile: Some("other".into()),
+            ..args_with_command()
+        };
+        let config = build(args, Some(file_config)).unwrap();
+        assert!(!config.hardened);
+    }
+
+    #[test]
+    fn build_missing_default_profile_errors() {
+        let file_config = FileConfig {
+            default_profile: Some("nope".into()),
+            ..FileConfig::default()
+        };
+        assert!(matches!(
+            build(args_with_command(), Some(file_config)),
+            Err(SandboxError::ProfileNotFound(_))
+        ));
+    }
+
     #[test]
     fn build_missing_profile_errors() {
         let args = Args {