Implement profile inheritance

config-example.toml

@@ -1,10 +1,14 @@
-# Layered settings: CLI > active profile > globals. `--profile` selects the
-# profile, otherwise `default-profile` below is used. Vec fields append across
-# layers; scalars replace.
+# Merge rules (apply to every layering below): scalars replace, vec fields
+# append, profiles merge by name.
 #
-# `extra-config` optionally points to a second file layered on top of this one
-# using the same rules (scalars replace, vecs append, profiles merge by name).
-# Missing extra-config files are silently skipped; nesting is not supported.
+# Layers, lowest precedence first: globals -> active profile (with its
+# ancestors folded in) -> CLI flags. `--profile` selects the active profile;
+# otherwise the top-level `profile` below is used. Profiles can themselves set
+# `profile = "parent"` to inherit from another profile.
+#
+# `extra-config` optionally points to a second file layered on top of this
+# one. Missing extra-config files are silently skipped; nesting is not
+# supported.
 
 extra-config = "~/.config/agent-sandbox/extra.toml"
 
@@ -41,13 +45,17 @@ env = [
 # command = ["--model", "opus"]                              # default trailing args
 # bwrap-args = ["--tmpfs /opt/scratch"]                      # raw bwrap escape hatch
 
-default-profile = "claude"
+profile = "claude"
 
-[profile.claude]
+[profiles.claude]
 ro = ["~/.local/share/claude-code"]
 rw = ["~/.config/claude"]
+entrypoint = ["claude", "--allowedTools", "Bash(*)", "WebSearch", "WebFetch(*)", "mcp__*"]
+
+[profiles.claude-yolo]
+profile = "claude"
 entrypoint = ["claude", "--dangerously-skip-permissions"]
 
-[profile.codex]
+[profiles.codex]
 ro = ["~/.local/share/codex-cli"]
 entrypoint = ["codex", "--dangerously-bypass-approvals-and-sandbox"]