Accept a list of profiles on the CLI and in the config

config-example.toml

@@ -1,10 +1,11 @@
 # Merge rules (apply to every layering below): scalars replace, vec fields
 # append, profiles merge by name.
 #
-# Layers, lowest precedence first: globals -> active profile (with its
-# ancestors folded in) -> CLI flags. `--profile` selects the active profile;
-# otherwise the top-level `profile` below is used. Profiles can themselves set
-# `profile = "parent"` to inherit from another profile.
+# Layers, lowest precedence first: globals -> active profiles (with their
+# ancestors folded in) -> CLI flags. `--profile a,b` selects the active
+# profiles, merged left to right; otherwise the top-level `profile` below is
+# used. Either form takes one name or a list. Profiles can themselves set
+# `profile = "parent"` (or a list) to inherit; a shared ancestor merges once.
 #
 # `extra-config` optionally points to a second file layered on top of this
 # one. Missing extra-config files are silently skipped; nesting is not
@@ -24,10 +25,7 @@ whitelist = true
 ro = [
     "~/.config/agents",
     "~/.config/git",
-    "/etc/alsa",
-    "/run/user/1000/pulse",
-    "/run/user/1000/pipewire-0",
-    "~/.config/llama-server-api-key",
+    "~/dev",
     # "/host/path:/sandbox/path",  # SRC:DST -> mount host SRC at a different target
 ]
 rw = [
@@ -53,7 +51,7 @@ env = [
 # command = ["--model", "opus"]                              # default trailing args
 # bwrap-args = ["--tmpfs /opt/scratch"]                      # raw bwrap escape hatch
 
-profile = "claude"
+profile = ["claude", "audio"]
 
 [profiles.claude]
 ro = ["~/.local/share/claude-code"]
@@ -61,7 +59,7 @@ rw = ["~/.config/claude"]
 entrypoint = ["claude", "--dangerously-skip-permissions"]
 
 [profiles.codex]
-ro = ["~/.local/share/codex-cli"]
+ro = ["~/.local/share/codex-cli", "~/.agents"]
 rw = ["~/.config/codex"]
 entrypoint = ["codex", "--dangerously-bypass-approvals-and-sandbox"]
 
@@ -69,3 +67,13 @@ entrypoint = ["codex", "--dangerously-bypass-approvals-and-sandbox"]
 ro = ["~/.local/share/pi-agent"]
 rw = ["~/.config/pi"]
 entrypoint = ["pi"]
+
+[profiles.audio]
+ro = ["/etc/alsa", "/run/user/1000/pulse", "/run/user/1000/pipewire-0"]
+
+[profiles.gpu]
+bwrap-args = ["--dev-bind /dev/dri /dev/dri"]
+
+[profiles.wayland]
+ro = ["/run/user/1000/wayland-0"]
+env = ["WAYLAND_DISPLAY=wayland-0"]