老哥们 请教一个 Codex App 的使用问题：如何不让它读取.env*的文件内容？

现在使用 Codex 桌面版，使用的是 Full Access 完全访问模式

但是开发过程中.env 中有 API Key

如何不让它读取.env*的文件？

使用过 permissions 相关的配置，但是用了之后它读取不到自己的记忆，能力下降了很多

老哥们是如何解决这个问题的？可以借鉴一下老哥们的 config.toml 配置么

default_permissions = "workspace-network-no-env"

# Custom permission profile: keep project work fast while blocking env files.
[permissions.workspace-network-no-env.filesystem]
":minimal" = "read"
":tmpdir" = "write"
":slash_tmp" = "write"
"~/.gitconfig" = "read"
"~/.config/git" = "read"
glob_scan_max_depth = 6

[permissions.workspace-network-no-env.filesystem.":workspace_roots"]
"." = "write"
".env" = "deny"
".env.*" = "deny"
"**/.env" = "deny"
"**/.env.*" = "deny"
"**/*.env" = "deny"

[permissions.workspace-network-no-env.network]
enabled = true
allow_local_binding = true

[permissions.workspace-network-no-env.network.domains]
"*" = "allow"