fix(coder-labs/modules/codex): prevent config.toml overwrite on restart

registry/coder-labs/modules/codex/README.md

@@ -13,7 +13,7 @@ Install and configure the [Codex CLI](https://github.com/openai/codex) in your w
 ```tf
 module "codex" {
   source         = "registry.coder.com/coder-labs/codex/coder"
-  version        = "5.1.1"
+  version        = "5.2.0"
   agent_id       = coder_agent.main.id
   openai_api_key = var.openai_api_key
 }
@@ -33,7 +33,7 @@ locals {
 
 module "codex" {
   source         = "registry.coder.com/coder-labs/codex/coder"
-  version        = "5.1.1"
+  version        = "5.2.0"
   agent_id       = coder_agent.main.id
   workdir        = local.codex_workdir
   openai_api_key = var.openai_api_key
@@ -64,7 +64,7 @@ resource "coder_app" "codex" {
 ```tf
 module "codex" {
   source            = "registry.coder.com/coder-labs/codex/coder"
-  version           = "5.1.1"
+  version           = "5.2.0"
   agent_id          = coder_agent.main.id
   workdir           = "/home/coder/project"
   enable_ai_gateway = true
@@ -88,7 +88,7 @@ When `enable_ai_gateway = true`, the module configures Codex to use the `aigatew
 ```tf
 module "codex" {
   source         = "registry.coder.com/coder-labs/codex/coder"
-  version        = "5.1.1"
+  version        = "5.2.0"
   agent_id       = coder_agent.main.id
   workdir        = "/home/coder/project"
   openai_api_key = var.openai_api_key
@@ -117,7 +117,7 @@ The module exposes the `scripts` output: an ordered list of `coder exp sync` nam
 ```tf
 module "codex" {
   source         = "registry.coder.com/coder-labs/codex/coder"
-  version        = "5.1.1"
+  version        = "5.2.0"
   agent_id       = coder_agent.main.id
   openai_api_key = var.openai_api_key
 }
@@ -142,6 +142,28 @@ resource "coder_script" "post_codex" {
 
 When no custom `base_config_toml` is provided, the module uses a minimal default with `preferred_auth_method = "apikey"`. For advanced options, see [Codex config docs](https://developers.openai.com/codex/config-advanced).
 
+> [!NOTE]
+> Content you add outside the managed block is preserved across workspace restarts. The module structures the file as:
+>
+> ```toml
+> # bare keys you add above the managed block (root scope)
+> my_flag = true
+>
+> # >>> coder-managed: codex module >>>
+> preferred_auth_method = "apikey"
+> # ... module-managed content ...
+> # <<< coder-managed: codex module <<<
+>
+> # [sections] you add below the managed block
+> [mcp_servers.my_tool]
+> command = "my-tool"
+> ```
+>
+> Two constraints to keep the TOML valid:
+>
+> - Bare keys you place **above** the managed block must not duplicate keys already inside it (duplicate keys are a TOML error).
+> - `[section]` headers you place **below** the managed block must not duplicate a table name already defined inside it (same reason). Bare keys placed after the managed block will fall under whatever `[section]` preceded them — place bare keys above the block to keep them at root scope.
+
 ## Troubleshooting
 
 Check the log files in `~/.coder-modules/coder-labs/codex/logs/` for detailed information.