#history

history.persistence = "none" stops Codex writing chat history; keyring keeps credentials off disk

Two lines in ~/.codex/config.toml: history.persistence = "none" (default save-all) and cli_auth_credentials_store = "keyring" or "ephemeral". What each disables and the trade-offs.