Hermes hook installation rejected the client's default plugins.enabled: [] setting because yaml_sequence_line_has_unsupported treated flow-sequence brackets anywhere in the document as structural ambiguity. Codex 0.144.6 also rejected all three generated agent role files with 'invalid transport' because their per-role MCP tables specified enabled_tools without a command transport.
Allow flow-sequence brackets while retaining fail-closed handling for block scalars, malformed target paths, ownership conflicts, symlinks, and concurrent edits. Render self-contained Codex MCP tables with the installed command, tier-specific --tool-profile arguments, and read-only enabled_tools. Recognize the exact prior transport-less role documents during upgrade and uninstall so modified user profiles remain preserved.
Verification: CBM_ONLY_SUITE=config_yaml_edit make -f Makefile.cbm test (43 passed, ASan/UBSan); CBM_ONLY_SUITE=agent_profiles make -f Makefile.cbm test (10 passed, ASan/UBSan); isolated Hermes install with plugins.enabled: []; live install across detected harnesses; codex doctor --summary (17 ok, 0 warn, 0 fail); scripts/check-source-safety.sh.
Signed-off-by: Andrew Hundt <ATHundt@gmail.com>
Andrew Hundt
078d6e72bf