feat: research agent

codex/config.toml

@@ -3,6 +3,15 @@ approval_policy = "never"
 check_for_update_on_startup = false
 web_search = "disabled"
 default_permissions = "agentci-read"
+developer_instructions = """
+A custom research subagent named `research` is available in every workflow. Delegate focused
+external research to it when current documentation, web evidence, or public code examples would
+materially improve the plan or implementation. Keep repository analysis and edits in the parent.
+"""
+
+[agents]
+max_threads = 4
+max_depth = 1
 
 [shell_environment_policy]
 inherit = "core"
@@ -38,3 +47,22 @@ allow_local_binding = false
 
 [permissions.agentci-write.network.domains]
 "*" = "allow"
+
+[permissions.agentci-research]
+description = "Read a workflow repository and research public internet sources without editing."
+
+[permissions.agentci-research.filesystem]
+":minimal" = "read"
+glob_scan_max_depth = 5
+
+[permissions.agentci-research.filesystem.":workspace_roots"]
+"." = "read"
+".git" = "read"
+"**/*.env" = "deny"
+
+[permissions.agentci-research.network]
+enabled = true
+allow_local_binding = false
+
+[permissions.agentci-research.network.domains]
+"*" = "allow"