[Windows Desktop] create_thread bypasses disabled_tools and trusted PreToolUse hook, freezes UI, and hides the child task

Codex version

• Codex Desktop: 26.903.9818.0
• Bundled Codex CLI: 0.153.4
• Subscription: Not specified in this public report

Platform

Microsoft Windows NT 10.0.26200.0 x64

What issue are you seeing?

Codex Desktop continues to expose and execute its task-management tools after I disabled them through two independent configuration mechanisms.

First, I disabled the tools in ~/.codex/config.toml:

[plugins."codex-app-tools@openai-bundled".mcp_servers.codex_app]
disabled_tools = [
  "create_thread",
  "fork_thread",
  "send_message_to_thread",
  "handoff_thread"
]

Second, I added and trusted a PreToolUse hook that matches the same tools:

^(?:mcp__codex_app__|codex_app[./])?(?:create_thread|fork_thread|send_message_to_thread|handoff_thread)$

The hook command writes a denial message and exits with status 2. Codex shows the hook as trusted, and the trusted hash is present in config.toml.

Neither control prevents the calls. After a full application restart, fork_thread still executed successfully. In a later realtime voice session, Codex executed create_thread despite the disabled_tools entry and trusted hook.

When this happens, the Codex Desktop interface becomes unresponsive. I lose visibility into my chat windows and cannot tell whether the newly created task is still running or has completed. The child task may exist and remain active while being absent from the normal sidebar and task listing. It can still be read through its direct task ID, but the user has no normal way to discover or monitor it.

The only recovery I have found is to restart Codex Desktop. Restarting is disruptive because active work may be interrupted, and the user cannot see the hidden task's state before deciding whether to restart.

This has happened more than once, including after restarting the application and confirming that both safeguards were configured.

Steps to reproduce

1. On Codex Desktop for Windows, enable the bundled Codex app tools plugin.
2. Add create_thread, fork_thread, send_message_to_thread, and handoff_thread to that server's disabled_tools list.
3. Add a trusted PreToolUse hook matching those same tool names. Make the hook exit with status 2.
4. Fully quit and reopen Codex Desktop.
5. Start a realtime voice conversation associated with a saved project.
6. Give the conversation a project-related request that Codex may try to route into another task.
7. Observe that create_thread or fork_thread remains available and executes.
8. Observe that the desktop interface becomes unresponsive.
9. Observe that the created child may remain active but does not appear in the normal sidebar or task listing.
10. Restart Codex Desktop to regain access to the interface.

Expected behavior

• disabled_tools should remove the listed tools from the assistant's callable tools.
• If a disabled tool is somehow exposed, the trusted PreToolUse hook should run and block it before execution.
• A local instruction requiring explicit user permission before task creation should not be bypassed by automatic routing.
• If task creation does occur, Codex Desktop should remain responsive and show the task immediately in the sidebar with its current status.
• The user should never need to restart the application to regain chat visibility or discover whether work is still running.

Additional information

The local configuration contains both the expected disabled_tools entry and a trusted hook record. Recorded task history confirms that create_thread and fork_thread reached the task service instead of being blocked.

The issue appears to combine three defects:

1. Desktop-owned task tools bypass the configured disabled_tools list.
2. Desktop-owned task tools do not trigger or honor the trusted PreToolUse hook.
3. A successfully created child task can remain absent from the sidebar and normal task listing while it is active.

Related reports cover parts of the behavior, but none covers this exact enforcement bypass:

• https://github.com/openai/codex/issues/18491
• https://github.com/openai/codex/issues/30385
• https://github.com/openai/codex/issues/31119
• https://github.com/openai/codex/issues/37950

Public task IDs and private project names are omitted. They can be supplied privately if OpenAI provides an appropriate diagnostic channel.

No files or tests are named. Start by reproducing the Windows Desktop flow with disabled_tools and the trusted PreToolUse hook, then trace the create_thread and fork_thread entry points through tool enforcement and task listing. Done means blocked tools stay unavailable, and any created child remains visible while the interface stays responsive.