Codex App: agent-created threads start in workspace-write/on-request despite full-access default

What version of the Codex App are you using (From “About Codex” dialog)?

ChatGPT desktop 26.1023.51421 (build 22530), bundled Codex CLI 0.165.0-alpha.1.2

What subscription do you have?

Not stated

What platform is your computer?

macOS 27.0, arm64 (Mac mini)

What issue are you seeing?

Threads that the agent opens itself (thread_source = agent_created_thread, via the new-thread / create_thread tool) usually ignore the configured default permissions. They start in workspace-write with approval_policy = on-request, so every command needs manual approval. Their sub-agents inherit the restricted mode.

Config (~/.codex/config.toml):

approval_policy = "never"
default_permissions = ":danger-full-access"

codex app-server --strict-config --print-startup-config passes, and no managed requirements are present.

First turn_context of each thread in October 2026, from local rollout files:

The only 2 agent-created threads that got full access were created right after an app restart.

What steps can reproduce the bug?

1. Set the config above and restart the app.
2. In a thread that is running with Full access, ask Codex to start a task in a new thread.
3. Open the new thread's permission selector, or read the first turn_context in its rollout file.

What is the expected behavior?

The new thread uses the configured default permission profile, or inherits the parent thread's permission selection.

Additional information

• The create_thread tool schema exposes no permission, sandbox or approval parameter, so the agent cannot request a mode.
• Possibly related: #29503 (Full access selection still starts sessions with workspace-write) and #41410 (desktop project task creation forces read-only). This report is about the agent-created thread path.
• Workaround: switch the new thread to Full access by hand in the composer.