Codex adds per-thread startup tool allowlists and restricts plugin installs to the root thread
GitHub·medium signal
In the same alpha window, #45711 adds startup tool allowlists for threads and #45806 restricts plugin install requests to the root thread, so a spawned child agent can no longer install a plugin into the session. #45812 adds workspace routing for Responses requests and #45822 adds opt-in response body limits to the HTTP transport. Together these are the first real per-thread capability boundaries in Codex rather than a single process-wide policy.