Codex thread title generation loads the user's MCP servers and carried out the first message as a task #18293

Written by Claude Opus 5.5 on behalf of Daniel.

What happened

I started a new thread on the Claude provider and asked for a change to a
landing page. Within a minute something else was making the same change to
the same files. I had not started any other agent, and T3 Code showed only
the one thread. The Claude agent saw the files changing under it and stopped.
It took a long investigation to find out that the thread title generator was
doing the work.

Diagnosis

The Codex title generation run acted on my first message as a task, in the
project folder, and edited files.

packages/provider-core/src/server/textGenerationOperations.ts (about line
42) says that without investigate, "the prompt carries everything and the
model runs with no tools at all."

The Claude runner enforces this. apps/server/src/textGeneration/ClaudeTextGeneration.ts
(about line 211) passes --tools "", --disable-slash-commands and
--strict-mcp-config.

The Codex runner does not. apps/server/src/textGeneration/CodexTextGeneration.ts
(about lines 193 to 212) runs:

codex exec --ephemeral --skip-git-repo-check -s read-only --model <model>
  --config model_reasoning_effort="<effort>" --output-schema <file>
  --output-last-message <file> [--image <file>] -

with cwd set to the project. Nothing turns off tools, MCP servers or
plugins, so the run loads the user's Codex config. Mine has MCP servers
including node_repl and computer-use, and the bundled browser and
computer-use plugins. MCP servers run outside the Codex sandbox, so
-s read-only does not limit them.

During the title run I saw node_repl and codex-code-mode-host running as
its child processes. I could not confirm which tool performed each write.

Line numbers are from main at ed0f7b9 and may be off for this nightly.
The code is unchanged on main as of that commit.

Steps to reproduce

Seen once. I have not reproduced it on purpose.

1. Have a Codex config with an MCP server that can run code or write files.
2. Set text generation to Codex with gpt-6-luna.
3. In a project with a clean git tree, start a new thread.
4. Send a first message that reads as a coding task and asks for
   screenshots when done. Mine had two images attached.
5. Watch the project files and git status while the title is generated.

Version

0.0.46-nightly.20261011.2967

Environment

macOS 26.6.2, desktop app. codex-cli 0.162.1. Text generation model
gpt-6-luna, reasoning effort low. Thread provider Claude Code,
claude-opus-5-5.

Evidence

From server.trace.ndjson:

17:32:48 ThreadTitleRegenerationService.execute        277.3s Success
17:32:48 CodexTextGeneration.generateThreadTitle       180.1s Failure
17:32:48 runCodexJson.runCodexCommand                  180.0s Interrupted
17:35:50 CodexTextGeneration.generateThreadTitle        95.2s Success
17:43:28 CodexTextGeneration.generateThreadTitle         7.5s Success  (another thread)

What happened in the project folder, by file modification and process start times:

17:33:27 to 17:33:50  index.html, styles.css, app.js rewritten
17:34:30              python -m http.server 8787 started
17:35:32              Playwright CLI browser session opened the page
17:35:48              first title run interrupted at the 180 s timeout
17:36:15 to 17:36:22  index.html and styles.css edited again
17:37:17              two screenshots saved to /tmp
17:37:25              second title run finished and the thread got its title

Every write falls inside one of the two title runs. A file watch that ran
afterwards saw no further writes.

The run is ephemeral, so Codex kept no session for it, and T3 Code lists no
thread or run for it.

Related issues

#15230 and #5359 are about title generation failing. #18060 is about a
generic title for a link-only first message. None covers the title run
acting on the message or changing files.

Fix applied or workaround

Nothing was changed on the machine to work around it. Untested: choosing a
Claude model for text generation should avoid it, since that runner passes
--tools "".

Filed by

claude (claude-opus-5-5), from a normal T3 Code thread. t3 triage was not used.