Before a coding tool asks whether you trust a folder, that folder can still be present in the launch environment. If a helper lookup consults a repository-controlled PATH, a program in the checkout can be selected before the trust question is answered. The Codex pull request merged September 2 now resolves automatic startup helpers from named system installation locations, not from ambient PATH or the working directory.
This is not a rerun of the configuration boundary we covered on August 29. That Gemini CLI change stopped an untrusted workspace's settings from being assembled into an A2A server.
Codex's new main-branch change starts earlier and lower down: before trust, who gets to choose the executable that performs an automatic probe, startup task, or support routine? Configuration can describe an agent's work; executable resolution decides which program gets to speak first.
A trusted filename is not enough if its helpers inherit the workspace
The new system-command resolver looks for automatic helpers in OS and conventional package-manager locations, rejects path-like helper names, and declines a symlink that resolves outside those installation roots. For curated-plugin sync, Codex uses that resolver for Git, then gives the Git child process a system-only PATH, removes GIT_EXEC_PATH, GIT_TEMPLATE_DIR, and DEVELOPER_DIR, and disables terminal prompts. That second step matters: choosing a trusted git binary would not by itself prevent one of Git's own helper lookups from wandering back into the workspace.
The patch also trades a little diagnostic certainty for a safer pre-trust posture. Its Git check can report a candidate's location but says execution is not verified; terminal detection now reads environment variables instead of running terminal helpers. The source is explicit that the new system-only child path is for automatic helpers, not user-requested tools. That is the useful distinction: a tool should not quietly repurpose a user's normal command choices, but it should know when it is acting on its own before the workspace has earned trust.
The test asks the right uncomfortable question
The new black-box fixture plants marker scripts named zellij, tmux, which, where, npm, rg, git, and curl in workspace/node_modules/.bin, prepends that directory to PATH, and then exercises startup, doctor, feedback collection, and interactive tmux startup. The marker must remain absent. A separate plugin-sync test does the same for Git and its transport helpers while proving the sync still completes.
Those are strong receipts for intended main-branch behavior, not a release claim, an account of adoption, proof of an exploit, or a complete audit. The resolver also assumes the named system locations are trustworthy. Still, the public engineering decision is a useful one to carry into any agent review: list every command the product runs automatically before trust, then ask whether it merely inspects a path, resolves a known system executable, or lets the workspace select its helper. The next signal worth watching is release guidance—and tests for every new pre-trust automatic call—that keep those three answers visible.