Codex Desktop on macOS shadows project-local developer_instructions with a host-generated thread override

What version of the Codex App are you using?

• ChatGPT/Codex desktop app: 26.707.72221 (5307)
• Bundle identifier: com.openai.codex
• Embedded codex-cli: 0.144.2

What subscription do you have?

Pro

What platform is your computer?

• macOS 26.5.1 (25F80)
• Apple Silicon, arm64

What issue are you seeing?

In a trusted repository, a top-level developer_instructions value from the project-local .codex/config.toml is missing from fresh threads created by Codex Desktop.

The same embedded Codex binary, running from the same working directory, includes the project-local instructions in codex debug prompt-input.

This is not a complete project-config loading failure:

• the project is trusted;
• project-specific AGENTS.md, MCP, sandbox, and other project context can still load;
• the failure appears specific to developer_instructions.

The Desktop app appears to generate its own non-empty developerInstructions value and send it as a request-level field in thread/start. The app-server treats that value as a ConfigOverrides.developer_instructions override, which shadows the value resolved from .codex/config.toml.

As a result, repository-specific workflow or safety instructions can be silently omitted from Desktop-created threads.

What steps can reproduce the bug?

1. In a trusted Git repository, create .codex/config.toml:

developer_instructions = """
Include the exact marker PROJECT_DEV_INSTRUCTIONS_7F3A
in the first line of every response.
"""

1. From the repository root, inspect the prompt using the same Codex binary bundled with the desktop app:

/Applications/ChatGPT.app/Contents/Resources/codex \
  debug prompt-input "noop"

1. Confirm that the output contains:

PROJECT_DEV_INSTRUCTIONS_7F3A

1. Open the same trusted repository in Codex Desktop.

1. Start a completely fresh thread.

1. Inspect the initial developer-role messages in the corresponding rollout under ~/.codex/sessions/, or ask the thread which project developer instruction it received.

What is the expected behavior?

The project-local developer_instructions should remain part of the effective developer context.

Desktop-specific app instructions may be added, but they should not replace explicitly configured project instructions.

The resulting developer context should effectively contain both:

project .codex/config.toml developer_instructions
+
Desktop-specific app context

What is the actual behavior?

In the reproduced Desktop thread:

originator: Codex Desktop
source: vscode
cli_version: 0.144.2

The distinctive project instruction markers were absent from all initial developer-role messages.

By comparison, codex debug prompt-input using the bundled 0.144.2 binary from the same working directory contained those markers.

Source-level evidence

The current packaged Desktop webview performs the following sequence when constructing a fresh conversation:

1. buildNewConversationParams(...) calls the host endpoint named developer-instructions.
2. The returned app-generated instructions are assigned to developerInstructions.
3. That value is sent through thread/start.

In the open-source app-server implementation, the request field is passed into ConfigOverrides:

• thread/start passes developer_instructions into build_thread_config_overrides
• ConfigOverrides.developer_instructions is populated from that request value

The core configuration merge then uses:

let developer_instructions =
    developer_instructions.or(cfg.developer_instructions);

Source:

• codex-rs/core/src/config/mod.rs

Therefore, whenever Desktop supplies a non-None request-level value, the cfg.developer_instructions value resolved from user/project config files is never used.

This source path appears to explain the observed CLI/Desktop difference:

• CLI/debug path: no Desktop host override, so project config survives.
• Desktop path: host-generated developerInstructions becomes a higher-precedence override and shadows project config.

Suggested fix direction

One of the following should preserve the intended behavior:

1. Do not use the top-level thread/start.developerInstructions field solely for Desktop app-context instructions.
2. Merge the resolved config-file developer_instructions with the Desktop-generated app context before calling thread/start.
3. Introduce a separate protocol field for additive Desktop context so it cannot replace user-configured developer instructions.

A regression test should start a Desktop-style thread with both:

• project-local developer_instructions;
• host-generated Desktop instructions.

The resulting model request should contain both instruction blocks.

Related issues

• #11004 — Codex App developer_instructions are not attached to App-created threads
• #18259 — Project-local developer_instructions do not override global configuration
• #25145 — macOS Desktop does not load developer_instructions from config.toml

This report adds a current macOS reproduction on app version 26.707.72221, verifies the behavior with the same bundled Codex binary, and narrows the failure to the Desktop host’s request-level developerInstructions override rather than the general project-config loader.