Why

Research and training setups need to control which tool namespaces appear inside code mode's nested tools surface without disabling those tools entirely. This makes it possible to train against a deliberately reduced nested-tool setup while preserving the normal direct and deferred tool paths.

What

• Extend features.code_mode to accept structured configuration while preserving the existing boolean syntax.

• Add an exact excluded_tool_namespaces list under [features.code_mode]:

  [features.code_mode]
  enabled = true
  excluded_tool_namespaces = ["mcp__codex_apps", "multi_agent_v1"]

• Filter matching canonical ToolName namespaces when constructing code mode's nested router and code-mode-specific direct tool descriptions.

• Keep excluded tools registered, directly exposed in mixed code mode, and discoverable through top-level tool_search when otherwise eligible.

• Derive deferred nested-tool guidance after namespace filtering so the exec description does not advertise excluded-only deferred tools.

• Preserve the boolean/table representation when materializing config locks and update the generated config schema.

Testing

• just test -p codex-features
• just test -p codex-config
• just test -p codex-core load_config_resolves_code_mode_config
• just test -p codex-core lock_contains_prompts_and_materializes_features
• just test -p codex-core excluded_deferred_namespaces_do_not_enable_nested_tool_guidance
• just test -p codex-core code_mode_excludes_configured_nested_tool_namespaces
• cargo check -p codex-thread-manager-sample