Support model catalog permission messages

codex-rs/core/src/context_manager/updates.rs

@@ -46,6 +46,10 @@ fn build_permissions_update_item(
                     .model_messages
                     .as_ref()
                     .and_then(|messages| messages.approvals.as_ref()),
+                next.model_info
+                    .model_messages
+                    .as_ref()
+                    .and_then(|messages| messages.permissions.as_ref()),
             ),
             exec_policy,
             #[allow(deprecated)]

codex-rs/core/src/guardian/review_session.rs

@@ -1414,6 +1414,7 @@ mod tests {
             auto_review: Some(AutoReviewMessages {
                 policy: Some("Use the catalog Guardian policy.".to_string()),
             }),
+            permissions: None,
         };
 
         let guardian_config = build_guardian_review_session_config(
@@ -1441,6 +1442,7 @@ mod tests {
             auto_review: Some(AutoReviewMessages {
                 policy: Some(String::new()),
             }),
+            permissions: None,
         };
 
         let guardian_config = build_guardian_review_session_config(

codex-rs/core/src/session/mod.rs

@@ -3233,6 +3233,11 @@ impl Session {
                             .model_messages
                             .as_ref()
                             .and_then(|messages| messages.approvals.as_ref()),
+                        turn_context
+                            .model_info
+                            .model_messages
+                            .as_ref()
+                            .and_then(|messages| messages.permissions.as_ref()),
                     ),
                     self.services.exec_policy.current().as_ref(),
                     #[allow(deprecated)]

codex-rs/core/tests/suite/catalog_permission_messages.rs

@@ -0,0 +1,115 @@
+use anyhow::Result;
+use codex_core::config::Constrained;
+use codex_login::CodexAuth;
+use codex_models_manager::manager::RefreshStrategy;
+use codex_models_manager::model_info::model_info_from_slug;
+use codex_protocol::models::PermissionProfile;
+use codex_protocol::openai_models::ModelMessages;
+use codex_protocol::openai_models::ModelsResponse;
+use codex_protocol::openai_models::PermissionMessages;
+use codex_protocol::protocol::AskForApproval;
+use codex_protocol::protocol::EventMsg;
+use codex_protocol::protocol::Op;
+use codex_protocol::protocol::ThreadSettingsOverrides;
+use codex_protocol::user_input::UserInput;
+use core_test_support::responses::ev_completed;
+use core_test_support::responses::ev_response_created;
+use core_test_support::responses::mount_models_once;
+use core_test_support::responses::mount_sse_once;
+use core_test_support::responses::sse;
+use core_test_support::skip_if_no_network;
+use core_test_support::test_codex::test_codex;
+use core_test_support::wait_for_event;
+use pretty_assertions::assert_eq;
+use wiremock::MockServer;
+
+#[tokio::test(flavor = "multi_thread", worker_threads = 2)]
+async fn catalog_permission_message_loaded_from_remote_models_is_sent() -> Result<()> {
+    skip_if_no_network!(Ok(()));
+
+    let server = MockServer::start().await;
+    let model_slug = "remote-catalog-permissions-model";
+    let mut model = model_info_from_slug(model_slug);
+    model.model_messages = Some(ModelMessages {
+        instructions_template: None,
+        instructions_variables: None,
+        approvals: None,
+        auto_review: None,
+        permissions: Some(PermissionMessages {
+            danger_full_access: None,
+            workspace_write: None,
+            read_only: Some("remote catalog permissions: {{ network_access }}".to_string()),
+        }),
+    });
+    let models_mock = mount_models_once(
+        &server,
+        ModelsResponse {
+            models: vec![model],
+        },
+    )
+    .await;
+    let response_mock = mount_sse_once(
+        &server,
+        sse(vec![ev_response_created("resp-1"), ev_completed("resp-1")]),
+    )
+    .await;
+    let mut builder = test_codex()
+        .with_auth(CodexAuth::create_dummy_chatgpt_auth_for_testing())
+        .with_config(|config| {
+            config.permissions.approval_policy = Constrained::allow_any(AskForApproval::Never);
+            config
+                .permissions
+                .set_permission_profile(PermissionProfile::read_only())
+                .expect("read-only permission profile should be allowed");
+        });
+    let test = builder.build_with_auto_env(&server).await?;
+    test.thread_manager
+        .get_models_manager()
+        .list_models(
+            RefreshStrategy::OnlineIfUncached,
+            codex_core::test_support::default_http_client_factory(),
+        )
+        .await;
+
+    core_test_support::submit_thread_settings(
+        &test.codex,
+        ThreadSettingsOverrides {
+            model: Some(model_slug.to_string()),
+            ..Default::default()
+        },
+    )
+    .await?;
+    test.codex
+        .submit(Op::UserInput {
+            items: vec![UserInput::Text {
+                text: "hello".to_string(),
+                text_elements: Vec::new(),
+            }],
+            final_output_json_schema: None,
+            responsesapi_client_metadata: None,
+            additional_context: Default::default(),
+            thread_settings: Default::default(),
+        })
+        .await?;
+    wait_for_event(&test.codex, |event| {
+        matches!(event, EventMsg::TurnComplete(_))
+    })
+    .await;
+
+    assert_eq!(models_mock.single_request_path(), "/v1/models");
+    let permissions = response_mock
+        .single_request()
+        .message_input_texts("developer")
+        .into_iter()
+        .filter(|text| text.contains("<permissions instructions>"))
+        .map(|text| text.replace("\r\n", "\n"))
+        .collect::<Vec<_>>();
+    assert_eq!(
+        permissions,
+        vec![
+            "<permissions instructions>\nremote catalog permissions: restricted\nApproval policy is currently never. Do not provide the `sandbox_permissions` for any reason, commands will be rejected.\n</permissions instructions>"
+                .to_string()
+        ]
+    );
+    Ok(())
+}

codex-rs/core/tests/suite/mod.rs

@@ -38,6 +38,7 @@ mod apply_patch_cli;
 #[cfg(not(target_os = "windows"))]
 mod approvals;
 mod auto_review;
+mod catalog_permission_messages;
 mod cli_stream;
 mod client;
 mod client_websockets;

codex-rs/core/tests/suite/permissions_messages.rs

@@ -11,6 +11,7 @@ use codex_protocol::models::PermissionProfile;
 use codex_protocol::openai_models::ApprovalMessages;
 use codex_protocol::openai_models::ModelMessages;
 use codex_protocol::openai_models::ModelsResponse;
+use codex_protocol::openai_models::PermissionMessages;
 use codex_protocol::permissions::NetworkSandboxPolicy;
 use codex_protocol::protocol::AskForApproval;
 use codex_protocol::protocol::EventMsg;
@@ -52,6 +53,22 @@ fn model_with_approval_messages(
             on_request_auto_review: Some(on_request_auto_review.to_string()),
         }),
         auto_review: None,
+        permissions: None,
+    });
+    model
+}
+
+fn model_with_permission_messages(
+    slug: &str,
+    permissions: PermissionMessages,
+) -> codex_protocol::openai_models::ModelInfo {
+    let mut model = model_info_from_slug(slug);
+    model.model_messages = Some(ModelMessages {
+        instructions_template: None,
+        instructions_variables: None,
+        approvals: None,
+        auto_review: None,
+        permissions: Some(permissions),
     });
     model
 }
@@ -162,6 +179,128 @@ async fn model_change_appends_new_catalog_approval_message() -> Result<()> {
     Ok(())
 }
 
+#[tokio::test(flavor = "multi_thread", worker_threads = 2)]
+async fn catalog_permission_message_is_sent_initially_and_after_model_change() -> Result<()> {
+    skip_if_no_network!(Ok(()));
+
+    let server = start_mock_server().await;
+    let _req1 = mount_sse_once(
+        &server,
+        sse(vec![ev_response_created("resp-1"), ev_completed("resp-1")]),
+    )
+    .await;
+    let req2 = mount_sse_once(
+        &server,
+        sse(vec![ev_response_created("resp-2"), ev_completed("resp-2")]),
+    )
+    .await;
+    let first_slug = "catalog-permissions-model-a";
+    let second_slug = "catalog-permissions-model-b";
+    let first = model_with_permission_messages(
+        first_slug,
+        PermissionMessages {
+            danger_full_access: None,
+            workspace_write: None,
+            read_only: Some("model A permissions: {{ network_access }}".to_string()),
+        },
+    );
+    let second = model_with_permission_messages(
+        second_slug,
+        PermissionMessages {
+            danger_full_access: None,
+            workspace_write: None,
+            read_only: Some("model B permissions: {{ network_access }}".to_string()),
+        },
+    );
+    let mut builder = test_codex()
+        .with_model(first_slug)
+        .with_config(move |config| {
+            config.permissions.approval_policy = Constrained::allow_any(AskForApproval::Never);
+            config
+                .permissions
+                .set_permission_profile(PermissionProfile::read_only())
+                .expect("read-only permission profile should be allowed");
+            config.model_catalog = Some(ModelsResponse {
+                models: vec![first, second],
+            });
+        });
+    let test = builder.build(&server).await?;
+    submit_text_turn(&test, "first").await?;
+
+    core_test_support::submit_thread_settings(
+        &test.codex,
+        codex_protocol::protocol::ThreadSettingsOverrides {
+            model: Some(second_slug.to_string()),
+            ..Default::default()
+        },
+    )
+    .await?;
+    submit_text_turn(&test, "second").await?;
+
+    let permissions = permissions_texts(&req2.single_request());
+    assert_eq!(permissions.len(), 2);
+    assert!(permissions[0].contains("model A permissions: restricted"));
+    assert!(
+        permissions
+            .last()
+            .is_some_and(|text| text.contains("model B permissions: restricted"))
+    );
+    assert!(
+        permissions
+            .last()
+            .is_some_and(|text| text.contains("Approval policy is currently never"))
+    );
+    assert!(
+        !permissions
+            .iter()
+            .any(|text| text.contains("`sandbox_mode`"))
+    );
+    Ok(())
+}
+
+#[tokio::test(flavor = "multi_thread", worker_threads = 2)]
+async fn empty_catalog_permission_message_preserves_approval_instructions() -> Result<()> {
+    skip_if_no_network!(Ok(()));
+
+    let server = start_mock_server().await;
+    let req = mount_sse_once(
+        &server,
+        sse(vec![ev_response_created("resp-1"), ev_completed("resp-1")]),
+    )
+    .await;
+    let model_slug = "empty-catalog-permissions-model";
+    let model = model_with_permission_messages(
+        model_slug,
+        PermissionMessages {
+            danger_full_access: None,
+            workspace_write: None,
+            read_only: Some(String::new()),
+        },
+    );
+    let mut builder = test_codex()
+        .with_model(model_slug)
+        .with_config(move |config| {
+            config.permissions.approval_policy = Constrained::allow_any(AskForApproval::Never);
+            config
+                .permissions
+                .set_permission_profile(PermissionProfile::read_only())
+                .expect("read-only permission profile should be allowed");
+            config.model_catalog = Some(ModelsResponse {
+                models: vec![model],
+            });
+        });
+    let test = builder.build(&server).await?;
+
+    submit_text_turn(&test, "hello").await?;
+
+    let permissions = permissions_texts(&req.single_request());
+    assert_eq!(permissions.len(), 1);
+    assert!(permissions[0].contains("Approval policy is currently never"));
+    assert!(!permissions[0].contains("Filesystem sandboxing defines"));
+    assert!(!permissions[0].contains("`sandbox_mode`"));
+    Ok(())
+}
+
 #[tokio::test(flavor = "multi_thread", worker_threads = 2)]
 async fn permissions_message_sent_once_on_start() -> Result<()> {
     skip_if_no_network!(Ok(()));
@@ -692,7 +831,11 @@ async fn permissions_message_includes_writable_roots() -> Result<()> {
     let expected = PermissionsInstructions::from_permission_profile(
         &permission_profile,
         AskForApproval::OnRequest,
-        ApprovalPromptContext::new(test.config.approvals_reviewer, /*messages*/ None),
+        ApprovalPromptContext::new(
+            test.config.approvals_reviewer,
+            /*messages*/ None,
+            /*permission_messages*/ None,
+        ),
         &exec_policy,
         test.config.cwd.as_path(),
         /*exec_permission_approvals_enabled*/ false,

codex-rs/core/tests/suite/personality.rs

@@ -641,6 +641,7 @@ async fn remote_model_friendly_personality_instructions_with_feature() -> anyhow
             }),
             approvals: None,
             auto_review: None,
+            permissions: None,
         }),
         include_skills_usage_instructions: false,
         supports_reasoning_summary_parameter: true,
@@ -759,6 +760,7 @@ async fn user_turn_personality_remote_model_template_includes_update_message() -
             }),
             approvals: None,
             auto_review: None,
+            permissions: None,
         }),
         include_skills_usage_instructions: false,
         supports_reasoning_summary_parameter: true,

codex-rs/models-manager/src/model_info.rs

@@ -112,7 +112,10 @@ fn clear_instruction_messages(model: &mut ModelInfo) {
     if let Some(model_messages) = &mut model.model_messages {
         model_messages.instructions_template = None;
         model_messages.instructions_variables = None;
-        if model_messages.approvals.is_none() && model_messages.auto_review.is_none() {
+        if model_messages.approvals.is_none()
+            && model_messages.auto_review.is_none()
+            && model_messages.permissions.is_none()
+        {
             model.model_messages = None;
         }
     }
@@ -177,6 +180,7 @@ fn local_personality_messages_for_slug(slug: &str) -> Option<ModelMessages> {
             }),
             approvals: None,
             auto_review: None,
+            permissions: None,
         }),
         _ => None,
     }