skills: remove unused skill permission metadata

codex-rs/core-skills/src/injection_tests.rs

@@ -11,8 +11,6 @@ fn make_skill(name: &str, path: &str) -> SkillMetadata {
         interface: None,
         dependencies: None,
         policy: None,
-        permission_profile: None,
-        managed_network_override: None,
         path_to_skills_md: PathBuf::from(path),
         scope: codex_protocol::protocol::SkillScope::User,
     }

codex-rs/core-skills/src/invocation_utils_tests.rs

@@ -18,8 +18,6 @@ fn test_skill_metadata(skill_doc_path: PathBuf) -> SkillMetadata {
         interface: None,
         dependencies: None,
         policy: None,
-        permission_profile: None,
-        managed_network_override: None,
         path_to_skills_md: skill_doc_path,
         scope: codex_protocol::protocol::SkillScope::User,
     }

codex-rs/core-skills/src/loader.rs

@@ -2,7 +2,6 @@ use crate::model::SkillDependencies;
 use crate::model::SkillError;
 use crate::model::SkillInterface;
 use crate::model::SkillLoadOutcome;
-use crate::model::SkillManagedNetworkOverride;
 use crate::model::SkillMetadata;
 use crate::model::SkillPolicy;
 use crate::model::SkillToolDependency;
@@ -13,10 +12,6 @@ use codex_config::ConfigLayerStackOrdering;
 use codex_config::default_project_root_markers;
 use codex_config::merge_toml_values;
 use codex_config::project_root_markers_from_config;
-use codex_protocol::models::FileSystemPermissions;
-use codex_protocol::models::MacOsSeatbeltProfileExtensions;
-use codex_protocol::models::NetworkPermissions;
-use codex_protocol::models::PermissionProfile;
 use codex_protocol::protocol::Product;
 use codex_protocol::protocol::SkillScope;
 use codex_utils_absolute_path::AbsolutePathBufGuard;
@@ -59,8 +54,6 @@ struct SkillMetadataFile {
     dependencies: Option<Dependencies>,
     #[serde(default)]
     policy: Option<Policy>,
-    #[serde(default)]
-    permissions: Option<SkillPermissionProfile>,
 }
 
 #[derive(Default)]
@@ -68,28 +61,6 @@ struct LoadedSkillMetadata {
     interface: Option<SkillInterface>,
     dependencies: Option<SkillDependencies>,
     policy: Option<SkillPolicy>,
-    permission_profile: Option<PermissionProfile>,
-    managed_network_override: Option<SkillManagedNetworkOverride>,
-}
-
-#[derive(Debug, Default, Deserialize, PartialEq, Eq)]
-struct SkillPermissionProfile {
-    #[serde(default)]
-    network: Option<SkillNetworkPermissions>,
-    #[serde(default)]
-    file_system: Option<FileSystemPermissions>,
-    #[serde(default)]
-    macos: Option<MacOsSeatbeltProfileExtensions>,
-}
-
-#[derive(Debug, Default, Deserialize, PartialEq, Eq)]
-struct SkillNetworkPermissions {
-    #[serde(default)]
-    enabled: Option<bool>,
-    #[serde(default)]
-    allowed_domains: Option<Vec<String>>,
-    #[serde(default)]
-    denied_domains: Option<Vec<String>>,
 }
 
 #[derive(Debug, Default, Deserialize)]
@@ -551,8 +522,6 @@ fn parse_skill_file(path: &Path, scope: SkillScope) -> Result<SkillMetadata, Ski
         interface,
         dependencies,
         policy,
-        permission_profile,
-        managed_network_override,
     } = load_skill_metadata(path);
 
     validate_len(&name, MAX_NAME_LEN, "name")?;
@@ -574,8 +543,6 @@ fn parse_skill_file(path: &Path, scope: SkillScope) -> Result<SkillMetadata, Ski
         interface,
         dependencies,
         policy,
-        permission_profile,
-        managed_network_override,
         path_to_skills_md: resolved_path,
         scope,
     })
@@ -639,54 +606,14 @@ fn load_skill_metadata(skill_path: &Path) -> LoadedSkillMetadata {
         interface,
         dependencies,
         policy,
-        permissions,
     } = parsed;
-    let (permission_profile, managed_network_override) = normalize_permissions(permissions);
     LoadedSkillMetadata {
         interface: resolve_interface(interface, skill_dir),
         dependencies: resolve_dependencies(dependencies),
         policy: resolve_policy(policy),
-        permission_profile,
-        managed_network_override,
     }
 }
 
-fn normalize_permissions(
-    permissions: Option<SkillPermissionProfile>,
-) -> (
-    Option<PermissionProfile>,
-    Option<SkillManagedNetworkOverride>,
-) {
-    let Some(permissions) = permissions else {
-        return (None, None);
-    };
-    let managed_network_override = permissions
-        .network
-        .as_ref()
-        .map(|network| SkillManagedNetworkOverride {
-            allowed_domains: network.allowed_domains.clone(),
-            denied_domains: network.denied_domains.clone(),
-        })
-        .filter(SkillManagedNetworkOverride::has_domain_overrides);
-    let permission_profile = PermissionProfile {
-        network: permissions.network.and_then(|network| {
-            let network = NetworkPermissions {
-                enabled: network.enabled,
-            };
-            (!network.is_empty()).then_some(network)
-        }),
-        file_system: permissions
-            .file_system
-            .filter(|file_system| !file_system.is_empty()),
-        macos: permissions.macos,
-    };
-
-    (
-        (!permission_profile.is_empty()).then_some(permission_profile),
-        managed_network_override,
-    )
-}
-
 fn resolve_interface(interface: Option<Interface>, skill_dir: &Path) -> Option<SkillInterface> {
     let interface = interface?;
     let interface = SkillInterface {

codex-rs/core-skills/src/loader_tests.rs

@@ -4,12 +4,6 @@ use codex_config::ConfigLayerEntry;
 use codex_config::ConfigLayerStack;
 use codex_config::ConfigRequirements;
 use codex_config::ConfigRequirementsToml;
-use codex_protocol::models::FileSystemPermissions;
-use codex_protocol::models::MacOsAutomationPermission;
-use codex_protocol::models::MacOsContactsPermission;
-use codex_protocol::models::MacOsPreferencesPermission;
-use codex_protocol::models::MacOsSeatbeltProfileExtensions;
-use codex_protocol::models::PermissionProfile;
 use codex_protocol::protocol::Product;
 use codex_protocol::protocol::SkillScope;
 use codex_utils_absolute_path::AbsolutePathBuf;
@@ -290,8 +284,6 @@ fn loads_skills_from_home_agents_dir_for_user_scope() -> anyhow::Result<()> {
             interface: None,
             dependencies: None,
             policy: None,
-            permission_profile: None,
-            managed_network_override: None,
             path_to_skills_md: normalized(&skill_path),
             scope: SkillScope::User,
         }]
@@ -442,8 +434,6 @@ async fn loads_skill_dependencies_metadata_from_yaml() {
                 ],
             }),
             policy: None,
-            permission_profile: None,
-            managed_network_override: None,
             path_to_skills_md: normalized(&skill_path),
             scope: SkillScope::User,
         }]
@@ -499,8 +489,6 @@ interface:
             }),
             dependencies: None,
             policy: None,
-            permission_profile: None,
-            managed_network_override: None,
             path_to_skills_md: normalized(skill_path.as_path()),
             scope: SkillScope::User,
         }]
@@ -610,340 +598,6 @@ policy:
     );
 }
 
-#[tokio::test]
-async fn loads_skill_permissions_from_yaml() {
-    let codex_home = tempfile::tempdir().expect("tempdir");
-    let skill_path = write_skill(&codex_home, "demo", "permissions-skill", "from yaml");
-    let skill_dir = skill_path.parent().expect("skill dir");
-    fs::create_dir_all(skill_dir.join("data")).expect("create read path");
-    fs::create_dir_all(skill_dir.join("output")).expect("create write path");
-
-    write_skill_metadata_at(
-        skill_dir,
-        r#"
-permissions:
-  network:
-    enabled: true
-  file_system:
-    read:
-      - "./data"
-    write:
-      - "./output"
-"#,
-    );
-
-    let cfg = make_config(&codex_home).await;
-    let outcome = load_skills_for_test(&cfg);
-
-    assert!(
-        outcome.errors.is_empty(),
-        "unexpected errors: {:?}",
-        outcome.errors
-    );
-    assert_eq!(outcome.skills.len(), 1);
-    assert_eq!(
-        outcome.skills[0].permission_profile,
-        Some(PermissionProfile {
-            network: Some(NetworkPermissions {
-                enabled: Some(true),
-            }),
-            file_system: Some(FileSystemPermissions {
-                read: Some(vec![
-                    AbsolutePathBuf::try_from(normalized(skill_dir.join("data").as_path()))
-                        .expect("absolute data path"),
-                ]),
-                write: Some(vec![
-                    AbsolutePathBuf::try_from(normalized(skill_dir.join("output").as_path()))
-                        .expect("absolute output path"),
-                ]),
-            }),
-            macos: None,
-        })
-    );
-    assert_eq!(outcome.skills[0].managed_network_override, None);
-}
-
-#[tokio::test]
-async fn empty_skill_permissions_do_not_create_profile() {
-    let codex_home = tempfile::tempdir().expect("tempdir");
-    let skill_path = write_skill(&codex_home, "demo", "permissions-empty", "from yaml");
-    let skill_dir = skill_path.parent().expect("skill dir");
-
-    write_skill_metadata_at(
-        skill_dir,
-        r#"
-permissions: {}
-"#,
-    );
-
-    let cfg = make_config(&codex_home).await;
-    let outcome = load_skills_for_test(&cfg);
-
-    assert!(
-        outcome.errors.is_empty(),
-        "unexpected errors: {:?}",
-        outcome.errors
-    );
-    assert_eq!(outcome.skills.len(), 1);
-    assert_eq!(outcome.skills[0].permission_profile, None);
-}
-
-#[test]
-fn normalize_permissions_splits_managed_network_overrides() {
-    let (permission_profile, managed_network_override) =
-        normalize_permissions(Some(SkillPermissionProfile {
-            network: Some(SkillNetworkPermissions {
-                enabled: Some(true),
-                allowed_domains: Some(vec!["skill.example.com".to_string()]),
-                denied_domains: Some(vec!["blocked.skill.example.com".to_string()]),
-            }),
-            file_system: None,
-            macos: None,
-        }));
-
-    assert_eq!(
-        permission_profile,
-        Some(PermissionProfile {
-            network: Some(NetworkPermissions {
-                enabled: Some(true),
-            }),
-            file_system: None,
-            macos: None,
-        })
-    );
-    assert_eq!(
-        managed_network_override,
-        Some(SkillManagedNetworkOverride {
-            allowed_domains: Some(vec!["skill.example.com".to_string()]),
-            denied_domains: Some(vec!["blocked.skill.example.com".to_string()]),
-        })
-    );
-}
-
-#[test]
-fn normalize_permissions_preserves_network_gate_separately_from_overrides() {
-    let (permission_profile, managed_network_override) =
-        normalize_permissions(Some(SkillPermissionProfile {
-            network: Some(SkillNetworkPermissions {
-                enabled: Some(false),
-                allowed_domains: Some(vec!["skill.example.com".to_string()]),
-                denied_domains: None,
-            }),
-            file_system: None,
-            macos: None,
-        }));
-
-    assert_eq!(
-        permission_profile,
-        Some(PermissionProfile {
-            network: Some(NetworkPermissions {
-                enabled: Some(false),
-            }),
-            file_system: None,
-            macos: None,
-        })
-    );
-    assert_eq!(
-        managed_network_override,
-        Some(SkillManagedNetworkOverride {
-            allowed_domains: Some(vec!["skill.example.com".to_string()]),
-            denied_domains: None,
-        })
-    );
-}
-
-#[test]
-fn skill_metadata_parses_macos_permissions_yaml() {
-    let parsed = serde_yaml::from_str::<SkillMetadataFile>(
-        r#"
-permissions:
-  macos:
-    macos_preferences: "read_write"
-    macos_automation:
-      - "com.apple.Notes"
-    macos_launch_services: true
-    macos_accessibility: true
-    macos_calendar: true
-"#,
-    )
-    .expect("parse skill metadata");
-
-    assert_eq!(
-        parsed.permissions,
-        Some(SkillPermissionProfile {
-            network: None,
-            file_system: None,
-            macos: Some(MacOsSeatbeltProfileExtensions {
-                macos_preferences: MacOsPreferencesPermission::ReadWrite,
-                macos_automation: MacOsAutomationPermission::BundleIds(vec![
-                    "com.apple.Notes".to_string(),
-                ]),
-                macos_launch_services: true,
-                macos_accessibility: true,
-                macos_calendar: true,
-                macos_reminders: false,
-                macos_contacts: MacOsContactsPermission::None,
-            }),
-        })
-    );
-}
-
-#[test]
-fn skill_metadata_parses_macos_reminders_permission_yaml() {
-    let parsed = serde_yaml::from_str::<SkillMetadataFile>(
-        r#"
-permissions:
-  macos:
-    macos_reminders: true
-"#,
-    )
-    .expect("parse reminders skill metadata");
-
-    assert_eq!(
-        parsed.permissions,
-        Some(SkillPermissionProfile {
-            network: None,
-            file_system: None,
-            macos: Some(MacOsSeatbeltProfileExtensions {
-                macos_preferences: MacOsPreferencesPermission::ReadOnly,
-                macos_automation: MacOsAutomationPermission::None,
-                macos_launch_services: false,
-                macos_accessibility: false,
-                macos_calendar: false,
-                macos_reminders: true,
-                macos_contacts: MacOsContactsPermission::None,
-            }),
-        })
-    );
-}
-
-#[test]
-fn skill_metadata_parses_network_domain_overrides_under_permissions() {
-    let parsed = serde_yaml::from_str::<SkillMetadataFile>(
-        r#"
-permissions:
-  network:
-    enabled: true
-    allowed_domains:
-      - "skill.example.com"
-    denied_domains:
-      - "blocked.skill.example.com"
-"#,
-    )
-    .expect("parse network skill metadata");
-
-    assert_eq!(
-        parsed.permissions,
-        Some(SkillPermissionProfile {
-            network: Some(SkillNetworkPermissions {
-                enabled: Some(true),
-                allowed_domains: Some(vec!["skill.example.com".to_string()]),
-                denied_domains: Some(vec!["blocked.skill.example.com".to_string()]),
-            }),
-            file_system: None,
-            macos: None,
-        })
-    );
-}
-
-#[cfg(target_os = "macos")]
-#[tokio::test]
-async fn loads_skill_macos_permissions_from_yaml() {
-    let codex_home = tempfile::tempdir().expect("tempdir");
-    let skill_path = write_skill(&codex_home, "demo", "permissions-macos", "from yaml");
-    let skill_dir = skill_path.parent().expect("skill dir");
-
-    write_skill_metadata_at(
-        skill_dir,
-        r#"
-permissions:
-  macos:
-    macos_preferences: "read_write"
-    macos_automation:
-      - "com.apple.Notes"
-    macos_launch_services: true
-    macos_accessibility: true
-    macos_calendar: true
-"#,
-    );
-
-    let cfg = make_config(&codex_home).await;
-    let outcome = load_skills_for_test(&cfg);
-
-    assert!(
-        outcome.errors.is_empty(),
-        "unexpected errors: {:?}",
-        outcome.errors
-    );
-    assert_eq!(outcome.skills.len(), 1);
-    assert_eq!(
-        outcome.skills[0].permission_profile,
-        Some(PermissionProfile {
-            macos: Some(MacOsSeatbeltProfileExtensions {
-                macos_preferences: MacOsPreferencesPermission::ReadWrite,
-                macos_automation: MacOsAutomationPermission::BundleIds(vec![
-                    "com.apple.Notes".to_string()
-                ],),
-                macos_launch_services: true,
-                macos_accessibility: true,
-                macos_calendar: true,
-                macos_reminders: false,
-                macos_contacts: MacOsContactsPermission::None,
-            }),
-            ..Default::default()
-        })
-    );
-}
-
-#[cfg(not(target_os = "macos"))]
-#[tokio::test]
-async fn loads_skill_macos_permissions_from_yaml_non_macos_does_not_create_profile() {
-    let codex_home = tempfile::tempdir().expect("tempdir");
-    let skill_path = write_skill(&codex_home, "demo", "permissions-macos", "from yaml");
-    let skill_dir = skill_path.parent().expect("skill dir");
-
-    write_skill_metadata_at(
-        skill_dir,
-        r#"
-permissions:
-  macos:
-    macos_preferences: "read_write"
-    macos_automation:
-      - "com.apple.Notes"
-    macos_launch_services: true
-    macos_accessibility: true
-    macos_calendar: true
-"#,
-    );
-
-    let cfg = make_config(&codex_home).await;
-    let outcome = load_skills_for_test(&cfg);
-
-    assert!(
-        outcome.errors.is_empty(),
-        "unexpected errors: {:?}",
-        outcome.errors
-    );
-    assert_eq!(outcome.skills.len(), 1);
-    assert_eq!(
-        outcome.skills[0].permission_profile,
-        Some(PermissionProfile {
-            macos: Some(MacOsSeatbeltProfileExtensions {
-                macos_preferences: MacOsPreferencesPermission::ReadWrite,
-                macos_automation: MacOsAutomationPermission::BundleIds(vec![
-                    "com.apple.Notes".to_string()
-                ],),
-                macos_launch_services: true,
-                macos_accessibility: true,
-                macos_calendar: true,
-                macos_reminders: false,
-                macos_contacts: MacOsContactsPermission::None,
-            }),
-            ..Default::default()
-        })
-    );
-}
-
 #[tokio::test]
 async fn accepts_icon_paths_under_assets_dir() {
     let codex_home = tempfile::tempdir().expect("tempdir");
@@ -988,8 +642,6 @@ async fn accepts_icon_paths_under_assets_dir() {
             }),
             dependencies: None,
             policy: None,
-            permission_profile: None,
-            managed_network_override: None,
             path_to_skills_md: normalized(&skill_path),
             scope: SkillScope::User,
         }]
@@ -1030,8 +682,6 @@ async fn ignores_invalid_brand_color() {
             interface: None,
             dependencies: None,
             policy: None,
-            permission_profile: None,
-            managed_network_override: None,
             path_to_skills_md: normalized(&skill_path),
             scope: SkillScope::User,
         }]
@@ -1085,8 +735,6 @@ async fn ignores_default_prompt_over_max_length() {
             }),
             dependencies: None,
             policy: None,
-            permission_profile: None,
-            managed_network_override: None,
             path_to_skills_md: normalized(&skill_path),
             scope: SkillScope::User,
         }]
@@ -1128,8 +776,6 @@ async fn drops_interface_when_icons_are_invalid() {
             interface: None,
             dependencies: None,
             policy: None,
-            permission_profile: None,
-            managed_network_override: None,
             path_to_skills_md: normalized(&skill_path),
             scope: SkillScope::User,
         }]
@@ -1174,8 +820,6 @@ async fn loads_skills_via_symlinked_subdir_for_user_scope() {
             interface: None,
             dependencies: None,
             policy: None,
-            permission_profile: None,
-            managed_network_override: None,
             path_to_skills_md: normalized(&shared_skill_path),
             scope: SkillScope::User,
         }]
@@ -1235,8 +879,6 @@ async fn does_not_loop_on_symlink_cycle_for_user_scope() {
             interface: None,
             dependencies: None,
             policy: None,
-            permission_profile: None,
-            managed_network_override: None,
             path_to_skills_md: normalized(&skill_path),
             scope: SkillScope::User,
         }]
@@ -1273,8 +915,6 @@ fn loads_skills_via_symlinked_subdir_for_admin_scope() {
             interface: None,
             dependencies: None,
             policy: None,
-            permission_profile: None,
-            managed_network_override: None,
             path_to_skills_md: normalized(&shared_skill_path),
             scope: SkillScope::Admin,
         }]
@@ -1314,8 +954,6 @@ async fn loads_skills_via_symlinked_subdir_for_repo_scope() {
             interface: None,
             dependencies: None,
             policy: None,
-            permission_profile: None,
-            managed_network_override: None,
             path_to_skills_md: normalized(&linked_skill_path),
             scope: SkillScope::Repo,
         }]
@@ -1383,8 +1021,6 @@ async fn respects_max_scan_depth_for_user_scope() {
             interface: None,
             dependencies: None,
             policy: None,
-            permission_profile: None,
-            managed_network_override: None,
             path_to_skills_md: normalized(&within_depth_path),
             scope: SkillScope::User,
         }]
@@ -1412,8 +1048,6 @@ async fn loads_valid_skill() {
             interface: None,
             dependencies: None,
             policy: None,
-            permission_profile: None,
-            managed_network_override: None,
             path_to_skills_md: normalized(&skill_path),
             scope: SkillScope::User,
         }]
@@ -1446,8 +1080,6 @@ async fn falls_back_to_directory_name_when_skill_name_is_missing() {
             interface: None,
             dependencies: None,
             policy: None,
-            permission_profile: None,
-            managed_network_override: None,
             path_to_skills_md: normalized(&skill_path),
             scope: SkillScope::User,
         }]
@@ -1489,8 +1121,6 @@ async fn namespaces_plugin_skills_using_plugin_name() {
             interface: None,
             dependencies: None,
             policy: None,
-            permission_profile: None,
-            managed_network_override: None,
             path_to_skills_md: normalized(&skill_path),
             scope: SkillScope::User,
         }]
@@ -1522,8 +1152,6 @@ async fn loads_short_description_from_metadata() {
             interface: None,
             dependencies: None,
             policy: None,
-            permission_profile: None,
-            managed_network_override: None,
             path_to_skills_md: normalized(&skill_path),
             scope: SkillScope::User,
         }]
@@ -1636,8 +1264,6 @@ async fn loads_skills_from_repo_root() {
             interface: None,
             dependencies: None,
             policy: None,
-            permission_profile: None,
-            managed_network_override: None,
             path_to_skills_md: normalized(&skill_path),
             scope: SkillScope::Repo,
         }]
@@ -1673,8 +1299,6 @@ async fn loads_skills_from_agents_dir_without_codex_dir() {
             interface: None,
             dependencies: None,
             policy: None,
-            permission_profile: None,
-            managed_network_override: None,
             path_to_skills_md: normalized(&skill_path),
             scope: SkillScope::Repo,
         }]
@@ -1728,8 +1352,6 @@ async fn loads_skills_from_all_codex_dirs_under_project_root() {
                 interface: None,
                 dependencies: None,
                 policy: None,
-                permission_profile: None,
-                managed_network_override: None,
                 path_to_skills_md: normalized(&nested_skill_path),
                 scope: SkillScope::Repo,
             },
@@ -1740,8 +1362,6 @@ async fn loads_skills_from_all_codex_dirs_under_project_root() {
                 interface: None,
                 dependencies: None,
                 policy: None,
-                permission_profile: None,
-                managed_network_override: None,
                 path_to_skills_md: normalized(&root_skill_path),
                 scope: SkillScope::Repo,
             },
@@ -1781,8 +1401,6 @@ async fn loads_skills_from_codex_dir_when_not_git_repo() {
             interface: None,
             dependencies: None,
             policy: None,
-            permission_profile: None,
-            managed_network_override: None,
             path_to_skills_md: normalized(&skill_path),
             scope: SkillScope::Repo,
         }]
@@ -1820,8 +1438,6 @@ async fn deduplicates_by_path_preferring_first_root() {
             interface: None,
             dependencies: None,
             policy: None,
-            permission_profile: None,
-            managed_network_override: None,
             path_to_skills_md: normalized(&skill_path),
             scope: SkillScope::Repo,
         }]
@@ -1863,8 +1479,6 @@ async fn keeps_duplicate_names_from_repo_and_user() {
                 interface: None,
                 dependencies: None,
                 policy: None,
-                permission_profile: None,
-                managed_network_override: None,
                 path_to_skills_md: normalized(&repo_skill_path),
                 scope: SkillScope::Repo,
             },
@@ -1875,8 +1489,6 @@ async fn keeps_duplicate_names_from_repo_and_user() {
                 interface: None,
                 dependencies: None,
                 policy: None,
-                permission_profile: None,
-                managed_network_override: None,
                 path_to_skills_md: normalized(&user_skill_path),
                 scope: SkillScope::User,
             },
@@ -1940,8 +1552,6 @@ async fn keeps_duplicate_names_from_nested_codex_dirs() {
                 interface: None,
                 dependencies: None,
                 policy: None,
-                permission_profile: None,
-                managed_network_override: None,
                 path_to_skills_md: first_path,
                 scope: SkillScope::Repo,
             },
@@ -1952,8 +1562,6 @@ async fn keeps_duplicate_names_from_nested_codex_dirs() {
                 interface: None,
                 dependencies: None,
                 policy: None,
-                permission_profile: None,
-                managed_network_override: None,
                 path_to_skills_md: second_path,
                 scope: SkillScope::Repo,
             },
@@ -2025,8 +1633,6 @@ async fn loads_skills_when_cwd_is_file_in_repo() {
             interface: None,
             dependencies: None,
             policy: None,
-            permission_profile: None,
-            managed_network_override: None,
             path_to_skills_md: normalized(&skill_path),
             scope: SkillScope::Repo,
         }]
@@ -2085,8 +1691,6 @@ async fn loads_skills_from_system_cache_when_present() {
             interface: None,
             dependencies: None,
             policy: None,
-            permission_profile: None,
-            managed_network_override: None,
             path_to_skills_md: normalized(&skill_path),
             scope: SkillScope::System,
         }]

codex-rs/core-skills/src/manager_tests.rs

@@ -57,8 +57,6 @@ fn test_skill(name: &str, path: PathBuf) -> SkillMetadata {
         interface: None,
         dependencies: None,
         policy: None,
-        permission_profile: None,
-        managed_network_override: None,
         path_to_skills_md: path,
         scope: SkillScope::User,
     }

codex-rs/core-skills/src/model.rs

@@ -3,22 +3,8 @@ use std::collections::HashSet;
 use std::path::PathBuf;
 use std::sync::Arc;
 
-use codex_protocol::models::PermissionProfile;
 use codex_protocol::protocol::Product;
 use codex_protocol::protocol::SkillScope;
-use serde::Deserialize;
-
-#[derive(Debug, Clone, Default, Deserialize, PartialEq, Eq)]
-pub struct SkillManagedNetworkOverride {
-    pub allowed_domains: Option<Vec<String>>,
-    pub denied_domains: Option<Vec<String>>,
-}
-
-impl SkillManagedNetworkOverride {
-    pub fn has_domain_overrides(&self) -> bool {
-        self.allowed_domains.is_some() || self.denied_domains.is_some()
-    }
-}
 
 #[derive(Debug, Clone, PartialEq)]
 pub struct SkillMetadata {
@@ -28,8 +14,6 @@ pub struct SkillMetadata {
     pub interface: Option<SkillInterface>,
     pub dependencies: Option<SkillDependencies>,
     pub policy: Option<SkillPolicy>,
-    pub permission_profile: Option<PermissionProfile>,
-    pub managed_network_override: Option<SkillManagedNetworkOverride>,
     /// Path to the SKILLS.md file that declares this skill.
     pub path_to_skills_md: PathBuf,
     pub scope: SkillScope,

codex-rs/core/src/mcp/skill_dependencies_tests.rs

@@ -12,8 +12,6 @@ fn skill_with_tools(tools: Vec<SkillToolDependency>) -> SkillMetadata {
         interface: None,
         dependencies: Some(SkillDependencies { tools }),
         policy: None,
-        permission_profile: None,
-        managed_network_override: None,
         path_to_skills_md: PathBuf::from("skill"),
         scope: SkillScope::User,
     }

codex-rs/tui/src/bottom_pane/chat_composer.rs

@@ -5409,8 +5409,6 @@ mod tests {
             }),
             dependencies: None,
             policy: None,
-            permission_profile: None,
-            managed_network_override: None,
             path_to_skills_md: PathBuf::from("/tmp/repo/google-calendar/SKILL.md"),
             scope: codex_protocol::protocol::SkillScope::Repo,
         }]));
@@ -5501,8 +5499,6 @@ mod tests {
                 }),
                 dependencies: None,
                 policy: None,
-                permission_profile: None,
-                managed_network_override: None,
                 path_to_skills_md: PathBuf::from("/tmp/repo/google-calendar/SKILL.md"),
                 scope: codex_protocol::protocol::SkillScope::Repo,
             }]));

codex-rs/tui/src/bottom_pane/mod.rs

@@ -1708,8 +1708,6 @@ mod tests {
                 interface: None,
                 dependencies: None,
                 policy: None,
-                permission_profile: None,
-                managed_network_override: None,
                 path_to_skills_md: PathBuf::from("test-skill"),
                 scope: SkillScope::User,
             }]),

codex-rs/tui/src/chatwidget/skills.rs

@@ -191,8 +191,6 @@ fn protocol_skill_to_core(skill: &ProtocolSkillMetadata) -> SkillMetadata {
                     .collect(),
             }),
         policy: None,
-        permission_profile: None,
-        managed_network_override: None,
         path_to_skills_md: skill.path.clone(),
         scope: skill.scope,
     }

codex-rs/tui/src/chatwidget/tests.rs

@@ -1049,8 +1049,6 @@ async fn submission_prefers_selected_duplicate_skill_path() {
             interface: None,
             dependencies: None,
             policy: None,
-            permission_profile: None,
-            managed_network_override: None,
             path_to_skills_md: repo_skill_path,
             scope: SkillScope::Repo,
         },
@@ -1061,8 +1059,6 @@ async fn submission_prefers_selected_duplicate_skill_path() {
             interface: None,
             dependencies: None,
             policy: None,
-            permission_profile: None,
-            managed_network_override: None,
             path_to_skills_md: user_skill_path.clone(),
             scope: SkillScope::User,
         },

codex-rs/tui_app_server/src/bottom_pane/chat_composer.rs

@@ -5424,8 +5424,6 @@ mod tests {
             }),
             dependencies: None,
             policy: None,
-            permission_profile: None,
-            managed_network_override: None,
             path_to_skills_md: PathBuf::from("/tmp/repo/google-calendar/SKILL.md"),
             scope: codex_protocol::protocol::SkillScope::Repo,
         }]));
@@ -5516,8 +5514,6 @@ mod tests {
                 }),
                 dependencies: None,
                 policy: None,
-                permission_profile: None,
-                managed_network_override: None,
                 path_to_skills_md: PathBuf::from("/tmp/repo/google-calendar/SKILL.md"),
                 scope: codex_protocol::protocol::SkillScope::Repo,
             }]));

codex-rs/tui_app_server/src/bottom_pane/mod.rs

@@ -1701,8 +1701,6 @@ mod tests {
                 interface: None,
                 dependencies: None,
                 policy: None,
-                permission_profile: None,
-                managed_network_override: None,
                 path_to_skills_md: PathBuf::from("test-skill"),
                 scope: SkillScope::User,
             }]),

codex-rs/tui_app_server/src/chatwidget/skills.rs

@@ -191,8 +191,6 @@ fn protocol_skill_to_core(skill: &ProtocolSkillMetadata) -> SkillMetadata {
                     .collect(),
             }),
         policy: None,
-        permission_profile: None,
-        managed_network_override: None,
         path_to_skills_md: skill.path.clone(),
         scope: skill.scope,
     }

codex-rs/tui_app_server/src/chatwidget/tests.rs

@@ -1078,8 +1078,6 @@ async fn submission_prefers_selected_duplicate_skill_path() {
             interface: None,
             dependencies: None,
             policy: None,
-            permission_profile: None,
-            managed_network_override: None,
             path_to_skills_md: repo_skill_path,
             scope: SkillScope::Repo,
         },
@@ -1090,8 +1088,6 @@ async fn submission_prefers_selected_duplicate_skill_path() {
             interface: None,
             dependencies: None,
             policy: None,
-            permission_profile: None,
-            managed_network_override: None,
             path_to_skills_md: user_skill_path.clone(),
             scope: SkillScope::User,
         },