address comments

codex-rs/core/src/codex.rs

@@ -3187,7 +3187,7 @@ impl Session {
             if let Err(err) = persist_granted_permission_profile(
                 self.codex_home().await.as_path(),
                 &config,
-                &permissions,
+                &permissions.clone().into(),
             )
             .await
             {

codex-rs/core/src/codex_delegate.rs

@@ -43,6 +43,7 @@ use crate::guardian::GuardianApprovalRequest;
 use crate::guardian::review_approval_request_with_cancel;
 use crate::guardian::routes_approval_to_guardian;
 use crate::mcp_tool_call::MCP_TOOL_APPROVAL_ACCEPT;
+use crate::mcp_tool_call::MCP_TOOL_APPROVAL_ACCEPT_AND_REMEMBER;
 use crate::mcp_tool_call::MCP_TOOL_APPROVAL_ACCEPT_FOR_SESSION;
 use crate::mcp_tool_call::MCP_TOOL_APPROVAL_DECLINE_SYNTHETIC;
 use crate::mcp_tool_call::build_guardian_mcp_tool_review_request;
@@ -687,6 +688,16 @@ async fn maybe_auto_review_mcp_request_user_input(
     )
     .await;
     let selected_label = match decision {
+        ReviewDecision::ApprovedForAlways => question
+            .options
+            .as_ref()
+            .and_then(|options| {
+                options
+                    .iter()
+                    .find(|option| option.label == MCP_TOOL_APPROVAL_ACCEPT_AND_REMEMBER)
+            })
+            .map(|option| option.label.clone())
+            .unwrap_or_else(|| MCP_TOOL_APPROVAL_ACCEPT.to_string()),
         ReviewDecision::ApprovedForSession => question
             .options
             .as_ref()

codex-rs/core/src/codex_tests.rs

@@ -19,12 +19,7 @@ use codex_protocol::ThreadId;
 use codex_protocol::models::FileSystemPermissions;
 use codex_protocol::models::FunctionCallOutputBody;
 use codex_protocol::models::FunctionCallOutputPayload;
-use codex_protocol::models::MacOsAutomationPermission;
-use codex_protocol::models::MacOsContactsPermission;
-use codex_protocol::models::MacOsPreferencesPermission;
-use codex_protocol::models::MacOsSeatbeltProfileExtensions;
 use codex_protocol::models::NetworkPermissions;
-use codex_protocol::models::PermissionProfile;
 use codex_protocol::permissions::FileSystemAccessMode;
 use codex_protocol::permissions::FileSystemPath;
 use codex_protocol::permissions::FileSystemSandboxEntry;
@@ -2629,7 +2624,7 @@ async fn notify_request_permissions_response_persists_always_allow_permissions()
         .insert_pending_request_permissions("call-1".to_string(), tx);
     *session.active_turn.lock().await = Some(active_turn);
 
-    let permissions = PermissionProfile {
+    let permissions = RequestPermissionProfile {
         network: Some(NetworkPermissions {
             enabled: Some(true),
         }),
@@ -2640,17 +2635,6 @@ async fn notify_request_permissions_response_persists_always_allow_permissions()
                     .expect("absolute path"),
             ]),
         }),
-        macos: Some(MacOsSeatbeltProfileExtensions {
-            macos_preferences: MacOsPreferencesPermission::ReadWrite,
-            macos_automation: MacOsAutomationPermission::BundleIds(vec![
-                "com.apple.Calendar".to_string(),
-            ]),
-            macos_launch_services: false,
-            macos_accessibility: true,
-            macos_calendar: false,
-            macos_reminders: false,
-            macos_contacts: MacOsContactsPermission::None,
-        }),
     };
 
     session
@@ -2666,7 +2650,7 @@ async fn notify_request_permissions_response_persists_always_allow_permissions()
     assert_eq!(session.granted_turn_permissions().await, None);
     assert_eq!(
         session.granted_session_permissions().await,
-        Some(permissions)
+        Some(permissions.clone().into())
     );
     assert_eq!(
         rx.await.expect("response should be delivered").scope,

codex-rs/core/src/config/config_tests.rs

@@ -6122,11 +6122,11 @@ calendar = true
             automations: Some(MacOsAutomationPermission::BundleIds(vec![
                 "com.apple.Calendar".to_string(),
             ])),
-            launch_services: Some(false),
+            launch_services: None,
             accessibility: Some(true),
             calendar: Some(true),
-            reminders: Some(false),
-            contacts: Some(MacOsContactsPermission::None),
+            reminders: None,
+            contacts: None,
         })
     );
 }

codex-rs/core/src/config/permissions.rs

@@ -633,8 +633,11 @@ fn network_toml_has_values(network: &NetworkToml) -> bool {
 fn macos_permissions_toml_has_values(permissions: &MacOsPermissionsToml) -> bool {
     permissions.preferences.is_some()
         || permissions.automations.is_some()
+        || permissions.launch_services.is_some()
         || permissions.accessibility.is_some()
         || permissions.calendar.is_some()
+        || permissions.reminders.is_some()
+        || permissions.contacts.is_some()
 }
 
 fn compile_network_sandbox_policy(network: Option<&NetworkToml>) -> NetworkSandboxPolicy {

codex-rs/core/src/mcp_tool_call.rs

@@ -428,7 +428,7 @@ pub(crate) const MCP_TOOL_APPROVAL_ACCEPT_FOR_SESSION: &str = "Allow for this se
 // real "Decline" answer, so this lets guardian denials round-trip distinctly from user cancel.
 // This is not a user-facing option.
 pub(crate) const MCP_TOOL_APPROVAL_DECLINE_SYNTHETIC: &str = "__codex_mcp_decline__";
-const MCP_TOOL_APPROVAL_ACCEPT_AND_REMEMBER: &str = "Allow and don't ask me again";
+pub(crate) const MCP_TOOL_APPROVAL_ACCEPT_AND_REMEMBER: &str = "Allow and don't ask me again";
 const MCP_TOOL_APPROVAL_CANCEL: &str = "Cancel";
 const MCP_TOOL_APPROVAL_KIND_KEY: &str = "codex_approval_kind";
 const MCP_TOOL_APPROVAL_KIND_MCP_TOOL_CALL: &str = "mcp_tool_call";