Decouple request permissions feature and tool (#14426)

codex-rs/core/src/codex_tests.rs

@@ -2306,7 +2306,7 @@ async fn request_permissions_emits_event_when_reject_policy_allows_requests() {
 }
 
 #[tokio::test]
-async fn request_permissions_returns_empty_grant_when_reject_policy_blocks_requests() {
+async fn request_permissions_is_auto_denied_when_reject_policy_blocks_tool_requests() {
     let (session, mut turn_context, rx) = make_session_and_context_with_rx().await;
     *session.active_turn.lock().await = Some(ActiveTurn::default());
     Arc::get_mut(&mut turn_context)
@@ -2323,10 +2323,13 @@ async fn request_permissions_returns_empty_grant_when_reject_policy_blocks_reque
         ))
         .expect("test setup should allow updating approval policy");
 
+    let session = Arc::new(session);
+    let turn_context = Arc::new(turn_context);
+    let call_id = "call-1".to_string();
     let response = session
         .request_permissions(
-            &turn_context,
-            "call-1".to_string(),
+            turn_context.as_ref(),
+            call_id,
             codex_protocol::request_permissions::RequestPermissionsArgs {
                 reason: Some("need network".to_string()),
                 permissions: codex_protocol::models::PermissionProfile {
@@ -2349,10 +2352,10 @@ async fn request_permissions_returns_empty_grant_when_reject_policy_blocks_reque
         )
     );
     assert!(
-        tokio::time::timeout(StdDuration::from_millis(50), rx.recv())
+        tokio::time::timeout(StdDuration::from_millis(100), rx.recv())
             .await
             .is_err(),
-        "unexpected request_permissions event emitted",
+        "request_permissions should not emit an event when reject.request_permissions is set"
     );
 }