From 8495963ac6d15a3ac891517d979f5509d55605c0 Mon Sep 17 00:00:00 2001
From: jif <jif@openai.com>
Date: Mon, 27 Jul 2026 18:56:38 +0000
Subject: [PATCH] Place host skills before permission instructions (#35661)

## What changed

- Insert the `host_skills` world-state section before the permissions section
  when permissions are present.
- Verify that skill metadata appears before `<permissions instructions>` in the
  rendered developer message.

GitOrigin-RevId: e9fc62f498c384e841fc34ef679850557645f989
---
 codex-rs/core/src/context/world_state/mod.rs | 10 ++++++++--
 codex-rs/core/tests/suite/client.rs          |  5 +++++
 2 files changed, 13 insertions(+), 2 deletions(-)

diff --git a/codex-rs/core/src/context/world_state/mod.rs b/codex-rs/core/src/context/world_state/mod.rs
index 6f2520b2e7..38611f29bb 100644
--- a/codex-rs/core/src/context/world_state/mod.rs
+++ b/codex-rs/core/src/context/world_state/mod.rs
@@ -311,8 +311,14 @@ impl WorldState {
             !self.sections.contains_key(id),
             "duplicate world-state section ID: {id}"
         );
-        self.sections
-            .insert(id, Box::new(ExtensionWorldStateSection(section)));
+        let section = Box::new(ExtensionWorldStateSection(section));
+        if id == "host_skills"
+            && let Some(index) = self.sections.get_index_of(PermissionsState::ID)
+        {
+            self.sections.shift_insert(index, id, section);
+        } else {
+            self.sections.insert(id, section);
+        }
     }
 
     pub(crate) fn snapshot(&self) -> WorldStateSnapshot {
diff --git a/codex-rs/core/tests/suite/client.rs b/codex-rs/core/tests/suite/client.rs
index 0127de4a9f..be0b2986b3 100644
--- a/codex-rs/core/tests/suite/client.rs
+++ b/codex-rs/core/tests/suite/client.rs
@@ -2245,6 +2245,11 @@ async fn skills_append_to_developer_message() {
         developer_text.contains("demo: build charts"),
         "expected skill summary: {developer_messages:?}"
     );
+    assert!(
+        developer_text.find("demo: build charts")
+            < developer_text.find("<permissions instructions>"),
+        "host skills should precede permissions: {developer_messages:?}"
+    );
     let expected_path = normalize_path(skill_dir.join("SKILL.md")).unwrap();
     let expected_path_str = expected_path.to_string_lossy().replace('\\', "/");
     assert!(