Module policy 

Maps a SandboxMode to a concrete SandboxPolicy instance.

Functions

build_mode_catalog

All sandbox modes in a fixed display order (read-only → ask-writes → open → deny-all). current marks the currently selected item, mapping to the ACP SessionModeState.

build_policy

Selects the policy implementation based on [sandbox].mode.