Function build_mode_catalog 

pub fn build_mode_catalog(current: SandboxMode) -> ModeCatalog

All sandbox modes in a fixed display order (read-only → ask-writes → open → deny-all). current marks the currently selected item, mapping to the ACP SessionModeState.

Exposes all 4 modes to the client (session/set_mode can switch between them). Mode IDs use SandboxMode::as_str — the same strings as the [sandbox].mode value in the config file, providing a single source of truth.