110
return { [CodexSessionConfigKey.PermissionsPreset]: equivalentPreset };
111
}
112
>
// `read-only` is more locked-down than any preset's sandbox and cannot be
codexSessionConfigKeys.ts
113
>
// represented by one, so preserve the raw axes — surfacing a preset here
114
>
// would silently escalate the session to `workspace-write` on restore.
115
>
if (resolved.sandboxMode === 'read-only') {
116
>
return {
117
>
[CodexSessionConfigKey.ApprovalPolicy]: resolved.approvalPolicy,
118
>
[CodexSessionConfigKey.SandboxMode]: resolved.sandboxMode,
119
>
};
120
>
}
121
// Otherwise snap onto the preset whose sandbox matches so the displayed chip
122
// and the resolved axes stay consistent (`danger-full-access` → Full Access,