clippy, fix visibility

codex-rs/tui/src/app.rs

@@ -2354,9 +2354,6 @@ impl App {
                     ));
                 }
             }
-            AppEvent::OpenApprovalsPopup => {
-                self.chat_widget.open_approvals_popup();
-            }
             AppEvent::OpenAgentPicker => {
                 self.open_agent_picker().await;
             }

codex-rs/tui/src/app_event.rs

@@ -277,9 +277,6 @@ pub(crate) enum AppEvent {
     #[cfg_attr(not(target_os = "windows"), allow(dead_code))]
     SkipNextWorldWritableScan,
 
-    /// Re-open the approval presets popup.
-    OpenApprovalsPopup,
-
     /// Open the skills list popup.
     OpenSkillsList,
 

codex-rs/tui/src/chatwidget.rs

@@ -5331,11 +5331,6 @@ impl ChatWidget {
         );
     }
 
-    /// Open the permissions popup (alias for /permissions).
-    pub(crate) fn open_approvals_popup(&mut self) {
-        self.open_permissions_popup();
-    }
-
     /// Open a popup to choose the permissions mode (approval policy + sandbox policy).
     pub(crate) fn open_permissions_popup(&mut self) {
         let items: Vec<SelectionItem> = visible_permissions_options(&self.config);
@@ -5664,7 +5659,7 @@ impl ChatWidget {
                     name: "Go back".to_string(),
                     description: None,
                     actions: vec![Box::new(|tx| {
-                        tx.send(AppEvent::OpenApprovalsPopup);
+                        tx.send(AppEvent::OpenPermissionsPopup);
                     })],
                     dismiss_on_select: true,
                     ..Default::default()

codex-rs/tui/src/chatwidget/snapshots/codex_tui__chatwidget__tests__approvals_selection_popup.snap

@@ -6,7 +6,7 @@ expression: popup
 
 › 1. Default      Codex can read and edit files in the current workspace, and
                   run commands. Approval is required to access the internet or
-                  edit other files. (Identical to Agent mode)
+                  edit other files.
   2. Full Access  Codex can edit files outside this workspace and access the
                   internet without asking for approval. Exercise caution when
                   using.

codex-rs/tui/src/chatwidget/tests.rs

@@ -3076,7 +3076,7 @@ async fn ctrl_d_quits_without_prompt() {
 async fn ctrl_d_with_modal_open_does_not_quit() {
     let (mut chat, mut rx, _op_rx) = make_chatwidget_manual(None).await;
 
-    chat.open_approvals_popup();
+    chat.open_permissions_popup();
     chat.handle_key_event(KeyEvent::new(KeyCode::Char('d'), KeyModifiers::CONTROL));
 
     assert_matches!(rx.try_recv(), Err(TryRecvError::Empty));
@@ -5024,7 +5024,7 @@ async fn approvals_selection_popup_snapshot() {
     let (mut chat, _rx, _op_rx) = make_chatwidget_manual(None).await;
 
     chat.config.notices.hide_full_access_warning = None;
-    chat.open_approvals_popup();
+    chat.open_permissions_popup();
 
     let popup = render_bottom_popup(&chat, 80);
     #[cfg(target_os = "windows")]
@@ -5045,7 +5045,7 @@ async fn approvals_selection_popup_snapshot_windows_degraded_sandbox() {
     chat.set_feature_enabled(Feature::WindowsSandbox, true);
     chat.set_feature_enabled(Feature::WindowsSandboxElevated, false);
 
-    chat.open_approvals_popup();
+    chat.open_permissions_popup();
 
     let popup = render_bottom_popup(&chat, 80);
     assert!(
@@ -5399,7 +5399,7 @@ async fn approvals_popup_shows_disabled_presets() {
             )),
         })
         .expect("construct constrained approval policy");
-    chat.open_approvals_popup();
+    chat.open_permissions_popup();
 
     let width = 80;
     let height = chat.desired_height(width);
@@ -5432,7 +5432,7 @@ async fn approvals_popup_navigation_skips_disabled() {
             _ => Err(invalid_value(candidate.to_string(), "[on-request]")),
         })
         .expect("construct constrained approval policy");
-    chat.open_approvals_popup();
+    chat.open_permissions_popup();
 
     // The approvals popup is the active bottom-pane view; drive navigation via chat handle_key_event.
     // Start selected at idx 0 (enabled), move down twice; the disabled option should be skipped
@@ -5653,7 +5653,7 @@ async fn permissions_full_access_history_cell_emitted_only_after_confirmation()
         );
     }
     let preset = open_confirmation_event.expect("expected full access confirmation event");
-    chat.open_full_access_confirmation(preset.clone());
+    chat.open_full_access_confirmation(preset);
 
     let popup = render_bottom_popup(&chat, 80);
     assert!(

codex-rs/tui/src/permissions/mod.rs

@@ -9,6 +9,7 @@ use codex_core::config::Config;
 use codex_core::protocol::AskForApproval;
 use codex_core::protocol::Op;
 use codex_core::protocol::SandboxPolicy;
+#[cfg(target_os = "windows")]
 use codex_core::protocol_config_types::WindowsSandboxLevel;
 
 /// A simple preset pairing an approval policy with a sandbox policy.
@@ -39,7 +40,7 @@ pub fn builtin_permissions_presets() -> Vec<PermissionsPreset> {
         PermissionsPreset {
             id: "auto",
             label: "Default",
-            description: "Codex can read and edit files in the current workspace, and run commands. Approval is required to access the internet or edit other files. (Identical to Agent mode)",
+            description: "Codex can read and edit files in the current workspace, and run commands. Approval is required to access the internet or edit other files.",
             approval: AskForApproval::OnRequest,
             sandbox: SandboxPolicy::new_workspace_write_policy(),
         },
@@ -56,23 +57,15 @@ pub fn builtin_permissions_presets() -> Vec<PermissionsPreset> {
 pub(crate) fn visible_permissions_options(config: &Config) -> Vec<SelectionItem> {
     builtin_permissions_presets()
         .into_iter()
-        .filter(|preset| preset.is_visible(config))
+        .filter(PermissionsPreset::is_visible)
         .map(|preset| preset.to_selection_item(config))
         .collect()
 }
 
 impl PermissionsPreset {
-    pub(crate) fn is_visible(&self, config: &Config) -> bool {
-        match self.id {
-            "read-only" => cfg!(target_os = "windows"),
-            "auto" => {
-                !cfg!(target_os = "windows")
-                    || codex_core::windows_sandbox::windows_sandbox_level_from_config(config)
-                        == WindowsSandboxLevel::Disabled
-            }
-            "full-access" => true,
-            _ => false,
-        }
+    fn is_visible(&self) -> bool {
+        matches!(self.id, "auto" | "full-access")
+            || (cfg!(target_os = "windows") && matches!(self.id, "read-only"))
     }
 
     pub(crate) fn to_selection_item(&self, config: &Config) -> SelectionItem {
@@ -141,7 +134,11 @@ impl PermissionsPreset {
 
         let approval = self.approval;
         let sandbox = self.sandbox.clone();
-        let label = self.label.to_string();
+        let label = if self.id == "auto" && windows_degraded_sandbox_enabled(config) {
+            "Default (non-admin sandbox)".to_string()
+        } else {
+            self.label.to_string()
+        };
         vec![Box::new(move |tx: &AppEventSender| {
             let sandbox_clone = sandbox.clone();
             tx.send(AppEvent::CodexOp(Op::OverrideTurnContext {
@@ -215,7 +212,7 @@ fn windows_permissions_actions(
 pub(crate) fn windows_degraded_sandbox_enabled(config: &Config) -> bool {
     let windows_sandbox_level =
         codex_core::windows_sandbox::windows_sandbox_level_from_config(config);
-    matches!(windows_sandbox_level, WindowsSandboxLevel::RestrictedToken);
+    matches!(windows_sandbox_level, WindowsSandboxLevel::RestrictedToken)
 }
 
 #[cfg(target_os = "windows")]