feat(wework): add Codex permission modes

docs/en/user-guide/chat/codex-permissions.md

@@ -0,0 +1,19 @@
+---
+sidebar_position: 8
+---
+
+# Codex permission modes
+
+Wework provides a Codex permission selector below the composer. New chats inherit the default from **Settings > General**, while existing chats keep their own selection.
+
+## Permission modes
+
+- **Full access**: Runs without sandboxing or approval prompts. Use only in trusted workspaces.
+- **Ask for approval**: Codex works automatically inside the workspace and asks you before accessing files outside it, using blocked network access, or invoking side-effecting tools.
+- **Approve for me**: Keeps the same sandbox as Ask for approval, but routes boundary-crossing requests to an independent AI reviewer. Reviewer failures and timeouts deny the action instead of widening access.
+
+When you change the mode during execution, the current turn keeps its original mode and the new mode applies to the next turn.
+
+## Approval scope
+
+Approval cards show only decisions supported by the current Codex request, such as allow once, allow for the session, or decline. A persistent option appears only when Codex provides a command or network rule amendment; Wework does not broaden the proposed rule.

docs/zh/user-guide/chat/codex-permissions.md

@@ -0,0 +1,19 @@
+---
+sidebar_position: 8
+---
+
+# Codex 权限模式
+
+Wework 在输入框下方提供 Codex 权限选择器。新会话继承“设置 > 通用”中的默认值，已有会话保留自己的选择。
+
+## 权限模式
+
+- **完全访问**：不使用沙箱，也不会请求批准。仅适用于可信工作区。
+- **请求批准**：Codex 可在工作区内自动操作；访问工作区外文件、网络或有副作用的工具时由你批准。
+- **代我审批**：保持与“请求批准”相同的沙箱，由独立 AI reviewer 批准或拒绝越界操作。AI 审批失败或超时会拒绝操作，不会自动放宽权限。
+
+权限模式在执行期间切换时，当前轮继续使用原模式，下一轮开始使用新模式。
+
+## 审批范围
+
+审批卡只显示 Codex 当前请求支持的决定，例如允许本次、本会话允许或拒绝。只有 Codex 提供命令或网络规则提案时，才会显示长期允许选项；Wework 不会自行扩大规则范围。