feat: freeze legacy code queue entry

scripts/src/agentrun.ts

@@ -1,3 +1,4 @@
+import { readFileSync } from "node:fs";
 import type { UniDeskConfig } from "./config";
 import { runSshCommandCapture, type SshCaptureResult } from "./ssh";
 import { startJob } from "./jobs";
@@ -22,9 +23,17 @@ const mirrorToolsImage = "127.0.0.1:5000/hwlab/hwlab-ci-node-tools:node22-alpine
 
 export function agentRunHelp(): unknown {
   return {
-    command: "agentrun v01 control-plane status|trigger-current|refresh|cleanup-runs|cleanup-released-pvs | git-mirror status|sync|flush",
+    command: "agentrun v01 control-plane status|trigger-current|refresh|cleanup-runs|cleanup-released-pvs | git-mirror status|sync|flush | queue submit|list|show|stats|commander|read|cancel|dispatch|refresh | sessions ps|show|turn|steer|cancel|output|trace|read",
     output: "json",
     usage: [
+      "bun scripts/cli.ts agentrun v01 queue commander --reader-id cli",
+      "bun scripts/cli.ts agentrun v01 queue submit --json-file <task.json>",
+      "bun scripts/cli.ts agentrun v01 queue dispatch <taskId> --json-file <dispatch.json>",
+      "bun scripts/cli.ts agentrun v01 queue cancel <taskId> --reason <text>",
+      "bun scripts/cli.ts agentrun v01 sessions trace <sessionId> --after-seq 0 --limit 100",
+      "bun scripts/cli.ts agentrun v01 sessions output <sessionId> --after-seq 0 --limit 100",
+      "bun scripts/cli.ts agentrun v01 sessions steer <sessionId> --prompt-file <path>",
+      "bun scripts/cli.ts agentrun v01 sessions read <sessionId> --reader-id cli",
       "bun scripts/cli.ts agentrun v01 control-plane status",
       "bun scripts/cli.ts agentrun v01 control-plane status --full",
       "bun scripts/cli.ts agentrun v01 control-plane trigger-current --dry-run",
@@ -40,7 +49,7 @@ export function agentRunHelp(): unknown {
       "bun scripts/cli.ts agentrun v01 git-mirror sync --confirm",
       "bun scripts/cli.ts agentrun v01 git-mirror flush --confirm",
     ],
-    description: "Operate AgentRun v0.1 Tekton/Argo control plane and devops-infra git mirror through G14 routes; status is read-only, trigger-current pre-syncs mirror refs before creating the PipelineRun, and cleanup-runs/cleanup-released-pvs provide controlled completed CI workspace retention.",
+    description: "Operate AgentRun v0.1 Queue and Sessions through the official G14 /root/agentrun-v01 CLI, plus bounded Tekton/Argo control-plane and devops-infra git mirror actions through UniDesk routes. Queue/session commands are direct AgentRun CLI calls, not a UniDesk Code Queue adapter or double-write path.",
   };
 }
 
@@ -62,6 +71,9 @@ export async function runAgentRunCommand(config: UniDeskConfig, args: string[]):
       return await runGitMirrorJob(config, action, options);
     }
   }
+  if (group === "queue" || group === "sessions") {
+    return await runOfficialAgentRunCli(config, group, args.slice(2));
+  }
   return unsupported(args);
 }
 
@@ -1420,6 +1432,144 @@ function startAsyncAgentRunJob(name: string, command: string[], note: string): R
   };
 }
 
+interface AgentRunCliMaterializedFile {
+  flag: string;
+  source: string;
+  remotePath: string;
+  bytes: number;
+  base64: string;
+}
+
+interface PreparedAgentRunCliArgs {
+  args: string[];
+  materializedFiles: AgentRunCliMaterializedFile[];
+}
+
+async function runOfficialAgentRunCli(config: UniDeskConfig, group: "queue" | "sessions", args: string[]): Promise<Record<string, unknown>> {
+  const prepared = prepareOfficialAgentRunCliArgs([group, ...args]);
+  const command = `agentrun v01 ${prepared.args.join(" ")}`.trim();
+  const bridge = agentRunQueueBridgeMetadata(prepared.materializedFiles);
+  const script = officialAgentRunCliScript(prepared);
+  const result = await capture(config, g14SourceRoute, ["script", "--", script]);
+  const payload = captureJsonPayload(result);
+  if (result.exitCode === 0 && Object.keys(payload).length > 0) {
+    return {
+      ...payload,
+      command,
+      bridge,
+    };
+  }
+  if (result.exitCode === 0) {
+    return {
+      ok: true,
+      command,
+      bridge,
+      stdout: result.stdout.trim(),
+      remote: compactCapture(result, { full: true, stdoutTailChars: 4000, stderrTailChars: 2000 }),
+    };
+  }
+  return {
+    ok: false,
+    command,
+    degradedReason: "agentrun-cli-bridge-failed",
+    bridge,
+    agentrun: payload,
+    remote: compactCapture(result, { full: true, stdoutTailChars: 8000, stderrTailChars: 4000 }),
+  };
+}
+
+function prepareOfficialAgentRunCliArgs(args: string[]): PreparedAgentRunCliArgs {
+  const fileFlags = new Set(["--json-file", "--prompt-file", "--runner-json-file"]);
+  const remoteTmpDir = `/tmp/unidesk-agentrun-cli-${Date.now()}-${process.pid}-${Math.random().toString(36).slice(2)}`;
+  const materializedFiles: AgentRunCliMaterializedFile[] = [];
+  const prepared: string[] = [];
+  let stdinBuffer: Buffer | null = null;
+
+  const stdin = (): Buffer => {
+    if (stdinBuffer === null) stdinBuffer = readFileSync(0);
+    return stdinBuffer;
+  };
+
+  const materialize = (flag: string, source: string, buffer: Buffer): string => {
+    const remotePath = `${remoteTmpDir}/input-${materializedFiles.length}`;
+    materializedFiles.push({
+      flag,
+      source,
+      remotePath,
+      bytes: buffer.length,
+      base64: buffer.toString("base64"),
+    });
+    return remotePath;
+  };
+
+  for (let i = 0; i < args.length; i += 1) {
+    const arg = args[i] ?? "";
+    const equalsFlag = Array.from(fileFlags).find((flag) => arg.startsWith(`${flag}=`));
+    if (equalsFlag !== undefined) {
+      const source = arg.slice(equalsFlag.length + 1);
+      if (source.length === 0) throw new Error(`${equalsFlag} requires a path`);
+      const buffer = source === "-" ? stdin() : readFileSync(source);
+      prepared.push(equalsFlag, materialize(equalsFlag, source === "-" ? "stdin" : source, buffer));
+      continue;
+    }
+    if (fileFlags.has(arg)) {
+      const source = args[i + 1];
+      if (source === undefined || source.length === 0) throw new Error(`${arg} requires a path`);
+      const buffer = source === "-" ? stdin() : readFileSync(source);
+      prepared.push(arg, materialize(arg, source === "-" ? "stdin" : source, buffer));
+      i += 1;
+      continue;
+    }
+    if (arg === "--prompt-stdin" || arg === "--stdin") {
+      prepared.push("--prompt-file", materialize("--prompt-stdin", "stdin", stdin()));
+      continue;
+    }
+    prepared.push(arg);
+  }
+
+  return { args: prepared, materializedFiles };
+}
+
+function officialAgentRunCliScript(prepared: PreparedAgentRunCliArgs): string {
+  const setup = prepared.materializedFiles.length === 0
+    ? []
+    : [
+        `tmp_dir=${shQuote(parentDir(prepared.materializedFiles[0]?.remotePath ?? "/tmp/unidesk-agentrun-cli"))}`,
+        "mkdir -p \"$tmp_dir\"",
+        "trap 'rm -rf \"$tmp_dir\"' EXIT",
+        ...prepared.materializedFiles.map((file) => `printf %s ${shQuote(file.base64)} | base64 -d > ${shQuote(file.remotePath)}`),
+      ];
+  return [
+    "set -euo pipefail",
+    ...setup,
+    "cd /root/agentrun-v01",
+    `./scripts/agentrun --manager-url auto ${prepared.args.map(shQuote).join(" ")}`,
+  ].join("\n");
+}
+
+function parentDir(pathValue: string): string {
+  const index = pathValue.lastIndexOf("/");
+  return index > 0 ? pathValue.slice(0, index) : ".";
+}
+
+function agentRunQueueBridgeMetadata(materializedFiles: AgentRunCliMaterializedFile[]): Record<string, unknown> {
+  return {
+    route: g14SourceRoute,
+    sourceWorktree: "/root/agentrun-v01",
+    sourceBranch,
+    managerUrl: "auto",
+    officialCli: "./scripts/agentrun",
+    mode: "direct-official-cli",
+    compatibility: "no-code-queue-adapter-no-double-write",
+    fileFlagsMaterialized: materializedFiles.map((file) => ({
+      flag: file.flag,
+      source: file.source,
+      remotePath: file.remotePath,
+      bytes: file.bytes,
+    })),
+  };
+}
+
 async function capture(config: UniDeskConfig, target: string, args: string[]): Promise<SshCaptureResult> {
   return await runSshCommandCapture(config, target, args);
 }
@@ -1568,6 +1718,6 @@ function unsupported(args: string[]): Record<string, unknown> {
     ok: false,
     command: `agentrun ${args.join(" ")}`.trim(),
     degradedReason: "unsupported-command",
-    message: "supported commands: agentrun v01 control-plane status|trigger-current|refresh; agentrun v01 git-mirror status|sync|flush",
+    message: "supported commands: agentrun v01 queue submit|list|show|stats|commander|read|cancel|dispatch|refresh; agentrun v01 sessions ps|show|turn|steer|cancel|output|trace|read; agentrun v01 control-plane status|trigger-current|refresh; agentrun v01 git-mirror status|sync|flush",
   };
 }

scripts/src/code-queue.ts

@@ -64,6 +64,16 @@ const defaultSteerRetryDelayMs = 750;
 const maxSteerRetryDelayMs = 5_000;
 const codexTaskStatuses = ["queued", "running", "judging", "retry_wait", "succeeded", "failed", "canceled"] as const;
 const codexTerminalTaskStatuses = ["succeeded", "failed", "canceled"] as const;
+const agentRunQueueReplacementCommands = {
+  queueCommander: "bun scripts/cli.ts agentrun v01 queue commander --reader-id cli",
+  queueSubmit: "bun scripts/cli.ts agentrun v01 queue submit --json-file <task.json>",
+  queueDispatch: "bun scripts/cli.ts agentrun v01 queue dispatch <taskId> --json-file <dispatch.json>",
+  sessionsTrace: "bun scripts/cli.ts agentrun v01 sessions trace <sessionId> --after-seq 0 --limit 100",
+  sessionsOutput: "bun scripts/cli.ts agentrun v01 sessions output <sessionId> --after-seq 0 --limit 100",
+  sessionsSteer: "bun scripts/cli.ts agentrun v01 sessions steer <sessionId> --prompt-file <path>",
+  sessionsRead: "bun scripts/cli.ts agentrun v01 sessions read <sessionId> --reader-id cli",
+  queueCancel: "bun scripts/cli.ts agentrun v01 queue cancel <taskId> --reason <text>",
+};
 const codexTaskStatusAliases: Record<string, string> = {
   completed: "succeeded",
   complete: "succeeded",
@@ -87,6 +97,31 @@ const codexTaskStatusAliases: Record<string, string> = {
   "retry-wait": "retry_wait",
 };
 
+function legacyCodeQueueFrozenMutation(command: string): Record<string, unknown> {
+  return {
+    ok: false,
+    frozen: true,
+    mutation: false,
+    degradedReason: "legacy-code-queue-frozen",
+    error: "旧 UniDesk Code Queue 新任务和执行写入口已冻结；新任务使用 AgentRun Queue。",
+    command,
+    replacement: agentRunQueueReplacementCommands,
+    legacy: {
+      retainedFor: "historical archive/read-only troubleshooting; no new old-runtime work",
+      allowed: [
+        "bun scripts/cli.ts codex tasks",
+        "bun scripts/cli.ts codex task <taskId>",
+        "bun scripts/cli.ts codex output <taskId>",
+        "bun scripts/cli.ts codex unread",
+        "bun scripts/cli.ts codex read <taskId>",
+        "bun scripts/cli.ts codex queues",
+        "bun scripts/cli.ts codex interrupt <taskId>",
+      ],
+      noDoubleWrite: true,
+    },
+  };
+}
+
 interface CodexTaskOptions {
   detail: boolean;
   trace: boolean;
@@ -8366,7 +8401,7 @@ export async function runCodeQueueCommand(config: UniDeskConfig, args: string[])
     return codexPromptLintTask(args.slice(1));
   }
   if (action === "submit" || action === "enqueue") {
-    return codexSubmitTask(args.slice(1));
+    return legacyCodeQueueFrozenMutation(`codex ${action}`);
   }
   if (action === "task" || action === "summary" || action === "show") {
     const taskId = requireTaskId(taskIdArg, `codex ${action}`);
@@ -8401,27 +8436,23 @@ export async function runCodeQueueCommand(config: UniDeskConfig, args: string[])
   if (action === "queue") {
     const sub = taskIdArg ?? "list";
     if (sub === "list") return codeQueues(args.slice(2));
-    if (sub === "create") return codexCreateQueue(requireQueueId(args.slice(2), "queue create"));
+    if (sub === "create") return legacyCodeQueueFrozenMutation("codex queue create");
     if (sub === "merge") {
-      const mergeArgs = args.slice(2);
-      return codexMergeQueue(requireMergeSourceQueueId(mergeArgs, "queue merge"), requireMergeTargetQueueId(mergeArgs, "queue merge"));
+      return legacyCodeQueueFrozenMutation("codex queue merge");
     }
   }
   if (action === "move") {
-    const taskId = requireTaskId(taskIdArg, "codex move");
-    return codexMoveTask(taskId, requireQueueId(args.slice(2), "codex move"));
+    return legacyCodeQueueFrozenMutation("codex move");
   }
   if (action === "interrupt" || action === "cancel") {
     const taskId = requireTaskId(taskIdArg, `codex ${action}`);
     return codexInterruptTask(taskId);
   }
   if (action === "steer") {
-    const taskId = requireTaskId(taskIdArg, "codex steer");
-    return codexSteerTask(taskId, args.slice(2));
+    return legacyCodeQueueFrozenMutation("codex steer");
   }
   if (action === "resume") {
-    const taskId = requireTaskId(taskIdArg, "codex resume");
-    return codexResumeTask(taskId, args.slice(2));
+    return legacyCodeQueueFrozenMutation("codex resume");
   }
   if (action === "steer-confirm" || action === "steer-confirmation") {
     const taskId = requireTaskId(taskIdArg, `codex ${action}`);

scripts/src/help.ts

@@ -61,14 +61,14 @@ export function rootHelp(): unknown {
       { command: "commander contract|plan --dry-run|smoke --dry-run|approval request --dry-run|prompt-lint --kind gpt55-pr", description: "Host Codex commander skeleton contract, no-daemon smoke plan, dry-run approval preview, and advisory GPT-5.5 PR prompt boundary lint without live bridges, message sends, or submit gating." },
       { command: "hwlab nodes control-plane|git-mirror|secret --node G14 --lane v03", description: "Manage HWLAB node/lane runtime prerequisites for v0.3+ with the node identity passed as data instead of a command family." },
       { command: "hwlab g14 monitor-prs | hwlab g14 control-plane status|apply|trigger-current|runtime-migration|cleanup-runs|cleanup-released-pvs | hwlab g14 git-mirror status|apply|sync|flush | hwlab g14 tools-image status|build", description: "Start the legacy G14 PR monitor, run bounded v0.2 Tekton/Argo control-plane, manual PipelineRun trigger, runtime migration, CI workspace retention, manual devops-infra git mirror/relay maintenance, or fixed HWLAB CI tools image actions; long confirmed trigger/sync/flush actions return async jobs by default." },
-      { command: "agentrun v01 control-plane status|trigger-current|refresh|cleanup-runs|cleanup-released-pvs", description: "Run bounded AgentRun v0.1 Tekton/Argo status, manual PipelineRun trigger, Argo refresh, and completed CI workspace retention through UniDesk G14 routes." },
+      { command: "agentrun v01 queue|sessions|control-plane|git-mirror", description: "Use AgentRun v0.1 Queue and Sessions as the active commander entry through the official G14 CLI bridge, plus bounded Tekton/Argo and git-mirror operations." },
       { command: "hwlab cd audit --env dev | hwlab cd status --env dev | hwlab cd apply --env dev --dry-run", description: "Legacy D601 HWLAB DEV CD wrapper kept for explicit old-path diagnostics; current HWLAB rollout uses G14 GitOps." },
       { command: "code-agent-sandbox", description: "Independent Code Agent Sandbox service skeleton for adapter, mode, and credential-boundary diagnostics." },
       { command: "schedule list|get|runs|run|retry-run|delete", description: "Manage backend-core scheduled tasks and run history; schedule run <id> supports --wait-ms N and retry-run reuses the failed run's schedule." },
       { command: "schedule upsert-pgdata-backup [--time HH:MM] [--remote-base /SERVER_DATA/UNIDESK_PG_DATA]", description: "Create or update the daily PGDATA physical backup task that uploads monthly rotated archives to Baidu Netdisk." },
       { command: "codex deploy <commitId> [--provider-id D601] [--timeout-ms N]", description: "Disabled legacy Code Queue deploy path; use the dev-only artifact consumer instead." },
       { command: "codex prompt-lint [prompt|--prompt-file path|--prompt-stdin]", description: "Dry-run lint a runner prompt for DEV test class read-only/live-read/live-mutating authorization without echoing prompt text or touching live services." },
-      { command: "codex submit [prompt] [--prompt-file path|--prompt-stdin] [--queue queueId] [--provider-id id] [--cwd path] [--model model] [--execution-mode mode] [--max-attempts N] [--reference-task-id id] [--dry-run]", description: "Submit a Code Queue task through backend-core -> code-queue proxy; --dry-run shows the structured request, routing recommendation, and prompt live-authorization lint while real success only confirms the write and task id." },
+      { command: "codex submit|steer|resume|queue create|queue merge|move", description: "Frozen legacy Code Queue write commands; use agentrun v01 queue and agentrun v01 sessions for new commander work. Historical codex task/tasks/output/read/unread/queues remain available for archive troubleshooting." },
       { command: "codex skills-sync --dry-run [--full]", description: "Inspect the controlled runner skills hostPath lifecycle contract without copying files, restarting services, reading secrets, or mutating live runner paths." },
       { command: "codex execution-plane [--full|--raw]", description: "Read-only D601 native k3s Code Queue execution-plane inspection; compares formal deployments, deprecated Compose residuals, commit markers, pod digest, and mounted worktree HEAD." },
       { command: "codex pr-preflight [--remote] [--push-dry-run --push-dry-run-ref refs/heads/probe/<name>] [--pr-create-dry-run --pr-create-dry-run-head <head>] [--issue N] [--full|--raw]", description: "Read-only PR admission check with compact commander output by default; use --full or --raw to expand the full runtime preflight, tool, and observation payload." },
@@ -79,11 +79,10 @@ export function rootHelp(): unknown {
       { command: "codex read <taskId>", description: "Mark one reviewed terminal task read and return terminal metadata plus final response; prompt/tool logs stay behind drill-down commands." },
       { command: "codex dev-ready", description: "Fetch execution-container readiness, including sanitized skill injection status from /api/dev-ready." },
       { command: "codex judge <taskId> --attempt N [--dry-run] [--include-prompt]", description: "Replay one stored Code Queue attempt through the same judge context builder and MiniMax judge call path used by the live queue worker." },
-      { command: "codex steer <taskId> [prompt|--prompt-file path|--prompt-stdin] [--steer-id id] [--dry-run] [--no-retry|--retry-attempts N] [--full|--raw]", description: "Push a corrective prompt into a running Code Queue task with a steerId/idempotency key; retryable tunnel aborts get bounded trace confirmation before any retry guidance." },
-      { command: "codex resume <taskId> [prompt|--prompt-file path|--prompt-stdin] [--resume-id id] [--dry-run] [--full|--raw]", description: "Queue a follow-up turn on a terminal Code Queue task, preserving the original task/thread/PR context and suppressing duplicate resumeId delivery without echoing the prompt." },
+      { command: "codex steer <taskId> / codex resume <taskId>", description: "Frozen legacy execution mutation entries; use agentrun v01 sessions steer/read/cancel/output/trace against AgentRun sessions instead." },
       { command: "codex steer-confirm <taskId> --steer-id <id> [--raw]", description: "Read-only lookup for a steerId in task trace so deliveryUnconfirmed can be resolved without resending the corrective prompt." },
       { command: "codex interrupt|cancel <taskId>", description: "Request interrupt for a running Code Queue task, or cancel a queued/retry_wait task, through the same private proxy." },
-      { command: "codex (queues [--full|--all] | queue create <queueId> | queue merge <sourceQueueId> --into <targetQueueId> | move <taskId> --queue <queueId>)", description: "List low-noise queue summaries by default, including effective activity counts that distinguish scheduler-local queues, DB running tasks, and heartbeat-fresh runners; full queue rows require --full/--all." },
+      { command: "codex queues [--full|--all] [--limit N] [--page N|--offset N]", description: "Read legacy Code Queue archive summaries. Legacy queue create/merge and move are frozen; use agentrun v01 queue for new work." },
       { command: "job list [--limit N] [--include-command]", description: "List async jobs from .state/jobs with a bounded default page and progress summaries." },
       { command: "job status <jobId|latest> [--tail-bytes N]", description: "Show job state with a structured progress summary and bounded stdout/stderr tails." },
       { command: "job cancel <jobId>", description: "Cancel a queued/running async job through the .state/jobs control entry and keep a terminal canceled record." },
@@ -350,7 +349,7 @@ function commanderHelp(): unknown {
       "dry-run commands never open SSH, PTY, or stdio bridges",
       "high-risk actions only produce a <=200 char Chinese ClaudeQQ approval draft and notification-path-unavailable blocker",
       "authorized future sends must use backend-core /api/microservices/claudeqq/proxy, not local skill or powershell paths",
-      "prompt-lint is commander advisory output and does not change codex submit default behavior",
+      "prompt-lint is commander advisory output for AgentRun payload review; legacy codex submit is frozen",
       "token and secret values must never be printed",
     ],
     promptLint: {
@@ -389,9 +388,10 @@ function codexHelp(): unknown {
     usage: [
       "bun scripts/cli.ts codex deploy <commitId> # disabled legacy deployment entry",
       "bun scripts/cli.ts codex prompt-lint [prompt|--prompt-file path|--prompt-stdin]",
-      "bun scripts/cli.ts codex submit [prompt] [--prompt-file path|--prompt-stdin] [--queue id] [--model model] [--dry-run]",
-      "cat <<'PROMPT' | bun scripts/cli.ts codex submit --prompt-stdin --queue <id> --dry-run",
-      "bun scripts/cli.ts codex submit --prompt-file /tmp/code-queue-prompt.md --queue <id> --dry-run",
+      "bun scripts/cli.ts agentrun v01 queue commander --reader-id cli",
+      "bun scripts/cli.ts agentrun v01 queue submit --json-file <task.json>",
+      "bun scripts/cli.ts agentrun v01 sessions trace <sessionId> --after-seq 0 --limit 100",
+      "bun scripts/cli.ts codex submit # frozen legacy write entry; returns legacy-code-queue-frozen",
       "bun scripts/cli.ts codex task <taskId> [--detail] [--trace --tail|--from-start|--after-seq N|--before-seq N --limit N] [--full]",
       "bun scripts/cli.ts codex tasks [--view commander|supervisor|full] [--queue id] [--status succeeded,running] [--unread|--unread-only] [--limit N] [--before-id id]",
       "bun scripts/cli.ts codex unread [--repo owner/name] [--issue N] [--limit N]",
@@ -403,11 +403,12 @@ function codexHelp(): unknown {
       "bun scripts/cli.ts codex execution-plane [--full|--raw]",
       "bun scripts/cli.ts codex pr-preflight [--remote] [--push-dry-run --push-dry-run-ref refs/heads/probe/<name>] [--pr-create-dry-run --pr-create-dry-run-head <head>] [--issue N] [--full|--raw]",
       "bun scripts/cli.ts codex judge <taskId> --attempt N [--dry-run] [--include-prompt]",
-      "bun scripts/cli.ts codex steer <taskId> [prompt|--prompt-file path|--prompt-stdin] [--steer-id id] [--dry-run] [--no-retry|--retry-attempts N] [--full|--raw]",
-      "bun scripts/cli.ts codex resume <taskId> [prompt|--prompt-file path|--prompt-stdin] [--resume-id id] [--dry-run] [--full|--raw]",
+      "bun scripts/cli.ts agentrun v01 sessions steer <sessionId> --prompt-file <path>",
+      "bun scripts/cli.ts codex steer <taskId> # frozen legacy write entry",
+      "bun scripts/cli.ts codex resume <taskId> # frozen legacy write entry",
       "bun scripts/cli.ts codex steer-confirm <taskId> --steer-id <id> [--raw]",
       "bun scripts/cli.ts codex interrupt|cancel <taskId>",
-      "bun scripts/cli.ts codex queues [--commander] [--full|--all] [--limit N] [--page N|--offset N] | queue create <queueId> | queue merge <sourceQueueId> --into <targetQueueId> | move <taskId> --queue <queueId>",
+      "bun scripts/cli.ts codex queues [--commander] [--full|--all] [--limit N] [--page N|--offset N] # legacy archive read-only",
     ],
     promptInput: {
       recommended: ["--prompt-stdin", "--prompt-file"],
@@ -418,14 +419,14 @@ function codexHelp(): unknown {
     },
     executionMode: {
       validModes: ["default", "windows-native"],
-      boundary: "--execution-mode selects Code Queue runtime placement, not Codex sandbox permissions.",
-      permissionVisibility: "Submit dry-runs show requested/effective mode; real submit responses include service runnerPermissions.sandbox and approvalPolicy.",
+      boundary: "Legacy Code Queue submit is frozen; new runtime placement is selected by AgentRun Queue payloads.",
+      permissionVisibility: "Legacy Code Queue read commands expose historical runner metadata only; new tasks use AgentRun Queue/Sessions.",
     },
     submitSummary: {
-      default: "Real codex submit is a compact write confirmation: accepted status, submitted task ids, submitted status/source, queue ids, promptOmitted=true, queue counts, activity and drill-down commands.",
-      listSemantics: "Task id previews are bounded objects; if a count is nonzero but ids are omitted or unavailable, the field sets idsUnavailable=true and does not print items=[] as if the list were empty.",
-      splitBrainLive: "When split-brain-live heartbeat evidence is present, submit summaries keep the live disposition visible and continue to count heartbeat/database active tasks as active.",
-      rawDrillDown: "Use queue.listPreviewPolicy.rawCommand or bun scripts/cli.ts microservice proxy code-queue /api/tasks/overview?limit=30 --raw --full for raw queue detail.",
+      default: "codex submit/enqueue now returns ok=false, frozen=true, degradedReason=legacy-code-queue-frozen and AgentRun replacement commands.",
+      replacement: "Use bun scripts/cli.ts agentrun v01 queue submit --json-file <task.json> for new work.",
+      noDoubleWrite: "UniDesk does not mirror AgentRun submissions into old Code Queue and does not migrate old history into AgentRun.",
+      rawDrillDown: "Use codex tasks/task/output/read/unread/queues only for legacy archive inspection.",
     },
     readOutput: {
       default: "codex read marks a terminal task read and returns terminal metadata, final response, last error/judge, counts, and drill-down commands.",
@@ -453,13 +454,10 @@ function codexHelp(): unknown {
     },
     examples: {
       promptLint: "bun scripts/cli.ts codex prompt-lint --prompt-file /tmp/code-queue-prompt.md",
-      stdin: [
-        "cat <<'PROMPT' | bun scripts/cli.ts codex submit --prompt-stdin --queue <id> --dry-run",
-        "<multi-line prompt body>",
-        "PROMPT",
-      ],
-      file: "bun scripts/cli.ts codex submit --prompt-file /tmp/code-queue-prompt.md --queue <id> --dry-run",
-      dryRunThenSubmit: "Run with --dry-run first; remove --dry-run to submit exactly the same payload.",
+      agentRunCommander: "bun scripts/cli.ts agentrun v01 queue commander --reader-id cli",
+      agentRunSubmit: "bun scripts/cli.ts agentrun v01 queue submit --json-file <task.json>",
+      agentRunTrace: "bun scripts/cli.ts agentrun v01 sessions trace <sessionId> --after-seq 0 --limit 100",
+      frozenLegacySubmit: "bun scripts/cli.ts codex submit --prompt-file /tmp/code-queue-prompt.md",
     },
     disclosure: {
       defaultPolicy: "low-noise JSON by default; write commands confirm persistence, list/detail/output commands return bounded summaries with drill-down commands",
@@ -481,10 +479,10 @@ function codexHelp(): unknown {
       classes: ["read-only", "live-read", "live-mutating"],
       defaultWhenMissing: "read-only",
       command: "bun scripts/cli.ts codex prompt-lint --prompt-file <path>",
-      embeddedIn: ["codex submit --dry-run", "codex steer --dry-run"],
+      embeddedIn: [],
       reference: "docs/reference/code-queue-supervision.md#dev-测试授权分级",
     },
-    description: "Operate Code Queue through the stable backend-core private proxy path with bounded activity summaries for queue and supervisor views. Real submit/steer success is a low-noise write confirmation and does not echo prompt text; steer output includes steerId, delivery state, and a bounded trace confirmation command; terminal steer rejection returns compact status plus codex task/read/submit follow-up commands, with upstream/raw details behind --full or --raw.",
+    description: "Operate legacy Code Queue as a read-only archive through bounded task/output/read/unread/queues views. New task dispatch, retry/resume, steer, queue mutation, move, and workdir mutation are frozen and replaced by AgentRun Queue/Sessions via bun scripts/cli.ts agentrun v01 queue|sessions.",
   };
 }