fix: expose codex submit execution mode mapping

scripts/src/code-queue.ts

@@ -3,7 +3,16 @@ import { runCommand } from "./command";
 import { type UniDeskConfig, repoRoot, rootPath } from "./config";
 import { coreInternalFetch } from "./microservices";
 import { previewJson } from "./preview";
-import { codeAgentPortForModel, codeModelPorts as sharedCodeModelPorts, defaultCodeModels as sharedDefaultCodeModels, opencodeModels as sharedOpencodeModels } from "../../src/components/microservices/code-queue/src/code-agent/common";
+import {
+  codeAgentPortForModel,
+  codeExecutionModes,
+  codeModelPorts as sharedCodeModelPorts,
+  defaultCodeModels as sharedDefaultCodeModels,
+  normalizeCodeExecutionMode,
+  normalizeRequestedCodeExecutionMode,
+  opencodeModels as sharedOpencodeModels,
+  requestedCodeExecutionModeIsRecognized,
+} from "../../src/components/microservices/code-queue/src/code-agent/common";
 
 const defaultToolLimit = 3;
 const defaultTraceLimit = 80;
@@ -25,6 +34,7 @@ const diagnosticsIdPreviewLimit = 3;
 const diagnosticsReasonPreviewLimit = 2;
 const mutationQueueIdPreviewLimit = 15;
 const steerPromptPreviewChars = 320;
+const sandboxLikeExecutionModes = new Set(["full-access", "danger-full-access", "workspace-write", "read-only"]);
 const detailAttemptReturnedLimit = 3;
 const detailInitialPromptPreviewChars = 1200;
 const detailBasePromptPreviewChars = 800;
@@ -3921,6 +3931,61 @@ function referenceTaskIdsFromOptions(args: string[]): string[] {
   return ids;
 }
 
+function parseRequestedExecutionMode(value: string | undefined): string | undefined {
+  if (value === undefined) return undefined;
+  const requested = normalizeRequestedCodeExecutionMode(value);
+  if (requested === null) throw new Error("--execution-mode must be a short mode identifier");
+  return requested;
+}
+
+function executionModeSummary(requestedValue: string | null | undefined, effectiveValue?: unknown): Record<string, unknown> {
+  const requested = normalizeRequestedCodeExecutionMode(requestedValue);
+  const effective = typeof effectiveValue === "string" && effectiveValue.trim().length > 0
+    ? normalizeCodeExecutionMode(effectiveValue)
+    : normalizeCodeExecutionMode(requested);
+  const requestedLooksLikeSandbox = requested !== null && sandboxLikeExecutionModes.has(requested);
+  const recognized = requestedCodeExecutionModeIsRecognized(requested);
+  return {
+    requested,
+    effective,
+    recognized,
+    normalized: requested !== null && requested !== effective,
+    availableModes: codeExecutionModes,
+    requestedLooksLikeSandbox,
+    permissionBoundary: "--execution-mode selects the Code Queue runtime mode; Codex sandbox permissions come from runnerPermissions.sandbox.",
+    ...(requestedLooksLikeSandbox ? { warning: `${requested} is not a Code Queue execution mode and is not applied as a per-task sandbox override.` } : {}),
+  };
+}
+
+function dryRunRunnerPermissionsSummary(): Record<string, unknown> {
+  return {
+    observed: false,
+    scope: "code-queue-service-config",
+    sandbox: null,
+    approvalPolicy: null,
+    perTaskOverrideSupported: false,
+    note: "Dry-run does not contact Code Queue; real submit responses include observed runnerPermissions from the service.",
+    secretsPrinted: false,
+  };
+}
+
+function compactRunnerPermissions(value: unknown): Record<string, unknown> | null {
+  const record = asRecord(value);
+  if (record === null) return null;
+  return {
+    observed: record.observed ?? true,
+    scope: record.scope ?? "code-queue-service-config",
+    sandbox: record.sandbox ?? null,
+    approvalPolicy: record.approvalPolicy ?? null,
+    perTaskOverrideSupported: record.perTaskOverrideSupported ?? false,
+    secretsPrinted: false,
+  };
+}
+
+function compactTaskExecutionModeRequest(record: Record<string, unknown>): Record<string, unknown> {
+  return executionModeSummary(asString(record.requestedExecutionMode) || null, record.executionMode);
+}
+
 function parseSubmitOptions(args: string[]): CodexSubmitOptions {
   assertKnownOptions(args, {
     flags: ["--prompt-stdin", "--stdin", "--dry-run"],
@@ -3953,7 +4018,7 @@ function parseSubmitOptions(args: string[]): CodexSubmitOptions {
     cwd: optionValue(args, ["--cwd", "--workdir"]),
     model: optionValue(args, ["--model"]),
     reasoningEffort: optionValue(args, ["--reasoning-effort"]),
-    executionMode: optionValue(args, ["--execution-mode", "--mode"]),
+    executionMode: parseRequestedExecutionMode(optionValue(args, ["--execution-mode", "--mode"])),
     maxAttempts,
     referenceTaskIds: referenceTaskIdsFromOptions(args),
     dryRun: hasFlag(args, "--dry-run"),
@@ -4014,6 +4079,8 @@ function compactTaskMutationResponse(task: unknown, options: CompactTaskMutation
     reasoningEffort: record.reasoningEffort ?? null,
     cwd: record.cwd ?? null,
     executionMode: record.executionMode ?? null,
+    requestedExecutionMode: record.requestedExecutionMode ?? null,
+    executionModeRequest: compactTaskExecutionModeRequest(record),
     maxAttempts: record.maxAttempts ?? null,
     currentAttempt: record.currentAttempt ?? null,
     cancelRequested: record.cancelRequested ?? null,
@@ -4048,6 +4115,8 @@ function compactSubmitTaskConfirmation(task: unknown): Record<string, unknown> {
     reasoningEffort: record.reasoningEffort ?? null,
     cwd: record.cwd ?? null,
     executionMode: record.executionMode ?? null,
+    requestedExecutionMode: record.requestedExecutionMode ?? null,
+    executionModeRequest: compactTaskExecutionModeRequest(record),
     maxAttempts: record.maxAttempts ?? null,
     createdAt: record.createdAt ?? null,
     updatedAt: record.updatedAt ?? null,
@@ -4220,6 +4289,7 @@ function compactSubmitQueueConfirmation(value: unknown, options: CompactSubmitQu
     databaseActiveTaskIds: databaseActivePreview,
     queuedTaskIds: queuedPreview,
     executionDiagnostics: compactQueueExecutionDiagnostics(record.executionDiagnostics),
+    runnerPermissions: compactRunnerPermissions(record.runnerPermissions),
     ...(submittedTasks.length === 0 ? {} : { submittedTaskIds: submittedPreview }),
     countContext: {
       queued: countForStatus(counts, "queued"),
@@ -4265,9 +4335,14 @@ function compactSubmitSuccessResponse(body: Record<string, unknown>, upstream: R
   const queueIds = Array.from(new Set(tasks.map((task) => asString(task.queueId)).filter(Boolean))).sort();
   const firstTaskId = taskIds[0] ?? null;
   const firstQueueId = queueIds[0] ?? null;
+  const firstSubmittedTask = submittedTasks[0] ?? {};
+  const queueRecord = asRecord(body.queue);
+  const runnerPermissions = compactRunnerPermissions(queueRecord?.runnerPermissions);
   return {
     ok: true,
     upstream,
+    executionMode: executionModeSummary(asString(firstSubmittedTask.requestedExecutionMode) || null, firstSubmittedTask.executionMode),
+    runnerPermissions,
     submitted: {
       accepted: true,
       taskCount: allTasks.length,
@@ -4393,6 +4468,11 @@ function compactTerminalReadTask(summary: unknown, readTask: unknown, taskId: st
     readAt,
     providerId: summaryRecord.providerId ?? readRecord.providerId ?? null,
     executionMode: summaryRecord.executionMode ?? readRecord.executionMode ?? null,
+    requestedExecutionMode: summaryRecord.requestedExecutionMode ?? readRecord.requestedExecutionMode ?? null,
+    executionModeRequest: compactTaskExecutionModeRequest({
+      requestedExecutionMode: summaryRecord.requestedExecutionMode ?? readRecord.requestedExecutionMode ?? null,
+      executionMode: summaryRecord.executionMode ?? readRecord.executionMode ?? null,
+    }),
     executionModeInfo: summaryRecord.executionModeInfo ?? readRecord.executionModeInfo ?? null,
     model: summaryRecord.model ?? readRecord.model ?? null,
     agentPort: summaryRecord.agentPort ?? readRecord.agentPort ?? null,
@@ -5848,6 +5928,8 @@ function codexSubmitTask(args: string[]): unknown {
       ok: true,
       dryRun: true,
       promptLint,
+      executionMode: executionModeSummary(options.executionMode),
+      runnerPermissions: dryRunRunnerPermissionsSummary(),
       routingRecommendation: submitRoutingRecommendation(options),
       modelRegistry: submitModelRegistry(),
       request: {