Clarify Codex permissionMode=never as non-interactive with inherited native sandbox

[Jokasa7]

This came up while testing a statically bound, named Codex Provider. The current mapping is internally consistent, but the Web UI can make never look like a read-only guarantee even though it only controls approval prompting.

Environment

• @deepseek-ai/dsh-subagent-codex@0.1.0-rc.8
• Provider configured with permissionMode: never
• Static dsh-tool-subagent binding

Current mapping

never:
  approvalPolicy = never
  sandbox = omitted

approve-for-me:
  approvalPolicy = on-request
  approvalsReviewer = auto_review
  sandbox = workspace-write

dangerously-bypass-approvals-and-sandbox:
  approvalPolicy = never
  sandbox = danger-full-access

Expected

Web should show the Harness Session authority and the product Provider authority separately:

Harness Session
  sandbox: workspace-write
  approval: ask

Codex Provider
  providerName: codex
  mode: never
  meaning: never ask for approval
  native sandbox: inherited / not reported
  read-only guarantee: none

Actual

Web shows the Harness Session permission selector, but it does not show the selected Codex Provider, Provider permission mode, or native sandbox consequence.

Because never omits the sandbox field, it must not be interpreted as read-only or never-write.

Suggested resolution

• Use wording such as “Never ask · native sandbox inherited”.
• Expose a sanitized Provider descriptor containing providerName, native mode and a normalized permission explanation.
• Keep Provider selection and permission static in deployment configuration; do not add them as model-facing tool parameters.
• Consider a separate explicit read-only non-interactive combination in a future compatible API.