FEAT - LAUNCHER: expose system Codex agent entitlement

src/widgets/admin-overlay/AdminOverlay.tsx

@@ -3425,7 +3425,8 @@ function OperationalCoreAccessModal({
             </div>
             <div className="task-module-access-list">
               {operationalCoreModules.map((module) => {
-                const enabled = hasServiceModuleEntitlement(data, client.id, user.id, service.id, module.id);
+                const systemEnabled = hasSystemServiceModuleEntitlement(user, module.id);
+                const enabled = systemEnabled || hasServiceModuleEntitlement(data, client.id, user.id, service.id, module.id);
                 const pendingKey = serviceModuleEntitlementKey(client.id, user.id, service.id, module.id);
                 const pending = Boolean(pendingServiceModuleEntitlements[pendingKey]);
 
@@ -3435,7 +3436,7 @@ function OperationalCoreAccessModal({
                     className={cn("task-module-access-row", enabled && "task-module-access-row--enabled", pending && "task-module-access-row--pending")}
                     type="button"
                     aria-pressed={enabled}
-                    disabled={pending}
+                    disabled={pending || systemEnabled}
                     onClick={() =>
                       onSetServiceModuleEntitlement({
                         clientId: client.id,
@@ -3454,7 +3455,7 @@ function OperationalCoreAccessModal({
                       <span className="task-module-checker" aria-hidden="true">
                         {enabled ? <span /> : null}
                       </span>
-                      <span>{pending ? "Сохраняем..." : enabled ? module.enabledLabel : module.disabledLabel}</span>
+                      <span>{pending ? "Сохраняем..." : systemEnabled ? "Системно включён" : enabled ? module.enabledLabel : module.disabledLabel}</span>
                     </span>
                   </button>
                 );
@@ -4813,6 +4814,10 @@ function hasServiceModuleEntitlement(data: LauncherData, clientId: string, userI
   );
 }
 
+function hasSystemServiceModuleEntitlement(user: LauncherUser, moduleId: ServiceModuleId): boolean {
+  return user.id === "user_root" && moduleId === "codex_agents";
+}
+
 function isOperationalCoreService(service: Service): boolean {
   return service.slug === "task-manager" || service.authentikApplicationSlug === "task-manager";
 }