Add Computer Use requirements for controlling persistent approvals and app allowlist / denylist

[leoshimo-oai]

Summary

• add Computer Use config/requirements support for:
  • [computer_use] allow_persistent_approval
  • [computer_use.macos] allowed_bundle_ids
  • [computer_use.macos] denied_bundle_ids
• merge Computer Use requirements restrictively:
  • allow_persistent_approval = false wins
  • denied bundle IDs are unioned
  • allowed bundle IDs are intersected
• expose effective Computer Use policy from config/read
• expose requirements-only Computer Use policy from configRequirements/read
• regenerate app-server protocol schemas/types

Linear: SAI-13224

Policy examples

Config example:

[computer_use]
allow_persistent_approval = false

[computer_use.macos]
denied_bundle_ids = ["com.apple.calculator"]
allowed_bundle_ids = ["com.apple.TextEdit", "com.apple.Safari"]

Requirements example:

[computer_use]
allow_persistent_approval = false

[computer_use.macos]
denied_bundle_ids = ["com.apple.calculator"]
allowed_bundle_ids = ["com.apple.TextEdit", "com.apple.Safari"]

Testing

• cargo fmt --check
• cargo test -p codex-app-server-protocol schema_fixtures
• cargo test -p codex-app-server-protocol serialize_config_requirements_read
• cargo test -p codex-config computer_use --lib
• cargo test -p codex-app-server map_requirements_toml_to_api_converts_core_enums --lib
• cargo test -p codex-tui debug_config_output --lib
• cargo test -p codex-cloud-requirements --lib --no-run
• cargo test -p codex-core --lib --no-run
• cargo build --bin codex --bin codex-app-server
• manual stdio app-server checks for:
  • no config / no requirements
  • requirements-only
  • config-only
  • config + requirements