Add CUA requirements subsection for locked computer use (#23555)

Adds a new top-level section for "CUA" requirements that can allow for
disablement of specific features as needed for enterprises.

codex-rs/app-server-protocol/src/protocol/v2/config.rs

@@ -388,6 +388,7 @@ pub struct ConfigRequirements {
     pub allowed_sandbox_modes: Option<Vec<SandboxMode>>,
     pub allowed_web_search_modes: Option<Vec<WebSearchMode>>,
     pub allow_managed_hooks_only: Option<bool>,
+    pub computer_use: Option<ComputerUseRequirements>,
     pub feature_requirements: Option<BTreeMap<String, bool>>,
     #[experimental("configRequirements/read.hooks")]
     pub hooks: Option<ManagedHooksRequirements>,
@@ -396,6 +397,13 @@ pub struct ConfigRequirements {
     pub network: Option<NetworkRequirements>,
 }
 
+#[derive(Serialize, Deserialize, Debug, Clone, PartialEq, Eq, JsonSchema, TS)]
+#[serde(rename_all = "camelCase")]
+#[ts(export_to = "v2/")]
+pub struct ComputerUseRequirements {
+    pub allow_locked_computer_use: Option<bool>,
+}
+
 #[derive(Serialize, Deserialize, Debug, Clone, PartialEq, Eq, JsonSchema, TS)]
 #[serde(rename_all = "camelCase")]
 #[ts(export_to = "v2/")]

codex-rs/app-server-protocol/src/protocol/v2/tests.rs

@@ -1730,6 +1730,7 @@ fn config_requirements_granular_allowed_approval_policy_is_marked_experimental()
             allowed_sandbox_modes: None,
             allowed_web_search_modes: None,
             allow_managed_hooks_only: None,
+            computer_use: None,
             feature_requirements: None,
             hooks: None,
             enforce_residency: None,