Add browser and computer use configuration (#40018)

## What changed

- Add typed `browser_use` settings for history access and per-origin access,
  download, upload, and full CDP policies.
- Add typed `computer_use` settings for default app access, macOS bundle IDs,
  Windows AUMIDs, and Windows executable identities.
- Expose the merged settings through app-server config reads and generated
  Rust, TypeScript, and JSON schemas.

## Testing

- Cover TOML serialization round trips, layered config reads with origin
  metadata, and app-server batch writes.

GitOrigin-RevId: 78065f6fec990602071fc81ff639ff97f7ad8cd5

codex-rs/config/src/browser_computer_use_requirements.rs

@@ -1,7 +1,9 @@
+use schemars::JsonSchema;
 use serde::Deserialize;
+use serde::Serialize;
 use std::collections::BTreeMap;
 
-#[derive(Deserialize, Debug, Clone, Copy, PartialEq, Eq)]
+#[derive(Serialize, Deserialize, Debug, Clone, Copy, PartialEq, Eq, JsonSchema)]
 #[serde(rename_all = "lowercase")]
 pub enum AllowDenyRequirementToml {
     Allow,

codex-rs/config/src/browser_use.rs

@@ -0,0 +1,26 @@
+use crate::AllowDenyRequirementToml;
+use schemars::JsonSchema;
+use serde::Deserialize;
+use serde::Serialize;
+use std::collections::BTreeMap;
+
+#[derive(Serialize, Deserialize, Debug, Clone, Default, PartialEq, Eq, JsonSchema)]
+#[schemars(deny_unknown_fields)]
+pub struct BrowserUseConfigToml {
+    pub allow_history_access: Option<bool>,
+    pub default_origin_policy: Option<BrowserUseOriginPolicyConfigToml>,
+    pub origins: Option<BTreeMap<String, BrowserUseOriginPolicyConfigToml>>,
+}
+
+#[derive(Serialize, Deserialize, Debug, Clone, Default, PartialEq, Eq, JsonSchema)]
+#[schemars(deny_unknown_fields)]
+pub struct BrowserUseOriginPolicyConfigToml {
+    pub access: Option<AllowDenyRequirementToml>,
+    pub downloads: Option<AllowDenyRequirementToml>,
+    pub uploads: Option<AllowDenyRequirementToml>,
+    pub full_cdp_access: Option<AllowDenyRequirementToml>,
+}
+
+#[cfg(test)]
+#[path = "browser_use_tests.rs"]
+mod tests;

codex-rs/config/src/browser_use_tests.rs

@@ -0,0 +1,52 @@
+use super::*;
+use crate::AllowDenyRequirementToml;
+use crate::config_toml::ConfigToml;
+use pretty_assertions::assert_eq;
+
+#[test]
+fn browser_use_origin_policies_round_trip() {
+    let config: ConfigToml = toml::from_str(
+        r#"
+[browser_use]
+allow_history_access = true
+
+[browser_use.default_origin_policy]
+access = "deny"
+downloads = "allow"
+uploads = "deny"
+full_cdp_access = "allow"
+
+[browser_use.origins."https://example.com"]
+access = "allow"
+downloads = "deny"
+uploads = "allow"
+full_cdp_access = "deny"
+"#,
+    )
+    .expect("browser use config should deserialize");
+
+    let expected = BrowserUseConfigToml {
+        allow_history_access: Some(true),
+        default_origin_policy: Some(BrowserUseOriginPolicyConfigToml {
+            access: Some(AllowDenyRequirementToml::Deny),
+            downloads: Some(AllowDenyRequirementToml::Allow),
+            uploads: Some(AllowDenyRequirementToml::Deny),
+            full_cdp_access: Some(AllowDenyRequirementToml::Allow),
+        }),
+        origins: Some(BTreeMap::from([(
+            "https://example.com".to_string(),
+            BrowserUseOriginPolicyConfigToml {
+                access: Some(AllowDenyRequirementToml::Allow),
+                downloads: Some(AllowDenyRequirementToml::Deny),
+                uploads: Some(AllowDenyRequirementToml::Allow),
+                full_cdp_access: Some(AllowDenyRequirementToml::Deny),
+            },
+        )])),
+    };
+    assert_eq!(config.browser_use, Some(expected.clone()));
+
+    let serialized = toml::to_string(&config).expect("browser use config should serialize");
+    let reparsed: ConfigToml =
+        toml::from_str(&serialized).expect("serialized browser use config should deserialize");
+    assert_eq!(reparsed.browser_use, Some(expected));
+}

codex-rs/config/src/computer_use.rs

@@ -0,0 +1,39 @@
+use crate::AllowDenyRequirementToml;
+use schemars::JsonSchema;
+use serde::Deserialize;
+use serde::Serialize;
+use std::collections::BTreeMap;
+
+#[derive(Serialize, Deserialize, Debug, Clone, Default, PartialEq, Eq, JsonSchema)]
+#[schemars(deny_unknown_fields)]
+pub struct ComputerUseConfigToml {
+    pub default_app_access: Option<AllowDenyRequirementToml>,
+    pub macos: Option<ComputerUseMacosConfigToml>,
+    pub windows: Option<ComputerUseWindowsConfigToml>,
+}
+
+#[derive(Serialize, Deserialize, Debug, Clone, Default, PartialEq, Eq, JsonSchema)]
+#[schemars(deny_unknown_fields)]
+pub struct ComputerUseMacosConfigToml {
+    pub bundle_ids: Option<BTreeMap<String, AllowDenyRequirementToml>>,
+}
+
+#[derive(Serialize, Deserialize, Debug, Clone, Default, PartialEq, Eq, JsonSchema)]
+#[schemars(deny_unknown_fields)]
+pub struct ComputerUseWindowsConfigToml {
+    pub aumids: Option<BTreeMap<String, AllowDenyRequirementToml>>,
+    pub exes: Option<Vec<ComputerUseWindowsExeConfigToml>>,
+}
+
+#[derive(Serialize, Deserialize, Debug, Clone, PartialEq, Eq, JsonSchema)]
+#[schemars(deny_unknown_fields)]
+pub struct ComputerUseWindowsExeConfigToml {
+    pub publisher_name: String,
+    pub product_name: String,
+    pub binary_name: Option<String>,
+    pub access: AllowDenyRequirementToml,
+}
+
+#[cfg(test)]
+#[path = "computer_use_tests.rs"]
+mod tests;

codex-rs/config/src/computer_use_tests.rs

@@ -0,0 +1,54 @@
+use super::*;
+use crate::config_toml::ConfigToml;
+use pretty_assertions::assert_eq;
+
+#[test]
+fn computer_use_config_round_trips() {
+    let config: ConfigToml = toml::from_str(
+        r#"
+[computer_use]
+default_app_access = "deny"
+
+[computer_use.macos.bundle_ids]
+"com.apple.Safari" = "allow"
+
+[computer_use.windows.aumids]
+"Microsoft.Paint_8wekyb3d8bbwe!App" = "deny"
+
+[[computer_use.windows.exes]]
+publisher_name = "CN=Google LLC"
+product_name = "Google Chrome"
+binary_name = "chrome.exe"
+access = "allow"
+"#,
+    )
+    .expect("computer use config should deserialize");
+
+    let expected = ComputerUseConfigToml {
+        default_app_access: Some(AllowDenyRequirementToml::Deny),
+        macos: Some(ComputerUseMacosConfigToml {
+            bundle_ids: Some(BTreeMap::from([(
+                "com.apple.Safari".to_string(),
+                AllowDenyRequirementToml::Allow,
+            )])),
+        }),
+        windows: Some(ComputerUseWindowsConfigToml {
+            aumids: Some(BTreeMap::from([(
+                "Microsoft.Paint_8wekyb3d8bbwe!App".to_string(),
+                AllowDenyRequirementToml::Deny,
+            )])),
+            exes: Some(vec![ComputerUseWindowsExeConfigToml {
+                publisher_name: "CN=Google LLC".to_string(),
+                product_name: "Google Chrome".to_string(),
+                binary_name: Some("chrome.exe".to_string()),
+                access: AllowDenyRequirementToml::Allow,
+            }]),
+        }),
+    };
+    assert_eq!(config.computer_use, Some(expected.clone()));
+
+    let serialized = toml::to_string(&config).expect("computer use config should serialize");
+    let reparsed: ConfigToml =
+        toml::from_str(&serialized).expect("serialized computer use config should deserialize");
+    assert_eq!(reparsed.computer_use, Some(expected));
+}

codex-rs/config/src/config_toml.rs

@@ -6,6 +6,8 @@ use std::num::NonZeroU64;
 use std::path::Path;
 
 use crate::HooksToml;
+use crate::browser_use::BrowserUseConfigToml;
+use crate::computer_use::ComputerUseConfigToml;
 use crate::permissions_toml::PermissionsToml;
 use crate::profile_toml::ConfigProfile;
 use crate::types::AnalyticsConfigToml;
@@ -182,6 +184,10 @@ pub struct ConfigToml {
     #[serde(default)]
     pub auto_review: Option<AutoReviewToml>,
 
+    pub browser_use: Option<BrowserUseConfigToml>,
+
+    pub computer_use: Option<ComputerUseConfigToml>,
+
     #[serde(default)]
     pub shell_environment_policy: ShellEnvironmentPolicyToml,
 

codex-rs/config/src/lib.rs

@@ -1,7 +1,9 @@
 mod auth_policy;
 mod browser_computer_use_requirements;
+mod browser_use;
 mod cloud_config_bundle;
 mod cloud_config_layers;
+mod computer_use;
 mod config_layer_source;
 mod config_requirements;
 pub mod config_toml;
@@ -46,6 +48,8 @@ pub use browser_computer_use_requirements::ComputerUseMacosRequirementsToml;
 pub use browser_computer_use_requirements::ComputerUseRequirementsToml;
 pub use browser_computer_use_requirements::ComputerUseWindowsExeRequirementToml;
 pub use browser_computer_use_requirements::ComputerUseWindowsRequirementsToml;
+pub use browser_use::BrowserUseConfigToml;
+pub use browser_use::BrowserUseOriginPolicyConfigToml;
 pub use cloud_config_bundle::CloudConfigBundle;
 pub use cloud_config_bundle::CloudConfigBundleLayers;
 pub use cloud_config_bundle::CloudConfigBundleLoadError;
@@ -69,6 +73,10 @@ pub use codex_protocol::mcp_policy::McpServerValueMatcher;
 pub use codex_protocol::mcp_policy::PluginMcpRequirements as PluginRequirementsToml;
 pub use codex_utils_absolute_path::AbsolutePathBuf;
 pub use codex_utils_absolute_path::AbsolutePathBufGuard;
+pub use computer_use::ComputerUseConfigToml;
+pub use computer_use::ComputerUseMacosConfigToml;
+pub use computer_use::ComputerUseWindowsConfigToml;
+pub use computer_use::ComputerUseWindowsExeConfigToml;
 pub use config_layer_source::ConfigLayer;
 pub use config_layer_source::ConfigLayerMetadata;
 pub use config_layer_source::ConfigLayerSource;