Add CUA requirements subsection for locked computer use (#23555)

Adds a new top-level section for "CUA" requirements that can allow for
disablement of specific features as needed for enterprises.

codex-rs/app-server/src/request_processors/config_processor.rs

@@ -9,6 +9,7 @@ use crate::outgoing_message::OutgoingMessageSender;
 use codex_analytics::AnalyticsEventsClient;
 use codex_app_server_protocol::AppListUpdatedNotification;
 use codex_app_server_protocol::ClientResponsePayload;
+use codex_app_server_protocol::ComputerUseRequirements;
 use codex_app_server_protocol::ConfigBatchWriteParams;
 use codex_app_server_protocol::ConfigReadParams;
 use codex_app_server_protocol::ConfigReadResponse;
@@ -429,6 +430,9 @@ fn map_requirements_toml_to_api(requirements: ConfigRequirementsToml) -> ConfigR
             normalized
         }),
         allow_managed_hooks_only: requirements.allow_managed_hooks_only,
+        computer_use: requirements
+            .computer_use
+            .map(map_computer_use_requirements_to_api),
         feature_requirements: requirements
             .feature_requirements
             .map(|requirements| requirements.entries),
@@ -440,6 +444,14 @@ fn map_requirements_toml_to_api(requirements: ConfigRequirementsToml) -> ConfigR
     }
 }
 
+fn map_computer_use_requirements_to_api(
+    computer_use: codex_config::ComputerUseRequirementsToml,
+) -> ComputerUseRequirements {
+    ComputerUseRequirements {
+        allow_locked_computer_use: computer_use.allow_locked_computer_use,
+    }
+}
+
 fn map_hooks_requirements_to_api(hooks: ManagedHooksRequirementsToml) -> ManagedHooksRequirements {
     let ManagedHooksRequirementsToml {
         managed_dir,
@@ -617,6 +629,7 @@ fn config_write_error(code: ConfigWriteErrorCode, message: impl Into<String>) ->
 #[cfg(test)]
 mod tests {
     use super::map_requirements_toml_to_api;
+    use codex_config::ComputerUseRequirementsToml;
     use codex_config::ConfigRequirementsToml;
     use pretty_assertions::assert_eq;
 
@@ -630,4 +643,21 @@ mod tests {
         assert_eq!(mapped.allow_managed_hooks_only, Some(true));
         assert_eq!(mapped.hooks, None);
     }
+
+    #[test]
+    fn requirements_api_includes_computer_use_requirements() {
+        let mapped = map_requirements_toml_to_api(ConfigRequirementsToml {
+            computer_use: Some(ComputerUseRequirementsToml {
+                allow_locked_computer_use: Some(false),
+            }),
+            ..ConfigRequirementsToml::default()
+        });
+
+        assert_eq!(
+            mapped
+                .computer_use
+                .and_then(|requirements| requirements.allow_locked_computer_use),
+            Some(false)
+        );
+    }
 }