Feature request: first-class Computer Use support from the Codex CLI

Problem

Computer Use is currently exposed as a Codex desktop/app plugin, but it is not presented as a first-class, supported CLI capability.

The local implementation appears to be a bundled MCP helper:

computer-use -> ./Codex Computer Use.app/Contents/SharedSupport/SkyComputerUseClient.app/Contents/MacOS/SkyComputerUseClient mcp

On my machine, codex mcp list shows the computer-use server enabled from the OpenAI-bundled plugin cache, and the plugin metadata describes it as controlling Mac apps through screenshots/accessibility with user approval. The Codex CLI itself has general mcp commands, but codex --help does not expose a clear supported Computer Use workflow, permission setup, diagnostic path, or Desktop-bridge path for CLI sessions.

This is related to the narrower runtime bug in #19544, but the request here is a product/API request: make Computer Use an explicitly supported Codex CLI feature, not a Desktop-only capability that users discover indirectly through bundled MCP state.

Why this matters

For automation-heavy workflows, the CLI is where agents are launched, resumed, scripted, and supervised. If the same agent can use shell, files, web search, and MCP tools from the terminal, it should also have a clear way to use Computer Use from the terminal when the user grants the necessary macOS permissions.

A CLI-first workflow would let users run tasks like:

codex "Use Computer Use to inspect Chrome and summarize the current page"
codex exec "Use Computer Use to open Xcode, run the current project, and report failures"

without needing to start the task inside the Desktop app first.

Current local evidence

Environment from a current macOS install:

Codex app: 26.429.30905
Codex CLI: codex-cli 0.128.0
Computer Use plugin: openai-bundled/computer-use/1.0.770
macOS: 26.2 arm64

Observed wiring:

{
  "mcpServers": {
    "computer-use": {
      "command": "./Codex Computer Use.app/Contents/SharedSupport/SkyComputerUseClient.app/Contents/MacOS/SkyComputerUseClient",
      "args": ["mcp"],
      "cwd": "."
    }
  }
}

The helper bundle identifiers are:

com.openai.sky.CUAService
com.openai.sky.CUAService.cli

The helper is signed by OpenAI and has parent launch constraints, so the launch context appears to matter for CLI support and permission behavior.

Requested behavior

Please provide an official CLI path for Computer Use, including:

• a documented way to enable/use Computer Use from codex and codex exec
• a diagnostic command or doctor flow for app permissions, TCC state, helper launch context, and MCP availability
• a clear user approval flow for terminal-launched Computer Use actions
• actionable errors when the CLI is launched from an unsupported context
• parity between the official CLI install path and any app-bundled CLI path

Possible shapes:

codex computer-use doctor
codex computer-use allow "Google Chrome"
codex --enable computer-use "Inspect Safari and summarize the page"
codex exec --enable computer-use "List running apps and stop"

The exact command shape is less important than having a supported, documented contract.

Security requirements

Computer Use from the CLI should keep the same safety posture as Desktop:

• explicit per-app or per-session permissioning
• visible action approval for sensitive clicks/typing
• auditability of screenshots, clicks, typing, and app targets
• no silent escalation from shell access to desktop control
• clear behavior for non-interactive codex exec when approval is required

Acceptance criteria

• A fresh official Codex CLI install can use Computer Use after the required user approvals.
• codex mcp list and the actual CLI runtime agree on whether Computer Use is usable.
• A minimal CLI task can call computer-use/list_apps successfully.
• A CLI task can inspect and act on an approved app window with the same safety prompts as Desktop.
• Unsupported launch contexts fail with a clear diagnostic instead of a low-level Apple Event, code-signing, or helper-start error.