feat: add user-defined safe commands configuration and approval logic #380 (#386)

This pull request adds a feature that allows users to configure
auto-approved commands via a `safeCommands` array in the configuration
file.

## Related Issue
#380 

## Changes
- Added loading and validation of the `safeCommands` array in
`src/utils/config.ts`
- Implemented auto-approval logic for commands matching `safeCommands`
prefixes in `src/approvals.ts`
- Added test cases in `src/tests/approvals.test.ts` to verify
`safeCommands` behavior
- Updated documentation with examples and explanations of the
configuration

codex-cli/src/utils/config.ts

@@ -56,6 +56,8 @@ export type StoredConfig = {
     saveHistory?: boolean;
     sensitivePatterns?: Array<string>;
   };
+  /** User-defined safe commands */
+  safeCommands?: Array<string>;
 };
 
 // Minimal config written on first run.  An *empty* model string ensures that
@@ -87,6 +89,8 @@ export type AppConfig = {
     saveHistory: boolean;
     sensitivePatterns: Array<string>;
   };
+  /** User-defined safe commands */
+  safeCommands?: Array<string>;
 };
 
 // ---------------------------------------------------------------------------
@@ -271,6 +275,7 @@ export const loadConfig = (
         : DEFAULT_AGENTIC_MODEL),
     instructions: combinedInstructions,
     notify: storedConfig.notify === true,
+    safeCommands: storedConfig.safeCommands ?? [],
   };
 
   // -----------------------------------------------------------------------
@@ -348,6 +353,13 @@ export const loadConfig = (
     };
   }
 
+  // Load user-defined safe commands
+  if (Array.isArray(storedConfig.safeCommands)) {
+    config.safeCommands = storedConfig.safeCommands.map(String);
+  } else {
+    config.safeCommands = [];
+  }
+
   return config;
 };
 
@@ -389,6 +401,10 @@ export const saveConfig = (
       sensitivePatterns: config.history.sensitivePatterns,
     };
   }
+  // Save: User-defined safe commands
+  if (config.safeCommands && config.safeCommands.length > 0) {
+    configToSave.safeCommands = config.safeCommands;
+  }
 
   if (ext === ".yaml" || ext === ".yml") {
     writeFileSync(targetPath, dumpYaml(configToSave), "utf-8");