Add a requirements feature gate for the browser annotation API (#49784)

## What changed

Register `browser_annotation_api` as a stable, default-enabled feature intended for requirements rather than user configuration. It controls websites opening and customizing annotation tools in desktop apps, independently of ordinary user-driven annotation.

Add the key to the configuration schema, extending the browser requirements support introduced in https://github.com/openai/codex/pull/18956.

## Testing

Extend `browser_feature_requirements_are_valid` to verify that enterprise requirements setting `browser_annotation_api = false` disable the feature.

GitOrigin-RevId: 8c7bb65932e08560040958b4472fe45f6d1c916f

codex-rs/core/config.schema.json

@@ -759,6 +759,9 @@
             "bedrock_setup_wizard": {
               "type": "boolean"
             },
+            "browser_annotation_api": {
+              "type": "boolean"
+            },
             "browser_use": {
               "type": "boolean"
             },
@@ -6805,6 +6808,9 @@
         "bedrock_setup_wizard": {
           "type": "boolean"
         },
+        "browser_annotation_api": {
+          "type": "boolean"
+        },
         "browser_use": {
           "type": "boolean"
         },

codex-rs/core/src/config/config_tests.rs

@@ -11657,6 +11657,7 @@ async fn browser_feature_requirements_are_valid() -> std::io::Result<()> {
                 r#"
 [features]
 in_app_browser = false
+browser_annotation_api = false
 browser_use = false
 browser_use_full_cdp_access = false
 "#,
@@ -11666,6 +11667,7 @@ browser_use_full_cdp_access = false
         .await?;
 
     assert!(!config.features.enabled(Feature::InAppBrowser));
+    assert!(!config.features.enabled(Feature::BrowserAnnotationApi));
     assert!(!config.features.enabled(Feature::BrowserUse));
     assert!(!config.features.enabled(Feature::BrowserUseFullCdpAccess));
 

codex-rs/features/src/lib.rs

@@ -264,6 +264,11 @@ pub enum Feature {
     ///
     /// Requirements-only gate: this should be set from requirements, not user config.
     InAppBrowser,
+    /// Allow websites to open and customize annotation tools in desktop apps.
+    /// Ordinary user-driven annotation is independent of this gate.
+    ///
+    /// Requirements-only gate: this should be set from requirements, not user config.
+    BrowserAnnotationApi,
     /// Allow the in-app chat pane in desktop apps.
     ///
     /// Requirements-only gate: this should be set from requirements, not user config.
@@ -1517,6 +1522,12 @@ pub const FEATURES: &[FeatureSpec] = &[
         stage: Stage::Stable,
         default_enabled: true,
     },
+    FeatureSpec {
+        id: Feature::BrowserAnnotationApi,
+        key: "browser_annotation_api",
+        stage: Stage::Stable,
+        default_enabled: true,
+    },
     FeatureSpec {
         id: Feature::InAppChat,
         key: "in_app_chat",