Add a managed gate for in-app local automation (#40436)

## What changed

- Register the stable, requirements-only `in_app_local_automation` feature for desktop apps.
- Add the feature to the configuration schema.
- Verify that an enterprise requirement can disable local automation.

GitOrigin-RevId: 939f7f3ee15f662dc85589cd1bcc3838e4cd1287

codex-rs/core/config.schema.json

@@ -751,6 +751,9 @@
             "in_app_dictation": {
               "type": "boolean"
             },
+            "in_app_local_automation": {
+              "type": "boolean"
+            },
             "in_app_updates": {
               "type": "boolean"
             },
@@ -5724,6 +5727,9 @@
         "in_app_dictation": {
           "type": "boolean"
         },
+        "in_app_local_automation": {
+          "type": "boolean"
+        },
         "in_app_updates": {
           "type": "boolean"
         },

codex-rs/core/src/config/config_tests.rs

@@ -11160,6 +11160,28 @@ in_app_dictation = false
     Ok(())
 }
 
+#[tokio::test]
+async fn in_app_local_automation_feature_requirements_are_valid() -> std::io::Result<()> {
+    let codex_home = TempDir::new()?;
+
+    let config = ConfigBuilder::without_managed_config_for_tests()
+        .codex_home(codex_home.path().to_path_buf())
+        .cloud_config_bundle(
+            CloudConfigBundleFixture::loader_with_enterprise_requirement(
+                r#"
+[features]
+in_app_local_automation = false
+"#,
+            ),
+        )
+        .build()
+        .await?;
+
+    assert!(!config.features.enabled(Feature::InAppLocalAutomation));
+
+    Ok(())
+}
+
 #[tokio::test]
 async fn explicit_feature_config_is_normalized_by_requirements() -> std::io::Result<()> {
     let codex_home = TempDir::new()?;

codex-rs/features/src/lib.rs

@@ -219,6 +219,10 @@ pub enum Feature {
     ///
     /// Requirements-only gate: this should be set from requirements, not user config.
     InAppDictation,
+    /// Allow desktop apps to run local automations.
+    ///
+    /// Requirements-only gate: this should be set from requirements, not user config.
+    InAppLocalAutomation,
     /// Allow desktop apps to perform in-app updates.
     ///
     /// Requirements-only gate: this should be set from requirements, not user config.
@@ -1253,6 +1257,12 @@ pub const FEATURES: &[FeatureSpec] = &[
         stage: Stage::Stable,
         default_enabled: true,
     },
+    FeatureSpec {
+        id: Feature::InAppLocalAutomation,
+        key: "in_app_local_automation",
+        stage: Stage::Stable,
+        default_enabled: true,
+    },
     FeatureSpec {
         id: Feature::InAppUpdates,
         key: "in_app_updates",