feat(sdk): read Codex managed config requirements

sdk/AGENTS.md

@@ -241,6 +241,7 @@ await conn.disconnect();
 | `startReview(target?, delivery?)` | Start a Codex review (`review/start`); defaults to uncommitted changes |
 | `compactThread()` | Compact the active thread's context (`thread/compact/start`) |
 | `readConfig(params?)` | Read the app-server's effective config (`config/read`) |
+| `readConfigRequirements()` | Read enforced managed requirements (`configRequirements/read`) |
 | `onApprovalRequest(method, handler)` | Handle server-initiated approval or MCP elicitation requests (returns unsubscribe fn) |
 | `threadId` | The active thread id (`string \| undefined`) |
 | `onAxonEvent(listener)` | Subscribe to all Axon events (returns unsubscribe fn) |

sdk/README.md

@@ -617,6 +617,7 @@ Like ACP/Claude, call `initialize()` after `connect()` — it runs the app-serve
 | `startReview(target?, delivery?)` | Start a Codex review (`review/start`); defaults to reviewing uncommitted changes |
 | `compactThread()` | Compact the active thread's context (`thread/compact/start`) |
 | `readConfig(params?)` | Read the app-server's effective configuration (`config/read`) |
+| `readConfigRequirements()` | Read the managed requirements the app-server enforces, such as allowed sandbox modes (`configRequirements/read`) |
 
 **Listeners**:
 

sdk/src/codex/connection.test.ts

@@ -309,6 +309,7 @@ describe("CodexAxonConnection", () => {
     await conn.connect();
     await conn.startThread();
     await conn.getAccountRateLimits();
+    await conn.readConfigRequirements();
     await conn.getAccountTokenUsage();
     await conn.readThread({ includeTurns: true });
     await conn.setThreadName("renamed");
@@ -321,6 +322,7 @@ describe("CodexAxonConnection", () => {
     const byMethod = Object.fromEntries(frames.map((frame) => [frame.method, frame]));
     // Option<()> wire params: the field must be absent, not an empty object.
     expect(byMethod["account/rateLimits/read"]).not.toHaveProperty("params");
+    expect(byMethod["configRequirements/read"]).not.toHaveProperty("params");
     expect(byMethod["account/usage/read"]).not.toHaveProperty("params");
     expect(byMethod["thread/read"]).toMatchObject({
       params: { threadId: "thr-1", includeTurns: true },

sdk/src/codex/connection.ts

@@ -22,6 +22,7 @@ import type {
   CollaborationMode,
   ConfigReadParams,
   ConfigReadResponse,
+  ConfigRequirementsReadResponse,
   GetAccountRateLimitsResponse,
   GetAccountTokenUsageResponse,
   InitializeParams,
@@ -745,6 +746,18 @@ export class CodexAxonConnection {
   async readConfig(params: ConfigReadParams = {}): Promise<ConfigReadResponse> {
     return (await this.request("config/read", params)) as ConfigReadResponse;
   }
+  /**
+   * Reads the managed requirements the app-server enforces
+   * (`configRequirements/read`), such as allowed sandbox modes and permission
+   * profiles; `requirements` is null when none apply.
+   * Wire params are `Option<()>`: the params field must be omitted, not `{}`.
+   */
+  async readConfigRequirements(): Promise<ConfigRequirementsReadResponse> {
+    return (await this.request(
+      "configRequirements/read",
+      undefined,
+    )) as ConfigRequirementsReadResponse;
+  }
   /**
    * Reads the account's current rate limits (`account/rateLimits/read`).
    * Wire params are `Option<()>`: the params field must be omitted, not `{}`.

sdk/src/codex/protocol/index.ts

@@ -3,6 +3,8 @@ export type * from "./generated/index.js";
 export type {
   ConfigReadParams,
   ConfigReadResponse,
+  ConfigRequirements,
+  ConfigRequirementsReadResponse,
   GetAccountRateLimitsResponse,
   GetAccountTokenUsageResponse,
   ListMcpServerStatusParams,