@hiveku-apps/sync 0.3.5 → 0.3.6

package/README.md

@@ -108,9 +108,52 @@ This writes, merge-safely (only Hiveku-managed regions are touched):
   and deprecated).
 
 Pass `--trust` to pre-trust the folder in `~/.codex/config.toml` (so Codex loads
-the repo config without its first-run trust prompt). Codex ignores repo-level
-approval/sandbox config, so the safe-work rules ship as instructions in
-`AGENTS.md`, not enforced permissions.
+the repo config without its first-run trust prompt).
+
+**Approvals.** Codex asks first only for a **fixed list** of high-risk Hiveku
+tools: the 246 names in `src/codex-prompt-tools.json`, the same list as the
+Hiveku Codex plugin 0.1.16. It includes `deploy_site`, `site_delete`,
+`project_files_bulk_save` and every `hiveku_batch`, and it is written as
+`[mcp_servers.hiveku.tools.<tool>] approval_mode = "prompt"`. **Every other tool
+on the `hiveku` server runs without asking** (`default_tools_approval_mode =
+"approve"`), and that includes many deletes and sends, for example
+`crm_delete_contact`, `content_delete` and `survey_send`. So the safe-work rules
+in `AGENTS.md` still apply to every tool: they are instructions, not enforced
+permissions.
+
+**Your own setting wins.** When `.codex/config.toml` already has your own
+`[mcp_servers.hiveku.tools.<tool>]` table for a listed tool, outside the
+hiveku-sync block, hiveku-sync leaves that tool out of its block (TOML does not
+allow a table to be declared twice) and prints a line naming it. If your table
+sets no `approval_mode`, Codex uses the server default, `approve`, so that tool
+runs without asking, and the line says so. Add `approval_mode = "prompt"` to
+your table to have it ask first.
+
+hiveku-sync checks the updated file before it writes anything. It stops only
+when its own block would declare a table or key that another line of the file
+also declares, for example your own copy of `[mcp_servers.hiveku]`. Then it
+writes nothing in the folder and names that line by its number. It reads the
+file as Codex does, so TOML 1.1 syntax and a byte-order mark at the start are
+fine, and it leaves the rest of the file, including any line it cannot read,
+to you and Codex.
+
+The folder has to carry the list itself: Codex uses the folder's
+`[mcp_servers.hiveku]` instead of the plugin's, including for approvals, so the
+plugin's prompts do not apply here.
+
+Headless and bypass modes:
+
+- **`codex exec` never stops to ask.** Under a `read-only` or `workspace-write`
+  sandbox it cancels the listed calls and runs the rest.
+- **The bypass flag skips every prompt.** With
+  `--dangerously-bypass-approvals-and-sandbox` (`--yolo`), in `codex exec` or in
+  interactive `codex`, and with `danger-full-access` in `codex exec`
+  (`-s danger-full-access` or `sandbox_mode = "danger-full-access"`), the listed
+  tools run unattended too, like every other Hiveku tool.
+
+Folders set up by a hiveku-sync without these prompts (0.3.5 and earlier)
+approve every tool: run `hiveku-sync codex` in them once, with a release that has
+them, to add the prompts.
 
 > **This vs. the plugin.** For a single account, you can instead install the
 > published [Hiveku Codex plugin](https://github.com/locus2012/hiveku-codex-plugin)

package/bin/hiveku-sync.mjs

@@ -116,6 +116,30 @@ Ship a project (the agent-native deploy loop):
 Profiles: full, sales, marketing, helpdesk, pm, dev
 `;
 
+/**
+ * Plain lines naming the listed tools whose own config.toml table hiveku-sync
+ * left alone. A table that sets no approval_mode gets the server default
+ * ("approve"), so those tools are said to run without asking.
+ */
+function userToolTablesLines({ userToolTables = [], userTablesWithoutApprovalMode = [] }) {
+  const lines = [];
+  const kept = userToolTables.filter((tool) => !userTablesWithoutApprovalMode.includes(tool));
+  if (kept.length) {
+    const them = kept.length === 1 ? 'it' : 'them';
+    lines.push(
+      `your own setting kept for ${kept.join(', ')}: .codex/config.toml sets ${them} outside the hiveku-sync block, so hiveku-sync did not add its "ask first" setting for ${them}.`,
+    );
+  }
+  const bare = userTablesWithoutApprovalMode;
+  if (bare.length) {
+    const one = bare.length === 1;
+    lines.push(
+      `${bare.join(', ')} ${one ? 'runs' : 'run'} without asking: your own ${one ? 'table' : 'tables'} for ${one ? 'it' : 'them'} in .codex/config.toml, outside the hiveku-sync block, ${one ? 'sets' : 'set'} no approval_mode, so Codex uses the server default ("approve"). To have ${one ? 'it' : 'them'} ask first, add approval_mode = "prompt" to ${one ? 'that table' : 'those tables'}.`,
+    );
+  }
+  return lines;
+}
+
 function commitMessageFrom(flags) {
   // --commit "msg" | --commit=msg | -m "msg" | --message "msg". A bare --commit
   // (boolean true) means "commit with no message" → fall back to the default.
@@ -163,6 +187,7 @@ async function main() {
             ? `    MCP auth: inlined your OLYMPUS_API_KEY`
             : `    MCP auth: reads the OLYMPUS_API_KEY env var — after pasting your key into .env, run \`hiveku-sync codex\` to inline it, or \`export OLYMPUS_API_KEY=...\``,
         );
+        for (const line of userToolTablesLines(result.codex)) console.log(`    ${line}`);
         if (result.codex.trust === 'added') console.log(`    trust: pre-trusted this folder in ~/.codex/config.toml`);
       }
       console.log(`  then: cd ${result.folder} && hiveku-sync pull`);
@@ -172,6 +197,7 @@ async function main() {
       const result = await runCodex({ folder: positional[0], trust: !!flags['trust'] });
       console.log(`Codex lane ready in ${result.folder} (profile=${result.profile})`);
       console.log(`  AGENTS.md + .codex/config.toml written (git-ignored).`);
+      for (const line of userToolTablesLines(result)) console.log(`  ${line}`);
       console.log(
         result.inlinedKey
           ? `  MCP auth: inlined OLYMPUS_API_KEY from .env.`

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@hiveku-apps/sync",
-  "version": "0.3.5",
+  "version": "0.3.6",
   "description": "Sync a Hiveku account's memory/rules/skills + coder projects into a local folder, and ship projects (push/deploy/pull-env) from the terminal. Pairs with the Hiveku MCP at core.hiveku.com/mcp so Claude Code can drive Hiveku tools per-folder.",
   "type": "module",
   "license": "MIT",

package/src/codex-prompt-tools.json

@@ -0,0 +1,252 @@
+{
+  "source": "locus2012/hiveku-codex-plugin 0.1.16 (5b4e580), plugins/hiveku/.mcp.json: every hiveku.tools entry (all approval_mode \"prompt\")",
+  "why": "hiveku-sync writes its own [mcp_servers.hiveku] into a Codex folder. Codex then uses that entry, not the plugin's, for the server's connection and for every tool's approval mode, so these prompts must be written here too. Refresh this list whenever the Codex plugin's prompt list changes.",
+  "tools": [
+    "deploy_site",
+    "deploy_run",
+    "project_files_bulk_save",
+    "project_vcs_commit",
+    "project_vcs_merge",
+    "project_vcs_pr_merge",
+    "project_vcs_env_bind",
+    "project_vcs_branch_delete",
+    "project_vcs_stash",
+    "project_vcs_prune",
+    "project_vcs_branch_preview_teardown",
+    "project_vcs_revert",
+    "hiveku_batch",
+    "project_checkpoint_restore",
+    "checkpoint_restore",
+    "history_restore_to_time",
+    "checkpoint_delete",
+    "site_delete",
+    "site_firewall_allow",
+    "site_firewall_remove",
+    "project_indexing_set",
+    "account_memory_append",
+    "memory_update",
+    "memory_delete",
+    "memory_restore_version",
+    "memory_bulk_create",
+    "content_publish_to_site",
+    "content_schedule",
+    "email_campaign_send_now",
+    "email_campaign_schedule",
+    "email_campaign_resend_non_openers",
+    "email_campaign_test_send",
+    "crm_envelope_send",
+    "crm_estimate_send",
+    "helpdesk_ticket_send_reply",
+    "marketing_report_send",
+    "ppc_budget_update",
+    "ppc_platform_budget_update",
+    "ppc_bid_modifier_update",
+    "ppc_keyword_bid_update",
+    "ppc_platform_keyword_bid_update",
+    "ppc_bidding_strategy_update",
+    "ppc_platform_bidding_strategy_update",
+    "ppc_campaign_create",
+    "ppc_google_auto_apply_set",
+    "ppc_google_campaign_settings_set",
+    "ppc_google_ad_schedule_set",
+    "ppc_google_audience_exclusions_set",
+    "ppc_google_call_settings_set",
+    "ppc_google_campaign_ai_settings_set",
+    "ppc_bing_campaign_ai_settings_set",
+    "ppc_google_ad_text_update",
+    "ppc_google_ads_text_replace",
+    "ppc_negatives_remove",
+    "ppc_bing_url_tracking_set",
+    "ppc_bing_ad_extension_update",
+    "ppc_bing_ad_extension_remove",
+    "ppc_bing_experiment_create",
+    "ppc_bing_experiment_update",
+    "ppc_experiment_promote",
+    "ppc_experiment_treatment_set",
+    "ppc_conversion_adjustments_run",
+    "ppc_conversion_adjustments_set",
+    "ppc_meta_lead_quality_test",
+    "ppc_experiment_schedule",
+    "ppc_experiment_graduate",
+    "ppc_offline_conversion_upload",
+    "ppc_customer_match_upload",
+    "ppc_goals_set",
+    "ppc_budget_target_set",
+    "ppc_connection_update",
+    "agent_approval_approve",
+    "seo_ga4_key_event_update",
+    "seo_ga4_event_create_rule_update",
+    "accounting_bill_record_payment",
+    "accounting_invoice_record_payment",
+    "crm_contact_email_send",
+    "crm_enroll_sequence",
+    "crm_sequence_enroll_bulk",
+    "email_sequence_enroll",
+    "email_sequence_activate",
+    "voice_sms_send",
+    "voice_sms_send_to_contact",
+    "voice_sms_thread_reply",
+    "crm_remove_dnc",
+    "outbound_campaign_status_set",
+    "outbound_campaign_sequences_save",
+    "outbound_reply_draft_send",
+    "voice_number_purchase",
+    "voice_number_release",
+    "voice_e911_address_create",
+    "voice_extension_delete",
+    "voice_ivr_create",
+    "voice_ivr_update",
+    "voice_ivr_delete",
+    "voice_ring_group_delete",
+    "voice_queue_delete",
+    "voice_pool_delete",
+    "voice_call_tracking_setup",
+    "voice_call_originate",
+    "voice_sms_bulk_send",
+    "voice_sms_brand_submit",
+    "voice_sms_campaign_submit",
+    "voice_sms_campaign_resubmit",
+    "voice_sms_campaign_delete",
+    "voice_sms_number_assign_campaign",
+    "voice_sms_toll_free_verification_submit",
+    "voice_port_order_create",
+    "voice_port_order_action",
+    "voice_settings_update",
+    "voice_number_update",
+    "voice_blocked_numbers_remove",
+    "voice_tenant_repair",
+    "voice_swap_test",
+    "voice_call_tracking_live_probe",
+    "voice_phone_tracking_config_set",
+    "voice_phone_tracking_config_delete",
+    "voice_pool_update",
+    "voice_pool_create",
+    "voice_pool_numbers_add",
+    "voice_pool_numbers_remove",
+    "voice_pool_e911_apply",
+    "voice_webhook_create",
+    "voice_webhook_update",
+    "voice_webhook_delete",
+    "voice_sms_registration_share_link_create",
+    "voice_sms_registration_share_link_revoke",
+    "voice_port_order_share_link_create",
+    "voice_port_order_share_link_revoke",
+    "voice_ivrs_reprovision",
+    "voice_ai_agent_config_update",
+    "voice_number_cnam_set",
+    "voice_sms_campaign_appeal",
+    "voice_port_order_verification_codes_send",
+    "voice_sms_scheduled_cancel",
+    "voice_numbers_search",
+    "seo_gbp_review_reply",
+    "seo_gbp_review_reply_delete",
+    "seo_gbp_location_update",
+    "seo_gbp_attributes_update",
+    "seo_gsc_delete_sitemap",
+    "seo_report_clear",
+    "seo_deliverable_delete",
+    "seo_task_implement",
+    "seo_connection_delete",
+    "seo_gbp_services_update",
+    "seo_gbp_media_add",
+    "seo_gbp_media_delete",
+    "seo_gtm_publish",
+    "seo_gtm_install",
+    "seo_ga4_key_event_delete",
+    "seo_ga4_event_create_rule_delete",
+    "seo_tracking_project_delete",
+    "seo_rankings_platforms_set",
+    "seo_listings_scan",
+    "seo_connection_test",
+    "seo_competitor_delete",
+    "seo_keyword_cluster_delete",
+    "seo_topic_cluster_delete",
+    "seo_backlink_tracker_delete",
+    "seo_backlink_opportunity_delete",
+    "seo_automated_report_delete",
+    "seo_page_schema_delete",
+    "workflow_run",
+    "workflow_enable",
+    "workflow_trigger_update",
+    "workflow_delete",
+    "workflow_delete_schedule",
+    "workflow_stranded_replay",
+    "workflow_run_replay",
+    "workflow_run_retry",
+    "workflow_dead_letter_resolve",
+    "workflow_set_recipient",
+    "hiveboard_restore_version",
+    "hiveboard_delete",
+    "hiveboard_elements_prune",
+    "customer_avatar_version_restore",
+    "before_after_grid_version_restore",
+    "customer_journey_version_restore",
+    "customer_avatar_delete",
+    "customer_journey_delete",
+    "before_after_grid_delete",
+    "customer_journey_stage_delete",
+    "media_delete",
+    "media_folder_delete",
+    "brand_guide_delete",
+    "brand_guide_purge",
+    "marketing_storyboard_delete",
+    "marketing_generate_video",
+    "marketing_video_pipeline_retry_scene",
+    "design_voiceover_create",
+    "generate_image_set",
+    "media_upscale",
+    "marketing_testimonial_media_replace",
+    "marketing_form_upload_settings_update",
+    "marketing_form_capture_settings_update",
+    "marketing_form_capture_purge",
+    "social_publish_post",
+    "social_delete_post",
+    "social_comment_reply",
+    "social_linkedin_comment_add",
+    "social_linkedin_reaction_add",
+    "social_linkedin_comment_delete",
+    "social_post_reject",
+    "social_pillar_delete",
+    "social_hashtags_delete",
+    "social_calendar_delete",
+    "social_schedule_slot_delete",
+    "social_post_retry",
+    "webflow_project_cms_provider_set",
+    "webflow_site_publish",
+    "webflow_cms_item_publish",
+    "webflow_cms_item_unpublish",
+    "webflow_cms_item_delete",
+    "webflow_page_customcode_set",
+    "webflow_page_customcode_delete",
+    "webflow_cms_collection_delete",
+    "webflow_cms_field_delete",
+    "webflow_cms_item_unpublish_bulk",
+    "webflow_cms_item_delete_bulk",
+    "webflow_asset_delete",
+    "webflow_site_customcode_set",
+    "webflow_site_customcode_delete",
+    "webflow_hiveku_snippet_install",
+    "webflow_google_tag_upsert",
+    "webflow_google_tag_delete",
+    "webflow_form_submission_delete",
+    "webflow_webhook_create",
+    "webflow_webhook_update",
+    "webflow_webhook_delete",
+    "webflow_order_fulfill",
+    "webflow_order_refund",
+    "webflow_redirect_create",
+    "webflow_redirect_delete",
+    "webflow_robots_update",
+    "webflow_robots_replace",
+    "webflow_robots_delete",
+    "webflow_wellknown_create",
+    "webflow_wellknown_delete",
+    "webflow_llms_txt_set",
+    "webflow_llms_txt_delete",
+    "cms_publish",
+    "cms_delete_entry",
+    "cms_bulk_delete",
+    "cms_delete_collection",
+    "cms_remove_field"
+  ]
+}