@hiveku-apps/sync 0.3.5 → 0.4.0

package/src/codex-prompt-tools.json

@@ -0,0 +1,253 @@
+{
+  "source": "locus2012/hiveku-codex-plugin 0.1.16 (5b4e580), plugins/hiveku/.mcp.json: every hiveku.tools entry (all approval_mode \"prompt\"); plus project_vcs_rollback (Versions Wave 2, hiveku-codex-plugin feature/versions-wave2)",
+  "why": "hiveku-sync writes its own [mcp_servers.hiveku] into a Codex folder. Codex then uses that entry, not the plugin's, for the server's connection and for every tool's approval mode, so these prompts must be written here too. Refresh this list whenever the Codex plugin's prompt list changes.",
+  "tools": [
+    "deploy_site",
+    "deploy_run",
+    "project_files_bulk_save",
+    "project_vcs_commit",
+    "project_vcs_merge",
+    "project_vcs_pr_merge",
+    "project_vcs_env_bind",
+    "project_vcs_branch_delete",
+    "project_vcs_stash",
+    "project_vcs_prune",
+    "project_vcs_branch_preview_teardown",
+    "project_vcs_rollback",
+    "project_vcs_revert",
+    "hiveku_batch",
+    "project_checkpoint_restore",
+    "checkpoint_restore",
+    "history_restore_to_time",
+    "checkpoint_delete",
+    "site_delete",
+    "site_firewall_allow",
+    "site_firewall_remove",
+    "project_indexing_set",
+    "account_memory_append",
+    "memory_update",
+    "memory_delete",
+    "memory_restore_version",
+    "memory_bulk_create",
+    "content_publish_to_site",
+    "content_schedule",
+    "email_campaign_send_now",
+    "email_campaign_schedule",
+    "email_campaign_resend_non_openers",
+    "email_campaign_test_send",
+    "crm_envelope_send",
+    "crm_estimate_send",
+    "helpdesk_ticket_send_reply",
+    "marketing_report_send",
+    "ppc_budget_update",
+    "ppc_platform_budget_update",
+    "ppc_bid_modifier_update",
+    "ppc_keyword_bid_update",
+    "ppc_platform_keyword_bid_update",
+    "ppc_bidding_strategy_update",
+    "ppc_platform_bidding_strategy_update",
+    "ppc_campaign_create",
+    "ppc_google_auto_apply_set",
+    "ppc_google_campaign_settings_set",
+    "ppc_google_ad_schedule_set",
+    "ppc_google_audience_exclusions_set",
+    "ppc_google_call_settings_set",
+    "ppc_google_campaign_ai_settings_set",
+    "ppc_bing_campaign_ai_settings_set",
+    "ppc_google_ad_text_update",
+    "ppc_google_ads_text_replace",
+    "ppc_negatives_remove",
+    "ppc_bing_url_tracking_set",
+    "ppc_bing_ad_extension_update",
+    "ppc_bing_ad_extension_remove",
+    "ppc_bing_experiment_create",
+    "ppc_bing_experiment_update",
+    "ppc_experiment_promote",
+    "ppc_experiment_treatment_set",
+    "ppc_conversion_adjustments_run",
+    "ppc_conversion_adjustments_set",
+    "ppc_meta_lead_quality_test",
+    "ppc_experiment_schedule",
+    "ppc_experiment_graduate",
+    "ppc_offline_conversion_upload",
+    "ppc_customer_match_upload",
+    "ppc_goals_set",
+    "ppc_budget_target_set",
+    "ppc_connection_update",
+    "agent_approval_approve",
+    "seo_ga4_key_event_update",
+    "seo_ga4_event_create_rule_update",
+    "accounting_bill_record_payment",
+    "accounting_invoice_record_payment",
+    "crm_contact_email_send",
+    "crm_enroll_sequence",
+    "crm_sequence_enroll_bulk",
+    "email_sequence_enroll",
+    "email_sequence_activate",
+    "voice_sms_send",
+    "voice_sms_send_to_contact",
+    "voice_sms_thread_reply",
+    "crm_remove_dnc",
+    "outbound_campaign_status_set",
+    "outbound_campaign_sequences_save",
+    "outbound_reply_draft_send",
+    "voice_number_purchase",
+    "voice_number_release",
+    "voice_e911_address_create",
+    "voice_extension_delete",
+    "voice_ivr_create",
+    "voice_ivr_update",
+    "voice_ivr_delete",
+    "voice_ring_group_delete",
+    "voice_queue_delete",
+    "voice_pool_delete",
+    "voice_call_tracking_setup",
+    "voice_call_originate",
+    "voice_sms_bulk_send",
+    "voice_sms_brand_submit",
+    "voice_sms_campaign_submit",
+    "voice_sms_campaign_resubmit",
+    "voice_sms_campaign_delete",
+    "voice_sms_number_assign_campaign",
+    "voice_sms_toll_free_verification_submit",
+    "voice_port_order_create",
+    "voice_port_order_action",
+    "voice_settings_update",
+    "voice_number_update",
+    "voice_blocked_numbers_remove",
+    "voice_tenant_repair",
+    "voice_swap_test",
+    "voice_call_tracking_live_probe",
+    "voice_phone_tracking_config_set",
+    "voice_phone_tracking_config_delete",
+    "voice_pool_update",
+    "voice_pool_create",
+    "voice_pool_numbers_add",
+    "voice_pool_numbers_remove",
+    "voice_pool_e911_apply",
+    "voice_webhook_create",
+    "voice_webhook_update",
+    "voice_webhook_delete",
+    "voice_sms_registration_share_link_create",
+    "voice_sms_registration_share_link_revoke",
+    "voice_port_order_share_link_create",
+    "voice_port_order_share_link_revoke",
+    "voice_ivrs_reprovision",
+    "voice_ai_agent_config_update",
+    "voice_number_cnam_set",
+    "voice_sms_campaign_appeal",
+    "voice_port_order_verification_codes_send",
+    "voice_sms_scheduled_cancel",
+    "voice_numbers_search",
+    "seo_gbp_review_reply",
+    "seo_gbp_review_reply_delete",
+    "seo_gbp_location_update",
+    "seo_gbp_attributes_update",
+    "seo_gsc_delete_sitemap",
+    "seo_report_clear",
+    "seo_deliverable_delete",
+    "seo_task_implement",
+    "seo_connection_delete",
+    "seo_gbp_services_update",
+    "seo_gbp_media_add",
+    "seo_gbp_media_delete",
+    "seo_gtm_publish",
+    "seo_gtm_install",
+    "seo_ga4_key_event_delete",
+    "seo_ga4_event_create_rule_delete",
+    "seo_tracking_project_delete",
+    "seo_rankings_platforms_set",
+    "seo_listings_scan",
+    "seo_connection_test",
+    "seo_competitor_delete",
+    "seo_keyword_cluster_delete",
+    "seo_topic_cluster_delete",
+    "seo_backlink_tracker_delete",
+    "seo_backlink_opportunity_delete",
+    "seo_automated_report_delete",
+    "seo_page_schema_delete",
+    "workflow_run",
+    "workflow_enable",
+    "workflow_trigger_update",
+    "workflow_delete",
+    "workflow_delete_schedule",
+    "workflow_stranded_replay",
+    "workflow_run_replay",
+    "workflow_run_retry",
+    "workflow_dead_letter_resolve",
+    "workflow_set_recipient",
+    "hiveboard_restore_version",
+    "hiveboard_delete",
+    "hiveboard_elements_prune",
+    "customer_avatar_version_restore",
+    "before_after_grid_version_restore",
+    "customer_journey_version_restore",
+    "customer_avatar_delete",
+    "customer_journey_delete",
+    "before_after_grid_delete",
+    "customer_journey_stage_delete",
+    "media_delete",
+    "media_folder_delete",
+    "brand_guide_delete",
+    "brand_guide_purge",
+    "marketing_storyboard_delete",
+    "marketing_generate_video",
+    "marketing_video_pipeline_retry_scene",
+    "design_voiceover_create",
+    "generate_image_set",
+    "media_upscale",
+    "marketing_testimonial_media_replace",
+    "marketing_form_upload_settings_update",
+    "marketing_form_capture_settings_update",
+    "marketing_form_capture_purge",
+    "social_publish_post",
+    "social_delete_post",
+    "social_comment_reply",
+    "social_linkedin_comment_add",
+    "social_linkedin_reaction_add",
+    "social_linkedin_comment_delete",
+    "social_post_reject",
+    "social_pillar_delete",
+    "social_hashtags_delete",
+    "social_calendar_delete",
+    "social_schedule_slot_delete",
+    "social_post_retry",
+    "webflow_project_cms_provider_set",
+    "webflow_site_publish",
+    "webflow_cms_item_publish",
+    "webflow_cms_item_unpublish",
+    "webflow_cms_item_delete",
+    "webflow_page_customcode_set",
+    "webflow_page_customcode_delete",
+    "webflow_cms_collection_delete",
+    "webflow_cms_field_delete",
+    "webflow_cms_item_unpublish_bulk",
+    "webflow_cms_item_delete_bulk",
+    "webflow_asset_delete",
+    "webflow_site_customcode_set",
+    "webflow_site_customcode_delete",
+    "webflow_hiveku_snippet_install",
+    "webflow_google_tag_upsert",
+    "webflow_google_tag_delete",
+    "webflow_form_submission_delete",
+    "webflow_webhook_create",
+    "webflow_webhook_update",
+    "webflow_webhook_delete",
+    "webflow_order_fulfill",
+    "webflow_order_refund",
+    "webflow_redirect_create",
+    "webflow_redirect_delete",
+    "webflow_robots_update",
+    "webflow_robots_replace",
+    "webflow_robots_delete",
+    "webflow_wellknown_create",
+    "webflow_wellknown_delete",
+    "webflow_llms_txt_set",
+    "webflow_llms_txt_delete",
+    "cms_publish",
+    "cms_delete_entry",
+    "cms_bulk_delete",
+    "cms_delete_collection",
+    "cms_remove_field"
+  ]
+}

package/src/codex.mjs

@@ -17,8 +17,11 @@
  *                            the OLYMPUS_API_KEY env var). git-ignored.
  *   skill/command knowledge → .agents/skills/<name>/SKILL.md (repo-scoped; Codex
  *                            prompts are global-only + deprecated)
- *   permissions            → NO per-repo equivalent (Codex ignores approval/
- *                            sandbox keys in repo config) — stated in AGENTS.md.
+ *   permissions            → the hiveku server's per-tool approvals: a FIXED
+ *                            list of high-risk tools asks first
+ *                            (CODEX_PROMPT_TOOLS below), every other tool runs
+ *                            without asking. The safe-work rules are stated
+ *                            as instructions in AGENTS.md, for every tool.
  *
  * This complements the published Hiveku Codex plugin
  * (github.com/locus2012/hiveku-codex-plugin): the plugin ships the generic
@@ -29,27 +32,94 @@
  */
 
 import { readFile, writeFile, readdir, mkdir } from 'node:fs/promises';
-import { existsSync } from 'node:fs';
+import { existsSync, readFileSync } from 'node:fs';
 import { homedir } from 'node:os';
 import { join, resolve, dirname } from 'node:path';
 
+import { formatKey, readTomlDeclarations } from './toml.mjs';
 import { loadDotenv, safeSlug } from './util.mjs';
 
+/**
+ * The FIXED list of high-risk Hiveku tools that Codex asks about before
+ * running. It is the Hiveku Codex plugin's own prompt list, copied name for
+ * name (codex-prompt-tools.json says which release; 246 names at plugin
+ * 0.1.16, plus project_vcs_rollback from Versions Wave 2). It includes hiveku_batch, because Codex asks by the name of the tool
+ * it calls and a batch carries other tools.
+ *
+ * It is a list of names, not a category. Every tool not on it runs without
+ * asking under the "approve" default, and that includes many deletes and sends
+ * (at MCP d4a73ba6d, for example crm_delete_contact, content_delete,
+ * assets_delete, survey_send and accounting_invoice_send). That is why
+ * AGENTS.md keeps the safe-work rules as instructions for every tool.
+ *
+ * A listed tool does not always ask either. Codex checks the run mode before
+ * it reads a tool's approval_mode (codex-mcp mcp_permission_prompt_is_auto_approved):
+ *   - approval policy "never" (what `codex exec` sets) with a read-only or
+ *     workspace-write sandbox: nobody can answer, so a listed call is
+ *     cancelled and the rest run;
+ *   - approval policy "never" with no sandbox or full disk write
+ *     (--dangerously-bypass-approvals-and-sandbox, i.e. --yolo, or
+ *     danger-full-access in `codex exec`): every prompt is skipped, these
+ *     included, and every Hiveku tool runs unattended.
+ *
+ * Why this folder has to write it: the folder's .codex/config.toml defines
+ * [mcp_servers.hiveku]. Codex 0.131 then drops the plugin's server of the same
+ * name (core/src/config/mod.rs: configured servers win, plugin servers are
+ * only `or_insert`ed) and takes each tool's approval mode from the config
+ * layers alone (core/src/mcp_tool_call.rs custom_mcp_tool_approval_mode:
+ * tools.<tool>.approval_mode, else default_tools_approval_mode; the plugin is
+ * read only when no config layer names the server). With only
+ * default_tools_approval_mode = "approve" here, every Hiveku tool ran without
+ * a prompt, with or without the plugin installed.
+ *
+ * Adding another prompt list: put its names into this one Set, so each tool
+ * still gets exactly one table. A second block of tables would define some
+ * tables twice, and that makes the whole config.toml invalid TOML. (Versions
+ * Wave 2 did this: its five roll-back tools are in codex-prompt-tools.json,
+ * project_vcs_rollback included.)
+ *
+ * The user's own table wins: a listed tool that already has its own
+ * [mcp_servers.hiveku.tools.<tool>] table outside the managed block gets no
+ * table from us (userToolTables below), and writeCodexScaffold writes nothing
+ * when the block would still declare a table the file declares (blockConflict).
+ */
+export const CODEX_PROMPT_TOOLS = [
+  ...new Set(JSON.parse(readFileSync(new URL('./codex-prompt-tools.json', import.meta.url), 'utf8')).tools),
+];
+
+/** A TOML bare key when the name allows it, a quoted key otherwise. */
+function tomlKey(name) {
+  return /^[A-Za-z0-9_-]+$/.test(name) ? name : JSON.stringify(name);
+}
+
 const AGENTS_BEGIN = '<!-- hiveku:begin -->';
 const AGENTS_END = '<!-- hiveku:end -->';
 const TOML_BEGIN = '# hiveku:begin (managed by hiveku-sync — do not edit inside)';
 const TOML_END = '# hiveku:end';
 const SKILL_STAMP = '<!-- generated-by: hiveku-sync (mirrored from account knowledge) -->';
 
-/** Replace (or append) the marked region inside existing content. */
-function upsertMarkedRegion(existing, begin, end, region) {
+/**
+ * Replace (or append) the marked region inside existing content. Also says
+ * where: `start` is the region's offset in `text`, and `replaced` the old
+ * region it replaced (null when it was appended).
+ */
+function placeMarkedRegion(existing, begin, end, region) {
   const b = existing.indexOf(begin);
   const e = existing.indexOf(end);
   if (b !== -1 && e !== -1 && e > b) {
-    return existing.slice(0, b) + region + existing.slice(e + end.length);
+    return {
+      text: existing.slice(0, b) + region + existing.slice(e + end.length),
+      start: b,
+      replaced: existing.slice(b, e + end.length),
+    };
   }
   const sep = existing.length && !existing.endsWith('\n\n') ? (existing.endsWith('\n') ? '\n' : '\n\n') : '';
-  return existing + sep + region + '\n';
+  return { text: existing + sep + region + '\n', start: existing.length + sep.length, replaced: null };
+}
+
+/** Replace (or append) the marked region inside existing content. */
+function upsertMarkedRegion(existing, begin, end, region) {
+  return placeMarkedRegion(existing, begin, end, region).text;
 }
 
 /** AGENTS.md — lean on purpose (Codex caps the instruction chain at ~32KiB). */
@@ -78,6 +148,13 @@ Non-negotiables (also in CLAUDE.md, restated because they are load-bearing):
   — \`changed\` = they edited it, \`only_remote\` = they added files you lack). Before any tree-replace
   (\`delete_missing: true\`), \`dry_run\` first and READ the would-delete list — a file you did not send
   may be someone else's NEW work. Never blind-overwrite.
+- **Version every change.** After saving and verifying, call \`project_vcs_commit({ project_id, message })\`
+  with NO files, once per change, before \`deploy_site\` (or \`hiveku-sync push -m "..."\`, which does both);
+  409 \`nothing_to_commit\` means it is already a version: not an error.
+  The name is plain language for the site owner ("Updated the pricing section on the Home page"): never file
+  paths, extensions, \`fix:\` prefixes or tool names. Roll back with \`project_vcs_rollback\`: dry run first,
+  apply only after the user agrees, with the dry run's \`head_commit_id\` as \`expected_head_commit_id\` (on Your
+  site also its \`live_fingerprint\` as \`expected_live_fingerprint\`); publishing is a separate \`deploy_site\`.
 - **Keep ALL scratch work in \`.hiveku/tmp/\`** — never \`/tmp\` (shared across accounts), your home
   dir, or the repo root.
 - **Never ingest local agent config into a project push.** \`.codex/config.toml\`, \`.mcp.json\`, and
@@ -94,13 +171,117 @@ Non-negotiables (also in CLAUDE.md, restated because they are load-bearing):
 - Video generation is paid + capped — \`marketing_generate_video\` with \`dry_run: true\` first.
 
 Discover tools with \`hiveku_docs_search\` / \`hiveku_docs_get\` and \`hiveku_playbooks_list\` /
-\`hiveku_playbook_get\`. Codex ignores repo-level approval/sandbox config, so the rules above are
-instructions, not enforced permissions — follow them.
+\`hiveku_playbook_get\`. Codex asks the user first only for a fixed list of ${CODEX_PROMPT_TOOLS.length} high-risk Hiveku
+tools (hiveku-sync's \`codex-prompt-tools.json\`, the Hiveku Codex plugin's list, written as per-tool
+prompts in \`.codex/config.toml\`). Every other Hiveku tool, including many deletes and sends, runs
+without asking, and some Codex modes (\`--yolo\`, \`danger-full-access\`) skip even those prompts. So
+never count on a prompt: the rules above are instructions, not enforced permissions — follow them for
+every tool.
 ${AGENTS_END}`;
 }
 
+/**
+ * The listed tools whose table the user's own settings already declare
+ * outside the managed block, in list order. Writing ours as well would
+ * declare that table twice, which TOML does not allow, so theirs wins.
+ *
+ * A tool's table is declared by a [mcp_servers.hiveku.tools.<tool>] or
+ * [[...]] header, however it is spelled (quoted parts, spaces), or by a key
+ * that sets it from a table above it: `<tool> = { ... }` or
+ * `<tool>.approval_mode = ...` under [mcp_servers.hiveku.tools]. A header one
+ * level deeper ([...tools.<tool>.x]) does not declare it, so it does not count.
+ * The file is read as Codex reads it (TOML 1.1 syntax, a byte-order mark at
+ * the start); a line that cannot be read is skipped.
+ *
+ * `withoutApprovalMode`: those whose own table sets no approval_mode, so
+ * Codex uses the server default ("approve") for them.
+ */
+function userToolTables(existing) {
+  const text = existing.replace(/\r\n/g, '\n');
+  const begin = text.indexOf(TOML_BEGIN);
+  const end = text.indexOf(TOML_END);
+  const blockEnd = begin !== -1 && end > begin ? end + TOML_END.length : -1;
+  const found = new Map(); // tool -> { declared, setsMode, notATable }
+  for (const statement of readTomlDeclarations(text).statements) {
+    if (blockEnd !== -1 && statement.pos >= begin && statement.pos < blockEnd) continue; // ours
+    const keyval = statement.type === 'keyval';
+    const key = keyval ? [...statement.header, ...statement.key] : statement.key;
+    if (key.length < 4 || key[0] !== 'mcp_servers' || key[1] !== 'hiveku' || key[2] !== 'tools') continue;
+    const entry = found.get(key[3]) ?? { declared: false, setsMode: false, notATable: false };
+    if (keyval ? statement.header.length < 4 : key.length === 4) entry.declared = true;
+    if (key[4] === 'approval_mode') entry.setsMode = true;
+    if (keyval && key.length === 4) {
+      if (statement.value !== 'table') entry.notATable = true;
+      else if (statement.tableKeys.includes('approval_mode')) entry.setsMode = true;
+    }
+    if (statement.type === 'arrayTable' && key.length === 4) entry.notATable = true;
+    found.set(key[3], entry);
+  }
+  const tools = CODEX_PROMPT_TOOLS.filter((tool) => found.get(tool)?.declared);
+  const withoutApprovalMode = tools.filter((tool) => !found.get(tool).setsMode && !found.get(tool).notATable);
+  return { tools, withoutApprovalMode };
+}
+
+/**
+ * Where the update would declare a table or key twice with one of the two in
+ * hiveku-sync's own block: the one way writing the block can break a file.
+ * Returns the first such place as { ours, line }, `ours` being the block's
+ * statement and `line` the other declaration's line in `existing` (the file
+ * as it is now), or null. A problem in the rest of the file is the user's own
+ * and not a reason to stop: the block is written as before.
+ *
+ * `placed` is placeMarkedRegion's result for `region` in `existing`.
+ */
+function blockConflict(existing, placed, region) {
+  const normalize = (text) => text.replace(/\r\n/g, '\n');
+  const start = normalize(placed.text.slice(0, placed.start)).length;
+  const end = start + region.length;
+  const inBlock = (statement) => statement !== null && statement.pos >= start && statement.pos < end;
+  // Text before the block is as it was; text after it moved by the old block's length less the new one's.
+  const before = normalize(existing);
+  const oldLength = placed.replaced === null ? 0 : normalize(placed.replaced).length;
+  const lineNow = (pos) => before.slice(0, pos < start ? pos : pos - end + start + oldLength).split('\n').length;
+  for (const { statement, prior } of readTomlDeclarations(normalize(placed.text)).conflicts) {
+    if (!inBlock(statement) && !inBlock(prior)) continue;
+    const theirs = inBlock(statement) ? prior : statement;
+    return { ours: inBlock(statement) ? statement : prior, line: theirs && !inBlock(theirs) ? lineNow(theirs.pos) : null };
+  }
+  return null;
+}
+
+/**
+ * The error for an update blockConflict refused. It names the block's own
+ * table or key (hiveku-sync's names) and only the line number of the user's,
+ * so nothing the user typed is repeated (a pasted secret, say).
+ */
+function refusalMessage(tomlPath, existing, { ours, line }) {
+  const name =
+    ours.type === 'keyval' ? `the key ${formatKey([...ours.header, ...ours.key])}` : `the table [${formatKey(ours.key)}]`;
+  const where = line ? `line ${line} of it` : 'a line of it';
+  const lines = [
+    `${tomlPath} was not updated: ${where} conflicts with ${name} in the hiveku-sync block, and a TOML file may declare each table and key only once. Nothing in the folder was changed.`,
+  ];
+  const begin = existing.indexOf(TOML_BEGIN);
+  if (begin !== -1 && existing.indexOf(TOML_BEGIN, begin + 1) !== -1) {
+    lines.push('The file has more than one "# hiveku:begin" line, so hiveku-sync could not tell which block is its own. Keep one block, then run `hiveku-sync codex` again.');
+  } else if (begin !== -1 && !(existing.indexOf(TOML_END) > begin)) {
+    lines.push('hiveku-sync could not find its own block to replace: the "# hiveku:begin" line has no "# hiveku:end" line after it. Put "# hiveku:end" back at the end of the block, then run `hiveku-sync codex` again.');
+  } else {
+    lines.push(`Remove or change ${line ? `line ${line}` : 'that line'}, then run \`hiveku-sync codex\` again.`);
+  }
+  return lines.join(' ');
+}
+
+/** A TOML basic string holding `value`: quotes, backslashes and control characters other than tab escaped. */
+function tomlString(value) {
+  const escaped = value.replace(/["\\\x00-\x08\x0a-\x1f\x7f]/g, (ch) =>
+    ch === '"' || ch === '\\' ? `\\${ch}` : `\\u${ch.charCodeAt(0).toString(16).toUpperCase().padStart(4, '0')}`,
+  );
+  return `"${escaped}"`;
+}
+
 /** The [mcp_servers.*] region for <folder>/.codex/config.toml. */
-function codexTomlRegion({ baseUrl, profile, apiKey }) {
+function codexTomlRegion({ baseUrl, profile, apiKey, userTables = [] }) {
   const base = baseUrl.replace(/\/+$/, '');
   const url = profile === 'full' ? `${base}/mcp` : `${base}/mcp?profile=${encodeURIComponent(profile)}`;
   // Prefer an inlined key (self-contained, no env setup needed; the file is
@@ -113,20 +294,38 @@ function codexTomlRegion({ baseUrl, profile, apiKey }) {
   // to bearer_token_env_var). TOML allows the key once per table, so the
   // client label rides in the same inline table as an inlined key.
   // X-Hiveku-Client: codex is what the MCP server's memory log shows as
-  // "via Codex"; it is a label, never authentication.
+  // "via Codex"; it is a label, never authentication. The key and the URL come
+  // from .env, so they are escaped: a quote in either would otherwise end the
+  // string early and leave the block itself unreadable.
   const auth = apiKey
-    ? `http_headers = { "Authorization" = "Bearer ${apiKey}", "X-Hiveku-Client" = "codex" }`
+    ? `http_headers = { "Authorization" = ${tomlString(`Bearer ${apiKey}`)}, "X-Hiveku-Client" = "codex" }`
     : `bearer_token_env_var = "OLYMPUS_API_KEY"\nhttp_headers = { "X-Hiveku-Client" = "codex" }`;
   // default_tools_approval_mode = "approve": this folder exists so the agent
-  // can operate the account — per-call approval prompts would also auto-cancel
-  // every tool call in headless `codex exec` (CI/cron), this lane's core use.
-  // (Enum is approve|prompt; the docs' "auto" is not accepted by codex 0.131.)
+  // can operate the account — per-call approval prompts would also cancel
+  // every tool call in headless `codex exec` (CI/cron, this lane's core use)
+  // under a read-only or workspace-write sandbox.
+  // The per-tool tables after it override that default for CODEX_PROMPT_TOOLS
+  // (a tool's own approval_mode wins over the server default), so those ask
+  // first, exactly as they do under the Hiveku Codex plugin, in the modes where
+  // Codex asks at all (see CODEX_PROMPT_TOOLS). Each tool gets ONE table: a
+  // table defined twice makes the whole file invalid TOML, so merge any other
+  // prompt list into CODEX_PROMPT_TOOLS instead of adding tables here, and
+  // leave out the tools whose table the user declares outside this block
+  // (userTables): their own setting wins.
+  const skip = new Set(userTables);
+  const promptTables = CODEX_PROMPT_TOOLS.filter((tool) => !skip.has(tool))
+    .map((tool) => `[mcp_servers.hiveku.tools.${tomlKey(tool)}]\napproval_mode = "prompt"`)
+    .join('\n');
   return `${TOML_BEGIN}
 [mcp_servers.hiveku]
-url = "${url}"
+url = ${tomlString(url)}
 ${auth}
 default_tools_approval_mode = "approve"
 
+# Ask first: a fixed list of high-risk tools (the Hiveku Codex plugin's list).
+# Every other hiveku tool runs without asking.
+${promptTables}
+
 [mcp_servers.playwright]
 command = "npx"
 args = ["-y", "@playwright/mcp@latest"]
@@ -211,6 +410,10 @@ export async function mirrorKnowledgeToSkills(folder) {
  * .codex/config.toml (git-ignored) + mirror the account's knowledge to skills.
  * Resolves OLYMPUS_API_KEY from the folder's .env / process env to inline the
  * MCP auth when possible.
+ *
+ * Throws, with nothing in the folder written, when the hiveku-sync block would
+ * declare a table or key that the rest of config.toml also declares (see
+ * blockConflict). The updated file is checked in memory, before any write.
  */
 export async function writeCodexScaffold({ folder, slug, baseUrl, profile }) {
   // The FOLDER's .env wins over a process-level export: folder = tenant
@@ -222,6 +425,24 @@ export async function writeCodexScaffold({ folder, slug, baseUrl, profile }) {
     dotenv.OLYMPUS_API_KEY && dotenv.OLYMPUS_API_KEY !== 'olp_replace_me' ? dotenv.OLYMPUS_API_KEY : '';
   const apiKey = dotenvKey || (existsSync(join(folder, '.env')) ? '' : process.env.OLYMPUS_API_KEY || '');
 
+  // .codex/config.toml (marker-managed region; rest of user's config untouched).
+  // First, and checked in memory before anything is written, so that a refused
+  // update leaves the whole folder as it was (no .codex/ folder created either).
+  const tomlPath = join(folder, '.codex', 'config.toml');
+  let toml = '';
+  try {
+    toml = await readFile(tomlPath, 'utf8');
+  } catch (err) {
+    if (err.code !== 'ENOENT') throw err;
+  }
+  const userTables = userToolTables(toml);
+  const region = codexTomlRegion({ baseUrl, profile, apiKey, userTables: userTables.tools });
+  const placed = placeMarkedRegion(toml, TOML_BEGIN, TOML_END, region);
+  const conflict = blockConflict(toml, placed, region);
+  if (conflict) throw new Error(refusalMessage(tomlPath, toml, conflict));
+  await mkdir(dirname(tomlPath), { recursive: true });
+  await writeFile(tomlPath, placed.text, 'utf8');
+
   // AGENTS.md (marker-managed)
   const agentsPath = join(folder, 'AGENTS.md');
   let agents = '';
@@ -232,17 +453,6 @@ export async function writeCodexScaffold({ folder, slug, baseUrl, profile }) {
   }
   await writeFile(agentsPath, upsertMarkedRegion(agents, AGENTS_BEGIN, AGENTS_END, agentsMdRegion({ slug })), 'utf8');
 
-  // .codex/config.toml (marker-managed region; rest of user's config untouched)
-  const tomlPath = join(folder, '.codex', 'config.toml');
-  let toml = '';
-  try {
-    toml = await readFile(tomlPath, 'utf8');
-  } catch {
-    /* new */
-  }
-  await mkdir(dirname(tomlPath), { recursive: true });
-  await writeFile(tomlPath, upsertMarkedRegion(toml, TOML_BEGIN, TOML_END, codexTomlRegion({ baseUrl, profile, apiKey })), 'utf8');
-
   // Gitignore EVERY credential-bearing file this lane depends on — not just the
   // one we write. The retrofit reads .env for OLYMPUS_API_KEY to inline it, so a
   // folder that had no .gitignore would otherwise end up with one that ignores
@@ -253,7 +463,14 @@ export async function writeCodexScaffold({ folder, slug, baseUrl, profile }) {
   await appendGitignoreLines(folder, ['.codex/config.toml', '.env', '.env.local', '.hiveku/']);
 
   const skills = await mirrorKnowledgeToSkills(folder);
-  return { inlinedKey: !!apiKey, skillsMirrored: skills };
+  // userToolTables: listed tools left to the user's own table (the CLI names
+  // them); userTablesWithoutApprovalMode: those whose table sets no approval_mode.
+  return {
+    inlinedKey: !!apiKey,
+    skillsMirrored: skills,
+    userToolTables: userTables.tools,
+    userTablesWithoutApprovalMode: userTables.withoutApprovalMode,
+  };
 }
 
 /**