@hiveku-apps/sync 0.5.14 → 0.5.18

package/README.md

@@ -12,7 +12,9 @@ Local sync CLI for a Hiveku account. Pairs with the Hiveku MCP server at
    It also writes the account memory (see "Account memory" below) to
    `hiveku-data/account/ACCOUNT_MEMORY.md`, read-only, and brings the folder
    layout, the memory rules and the plan rules in `CLAUDE.md` up to date (see
-   "CLAUDE.md stays current" below).
+   "CLAUDE.md stays current" below). In a Codex folder it also brings the
+   ask-first prompts in `.codex/config.toml` up to date (see "Codex (OpenAI)
+   support" below).
 
 The goal: open one folder per Hiveku tenant in VS Code with Claude Code,
 with the account's memory mirrored as local `.md` files Claude can read
@@ -126,12 +128,24 @@ the last `pull` wrote under `rules/<agent>/` (never those in
 `rules/<agent>/not-followed/`). Run `hiveku-sync codex` after `pull` to refresh it
 (`pull` reminds you when the folder has a Codex lane).
 
+**`pull` keeps the ask-first prompts current.** When `.codex/config.toml` has
+the hiveku-sync block, every `pull` brings that block up to date exactly as
+`hiveku-sync codex` would write it, so a tool added to the ask-first list asks
+in the folder after its next pull, and the pull names the tools that ask now.
+It takes the key from `.env` as `hiveku-sync codex` does, and says so when that
+changes the key Codex uses. The rules below still hold: your own tool tables
+win, and a block that would declare a table or key twice is not written. Then
+the pull ends with an error (exit 2) that names the line to fix and the listed
+tools that run without asking until you do. `pull` never creates
+`.codex/config.toml` or a block in it, and it leaves `AGENTS.md` and
+`.agents/skills/` to `hiveku-sync codex`.
+
 Pass `--trust` to pre-trust the folder in `~/.codex/config.toml` (so Codex loads
 the repo config without its first-run trust prompt).
 
 **Approvals.** Codex asks first only for a **fixed list** of high-risk Hiveku
-tools: the 278 names in `src/codex-prompt-tools.json`, the same list as the
-Hiveku Codex plugin 0.3.13. It includes `deploy_site`, `site_delete`,
+tools: the 328 names in `src/codex-prompt-tools.json`, the same list as the
+Hiveku Codex plugin 0.3.46. It includes `deploy_site`, `site_delete`,
 `project_files_bulk_save` and every `hiveku_batch`, and it is written as
 `[mcp_servers.hiveku.tools.<tool>] approval_mode = "prompt"`. **Every other tool
 on the `hiveku` server runs without asking** (`default_tools_approval_mode =
@@ -181,13 +195,17 @@ Headless and bypass modes:
 
 Folders set up by a hiveku-sync without these prompts (0.3.5 and earlier)
 approve every tool: run `hiveku-sync codex` in them once, with a release that has
-them, to add the prompts.
+them, to add the prompts. From 0.5.18 a `pull` adds them too.
 
 > **This vs. the plugin.** For a single account, you can instead install the
 > published [Hiveku Codex plugin](https://github.com/locus2012/hiveku-codex-plugin)
-> once (`codex plugin marketplace add locus2012/hiveku-codex-plugin` then
-> `codex plugin add hiveku@hiveku`) and set
-> `HIVEKU_TOKEN`. `hiveku-sync --codex` is the self-contained, per-account route —
+> once (`codex plugin marketplace add locus2012/hiveku-codex-plugin`, then
+> `codex plugin add hiveku@hiveku`, then `codex plugin add hiveku-hooks@hiveku`)
+> and set `HIVEKU_TOKEN`. Already have Hiveku in Codex? Run
+> `codex plugin marketplace upgrade hiveku` before these commands. The first
+> time, Codex asks you to approve Hiveku's hooks: type `/hooks` in Codex and
+> trust them.
+> `hiveku-sync --codex` is the self-contained, per-account route:
 > better for multi-account / CI / power-user setups, and it also brings the
 > account's own knowledge. Use one route per folder, not both.
 

package/bin/hiveku-sync.mjs

@@ -10,7 +10,7 @@
 
 import { runInit } from '../src/init.mjs';
 import { runCodex } from '../src/init.mjs';
-import { runPull } from '../src/pull.mjs';
+import { runPull, toolNames } from '../src/pull.mjs';
 import {
   runProjectsList,
   runPullProject,
@@ -86,8 +86,10 @@ Memory/rules/skills:
                                     that owns each one (<type>/<agent>/, and
                                     <type>/shared/ for every agent). Brings the
                                     folder layout and memory rules in CLAUDE.md
-                                    up to date. Reads OLYMPUS_API_KEY and
-                                    OLYMPUS_BASE_URL from ./.env.
+                                    up to date, and in a Codex folder the
+                                    ask-first prompts in .codex/config.toml.
+                                    Reads OLYMPUS_API_KEY and OLYMPUS_BASE_URL
+                                    from ./.env.
   codex [<folder>] [--trust]        Retrofit an existing account folder with the
                                     Codex lane (AGENTS.md + .codex/config.toml +
                                     mirror the account's skills/commands to
@@ -96,7 +98,13 @@ Memory/rules/skills:
                                     Hiveku Codex plugin (single-account users can
                                     instead run: codex plugin marketplace add
                                     locus2012/hiveku-codex-plugin, then:
-                                    codex plugin add hiveku@hiveku).
+                                    codex plugin add hiveku@hiveku, then:
+                                    codex plugin add hiveku-hooks@hiveku.
+                                    Already have Hiveku in Codex? Run
+                                    codex plugin marketplace upgrade hiveku
+                                    before these commands. The first time,
+                                    Codex asks you to approve Hiveku's hooks:
+                                    type /hooks in Codex and trust them).
 
 Coder projects:
   projects                          List the account's coder projects.
@@ -187,6 +195,30 @@ function userToolTablesLines({ userToolTables = [], userTablesWithoutApprovalMod
   return lines;
 }
 
+/**
+ * What `pull` did to the hiveku-sync block of .codex/config.toml
+ * (refreshCodexConfig), as lines to print: only when it wrote the block. A
+ * block it could not write is printed with the errors, and a current block or
+ * a folder with none says nothing.
+ */
+export function codexConfigLines(result) {
+  if (result?.status !== 'updated') return [];
+  const from = result.release ? ` (hiveku-sync ${result.release} wrote it)` : '';
+  const lines = [`  Codex: brought the hiveku-sync block in .codex/config.toml up to date${from}.`];
+  const added = result.added ?? [];
+  if (added.length) {
+    lines.push(`    It now also asks first before ${toolNames(added)}.`);
+  }
+  const AUTH = {
+    inlined: 'MCP auth: it now carries the OLYMPUS_API_KEY from .env (it read the OLYMPUS_API_KEY env var before).',
+    'env-var': 'MCP auth: it now reads the OLYMPUS_API_KEY env var, because .env has no key to put in it.',
+    key: 'MCP auth: it now carries the OLYMPUS_API_KEY from .env, which is not the key it held before.',
+  };
+  if (AUTH[result.auth]) lines.push(`    ${AUTH[result.auth]}`);
+  for (const line of userToolTablesLines(result)) lines.push(`    ${line}`);
+  return lines;
+}
+
 /**
  * What refreshing CLAUDE.md's kept-current part (folder layout and memory
  * rules, claude-md.mjs) did, as lines to print. Nothing when it was already
@@ -333,6 +365,7 @@ async function main() {
         console.log('They were left on disk. Delete them manually if no longer needed.');
       }
       for (const line of claudeMdLines(summary.claude_md)) console.log(line);
+      for (const line of codexConfigLines(summary.codex_config)) console.log(line);
       if (summary.codex_lane) {
         console.log('\nCodex: run `hiveku-sync codex` to refresh the rules list in AGENTS.md and the skills in .agents/skills/.');
       }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@hiveku-apps/sync",
-  "version": "0.5.14",
+  "version": "0.5.18",
   "description": "Sync a Hiveku account's memory/rules/skills + coder projects into a local folder, and ship projects (push/deploy/pull-env) from the terminal. Pairs with the Hiveku MCP at core.hiveku.com/mcp so Claude Code can drive Hiveku tools per-folder.",
   "type": "module",
   "license": "MIT",

package/src/codex-prompt-tools.json

@@ -1,5 +1,5 @@
 {
-  "source": "locus2012/hiveku-codex-plugin 0.3.41 (3974fee, on main 616e72b), plugins/hiveku/.mcp.json: every hiveku.tools entry with approval_mode \"prompt\" (project_vcs_rollback included)",
+  "source": "locus2012/hiveku-codex-plugin feature/ask-loa-send (0.3.46, on main d667b1b), plugins/hiveku/.mcp.json: every hiveku.tools entry with approval_mode \"prompt\" (project_vcs_rollback included)",
   "why": "hiveku-sync writes its own [mcp_servers.hiveku] into a Codex folder. Codex then uses that entry, not the plugin's, for the server's connection and for every tool's approval mode, so these prompts must be written here too. Refresh this list whenever the Codex plugin's prompt list changes.",
   "tools": [
     "deploy_site",
@@ -82,6 +82,13 @@
     "helpdesk_assistant_knowledge_sources_update",
     "helpdesk_contact_data_erase",
     "helpdesk_chat_retention_set",
+    "helpdesk_social_comments_settings_update",
+    "voice_site_create",
+    "voice_role_assign",
+    "voice_role_remove",
+    "voice_api_key_create",
+    "voice_api_key_revoke",
+    "voice_desk_phone_set",
     "marketing_report_send",
     "ppc_budget_update",
     "ppc_platform_budget_update",
@@ -177,6 +184,8 @@
     "voice_sms_toll_free_verification_submit",
     "voice_port_order_create",
     "voice_port_order_action",
+    "voice_port_order_document_upload",
+    "voice_port_order_loa_send",
     "voice_settings_update",
     "voice_number_update",
     "voice_blocked_numbers_remove",

package/src/codex.mjs

@@ -27,6 +27,11 @@
  *                            without asking. The safe-work rules are stated
  *                            as instructions in AGENTS.md, for every tool.
  *
+ * `hiveku-sync pull` rewrites the .codex/config.toml block too, when the file
+ * has one (refreshCodexConfig, the same step as `hiveku-sync codex`), so a
+ * tool added to the ask-first list asks in an existing folder after its next
+ * pull, not only after someone remembers to run `hiveku-sync codex`.
+ *
  * This complements the published Hiveku Codex plugin
  * (github.com/locus2012/hiveku-codex-plugin): the plugin ships the generic
  * `hiveku` MCP server + doctrine skills for single-account users who install it
@@ -98,6 +103,20 @@ export const CODEX_PROMPT_TOOLS = [
 /** This package's version, as published (package.json ships in every npm package). */
 export const SYNC_VERSION = JSON.parse(readFileSync(new URL('../package.json', import.meta.url), 'utf8')).version;
 
+/** The Hiveku MCP host a folder uses when its .env names none. */
+export const DEFAULT_BASE_URL = 'https://core.hiveku.com';
+
+/**
+ * The URL and profile a folder's Codex lane is written with: the folder's own
+ * .env (OLYMPUS_BASE_URL, HIVEKU_PROFILE), else the defaults. `hiveku-sync
+ * codex` and `pull` both read them here, so a pull writes the block exactly as
+ * `hiveku-sync codex` would.
+ */
+export async function codexLaneSettings(folder) {
+  const dotenv = await loadDotenv(join(folder, '.env'));
+  return { baseUrl: dotenv.OLYMPUS_BASE_URL || DEFAULT_BASE_URL, profile: dotenv.HIVEKU_PROFILE || 'full' };
+}
+
 /**
  * X-Hiveku-Client for the folder's [mcp_servers.hiveku]: `hiveku-sync/<version>`,
  * the declaration that this config asks a person before project_secrets_reveal
@@ -300,13 +319,16 @@ function blockConflict(existing, placed, region) {
  * The error for an update blockConflict refused. It names the block's own
  * table or key (hiveku-sync's names) and only the line number of the user's,
  * so nothing the user typed is repeated (a pasted secret, say).
+ * `folderUnchanged`: `hiveku-sync codex` writes nothing in the folder when it
+ * refuses, and says so; `pull` has written the pulled files by then, so it
+ * passes false.
  */
-function refusalMessage(tomlPath, existing, { ours, line }) {
+function refusalMessage(tomlPath, existing, { ours, line }, { folderUnchanged = true } = {}) {
   const name =
     ours.type === 'keyval' ? `the key ${formatKey([...ours.header, ...ours.key])}` : `the table [${formatKey(ours.key)}]`;
   const where = line ? `line ${line} of it` : 'a line of it';
   const lines = [
-    `${tomlPath} was not updated: ${where} conflicts with ${name} in the hiveku-sync block, and a TOML file may declare each table and key only once. Nothing in the folder was changed.`,
+    `${tomlPath} was not updated: ${where} conflicts with ${name} in the hiveku-sync block, and a TOML file may declare each table and key only once.${folderUnchanged ? ' Nothing in the folder was changed.' : ''}`,
   ];
   const begin = existing.indexOf(TOML_BEGIN);
   if (begin !== -1 && existing.indexOf(TOML_BEGIN, begin + 1) !== -1) {
@@ -624,25 +646,175 @@ export async function rulesDigest(folder) {
   return [...head, ...lines].join('\n');
 }
 
+/**
+ * The key a folder's block inlines, or '' to read the OLYMPUS_API_KEY env var.
+ * The FOLDER's .env wins over a process-level export: folder = tenant
+ * boundary, and a globally exported key for account A must never get inlined
+ * into account B's config during a retrofit. process.env is only a fallback
+ * for folders that keep no .env at all.
+ */
+async function folderApiKey(folder) {
+  const dotenv = await loadDotenv(join(folder, '.env'));
+  const dotenvKey =
+    dotenv.OLYMPUS_API_KEY && dotenv.OLYMPUS_API_KEY !== 'olp_replace_me' ? dotenv.OLYMPUS_API_KEY : '';
+  return dotenvKey || (existsSync(join(folder, '.env')) ? '' : process.env.OLYMPUS_API_KEY || '');
+}
+
+/** Every credential-bearing file the Codex lane depends on (see writeCodexScaffold). */
+const CREDENTIAL_IGNORES = ['.codex/config.toml', '.env', '.env.local', '.hiveku/'];
+
+/**
+ * The one .codex/config.toml step, shared by `hiveku-sync codex` (through
+ * writeCodexScaffold) and `pull` (refreshCodexConfig): `existing` with the
+ * hiveku-sync block replaced (or appended) for this release, checked in
+ * memory and not written. Listed tools whose table the user declares outside
+ * the block are left to that table (userToolTables). `conflict` is set
+ * (blockConflict) when the block would declare a table or key that the rest
+ * of the file also declares: then the text must not be written.
+ */
+function planCodexConfig({ existing, baseUrl, profile, apiKey }) {
+  const userTables = userToolTables(existing);
+  const region = codexTomlRegion({ baseUrl, profile, apiKey, userTables: userTables.tools });
+  const placed = placeMarkedRegion(existing, TOML_BEGIN, TOML_END, region);
+  return { text: placed.text, userTables, conflict: blockConflict(existing, placed, region) };
+}
+
+/**
+ * The tools that `text` gives a prompt table the way hiveku-sync writes one in
+ * its block, `[mcp_servers.hiveku.tools.<tool>]` followed by
+ * `approval_mode = "prompt"`, wherever they are in the file.
+ */
+function promptTables(text) {
+  const asked = new Set();
+  for (const hit of text.replace(/\r\n/g, '\n').matchAll(/^\[mcp_servers\.hiveku\.tools\.([A-Za-z0-9_-]+)\]\napproval_mode = "prompt"$/gm)) {
+    asked.add(hit[1]);
+  }
+  return asked;
+}
+
+/** The hiveku-sync block in `text`, to its end line or the end of the file; '' when there is none. */
+function blockText(text) {
+  const begin = text.indexOf(TOML_BEGIN);
+  if (begin === -1) return '';
+  const end = text.indexOf(TOML_END, begin);
+  return text.slice(begin, end === -1 ? undefined : end);
+}
+
+/**
+ * The hiveku-sync release the block in `text` declares in X-Hiveku-Client
+ * (`hiveku-sync/<version>`), or null: a block that sends the plain `codex`
+ * label, or one an older release wrote without the header, does not say.
+ */
+function blockRelease(text) {
+  return blockText(text).match(/"X-Hiveku-Client" = "hiveku-sync\/([0-9A-Za-z.+-]+)"/)?.[1] ?? null;
+}
+
+/**
+ * How the block in `text` authenticates: its inlined Authorization value, or
+ * 'env' when it reads the OLYMPUS_API_KEY env var. Compared in memory only,
+ * never returned or printed: the value is the account's key.
+ */
+function blockAuth(text) {
+  const block = blockText(text);
+  const inlined = block.match(/"Authorization" = ("(?:[^"\\]|\\.)*")/);
+  if (inlined) return inlined[1];
+  return /^bearer_token_env_var = "OLYMPUS_API_KEY"$/m.test(block) ? 'env' : null;
+}
+
+/**
+ * What a rewrite changed in how the folder's Codex reaches Hiveku, so `pull`
+ * can say it (the key comes from the folder's .env, as for `hiveku-sync
+ * codex`): 'inlined' (it read the env var before), 'env-var' (it inlined a
+ * key before, and .env has none to inline now), 'key' (another key), or null.
+ */
+function authChange(before, after) {
+  const was = blockAuth(before);
+  const now = blockAuth(after);
+  if (was === now || now === null) return null;
+  if (now === 'env') return 'env-var';
+  return was === 'env' ? 'inlined' : 'key';
+}
+
+/**
+ * `hiveku-sync pull` in a Codex folder: rewrite the hiveku-sync block of
+ * .codex/config.toml exactly as `hiveku-sync codex` would (planCodexConfig:
+ * the user's own tool tables win, and a block that would declare a table or
+ * key twice is refused with nothing written). Without this, a folder kept the
+ * prompt list of the release that last ran `hiveku-sync codex` there, and its
+ * own [mcp_servers.hiveku] approves every other tool, so a tool added to the
+ * list since ran without asking (review of #29, 2026-10-29).
+ *
+ * It never creates the file or a block: a folder with neither has no
+ * [mcp_servers.hiveku] of hiveku-sync's for Codex to use. It does not touch
+ * AGENTS.md or the mirrored skills (`hiveku-sync codex` does).
+ *
+ * Returns { status } and what to say:
+ *   'no-block'  no .codex/config.toml, or no hiveku-sync block in it;
+ *   'current'   the block is what this release writes; nothing written;
+ *   'updated'   written. `added`: listed tools that ask now and did not
+ *               before; `release`: the hiveku-sync that wrote the old block;
+ *               `auth`: authChange's word, or null; userToolTables /
+ *               userTablesWithoutApprovalMode as writeCodexScaffold returns
+ *               them;
+ *   'refused'   blockConflict: nothing written. `message` says why and what
+ *               to do; `notAsking`: listed tools the file gives no prompt and
+ *               no table of the user's own, when Codex can read the file as it
+ *               is (null when a line cannot be read or something is declared
+ *               twice already, so Codex cannot load it); `release` as above;
+ *   'failed'    the file could not be read or written: `message`.
+ */
+export async function refreshCodexConfig(folder) {
+  const tomlPath = join(folder, '.codex', 'config.toml');
+  let existing;
+  try {
+    existing = await readFile(tomlPath, 'utf8');
+  } catch (err) {
+    if (err.code === 'ENOENT') return { status: 'no-block' };
+    return { status: 'failed', message: `${tomlPath} could not be read: ${err.message}` };
+  }
+  if (!existing.includes(TOML_BEGIN)) return { status: 'no-block' };
+  const { baseUrl, profile } = await codexLaneSettings(folder);
+  const apiKey = await folderApiKey(folder);
+  const asked = promptTables(existing);
+  const release = blockRelease(existing);
+  const plan = planCodexConfig({ existing, baseUrl, profile, apiKey });
+  if (plan.conflict) {
+    const message = refusalMessage(tomlPath, existing, plan.conflict, { folderUnchanged: false });
+    const { conflicts, unreadLines } = readTomlDeclarations(existing.replace(/\r\n/g, '\n'));
+    const readable = conflicts.length === 0 && unreadLines.length === 0;
+    const own = new Set(userToolTables(existing).tools);
+    const notAsking = readable ? CODEX_PROMPT_TOOLS.filter((tool) => !asked.has(tool) && !own.has(tool)) : null;
+    return { status: 'refused', message, notAsking, release };
+  }
+  const tables = {
+    userToolTables: plan.userTables.tools,
+    userTablesWithoutApprovalMode: plan.userTables.withoutApprovalMode,
+  };
+  if (plan.text === existing) return { status: 'current', release, ...tables };
+  try {
+    // .gitignore first, as `hiveku-sync codex` keeps it: the block may now inline the key.
+    await appendGitignoreLines(folder, CREDENTIAL_IGNORES);
+    await writeFile(tomlPath, plan.text, 'utf8');
+  } catch (err) {
+    return { status: 'failed', message: `${tomlPath} was not updated: ${err.message}` };
+  }
+  const own = new Set(plan.userTables.tools);
+  const added = CODEX_PROMPT_TOOLS.filter((tool) => !asked.has(tool) && !own.has(tool));
+  return { status: 'updated', added, release, auth: authChange(existing, plan.text), ...tables };
+}
+
 /**
  * Write/refresh the Codex scaffold for one account folder: AGENTS.md +
  * .codex/config.toml (git-ignored) + mirror the account's knowledge to skills.
  * Resolves OLYMPUS_API_KEY from the folder's .env / process env to inline the
- * MCP auth when possible.
+ * MCP auth when possible (folderApiKey).
  *
  * Throws, with nothing in the folder written, when the hiveku-sync block would
  * declare a table or key that the rest of config.toml also declares (see
  * blockConflict). The updated file is checked in memory, before any write.
  */
 export async function writeCodexScaffold({ folder, slug, baseUrl, profile }) {
-  // The FOLDER's .env wins over a process-level export: folder = tenant
-  // boundary, and a globally exported key for account A must never get
-  // inlined into account B's config during a retrofit. process.env is only a
-  // fallback for folders that keep no .env at all.
-  const dotenv = await loadDotenv(join(folder, '.env'));
-  const dotenvKey =
-    dotenv.OLYMPUS_API_KEY && dotenv.OLYMPUS_API_KEY !== 'olp_replace_me' ? dotenv.OLYMPUS_API_KEY : '';
-  const apiKey = dotenvKey || (existsSync(join(folder, '.env')) ? '' : process.env.OLYMPUS_API_KEY || '');
+  const apiKey = await folderApiKey(folder);
 
   // .codex/config.toml (marker-managed region; rest of user's config untouched).
   // First, and checked in memory before anything is written, so that a refused
@@ -654,13 +826,10 @@ export async function writeCodexScaffold({ folder, slug, baseUrl, profile }) {
   } catch (err) {
     if (err.code !== 'ENOENT') throw err;
   }
-  const userTables = userToolTables(toml);
-  const region = codexTomlRegion({ baseUrl, profile, apiKey, userTables: userTables.tools });
-  const placed = placeMarkedRegion(toml, TOML_BEGIN, TOML_END, region);
-  const conflict = blockConflict(toml, placed, region);
+  const { text, userTables, conflict } = planCodexConfig({ existing: toml, baseUrl, profile, apiKey });
   if (conflict) throw new Error(refusalMessage(tomlPath, toml, conflict));
   await mkdir(dirname(tomlPath), { recursive: true });
-  await writeFile(tomlPath, placed.text, 'utf8');
+  await writeFile(tomlPath, text, 'utf8');
 
   // AGENTS.md (marker-managed)
   const agentsPath = join(folder, 'AGENTS.md');
@@ -680,7 +849,7 @@ export async function writeCodexScaffold({ folder, slug, baseUrl, profile }) {
   // entry point was a leaked credential; a scaffolder must never leave one
   // git-trackable.) runInit already covers .env for fresh folders; this makes
   // the retrofit path equally safe.
-  await appendGitignoreLines(folder, ['.codex/config.toml', '.env', '.env.local', '.hiveku/']);
+  await appendGitignoreLines(folder, CREDENTIAL_IGNORES);
 
   const skills = await syncKnowledgeSkills(folder);
   // userToolTables: listed tools left to the user's own table (the CLI names

package/src/init.mjs

@@ -13,12 +13,11 @@ import { existsSync } from 'node:fs';
 import { mkdir, readFile, writeFile } from 'node:fs/promises';
 import { basename, join, resolve } from 'node:path';
 
-import { writeFileAtomic, safeSlug, TYPE_TO_FOLDER, loadDotenv } from './util.mjs';
-import { writeCodexScaffold, preTrustFolder } from './codex.mjs';
+import { writeFileAtomic, safeSlug, TYPE_TO_FOLDER } from './util.mjs';
+import { DEFAULT_BASE_URL, codexLaneSettings, writeCodexScaffold, preTrustFolder } from './codex.mjs';
 import { claudeMdMemoryRegion, refreshClaudeMd } from './claude-md.mjs';
 
 const VALID_PROFILES = ['full', 'sales', 'marketing', 'helpdesk', 'pm', 'dev'];
-const DEFAULT_BASE_URL = 'https://core.hiveku.com';
 
 function dotenvTemplate({ profile, baseUrl }) {
   return [
@@ -229,8 +228,9 @@ export async function runInit({ slug, parentDir, profile = 'full', codex = false
 /**
  * Retrofit an EXISTING account folder with the Codex lane (AGENTS.md +
  * .codex/config.toml + knowledge→skills). Run from inside the folder, or pass
- * one. Derives the account slug from the folder name and the profile from
- * .env (HIVEKU_PROFILE), and inlines the real OLYMPUS_API_KEY when .env has it.
+ * one. Derives the account slug from the folder name and the profile and URL
+ * from .env (codexLaneSettings, which `pull` reads too), and inlines the real
+ * OLYMPUS_API_KEY when .env has it.
  * AGENTS.md sends Codex to CLAUDE.md first, so the part of CLAUDE.md that
  * hiveku-sync keeps current is refreshed too (claude-md.mjs), after the
  * scaffold is written: a refused config.toml update changes nothing.
@@ -238,9 +238,7 @@ export async function runInit({ slug, parentDir, profile = 'full', codex = false
 export async function runCodex({ folder, trust = false } = {}) {
   const target = folder ? resolve(folder) : process.cwd();
   if (!existsSync(target)) throw new Error(`Folder not found: ${target}`);
-  const dotenv = await loadDotenv(join(target, '.env'));
-  const profile = dotenv.HIVEKU_PROFILE || 'full';
-  const baseUrl = dotenv.OLYMPUS_BASE_URL || DEFAULT_BASE_URL;
+  const { baseUrl, profile } = await codexLaneSettings(target);
   const slug = safeSlug(basename(target));
   const result = await writeCodexScaffold({ folder: target, slug, baseUrl, profile });
   if (trust) result.trust = await preTrustFolder(target);

package/src/mcp.mjs

@@ -1,10 +1,138 @@
 /**
  * Minimal MCP JSON-RPC client over Streamable HTTP.
  * Speaks just enough of the protocol to initialize + call tools.
+ *
+ * Every body goes gzip-compressed, and a refusal from the web edge in front of
+ * Hiveku fails only the request it refused (HK-847, below). This is the only
+ * place hiveku-sync posts to core.hiveku.com; it posts to nothing else.
  */
+import { gzipSync } from 'node:zlib';
 
 const PROTOCOL_VERSION = '2024-11-05';
 
+/**
+ * ★ EVERY BODY TO CORE GOES GZIP-COMPRESSED (HK-847): Content-Encoding gzip,
+ * the Content-Type unchanged, and the JSON inside byte for byte what it was.
+ *
+ * The web edge in front of core.hiveku.com reads plain request bodies against
+ * content rules nobody at Hiveku can see or change. On 2026-10-28 it answered a
+ * pm_tasks_create from the Claude Code plugin with an HTML "Blocked" page
+ * because of a file path in the task's text (HK-838), and the same body sent
+ * gzip-compressed passed. A push carries whole files, code and file paths
+ * included, so this client needs it as much as the plugin (lib/upstream.mjs
+ * gzipBody, since 0.27.111) and the VS Code extension (src/mcpClient.ts).
+ *
+ * WHERE THE SERVER INFLATES IT (hiveku-mcp-api-server, checked 2026-10-29):
+ * src/middleware/json-body.ts is its one JSON body parser, mounted app-wide in
+ * src/index-unified-http.ts before every route. It inflates gzip and deflate
+ * (body-parser's default) and counts its 30 MB limit after inflating, so a
+ * compressed body has the ceiling a plain one had.
+ */
+export function gzipJsonBody(message) {
+  return gzipSync(Buffer.from(JSON.stringify(message), 'utf8'));
+}
+
+/**
+ * ★ WHO REFUSED: HIVEKU, OR THE WEB EDGE IN FRONT OF IT (HK-847).
+ *
+ * 401, 403 and 429 come from both. Hiveku's MCP server sends each one as a
+ * JSON-RPC error object: mcp-auth.ts for a revoked key (401) or a key used for
+ * another account (403), rate-limiter.ts for its 429. The edge sends a page of
+ * its own instead, and the request never reached Hiveku. So the BODY decides,
+ * never the status alone: Hiveku's own JSON-RPC error keeps the `MCP HTTP
+ * <status>: <body>` it always had, and anything else on those statuses (an
+ * HTML page, a "Blocked" title, plain text, an empty body, JSON that is not a
+ * JSON-RPC error) is the edge refusing THIS request: McpEdgeRefusalError, a
+ * plain message with the edge's ray id that never calls it a key problem.
+ * 503 is not one of them: the proxy in front of Hiveku also answers 503 when a
+ * deploy cuts a call it had already delivered, so it keeps the generic path.
+ * The words are exactly the VS Code extension's (src/mcpClient.ts
+ * coreEdgeRefusalMessage); the plugin (lib/upstream.mjs edgeRefusalError)
+ * says the same facts to a model, with the next steps a model has.
+ */
+const EDGE_REFUSAL_STATUSES = new Set([401, 403, 429]);
+
+/** True for Hiveku's own error answer: JSON-RPC 2.0 whose `error` has a whole-number code and a string message. */
+export function isHivekuErrorAnswer(text) {
+  if (typeof text !== 'string' || !text.trim()) return false;
+  let body;
+  try {
+    body = JSON.parse(text);
+  } catch {
+    return false;
+  }
+  if (!body || typeof body !== 'object' || Array.isArray(body) || body.jsonrpc !== '2.0') return false;
+  const { error } = body;
+  if (!error || typeof error !== 'object' || Array.isArray(error)) return false;
+  return Number.isInteger(error.code) && typeof error.message === 'string';
+}
+
+/** A ray id is an id: only an id-shaped value is passed on. */
+const RAY_HEADER_RE = /^[0-9a-f]{16}(?:-[a-z]{3,4})?$/i;
+/** "Ray ID: <strong>8f1c...</strong>" in a block page, or "ray_id":"8f1c..." in a JSON one. */
+const RAY_IN_PAGE_RE = /ray[\s_-]*id[\s\S]{0,80}?(?<![0-9a-z])([0-9a-f]{16})(?![0-9a-z])/i;
+
+/** The ray id the edge gave its refusal: the cf-ray header first, else one named in the page. null when neither holds one. */
+export function edgeRayId(headers, text) {
+  const header = String(headers?.get?.('cf-ray') ?? '').trim();
+  if (RAY_HEADER_RE.test(header)) return header;
+  const found = typeof text === 'string' ? text.slice(0, 64 * 1024).match(RAY_IN_PAGE_RE) : null;
+  return found ? found[1] : null;
+}
+
+/**
+ * The words for a refusal from the web edge in front of Hiveku. They claim only
+ * what this client knows: the edge refused this request, so it never reached
+ * Hiveku, and Hiveku did not refuse the key. Not why: a rule on a request's text
+ * is the usual cause, but a rule on where requests come from answers every
+ * request the same way, so a 401 or 403 says what to do then. The ray id comes
+ * first, so a message cut short still carries it. Plain words: no vendor names.
+ */
+export function edgeRefusalMessage(status, rayId) {
+  const byText = status === 401 || status === 403;
+  const label = rayId ? `HTTP ${status}, ray id ${rayId}` : `HTTP ${status}`;
+  const give = rayId ? `ray id ${rayId}` : 'the time it happened';
+  const what = byText
+    ? `The web edge in front of Hiveku refused this one request (${label}), most often because of something in its text.`
+    : `The web edge in front of Hiveku turned this one request away (${label}). It does that when it is busy, and also ` +
+      "because of something in a request's text.";
+  const next = byText
+    ? 'Try it again with the text shortened or rephrased: code and file paths are the usual cause. If every request ' +
+      'is refused this way, even a plain one, the block is on where the requests come from, not on their text: tell ' +
+      `Hiveku support and give them ${give}.`
+    : 'Wait a minute and try it once more. If it is turned away again, shorten or rephrase the text: code and file ' +
+      `paths are the usual cause. If it keeps happening, tell Hiveku support and give them ${give}.`;
+  return (
+    `${what} It never reached Hiveku and nothing was saved. Hiveku did not refuse your key, so there is no need to ` +
+    `reconnect: the next request is sent as usual. ${next}`
+  );
+}
+
+/** The words for a 401, 403 or 429 whose answer could not be read, so who refused it is not known. */
+export function refusalUnreadMessage(status) {
+  return (
+    `The answer to this request (HTTP ${status}) could not be read, so it is not known whether Hiveku or ` +
+    'the web edge in front of Hiveku refused it. It is not taken as a sign that your key stopped working: the next ' +
+    'request is sent as usual. Try it once more.'
+  );
+}
+
+/**
+ * A 401, 403 or 429 that was not Hiveku's own JSON-RPC error. `edge_blocked`:
+ * the edge's own page, so the request never reached Hiveku. `unreadable`: the
+ * answer could not be read, so who refused it is not known. Neither is a key
+ * problem.
+ */
+export class McpEdgeRefusalError extends Error {
+  constructor(kind, httpStatus, rayId = null) {
+    super(kind === 'edge_blocked' ? edgeRefusalMessage(httpStatus, rayId) : refusalUnreadMessage(httpStatus));
+    this.name = 'McpEdgeRefusalError';
+    this.kind = kind;
+    this.httpStatus = httpStatus;
+    this.rayId = kind === 'edge_blocked' ? rayId : null;
+  }
+}
+
 export class HivekuMcpClient {
   constructor({ baseUrl, apiKey, profile = 'full' }) {
     if (!baseUrl) throw new Error('baseUrl required');
@@ -30,6 +158,8 @@ export class HivekuMcpClient {
     const headers = {
       Authorization: `Bearer ${this.apiKey}`,
       'Content-Type': 'application/json',
+      // The body is gzip, so the edge's content rules never read it (gzipJsonBody).
+      'Content-Encoding': 'gzip',
       Accept: 'application/json',
     };
     if (this.sessionId) headers['Mcp-Session-Id'] = this.sessionId;
@@ -37,15 +167,20 @@ export class HivekuMcpClient {
     const res = await fetch(this.endpoint, {
       method: 'POST',
       headers,
-      body: JSON.stringify({ jsonrpc: '2.0', id, method, params }),
+      body: gzipJsonBody({ jsonrpc: '2.0', id, method, params }),
     });
 
     const sessionHeader = res.headers.get('mcp-session-id');
     if (sessionHeader) this.sessionId = sessionHeader;
 
     if (!res.ok) {
-      const text = await res.text().catch(() => '');
-      throw new Error(`MCP HTTP ${res.status}: ${text.slice(0, 500)}`);
+      const text = await res.text().catch(() => null);
+      // ★ A 401, 403 or 429 is classified by its body first (EDGE_REFUSAL_STATUSES).
+      if (EDGE_REFUSAL_STATUSES.has(res.status)) {
+        if (text === null) throw new McpEdgeRefusalError('unreadable', res.status);
+        if (!isHivekuErrorAnswer(text)) throw new McpEdgeRefusalError('edge_blocked', res.status, edgeRayId(res.headers, text));
+      }
+      throw new Error(`MCP HTTP ${res.status}: ${(text ?? '').slice(0, 500)}`);
     }
 
     if (res.status === 204) return null;

package/src/pull.mjs

@@ -16,6 +16,12 @@
  * It also refreshes the folder layout and memory rules in CLAUDE.md, the part
  * between hiveku-sync's markers (claude-md.mjs).
  *
+ * In a Codex folder it rewrites the hiveku-sync block of .codex/config.toml
+ * the way `hiveku-sync codex` does (codex.mjs refreshCodexConfig), so a tool
+ * added to the ask-first list asks there after this pull. A block it cannot
+ * write is an error (exit 2): until it is fixed, a listed tool that block has
+ * no prompt for runs in that folder without asking.
+ *
  * The account memory (domains `account` and `account-suggestions`) is not a
  * knowledge entry: it is classified explicitly, never written under memory/,
  * and pulled once from account_memory_get into a read-only
@@ -49,6 +55,7 @@ import {
 } from './account-memory.mjs';
 import { planKnowledgeFiles } from './knowledge-files.mjs';
 import { refreshClaudeMd } from './claude-md.mjs';
+import { refreshCodexConfig } from './codex.mjs';
 
 const MANIFEST_PATH = '.hiveku/manifest.json';
 export const KNOWLEDGE_SET_ASIDE_DIR = '.hiveku/set-aside/knowledge';
@@ -288,5 +295,42 @@ export async function runPull({ baseDir = process.cwd(), profile, client: inject
     /* no Codex lane */
   }
 
-  return { ...summary, removed_remotely: removedRemotely, profile: activeProfile, baseUrl, codex_lane: codexLane };
+  // The Codex folder's ask-first prompts: its own [mcp_servers.hiveku] approves
+  // every tool it gives no prompt table, so the block is brought up to this
+  // release's list here, not only when someone runs `hiveku-sync codex`.
+  const codexConfig = await refreshCodexConfig(baseDir);
+  if (codexConfig.status === 'refused' || codexConfig.status === 'failed') {
+    summary.errors.push({ type: 'codex config', message: codexConfigProblem(codexConfig) });
+  }
+
+  return {
+    ...summary,
+    removed_remotely: removedRemotely,
+    profile: activeProfile,
+    baseUrl,
+    codex_lane: codexLane,
+    codex_config: codexConfig,
+  };
+}
+
+/**
+ * The error line for a config.toml block `pull` could not bring up to date:
+ * why (refreshCodexConfig's message, which says what to do), then, when Codex
+ * can read the file as it is, the listed tools that run there without asking
+ * until it is fixed.
+ */
+export function codexConfigProblem({ message, notAsking, release }) {
+  if (!notAsking || notAsking.length === 0) return message;
+  const one = notAsking.length === 1;
+  const block = release ? `the block hiveku-sync ${release} wrote there` : 'the hiveku-sync block there';
+  return (
+    `${message} Until it is updated, Codex runs ${toolNames(notAsking)} in this folder without asking: ` +
+    `${block} has no prompt for ${one ? 'it' : 'them'}.`
+  );
+}
+
+/** Up to `max` tool names, then how many more. */
+export function toolNames(names, max = 10) {
+  if (names.length <= max) return names.join(', ');
+  return `${names.slice(0, max).join(', ')} and ${names.length - max} more listed tools`;
 }

package/src/push.mjs

@@ -69,6 +69,7 @@ import {
   tryReadVersionStatus,
   versionAfterPush,
 } from './versions.mjs';
+import { McpEdgeRefusalError } from './mcp.mjs';
 import { saveCodeFiles } from './saveFiles.mjs';
 import {
   branchMovedSafeNote,
@@ -423,6 +424,11 @@ export async function pushProject({
     log: (line) => console.log(line),
   });
   const failedPaths = [...code.failed];
+  // The words of the last request the web edge in front of Hiveku refused
+  // (mcp.mjs McpEdgeRefusalError, HK-847), printed with the files it kept from
+  // saving so the person sees why, and the edge's ray id. Set only where that
+  // refusal left a file unsaved, never for one a retry got past.
+  let edgeRefusal = code.refusal ?? null;
   const codeSaved = code.saved;
   // The branch tree this push leaves behind (every branch write answers it).
   let branchEtag = code.workingTreeEtag;
@@ -444,7 +450,12 @@ export async function pushProject({
         }
         return;
       } catch (e) {
-        if (attempt >= 2) failedPaths.push(f.path);
+        if (attempt >= 2) {
+          failedPaths.push(f.path);
+          // Only the attempt that left the file unsaved says why: an edge
+          // refusal that a second attempt got past says nothing (HK-847).
+          if (e instanceof McpEdgeRefusalError) edgeRefusal = e.message;
+        }
       }
     }
   });
@@ -461,7 +472,8 @@ export async function pushProject({
       const etag = answer?.working_tree_etag ?? answer?.data?.working_tree_etag;
       if (typeof etag === 'string' && etag) branchEtag = etag;
       deleted += 1;
-    } catch {
+    } catch (e) {
+      if (e instanceof McpEdgeRefusalError) edgeRefusal = e.message;
       failedPaths.push(p);
     }
   }
@@ -478,6 +490,7 @@ export async function pushProject({
       `  ${failedPaths.length} file${failedPaths.length !== 1 ? 's' : ''} did NOT save: ` +
         `${failedPaths.slice(0, 10).join(', ')}${failedPaths.length > 10 ? '…' : ''}`,
     );
+    if (edgeRefusal) console.log(`  ${edgeRefusal}`);
     console.log('  Every other file IS saved. Push again to retry the ones that failed.');
   }
 

package/src/saveFiles.mjs

@@ -17,6 +17,7 @@
  * Builder contract: hiveku_builder feature/versions-core
  * src/app/api/olympus/builder/projects/[projectId]/files-bulk/route.ts (POST).
  */
+import { McpEdgeRefusalError } from './mcp.mjs';
 
 /** Batches of about 25 text files finish inside the route's time budget (the tool's own advice). */
 export const BATCH_FILES = 25;
@@ -71,16 +72,24 @@ export function readSaveAnswer(data, sentPaths) {
 
 /**
  * Save `files` ({ path, content, encoding }) to Your site (branch null) or a
- * branch. Returns { saved, failed: [paths], workingTreeEtag }. Never throws for
- * a refused or failed call: those files are reported in `failed`.
+ * branch. Returns { saved, failed: [paths], workingTreeEtag, refusal }. Never
+ * throws for a refused or failed call: those files are reported in `failed`.
+ * `refusal` is the web edge's words (mcp.mjs McpEdgeRefusalError, HK-847),
+ * with its ray id, when the edge refused the last attempt of a batch whose
+ * files are in `failed`, so the person is told why those did not save; else
+ * null. A refused attempt followed by one Hiveku answered says nothing about
+ * the batch any more, so its words are dropped.
  */
 export async function saveCodeFiles({ client, projectId, files, branch = null, note, log = () => {} }) {
   const savedPaths = new Set();
   const failed = [];
   let workingTreeEtag = null;
+  let refusal = null;
   const total = files.length;
   for (const batch of batchFiles(files)) {
     let pending = batch;
+    // The edge's words when it refused this batch's latest attempt, else null.
+    let batchRefusal = null;
     for (let attempt = 1; attempt <= ATTEMPTS && pending.length; attempt++) {
       const sentPaths = pending.map((f) => f.path);
       let data;
@@ -94,10 +103,14 @@ export async function saveCodeFiles({ client, projectId, files, branch = null, n
             ...(branch ? { branch } : {}),
           })
         )?.data;
-      } catch {
+      } catch (err) {
         // No answer: nothing is known about this batch, so all of it is sent again.
+        // The edge refusing it never reached Hiveku; its words are kept for the person.
+        batchRefusal = err instanceof McpEdgeRefusalError ? err.message : null;
         continue;
       }
+      // Hiveku answered, so it, not the edge, says what did not land.
+      batchRefusal = null;
       const answer = readSaveAnswer(data, sentPaths);
       for (const p of answer.landed) savedPaths.add(p);
       if (answer.etag) workingTreeEtag = answer.etag;
@@ -105,7 +118,9 @@ export async function saveCodeFiles({ client, projectId, files, branch = null, n
       pending = pending.filter((f) => again.has(f.path) && !savedPaths.has(f.path));
     }
     failed.push(...pending.map((f) => f.path));
+    // Set only by a refused last attempt, which leaves this batch's files in `failed`.
+    if (batchRefusal) refusal = batchRefusal;
     log(`  code ${savedPaths.size}/${total}`);
   }
-  return { saved: savedPaths.size, failed, workingTreeEtag };
+  return { saved: savedPaths.size, failed, workingTreeEtag, refusal };
 }