@hiveku-apps/sync 0.5.17 → 0.5.19

package/README.md

@@ -12,7 +12,9 @@ Local sync CLI for a Hiveku account. Pairs with the Hiveku MCP server at
    It also writes the account memory (see "Account memory" below) to
    `hiveku-data/account/ACCOUNT_MEMORY.md`, read-only, and brings the folder
    layout, the memory rules and the plan rules in `CLAUDE.md` up to date (see
-   "CLAUDE.md stays current" below).
+   "CLAUDE.md stays current" below). In a Codex folder it also brings the
+   ask-first prompts in `.codex/config.toml` up to date (see "Codex (OpenAI)
+   support" below).
 
 The goal: open one folder per Hiveku tenant in VS Code with Claude Code,
 with the account's memory mirrored as local `.md` files Claude can read
@@ -126,12 +128,24 @@ the last `pull` wrote under `rules/<agent>/` (never those in
 `rules/<agent>/not-followed/`). Run `hiveku-sync codex` after `pull` to refresh it
 (`pull` reminds you when the folder has a Codex lane).
 
+**`pull` keeps the ask-first prompts current.** When `.codex/config.toml` has
+the hiveku-sync block, every `pull` brings that block up to date exactly as
+`hiveku-sync codex` would write it, so a tool added to the ask-first list asks
+in the folder after its next pull, and the pull names the tools that ask now.
+It takes the key from `.env` as `hiveku-sync codex` does, and says so when that
+changes the key Codex uses. The rules below still hold: your own tool tables
+win, and a block that would declare a table or key twice is not written. Then
+the pull ends with an error (exit 2) that names the line to fix and the listed
+tools that run without asking until you do. `pull` never creates
+`.codex/config.toml` or a block in it, and it leaves `AGENTS.md` and
+`.agents/skills/` to `hiveku-sync codex`.
+
 Pass `--trust` to pre-trust the folder in `~/.codex/config.toml` (so Codex loads
 the repo config without its first-run trust prompt).
 
 **Approvals.** Codex asks first only for a **fixed list** of high-risk Hiveku
-tools: the 278 names in `src/codex-prompt-tools.json`, the same list as the
-Hiveku Codex plugin 0.3.13. It includes `deploy_site`, `site_delete`,
+tools: the 331 names in `src/codex-prompt-tools.json`, the same list as the
+Hiveku Codex plugin 0.3.47. It includes `deploy_site`, `site_delete`,
 `project_files_bulk_save` and every `hiveku_batch`, and it is written as
 `[mcp_servers.hiveku.tools.<tool>] approval_mode = "prompt"`. **Every other tool
 on the `hiveku` server runs without asking** (`default_tools_approval_mode =
@@ -181,7 +195,7 @@ Headless and bypass modes:
 
 Folders set up by a hiveku-sync without these prompts (0.3.5 and earlier)
 approve every tool: run `hiveku-sync codex` in them once, with a release that has
-them, to add the prompts.
+them, to add the prompts. From 0.5.18 a `pull` adds them too.
 
 > **This vs. the plugin.** For a single account, you can instead install the
 > published [Hiveku Codex plugin](https://github.com/locus2012/hiveku-codex-plugin)

package/bin/hiveku-sync.mjs

@@ -10,7 +10,7 @@
 
 import { runInit } from '../src/init.mjs';
 import { runCodex } from '../src/init.mjs';
-import { runPull } from '../src/pull.mjs';
+import { runPull, toolNames } from '../src/pull.mjs';
 import {
   runProjectsList,
   runPullProject,
@@ -86,8 +86,10 @@ Memory/rules/skills:
                                     that owns each one (<type>/<agent>/, and
                                     <type>/shared/ for every agent). Brings the
                                     folder layout and memory rules in CLAUDE.md
-                                    up to date. Reads OLYMPUS_API_KEY and
-                                    OLYMPUS_BASE_URL from ./.env.
+                                    up to date, and in a Codex folder the
+                                    ask-first prompts in .codex/config.toml.
+                                    Reads OLYMPUS_API_KEY and OLYMPUS_BASE_URL
+                                    from ./.env.
   codex [<folder>] [--trust]        Retrofit an existing account folder with the
                                     Codex lane (AGENTS.md + .codex/config.toml +
                                     mirror the account's skills/commands to
@@ -193,6 +195,30 @@ function userToolTablesLines({ userToolTables = [], userTablesWithoutApprovalMod
   return lines;
 }
 
+/**
+ * What `pull` did to the hiveku-sync block of .codex/config.toml
+ * (refreshCodexConfig), as lines to print: only when it wrote the block. A
+ * block it could not write is printed with the errors, and a current block or
+ * a folder with none says nothing.
+ */
+export function codexConfigLines(result) {
+  if (result?.status !== 'updated') return [];
+  const from = result.release ? ` (hiveku-sync ${result.release} wrote it)` : '';
+  const lines = [`  Codex: brought the hiveku-sync block in .codex/config.toml up to date${from}.`];
+  const added = result.added ?? [];
+  if (added.length) {
+    lines.push(`    It now also asks first before ${toolNames(added)}.`);
+  }
+  const AUTH = {
+    inlined: 'MCP auth: it now carries the OLYMPUS_API_KEY from .env (it read the OLYMPUS_API_KEY env var before).',
+    'env-var': 'MCP auth: it now reads the OLYMPUS_API_KEY env var, because .env has no key to put in it.',
+    key: 'MCP auth: it now carries the OLYMPUS_API_KEY from .env, which is not the key it held before.',
+  };
+  if (AUTH[result.auth]) lines.push(`    ${AUTH[result.auth]}`);
+  for (const line of userToolTablesLines(result)) lines.push(`    ${line}`);
+  return lines;
+}
+
 /**
  * What refreshing CLAUDE.md's kept-current part (folder layout and memory
  * rules, claude-md.mjs) did, as lines to print. Nothing when it was already
@@ -339,6 +365,7 @@ async function main() {
         console.log('They were left on disk. Delete them manually if no longer needed.');
       }
       for (const line of claudeMdLines(summary.claude_md)) console.log(line);
+      for (const line of codexConfigLines(summary.codex_config)) console.log(line);
       if (summary.codex_lane) {
         console.log('\nCodex: run `hiveku-sync codex` to refresh the rules list in AGENTS.md and the skills in .agents/skills/.');
       }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@hiveku-apps/sync",
-  "version": "0.5.17",
+  "version": "0.5.19",
   "description": "Sync a Hiveku account's memory/rules/skills + coder projects into a local folder, and ship projects (push/deploy/pull-env) from the terminal. Pairs with the Hiveku MCP at core.hiveku.com/mcp so Claude Code can drive Hiveku tools per-folder.",
   "type": "module",
   "license": "MIT",

package/src/codex-prompt-tools.json

@@ -1,5 +1,5 @@
 {
-  "source": "locus2012/hiveku-codex-plugin 0.3.44 (859caff, on main f588ca8), plugins/hiveku/.mcp.json: every hiveku.tools entry with approval_mode \"prompt\" (project_vcs_rollback included)",
+  "source": "locus2012/hiveku-codex-plugin 0.3.47 (feature/ask-contract-alerts 5ff2b8e, on main c535f59), plugins/hiveku/.mcp.json: every hiveku.tools entry with approval_mode \"prompt\" (project_vcs_rollback included)",
   "why": "hiveku-sync writes its own [mcp_servers.hiveku] into a Codex folder. Codex then uses that entry, not the plugin's, for the server's connection and for every tool's approval mode, so these prompts must be written here too. Refresh this list whenever the Codex plugin's prompt list changes.",
   "tools": [
     "deploy_site",
@@ -77,6 +77,9 @@
     "email_project_connect",
     "email_suppression_import",
     "crm_envelope_send",
+    "crm_envelope_alerts_set",
+    "crm_contract_template_create",
+    "crm_contract_template_update",
     "crm_estimate_send",
     "helpdesk_ticket_send_reply",
     "helpdesk_assistant_knowledge_sources_update",
@@ -185,6 +188,7 @@
     "voice_port_order_create",
     "voice_port_order_action",
     "voice_port_order_document_upload",
+    "voice_port_order_loa_send",
     "voice_settings_update",
     "voice_number_update",
     "voice_blocked_numbers_remove",

package/src/codex.mjs

@@ -27,6 +27,11 @@
  *                            without asking. The safe-work rules are stated
  *                            as instructions in AGENTS.md, for every tool.
  *
+ * `hiveku-sync pull` rewrites the .codex/config.toml block too, when the file
+ * has one (refreshCodexConfig, the same step as `hiveku-sync codex`), so a
+ * tool added to the ask-first list asks in an existing folder after its next
+ * pull, not only after someone remembers to run `hiveku-sync codex`.
+ *
  * This complements the published Hiveku Codex plugin
  * (github.com/locus2012/hiveku-codex-plugin): the plugin ships the generic
  * `hiveku` MCP server + doctrine skills for single-account users who install it
@@ -98,6 +103,20 @@ export const CODEX_PROMPT_TOOLS = [
 /** This package's version, as published (package.json ships in every npm package). */
 export const SYNC_VERSION = JSON.parse(readFileSync(new URL('../package.json', import.meta.url), 'utf8')).version;
 
+/** The Hiveku MCP host a folder uses when its .env names none. */
+export const DEFAULT_BASE_URL = 'https://core.hiveku.com';
+
+/**
+ * The URL and profile a folder's Codex lane is written with: the folder's own
+ * .env (OLYMPUS_BASE_URL, HIVEKU_PROFILE), else the defaults. `hiveku-sync
+ * codex` and `pull` both read them here, so a pull writes the block exactly as
+ * `hiveku-sync codex` would.
+ */
+export async function codexLaneSettings(folder) {
+  const dotenv = await loadDotenv(join(folder, '.env'));
+  return { baseUrl: dotenv.OLYMPUS_BASE_URL || DEFAULT_BASE_URL, profile: dotenv.HIVEKU_PROFILE || 'full' };
+}
+
 /**
  * X-Hiveku-Client for the folder's [mcp_servers.hiveku]: `hiveku-sync/<version>`,
  * the declaration that this config asks a person before project_secrets_reveal
@@ -300,13 +319,16 @@ function blockConflict(existing, placed, region) {
  * The error for an update blockConflict refused. It names the block's own
  * table or key (hiveku-sync's names) and only the line number of the user's,
  * so nothing the user typed is repeated (a pasted secret, say).
+ * `folderUnchanged`: `hiveku-sync codex` writes nothing in the folder when it
+ * refuses, and says so; `pull` has written the pulled files by then, so it
+ * passes false.
  */
-function refusalMessage(tomlPath, existing, { ours, line }) {
+function refusalMessage(tomlPath, existing, { ours, line }, { folderUnchanged = true } = {}) {
   const name =
     ours.type === 'keyval' ? `the key ${formatKey([...ours.header, ...ours.key])}` : `the table [${formatKey(ours.key)}]`;
   const where = line ? `line ${line} of it` : 'a line of it';
   const lines = [
-    `${tomlPath} was not updated: ${where} conflicts with ${name} in the hiveku-sync block, and a TOML file may declare each table and key only once. Nothing in the folder was changed.`,
+    `${tomlPath} was not updated: ${where} conflicts with ${name} in the hiveku-sync block, and a TOML file may declare each table and key only once.${folderUnchanged ? ' Nothing in the folder was changed.' : ''}`,
   ];
   const begin = existing.indexOf(TOML_BEGIN);
   if (begin !== -1 && existing.indexOf(TOML_BEGIN, begin + 1) !== -1) {
@@ -624,25 +646,175 @@ export async function rulesDigest(folder) {
   return [...head, ...lines].join('\n');
 }
 
+/**
+ * The key a folder's block inlines, or '' to read the OLYMPUS_API_KEY env var.
+ * The FOLDER's .env wins over a process-level export: folder = tenant
+ * boundary, and a globally exported key for account A must never get inlined
+ * into account B's config during a retrofit. process.env is only a fallback
+ * for folders that keep no .env at all.
+ */
+async function folderApiKey(folder) {
+  const dotenv = await loadDotenv(join(folder, '.env'));
+  const dotenvKey =
+    dotenv.OLYMPUS_API_KEY && dotenv.OLYMPUS_API_KEY !== 'olp_replace_me' ? dotenv.OLYMPUS_API_KEY : '';
+  return dotenvKey || (existsSync(join(folder, '.env')) ? '' : process.env.OLYMPUS_API_KEY || '');
+}
+
+/** Every credential-bearing file the Codex lane depends on (see writeCodexScaffold). */
+const CREDENTIAL_IGNORES = ['.codex/config.toml', '.env', '.env.local', '.hiveku/'];
+
+/**
+ * The one .codex/config.toml step, shared by `hiveku-sync codex` (through
+ * writeCodexScaffold) and `pull` (refreshCodexConfig): `existing` with the
+ * hiveku-sync block replaced (or appended) for this release, checked in
+ * memory and not written. Listed tools whose table the user declares outside
+ * the block are left to that table (userToolTables). `conflict` is set
+ * (blockConflict) when the block would declare a table or key that the rest
+ * of the file also declares: then the text must not be written.
+ */
+function planCodexConfig({ existing, baseUrl, profile, apiKey }) {
+  const userTables = userToolTables(existing);
+  const region = codexTomlRegion({ baseUrl, profile, apiKey, userTables: userTables.tools });
+  const placed = placeMarkedRegion(existing, TOML_BEGIN, TOML_END, region);
+  return { text: placed.text, userTables, conflict: blockConflict(existing, placed, region) };
+}
+
+/**
+ * The tools that `text` gives a prompt table the way hiveku-sync writes one in
+ * its block, `[mcp_servers.hiveku.tools.<tool>]` followed by
+ * `approval_mode = "prompt"`, wherever they are in the file.
+ */
+function promptTables(text) {
+  const asked = new Set();
+  for (const hit of text.replace(/\r\n/g, '\n').matchAll(/^\[mcp_servers\.hiveku\.tools\.([A-Za-z0-9_-]+)\]\napproval_mode = "prompt"$/gm)) {
+    asked.add(hit[1]);
+  }
+  return asked;
+}
+
+/** The hiveku-sync block in `text`, to its end line or the end of the file; '' when there is none. */
+function blockText(text) {
+  const begin = text.indexOf(TOML_BEGIN);
+  if (begin === -1) return '';
+  const end = text.indexOf(TOML_END, begin);
+  return text.slice(begin, end === -1 ? undefined : end);
+}
+
+/**
+ * The hiveku-sync release the block in `text` declares in X-Hiveku-Client
+ * (`hiveku-sync/<version>`), or null: a block that sends the plain `codex`
+ * label, or one an older release wrote without the header, does not say.
+ */
+function blockRelease(text) {
+  return blockText(text).match(/"X-Hiveku-Client" = "hiveku-sync\/([0-9A-Za-z.+-]+)"/)?.[1] ?? null;
+}
+
+/**
+ * How the block in `text` authenticates: its inlined Authorization value, or
+ * 'env' when it reads the OLYMPUS_API_KEY env var. Compared in memory only,
+ * never returned or printed: the value is the account's key.
+ */
+function blockAuth(text) {
+  const block = blockText(text);
+  const inlined = block.match(/"Authorization" = ("(?:[^"\\]|\\.)*")/);
+  if (inlined) return inlined[1];
+  return /^bearer_token_env_var = "OLYMPUS_API_KEY"$/m.test(block) ? 'env' : null;
+}
+
+/**
+ * What a rewrite changed in how the folder's Codex reaches Hiveku, so `pull`
+ * can say it (the key comes from the folder's .env, as for `hiveku-sync
+ * codex`): 'inlined' (it read the env var before), 'env-var' (it inlined a
+ * key before, and .env has none to inline now), 'key' (another key), or null.
+ */
+function authChange(before, after) {
+  const was = blockAuth(before);
+  const now = blockAuth(after);
+  if (was === now || now === null) return null;
+  if (now === 'env') return 'env-var';
+  return was === 'env' ? 'inlined' : 'key';
+}
+
+/**
+ * `hiveku-sync pull` in a Codex folder: rewrite the hiveku-sync block of
+ * .codex/config.toml exactly as `hiveku-sync codex` would (planCodexConfig:
+ * the user's own tool tables win, and a block that would declare a table or
+ * key twice is refused with nothing written). Without this, a folder kept the
+ * prompt list of the release that last ran `hiveku-sync codex` there, and its
+ * own [mcp_servers.hiveku] approves every other tool, so a tool added to the
+ * list since ran without asking (review of #29, 2026-10-29).
+ *
+ * It never creates the file or a block: a folder with neither has no
+ * [mcp_servers.hiveku] of hiveku-sync's for Codex to use. It does not touch
+ * AGENTS.md or the mirrored skills (`hiveku-sync codex` does).
+ *
+ * Returns { status } and what to say:
+ *   'no-block'  no .codex/config.toml, or no hiveku-sync block in it;
+ *   'current'   the block is what this release writes; nothing written;
+ *   'updated'   written. `added`: listed tools that ask now and did not
+ *               before; `release`: the hiveku-sync that wrote the old block;
+ *               `auth`: authChange's word, or null; userToolTables /
+ *               userTablesWithoutApprovalMode as writeCodexScaffold returns
+ *               them;
+ *   'refused'   blockConflict: nothing written. `message` says why and what
+ *               to do; `notAsking`: listed tools the file gives no prompt and
+ *               no table of the user's own, when Codex can read the file as it
+ *               is (null when a line cannot be read or something is declared
+ *               twice already, so Codex cannot load it); `release` as above;
+ *   'failed'    the file could not be read or written: `message`.
+ */
+export async function refreshCodexConfig(folder) {
+  const tomlPath = join(folder, '.codex', 'config.toml');
+  let existing;
+  try {
+    existing = await readFile(tomlPath, 'utf8');
+  } catch (err) {
+    if (err.code === 'ENOENT') return { status: 'no-block' };
+    return { status: 'failed', message: `${tomlPath} could not be read: ${err.message}` };
+  }
+  if (!existing.includes(TOML_BEGIN)) return { status: 'no-block' };
+  const { baseUrl, profile } = await codexLaneSettings(folder);
+  const apiKey = await folderApiKey(folder);
+  const asked = promptTables(existing);
+  const release = blockRelease(existing);
+  const plan = planCodexConfig({ existing, baseUrl, profile, apiKey });
+  if (plan.conflict) {
+    const message = refusalMessage(tomlPath, existing, plan.conflict, { folderUnchanged: false });
+    const { conflicts, unreadLines } = readTomlDeclarations(existing.replace(/\r\n/g, '\n'));
+    const readable = conflicts.length === 0 && unreadLines.length === 0;
+    const own = new Set(userToolTables(existing).tools);
+    const notAsking = readable ? CODEX_PROMPT_TOOLS.filter((tool) => !asked.has(tool) && !own.has(tool)) : null;
+    return { status: 'refused', message, notAsking, release };
+  }
+  const tables = {
+    userToolTables: plan.userTables.tools,
+    userTablesWithoutApprovalMode: plan.userTables.withoutApprovalMode,
+  };
+  if (plan.text === existing) return { status: 'current', release, ...tables };
+  try {
+    // .gitignore first, as `hiveku-sync codex` keeps it: the block may now inline the key.
+    await appendGitignoreLines(folder, CREDENTIAL_IGNORES);
+    await writeFile(tomlPath, plan.text, 'utf8');
+  } catch (err) {
+    return { status: 'failed', message: `${tomlPath} was not updated: ${err.message}` };
+  }
+  const own = new Set(plan.userTables.tools);
+  const added = CODEX_PROMPT_TOOLS.filter((tool) => !asked.has(tool) && !own.has(tool));
+  return { status: 'updated', added, release, auth: authChange(existing, plan.text), ...tables };
+}
+
 /**
  * Write/refresh the Codex scaffold for one account folder: AGENTS.md +
  * .codex/config.toml (git-ignored) + mirror the account's knowledge to skills.
  * Resolves OLYMPUS_API_KEY from the folder's .env / process env to inline the
- * MCP auth when possible.
+ * MCP auth when possible (folderApiKey).
  *
  * Throws, with nothing in the folder written, when the hiveku-sync block would
  * declare a table or key that the rest of config.toml also declares (see
  * blockConflict). The updated file is checked in memory, before any write.
  */
 export async function writeCodexScaffold({ folder, slug, baseUrl, profile }) {
-  // The FOLDER's .env wins over a process-level export: folder = tenant
-  // boundary, and a globally exported key for account A must never get
-  // inlined into account B's config during a retrofit. process.env is only a
-  // fallback for folders that keep no .env at all.
-  const dotenv = await loadDotenv(join(folder, '.env'));
-  const dotenvKey =
-    dotenv.OLYMPUS_API_KEY && dotenv.OLYMPUS_API_KEY !== 'olp_replace_me' ? dotenv.OLYMPUS_API_KEY : '';
-  const apiKey = dotenvKey || (existsSync(join(folder, '.env')) ? '' : process.env.OLYMPUS_API_KEY || '');
+  const apiKey = await folderApiKey(folder);
 
   // .codex/config.toml (marker-managed region; rest of user's config untouched).
   // First, and checked in memory before anything is written, so that a refused
@@ -654,13 +826,10 @@ export async function writeCodexScaffold({ folder, slug, baseUrl, profile }) {
   } catch (err) {
     if (err.code !== 'ENOENT') throw err;
   }
-  const userTables = userToolTables(toml);
-  const region = codexTomlRegion({ baseUrl, profile, apiKey, userTables: userTables.tools });
-  const placed = placeMarkedRegion(toml, TOML_BEGIN, TOML_END, region);
-  const conflict = blockConflict(toml, placed, region);
+  const { text, userTables, conflict } = planCodexConfig({ existing: toml, baseUrl, profile, apiKey });
   if (conflict) throw new Error(refusalMessage(tomlPath, toml, conflict));
   await mkdir(dirname(tomlPath), { recursive: true });
-  await writeFile(tomlPath, placed.text, 'utf8');
+  await writeFile(tomlPath, text, 'utf8');
 
   // AGENTS.md (marker-managed)
   const agentsPath = join(folder, 'AGENTS.md');
@@ -680,7 +849,7 @@ export async function writeCodexScaffold({ folder, slug, baseUrl, profile }) {
   // entry point was a leaked credential; a scaffolder must never leave one
   // git-trackable.) runInit already covers .env for fresh folders; this makes
   // the retrofit path equally safe.
-  await appendGitignoreLines(folder, ['.codex/config.toml', '.env', '.env.local', '.hiveku/']);
+  await appendGitignoreLines(folder, CREDENTIAL_IGNORES);
 
   const skills = await syncKnowledgeSkills(folder);
   // userToolTables: listed tools left to the user's own table (the CLI names

package/src/init.mjs

@@ -13,12 +13,11 @@ import { existsSync } from 'node:fs';
 import { mkdir, readFile, writeFile } from 'node:fs/promises';
 import { basename, join, resolve } from 'node:path';
 
-import { writeFileAtomic, safeSlug, TYPE_TO_FOLDER, loadDotenv } from './util.mjs';
-import { writeCodexScaffold, preTrustFolder } from './codex.mjs';
+import { writeFileAtomic, safeSlug, TYPE_TO_FOLDER } from './util.mjs';
+import { DEFAULT_BASE_URL, codexLaneSettings, writeCodexScaffold, preTrustFolder } from './codex.mjs';
 import { claudeMdMemoryRegion, refreshClaudeMd } from './claude-md.mjs';
 
 const VALID_PROFILES = ['full', 'sales', 'marketing', 'helpdesk', 'pm', 'dev'];
-const DEFAULT_BASE_URL = 'https://core.hiveku.com';
 
 function dotenvTemplate({ profile, baseUrl }) {
   return [
@@ -229,8 +228,9 @@ export async function runInit({ slug, parentDir, profile = 'full', codex = false
 /**
  * Retrofit an EXISTING account folder with the Codex lane (AGENTS.md +
  * .codex/config.toml + knowledge→skills). Run from inside the folder, or pass
- * one. Derives the account slug from the folder name and the profile from
- * .env (HIVEKU_PROFILE), and inlines the real OLYMPUS_API_KEY when .env has it.
+ * one. Derives the account slug from the folder name and the profile and URL
+ * from .env (codexLaneSettings, which `pull` reads too), and inlines the real
+ * OLYMPUS_API_KEY when .env has it.
  * AGENTS.md sends Codex to CLAUDE.md first, so the part of CLAUDE.md that
  * hiveku-sync keeps current is refreshed too (claude-md.mjs), after the
  * scaffold is written: a refused config.toml update changes nothing.
@@ -238,9 +238,7 @@ export async function runInit({ slug, parentDir, profile = 'full', codex = false
 export async function runCodex({ folder, trust = false } = {}) {
   const target = folder ? resolve(folder) : process.cwd();
   if (!existsSync(target)) throw new Error(`Folder not found: ${target}`);
-  const dotenv = await loadDotenv(join(target, '.env'));
-  const profile = dotenv.HIVEKU_PROFILE || 'full';
-  const baseUrl = dotenv.OLYMPUS_BASE_URL || DEFAULT_BASE_URL;
+  const { baseUrl, profile } = await codexLaneSettings(target);
   const slug = safeSlug(basename(target));
   const result = await writeCodexScaffold({ folder: target, slug, baseUrl, profile });
   if (trust) result.trust = await preTrustFolder(target);

package/src/pull.mjs

@@ -16,6 +16,12 @@
  * It also refreshes the folder layout and memory rules in CLAUDE.md, the part
  * between hiveku-sync's markers (claude-md.mjs).
  *
+ * In a Codex folder it rewrites the hiveku-sync block of .codex/config.toml
+ * the way `hiveku-sync codex` does (codex.mjs refreshCodexConfig), so a tool
+ * added to the ask-first list asks there after this pull. A block it cannot
+ * write is an error (exit 2): until it is fixed, a listed tool that block has
+ * no prompt for runs in that folder without asking.
+ *
  * The account memory (domains `account` and `account-suggestions`) is not a
  * knowledge entry: it is classified explicitly, never written under memory/,
  * and pulled once from account_memory_get into a read-only
@@ -49,6 +55,7 @@ import {
 } from './account-memory.mjs';
 import { planKnowledgeFiles } from './knowledge-files.mjs';
 import { refreshClaudeMd } from './claude-md.mjs';
+import { refreshCodexConfig } from './codex.mjs';
 
 const MANIFEST_PATH = '.hiveku/manifest.json';
 export const KNOWLEDGE_SET_ASIDE_DIR = '.hiveku/set-aside/knowledge';
@@ -288,5 +295,42 @@ export async function runPull({ baseDir = process.cwd(), profile, client: inject
     /* no Codex lane */
   }
 
-  return { ...summary, removed_remotely: removedRemotely, profile: activeProfile, baseUrl, codex_lane: codexLane };
+  // The Codex folder's ask-first prompts: its own [mcp_servers.hiveku] approves
+  // every tool it gives no prompt table, so the block is brought up to this
+  // release's list here, not only when someone runs `hiveku-sync codex`.
+  const codexConfig = await refreshCodexConfig(baseDir);
+  if (codexConfig.status === 'refused' || codexConfig.status === 'failed') {
+    summary.errors.push({ type: 'codex config', message: codexConfigProblem(codexConfig) });
+  }
+
+  return {
+    ...summary,
+    removed_remotely: removedRemotely,
+    profile: activeProfile,
+    baseUrl,
+    codex_lane: codexLane,
+    codex_config: codexConfig,
+  };
+}
+
+/**
+ * The error line for a config.toml block `pull` could not bring up to date:
+ * why (refreshCodexConfig's message, which says what to do), then, when Codex
+ * can read the file as it is, the listed tools that run there without asking
+ * until it is fixed.
+ */
+export function codexConfigProblem({ message, notAsking, release }) {
+  if (!notAsking || notAsking.length === 0) return message;
+  const one = notAsking.length === 1;
+  const block = release ? `the block hiveku-sync ${release} wrote there` : 'the hiveku-sync block there';
+  return (
+    `${message} Until it is updated, Codex runs ${toolNames(notAsking)} in this folder without asking: ` +
+    `${block} has no prompt for ${one ? 'it' : 'them'}.`
+  );
+}
+
+/** Up to `max` tool names, then how many more. */
+export function toolNames(names, max = 10) {
+  if (names.length <= max) return names.join(', ');
+  return `${names.slice(0, max).join(', ')} and ${names.length - max} more listed tools`;
 }