@researai/deepscientist 1.5.17 → 1.6.0

package/src/deepscientist/runners/codex.py

@@ -17,13 +17,29 @@ from ..codex_cli_compat import (
     provider_profile_metadata_from_home,
 )
 from ..config import ConfigManager
+from ..evidence_packets import compact_runner_tool_event
 from ..gitops import export_git_graph
 from ..process_control import process_session_popen_kwargs
 from ..prompts import PromptBuilder
 from ..runtime_logs import JsonlLogger
-from ..shared import append_jsonl, ensure_dir, generate_id, read_yaml, resolve_runner_binary, utc_now, write_json, write_text
+from ..shared import append_jsonl, ensure_dir, ensure_utf8_subprocess_env, generate_id, read_yaml, resolve_runner_binary, utc_now, write_json, write_text
 from ..web_search import extract_web_search_payload
-from .base import RunRequest, RunResult
+from .base import (
+    SETTINGS_ISSUE_CUSTOM_PROFILE,
+    START_SETUP_PREPARE_PROFILE,
+    RunRequest,
+    RunResult,
+    builtin_mcp_server_names_for_custom_profile,
+    extract_start_setup_patch_from_text,
+    extract_start_setup_session_patch_from_text,
+    resolve_mcp_tool_profile_for_quest,
+)
+from .codex_telemetry import (
+    DEFAULT_TURN_TOOL_CALL_BUDGET,
+    _finalize_tool_budget_telemetry,
+    _new_tool_budget_telemetry,
+    _record_tool_budget_event,
+)
 
 _TOOL_EVENT_ARGS_TEXT_LIMIT = 8_000
 _TOOL_EVENT_OUTPUT_TEXT_LIMIT = 16_000
@@ -39,6 +55,7 @@ _BUILTIN_MCP_TOOL_APPROVALS: dict[str, tuple[str, ...]] = {
     ),
     "artifact": (
         "record",
+        "science",
         "checkpoint",
         "prepare_branch",
         "activate_branch",
@@ -46,6 +63,10 @@ _BUILTIN_MCP_TOOL_APPROVALS: dict[str, tuple[str, ...]] = {
         "list_research_branches",
         "resolve_runtime_refs",
         "get_paper_contract_health",
+        "validate_manuscript_coverage",
+        "validate_academic_outline",
+        "validate_manuscript_language",
+        "compile_outline_to_writing_plan",
         "get_quest_state",
         "get_global_status",
         "get_method_scoreboard",
@@ -62,6 +83,7 @@ _BUILTIN_MCP_TOOL_APPROVALS: dict[str, tuple[str, ...]] = {
         "publish_baseline",
         "attach_baseline",
         "confirm_baseline",
+        "overwrite_baseline",
         "waive_baseline",
         "arxiv",
         "refresh_summary",
@@ -74,11 +96,82 @@ _BUILTIN_MCP_TOOL_APPROVALS: dict[str, tuple[str, ...]] = {
     ),
 }
 
+
+def _builtin_mcp_tool_approvals_for_profile(custom_profile: str | None) -> dict[str, tuple[str, ...]]:
+    normalized = str(custom_profile or "").strip().lower()
+    if normalized == SETTINGS_ISSUE_CUSTOM_PROFILE:
+        return {
+            "artifact": ("prepare_github_issue",),
+            "bash_exec": _BUILTIN_MCP_TOOL_APPROVALS.get("bash_exec", ()),
+        }
+    if normalized == START_SETUP_PREPARE_PROFILE:
+        return {
+            "artifact": ("prepare_start_setup_form",),
+            "bash_exec": _BUILTIN_MCP_TOOL_APPROVALS.get("bash_exec", ()),
+        }
+    return _BUILTIN_MCP_TOOL_APPROVALS
+
 _PROVIDER_ENV_CONFLICT_KEYS = (
     "OPENAI_API_KEY",
     "OPENAI_BASE_URL",
 )
 _CHAT_WIRE_TOOL_CALL_GUARD_MARKER = "## Codex Chat-Wire Tool Call Compatibility"
+_WINDOWS_GBK_SAFE_REPLACEMENTS: dict[str, str] = {
+    "•": "-",
+    "…": "...",
+    "→": "->",
+    "←": "<-",
+    "↔": "<->",
+    "≤": "<=",
+    "≥": ">=",
+    "—": "-",
+    "–": "-",
+    "✓": "[ok]",
+    "✗": "[x]",
+    "✨": "*",
+    "🚀": "[launch]",
+    "📄": "[file]",
+    "📊": "[chart]",
+    "📌": "[pin]",
+    "💡": "[idea]",
+    "📎": "[attachment]",
+    "̀": "",
+    "́": "",
+}
+
+
+def _usage_metrics_from_event(event: dict[str, Any]) -> dict[str, int]:
+    candidates: list[dict[str, Any]] = []
+    for key in ("usage", "token_usage", "turn_usage"):
+        value = event.get(key)
+        if isinstance(value, dict):
+            candidates.append(value)
+    item = event.get("item")
+    if isinstance(item, dict):
+        for key in ("usage", "token_usage", "turn_usage"):
+            value = item.get(key)
+            if isinstance(value, dict):
+                candidates.append(value)
+    aliases = {
+        "input_tokens": ("input_tokens", "prompt_tokens"),
+        "cached_input_tokens": ("cached_input_tokens", "cached_tokens", "cached_prompt_tokens"),
+        "output_tokens": ("output_tokens", "completion_tokens"),
+        "total_tokens": ("total_tokens",),
+    }
+    merged: dict[str, int] = {}
+    for candidate in candidates:
+        for target, source_keys in aliases.items():
+            if target in merged:
+                continue
+            for key in source_keys:
+                value = candidate.get(key)
+                if isinstance(value, int):
+                    merged[target] = value
+                    break
+                if isinstance(value, float):
+                    merged[target] = int(value)
+                    break
+    return merged
 
 
 def _compact_text(value: object, *, limit: int = 1200) -> str:
@@ -96,6 +189,29 @@ def _compact_text(value: object, *, limit: int = 1200) -> str:
     return text[: limit - 1].rstrip() + "…"
 
 
+def _sanitize_text_for_windows_gbk(text: str) -> tuple[str, dict[str, str]]:
+    source = str(text or "")
+    if not source:
+        return source, {}
+    try:
+        source.encode("gbk")
+        return source, {}
+    except UnicodeEncodeError:
+        pass
+
+    replacements: dict[str, str] = {}
+    rendered: list[str] = []
+    for char in source:
+        try:
+            char.encode("gbk")
+            rendered.append(char)
+        except UnicodeEncodeError:
+            replacement = _WINDOWS_GBK_SAFE_REPLACEMENTS.get(char, "?")
+            replacements.setdefault(char, replacement)
+            rendered.append(replacement)
+    return "".join(rendered), replacements
+
+
 def _truncate_leaf_text(text: str, *, limit: int) -> str:
     if limit <= 0 or len(text) <= limit:
         return text
@@ -464,6 +580,56 @@ def _mcp_result_payload(item: dict[str, Any]) -> dict[str, Any]:
     return {}
 
 
+def _parse_single_text_content(value: Any) -> Any | None:
+    if not isinstance(value, list) or len(value) != 1:
+        return None
+    item = value[0]
+    if not isinstance(item, dict):
+        return None
+    text = item.get("text")
+    if not isinstance(text, str) or not text.strip():
+        return None
+    try:
+        return json.loads(text)
+    except json.JSONDecodeError:
+        return text
+
+
+def _raw_tool_result_payload(event: dict[str, Any]) -> Any | None:
+    item = event.get("item") if isinstance(event.get("item"), dict) else {}
+    item_type = str(item.get("type") or event.get("item_type") or "")
+    if item_type == "mcp_tool_call":
+        result = item.get("result")
+        if isinstance(result, dict):
+            structured = result.get("structured_content") or result.get("structuredContent")
+            if structured is not None:
+                return structured
+            parsed_content = _parse_single_text_content(result.get("content"))
+            if parsed_content is not None:
+                return parsed_content
+            return result
+        if result is not None:
+            return result
+
+    for value in (
+        item.get("result"),
+        item.get("aggregated_output"),
+        item.get("changes"),
+        item.get("output"),
+        item.get("content"),
+        item.get("error"),
+        event.get("result"),
+        event.get("aggregated_output"),
+        event.get("changes"),
+        event.get("output"),
+        event.get("content"),
+        event.get("error"),
+    ):
+        if value is not None:
+            return value
+    return None
+
+
 def _mcp_tool_metadata(
     *,
     quest_id: str,
@@ -743,6 +909,8 @@ class CodexRunner:
             "stdout": subprocess.PIPE,
             "stderr": subprocess.PIPE,
             "text": True,
+            "encoding": "utf-8",
+            "errors": "replace",
             **process_session_popen_kwargs(hide_window=True),
         }
 
@@ -762,7 +930,16 @@ class CodexRunner:
             retry_context=request.retry_context,
         )
         prompt = self._apply_chat_wire_tool_call_guard(prompt, runner_config=runner_config)
+        prompt_to_send = prompt
+        prompt_sanitization: dict[str, str] = {}
+        sanitized_prompt_path: str | None = None
+        if os.name == "nt":
+            prompt_to_send, prompt_sanitization = _sanitize_text_for_windows_gbk(prompt)
         write_text(run_root / "prompt.md", prompt)
+        if prompt_sanitization:
+            sanitized_path = run_root / "prompt.windows-gbk-sanitized.md"
+            write_text(sanitized_path, prompt_to_send)
+            sanitized_prompt_path = str(sanitized_path)
 
         codex_home = self._prepare_project_codex_home(
             workspace_root,
@@ -771,7 +948,7 @@ class CodexRunner:
             run_id=request.run_id,
             runner_config=runner_config,
         )
-        command = self._build_command(request, prompt, runner_config=runner_config)
+        command = self._build_command(request, prompt_to_send, runner_config=runner_config)
         write_json(
             run_root / "command.json",
             {
@@ -783,8 +960,39 @@ class CodexRunner:
                 "turn_reason": request.turn_reason,
                 "turn_intent": request.turn_intent,
                 "turn_mode": request.turn_mode,
+                "windows_gbk_prompt_sanitized": bool(prompt_sanitization),
+                "windows_gbk_sanitized_prompt_path": sanitized_prompt_path,
+                "windows_gbk_replacements": prompt_sanitization,
             },
         )
+        configured_tool_budget = runner_config.get("tool_call_budget")
+        if not isinstance(configured_tool_budget, int):
+            configured_tool_budget = DEFAULT_TURN_TOOL_CALL_BUDGET
+        tool_budget_telemetry = _new_tool_budget_telemetry(tool_call_budget=configured_tool_budget)
+        telemetry: dict[str, Any] = {
+            "version": 1,
+            "quest_id": request.quest_id,
+            "run_id": request.run_id,
+            "skill_id": request.skill_id,
+            "turn_reason": request.turn_reason,
+            "turn_intent": request.turn_intent,
+            "turn_mode": request.turn_mode,
+            "model": request.model,
+            "model_inherited": str(request.model or "").strip().lower()
+            in {"", "inherit", "default", "codex-default", "inherit_local_codex_default"},
+            "reasoning_effort": request.reasoning_effort,
+            "runner_profile": str(runner_config.get("profile") or "").strip() or None,
+            "prompt_bytes": len(prompt.encode("utf-8", errors="replace")),
+            "stdout_event_count": 0,
+            "stdout_bytes": 0,
+            "tool_result_count": 0,
+            "tool_result_bytes_total": 0,
+            "compacted_tool_result_count": 0,
+            "full_detail_tool_call_count": 0,
+            **tool_budget_telemetry,
+            "token_usage": {},
+            "created_at": utc_now(),
+        }
 
         env = dict(**os.environ)
         runner_env = runner_config.get("env") if isinstance(runner_config.get("env"), dict) else {}
@@ -799,6 +1007,7 @@ class CodexRunner:
         env["CODEX_HOME"] = str(codex_home)
         env = self._sanitize_provider_env(env, runner_config=runner_config)
         env["DEEPSCIENTIST_HOME"] = str(self.home)
+        env["DEEPSCIENTIST_REPO_ROOT"] = str(self.repo_root)
         env["DS_HOME"] = str(self.home)
         env["DS_QUEST_ID"] = request.quest_id
         env["DS_QUEST_ROOT"] = str(request.quest_root)
@@ -812,6 +1021,7 @@ class CodexRunner:
         env["DS_CONVERSATION_ID"] = f"quest:{request.quest_id}"
         env["DS_AGENT_ROLE"] = request.skill_id
         env["DS_TEAM_MODE"] = "single"
+        env = ensure_utf8_subprocess_env(env)
         popen_kwargs = self._subprocess_popen_kwargs(workspace_root=workspace_root, env=env)
         process = subprocess.Popen(command, **popen_kwargs)
         with self._process_lock:
@@ -820,11 +1030,6 @@ class CodexRunner:
         assert process.stdout is not None
         assert process.stderr is not None
         try:
-            process.stdin.write(prompt)
-            process.stdin.close()
-
-            output_parts: list[str] = []
-            final_output_parts: list[str] = []
             history_events = history_root / "events.jsonl"
             stdout_events = run_root / "stdout.jsonl"
             quest_events = request.quest_root / ".ds" / "events.jsonl"
@@ -843,15 +1048,74 @@ class CodexRunner:
                     "created_at": utc_now(),
                 },
             )
+            if prompt_sanitization:
+                append_jsonl(
+                    quest_events,
+                    {
+                        "event_id": generate_id("evt"),
+                        "type": "runner.prompt_sanitized",
+                        "quest_id": request.quest_id,
+                        "run_id": request.run_id,
+                        "source": "codex",
+                        "skill_id": request.skill_id,
+                        "summary": (
+                            "Windows GBK-compatible prompt sanitization replaced non-encodable characters "
+                            "before sending the prompt to Codex."
+                        ),
+                        "replacements": prompt_sanitization,
+                        "created_at": utc_now(),
+                    },
+                )
+
+            try:
+                process.stdin.write(prompt_to_send)
+            except UnicodeEncodeError as exc:
+                if os.name == "nt" and not prompt_sanitization:
+                    prompt_to_send, prompt_sanitization = _sanitize_text_for_windows_gbk(prompt)
+                    if not prompt_sanitization:
+                        raise exc
+                    sanitized_path = run_root / "prompt.windows-gbk-sanitized.md"
+                    write_text(sanitized_path, prompt_to_send)
+                    append_jsonl(
+                        quest_events,
+                        {
+                            "event_id": generate_id("evt"),
+                            "type": "runner.prompt_sanitized",
+                            "quest_id": request.quest_id,
+                            "run_id": request.run_id,
+                            "source": "codex",
+                            "skill_id": request.skill_id,
+                            "summary": (
+                                "Windows GBK-compatible prompt sanitization retried after a UnicodeEncodeError "
+                                "while writing the prompt to Codex."
+                            ),
+                            "replacements": prompt_sanitization,
+                            "created_at": utc_now(),
+                        },
+                    )
+                    process.stdin.write(prompt_to_send)
+                else:
+                    raise exc
+            process.stdin.close()
+
+            output_parts: list[str] = []
+            final_output_parts: list[str] = []
 
             for raw_line in process.stdout:
                 line = raw_line.rstrip("\n")
                 if not line:
                     continue
+                telemetry["stdout_event_count"] = int(telemetry.get("stdout_event_count") or 0) + 1
+                telemetry["stdout_bytes"] = int(telemetry.get("stdout_bytes") or 0) + len(
+                    line.encode("utf-8", errors="replace")
+                )
                 try:
                     payload = json.loads(line)
                 except json.JSONDecodeError:
                     payload = {"raw": line}
+                usage_metrics = _usage_metrics_from_event(payload)
+                if usage_metrics:
+                    telemetry["token_usage"] = usage_metrics
                 timestamp = utc_now()
                 append_jsonl(history_events, {"timestamp": timestamp, "event": payload})
                 append_jsonl(stdout_events, {"timestamp": timestamp, "line": line})
@@ -871,6 +1135,39 @@ class CodexRunner:
                     created_at=timestamp,
                 )
                 if tool_event is not None:
+                    if str(tool_event.get("type") or "") == "runner.tool_call":
+                        _record_tool_budget_event(telemetry, tool_event)
+                        args_text = str(tool_event.get("args") or "")
+                        if "detail" in args_text and "full" in args_text.lower():
+                            telemetry["full_detail_tool_call_count"] = int(
+                                telemetry.get("full_detail_tool_call_count") or 0
+                            ) + 1
+                    if str(tool_event.get("type") or "") == "runner.tool_result":
+                        raw_tool_payload = _raw_tool_result_payload(payload)
+                        compaction_kwargs: dict[str, Any] = {}
+                        if raw_tool_payload is not None:
+                            compaction_kwargs["raw_payload"] = raw_tool_payload
+                        compacted_tool_event, compaction_meta = compact_runner_tool_event(
+                            tool_event,
+                            quest_root=request.quest_root,
+                            run_id=request.run_id,
+                            **compaction_kwargs,
+                        )
+                        tool_event = compacted_tool_event
+                        telemetry["tool_result_count"] = int(telemetry.get("tool_result_count") or 0) + 1
+                        telemetry["tool_result_bytes_total"] = int(
+                            telemetry.get("tool_result_bytes_total") or 0
+                        ) + int(
+                            compaction_meta.get("source_payload_bytes")
+                            or compaction_meta.get("output_bytes")
+                            or compaction_meta.get("payload_bytes")
+                            or 0
+                        )
+                        if bool(compaction_meta.get("compacted")):
+                            telemetry["compacted_tool_result_count"] = int(
+                                telemetry.get("compacted_tool_result_count") or 0
+                            ) + 1
+                        _record_tool_budget_event(telemetry, tool_event)
                     append_jsonl(quest_events, tool_event)
                 message_events, message_output_parts = _message_events(
                     payload,
@@ -901,6 +1198,18 @@ class CodexRunner:
                 )
                 or summary_text
             )
+            self._apply_start_setup_patch_fallback_if_present(
+                request=request,
+                output_text=output_text,
+                quest_events=quest_events,
+            )
+            telemetry["exit_code"] = exit_code
+            telemetry["stderr_bytes"] = len(stderr_text.encode("utf-8", errors="replace"))
+            telemetry["output_text_bytes"] = len(output_text.encode("utf-8", errors="replace"))
+            telemetry["completed_at"] = utc_now()
+            _finalize_tool_budget_telemetry(telemetry)
+            telemetry_path = run_root / "telemetry.json"
+            write_json(telemetry_path, telemetry)
             append_jsonl(
                 quest_events,
                 {
@@ -917,6 +1226,37 @@ class CodexRunner:
                     "created_at": utc_now(),
                 },
             )
+            append_jsonl(
+                quest_events,
+                {
+                    "event_id": generate_id("evt"),
+                    "type": "runner.turn_telemetry",
+                    "quest_id": request.quest_id,
+                    "run_id": request.run_id,
+                    "source": "codex",
+                    "skill_id": request.skill_id,
+                    "model": request.model,
+                    "prompt_bytes": telemetry.get("prompt_bytes"),
+                    "stdout_bytes": telemetry.get("stdout_bytes"),
+                    "tool_call_budget": telemetry.get("tool_call_budget"),
+                    "tool_call_count": telemetry.get("tool_call_count"),
+                    "tool_count": telemetry.get("tool_count"),
+                    "tool_call_budget_remaining": telemetry.get("tool_call_budget_remaining"),
+                    "tool_call_budget_exceeded": telemetry.get("tool_call_budget_exceeded"),
+                    "unique_command_count": telemetry.get("unique_command_count"),
+                    "read_tool_call_count": telemetry.get("read_tool_call_count"),
+                    "repeated_read_result_count": telemetry.get("repeated_read_result_count"),
+                    "repeated_read_ratio": telemetry.get("repeated_read_ratio"),
+                    "tool_result_bytes_total": telemetry.get("tool_result_bytes_total"),
+                    "compacted_tool_result_count": telemetry.get("compacted_tool_result_count"),
+                    "saved_bytes": telemetry.get("saved_bytes"),
+                    "full_detail_tool_call_count": telemetry.get("full_detail_tool_call_count"),
+                    "full_detail_count": telemetry.get("full_detail_count"),
+                    "token_usage": telemetry.get("token_usage"),
+                    "telemetry_path": str(telemetry_path),
+                    "created_at": utc_now(),
+                },
+            )
             write_text(history_root / "assistant.md", (output_text or "") + ("\n" if output_text else ""))
             write_text(run_root / "stderr.txt", stderr_text)
             result_payload = {
@@ -926,6 +1266,7 @@ class CodexRunner:
                 "exit_code": exit_code,
                 "history_root": str(history_root),
                 "run_root": str(run_root),
+                "telemetry_path": str(telemetry_path),
                 "output_text": output_text,
                 "stderr_text": stderr_text,
                 "completed_at": utc_now(),
@@ -1027,6 +1368,50 @@ class CodexRunner:
             process.wait(timeout=3)
         return interrupted
 
+    def _apply_start_setup_patch_fallback_if_present(
+        self,
+        *,
+        request: RunRequest,
+        output_text: str,
+        quest_events: Path,
+    ) -> None:
+        quest_yaml = read_yaml(request.quest_root / "quest.yaml", {})
+        startup_contract = quest_yaml.get("startup_contract") if isinstance(quest_yaml.get("startup_contract"), dict) else {}
+        if not isinstance(startup_contract.get("start_setup_session"), dict):
+            return
+        patch = extract_start_setup_patch_from_text(output_text)
+        session_patch = extract_start_setup_session_patch_from_text(output_text)
+        if not patch and not session_patch:
+            return
+        result = self.artifact_service.apply_start_setup_form_patch(
+            request.quest_root,
+            form_patch=patch,
+            session_patch=session_patch,
+            message="Applied from runner fallback `start_setup_patch` block.",
+        )
+        patch_keys = sorted(result.get("form_patch", {}).keys()) if isinstance(result.get("form_patch"), dict) else sorted((patch or {}).keys())
+        append_jsonl(
+            quest_events,
+            {
+                "event_id": generate_id("evt"),
+                "type": "runner.turn_postprocess_info",
+                "quest_id": request.quest_id,
+                "run_id": request.run_id,
+                "source": "codex",
+                "skill_id": request.skill_id,
+                "summary": (
+                    "Applied the fenced `start_setup_patch` fallback block to the quest startup form "
+                    "so the suggested form stays synchronized even when Codex answered with a patch block "
+                    "instead of a direct MCP tool call."
+                ),
+                "details": {
+                    "warning_code": "start_setup_patch_fallback_applied",
+                    "patch_keys": patch_keys,
+                },
+                "created_at": utc_now(),
+            },
+        )
+
     def _build_command(self, request: RunRequest, prompt: str, *, runner_config: dict[str, Any] | None = None) -> list[str]:
         workspace_root = request.worktree_root or request.quest_root
         resolved_binary = resolve_runner_binary(self.binary, runner_name="codex")
@@ -1063,7 +1448,9 @@ class CodexRunner:
         tool_timeout_sec = self._positive_timeout_seconds(resolved_runner_config.get("mcp_tool_timeout_sec"))
         if tool_timeout_sec is not None:
             timeout_value = int(tool_timeout_sec) if float(tool_timeout_sec).is_integer() else float(tool_timeout_sec)
-            for server_name in ("memory", "artifact", "bash_exec"):
+            custom_profile = resolve_mcp_tool_profile_for_quest(request.quest_root)
+            server_names = builtin_mcp_server_names_for_custom_profile(custom_profile)
+            for server_name in server_names:
                 command.extend(["-c", f"mcp_servers.{server_name}.tool_timeout_sec={timeout_value}"])
         if request.sandbox_mode:
             command.extend(["--sandbox", request.sandbox_mode])
@@ -1162,8 +1549,9 @@ class CodexRunner:
         resolved_runner_config = runner_config if isinstance(runner_config, dict) else self._load_runner_config()
         tool_timeout_sec = self._positive_timeout_seconds(resolved_runner_config.get("mcp_tool_timeout_sec"))
 
-        shared_env = {
+        shared_env = ensure_utf8_subprocess_env({
             "DEEPSCIENTIST_HOME": str(self.home),
+            "DEEPSCIENTIST_REPO_ROOT": str(self.repo_root),
             "DS_HOME": str(self.home),
             "DS_QUEST_ID": quest_id,
             "DS_QUEST_ROOT": str(quest_root),
@@ -1174,26 +1562,38 @@ class CodexRunner:
             "DS_CONVERSATION_ID": f"quest:{quest_id}",
             "DS_AGENT_ROLE": "pi",
             "DS_TEAM_MODE": "single",
-        }
+        })
+        custom_profile = resolve_mcp_tool_profile_for_quest(quest_root)
+        if custom_profile:
+            shared_env["DS_CUSTOM_PROFILE"] = custom_profile
         if pythonpath:
             shared_env["PYTHONPATH"] = pythonpath
 
+        server_names = builtin_mcp_server_names_for_custom_profile(custom_profile)
+        tool_approvals = _builtin_mcp_tool_approvals_for_profile(custom_profile)
         block = "\n".join(
-            [
-                marker_start,
-                self._mcp_block("memory", shared_env, tool_timeout_sec=tool_timeout_sec),
-                "",
-                self._mcp_block("artifact", shared_env, tool_timeout_sec=tool_timeout_sec),
-                "",
-                self._mcp_block("bash_exec", shared_env, tool_timeout_sec=tool_timeout_sec),
-                marker_end,
+            [marker_start]
+            + [
+                item
+                for index, name in enumerate(server_names)
+                for item in (
+                    [self._mcp_block(name, shared_env, tool_timeout_sec=tool_timeout_sec, approvals=tool_approvals.get(name, ()))]
+                    + ([""] if index < len(server_names) - 1 else [])
+                )
             ]
+            + [marker_end]
         ).strip()
         new_text = f"{prefix}\n\n{block}\n" if prefix else f"{block}\n"
         write_text(config_path, new_text)
 
     @staticmethod
-    def _mcp_block(name: str, env: dict[str, str], *, tool_timeout_sec: float | None = None) -> str:
+    def _mcp_block(
+        name: str,
+        env: dict[str, str],
+        *,
+        tool_timeout_sec: float | None = None,
+        approvals: tuple[str, ...] = (),
+    ) -> str:
         args = ["-m", "deepscientist.mcp.server", "--namespace", name]
         lines = [
             f"[mcp_servers.{name}]",
@@ -1212,7 +1612,7 @@ class CodexRunner:
         )
         for key, value in env.items():
             lines.append(f"{key} = {json.dumps(value)}")
-        for tool_name in _BUILTIN_MCP_TOOL_APPROVALS.get(name, ()):
+        for tool_name in approvals:
             lines.extend(
                 [
                     "",