Support Codex rule injection hooks

[code-yeongyu]

Summary

• Add Codex rule injection hook support.
• Cache dynamic rule discovery and matcher work.
• Harden malformed hook input and Windows path handling.

Improvement table

Area	Baseline / risk before this PR	Final pinned behavior	Delta / proof
Codex hook support	No Codex rule-injection hook surface.	SessionStart, UserPromptSubmit, PostToolUse, and PostCompact hook paths covered.	New behavior pinned by test/codex-hook.test.ts.
Dynamic duplicate targets	Repeated targets could repeat discovery/read/match work.	Duplicate-target benchmark and engine counters are tracked by scripts/bench-codex-rules.mjs.	Baseline recorded: duplicate-targets median 5.555042ms, counters findProjectRoot:40, findCandidates:40, readFile:4800.
Distinct targets	Distinct target fan-out was not benchmarked.	Distinct-target benchmark records discovery/read counters.	Baseline recorded: distinct-targets median 28.971417ms, counters findProjectRoot:40, findCandidates:3200, readFile:4800.
Repeated hook fast path	Repeat PostToolUse output/work was not pinned.	Benchmark compares repeat output bytes and median repeat duration against baseline.	npm run bench passes and guards repeat-output regressions.

Verification

• npm test
• npm run check
• npm run bench
• npm pack --dry-run
• no-excuse TypeScript gate

Review

• Local verification completed for Codex plugin behavior.
• Cubic review passed before merge.

[cubic-dev-ai]

3 issues found across 50 files

Prompt for AI agents (unresolved issues)

Check if these issues are valid — if so, understand the root cause of each and fix them. If appropriate, use sub-agents to investigate and fix each issue separately.


<file name="src/rules/matcher.ts">

<violation number="1" location="src/rules/matcher.ts:130">
P1: Replacing `picomatch` with `globToRegExp` narrows supported glob syntax and can break existing rule patterns (e.g., character classes/extglob), causing unexpected rule match failures.</violation>
</file>

<file name="test/codex-hook.test.ts">

<violation number="1" location="test/codex-hook.test.ts:25">
P2: Use `fileURLToPath()` here instead of `.pathname`; the current value is not a portable file path.</violation>
</file>

<file name="scripts/bench-codex-rules.mjs">

<violation number="1" location="scripts/bench-codex-rules.mjs:109">
P2: Move target generation outside the timer so the benchmark measures `loadDynamicRules()` rather than path निर्माण overhead.</violation>
</file>

_{Reply with feedback, questions, or to request a fix. Tag @cubic-dev-ai to re-run a review.
Re-trigger cubic}

[cubic-dev-ai]

P1: Replacing picomatch with globToRegExp narrows supported glob syntax and can break existing rule patterns (e.g., character classes/extglob), causing unexpected rule match failures.

Prompt for AI agents

Check if this issue is valid — if so, understand the root cause and fix it. At src/rules/matcher.ts, line 130:

<comment>Replacing `picomatch` with `globToRegExp` narrows supported glob syntax and can break existing rule patterns (e.g., character classes/extglob), causing unexpected rule match failures.</comment>

<file context>
@@ -83,6 +85,100 @@ function normalizePath(path: string): string {
+	return (path: string) => expression.test(path);
+}
+
+function globToRegExp(pattern: string): RegExp {
+	let source = "^";
+	for (let index = 0; index < pattern.length; index += 1) {
</file context>

[cubic-dev-ai]

1 issue found across 6 files (changes from recent commits).

Prompt for AI agents (unresolved issues)

Check if these issues are valid — if so, understand the root cause of each and fix them. If appropriate, use sub-agents to investigate and fix each issue separately.


<file name="src/rules/engine.ts">

<violation number="1" location="src/rules/engine.ts:201">
P2: Dynamic match cache key omits frontmatter changes, which can return stale match decisions after rule metadata-only edits.</violation>
</file>

_{Tip: Review your code locally with the cubic CLI to iterate faster.
Re-trigger cubic}

[cubic-dev-ai]

1 issue found across 24 files (changes from recent commits).

Prompt for AI agents (unresolved issues)

Check if these issues are valid — if so, understand the root cause of each and fix them. If appropriate, use sub-agents to investigate and fix each issue separately.


<file name="scripts/bench-codex-rules.mjs">

<violation number="1" location="scripts/bench-codex-rules.mjs:62">
P2: `hookFastPath` is never included in `--compare`, so regressions in the new benchmark path will not fail CI.</violation>
</file>

_{Tip: Review your code locally with the cubic CLI to iterate faster.
Re-trigger cubic}

[code-yeongyu]

Status update: CI matrix, GitGuardian, and Cubic are all green for head ac04990. Normal merge is still blocked by base branch policy, and repository auto-merge is disabled. Please merge through the protected-branch flow or adjust the required policy condition; no admin bypass was used.

[code-yeongyu]

Status update: CI matrix, GitGuardian, and Cubic are green for head ac04990. Normal merge is still blocked by base branch policy and repository auto-merge is disabled. Please merge through the protected-branch flow or adjust the required policy condition. No admin bypass was used.