Support Codex rule injection hooks

.gitattributes

@@ -0,0 +1,13 @@
+# Normalize line endings: store LF in git, check out LF on every platform.
+# Required so biome's --check passes on Windows (default core.autocrlf=true).
+* text=auto eol=lf
+
+# Explicit binary types
+*.png binary
+*.jpg binary
+*.jpeg binary
+*.gif binary
+*.ico binary
+*.zip binary
+*.tgz binary
+*.gz binary

.github/workflows/ci.yml

@@ -22,7 +22,7 @@ jobs:
     strategy:
       fail-fast: false
       matrix:
-        os: [ubuntu-latest, macos-latest]
+        os: [ubuntu-latest, macos-latest, windows-latest]
         node: ["20", "22"]
     steps:
       - name: Checkout

CHANGELOG.md

@@ -1,5 +1,14 @@
 # Changelog
 
+## Unreleased
+
+- Add `PostToolUse` matching for MCP filesystem write, edit, and multi-read payloads.
+- Harden dynamic hook coverage for additional-context JSON output, disabled/static modes, failed tool responses, and duplicate suppression.
+- Remove redundant apply_patch path scanning and stale tracked-tool constants.
+- Use portable Codex hook interpolation and add package smoke coverage for hook entrypoints.
+- Cap recursive rule directory scans and run CI on Windows in addition to Ubuntu and macOS.
+- Replace the external glob matcher dependency with an internal matcher so clean Codex plugin installs run without `node_modules`.
+
 ## 0.1.0 - 2026-05-15
 
 - Port `pi-rules` rule loading, matching, formatting, truncation, and deduplication to a Codex plugin.

README.md

@@ -5,9 +5,13 @@ Codex plugin that injects local project rule files into model context through li
 It ports the `pi-rules` rule injector to Codex:
 
 - `SessionStart` and `UserPromptSubmit` load static project instructions once per session.
-- `PostToolUse` watches file reads and edits, then injects matching file-specific rules.
+- `PostToolUse` watches supported file reads, edits, `apply_patch`, MCP filesystem payloads, and shell command file references, then injects matching file-specific rules as additional context.
 - Session-level deduplication prevents the same rule from being repeated after it has been injected.
 
+`PostToolUse` output is context-only: it emits `hookSpecificOutput.additionalContext` and does not rewrite tool output.
+
+The runtime has no npm production dependencies, so a clean Codex marketplace copy can run without a follow-up `npm install`.
+
 ## Rule Sources
 
 Project-level sources:
@@ -44,7 +48,7 @@ codex plugin marketplace add /Users/yeongyu/local-workspaces/codex-plugins
 node /Users/yeongyu/local-workspaces/codex-plugins/scripts/install-local.mjs /Users/yeongyu/local-workspaces/codex-plugins
 ```
 
-The local installer builds the plugin, copies a clean cache entry to:
+The local installer builds the plugin and copies a clean cache entry to:
 
 ```text
 ~/.codex/plugins/cache/code-yeongyu-codex-plugins/codex-rules/0.1.0
@@ -55,6 +59,7 @@ It also enables:
 ```toml
 [features]
 plugins = true
+plugin_hooks = true
 
 [plugins."codex-rules@code-yeongyu-codex-plugins"]
 enabled = true
@@ -80,6 +85,7 @@ For migration from `pi-rules`, equivalent `PI_RULES_*` variables are accepted as
 npm install
 npm test
 npm run check
+npm run typecheck
 npm pack --dry-run
 ```
 

dist/rules/constants.d.ts

@@ -37,6 +37,7 @@ export declare const GLOBAL_DISTANCE = 9999;
  * Per-rule body character cap (default).
  */
 export declare const DEFAULT_MAX_RULE_CHARS = 12000;
+export declare const DEFAULT_MAX_SCAN_FILES = 1000;
 /**
  * Total injected chars per tool result (default).
  */
@@ -45,11 +46,6 @@ export declare const DEFAULT_MAX_RESULT_CHARS = 40000;
  * Truncation marker template. `{path}` is replaced with the relative path.
  */
 export declare const TRUNCATION_NOTICE = "\n\n[Rule truncated. Read full rule: {path}]";
-/**
- * Built-in tool names whose results trigger dynamic rule injection.
- */
-export declare const TRACKED_BUILTIN_TOOLS: readonly string[];
-export declare const TRACKED_BUILTIN_TOOL_SET: ReadonlySet<string>;
 /**
  * Directories excluded by the recursive scanner regardless of glob settings.
  */