feat(codexcli): follow the SessionEnd hook, Windows command override, and MCP environment targeting

[dyoshikawa]

Background

Related issue: #2398

Codex CLI added a SessionEnd hook event (0.145.0, PR #33895), the per-hook commandWindows override (0.131.0, PR #22159) and statusMessage, and per-server MCP environment targeting (0.134.0, PR #23583). Rulesync followed none of them. Each was re-verified against the hooks reference and the MCP reference before implementing — note that developers.openai.com/codex/* now 308-redirects to learn.chatgpt.com/docs/*.

Changes

hooks — SessionEnd. Added to CODEXCLI_HOOK_EVENTS and CANONICAL_TO_CODEXCLI_EVENT_NAMES. The canonical sessionEnd event already existed, so a .rulesync/hooks.jsonc block that was silently dropped for codexcli now generates, and an existing .codex/hooks.json imports back.

hooks — commandWindows / statusMessage. commandWindows is new on HookDefinitionSchema; statusMessage was already there for Qwen Code. Both are wired through stringPassthroughFields for codexcli, whose canonical union widened accordingly. commandWindows is the material one: without it a rulesync-generated hook set cannot be made cross-platform.

mcp — env_vars object entries. envVars entries may now be { name, source } as well as bare names, matching the documented env_vars = ["LOCAL_TOKEN", { name = "REMOTE_TOKEN", source = "remote" }]. The isStringArray guard in codexcli-mcp.ts is relaxed for env_vars only — enabled_tools / disabled_tools still require plain string arrays.

mcp — experimental_environment. Modelled as the codex-scoped canonical experimentalEnvironment, following the envVars precedent: declared in McpServerSchema, stripped in RulesyncMcp.getMcpServers(), re-added in CodexcliMcp.fromRulesyncMcp. This fixes a real leak — it previously reached .codex/config.toml only as unmodelled passthrough, which meant it was also copied into every other tool's MCP config. The raw snake_case spelling is stripped and re-read too, so a server config pasted out of a config.toml keeps working.

Verified by hand that both directions round-trip exactly and that nothing leaks into a sibling target's config.

Not changed

Gap 5 of the issue (surface the custom-prompts deprecation) is already done: docs/reference/file-formats.md has carried the "Custom prompts are deprecated. Use skills for reusable instructions" note since an earlier merge. No further action.

Verification

• pnpm cicheck (full: code + content)
• npx vitest run --config vitest.e2e.config.ts src/e2e/e2e-hooks.spec.ts src/e2e/e2e-mcp.spec.ts
• Manual generate/import round trips for both features in a scratch project.

Closes #2398