feat: add Codex-native React Doctor loop

[aidenybai]

Summary

• add a Codex-native internal plugin that continuously audits and fixes React Doctor false positives
• dynamically activate the workflow through Codex hooks instead of maintaining a separate CLI driver
• codify the ReactBench audit process: semantic root-cause cohorts, current-main verification, exact callsite evidence, true-positive controls, focused tests, fuzzing, and exact base/head parity
• isolate ChatGPT-plan authentication behind a dedicated CODEX_HOME, with no API-key fallback or committed credentials
• wrap Daytona evaluation with fixed concurrency, sandbox, repository, duration, and daily launch limits
• require loop/* branches and draft PRs while blocking merge, release, publish, tag, auth mutation, and unsafe push actions

Validation

• 9 hook tests pass
• plugin manifest and hook configuration validate
• loop skill validates
• formatting check passes
• targeted plugin lint passes

No live Codex inference or Daytona evaluation was run as part of this change.

---

Note

Medium Risk
New agent automation that can create PRs and run Daytona evals while reading DAYTONA_API_KEY from .env.local; risk is mitigated by fail-closed hooks, draft-only PR rules, and daily/concurrency budgets.

Overview
Adds a Codex-native react-doctor-loop plugin that turns confirmed React Doctor false-positive cohorts into validated, review-only draft PRs—without a separate CLI driver.

Activation and safety live in Codex hooks: the loop turns on from $react-doctor-loop prompts, then blocks merge/ready, release/publish, force or main pushes, auth mutation, secret reads, and non-draft/[loop] PRs. Stop only advances after complete.mjs verifies a loop/* branch, required evidence (tests, fuzz, coverage ledger, RDE parity), allowed path prefixes, and an open draft PR.

Daytona access is funneled through run-daytona-eval.mjs, which injects only DAYTONA_API_KEY, strips other credentials, and caps runs (2/day, ≤2k repos, concurrency 200, 30 minutes). The skill documents the audit → narrow fix → prove → draft-PR gold path; marketplace + .gitignore updates track the plugin and ignore local loop state.

^{Reviewed by Cursor Bugbot for commit 566a520. Bugbot is set up for automated code reviews on this repo. Configure here.}

[github-actions]

Interactive terminal E2E

Terminal Control verified the built CLI at 566a520 in a real PTY:

• selected a project interactively and observed Scanning... before the three-second Git delay completed
• waited for the clean result and exercised the compact report
• opened copy context and the GitHub Actions confirmation, then cancelled safely

Download the edited MP4 and PNG evidence

[pkg-pr-new]

Open in StackBlitz

npm i https://pkg.pr.new/eslint-plugin-react-doctor@1614

npm i https://pkg.pr.new/oxlint-plugin-react-doctor@1614

npm i https://pkg.pr.new/react-doctor@1614

commit: 566a520

[github-actions]

React Doctor found no new issues. 🎉

_{Reviewed by React Doctor for commit 566a520.}

[cursor]

Cursor Bugbot has reviewed your changes using high effort and found 1 potential issue.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit 566a520. Configure here.}

[cursor]

Daytona wrapper easily bypassed

High Severity

The PreToolUse Daytona gate only matches nr ... eval or the substring packages/evals. Commands such as pnpm --filter @react-doctor/evals eval never hit that check, so the agent can run unbounded evals outside run-daytona-eval.mjs and skip the daily limit and credential scrubbing.

 

^{Reviewed by Cursor Bugbot for commit 566a520. Configure here.}