codex-plugin-doctor 0.21.0 → 1.0.0-rc.2

package/README.md

@@ -194,8 +194,8 @@ codex-plugin-doctor doctor contract
 codex-plugin-doctor doctor contract --json --output output-contract.json
 codex-plugin-doctor doctor corpus
 codex-plugin-doctor doctor corpus --json --output validation-corpus.json
-codex-plugin-doctor doctor npm codex-plugin-doctor
-codex-plugin-doctor doctor npm codex-plugin-doctor --json --output npm-preinstall.json
+codex-plugin-doctor doctor npm <published-plugin-package>
+codex-plugin-doctor doctor npm <published-plugin-package> --json --output npm-preinstall.json
 codex-plugin-doctor doctor attest .
 codex-plugin-doctor doctor attest . --json --output attestation.json
 codex-plugin-doctor doctor inspector .
@@ -276,7 +276,7 @@ codex-plugin-doctor check . --json --runtime --verbose-runtime
 
 `self-test` runs the bundled runtime-complete sample through static validation, runtime MCP probes, and the compatibility scorecard. It is the fastest post-install check after `npm install -g codex-plugin-doctor`.
 
-`doctor` checks the local environment, including package version, platform, Node version, npm global prefix, Codex home, and Codex plugin cache visibility. The text output also includes recommended next commands for self-test, installed plugin discovery, runtime checks, compatibility scoring, and CI setup. `doctor contract` publishes the machine-readable output contract, including public JSON schema surfaces, stable-through-1.0 compatibility metadata, and a frozen rule catalog digest. Add `--json` for automation or `--output output-contract.json` to write the contract to disk. `doctor corpus` runs the bundled validation corpus against healthy runtime, risky security, and starter skill packages, then reports whether each case matched its expected outcome. Add `--json` for automation or `--output validation-corpus.json` to write the corpus report to disk. `doctor npm <package>` runs a preinstall scan by packing the npm package with scripts disabled, extracting the publish tarball, and running validation, security, trust, and recommendation checks against the shipped contents. Add `--json` for automation or `--output npm-preinstall.json` to write the report to disk. `doctor attest <path>` creates a deterministic local attestation with a package fingerprint, report digest, validation/security/compatibility/trust summary, and unsigned verification metadata. Add `--json` for automation or `--output attestation.json` to write the artifact to disk. `doctor inspector <path>` builds a safe MCP Inspector launch command from a packaged `.mcp.json` file without starting the Inspector proxy automatically. Use `--server <name>` when the package contains multiple MCP server entries. `doctor diff --before <path> --after <path>` compares two package roots and reports new findings, resolved findings, trust score delta, and whether risk increased. `doctor recommend <path>` turns validation, security, and compatibility signals into a prioritized action plan with blocker, high, medium, and info actions. Add `--json` for automation or `--output recommendations.json` to write the report to disk. `doctor trust <path>` creates a local trust score from package lifecycle scripts, dependency specs, and MCP security findings. Use it before release when you want supply-chain risks summarized as one score. `doctor perf <path>` profiles the shared package analysis pipeline and reports per-stage durations for validation, config, security, compatibility, trust, recommendations, and total runtime. `doctor export --bundle <path>` creates a redacted operator handoff bundle that includes validation JSON, security scorecard data, compatibility matrix, recommendations, and trust score in one file. `doctor snapshot` creates a redacted diagnostics bundle with environment health, client config readiness, installed plugin metadata, and next commands. Add `--json` for machine-readable output or `--output doctor-snapshot.json` to write the bundle to disk. `doctor clients` reports local Codex, Claude Desktop, Cursor, Cline, and Windsurf config readiness. `doctor --update-check` compares the installed CLI version with the latest npm version and prints the upgrade command when a newer release is available.
+`doctor` checks the local environment, including package version, platform, Node version, npm global prefix, Codex home, and Codex plugin cache visibility. The text output also includes recommended next commands for self-test, installed plugin discovery, runtime checks, compatibility scoring, and CI setup. `doctor contract` publishes the machine-readable output contract, including public JSON schema surfaces, stable-through-1.0 compatibility metadata, and a frozen rule catalog digest. Add `--json` for automation or `--output output-contract.json` to write the contract to disk. `doctor corpus` runs the bundled validation corpus against healthy runtime, risky security, and starter skill packages, then reports whether each case matched its expected outcome. Add `--json` for automation or `--output validation-corpus.json` to write the corpus report to disk. `doctor npm <package>` runs a preinstall scan by packing the npm package with scripts disabled, extracting the publish tarball, and running validation, security, trust, and recommendation checks against the shipped contents. Use a published Codex plugin package as the target; scanning `codex-plugin-doctor` itself intentionally reports a missing plugin manifest because this CLI package is not a plugin package. Add `--json` for automation or `--output npm-preinstall.json` to write the report to disk. `doctor attest <path>` creates a deterministic local attestation with a package fingerprint, report digest, validation/security/compatibility/trust summary, and unsigned verification metadata. Add `--json` for automation or `--output attestation.json` to write the artifact to disk. `doctor inspector <path>` builds a safe MCP Inspector launch command from a packaged `.mcp.json` file without starting the Inspector proxy automatically. Use `--server <name>` when the package contains multiple MCP server entries. `doctor diff --before <path> --after <path>` compares two package roots and reports new findings, resolved findings, trust score delta, and whether risk increased. `doctor recommend <path>` turns validation, security, and compatibility signals into a prioritized action plan with blocker, high, medium, and info actions. Add `--json` for automation or `--output recommendations.json` to write the report to disk. `doctor trust <path>` creates a local trust score from package lifecycle scripts, dependency specs, and MCP security findings. Use it before release when you want supply-chain risks summarized as one score. `doctor perf <path>` profiles the shared package analysis pipeline and reports per-stage durations for validation, config, security, compatibility, trust, recommendations, and total runtime. `doctor export --bundle <path>` creates a redacted operator handoff bundle that includes validation JSON, security scorecard data, compatibility matrix, recommendations, and trust score in one file. `doctor snapshot` creates a redacted diagnostics bundle with environment health, client config readiness, installed plugin metadata, and next commands. Add `--json` for machine-readable output or `--output doctor-snapshot.json` to write the bundle to disk. `doctor clients` reports local Codex, Claude Desktop, Cursor, Cline, and Windsurf config readiness. `doctor --update-check` compares the installed CLI version with the latest npm version and prints the upgrade command when a newer release is available.
 
 `audit --installed` runs a local ecosystem audit against every discovered Codex plugin in the installed plugin cache. Add `--security` to include security scorecards, `--compat` to include the all-client compatibility matrix, and `--json --output local-audit.json` when you want a shareable machine-readable report. Add `--cache` to reuse unchanged plugin results between runs; add `--changed` to only report plugins whose fingerprint changed since the last cached audit. Use `--cache-file path/to/audit-cache.json` when CI or scripted runs need an explicit cache location.
 
@@ -342,9 +342,9 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v4
-      - uses: Esquetta/CodexPluginDoctor@v0.21.0
+      - uses: Esquetta/CodexPluginDoctor@v1.0.0-rc.2
         with:
-          version: "0.21.0"
+          version: "1.0.0-rc.2"
           path: .
           runtime: "true"
           policy: codex-publish

package/dist/release/release-sync.d.ts

@@ -6,9 +6,12 @@ export interface GitHubReleaseSyncState {
 export interface ReleaseSyncEvaluationInput {
     version: string;
     npmVersion: string;
+    npmDistTag?: string;
     remoteTagOutput: string;
     githubRelease: GitHubReleaseSyncState | null;
     latestReleaseTag: string;
+    expectPrerelease?: boolean;
+    requireLatestRelease?: boolean;
 }
 export interface ReleaseSyncCheck {
     id: string;

package/dist/release/release-sync.js

@@ -7,24 +7,31 @@ function buildCheck(id, status, message) {
 }
 export function evaluateReleaseSync(input) {
     const expectedTag = `v${input.version}`;
+    const npmDistTag = input.npmDistTag ?? "latest";
+    const expectPrerelease = input.expectPrerelease ?? false;
+    const requireLatestRelease = input.requireLatestRelease ?? !expectPrerelease;
     const checks = [];
     checks.push(input.npmVersion === input.version
-        ? buildCheck("npm.version", "pass", `npm latest is ${input.version}.`)
-        : buildCheck("npm.version", "fail", `npm latest is ${input.npmVersion || "missing"}, expected ${input.version}.`));
+        ? buildCheck("npm.version", "pass", `npm ${npmDistTag} is ${input.version}.`)
+        : buildCheck("npm.version", "fail", `npm ${npmDistTag} is ${input.npmVersion || "missing"}, expected ${input.version}.`));
     checks.push(input.remoteTagOutput.includes(`refs/tags/${expectedTag}`)
         ? buildCheck("git.remote_tag", "pass", `Remote tag ${expectedTag} exists.`)
         : buildCheck("git.remote_tag", "fail", `Remote tag ${expectedTag} is missing.`));
     const releaseMatches = input.githubRelease?.tagName === expectedTag &&
         !input.githubRelease.isDraft &&
-        !input.githubRelease.isPrerelease;
+        input.githubRelease.isPrerelease === expectPrerelease;
     checks.push(releaseMatches
-        ? buildCheck("github.release", "pass", `GitHub release ${expectedTag} is published.`)
+        ? buildCheck("github.release", "pass", expectPrerelease
+            ? `GitHub prerelease ${expectedTag} is published.`
+            : `GitHub release ${expectedTag} is published.`)
         : buildCheck("github.release", "fail", input.githubRelease
-            ? `GitHub release state is tag=${input.githubRelease.tagName}, draft=${input.githubRelease.isDraft}, prerelease=${input.githubRelease.isPrerelease}; expected published ${expectedTag}.`
+            ? `GitHub release state is tag=${input.githubRelease.tagName}, draft=${input.githubRelease.isDraft}, prerelease=${input.githubRelease.isPrerelease}; expected ${expectPrerelease ? "published prerelease" : "published release"} ${expectedTag}.`
             : `GitHub release ${expectedTag} is missing.`));
-    checks.push(input.latestReleaseTag === expectedTag
-        ? buildCheck("github.latest_release", "pass", `GitHub latest release is ${expectedTag}.`)
-        : buildCheck("github.latest_release", "fail", `GitHub latest release is ${input.latestReleaseTag || "missing"}, expected ${expectedTag}.`));
+    checks.push(!requireLatestRelease
+        ? buildCheck("github.latest_release", "pass", `GitHub latest release does not need to be ${expectedTag} for this prerelease verification.`)
+        : input.latestReleaseTag === expectedTag
+            ? buildCheck("github.latest_release", "pass", `GitHub latest release is ${expectedTag}.`)
+            : buildCheck("github.latest_release", "fail", `GitHub latest release is ${input.latestReleaseTag || "missing"}, expected ${expectedTag}.`));
     return {
         version: input.version,
         status: checks.some((check) => check.status === "fail") ? "fail" : "pass",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "codex-plugin-doctor",
-  "version": "0.21.0",
+  "version": "1.0.0-rc.2",
   "description": "CLI-first validator for Codex plugins, skills, and MCP package surfaces with runtime MCP protocol validation.",
   "type": "module",
   "main": "./dist/index.js",