codex-plugin-doctor 1.13.0 → 1.15.0

package/README.md

@@ -358,9 +358,9 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v5
-      - uses: Esquetta/CodexPluginDoctor@v1.13.0
+      - uses: Esquetta/CodexPluginDoctor@v1.15.0
         with:
-          version: "1.13.0"
+          version: "1.15.0"
           path: .
           runtime: "true"
           policy: codex-publish

package/dist/core/review-bundle.d.ts

@@ -71,6 +71,10 @@ export interface DoctorReviewBundleVerificationReport {
         status: "pass" | "fail";
         message: string;
     }>;
+    failedChecks: Array<{
+        id: string;
+        message: string;
+    }>;
     attestation: DoctorAttestationVerificationReport | null;
     releaseEvidence: DoctorReleaseEvidenceVerificationReport | null;
 }

package/dist/core/review-bundle.js

@@ -47,21 +47,120 @@ function isManifestIntegrity(value) {
         isPlainObject(value.files) &&
         Object.values(value.files).every(isIntegrityEntry);
 }
+function valueType(value) {
+    return Array.isArray(value) ? "array" : value === null ? "null" : typeof value;
+}
+function describeExpectedType(pathName, expected, actual) {
+    return `${pathName} expected ${expected}, got ${valueType(actual)}.`;
+}
+function validateManifestFileMap(value) {
+    if (!isPlainObject(value)) {
+        return [describeExpectedType("files", "object", value)];
+    }
+    const expectedKeys = Object.keys(relativeBundleFiles());
+    const actualKeys = Object.keys(value);
+    const errors = [];
+    for (const key of expectedKeys) {
+        if (!(key in value)) {
+            errors.push(`files.${key} is missing.`);
+        }
+        else if (typeof value[key] !== "string") {
+            errors.push(describeExpectedType(`files.${key}`, "string", value[key]));
+        }
+    }
+    for (const key of actualKeys) {
+        if (!expectedKeys.includes(key)) {
+            errors.push(`files.${key} is unexpected.`);
+        }
+    }
+    return errors;
+}
+function validateManifestIntegrity(value) {
+    if (value === undefined) {
+        return [];
+    }
+    if (!isPlainObject(value)) {
+        return [describeExpectedType("integrity", "object", value)];
+    }
+    const errors = [];
+    if (value.algorithm !== "sha256") {
+        errors.push(`integrity.algorithm expected sha256, got ${String(value.algorithm)}.`);
+    }
+    if (!isPlainObject(value.files)) {
+        errors.push(describeExpectedType("integrity.files", "object", value.files));
+        return errors;
+    }
+    for (const [key, entry] of Object.entries(value.files)) {
+        if (!isPlainObject(entry)) {
+            errors.push(describeExpectedType(`integrity.files.${key}`, "object", entry));
+            continue;
+        }
+        if (typeof entry.path !== "string") {
+            errors.push(describeExpectedType(`integrity.files.${key}.path`, "string", entry.path));
+        }
+        if (typeof entry.digest !== "string" || !/^sha256:[a-f0-9]{64}$/.test(entry.digest)) {
+            errors.push(`integrity.files.${key}.digest expected sha256 digest, got ${valueType(entry.digest)}.`);
+        }
+        if (typeof entry.bytes !== "number" || !Number.isSafeInteger(entry.bytes) || entry.bytes < 0) {
+            errors.push(describeExpectedType(`integrity.files.${key}.bytes`, "non-negative safe integer", entry.bytes));
+        }
+    }
+    return errors;
+}
+function validateDoctorReviewBundleManifest(value) {
+    if (!isPlainObject(value)) {
+        return [describeExpectedType("manifest", "object", value)];
+    }
+    const errors = [];
+    if (value.schemaVersion !== "1.0.0") {
+        errors.push(`schemaVersion expected 1.0.0, got ${String(value.schemaVersion)}.`);
+    }
+    if (value.kind !== "doctor.review.bundle") {
+        errors.push(`kind expected doctor.review.bundle, got ${String(value.kind)}.`);
+    }
+    if (typeof value.generatedAt !== "string") {
+        errors.push(describeExpectedType("generatedAt", "string", value.generatedAt));
+    }
+    if (typeof value.version !== "string") {
+        errors.push(describeExpectedType("version", "string", value.version));
+    }
+    if (typeof value.targetPath !== "string") {
+        errors.push(describeExpectedType("targetPath", "string", value.targetPath));
+    }
+    if (typeof value.outputDirectory !== "string") {
+        errors.push(describeExpectedType("outputDirectory", "string", value.outputDirectory));
+    }
+    if (!isStatus(value.status)) {
+        errors.push(`status expected pass, warn, or fail, got ${String(value.status)}.`);
+    }
+    if (value.exitCode !== 0 && value.exitCode !== 1) {
+        errors.push(`exitCode expected 0 or 1, got ${String(value.exitCode)}.`);
+    }
+    if (!isPlainObject(value.summary)) {
+        errors.push(describeExpectedType("summary", "object", value.summary));
+    }
+    else {
+        if (!isRuntimePolicyDecision(value.summary.runtimePolicy)) {
+            errors.push(`summary.runtimePolicy expected allow, review, sandbox_recommended, or deny, got ${String(value.summary.runtimePolicy)}.`);
+        }
+        if (typeof value.summary.releaseReady !== "boolean") {
+            errors.push(describeExpectedType("summary.releaseReady", "boolean", value.summary.releaseReady));
+        }
+        if (!isStatus(value.summary.attestation)) {
+            errors.push(`summary.attestation expected pass, warn, or fail, got ${String(value.summary.attestation)}.`);
+        }
+        if (value.summary.releaseEvidence !== "pass" && value.summary.releaseEvidence !== "fail") {
+            errors.push(`summary.releaseEvidence expected pass or fail, got ${String(value.summary.releaseEvidence)}.`);
+        }
+    }
+    errors.push(...validateManifestFileMap(value.files));
+    errors.push(...validateManifestIntegrity(value.integrity));
+    return errors;
+}
 function isDoctorReviewBundleManifest(value) {
-    return isPlainObject(value) &&
-        value.schemaVersion === "1.0.0" &&
-        value.kind === "doctor.review.bundle" &&
-        typeof value.generatedAt === "string" &&
-        typeof value.version === "string" &&
-        typeof value.targetPath === "string" &&
-        typeof value.outputDirectory === "string" &&
-        isStatus(value.status) &&
-        (value.exitCode === 0 || value.exitCode === 1) &&
+    return validateDoctorReviewBundleManifest(value).length === 0 &&
+        isPlainObject(value) &&
         isPlainObject(value.summary) &&
-        isRuntimePolicyDecision(value.summary.runtimePolicy) &&
-        typeof value.summary.releaseReady === "boolean" &&
-        isStatus(value.summary.attestation) &&
-        (value.summary.releaseEvidence === "pass" || value.summary.releaseEvidence === "fail") &&
         isBundleFileMap(value.files) &&
         (value.integrity === undefined || isManifestIntegrity(value.integrity));
 }
@@ -383,7 +482,8 @@ export async function verifyDoctorReviewBundle(bundleDirectory, options) {
     let integrityStatus = "pass";
     try {
         const manifestArtifact = await readBundleJsonFile(resolvedBundleDirectory, "manifest.json");
-        if (isDoctorReviewBundleManifest(manifestArtifact)) {
+        const manifestErrors = validateDoctorReviewBundleManifest(manifestArtifact);
+        if (manifestErrors.length === 0 && isDoctorReviewBundleManifest(manifestArtifact)) {
             manifest = manifestArtifact;
             checks.push({
                 id: "review_bundle.manifest.valid",
@@ -395,7 +495,7 @@ export async function verifyDoctorReviewBundle(bundleDirectory, options) {
             checks.push({
                 id: "review_bundle.manifest.valid",
                 status: "fail",
-                message: "The review bundle manifest is missing or invalid."
+                message: `The review bundle manifest is invalid: ${manifestErrors.slice(0, 3).join(" ")}`
             });
         }
     }
@@ -597,7 +697,12 @@ export async function verifyDoctorReviewBundle(bundleDirectory, options) {
             message: "The bundled release evidence could not be verified."
         });
     }
-    const failedChecks = checks.filter((check) => check.status === "fail");
+    const failedChecks = checks
+        .filter((check) => check.status === "fail")
+        .map((check) => ({
+        id: check.id,
+        message: check.message
+    }));
     const fileChecks = checks.filter((check) => check.id.startsWith("review_bundle.file."));
     const manifestStatus = checks.find((check) => check.id === "review_bundle.manifest.valid")?.status ?? "fail";
     return {
@@ -617,6 +722,7 @@ export async function verifyDoctorReviewBundle(bundleDirectory, options) {
             releaseEvidence: releaseEvidence?.status ?? "fail"
         },
         checks,
+        failedChecks,
         attestation,
         releaseEvidence
     };
@@ -637,10 +743,21 @@ export function renderDoctorReviewBundleVerification(report) {
         `Runtime policy: ${report.summary.runtimePolicy.toUpperCase()}`,
         `Attestation: ${report.summary.attestation.toUpperCase()}`,
         `Release evidence: ${report.summary.releaseEvidence.toUpperCase()}`,
+        `Failed checks: ${report.failedChecks.length}`,
         "",
-        "Checks",
-        "------"
+        "Failed Checks",
+        "-------------"
     ];
+    if (report.failedChecks.length === 0) {
+        lines.push("None.");
+    }
+    else {
+        for (const check of report.failedChecks) {
+            lines.push(`FAIL ${check.id}`);
+            lines.push(`  ${check.message}`);
+        }
+    }
+    lines.push("", "Checks", "------");
     for (const check of report.checks) {
         lines.push(`${check.status === "pass" ? "PASS" : "FAIL"} ${check.id}`);
         lines.push(`  ${check.message}`);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "codex-plugin-doctor",
-  "version": "1.13.0",
+  "version": "1.15.0",
   "description": "CLI-first validator for Codex plugins, skills, and MCP package surfaces with runtime MCP protocol validation.",
   "type": "module",
   "main": "./dist/index.js",