codex-plugin-doctor 1.19.0 → 1.21.0

package/README.md

@@ -370,9 +370,9 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v5
-      - uses: Esquetta/CodexPluginDoctor@v1.19.0
+      - uses: Esquetta/CodexPluginDoctor@v1.21.0
         with:
-          version: "1.19.0"
+          version: "1.21.0"
           path: .
           runtime: "true"
           policy: codex-publish
@@ -384,7 +384,7 @@ jobs:
           review-bundle-verify: "true"
 ```
 
-The action writes `codex-plugin-doctor-summary.md`, `codex-plugin-doctor-report.json`, optional `codex-plugin-doctor.sarif`, optional `validation-corpus.json`, optional `output-contract.json`, and optional signed `review-bundle/` files to `codex-plugin-doctor-reports`, appends the Markdown report to the GitHub Actions step summary, uploads the report directory as an artifact, and then returns the real validation exit code. Review bundle generation requires a signing key environment variable such as `CODEX_PLUGIN_DOCTOR_SIGNING_KEY`. For runtime probing, SARIF output, corpus and contract artifacts, review bundle artifacts, installed plugin cache checks, CI policy presets, and pinned release examples, see [GitHub Action Usage](./docs/engineering/github-action-usage.md).
+The action writes `codex-plugin-doctor-summary.md`, `codex-plugin-doctor-report.json`, `codex-plugin-doctor-action-manifest.json`, optional `codex-plugin-doctor.sarif`, optional `validation-corpus.json`, optional `output-contract.json`, and optional signed `review-bundle/` files to `codex-plugin-doctor-reports`, appends the Markdown report to the GitHub Actions step summary, uploads the report directory as an artifact, and then returns the real validation exit code. Review bundle generation requires a signing key environment variable such as `CODEX_PLUGIN_DOCTOR_SIGNING_KEY`. For runtime probing, SARIF output, corpus and contract artifacts, review bundle artifacts, installed plugin cache checks, CI policy presets, and pinned release examples, see [GitHub Action Usage](./docs/engineering/github-action-usage.md).
 
 To self-test this repository after cloning it:
 

package/dist/core/dep-audit.js

@@ -15,7 +15,11 @@ async function fileExists(filePath) {
 }
 async function runNpmAudit(cwd) {
     return new Promise((resolve, reject) => {
-        execFile("npm", ["audit", "--json"], { cwd, shell: process.platform === "win32", timeout: 120_000 }, (error, stdout, stderr) => {
+        const command = process.platform === "win32" ? process.env.ComSpec ?? "cmd.exe" : "npm";
+        const args = process.platform === "win32"
+            ? ["/d", "/s", "/c", "npm", "audit", "--json"]
+            : ["audit", "--json"];
+        execFile(command, args, { cwd, timeout: 120_000 }, (error, stdout, stderr) => {
             const parsed = (() => {
                 try {
                     return JSON.parse(stdout);

package/dist/core/npm-package-doctor.js

@@ -7,8 +7,14 @@ import { gunzip } from "node:zlib";
 import { buildDoctorRecommendationsFromAnalysis, buildPackageAnalysis } from "./package-analysis.js";
 const execFileAsync = promisify(execFile);
 const gunzipAsync = promisify(gunzip);
-function npmCommand() {
-    return "npm";
+function npmCommand(args) {
+    if (process.platform === "win32") {
+        return {
+            command: process.env.ComSpec ?? "cmd.exe",
+            args: ["/d", "/s", "/c", "npm", ...args]
+        };
+    }
+    return { command: "npm", args };
 }
 function isPathWithinRoot(rootPath, candidatePath) {
     const relativePath = path.relative(rootPath, candidatePath);
@@ -80,17 +86,17 @@ async function resolvePackageSpecForPack(packageSpec) {
 }
 async function packNpmPackage(packageSpec, destinationPath) {
     const resolvedPackageSpec = await resolvePackageSpecForPack(packageSpec);
-    const { stdout } = await execFileAsync(npmCommand(), [
+    const npmPackCommand = npmCommand([
         "pack",
         resolvedPackageSpec,
         "--json",
         "--ignore-scripts",
         "--pack-destination",
         destinationPath
-    ], {
+    ]);
+    const { stdout } = await execFileAsync(npmPackCommand.command, npmPackCommand.args, {
         cwd: destinationPath,
-        maxBuffer: 10 * 1024 * 1024,
-        shell: process.platform === "win32"
+        maxBuffer: 10 * 1024 * 1024
     });
     const packEntries = JSON.parse(stdout);
     const metadata = packEntries[0];

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "codex-plugin-doctor",
-  "version": "1.19.0",
+  "version": "1.21.0",
   "description": "CLI-first validator for Codex plugins, skills, and MCP package surfaces with runtime MCP protocol validation.",
   "type": "module",
   "main": "./dist/index.js",