codex-plugin-doctor 1.27.0 → 1.29.0

package/dist/run-cli.js

@@ -44,6 +44,7 @@ import { renderCompatibilityReport } from "./reporting/render-compatibility-repo
 import { renderHistorySummary } from "./reporting/render-history-summary.js";
 import { renderJsonReport } from "./reporting/render-json-report.js";
 import { buildMarkdownReport } from "./reporting/render-markdown-report.js";
+import { renderSuppressionList, renderSuppressionListJson, renderSuppressionMutation, renderSuppressionMutationJson, renderSuppressionPrune, renderSuppressionPruneJson } from "./reporting/render-suppression-management.js";
 import { renderRuleExplanation } from "./reporting/render-rule-explanation.js";
 import { renderSarifReport } from "./reporting/render-sarif-report.js";
 import { renderTextReport } from "./reporting/render-text-report.js";
@@ -55,6 +56,7 @@ import { createLiveStatusRenderer } from "./terminal/live-status-renderer.js";
 import { determineOutputPolicy } from "./terminal/output-policy.js";
 import { getSpinner } from "./terminal/spinner-registry.js";
 import { packageVersion } from "./version.js";
+import { addSuppression, listSuppressions, pruneSuppressions, readRawDoctorConfig, removeSuppressionByFingerprint, removeSuppressionByIndex, SuppressionManagementError, writeRawDoctorConfig } from "./index.js";
 const defaultIo = {
     writeStdout(message) {
         process.stdout.write(`${message}\n`);
@@ -76,7 +78,18 @@ const defaultIo = {
     }
 };
 function printUsage(io) {
-    io.writeStderr("Usage: codex-plugin-doctor check <path|--installed> [filter] [--policy codex-publish|mcp-strict|security] [--compat] [--json|--markdown|--badge-json|--badge-markdown] [--output <path>] [--history <path>] [--runtime] [--require-runtime-approval --runtime-approval-digest <digest>] [--verbose-runtime] [--explain] [--no-animations] [--ascii]\n       codex-plugin-doctor audit --installed [filter] [--policy codex-publish|mcp-strict|security] [--security] [--compat] [--json] [--output <path>] [--cache] [--changed]\n       codex-plugin-doctor audit deps <path> [--json] [--output <path>]\n       codex-plugin-doctor mcp <path> [--json] [--output <path>]\n       codex-plugin-doctor security <path> [--policy security] [--json|--scorecard]\n       codex-plugin-doctor compat <path> [--all|--client <client>] [--json] [--scorecard] [--output <path>] [--install-preview|--apply --backup]\n       codex-plugin-doctor fix <path> (--dry-run|--interactive --backup|--apply --backup)\n       codex-plugin-doctor history <history.jsonl> [--json] [--fail-on-regression]\n       codex-plugin-doctor watch <path> [--runtime] [--json] [--output <path>] [--debounce-ms <ms>]\n       codex-plugin-doctor doctor [npm <package>|contract|corpus|runtime-plan <path> [--json|--markdown] [--output <path>]|runtime-policy <path> [--json] [--output <path>]|review-bundle <path> --output <dir> --sign-key-env NAME [--json] [--allow-dirty] [--allow-untagged]|review-bundle verify <bundle-dir> --target <path> --sign-key-env NAME [--json] [--output <path>] [--failures-only]|review-bundle diff --before <dir> --after <dir> [--json]|attest <path> [--sign-key-env NAME]|attest verify <attestation.json> --target <path> --sign-key-env NAME|release-evidence <path> --sign-key-env NAME [--allow-dirty] [--allow-untagged] [--require-runtime-approval --runtime-approval-digest <digest>]|release-evidence verify <evidence.json> --target <path> --sign-key-env NAME|release-evidence asset <path> --tag <tag> --output <evidence.json> --sign-key-env NAME [--upload]|mcp <path>|inspector <path>|diff --before <path> --after <path>|recommend <path>|trust <path>|perf <path> [--max-total-ms <ms>] [--max-stage-ms stage=ms]|export --bundle <path>|snapshot|clients|--json|--update-check]\n       codex-plugin-doctor init [path] [--template skill-only|mcp-stdio|mcp-http|full-runtime]\n       codex-plugin-doctor init-ci [path]\n       codex-plugin-doctor init-git-hooks [path] [--force] [--json]\n       codex-plugin-doctor self-test\n       codex-plugin-doctor list --installed\n       codex-plugin-doctor explain <finding-id>\n       codex-plugin-doctor --version\n\nFirst run:\n       codex-plugin-doctor doctor\n       codex-plugin-doctor self-test\n       codex-plugin-doctor init my-plugin\n       codex-plugin-doctor check . --runtime --explain");
+    io.writeStderr("Usage: codex-plugin-doctor check <path|--installed> [filter] [--policy codex-publish|mcp-strict|security] [--compat] [--json|--markdown|--badge-json|--badge-markdown] [--output <path>] [--history <path>] [--runtime] [--require-runtime-approval --runtime-approval-digest <digest>] [--verbose-runtime] [--explain] [--no-animations] [--ascii]\n       codex-plugin-doctor audit --installed [filter] [--policy codex-publish|mcp-strict|security] [--security] [--compat] [--json] [--output <path>] [--cache] [--changed]\n       codex-plugin-doctor audit deps <path> [--json] [--output <path>]\n       codex-plugin-doctor mcp <path> [--json] [--output <path>]\n       codex-plugin-doctor security <path> [--policy security] [--json|--scorecard]\n       codex-plugin-doctor compat <path> [--all|--client <client>] [--json] [--scorecard] [--output <path>] [--install-preview|--apply --backup]\n       codex-plugin-doctor suppress add <path> [--fingerprint <sha256> --reason <text> --expires-at YYYY-MM-DD] [--config <path>] [--json]\n       codex-plugin-doctor suppress list <path> [--config <path>] [--json]\n       codex-plugin-doctor suppress remove <path> [--fingerprint <sha256>|--index <n>] [--config <path>] [--json]\n       codex-plugin-doctor fix <path> (--dry-run|--interactive --backup|--apply --backup)\n       codex-plugin-doctor history <history.jsonl> [--json] [--fail-on-regression]\n       codex-plugin-doctor watch <path> [--runtime] [--json] [--output <path>] [--debounce-ms <ms>]\n       codex-plugin-doctor doctor [npm <package>|contract|corpus|runtime-plan <path> [--json|--markdown] [--output <path>]|runtime-policy <path> [--json] [--output <path>]|review-bundle <path> --output <dir> --sign-key-env NAME [--json] [--allow-dirty] [--allow-untagged]|review-bundle verify <bundle-dir> --target <path> --sign-key-env NAME [--json] [--output <path>] [--failures-only]|review-bundle diff --before <dir> --after <dir> [--json]|attest <path> [--sign-key-env NAME]|attest verify <attestation.json> --target <path> --sign-key-env NAME|release-evidence <path> --sign-key-env NAME [--allow-dirty] [--allow-untagged] [--require-runtime-approval --runtime-approval-digest <digest>]|release-evidence verify <evidence.json> --target <path> --sign-key-env NAME|release-evidence asset <path> --tag <tag> --output <evidence.json> --sign-key-env NAME [--upload]|mcp <path>|inspector <path>|diff --before <path> --after <path>|recommend <path>|trust <path>|perf <path> [--max-total-ms <ms>] [--max-stage-ms stage=ms]|export --bundle <path>|snapshot|clients|--json|--update-check]\n       codex-plugin-doctor init [path] [--template skill-only|mcp-stdio|mcp-http|full-runtime]\n       codex-plugin-doctor init-ci [path]\n       codex-plugin-doctor init-git-hooks [path] [--force] [--json]\n       codex-plugin-doctor self-test\n       codex-plugin-doctor list --installed\n       codex-plugin-doctor explain <finding-id>\n       codex-plugin-doctor --version\n\nFirst run:\n       codex-plugin-doctor doctor\n       codex-plugin-doctor self-test\n       codex-plugin-doctor init my-plugin\n       codex-plugin-doctor check . --runtime --explain");
+    io.writeStderr("Suppression governance: codex-plugin-doctor suppress list <path> [--fail-on-expired] [--fail-on-invalid] [--warn-expiring-within-days <days>]\n       codex-plugin-doctor suppress prune <path> [--apply] [--json]");
+}
+const suppressUsageText = [
+    "Usage:",
+    "       codex-plugin-doctor suppress add <path> [--fingerprint <sha256> --reason <text> --expires-at YYYY-MM-DD] [--config <path>] [--json]",
+    "       codex-plugin-doctor suppress list <path> [--config <path>] [--json] [--fail-on-expired] [--fail-on-invalid] [--warn-expiring-within-days <days>]",
+    "       codex-plugin-doctor suppress remove <path> [--fingerprint <sha256>|--index <n>] [--config <path>] [--json]",
+    "       codex-plugin-doctor suppress prune <path> [--config <path>] [--apply] [--json]"
+].join("\n");
+function printSuppressUsage(io) {
+    io.writeStderr(suppressUsageText);
 }
 const performanceStageNames = new Set([
     "validation",
@@ -94,6 +107,520 @@ function parseNonNegativeNumber(value) {
     const parsed = Number(value);
     return Number.isFinite(parsed) && parsed >= 0 ? parsed : null;
 }
+function parseSuppressCommand(args) {
+    const [action, targetPath, ...flags] = args;
+    if (!action) {
+        return {
+            message: "Missing suppress action.",
+            showUsage: true
+        };
+    }
+    if (action !== "add" &&
+        action !== "list" &&
+        action !== "remove" &&
+        action !== "prune") {
+        return {
+            message: `Unknown suppress action: ${action}.`,
+            showUsage: true
+        };
+    }
+    if (!targetPath || targetPath.startsWith("--")) {
+        return {
+            message: "Missing suppression target path.",
+            showUsage: true
+        };
+    }
+    let configPath = null;
+    let jsonOutput = false;
+    let fingerprint = null;
+    let reason = null;
+    let expiresAt = null;
+    let indexValue = null;
+    let failOnExpired = false;
+    let failOnInvalid = false;
+    let apply = false;
+    let warnExpiringWithinDays = null;
+    const seenFlags = new Set();
+    const markSeenFlag = (flag) => {
+        if (seenFlags.has(flag)) {
+            return {
+                message: `Duplicate suppress flag: ${flag}.`,
+                showUsage: false
+            };
+        }
+        seenFlags.add(flag);
+        return null;
+    };
+    for (let index = 0; index < flags.length; index += 1) {
+        const flag = flags[index];
+        if (flag === "--json") {
+            const duplicateError = markSeenFlag(flag);
+            if (duplicateError) {
+                return duplicateError;
+            }
+            jsonOutput = true;
+            continue;
+        }
+        if (flag === "--config") {
+            const duplicateError = markSeenFlag(flag);
+            if (duplicateError) {
+                return duplicateError;
+            }
+            const value = flags[index + 1];
+            if (!value || value.startsWith("--")) {
+                return {
+                    message: "Missing path after --config.",
+                    showUsage: false
+                };
+            }
+            configPath = value;
+            index += 1;
+            continue;
+        }
+        if (action === "list" && flag === "--fail-on-expired") {
+            const duplicateError = markSeenFlag(flag);
+            if (duplicateError) {
+                return duplicateError;
+            }
+            failOnExpired = true;
+            continue;
+        }
+        if (action === "list" && flag === "--fail-on-invalid") {
+            const duplicateError = markSeenFlag(flag);
+            if (duplicateError) {
+                return duplicateError;
+            }
+            failOnInvalid = true;
+            continue;
+        }
+        if (action === "list" && flag === "--warn-expiring-within-days") {
+            const duplicateError = markSeenFlag(flag);
+            if (duplicateError) {
+                return duplicateError;
+            }
+            const value = flags[index + 1];
+            if (!value || value.startsWith("--")) {
+                return {
+                    message: "Missing days after --warn-expiring-within-days.",
+                    showUsage: false
+                };
+            }
+            if (!/^\d+$/.test(value)) {
+                return {
+                    message: "--warn-expiring-within-days must be a non-negative integer.",
+                    showUsage: false
+                };
+            }
+            const parsedDays = Number(value);
+            if (!Number.isSafeInteger(parsedDays)) {
+                return {
+                    message: "--warn-expiring-within-days must be a non-negative integer.",
+                    showUsage: false
+                };
+            }
+            warnExpiringWithinDays = parsedDays;
+            index += 1;
+            continue;
+        }
+        if (action === "prune" && flag === "--apply") {
+            const duplicateError = markSeenFlag(flag);
+            if (duplicateError) {
+                return duplicateError;
+            }
+            apply = true;
+            continue;
+        }
+        if (action === "add" && flag === "--fingerprint") {
+            const duplicateError = markSeenFlag(flag);
+            if (duplicateError) {
+                return duplicateError;
+            }
+            const value = flags[index + 1];
+            if (!value || value.startsWith("--")) {
+                return {
+                    message: "Missing fingerprint after --fingerprint.",
+                    showUsage: false
+                };
+            }
+            fingerprint = value;
+            index += 1;
+            continue;
+        }
+        if (action === "add" && flag === "--reason") {
+            const duplicateError = markSeenFlag(flag);
+            if (duplicateError) {
+                return duplicateError;
+            }
+            const value = flags[index + 1];
+            if (!value || value.startsWith("--")) {
+                return {
+                    message: "Missing reason after --reason.",
+                    showUsage: false
+                };
+            }
+            reason = value;
+            index += 1;
+            continue;
+        }
+        if (action === "add" && flag === "--expires-at") {
+            const duplicateError = markSeenFlag(flag);
+            if (duplicateError) {
+                return duplicateError;
+            }
+            const value = flags[index + 1];
+            if (!value || value.startsWith("--")) {
+                return {
+                    message: "Missing date after --expires-at.",
+                    showUsage: false
+                };
+            }
+            expiresAt = value;
+            index += 1;
+            continue;
+        }
+        if (action === "remove" && flag === "--fingerprint") {
+            const duplicateError = markSeenFlag(flag);
+            if (duplicateError) {
+                return duplicateError;
+            }
+            const value = flags[index + 1];
+            if (!value || value.startsWith("--")) {
+                return {
+                    message: "Missing fingerprint after --fingerprint.",
+                    showUsage: false
+                };
+            }
+            fingerprint = value;
+            index += 1;
+            continue;
+        }
+        if (action === "remove" && flag === "--index") {
+            const duplicateError = markSeenFlag(flag);
+            if (duplicateError) {
+                return duplicateError;
+            }
+            const value = flags[index + 1];
+            if (!value || value.startsWith("--")) {
+                return {
+                    message: "Missing value after --index.",
+                    showUsage: false
+                };
+            }
+            indexValue = value;
+            index += 1;
+            continue;
+        }
+        return {
+            message: `Unknown suppress flag: ${flag}.`,
+            showUsage: false
+        };
+    }
+    if (action === "list") {
+        return {
+            action,
+            targetPath,
+            configPath,
+            jsonOutput,
+            failOnExpired,
+            failOnInvalid,
+            warnExpiringWithinDays
+        };
+    }
+    if (action === "prune") {
+        return {
+            action,
+            targetPath,
+            configPath,
+            jsonOutput,
+            apply
+        };
+    }
+    if (action === "add") {
+        const suppliedFlagCount = [fingerprint, reason, expiresAt].filter((value) => value !== null).length;
+        if (suppliedFlagCount === 0) {
+            return {
+                action,
+                targetPath,
+                configPath,
+                jsonOutput,
+                interactive: true
+            };
+        }
+        if (suppliedFlagCount !== 3 || !fingerprint || !reason || !expiresAt) {
+            return {
+                message: "suppress add requires --fingerprint, --reason, and --expires-at together.",
+                showUsage: false
+            };
+        }
+        return {
+            action,
+            targetPath,
+            configPath,
+            jsonOutput,
+            interactive: false,
+            fingerprint,
+            reason,
+            expiresAt
+        };
+    }
+    if (fingerprint && indexValue !== null) {
+        return {
+            message: "Use exactly one of --index or --fingerprint for suppress remove.",
+            showUsage: false
+        };
+    }
+    if (!fingerprint && indexValue === null) {
+        return {
+            action,
+            targetPath,
+            configPath,
+            jsonOutput,
+            interactive: true
+        };
+    }
+    if (indexValue !== null) {
+        if (!/^\d+$/.test(indexValue)) {
+            return {
+                message: "--index must be a non-negative integer.",
+                showUsage: false
+            };
+        }
+        const parsedIndex = Number(indexValue);
+        if (!Number.isSafeInteger(parsedIndex)) {
+            return {
+                message: "--index must be a non-negative integer.",
+                showUsage: false
+            };
+        }
+        return {
+            action,
+            targetPath,
+            configPath,
+            jsonOutput,
+            interactive: false,
+            selector: {
+                type: "index",
+                index: parsedIndex
+            }
+        };
+    }
+    return {
+        action,
+        targetPath,
+        configPath,
+        jsonOutput,
+        interactive: false,
+        selector: {
+            type: "fingerprint",
+            fingerprint: fingerprint
+        }
+    };
+}
+function formatLocalDate(date) {
+    const year = date.getFullYear();
+    const month = String(date.getMonth() + 1).padStart(2, "0");
+    const day = String(date.getDate()).padStart(2, "0");
+    return `${year}-${month}-${day}`;
+}
+function defaultSuppressionExpiry(now) {
+    const expiry = new Date(now.getFullYear(), now.getMonth(), now.getDate());
+    expiry.setDate(expiry.getDate() + 30);
+    return formatLocalDate(expiry);
+}
+function parseSuppressionDateUtcStart(value) {
+    const match = /^(\d{4})-(\d{2})-(\d{2})$/.exec(value);
+    if (!match) {
+        return null;
+    }
+    const year = Number(match[1]);
+    const month = Number(match[2]);
+    const day = Number(match[3]);
+    const timestamp = Date.UTC(year, month - 1, day);
+    const date = new Date(timestamp);
+    return date.getUTCFullYear() === year &&
+        date.getUTCMonth() === month - 1 &&
+        date.getUTCDate() === day
+        ? timestamp
+        : null;
+}
+function listExpiringSuppressionIndexes(suppressions, now, withinDays) {
+    const dayMs = 24 * 60 * 60 * 1000;
+    const todayUtc = Date.UTC(now.getUTCFullYear(), now.getUTCMonth(), now.getUTCDate());
+    const cutoffUtc = todayUtc + withinDays * dayMs;
+    return suppressions.flatMap((suppression) => {
+        if (suppression.status !== "active" || !suppression.expiresAt) {
+            return [];
+        }
+        const expiresAtUtc = parseSuppressionDateUtcStart(suppression.expiresAt);
+        return expiresAtUtc !== null &&
+            expiresAtUtc >= todayUtc &&
+            expiresAtUtc <= cutoffUtc
+            ? [suppression.index]
+            : [];
+    });
+}
+function parseInteractiveSelection(answer, count) {
+    const trimmed = answer.trim();
+    if (!/^\d+$/.test(trimmed)) {
+        return null;
+    }
+    const selection = Number(trimmed);
+    return Number.isSafeInteger(selection) && selection >= 1 && selection <= count
+        ? selection - 1
+        : null;
+}
+function renderInteractiveFindingCandidates(findings) {
+    return findings
+        .map((finding, index) => `[${index + 1}] ${finding.severity.toUpperCase()} ${finding.id} - ${finding.message}\n    ${finding.fingerprint}`)
+        .join("\n");
+}
+function renderInteractiveSuppressionCandidates(suppressions) {
+    return suppressions
+        .map((suppression, selectionIndex) => {
+        const prefix = `[${selectionIndex + 1}] ${suppression.status.toUpperCase()} config index ${suppression.index}`;
+        return suppression.status === "invalid"
+            ? `${prefix} ${suppression.invalidField}`
+            : `${prefix} ${suppression.fingerprint}`;
+    })
+        .join("\n");
+}
+async function executeSuppressCommand(command, io, options = {}) {
+    const writeConfig = options.writeRawDoctorConfigImpl ?? writeRawDoctorConfig;
+    if ((command.action === "add" || command.action === "remove") &&
+        command.interactive) {
+        if (command.jsonOutput) {
+            io.writeStderr(`Interactive suppress ${command.action} does not support --json.`);
+            return 2;
+        }
+        if (!io.readStdin) {
+            io.writeStderr(`Interactive suppress ${command.action} requires stdin input.`);
+            return 2;
+        }
+    }
+    try {
+        const rawConfig = await readRawDoctorConfig(command.targetPath, command.configPath);
+        const now = options.now?.() ?? new Date();
+        if (command.action === "list") {
+            const suppressions = listSuppressions(rawConfig.value, now);
+            const expiredCount = suppressions.filter((suppression) => suppression.status === "expired").length;
+            const invalidCount = suppressions.filter((suppression) => suppression.status === "invalid").length;
+            io.writeStdout(command.jsonOutput
+                ? renderSuppressionListJson(rawConfig.configPath, suppressions)
+                : renderSuppressionList(rawConfig.configPath, suppressions));
+            if (command.warnExpiringWithinDays !== null) {
+                const expiringIndexes = listExpiringSuppressionIndexes(suppressions, now, command.warnExpiringWithinDays);
+                if (expiringIndexes.length > 0) {
+                    io.writeStderr(`Warning: ${expiringIndexes.length} suppression(s) expire within ${command.warnExpiringWithinDays} day(s): indexes ${expiringIndexes.join(", ")}.`);
+                }
+            }
+            return (command.failOnExpired && expiredCount > 0) ||
+                (command.failOnInvalid && invalidCount > 0)
+                ? 1
+                : 0;
+        }
+        if (command.action === "prune") {
+            const result = pruneSuppressions(rawConfig.value, now);
+            if (command.apply && result.removed.length > 0) {
+                await writeConfig(rawConfig.configPath, result.config);
+            }
+            io.writeStdout(command.jsonOutput
+                ? renderSuppressionPruneJson(rawConfig.configPath, result, {
+                    applied: command.apply
+                })
+                : renderSuppressionPrune(rawConfig.configPath, result, {
+                    applied: command.apply
+                }));
+            return 0;
+        }
+        if (command.action === "add") {
+            if (command.interactive) {
+                listSuppressions(rawConfig.value, now);
+                const configuredResult = applyDoctorConfig(await (options.runCheckImpl ?? runCheck)(command.targetPath), await loadDoctorConfig(command.targetPath, command.configPath), { now });
+                const candidates = configuredResult.findings.filter((finding) => Boolean(finding.fingerprint) &&
+                    !finding.id.startsWith("suppression."));
+                if (candidates.length === 0) {
+                    io.writeStderr("No active fingerprinted findings are available to suppress.");
+                    return 1;
+                }
+                io.writeStdout(renderInteractiveFindingCandidates(candidates));
+                const selection = parseInteractiveSelection(await io.readStdin("Select finding to suppress: "), candidates.length);
+                if (selection === null) {
+                    io.writeStderr(`Selection must be a number from 1 to ${candidates.length}.`);
+                    return 2;
+                }
+                const reason = (await io.readStdin("Reason: ")).trim();
+                if (!reason) {
+                    io.writeStderr("Suppression reason must not be blank.");
+                    return 2;
+                }
+                const defaultExpiry = defaultSuppressionExpiry(now);
+                const expiryAnswer = (await io.readStdin(`Expiration date [${defaultExpiry}]: `)).trim();
+                const result = addSuppression(rawConfig.value, {
+                    fingerprint: candidates[selection].fingerprint,
+                    reason,
+                    expiresAt: expiryAnswer || defaultExpiry
+                });
+                const confirmation = await io.readStdin("Type yes to confirm: ");
+                if (confirmation.trim().toLowerCase() !== "yes") {
+                    io.writeStdout("Suppression add cancelled.");
+                    return 0;
+                }
+                await writeConfig(rawConfig.configPath, result.config);
+                io.writeStdout(renderSuppressionMutation("suppress.add", rawConfig.configPath, result));
+                return 0;
+            }
+            const result = addSuppression(rawConfig.value, {
+                fingerprint: command.fingerprint,
+                reason: command.reason,
+                expiresAt: command.expiresAt
+            });
+            await writeConfig(rawConfig.configPath, result.config);
+            io.writeStdout(command.jsonOutput
+                ? renderSuppressionMutationJson("suppress.add", rawConfig.configPath, result)
+                : renderSuppressionMutation("suppress.add", rawConfig.configPath, result));
+            return 0;
+        }
+        if (command.interactive) {
+            const suppressions = listSuppressions(rawConfig.value, now);
+            if (suppressions.length === 0) {
+                io.writeStderr("No suppressions are available to remove.");
+                return 1;
+            }
+            io.writeStdout(renderInteractiveSuppressionCandidates(suppressions));
+            const selection = parseInteractiveSelection(await io.readStdin("Select suppression to remove: "), suppressions.length);
+            if (selection === null) {
+                io.writeStderr(`Selection must be a number from 1 to ${suppressions.length}.`);
+                return 2;
+            }
+            const result = removeSuppressionByIndex(rawConfig.value, suppressions[selection].index);
+            const confirmation = await io.readStdin("Type yes to confirm: ");
+            if (confirmation.trim().toLowerCase() !== "yes") {
+                io.writeStdout("Suppression remove cancelled.");
+                return 0;
+            }
+            await writeConfig(rawConfig.configPath, result.config);
+            io.writeStdout(renderSuppressionMutation("suppress.remove", rawConfig.configPath, result));
+            return 0;
+        }
+        const result = command.selector.type === "index"
+            ? removeSuppressionByIndex(rawConfig.value, command.selector.index)
+            : removeSuppressionByFingerprint(rawConfig.value, command.selector.fingerprint);
+        await writeConfig(rawConfig.configPath, result.config);
+        io.writeStdout(command.jsonOutput
+            ? renderSuppressionMutationJson("suppress.remove", rawConfig.configPath, result)
+            : renderSuppressionMutation("suppress.remove", rawConfig.configPath, result));
+        return 0;
+    }
+    catch (error) {
+        io.writeStderr(error instanceof Error ? error.message : "Unknown suppression command error.");
+        return command.action === "add" &&
+            command.interactive &&
+            error instanceof SuppressionManagementError &&
+            error.code === "suppression_invalid_record"
+            ? 2
+            : 1;
+    }
+}
 function buildGenericMcpDoctorCommandArgs(commandTarget, flags) {
     if (!commandTarget || commandTarget.startsWith("--")) {
         return "Missing target path. Usage: codex-plugin-doctor mcp <path> [--json] [--output <path>]";
@@ -1586,6 +2113,21 @@ export async function runCli(args, io = defaultIo, options = {}) {
         io.writeStdout(report);
         return matrixExitCode(matrix);
     }
+    if (command === "suppress") {
+        const parsedSuppressCommand = parseSuppressCommand([maybePath ?? "", ...remainingArgs]);
+        if ("message" in parsedSuppressCommand) {
+            io.writeStderr(parsedSuppressCommand.message);
+            if (parsedSuppressCommand.showUsage) {
+                printSuppressUsage(io);
+            }
+            return 2;
+        }
+        return executeSuppressCommand(parsedSuppressCommand, io, {
+            runCheckImpl: options.runCheckImpl,
+            writeRawDoctorConfigImpl: options.writeRawDoctorConfigImpl,
+            now: options.now
+        });
+    }
     if (command !== "check") {
         printUsage(io);
         return 2;