codex-plugin-doctor 1.31.0 → 1.33.0

package/README.md

@@ -400,9 +400,9 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v5
-      - uses: Esquetta/CodexPluginDoctor@v1.31.0
+      - uses: Esquetta/CodexPluginDoctor@v1.33.0
         with:
-          version: "1.31.0"
+          version: "1.33.0"
           path: .
           runtime: "true"
           policy: codex-publish

package/dist/core/dep-audit.d.ts

@@ -15,3 +15,4 @@ export interface DepAuditReport {
 export declare function buildDepAudit(targetPath: string): Promise<DepAuditReport>;
 export declare function renderDepAudit(report: DepAuditReport): string;
 export declare function renderDepAuditJson(report: DepAuditReport): string;
+export declare function renderDepAuditSarif(report: DepAuditReport): string;

package/dist/core/dep-audit.js

@@ -171,3 +171,40 @@ export function renderDepAuditJson(report) {
         audit: report.auditJson
     }, null, 2);
 }
+export function renderDepAuditSarif(report) {
+    const rules = report.vulnerabilities.map((vuln) => ({
+        id: `dep-audit.${vuln.name}`,
+        name: vuln.name,
+        shortDescription: {
+            text: `${vuln.severity} severity vulnerability in ${vuln.name}${vuln.fixAvailable ? " (fix available)" : ""}`
+        },
+        help: {
+            text: vuln.via.length > 0 ? `Via: ${vuln.via.join(", ")}` : "No additional information."
+        }
+    }));
+    const results = report.vulnerabilities.map((vuln, index) => ({
+        ruleId: `dep-audit.${vuln.name}`,
+        ruleIndex: index,
+        level: vuln.severity === "critical" || vuln.severity === "high" ? "error" : "warning",
+        message: {
+            text: `${vuln.severity}: ${vuln.name} ${vuln.fixAvailable ? "(fix available)" : "(no fix available)"}`
+        }
+    }));
+    const sarif = {
+        version: "2.1.0",
+        $schema: "https://raw.githubusercontent.com/oasis-tcs/sarif-spec/master/Schemata/sarif-schema-2.1.0.json",
+        runs: [
+            {
+                tool: {
+                    driver: {
+                        name: "codex-plugin-doctor (dep-audit)",
+                        informationUri: "https://github.com/Esquetta/CodexPluginDoctor",
+                        rules
+                    }
+                },
+                results
+            }
+        ]
+    };
+    return JSON.stringify(sarif, null, 2);
+}

package/dist/core/watch-plugin.d.ts

@@ -4,10 +4,14 @@ export interface WatchPluginOptions {
     runtime?: boolean;
     jsonOutput?: boolean;
     outputPath?: string | null;
+    maxIterations?: number;
+    failFast?: boolean;
+    accumulateJsonPath?: string | null;
 }
 export interface WatchPluginResult {
     targetPath: string;
     validations: number;
     failures: number;
+    iterationsReached?: boolean;
 }
 export declare function watchPlugin(options: WatchPluginOptions): Promise<WatchPluginResult>;

package/dist/core/watch-plugin.js

@@ -1,6 +1,27 @@
 import { watch } from "node:fs";
+import { writeFile } from "node:fs/promises";
 import path from "node:path";
 import { validatePlugin } from "./validate-plugin.js";
+const ignoredDirs = new Set([
+    "node_modules",
+    ".git",
+    "dist",
+    "coverage",
+    ".cache",
+    "build",
+    ".turbo",
+    ".next",
+    ".nuxt",
+    "__pycache__"
+]);
+function isIgnored(filename) {
+    for (const dir of ignoredDirs) {
+        if (filename.includes(dir) || filename.startsWith(`${dir}/`) || filename.startsWith(`${dir}\\`)) {
+            return true;
+        }
+    }
+    return false;
+}
 function renderWatchValidation(result, iteration, jsonOutput) {
     if (jsonOutput) {
         const report = {
@@ -12,7 +33,7 @@ function renderWatchValidation(result, iteration, jsonOutput) {
             findingsCount: result.findings.length,
             findings: result.findings
         };
-        return JSON.stringify(report, null, 2);
+        return JSON.stringify(report);
     }
     const icon = result.status === "pass" ? "PASS" : "FAIL";
     return [
@@ -24,25 +45,40 @@ function renderWatchValidation(result, iteration, jsonOutput) {
     ].filter(Boolean).join("\n");
 }
 export async function watchPlugin(options) {
-    const { targetPath, debounceMs = 300, runtime = false, jsonOutput = false, outputPath = null } = options;
+    const { targetPath, debounceMs = 300, runtime = false, jsonOutput = false, outputPath = null, maxIterations = 0, failFast = false, accumulateJsonPath = null } = options;
     const resolvedPath = path.resolve(targetPath);
     let validations = 0;
     let failures = 0;
     let timer = null;
     let pending = false;
     const runValidation = async (iteration) => {
-        const result = await validatePlugin(resolvedPath, { runtime });
-        validations += 1;
-        if (result.status !== "pass") {
-            failures += 1;
+        try {
+            const result = await validatePlugin(resolvedPath, { runtime });
+            if (result.status !== "pass") {
+                failures += 1;
+            }
+            const output = renderWatchValidation(result, iteration, jsonOutput);
+            if (outputPath) {
+                await writeFile(outputPath, output, "utf8");
+            }
+            if (accumulateJsonPath && jsonOutput) {
+                await writeFile(accumulateJsonPath, `${output}\n`, { encoding: "utf8", flag: "a" });
+            }
+            if (!outputPath && !accumulateJsonPath) {
+                if (jsonOutput) {
+                    process.stdout.write(`${JSON.stringify(JSON.parse(output), null, 2)}\n\n`);
+                }
+                else {
+                    process.stdout.write(`${output}\n\n`);
+                }
+            }
         }
-        const output = renderWatchValidation(result, iteration, jsonOutput);
-        if (outputPath) {
-            const { writeFile } = await import("node:fs/promises");
-            await writeFile(outputPath, output, "utf8");
+        catch (error) {
+            process.stderr.write(`Watch validation error: ${error.message}\n`);
+            failures += 1;
         }
-        else {
-            process.stdout.write(`${output}\n\n`);
+        finally {
+            validations += 1;
         }
     };
     return new Promise((resolve, _reject) => {
@@ -60,10 +96,29 @@ export async function watchPlugin(options) {
                 timer = null;
                 iteration += 1;
                 await runValidation(iteration);
+                if (failFast && failures > 0) {
+                    cleanup();
+                    resolve({ targetPath: resolvedPath, validations, failures });
+                    return;
+                }
+                if (maxIterations > 0 && validations >= maxIterations) {
+                    cleanup();
+                    resolve({ targetPath: resolvedPath, validations, failures, iterationsReached: true });
+                    return;
+                }
+                if (maxIterations > 0) {
+                    schedule();
+                }
             }, debounceMs);
         };
         const watcher = watch(resolvedPath, { recursive: true }, (_eventType, filename) => {
-            if (!filename || filename.includes("node_modules") || filename.startsWith(".git")) {
+            if (!filename || isIgnored(filename)) {
+                return;
+            }
+            if (outputPath && filename === path.basename(outputPath)) {
+                return;
+            }
+            if (accumulateJsonPath && filename === path.basename(accumulateJsonPath)) {
                 return;
             }
             schedule();
@@ -71,17 +126,31 @@ export async function watchPlugin(options) {
         watcher.on("error", (error) => {
             process.stderr.write(`Watch error: ${error.message}\n`);
         });
-        const handleExit = () => {
+        const cleanup = () => {
             if (timer !== null) {
                 clearTimeout(timer);
             }
             watcher.close();
+            process.removeListener("SIGINT", handleExit);
+            process.removeListener("SIGTERM", handleExit);
+            process.removeListener("SIGHUP", handleExit);
+        };
+        const handleExit = () => {
+            cleanup();
             resolve({ targetPath: resolvedPath, validations, failures });
         };
         process.on("SIGINT", handleExit);
         process.on("SIGTERM", handleExit);
         process.on("SIGHUP", handleExit);
-        process.stdout.write(`Watching ${resolvedPath} for changes (debounce: ${debounceMs}ms, runtime: ${runtime ? "enabled" : "disabled"})...\nPress Ctrl+C to stop.\n\n`);
+        const flags = [];
+        if (maxIterations > 0) {
+            flags.push(`max-iterations: ${maxIterations}`);
+        }
+        if (failFast) {
+            flags.push("fail-fast");
+        }
+        const flagsStr = flags.length > 0 ? `, ${flags.join(", ")}` : "";
+        process.stdout.write(`Watching ${resolvedPath} for changes (debounce: ${debounceMs}ms, runtime: ${runtime ? "enabled" : "disabled"}${flagsStr})...\nPress Ctrl+C to stop.\n\n`);
         schedule();
     });
 }

package/dist/index.d.ts

@@ -22,9 +22,9 @@ export { buildDoctorNpmPackageReport, renderDoctorNpmPackageReport, renderDoctor
 export { buildDoctorRiskDiffReport, renderDoctorRiskDiffReport, renderDoctorRiskDiffReportJson, type BuildDoctorRiskDiffReportOptions, type DoctorRiskDiffReport, type RiskDiffFinding, type RiskFindingCategory } from "./core/risk-diff.js";
 export { buildDoctorInspectorReport, renderDoctorInspectorReport, renderDoctorInspectorReportJson, type BuildDoctorInspectorReportOptions, type DoctorInspectorReport } from "./core/inspector-bridge.js";
 export { buildEcosystemAudit, renderEcosystemAudit, renderEcosystemAuditJson, type EcosystemAuditReport } from "./audit/ecosystem-audit.js";
-export { applyPolicyToDoctorConfig, applyPolicyToSecurityAudit, parsePolicyPack, policyEnablesRuntime, policyFailsOnWarnings, policyPackNames, type PolicyPackName } from "./policy/policy-packs.js";
+export { applyPolicyToDepAudit, applyPolicyToDoctorConfig, applyPolicyToSecurityAudit, parsePolicyPack, policyEnablesRuntime, policyFailsOnWarnings, policyPackNames, type PolicyPackName } from "./policy/policy-packs.js";
 export { buildGenericMcpDoctor, renderGenericMcpDoctor, renderGenericMcpDoctorJson, type GenericMcpDoctorReport } from "./mcp/generic-mcp-doctor.js";
 export { watchPlugin, type WatchPluginOptions, type WatchPluginResult } from "./core/watch-plugin.js";
-export { buildDepAudit, renderDepAudit, renderDepAuditJson, type DepAuditReport, type DepAuditVulnerability } from "./core/dep-audit.js";
+export { buildDepAudit, renderDepAudit, renderDepAuditJson, renderDepAuditSarif, type DepAuditReport, type DepAuditVulnerability } from "./core/dep-audit.js";
 export { initGitHooks, removeGitHooks, type InitGitHooksResult, type RemoveGitHooksResult } from "./core/init-git-hooks.js";
 export declare function runCheck(targetPath: string, options?: CheckOptions): Promise<CheckResult>;

package/dist/index.js

@@ -22,10 +22,10 @@ export { buildDoctorNpmPackageReport, renderDoctorNpmPackageReport, renderDoctor
 export { buildDoctorRiskDiffReport, renderDoctorRiskDiffReport, renderDoctorRiskDiffReportJson } from "./core/risk-diff.js";
 export { buildDoctorInspectorReport, renderDoctorInspectorReport, renderDoctorInspectorReportJson } from "./core/inspector-bridge.js";
 export { buildEcosystemAudit, renderEcosystemAudit, renderEcosystemAuditJson } from "./audit/ecosystem-audit.js";
-export { applyPolicyToDoctorConfig, applyPolicyToSecurityAudit, parsePolicyPack, policyEnablesRuntime, policyFailsOnWarnings, policyPackNames } from "./policy/policy-packs.js";
+export { applyPolicyToDepAudit, applyPolicyToDoctorConfig, applyPolicyToSecurityAudit, parsePolicyPack, policyEnablesRuntime, policyFailsOnWarnings, policyPackNames } from "./policy/policy-packs.js";
 export { buildGenericMcpDoctor, renderGenericMcpDoctor, renderGenericMcpDoctorJson } from "./mcp/generic-mcp-doctor.js";
 export { watchPlugin } from "./core/watch-plugin.js";
-export { buildDepAudit, renderDepAudit, renderDepAuditJson } from "./core/dep-audit.js";
+export { buildDepAudit, renderDepAudit, renderDepAuditJson, renderDepAuditSarif } from "./core/dep-audit.js";
 export { initGitHooks, removeGitHooks } from "./core/init-git-hooks.js";
 export async function runCheck(targetPath, options = {}) {
     return validatePlugin(targetPath, options);

package/dist/policy/policy-packs.d.ts

@@ -1,4 +1,5 @@
 import type { DoctorConfig } from "../core/doctor-config.js";
+import type { DepAuditReport } from "../core/dep-audit.js";
 import type { SecurityAudit } from "../security/security-audit.js";
 export declare const policyPackNames: readonly ["codex-publish", "mcp-strict", "security"];
 export type PolicyPackName = (typeof policyPackNames)[number];
@@ -7,3 +8,4 @@ export declare function policyEnablesRuntime(policy: PolicyPackName | null): boo
 export declare function policyFailsOnWarnings(policy: PolicyPackName | null): boolean;
 export declare function applyPolicyToDoctorConfig(config: DoctorConfig, policy: PolicyPackName | null): DoctorConfig;
 export declare function applyPolicyToSecurityAudit(audit: SecurityAudit, policy: PolicyPackName | null): SecurityAudit;
+export declare function applyPolicyToDepAudit(report: DepAuditReport, policy: PolicyPackName | null): DepAuditReport;

package/dist/policy/policy-packs.js

@@ -31,3 +31,12 @@ export function applyPolicyToSecurityAudit(audit, policy) {
         status: "fail"
     };
 }
+export function applyPolicyToDepAudit(report, policy) {
+    if (!policyFailsOnWarnings(policy)) {
+        return report;
+    }
+    if (report.status === "warn") {
+        return { ...report, status: "fail" };
+    }
+    return report;
+}

package/dist/rules/rule-catalog.js

@@ -251,6 +251,15 @@ export const ruleCatalog = [
         fix: "Use HTTPS for remote MCP servers; reserve HTTP for explicit localhost development endpoints.",
         example: '{ "url": "https://example.com/mcp" }'
     },
+    {
+        id: "plugin.security.mcp_binds_all_interfaces",
+        category: "security",
+        defaultSeverity: "warn",
+        summary: "An MCP server listens on `0.0.0.0` instead of `localhost`.",
+        why: "Servers that bind to all interfaces can accept connections from external hosts, which is rarely intended for local MCP development.",
+        fix: "Use `127.0.0.1` or `localhost` in server URLs and transport configuration unless external access is explicitly required.",
+        example: '{ "url": "http://127.0.0.1:3000/mcp" }'
+    },
     {
         id: "plugin.security.prompt_injection_text",
         category: "security",

package/dist/run-cli.js

@@ -31,7 +31,7 @@ import { applyFixPlan, buildFixPlan, renderApplyFixResult, renderFixPlanJsonRepo
 import { renderClientDoctor, renderEnvironmentDoctor, renderEnvironmentDoctorJson } from "./core/environment-doctor.js";
 import { initCiWorkflow } from "./core/init-ci.js";
 import { watchPlugin } from "./core/watch-plugin.js";
-import { buildDepAudit, renderDepAudit, renderDepAuditJson } from "./core/dep-audit.js";
+import { buildDepAudit, renderDepAudit, renderDepAuditJson, renderDepAuditSarif } from "./core/dep-audit.js";
 import { initGitHooks, removeGitHooks } from "./core/init-git-hooks.js";
 import { initPluginPackage, initPluginTemplates, isInitPluginTemplate } from "./core/init-plugin.js";
 import { runCheck } from "./index.js";
@@ -48,7 +48,7 @@ import { renderSuppressionList, renderSuppressionListJson, renderSuppressionMuta
 import { renderRuleExplanation } from "./reporting/render-rule-explanation.js";
 import { renderSarifReport } from "./reporting/render-sarif-report.js";
 import { renderTextReport } from "./reporting/render-text-report.js";
-import { applyPolicyToDoctorConfig, applyPolicyToSecurityAudit, parsePolicyPack, policyEnablesRuntime, policyFailsOnWarnings, policyPackNames } from "./policy/policy-packs.js";
+import { applyPolicyToDepAudit, applyPolicyToDoctorConfig, applyPolicyToSecurityAudit, parsePolicyPack, policyEnablesRuntime, policyFailsOnWarnings, policyPackNames } from "./policy/policy-packs.js";
 import { findRuleDefinition } from "./rules/rule-catalog.js";
 import { buildSecurityAudit, renderSecurityAuditJson, renderSecurityScorecard } from "./security/security-audit.js";
 import { buildTrustScore, renderTrustScore, renderTrustScoreJson } from "./security/trust-score.js";
@@ -78,7 +78,7 @@ const defaultIo = {
     }
 };
 function printUsage(io) {
-    io.writeStderr("Usage: codex-plugin-doctor check <path|--installed> [filter] [--policy codex-publish|mcp-strict|security] [--compat] [--json|--markdown|--badge-json|--badge-markdown] [--output <path>] [--history <path>] [--runtime] [--require-runtime-approval --runtime-approval-digest <digest>] [--verbose-runtime] [--explain] [--no-animations] [--ascii]\n       codex-plugin-doctor audit --installed [filter] [--policy codex-publish|mcp-strict|security] [--security] [--compat] [--json] [--output <path>] [--cache] [--changed]\n       codex-plugin-doctor audit deps <path> [--json] [--output <path>]\n       codex-plugin-doctor mcp <path> [--json] [--output <path>]\n       codex-plugin-doctor security <path> [--policy security] [--json|--scorecard]\n       codex-plugin-doctor compat <path> [--all|--client <client>] [--json] [--scorecard] [--output <path>] [--install-preview|--apply --backup]\n       codex-plugin-doctor suppress add <path> [--fingerprint <sha256> --reason <text> --expires-at YYYY-MM-DD] [--config <path>] [--json]\n       codex-plugin-doctor suppress list <path> [--config <path>] [--json]\n       codex-plugin-doctor suppress remove <path> [--fingerprint <sha256>|--index <n>] [--config <path>] [--json]\n       codex-plugin-doctor fix <path> (--dry-run|--interactive --backup|--apply --backup)\n       codex-plugin-doctor history <history.jsonl> [--json] [--fail-on-regression]\n       codex-plugin-doctor watch <path> [--runtime] [--json] [--output <path>] [--debounce-ms <ms>]\n       codex-plugin-doctor doctor [npm <package>|contract|corpus|runtime-plan <path> [--json|--markdown] [--output <path>]|runtime-policy <path> [--json] [--output <path>]|review-bundle <path> --output <dir> --sign-key-env NAME [--json] [--allow-dirty] [--allow-untagged]|review-bundle verify <bundle-dir> --target <path> --sign-key-env NAME [--json] [--output <path>] [--failures-only]|review-bundle diff --before <dir> --after <dir> [--json]|attest <path> [--sign-key-env NAME]|attest verify <attestation.json> --target <path> --sign-key-env NAME|release-evidence <path> --sign-key-env NAME [--allow-dirty] [--allow-untagged] [--require-runtime-approval --runtime-approval-digest <digest>]|release-evidence verify <evidence.json> --target <path> --sign-key-env NAME|release-evidence asset <path> --tag <tag> --output <evidence.json> --sign-key-env NAME [--upload]|mcp <path>|inspector <path>|diff --before <path> --after <path>|recommend <path>|trust <path>|perf <path> [--max-total-ms <ms>] [--max-stage-ms stage=ms]|export --bundle <path>|snapshot|clients|--json|--update-check]\n       codex-plugin-doctor init [path] [--template skill-only|mcp-stdio|mcp-http|full-runtime]\n       codex-plugin-doctor init-ci [path]\n       codex-plugin-doctor init-git-hooks [path] [--force] [--json]\n       codex-plugin-doctor init-git-hooks [path] --remove [--json]\n       codex-plugin-doctor self-test\n       codex-plugin-doctor list --installed\n       codex-plugin-doctor explain <finding-id>\n       codex-plugin-doctor --version\n\nFirst run:\n       codex-plugin-doctor doctor\n       codex-plugin-doctor self-test\n       codex-plugin-doctor init my-plugin\n       codex-plugin-doctor check . --runtime --explain");
+    io.writeStderr("Usage: codex-plugin-doctor check <path|--installed> [filter] [--policy codex-publish|mcp-strict|security] [--compat] [--json|--markdown|--badge-json|--badge-markdown] [--output <path>] [--history <path>] [--runtime] [--require-runtime-approval --runtime-approval-digest <digest>] [--verbose-runtime] [--explain] [--no-animations] [--ascii]\n       codex-plugin-doctor audit --installed [filter] [--policy codex-publish|mcp-strict|security] [--security] [--compat] [--json] [--output <path>] [--cache] [--changed]\n       codex-plugin-doctor audit deps <path> [--policy codex-publish|mcp-strict|security] [--json|--sarif] [--output <path>]\n       codex-plugin-doctor mcp <path> [--json] [--output <path>]\n       codex-plugin-doctor security <path> [--policy security] [--json|--scorecard]\n       codex-plugin-doctor compat <path> [--all|--client <client>] [--json] [--scorecard] [--output <path>] [--install-preview|--apply --backup]\n       codex-plugin-doctor suppress add <path> [--fingerprint <sha256> --reason <text> --expires-at YYYY-MM-DD] [--config <path>] [--json]\n       codex-plugin-doctor suppress list <path> [--config <path>] [--json]\n       codex-plugin-doctor suppress remove <path> [--fingerprint <sha256>|--index <n>] [--config <path>] [--json]\n       codex-plugin-doctor fix <path> (--dry-run|--interactive --backup|--apply --backup)\n       codex-plugin-doctor history <history.jsonl> [--json] [--fail-on-regression]\n       codex-plugin-doctor watch <path> [--runtime] [--json] [--output <path>] [--debounce-ms <ms>] [--max-iterations <n>] [--fail-fast] [--accumulate-json <path>]\n       codex-plugin-doctor doctor [npm <package>|contract|corpus|runtime-plan <path> [--json|--markdown] [--output <path>]|runtime-policy <path> [--json] [--output <path>]|review-bundle <path> --output <dir> --sign-key-env NAME [--json] [--allow-dirty] [--allow-untagged]|review-bundle verify <bundle-dir> --target <path> --sign-key-env NAME [--json] [--output <path>] [--failures-only]|review-bundle diff --before <dir> --after <dir> [--json]|attest <path> [--sign-key-env NAME]|attest verify <attestation.json> --target <path> --sign-key-env NAME|release-evidence <path> --sign-key-env NAME [--allow-dirty] [--allow-untagged] [--require-runtime-approval --runtime-approval-digest <digest>]|release-evidence verify <evidence.json> --target <path> --sign-key-env NAME|release-evidence asset <path> --tag <tag> --output <evidence.json> --sign-key-env NAME [--upload]|mcp <path>|inspector <path>|diff --before <path> --after <path>|recommend <path>|trust <path>|perf <path> [--max-total-ms <ms>] [--max-stage-ms stage=ms]|export --bundle <path>|snapshot|clients|--json|--update-check]\n       codex-plugin-doctor init [path] [--template skill-only|mcp-stdio|mcp-http|full-runtime]\n       codex-plugin-doctor init-ci [path]\n       codex-plugin-doctor init-git-hooks [path] [--force] [--json]\n       codex-plugin-doctor init-git-hooks [path] --remove [--json]\n       codex-plugin-doctor self-test\n       codex-plugin-doctor list --installed\n       codex-plugin-doctor explain <finding-id>\n       codex-plugin-doctor --version\n\nFirst run:\n       codex-plugin-doctor doctor\n       codex-plugin-doctor self-test\n       codex-plugin-doctor init my-plugin\n       codex-plugin-doctor check . --runtime --explain");
     io.writeStderr("Suppression governance: codex-plugin-doctor suppress list <path> [--fail-on-expired] [--fail-on-invalid] [--warn-expiring-within-days <days>]\n       codex-plugin-doctor suppress prune <path> [--apply] [--json]");
 }
 const suppressUsageText = [
@@ -1815,23 +1815,41 @@ export async function runCli(args, io = defaultIo, options = {}) {
             : remainingArgs;
         const runtime = watchFlags.includes("--runtime");
         const jsonOutput = watchFlags.includes("--json");
+        const failFast = watchFlags.includes("--fail-fast");
         const outputIndex = watchFlags.indexOf("--output");
         const outputPath = outputIndex === -1 ? null : watchFlags[outputIndex + 1];
         const debounceIndex = watchFlags.indexOf("--debounce-ms");
         const debounceRaw = debounceIndex === -1 ? null : watchFlags[debounceIndex + 1];
         const debounceMs = debounceRaw ? Number(debounceRaw) || 300 : 300;
+        const maxIterationsIndex = watchFlags.indexOf("--max-iterations");
+        const maxIterationsRaw = maxIterationsIndex === -1 ? null : watchFlags[maxIterationsIndex + 1];
+        const maxIterations = maxIterationsRaw ? Number(maxIterationsRaw) || 0 : 0;
+        const accumulateIndex = watchFlags.indexOf("--accumulate-json");
+        const accumulatePath = accumulateIndex === -1 ? null : watchFlags[accumulateIndex + 1];
         if (outputIndex !== -1 && (!outputPath || outputPath.startsWith("--"))) {
             io.writeStderr("Missing path after --output.");
             return 2;
         }
+        if (maxIterationsIndex !== -1 && (!maxIterationsRaw || maxIterationsRaw.startsWith("--"))) {
+            io.writeStderr("Missing number after --max-iterations.");
+            return 2;
+        }
+        if (accumulateIndex !== -1 && (!accumulatePath || accumulatePath.startsWith("--"))) {
+            io.writeStderr("Missing path after --accumulate-json.");
+            return 2;
+        }
         const result = await watchPlugin({
             targetPath,
             debounceMs,
             runtime,
             jsonOutput,
-            outputPath
+            outputPath,
+            maxIterations,
+            failFast,
+            accumulateJsonPath: accumulatePath
         });
-        io.writeStdout(`\nStopped watching ${result.targetPath}: ${result.validations} validations, ${result.failures} failures.`);
+        const reason = result.iterationsReached ? "max iterations reached" : "stopped";
+        io.writeStdout(`\nStopped watching ${result.targetPath}: ${result.validations} validations, ${result.failures} failures (${reason}).`);
         return result.failures > 0 ? 1 : 0;
     }
     if (command === "fix") {
@@ -1945,16 +1963,37 @@ export async function runCli(args, io = defaultIo, options = {}) {
                 ? remainingArgs
                 : remainingArgs.slice(1);
             const jsonOutput = depsFlags.includes("--json");
+            const sarifOutput = depsFlags.includes("--sarif");
             const outputIndex = depsFlags.indexOf("--output");
             const outputPath = outputIndex === -1 ? null : depsFlags[outputIndex + 1];
+            const policyIndex = depsFlags.indexOf("--policy");
+            const policyName = policyIndex === -1 ? null : depsFlags[policyIndex + 1];
+            const policy = parsePolicyPack(policyName);
             if (outputIndex !== -1 && (!outputPath || outputPath.startsWith("--"))) {
                 io.writeStderr("Missing path after --output.");
                 return 2;
             }
-            const report = await buildDepAudit(targetPath);
-            const renderedReport = jsonOutput
-                ? renderDepAuditJson(report)
-                : renderDepAudit(report);
+            if (policyIndex !== -1 && (!policyName || policyName.startsWith("--"))) {
+                io.writeStderr("Missing policy after --policy.");
+                return 2;
+            }
+            if (policyIndex !== -1 && !policy) {
+                io.writeStderr(`Unknown policy: ${policyName}. Supported policies: ${policyPackNames.join(", ")}.`);
+                return 2;
+            }
+            if (jsonOutput && sarifOutput) {
+                io.writeStderr("Use either --json or --sarif, not both.");
+                return 2;
+            }
+            let report = await buildDepAudit(targetPath);
+            if (policy) {
+                report = applyPolicyToDepAudit(report, policy);
+            }
+            const renderedReport = sarifOutput
+                ? renderDepAuditSarif(report)
+                : jsonOutput
+                    ? renderDepAuditJson(report)
+                    : renderDepAudit(report);
             if (outputPath) {
                 await writeFile(outputPath, renderedReport, "utf8");
             }
@@ -1964,7 +2003,7 @@ export async function runCli(args, io = defaultIo, options = {}) {
         const auditFlags = maybePath ? [maybePath, ...remainingArgs] : remainingArgs;
         const installed = auditFlags.includes("--installed");
         if (!installed) {
-            io.writeStderr("Usage: codex-plugin-doctor audit --installed [filter] [--security] [--compat] [--json] [--output <path>] [--cache] [--changed]\n       codex-plugin-doctor audit deps <path> [--json] [--output <path>]");
+            io.writeStderr("Usage: codex-plugin-doctor audit --installed [filter] [--security] [--compat] [--json] [--output <path>] [--cache] [--changed]\n       codex-plugin-doctor audit deps <path> [--policy codex-publish|mcp-strict|security] [--json|--sarif] [--output <path>]");
             return 2;
         }
         const installedIndex = auditFlags.indexOf("--installed");

package/dist/security/security-audit.js

@@ -227,6 +227,9 @@ export function auditMcpServerConfig(rootPath, parsedConfig, options = {}) {
         if (typeof url === "string" && /^http:\/\//i.test(url)) {
             findings.push(buildFinding("warn", "plugin.security.insecure_http_url", `The MCP server \`${serverName}\` uses an insecure HTTP URL.`, "Plain HTTP transports can expose MCP traffic on non-local networks and make endpoint identity harder to verify.", "Use HTTPS for remote MCP servers; reserve HTTP for explicit localhost development endpoints.", { serverName, configPath, url }));
         }
+        if (typeof url === "string" && /\/\/0\.0\.0\.0[:/]/i.test(url)) {
+            findings.push(buildFinding("warn", "plugin.security.mcp_binds_all_interfaces", `The MCP server \`${serverName}\` URL binds to \`0.0.0.0\`.`, "Servers that listen on all interfaces can accept connections from external hosts, which is rarely intended for local MCP development.", "Use `127.0.0.1` or `localhost` instead of `0.0.0.0` unless external access is explicitly required.", { serverName, configPath, url }));
+        }
     }
     return findings;
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "codex-plugin-doctor",
-  "version": "1.31.0",
+  "version": "1.33.0",
   "description": "CLI-first validator for Codex plugins, skills, and MCP package surfaces with runtime MCP protocol validation.",
   "type": "module",
   "main": "./dist/index.js",