codex-plugin-doctor 1.41.0 → 1.42.0

package/README.md

@@ -234,12 +234,12 @@ codex-plugin-doctor audit --installed
 codex-plugin-doctor audit --installed --security --compat
 codex-plugin-doctor audit --installed --security --compat --json --output local-audit.json
 codex-plugin-doctor audit --installed --security --compat --cache
-codex-plugin-doctor audit --installed --changed --cache
-codex-plugin-doctor audit deps .
-codex-plugin-doctor audit deps . --json --output dependency-audit.json
-codex-plugin-doctor audit deps . --recommend
-codex-plugin-doctor audit deps . --recommend --json --output dependency-remediation.json
-codex-plugin-doctor watch .
+codex-plugin-doctor audit --installed --changed --cache
+codex-plugin-doctor audit deps .
+codex-plugin-doctor audit deps . --json --output dependency-audit.json
+codex-plugin-doctor audit deps . --recommend
+codex-plugin-doctor audit deps . --recommend --json --output dependency-remediation.json
+codex-plugin-doctor watch .
 codex-plugin-doctor watch . --json --output watch-latest.json --debounce-ms 500
 codex-plugin-doctor init-git-hooks .
 codex-plugin-doctor init-git-hooks . --json
@@ -304,7 +304,7 @@ codex-plugin-doctor check . --json --runtime --verbose-runtime
 
 `audit --installed` runs a local ecosystem audit against every discovered Codex plugin in the installed plugin cache. Add `--security` to include security scorecards, `--compat` to include the all-client compatibility matrix, and `--json --output local-audit.json` when you want a shareable machine-readable report. Add `--cache` to reuse unchanged plugin results between runs; add `--changed` to only report plugins whose fingerprint changed since the last cached audit. Use `--cache-file path/to/audit-cache.json` when CI or scripted runs need an explicit cache location.
 
-`audit deps <path>` runs `npm audit --json` for the target package and normalizes dependency vulnerability results into a stable `schemaVersion: "1.0.0"` report. Use `--json --output dependency-audit.json` when CI needs machine-readable status, vulnerability counts, and the raw npm audit payload. Add `--recommend` to include prioritized remediation actions for direct upgrades, direct no-fix packages, transitive parent updates, and manual transitive review.
+`audit deps <path>` runs `npm audit --json` for the target package and normalizes dependency vulnerability results into a stable `schemaVersion: "1.0.0"` report. Use `--json --output dependency-audit.json` when CI needs machine-readable status, vulnerability counts, and the raw npm audit payload. Add `--recommend` to include prioritized remediation actions for direct upgrades, direct no-fix packages, transitive parent updates, and manual transitive review.
 
 `watch <path>` continuously validates a plugin package after file changes. Use `--debounce-ms <ms>` to tune noisy repositories, `--runtime` when runtime probes are required, and `--json --output watch-latest.json` when another process should consume the latest validation snapshot.
 
@@ -330,7 +330,7 @@ codex-plugin-doctor check . --json --runtime --verbose-runtime
 
 `check --profile ci|strict|publish` applies named validation policies. `ci` keeps default behavior, `strict` fails on warnings, and `publish` fails on warnings while enabling runtime probing by default.
 
-`check --explain` adds a deduplicated `Next Actions` summary plus inline rule catalog context to text reports, including the problem summary, rule category, why a finding matters, a more detailed fix path, a compact example, and the matching `codex-plugin-doctor explain <finding-id>` follow-up command.
+`check --explain` adds a deduplicated `Next Actions` summary plus inline rule catalog context to text reports, including the problem summary, rule category, why a finding matters, a more detailed fix path, a compact example, and the matching `codex-plugin-doctor explain <finding-id>` follow-up command.
 
 `check --badge-json` emits Shields endpoint-compatible JSON such as `{"schemaVersion":1,"label":"doctor","message":"PASS","color":"brightgreen"}`. `check --badge-markdown` emits a static shields.io Markdown badge for README or release notes. Badge output is intentionally limited to single package checks, not `check --installed`.
 
@@ -402,9 +402,9 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v5
-      - uses: Esquetta/CodexPluginDoctor@v1.41.0
-        with:
-          version: "1.41.0"
+      - uses: Esquetta/CodexPluginDoctor@v1.42.0
+        with:
+          version: "1.42.0"
           path: .
           runtime: "true"
           policy: codex-publish
@@ -459,7 +459,7 @@ npm run prepare-release
 npm run release-check
 ```
 
-`prepare-release` runs tests, builds the TypeScript output, and performs `npm pack --dry-run`. `release-check` adds release preflight checks for a clean git tree, existing npm versions, existing version tags, tests, build, pack dry-run, fresh temp install audit, and publish dry-run.
+`prepare-release` runs tests, builds the TypeScript output, and performs `npm pack --dry-run`. `release-check` adds release preflight checks for a clean git tree, existing npm versions, existing version tags, tests, build, pack dry-run, fresh temp install audit, and publish dry-run.
 
 Related docs:
 

package/dist/reporting/render-markdown-report.js

@@ -37,6 +37,13 @@ export function buildMarkdownReport(result, options) {
         lines.push(`| prompts/get | ${result.runtimeScorecard.promptGet.toUpperCase()} |`);
     }
     if (result.findings.length > 0) {
+        const nextActions = Array.from(new Set(result.findings.map((finding) => finding.suggestedFix))).slice(0, 5);
+        if (nextActions.length > 0) {
+            lines.push("", "## Next Actions", "");
+            for (const [index, action] of nextActions.entries()) {
+                lines.push(`${index + 1}. ${action}`);
+            }
+        }
         lines.push("", "## Findings", "");
         for (const finding of result.findings) {
             lines.push(`### ${finding.severity.toUpperCase()} \`${finding.id}\``);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "codex-plugin-doctor",
-  "version": "1.41.0",
+  "version": "1.42.0",
   "description": "CLI-first validator for Codex plugins, skills, and MCP package surfaces with runtime MCP protocol validation.",
   "type": "module",
   "main": "./dist/index.js",