codex-plugin-doctor 1.41.0 → 1.43.0

package/README.md

@@ -234,12 +234,12 @@ codex-plugin-doctor audit --installed
 codex-plugin-doctor audit --installed --security --compat
 codex-plugin-doctor audit --installed --security --compat --json --output local-audit.json
 codex-plugin-doctor audit --installed --security --compat --cache
-codex-plugin-doctor audit --installed --changed --cache
-codex-plugin-doctor audit deps .
-codex-plugin-doctor audit deps . --json --output dependency-audit.json
-codex-plugin-doctor audit deps . --recommend
-codex-plugin-doctor audit deps . --recommend --json --output dependency-remediation.json
-codex-plugin-doctor watch .
+codex-plugin-doctor audit --installed --changed --cache
+codex-plugin-doctor audit deps .
+codex-plugin-doctor audit deps . --json --output dependency-audit.json
+codex-plugin-doctor audit deps . --recommend
+codex-plugin-doctor audit deps . --recommend --json --output dependency-remediation.json
+codex-plugin-doctor watch .
 codex-plugin-doctor watch . --json --output watch-latest.json --debounce-ms 500
 codex-plugin-doctor init-git-hooks .
 codex-plugin-doctor init-git-hooks . --json
@@ -304,7 +304,7 @@ codex-plugin-doctor check . --json --runtime --verbose-runtime
 
 `audit --installed` runs a local ecosystem audit against every discovered Codex plugin in the installed plugin cache. Add `--security` to include security scorecards, `--compat` to include the all-client compatibility matrix, and `--json --output local-audit.json` when you want a shareable machine-readable report. Add `--cache` to reuse unchanged plugin results between runs; add `--changed` to only report plugins whose fingerprint changed since the last cached audit. Use `--cache-file path/to/audit-cache.json` when CI or scripted runs need an explicit cache location.
 
-`audit deps <path>` runs `npm audit --json` for the target package and normalizes dependency vulnerability results into a stable `schemaVersion: "1.0.0"` report. Use `--json --output dependency-audit.json` when CI needs machine-readable status, vulnerability counts, and the raw npm audit payload. Add `--recommend` to include prioritized remediation actions for direct upgrades, direct no-fix packages, transitive parent updates, and manual transitive review.
+`audit deps <path>` runs `npm audit --json` for the target package and normalizes dependency vulnerability results into a stable `schemaVersion: "1.0.0"` report. Use `--json --output dependency-audit.json` when CI needs machine-readable status, vulnerability counts, and the raw npm audit payload. Add `--recommend` to include prioritized remediation actions for direct upgrades, direct no-fix packages, transitive parent updates, and manual transitive review.
 
 `watch <path>` continuously validates a plugin package after file changes. Use `--debounce-ms <ms>` to tune noisy repositories, `--runtime` when runtime probes are required, and `--json --output watch-latest.json` when another process should consume the latest validation snapshot.
 
@@ -330,7 +330,7 @@ codex-plugin-doctor check . --json --runtime --verbose-runtime
 
 `check --profile ci|strict|publish` applies named validation policies. `ci` keeps default behavior, `strict` fails on warnings, and `publish` fails on warnings while enabling runtime probing by default.
 
-`check --explain` adds a deduplicated `Next Actions` summary plus inline rule catalog context to text reports, including the problem summary, rule category, why a finding matters, a more detailed fix path, a compact example, and the matching `codex-plugin-doctor explain <finding-id>` follow-up command.
+`check --explain` adds a deduplicated `Next Actions` summary plus inline rule catalog context to text reports, including the problem summary, rule category, why a finding matters, a more detailed fix path, a compact example, and the matching `codex-plugin-doctor explain <finding-id>` follow-up command.
 
 `check --badge-json` emits Shields endpoint-compatible JSON such as `{"schemaVersion":1,"label":"doctor","message":"PASS","color":"brightgreen"}`. `check --badge-markdown` emits a static shields.io Markdown badge for README or release notes. Badge output is intentionally limited to single package checks, not `check --installed`.
 
@@ -402,9 +402,9 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v5
-      - uses: Esquetta/CodexPluginDoctor@v1.41.0
-        with:
-          version: "1.41.0"
+      - uses: Esquetta/CodexPluginDoctor@v1.43.0
+        with:
+          version: "1.43.0"
           path: .
           runtime: "true"
           policy: codex-publish
@@ -459,7 +459,7 @@ npm run prepare-release
 npm run release-check
 ```
 
-`prepare-release` runs tests, builds the TypeScript output, and performs `npm pack --dry-run`. `release-check` adds release preflight checks for a clean git tree, existing npm versions, existing version tags, tests, build, pack dry-run, fresh temp install audit, and publish dry-run.
+`prepare-release` runs tests, builds the TypeScript output, and performs `npm pack --dry-run`. `release-check` adds release preflight checks for a clean git tree, existing npm versions, existing version tags, tests, build, pack dry-run, fresh temp install audit, and publish dry-run.
 
 Related docs:
 

package/dist/reporting/recommended-commands.d.ts

@@ -0,0 +1,2 @@
+import type { CheckResult } from "../domain/types.js";
+export declare function buildRecommendedCommands(result: CheckResult): string[];

package/dist/reporting/recommended-commands.js

@@ -0,0 +1,17 @@
+function quoteCliArg(value) {
+    return JSON.stringify(value);
+}
+export function buildRecommendedCommands(result) {
+    if (result.findings.length === 0) {
+        return [];
+    }
+    const target = quoteCliArg(result.targetPath);
+    const commands = [
+        `codex-plugin-doctor doctor recommend ${target}`,
+        `codex-plugin-doctor fix ${target} --dry-run`
+    ];
+    if (result.findings.some((finding) => finding.fingerprint)) {
+        commands.push(`codex-plugin-doctor suppress add ${target}`);
+    }
+    return commands;
+}

package/dist/reporting/render-markdown-report.js

@@ -1,5 +1,6 @@
 import { formatFindingEvidenceLine } from "./format-finding-evidence.js";
 import { formatFindingFingerprintLine } from "./finding-fingerprint.js";
+import { buildRecommendedCommands } from "./recommended-commands.js";
 export function buildMarkdownReport(result, options) {
     const failCount = result.findings.filter((finding) => finding.severity === "fail").length;
     const warnCount = result.findings.filter((finding) => finding.severity === "warn").length;
@@ -37,6 +38,13 @@ export function buildMarkdownReport(result, options) {
         lines.push(`| prompts/get | ${result.runtimeScorecard.promptGet.toUpperCase()} |`);
     }
     if (result.findings.length > 0) {
+        const nextActions = Array.from(new Set(result.findings.map((finding) => finding.suggestedFix))).slice(0, 5);
+        if (nextActions.length > 0) {
+            lines.push("", "## Next Actions", "");
+            for (const [index, action] of nextActions.entries()) {
+                lines.push(`${index + 1}. ${action}`);
+            }
+        }
         lines.push("", "## Findings", "");
         for (const finding of result.findings) {
             lines.push(`### ${finding.severity.toUpperCase()} \`${finding.id}\``);
@@ -70,5 +78,12 @@ export function buildMarkdownReport(result, options) {
             lines.push("");
         }
     }
+    const recommendedCommands = buildRecommendedCommands(result);
+    if (recommendedCommands.length > 0) {
+        lines.push("", "## Recommended Commands", "");
+        for (const command of recommendedCommands) {
+            lines.push(`- \`${command}\``);
+        }
+    }
     return lines.join("\n");
 }

package/dist/reporting/render-text-report.js

@@ -1,6 +1,7 @@
 import { findRuleDefinition } from "../rules/rule-catalog.js";
 import { formatFindingEvidenceLine } from "./format-finding-evidence.js";
 import { formatFindingFingerprintLine } from "./finding-fingerprint.js";
+import { buildRecommendedCommands } from "./recommended-commands.js";
 function getCounts(result) {
     const failCount = result.findings.filter((finding) => finding.severity === "fail").length;
     const warnCount = result.findings.filter((finding) => finding.severity === "warn").length;
@@ -118,5 +119,12 @@ export function renderTextReport(result, options = {}) {
         lines.push(`prompts/list: ${result.runtimeScorecard.promptsList}`);
         lines.push(`prompts/get: ${result.runtimeScorecard.promptGet}`);
     }
+    const recommendedCommands = buildRecommendedCommands(result);
+    if (recommendedCommands.length > 0) {
+        lines.push("", "Recommended Commands", "--------------------");
+        for (const command of recommendedCommands) {
+            lines.push(`- ${command}`);
+        }
+    }
     return lines.join("\n");
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "codex-plugin-doctor",
-  "version": "1.41.0",
+  "version": "1.43.0",
   "description": "CLI-first validator for Codex plugins, skills, and MCP package surfaces with runtime MCP protocol validation.",
   "type": "module",
   "main": "./dist/index.js",