codex-plugin-doctor 1.44.0 → 1.46.0

package/README.md

@@ -287,10 +287,10 @@ codex-plugin-doctor check . --ascii
 codex-plugin-doctor check . --no-animations
 codex-plugin-doctor check . --runtime
 codex-plugin-doctor check . --runtime --require-runtime-approval --runtime-approval-digest sha256:<approved-plan-digest>
-codex-plugin-doctor check . --config .codex-doctor.json
-codex-plugin-doctor baseline create . --output .codex-doctor-baseline.json
-codex-plugin-doctor check . --baseline .codex-doctor-baseline.json
-codex-plugin-doctor check . --history validation-history.jsonl
+codex-plugin-doctor check . --config .codex-doctor.json
+codex-plugin-doctor baseline create . --output .codex-doctor-baseline.json
+codex-plugin-doctor check . --baseline .codex-doctor-baseline.json
+codex-plugin-doctor check . --history validation-history.jsonl
 codex-plugin-doctor history validation-history.jsonl
 codex-plugin-doctor history validation-history.jsonl --json
 codex-plugin-doctor history validation-history.jsonl --fail-on-regression
@@ -336,11 +336,11 @@ codex-plugin-doctor check . --json --runtime --verbose-runtime
 
 `check --badge-json` emits Shields endpoint-compatible JSON such as `{"schemaVersion":1,"label":"doctor","message":"PASS","color":"brightgreen"}`. `check --badge-markdown` emits a static shields.io Markdown badge for README or release notes. Badge output is intentionally limited to single package checks, not `check --installed`.
 
-`check --history <path>` appends a compact JSONL validation snapshot after a single package check. `history <path>` reads the JSONL file and compares the latest run to the previous run, including status, finding-count deltas, and whether the latest run regressed. Add `history --json` for automation output or `history --fail-on-regression` when CI should fail after a worse latest run.
-
-`baseline create <path> --output <path>` records the current fingerprinted findings for gradual CI adoption. A later `check <path> --baseline <path>` keeps matched findings visible in baseline metadata but gates only new active findings; reports summarize new, matched, and resolved counts. Commit the baseline for review and regenerate it deliberately after accepted findings change.
-
-`fix --dry-run` renders safe automatic fix plans without changing files. `fix --interactive --backup` shows the same numbered plan, then applies everything after `yes` or only selected action numbers such as `1,3`. `fix --apply --backup` applies supported safe fixes, such as manifest defaults and missing skills directories, after creating backups.
+`check --history <path>` appends a compact JSONL validation snapshot after a single package check. `history <path>` reads the JSONL file and compares the latest run to the previous run, including status, finding-count deltas, and whether the latest run regressed. Add `history --json` for automation output or `history --fail-on-regression` when CI should fail after a worse latest run.
+
+`baseline create <path> --output <path>` records the current fingerprinted findings for gradual CI adoption. A later `check <path> --baseline <path>` keeps matched findings visible in baseline metadata but gates only new active findings; reports summarize new, matched, and resolved counts. Commit the baseline for review and regenerate it deliberately after accepted findings change.
+
+`fix --dry-run` renders safe automatic fix plans without changing files. `fix --interactive --backup` shows the same numbered plan, then applies everything after `yes` or only selected action numbers such as `1,3`. `fix --apply --backup` applies supported safe fixes, such as manifest defaults and missing skills directories, after creating backups.
 
 Optional local policy file:
 
@@ -406,9 +406,9 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v5
-      - uses: Esquetta/CodexPluginDoctor@v1.44.0
+      - uses: Esquetta/CodexPluginDoctor@v1.46.0
         with:
-          version: "1.44.0"
+          version: "1.46.0"
           path: .
           runtime: "true"
           policy: codex-publish

package/dist/core/config-validate.d.ts

@@ -0,0 +1,13 @@
+export interface ConfigValidationFinding {
+    field: string;
+    message: string;
+    severity: "fail" | "warn";
+}
+export interface ConfigValidationReport {
+    configPath: string;
+    status: "pass" | "fail";
+    findings: ConfigValidationFinding[];
+}
+export declare function validateConfigFile(configPath: string): Promise<ConfigValidationReport>;
+export declare function renderConfigValidation(report: ConfigValidationReport): string;
+export declare function renderConfigValidationJson(report: ConfigValidationReport): string;

package/dist/core/config-validate.js

@@ -0,0 +1,133 @@
+import { readFile, stat } from "node:fs/promises";
+import path from "node:path";
+const knownFields = ["ignoreRules", "failOnWarnings", "suppressions"];
+export async function validateConfigFile(configPath) {
+    const resolvedPath = path.resolve(configPath);
+    const findings = [];
+    try {
+        await stat(resolvedPath);
+    }
+    catch {
+        return {
+            configPath: resolvedPath,
+            status: "fail",
+            findings: [
+                { field: "file", message: `Config file not found: ${resolvedPath}`, severity: "fail" }
+            ]
+        };
+    }
+    let parsed;
+    try {
+        parsed = JSON.parse(await readFile(resolvedPath, "utf8"));
+    }
+    catch (error) {
+        return {
+            configPath: resolvedPath,
+            status: "fail",
+            findings: [
+                { field: "json", message: `Invalid JSON: ${error.message}`, severity: "fail" }
+            ]
+        };
+    }
+    if (!parsed || typeof parsed !== "object" || Array.isArray(parsed)) {
+        return {
+            configPath: resolvedPath,
+            status: "fail",
+            findings: [
+                { field: "root", message: "Config must be a JSON object.", severity: "fail" }
+            ]
+        };
+    }
+    const config = parsed;
+    for (const key of Object.keys(config)) {
+        if (!knownFields.includes(key)) {
+            findings.push({
+                field: key,
+                message: `Unknown field: "${key}". Known fields: ${knownFields.join(", ")}`,
+                severity: "warn"
+            });
+        }
+    }
+    if ("ignoreRules" in config) {
+        const ignoreRules = config.ignoreRules;
+        if (!Array.isArray(ignoreRules)) {
+            findings.push({ field: "ignoreRules", message: "Must be an array of strings.", severity: "fail" });
+        }
+        else if (!ignoreRules.every((r) => typeof r === "string")) {
+            findings.push({ field: "ignoreRules", message: "All entries must be strings.", severity: "fail" });
+        }
+    }
+    if ("failOnWarnings" in config) {
+        if (typeof config.failOnWarnings !== "boolean") {
+            findings.push({ field: "failOnWarnings", message: "Must be a boolean.", severity: "fail" });
+        }
+    }
+    if ("suppressions" in config) {
+        const suppressions = config.suppressions;
+        if (!Array.isArray(suppressions)) {
+            findings.push({ field: "suppressions", message: "Must be an array.", severity: "fail" });
+        }
+        else {
+            for (let i = 0; i < suppressions.length; i += 1) {
+                const entry = suppressions[i];
+                if (!entry || typeof entry !== "object") {
+                    findings.push({ field: `suppressions[${i}]`, message: "Must be an object.", severity: "fail" });
+                    continue;
+                }
+                if (typeof entry.fingerprint !== "string" || !/^[a-f0-9]{64}$/.test(entry.fingerprint)) {
+                    findings.push({
+                        field: `suppressions[${i}].fingerprint`,
+                        message: "Must be a 64-character lowercase hex string.",
+                        severity: "fail"
+                    });
+                }
+                if (typeof entry.reason !== "string" || entry.reason.trim().length === 0) {
+                    findings.push({
+                        field: `suppressions[${i}].reason`,
+                        message: "Must be a non-empty string.",
+                        severity: "fail"
+                    });
+                }
+                if (typeof entry.expiresAt !== "string" || !/^\d{4}-\d{2}-\d{2}$/.test(entry.expiresAt)) {
+                    findings.push({
+                        field: `suppressions[${i}].expiresAt`,
+                        message: "Must be a YYYY-MM-DD date string.",
+                        severity: "fail"
+                    });
+                }
+            }
+        }
+    }
+    const hasFail = findings.some((f) => f.severity === "fail");
+    return {
+        configPath: resolvedPath,
+        status: hasFail ? "fail" : findings.length === 0 ? "pass" : "warn",
+        findings
+    };
+}
+export function renderConfigValidation(report) {
+    const lines = [
+        "Codex Plugin Doctor Config Validation",
+        "=====================================",
+        `Path: ${report.configPath}`,
+        `Status: ${report.status.toUpperCase()}`,
+        ""
+    ];
+    if (report.findings.length === 0) {
+        lines.push("Config is valid.");
+        return lines.join("\n");
+    }
+    for (const finding of report.findings) {
+        const tag = finding.severity === "fail" ? "FAIL" : "WARN";
+        lines.push(`${tag}  ${finding.field}: ${finding.message}`);
+    }
+    return lines.join("\n");
+}
+export function renderConfigValidationJson(report) {
+    return JSON.stringify({
+        schemaVersion: "1.0.0",
+        configPath: report.configPath,
+        status: report.status,
+        findings: report.findings
+    }, null, 2);
+}

package/dist/core/release-check.d.ts

@@ -0,0 +1,35 @@
+export interface ReleaseCheckReport {
+    targetPath: string;
+    status: "pass" | "fail";
+    checks: {
+        validation: {
+            status: string;
+            findings: number;
+            exitCode: number;
+        };
+        security: {
+            status: string;
+            score: number;
+        };
+        dependencies: {
+            status: string;
+            vulnerabilities: number;
+        };
+        compatibility: {
+            status: string;
+            score: number;
+            overallStatus: string;
+        };
+        trust: {
+            status: string;
+            score: number;
+        };
+    };
+    ready: boolean;
+}
+export declare function buildReleaseCheck(targetPath: string, options?: {
+    env?: Record<string, string | undefined>;
+    platform?: NodeJS.Platform;
+}): Promise<ReleaseCheckReport>;
+export declare function renderReleaseCheck(report: ReleaseCheckReport): string;
+export declare function renderReleaseCheckJson(report: ReleaseCheckReport): string;

package/dist/core/release-check.js

@@ -0,0 +1,103 @@
+import path from "node:path";
+import { validatePlugin } from "./validate-plugin.js";
+import { buildSecurityAudit } from "../security/security-audit.js";
+import { buildDepAudit } from "./dep-audit.js";
+import { buildCompatibilityMatrix } from "../compatibility/compatibility-matrix.js";
+import { buildTrustScore } from "../security/trust-score.js";
+function matrixOverallStatus(matrix) {
+    const statuses = matrix.results.map((r) => r.status);
+    const passCount = statuses.filter((s) => s === "pass").length;
+    const total = statuses.length;
+    if (total === 0) {
+        return "pass";
+    }
+    if (passCount === total) {
+        return "pass";
+    }
+    const failCount = statuses.filter((s) => s === "fail").length;
+    return failCount > 0 ? "fail" : "warn";
+}
+function matrixScore(matrix) {
+    const scoreMap = { pass: 100, warn: 70, fail: 0, skipped: 0 };
+    const scores = matrix.results.map((r) => scoreMap[r.status] ?? 0);
+    if (scores.length === 0) {
+        return 0;
+    }
+    return Math.round(scores.reduce((a, b) => a + b, 0) / scores.length);
+}
+export async function buildReleaseCheck(targetPath, options = {}) {
+    const resolvedPath = path.resolve(targetPath);
+    const env = options.env ?? process.env;
+    const platform = options.platform ?? process.platform;
+    const validationResult = await validatePlugin(resolvedPath, { runtime: true });
+    const securityResult = await buildSecurityAudit(resolvedPath);
+    const depResult = await buildDepAudit(resolvedPath);
+    const compatResult = await buildCompatibilityMatrix(resolvedPath, { env, platform });
+    const trustResult = await buildTrustScore(resolvedPath);
+    const checks = {
+        validation: {
+            status: validationResult.status,
+            findings: validationResult.findings.length,
+            exitCode: validationResult.exitCode
+        },
+        security: {
+            status: securityResult.status,
+            score: securityResult.score
+        },
+        dependencies: {
+            status: depResult.status,
+            vulnerabilities: depResult.totalVulnerabilities
+        },
+        compatibility: {
+            status: matrixOverallStatus(compatResult),
+            score: matrixScore(compatResult),
+            overallStatus: matrixOverallStatus(compatResult)
+        },
+        trust: {
+            status: trustResult.status,
+            score: trustResult.score
+        }
+    };
+    const ready = checks.validation.status === "pass" &&
+        checks.security.status === "pass" &&
+        checks.dependencies.status !== "fail" &&
+        checks.compatibility.status !== "fail" &&
+        checks.trust.status === "pass";
+    return {
+        targetPath: resolvedPath,
+        status: ready ? "pass" : "fail",
+        checks,
+        ready
+    };
+}
+export function renderReleaseCheck(report) {
+    const icon = (pass) => pass ? "PASS" : pass === undefined ? "SKIP" : "FAIL";
+    const lines = [
+        "Codex Plugin Doctor Release Check",
+        "==================================",
+        `Path: ${report.targetPath}`,
+        `Ready: ${report.ready ? "YES" : "NO"}`,
+        "",
+        "Checks",
+        "------",
+        `  ${icon(report.checks.validation.status === "pass")}  validation    ${report.checks.validation.status}  (${report.checks.validation.findings} findings)`,
+        `  ${icon(report.checks.security.status === "pass")}  security      ${report.checks.security.status}  (score: ${report.checks.security.score})`,
+        `  ${icon(report.checks.dependencies.status === "pass")}  dependencies  ${report.checks.dependencies.status}  (${report.checks.dependencies.vulnerabilities} vulns)`,
+        `  ${icon(report.checks.compatibility.status === "pass")}  compatibility ${report.checks.compatibility.status}  (score: ${report.checks.compatibility.score})`,
+        `  ${icon(report.checks.trust.status === "pass")}  trust         ${report.checks.trust.status}  (score: ${report.checks.trust.score})`,
+        "",
+        report.ready
+            ? "All release checks passed. Ready to publish."
+            : "Some checks failed. Fix issues before publishing."
+    ];
+    return lines.join("\n");
+}
+export function renderReleaseCheckJson(report) {
+    return JSON.stringify({
+        schemaVersion: "1.0.0",
+        targetPath: report.targetPath,
+        status: report.status,
+        ready: report.ready,
+        checks: report.checks
+    }, null, 2);
+}

package/dist/core/shell-completion.d.ts

@@ -0,0 +1,2 @@
+export type CompletionShell = "bash" | "zsh" | "fish";
+export declare function generateCompletion(shell: CompletionShell): string;

package/dist/core/shell-completion.js

@@ -0,0 +1,97 @@
+const topLevelCommands = [
+    "check",
+    "audit",
+    "mcp",
+    "security",
+    "compat",
+    "suppress",
+    "fix",
+    "history",
+    "watch",
+    "doctor",
+    "init",
+    "init-ci",
+    "init-git-hooks",
+    "self-test",
+    "list",
+    "explain",
+    "config"
+];
+function bashCompletion() {
+    return [
+        "_codex_plugin_doctor() {",
+        "  local cur prev",
+        "  COMPREPLY=()",
+        "  cur=\"${COMP_WORDS[COMP_CWORD]}\"",
+        "  prev=\"${COMP_WORDS[COMP_CWORD-1]}\"",
+        "",
+        `  local commands="${topLevelCommands.join(" ")}"`,
+        "",
+        "  case \"${prev}\" in",
+        "    codex-plugin-doctor)",
+        "      COMPREPLY=( $(compgen -W \"${commands}\" -- \"${cur}\") )",
+        "      return 0",
+        "      ;;",
+        "  esac",
+        "",
+        "  case \"${cur}\" in",
+        "    --*)",
+        "      local flags=\"--json --output --runtime --policy --help\"",
+        "      COMPREPLY=( $(compgen -W \"${flags}\" -- \"${cur}\") )",
+        "      return 0",
+        "      ;;",
+        "    *)",
+        "      COMPREPLY=( $(compgen -W \"${commands}\" -- \"${cur}\") )",
+        "      return 0",
+        "      ;;",
+        "  esac",
+        "}",
+        "",
+        "complete -F _codex_plugin_doctor codex-plugin-doctor",
+        ""
+    ].join("\n");
+}
+function zshCompletion() {
+    return [
+        "#compdef codex-plugin-doctor",
+        "",
+        "_codex_plugin_doctor() {",
+        "  local context state line",
+        "  typeset -A opt_args",
+        "",
+        `  local commands=(${topLevelCommands.join(" ")})`,
+        "",
+        "  _arguments -C \\",
+        "    '1:command:(${commands})' \\",
+        "    '*--json[Output as JSON]' \\",
+        "    '*--output[Write to file]:file:_files' \\",
+        "    '*--runtime[Enable runtime probes]' \\",
+        "    '*--policy[Apply policy]:policy:(codex-publish mcp-strict security)'",
+        "}",
+        "",
+        "_codex_plugin_doctor \"$@\"",
+        ""
+    ].join("\n");
+}
+function fishCompletion() {
+    return [
+        "complete -c codex-plugin-doctor -f",
+        `complete -c codex-plugin-doctor -n "not __fish_seen_subcommand_from ${topLevelCommands.join(" ")}" -a "${topLevelCommands.join(" ")}"`,
+        "complete -c codex-plugin-doctor -s h -l help -d 'Show help'",
+        "complete -c codex-plugin-doctor -l json -d 'Output as JSON'",
+        "complete -c codex-plugin-doctor -l output -d 'Write to file' -r",
+        "complete -c codex-plugin-doctor -l runtime -d 'Enable runtime probes'",
+        "complete -c codex-plugin-doctor -l policy -d 'Apply policy' -x -a 'codex-publish mcp-strict security'",
+        ""
+    ].join("\n");
+}
+export function generateCompletion(shell) {
+    switch (shell) {
+        case "bash":
+            return bashCompletion();
+        case "zsh":
+            return zshCompletion();
+        case "fish":
+            return fishCompletion();
+    }
+}

package/dist/index.d.ts

@@ -27,4 +27,7 @@ export { buildGenericMcpDoctor, renderGenericMcpDoctor, renderGenericMcpDoctorJs
 export { watchPlugin, type WatchPluginOptions, type WatchPluginResult } from "./core/watch-plugin.js";
 export { buildDepAudit, buildDepAuditRecommendations, renderDepAudit, renderDepAuditJson, renderDepAuditSarif, type DepAuditRecommendation, type DepAuditReport, type DepAuditVulnerability } from "./core/dep-audit.js";
 export { initGitHooks, removeGitHooks, type InitGitHooksResult, type RemoveGitHooksResult } from "./core/init-git-hooks.js";
+export { generateCompletion, type CompletionShell } from "./core/shell-completion.js";
+export { validateConfigFile, renderConfigValidation, renderConfigValidationJson, type ConfigValidationFinding, type ConfigValidationReport } from "./core/config-validate.js";
+export { buildReleaseCheck, renderReleaseCheck, renderReleaseCheckJson, type ReleaseCheckReport } from "./core/release-check.js";
 export declare function runCheck(targetPath: string, options?: CheckOptions): Promise<CheckResult>;

package/dist/index.js

@@ -27,6 +27,9 @@ export { buildGenericMcpDoctor, renderGenericMcpDoctor, renderGenericMcpDoctorJs
 export { watchPlugin } from "./core/watch-plugin.js";
 export { buildDepAudit, buildDepAuditRecommendations, renderDepAudit, renderDepAuditJson, renderDepAuditSarif } from "./core/dep-audit.js";
 export { initGitHooks, removeGitHooks } from "./core/init-git-hooks.js";
+export { generateCompletion } from "./core/shell-completion.js";
+export { validateConfigFile, renderConfigValidation, renderConfigValidationJson } from "./core/config-validate.js";
+export { buildReleaseCheck, renderReleaseCheck, renderReleaseCheckJson } from "./core/release-check.js";
 export async function runCheck(targetPath, options = {}) {
     return validatePlugin(targetPath, options);
 }

package/dist/run-cli.js

@@ -34,6 +34,9 @@ import { initCiWorkflow } from "./core/init-ci.js";
 import { watchPlugin } from "./core/watch-plugin.js";
 import { buildDepAudit, renderDepAudit, renderDepAuditJson, renderDepAuditSarif } from "./core/dep-audit.js";
 import { initGitHooks, removeGitHooks } from "./core/init-git-hooks.js";
+import { generateCompletion } from "./core/shell-completion.js";
+import { renderConfigValidation, renderConfigValidationJson, validateConfigFile } from "./core/config-validate.js";
+import { buildReleaseCheck, renderReleaseCheck, renderReleaseCheckJson } from "./core/release-check.js";
 import { initPluginPackage, initPluginTemplates, isInitPluginTemplate } from "./core/init-plugin.js";
 import { runCheck } from "./index.js";
 import { buildGenericMcpDoctor, renderGenericMcpDoctor, renderGenericMcpDoctorJson } from "./mcp/generic-mcp-doctor.js";
@@ -79,7 +82,7 @@ const defaultIo = {
     }
 };
 function printUsage(io) {
-    io.writeStderr("Usage: codex-plugin-doctor check <path|--installed> [filter] [--policy codex-publish|mcp-strict|security] [--compat] [--json|--markdown|--badge-json|--badge-markdown] [--output <path>] [--history <path>] [--runtime] [--require-runtime-approval --runtime-approval-digest <digest>] [--verbose-runtime] [--explain] [--no-animations] [--ascii] [--changed-since <ref>]\n       codex-plugin-doctor audit --installed [filter] [--policy codex-publish|mcp-strict|security] [--security] [--compat] [--json] [--output <path>] [--cache] [--changed]\n       codex-plugin-doctor audit deps <path> [--policy codex-publish|mcp-strict|security] [--recommend] [--json|--sarif] [--output <path>]\n       codex-plugin-doctor mcp <path> [--json] [--output <path>]\n       codex-plugin-doctor security <path> [--policy security] [--json|--scorecard]\n       codex-plugin-doctor compat <path> [--all|--client <client>] [--json] [--scorecard] [--output <path>] [--install-preview|--apply --backup]\n       codex-plugin-doctor suppress add <path> [--fingerprint <sha256> --reason <text> --expires-at YYYY-MM-DD] [--config <path>] [--json]\n       codex-plugin-doctor suppress list <path> [--config <path>] [--json]\n       codex-plugin-doctor suppress remove <path> [--fingerprint <sha256>|--index <n>] [--config <path>] [--json]\n       codex-plugin-doctor fix <path> (--dry-run|--interactive --backup|--apply --backup)\n       codex-plugin-doctor history <history.jsonl> [--json] [--fail-on-regression]\n       codex-plugin-doctor watch <path> [--runtime] [--json] [--output <path>] [--debounce-ms <ms>] [--max-iterations <n>] [--fail-fast] [--accumulate-json <path>]\n       codex-plugin-doctor doctor [npm <package>|contract|corpus|runtime-plan <path> [--json|--markdown] [--output <path>]|runtime-policy <path> [--json] [--output <path>]|review-bundle <path> --output <dir> --sign-key-env NAME [--json] [--allow-dirty] [--allow-untagged]|review-bundle verify <bundle-dir> --target <path> --sign-key-env NAME [--json] [--output <path>] [--failures-only]|review-bundle diff --before <dir> --after <dir> [--json]|attest <path> [--sign-key-env NAME]|attest verify <attestation.json> --target <path> --sign-key-env NAME|release-evidence <path> --sign-key-env NAME [--allow-dirty] [--allow-untagged] [--require-runtime-approval --runtime-approval-digest <digest>]|release-evidence verify <evidence.json> --target <path> --sign-key-env NAME|release-evidence asset <path> --tag <tag> --output <evidence.json> --sign-key-env NAME [--upload]|mcp <path>|inspector <path>|diff --before <path> --after <path>|recommend <path>|trust <path>|perf <path> [--max-total-ms <ms>] [--max-stage-ms stage=ms]|export --bundle <path>|snapshot|clients|--json|--update-check]\n       codex-plugin-doctor init [path] [--template skill-only|mcp-stdio|mcp-http|full-runtime]\n       codex-plugin-doctor init-ci [path]\n       codex-plugin-doctor init-git-hooks [path] [--force] [--json]\n       codex-plugin-doctor init-git-hooks [path] --remove [--json]\n       codex-plugin-doctor self-test\n       codex-plugin-doctor list --installed\n       codex-plugin-doctor explain <finding-id>\n       codex-plugin-doctor --version\n\nFirst run:\n       codex-plugin-doctor doctor\n       codex-plugin-doctor self-test\n       codex-plugin-doctor init my-plugin\n       codex-plugin-doctor check . --runtime --explain");
+    io.writeStderr("Usage: codex-plugin-doctor check <path|--installed> [filter] [--policy codex-publish|mcp-strict|security] [--compat] [--json|--markdown|--badge-json|--badge-markdown] [--output <path>] [--history <path>] [--runtime] [--require-runtime-approval --runtime-approval-digest <digest>] [--verbose-runtime] [--explain] [--no-animations] [--ascii] [--changed-since <ref>]\n       codex-plugin-doctor audit --installed [filter] [--policy codex-publish|mcp-strict|security] [--security] [--compat] [--json] [--output <path>] [--cache] [--changed]\n       codex-plugin-doctor audit deps <path> [--policy codex-publish|mcp-strict|security] [--recommend] [--json|--sarif] [--output <path>]\n       codex-plugin-doctor mcp <path> [--json] [--output <path>]\n       codex-plugin-doctor security <path> [--policy security] [--json|--scorecard]\n       codex-plugin-doctor compat <path> [--all|--client <client>] [--json] [--scorecard] [--output <path>] [--install-preview|--apply --backup]\n       codex-plugin-doctor suppress add <path> [--fingerprint <sha256> --reason <text> --expires-at YYYY-MM-DD] [--config <path>] [--json]\n       codex-plugin-doctor suppress list <path> [--config <path>] [--json]\n       codex-plugin-doctor suppress remove <path> [--fingerprint <sha256>|--index <n>] [--config <path>] [--json]\n       codex-plugin-doctor fix <path> (--dry-run|--interactive --backup|--apply --backup)\n       codex-plugin-doctor history <history.jsonl> [--json] [--fail-on-regression]\n       codex-plugin-doctor watch <path> [--runtime] [--json] [--output <path>] [--debounce-ms <ms>] [--max-iterations <n>] [--fail-fast] [--accumulate-json <path>]\n       codex-plugin-doctor doctor [npm <package>|contract|corpus|runtime-plan <path> [--json|--markdown] [--output <path>]|runtime-policy <path> [--json] [--output <path>]|review-bundle <path> --output <dir> --sign-key-env NAME [--json] [--allow-dirty] [--allow-untagged]|review-bundle verify <bundle-dir> --target <path> --sign-key-env NAME [--json] [--output <path>] [--failures-only]|review-bundle diff --before <dir> --after <dir> [--json]|attest <path> [--sign-key-env NAME]|attest verify <attestation.json> --target <path> --sign-key-env NAME|release-evidence <path> --sign-key-env NAME [--allow-dirty] [--allow-untagged] [--require-runtime-approval --runtime-approval-digest <digest>]|release-evidence verify <evidence.json> --target <path> --sign-key-env NAME|release-evidence asset <path> --tag <tag> --output <evidence.json> --sign-key-env NAME [--upload]|mcp <path>|inspector <path>|diff --before <path> --after <path>|recommend <path>|trust <path>|perf <path> [--max-total-ms <ms>] [--max-stage-ms stage=ms]|export --bundle <path>|snapshot|clients|--json|--update-check]\n       codex-plugin-doctor init [path] [--template skill-only|mcp-stdio|mcp-http|full-runtime]\n       codex-plugin-doctor init-ci [path]\n       codex-plugin-doctor init-git-hooks [path] [--force] [--json]\n       codex-plugin-doctor init-git-hooks [path] --remove [--json]\n       codex-plugin-doctor completion bash|zsh|fish\n       codex-plugin-doctor config validate <path> [--json]\n       codex-plugin-doctor release check <path> [--json]\n       codex-plugin-doctor self-test\n       codex-plugin-doctor list --installed\n       codex-plugin-doctor explain <finding-id>\n       codex-plugin-doctor --version\n\nFirst run:\n       codex-plugin-doctor doctor\n       codex-plugin-doctor self-test\n       codex-plugin-doctor init my-plugin\n       codex-plugin-doctor check . --runtime --explain");
     io.writeStderr("Suppression governance: codex-plugin-doctor suppress list <path> [--fail-on-expired] [--fail-on-invalid] [--warn-expiring-within-days <days>]\n       codex-plugin-doctor suppress prune <path> [--apply] [--json]");
     io.writeStderr("Baseline gating: codex-plugin-doctor baseline create <path> --output <path> [--runtime]\n       codex-plugin-doctor check <path> --baseline <path>");
 }
@@ -2220,6 +2223,54 @@ export async function runCli(args, io = defaultIo, options = {}) {
         io.writeStdout(report);
         return matrixExitCode(matrix);
     }
+    if (command === "completion") {
+        const shell = maybePath;
+        if (!shell || !["bash", "zsh", "fish"].includes(shell)) {
+            io.writeStderr("Usage: codex-plugin-doctor completion bash|zsh|fish");
+            return 2;
+        }
+        io.writeStdout(generateCompletion(shell));
+        return 0;
+    }
+    if (command === "config") {
+        const subCommand = maybePath;
+        if (subCommand !== "validate") {
+            io.writeStderr("Usage: codex-plugin-doctor config validate <path> [--json]");
+            return 2;
+        }
+        const configPath = remainingArgs[0] && !remainingArgs[0].startsWith("--") ? remainingArgs[0] : ".codex-doctor.json";
+        const configFlags = remainingArgs[0] && remainingArgs[0].startsWith("--")
+            ? remainingArgs
+            : remainingArgs.slice(1);
+        const jsonOutput = configFlags.includes("--json");
+        const report = await validateConfigFile(configPath);
+        const output = jsonOutput
+            ? renderConfigValidationJson(report)
+            : renderConfigValidation(report);
+        io.writeStdout(output);
+        return report.status === "fail" ? 1 : 0;
+    }
+    if (command === "release") {
+        const subCommand = maybePath;
+        if (subCommand !== "check") {
+            io.writeStderr("Usage: codex-plugin-doctor release check <path> [--json]");
+            return 2;
+        }
+        const targetPath = remainingArgs[0] && !remainingArgs[0].startsWith("--") ? remainingArgs[0] : ".";
+        const releaseFlags = remainingArgs[0] && remainingArgs[0].startsWith("--")
+            ? remainingArgs
+            : remainingArgs.slice(1);
+        const jsonOutput = releaseFlags.includes("--json");
+        const report = await buildReleaseCheck(targetPath, {
+            env: terminalContext.env,
+            platform: terminalContext.platform
+        });
+        const output = jsonOutput
+            ? renderReleaseCheckJson(report)
+            : renderReleaseCheck(report);
+        io.writeStdout(output);
+        return report.status === "fail" ? 1 : 0;
+    }
     if (command === "suppress") {
         const parsedSuppressCommand = parseSuppressCommand([maybePath ?? "", ...remainingArgs]);
         if ("message" in parsedSuppressCommand) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "codex-plugin-doctor",
-  "version": "1.44.0",
+  "version": "1.46.0",
   "description": "CLI-first validator for Codex plugins, skills, and MCP package surfaces with runtime MCP protocol validation.",
   "type": "module",
   "main": "./dist/index.js",