codex-plugin-doctor 1.45.0 → 1.46.1

package/README.md

@@ -285,12 +285,16 @@ codex-plugin-doctor check . --badge-markdown
 codex-plugin-doctor check . --sarif --output results.sarif
 codex-plugin-doctor check . --ascii
 codex-plugin-doctor check . --no-animations
-codex-plugin-doctor check . --runtime
-codex-plugin-doctor check . --runtime --require-runtime-approval --runtime-approval-digest sha256:<approved-plan-digest>
+codex-plugin-doctor check . --runtime
+codex-plugin-doctor check . --runtime --require-runtime-approval --runtime-approval-digest sha256:<approved-plan-digest>
+codex-plugin-doctor release check .
+codex-plugin-doctor release check . --json
+codex-plugin-doctor release check . --runtime
+codex-plugin-doctor release check . --runtime --require-runtime-approval --runtime-approval-digest sha256:<approved-plan-digest>
 codex-plugin-doctor check . --config .codex-doctor.json
-codex-plugin-doctor baseline create . --output .codex-doctor-baseline.json
-codex-plugin-doctor check . --baseline .codex-doctor-baseline.json
-codex-plugin-doctor check . --history validation-history.jsonl
+codex-plugin-doctor baseline create . --output .codex-doctor-baseline.json
+codex-plugin-doctor check . --baseline .codex-doctor-baseline.json
+codex-plugin-doctor check . --history validation-history.jsonl
 codex-plugin-doctor history validation-history.jsonl
 codex-plugin-doctor history validation-history.jsonl --json
 codex-plugin-doctor history validation-history.jsonl --fail-on-regression
@@ -336,11 +340,11 @@ codex-plugin-doctor check . --json --runtime --verbose-runtime
 
 `check --badge-json` emits Shields endpoint-compatible JSON such as `{"schemaVersion":1,"label":"doctor","message":"PASS","color":"brightgreen"}`. `check --badge-markdown` emits a static shields.io Markdown badge for README or release notes. Badge output is intentionally limited to single package checks, not `check --installed`.
 
-`check --history <path>` appends a compact JSONL validation snapshot after a single package check. `history <path>` reads the JSONL file and compares the latest run to the previous run, including status, finding-count deltas, and whether the latest run regressed. Add `history --json` for automation output or `history --fail-on-regression` when CI should fail after a worse latest run.
-
-`baseline create <path> --output <path>` records the current fingerprinted findings for gradual CI adoption. A later `check <path> --baseline <path>` keeps matched findings visible in baseline metadata but gates only new active findings; reports summarize new, matched, and resolved counts. Commit the baseline for review and regenerate it deliberately after accepted findings change.
-
-`fix --dry-run` renders safe automatic fix plans without changing files. `fix --interactive --backup` shows the same numbered plan, then applies everything after `yes` or only selected action numbers such as `1,3`. `fix --apply --backup` applies supported safe fixes, such as manifest defaults and missing skills directories, after creating backups.
+`check --history <path>` appends a compact JSONL validation snapshot after a single package check. `history <path>` reads the JSONL file and compares the latest run to the previous run, including status, finding-count deltas, and whether the latest run regressed. Add `history --json` for automation output or `history --fail-on-regression` when CI should fail after a worse latest run.
+
+`baseline create <path> --output <path>` records the current fingerprinted findings for gradual CI adoption. A later `check <path> --baseline <path>` keeps matched findings visible in baseline metadata but gates only new active findings; reports summarize new, matched, and resolved counts. Commit the baseline for review and regenerate it deliberately after accepted findings change.
+
+`fix --dry-run` renders safe automatic fix plans without changing files. `fix --interactive --backup` shows the same numbered plan, then applies everything after `yes` or only selected action numbers such as `1,3`. `fix --apply --backup` applies supported safe fixes, such as manifest defaults and missing skills directories, after creating backups.
 
 Optional local policy file:
 
@@ -406,9 +410,9 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v5
-      - uses: Esquetta/CodexPluginDoctor@v1.45.0
+      - uses: Esquetta/CodexPluginDoctor@v1.46.1
         with:
-          version: "1.45.0"
+          version: "1.46.1"
           path: .
           runtime: "true"
           policy: codex-publish
@@ -463,7 +467,9 @@ npm run prepare-release
 npm run release-check
 ```
 
-`prepare-release` runs tests, builds the TypeScript output, and performs `npm pack --dry-run`. `release-check` adds release preflight checks for a clean git tree, existing npm versions, existing version tags, tests, build, pack dry-run, fresh temp install audit, and publish dry-run.
+`prepare-release` runs tests, builds the TypeScript output, and performs `npm pack --dry-run`. `release-check` adds release preflight checks for a clean git tree, existing npm versions, existing version tags, package/lockfile/changelog version consistency, tests, build, pack dry-run, fresh temp install audit, and publish dry-run.
+
+For plugin packages, `codex-plugin-doctor release check .` performs static readiness checks by default. Runtime probing executes package-local MCP servers and therefore requires an explicit `--runtime`; protected workflows can also require the approved runtime-plan digest.
 
 Related docs:
 

package/dist/core/release-check.d.ts

@@ -0,0 +1,50 @@
+import type { CheckOptions, CheckResult } from "../domain/types.js";
+export interface ReleaseCheckReport {
+    targetPath: string;
+    status: "pass" | "fail";
+    runtimeProbeEnabled?: boolean;
+    checks: {
+        validation: {
+            status: string;
+            findings: number;
+            exitCode: number;
+        };
+        security: {
+            status: string;
+            score: number;
+        };
+        dependencies: {
+            status: string;
+            vulnerabilities: number;
+        };
+        compatibility: {
+            status: string;
+            score: number;
+            overallStatus: string;
+        };
+        trust: {
+            status: string;
+            score: number;
+        };
+        metadata?: ReleaseMetadataCheck;
+    };
+    ready: boolean;
+}
+export interface ReleaseMetadataCheck {
+    status: "pass" | "fail" | "skipped";
+    packageVersion: string | null;
+    lockfileVersion: string | null;
+    changelogVersion: boolean | null;
+    findings: string[];
+}
+export interface BuildReleaseCheckOptions {
+    env?: Record<string, string | undefined>;
+    platform?: NodeJS.Platform;
+    runtime?: boolean;
+    runCheck?: (targetPath: string, options: CheckOptions) => Promise<CheckResult>;
+}
+export declare function buildReleaseMetadataCheck(targetPath: string): Promise<ReleaseMetadataCheck>;
+export declare function assertReleaseMetadataSync(targetPath: string): Promise<void>;
+export declare function buildReleaseCheck(targetPath: string, options?: BuildReleaseCheckOptions): Promise<ReleaseCheckReport>;
+export declare function renderReleaseCheck(report: ReleaseCheckReport): string;
+export declare function renderReleaseCheckJson(report: ReleaseCheckReport): string;

package/dist/core/release-check.js

@@ -0,0 +1,189 @@
+import { readFile } from "node:fs/promises";
+import path from "node:path";
+import { validatePlugin } from "./validate-plugin.js";
+import { buildSecurityAudit } from "../security/security-audit.js";
+import { buildDepAudit } from "./dep-audit.js";
+import { buildCompatibilityMatrix } from "../compatibility/compatibility-matrix.js";
+import { buildTrustScore } from "../security/trust-score.js";
+async function readOptionalFile(filePath) {
+    try {
+        return await readFile(filePath, "utf8");
+    }
+    catch (error) {
+        if (error.code === "ENOENT") {
+            return null;
+        }
+        throw error;
+    }
+}
+export async function buildReleaseMetadataCheck(targetPath) {
+    const packageContent = await readOptionalFile(path.join(targetPath, "package.json"));
+    if (packageContent === null) {
+        return {
+            status: "skipped",
+            packageVersion: null,
+            lockfileVersion: null,
+            changelogVersion: null,
+            findings: []
+        };
+    }
+    const findings = [];
+    let packageVersion = null;
+    let lockfileVersion = null;
+    try {
+        const packageJson = JSON.parse(packageContent);
+        packageVersion = typeof packageJson.version === "string" ? packageJson.version : null;
+    }
+    catch {
+        findings.push("package.json is not valid JSON.");
+    }
+    if (!packageVersion) {
+        findings.push("package.json must contain a version.");
+    }
+    const lockContent = await readOptionalFile(path.join(targetPath, "package-lock.json"));
+    if (lockContent !== null) {
+        try {
+            const lock = JSON.parse(lockContent);
+            const rootVersion = lock.packages?.[""]?.version ?? lock.version;
+            lockfileVersion = typeof rootVersion === "string" ? rootVersion : null;
+        }
+        catch {
+            findings.push("package-lock.json is not valid JSON.");
+        }
+        if (!lockfileVersion) {
+            findings.push("package-lock.json must contain the root package version.");
+        }
+        else if (packageVersion && lockfileVersion !== packageVersion) {
+            findings.push(`package-lock.json version ${lockfileVersion} does not match package.json ${packageVersion}.`);
+        }
+    }
+    const changelog = await readOptionalFile(path.join(targetPath, "CHANGELOG.md"));
+    const changelogVersion = changelog === null || !packageVersion
+        ? null
+        : new RegExp(`^## \\[${packageVersion.replace(/[.*+?^${}()|[\]\\]/g, "\\$&")}\\](?:\\s|$)`, "m").test(changelog);
+    if (changelogVersion === false) {
+        findings.push(`CHANGELOG.md does not contain a ${packageVersion} release section.`);
+    }
+    return {
+        status: findings.length === 0 ? "pass" : "fail",
+        packageVersion,
+        lockfileVersion,
+        changelogVersion,
+        findings
+    };
+}
+export async function assertReleaseMetadataSync(targetPath) {
+    const metadata = await buildReleaseMetadataCheck(path.resolve(targetPath));
+    if (metadata.status === "fail") {
+        throw new Error(`Release metadata is inconsistent: ${metadata.findings.join(" ")}`);
+    }
+}
+function matrixOverallStatus(matrix) {
+    const statuses = matrix.results.map((r) => r.status);
+    const passCount = statuses.filter((s) => s === "pass").length;
+    const total = statuses.length;
+    if (total === 0) {
+        return "pass";
+    }
+    if (passCount === total) {
+        return "pass";
+    }
+    const failCount = statuses.filter((s) => s === "fail").length;
+    return failCount > 0 ? "fail" : "warn";
+}
+function matrixScore(matrix) {
+    const scoreMap = { pass: 100, warn: 70, fail: 0, skipped: 0 };
+    const scores = matrix.results.map((r) => scoreMap[r.status] ?? 0);
+    if (scores.length === 0) {
+        return 0;
+    }
+    return Math.round(scores.reduce((a, b) => a + b, 0) / scores.length);
+}
+export async function buildReleaseCheck(targetPath, options = {}) {
+    const resolvedPath = path.resolve(targetPath);
+    const env = options.env ?? process.env;
+    const platform = options.platform ?? process.platform;
+    const runtimeProbeEnabled = options.runtime ?? false;
+    const validationResult = await (options.runCheck ?? validatePlugin)(resolvedPath, {
+        runtime: runtimeProbeEnabled
+    });
+    const securityResult = await buildSecurityAudit(resolvedPath);
+    const depResult = await buildDepAudit(resolvedPath);
+    const compatResult = await buildCompatibilityMatrix(resolvedPath, { env, platform });
+    const trustResult = await buildTrustScore(resolvedPath);
+    const metadataResult = await buildReleaseMetadataCheck(resolvedPath);
+    const checks = {
+        validation: {
+            status: validationResult.status,
+            findings: validationResult.findings.length,
+            exitCode: validationResult.exitCode
+        },
+        security: {
+            status: securityResult.status,
+            score: securityResult.score
+        },
+        dependencies: {
+            status: depResult.status,
+            vulnerabilities: depResult.totalVulnerabilities
+        },
+        compatibility: {
+            status: matrixOverallStatus(compatResult),
+            score: matrixScore(compatResult),
+            overallStatus: matrixOverallStatus(compatResult)
+        },
+        trust: {
+            status: trustResult.status,
+            score: trustResult.score
+        },
+        metadata: metadataResult
+    };
+    const ready = checks.validation.status === "pass" &&
+        checks.security.status === "pass" &&
+        checks.dependencies.status !== "fail" &&
+        checks.compatibility.status !== "fail" &&
+        checks.trust.status === "pass" &&
+        checks.metadata.status !== "fail";
+    return {
+        targetPath: resolvedPath,
+        status: ready ? "pass" : "fail",
+        runtimeProbeEnabled,
+        checks,
+        ready
+    };
+}
+export function renderReleaseCheck(report) {
+    const icon = (pass) => pass ? "PASS" : pass === undefined ? "SKIP" : "FAIL";
+    const lines = [
+        "Codex Plugin Doctor Release Check",
+        "==================================",
+        `Path: ${report.targetPath}`,
+        `Ready: ${report.ready ? "YES" : "NO"}`,
+        `Runtime probe: ${report.runtimeProbeEnabled ? "enabled" : "disabled"}`,
+        "",
+        "Checks",
+        "------",
+        `  ${icon(report.checks.validation.status === "pass")}  validation    ${report.checks.validation.status}  (${report.checks.validation.findings} findings)`,
+        `  ${icon(report.checks.security.status === "pass")}  security      ${report.checks.security.status}  (score: ${report.checks.security.score})`,
+        `  ${icon(report.checks.dependencies.status === "pass")}  dependencies  ${report.checks.dependencies.status}  (${report.checks.dependencies.vulnerabilities} vulns)`,
+        `  ${icon(report.checks.compatibility.status === "pass")}  compatibility ${report.checks.compatibility.status}  (score: ${report.checks.compatibility.score})`,
+        `  ${icon(report.checks.trust.status === "pass")}  trust         ${report.checks.trust.status}  (score: ${report.checks.trust.score})`,
+        ...(report.checks.metadata
+            ? [`  ${icon(report.checks.metadata.status !== "fail")}  metadata      ${report.checks.metadata.status}  (${report.checks.metadata.findings.length} findings)`]
+            : []),
+        "",
+        report.ready
+            ? "All release checks passed. Ready to publish."
+            : "Some checks failed. Fix issues before publishing."
+    ];
+    return lines.join("\n");
+}
+export function renderReleaseCheckJson(report) {
+    return JSON.stringify({
+        schemaVersion: "1.0.0",
+        targetPath: report.targetPath,
+        status: report.status,
+        runtimeProbeEnabled: report.runtimeProbeEnabled ?? false,
+        ready: report.ready,
+        checks: report.checks
+    }, null, 2);
+}

package/dist/index.d.ts

@@ -29,4 +29,5 @@ export { buildDepAudit, buildDepAuditRecommendations, renderDepAudit, renderDepA
 export { initGitHooks, removeGitHooks, type InitGitHooksResult, type RemoveGitHooksResult } from "./core/init-git-hooks.js";
 export { generateCompletion, type CompletionShell } from "./core/shell-completion.js";
 export { validateConfigFile, renderConfigValidation, renderConfigValidationJson, type ConfigValidationFinding, type ConfigValidationReport } from "./core/config-validate.js";
+export { assertReleaseMetadataSync, buildReleaseCheck, buildReleaseMetadataCheck, renderReleaseCheck, renderReleaseCheckJson, type BuildReleaseCheckOptions, type ReleaseMetadataCheck, type ReleaseCheckReport } from "./core/release-check.js";
 export declare function runCheck(targetPath: string, options?: CheckOptions): Promise<CheckResult>;

package/dist/index.js

@@ -29,6 +29,7 @@ export { buildDepAudit, buildDepAuditRecommendations, renderDepAudit, renderDepA
 export { initGitHooks, removeGitHooks } from "./core/init-git-hooks.js";
 export { generateCompletion } from "./core/shell-completion.js";
 export { validateConfigFile, renderConfigValidation, renderConfigValidationJson } from "./core/config-validate.js";
+export { assertReleaseMetadataSync, buildReleaseCheck, buildReleaseMetadataCheck, renderReleaseCheck, renderReleaseCheckJson } from "./core/release-check.js";
 export async function runCheck(targetPath, options = {}) {
     return validatePlugin(targetPath, options);
 }

package/dist/run-cli.js

@@ -36,6 +36,7 @@ import { buildDepAudit, renderDepAudit, renderDepAuditJson, renderDepAuditSarif
 import { initGitHooks, removeGitHooks } from "./core/init-git-hooks.js";
 import { generateCompletion } from "./core/shell-completion.js";
 import { renderConfigValidation, renderConfigValidationJson, validateConfigFile } from "./core/config-validate.js";
+import { buildReleaseCheck, renderReleaseCheck, renderReleaseCheckJson } from "./core/release-check.js";
 import { initPluginPackage, initPluginTemplates, isInitPluginTemplate } from "./core/init-plugin.js";
 import { runCheck } from "./index.js";
 import { buildGenericMcpDoctor, renderGenericMcpDoctor, renderGenericMcpDoctorJson } from "./mcp/generic-mcp-doctor.js";
@@ -81,7 +82,7 @@ const defaultIo = {
     }
 };
 function printUsage(io) {
-    io.writeStderr("Usage: codex-plugin-doctor check <path|--installed> [filter] [--policy codex-publish|mcp-strict|security] [--compat] [--json|--markdown|--badge-json|--badge-markdown] [--output <path>] [--history <path>] [--runtime] [--require-runtime-approval --runtime-approval-digest <digest>] [--verbose-runtime] [--explain] [--no-animations] [--ascii] [--changed-since <ref>]\n       codex-plugin-doctor audit --installed [filter] [--policy codex-publish|mcp-strict|security] [--security] [--compat] [--json] [--output <path>] [--cache] [--changed]\n       codex-plugin-doctor audit deps <path> [--policy codex-publish|mcp-strict|security] [--recommend] [--json|--sarif] [--output <path>]\n       codex-plugin-doctor mcp <path> [--json] [--output <path>]\n       codex-plugin-doctor security <path> [--policy security] [--json|--scorecard]\n       codex-plugin-doctor compat <path> [--all|--client <client>] [--json] [--scorecard] [--output <path>] [--install-preview|--apply --backup]\n       codex-plugin-doctor suppress add <path> [--fingerprint <sha256> --reason <text> --expires-at YYYY-MM-DD] [--config <path>] [--json]\n       codex-plugin-doctor suppress list <path> [--config <path>] [--json]\n       codex-plugin-doctor suppress remove <path> [--fingerprint <sha256>|--index <n>] [--config <path>] [--json]\n       codex-plugin-doctor fix <path> (--dry-run|--interactive --backup|--apply --backup)\n       codex-plugin-doctor history <history.jsonl> [--json] [--fail-on-regression]\n       codex-plugin-doctor watch <path> [--runtime] [--json] [--output <path>] [--debounce-ms <ms>] [--max-iterations <n>] [--fail-fast] [--accumulate-json <path>]\n       codex-plugin-doctor doctor [npm <package>|contract|corpus|runtime-plan <path> [--json|--markdown] [--output <path>]|runtime-policy <path> [--json] [--output <path>]|review-bundle <path> --output <dir> --sign-key-env NAME [--json] [--allow-dirty] [--allow-untagged]|review-bundle verify <bundle-dir> --target <path> --sign-key-env NAME [--json] [--output <path>] [--failures-only]|review-bundle diff --before <dir> --after <dir> [--json]|attest <path> [--sign-key-env NAME]|attest verify <attestation.json> --target <path> --sign-key-env NAME|release-evidence <path> --sign-key-env NAME [--allow-dirty] [--allow-untagged] [--require-runtime-approval --runtime-approval-digest <digest>]|release-evidence verify <evidence.json> --target <path> --sign-key-env NAME|release-evidence asset <path> --tag <tag> --output <evidence.json> --sign-key-env NAME [--upload]|mcp <path>|inspector <path>|diff --before <path> --after <path>|recommend <path>|trust <path>|perf <path> [--max-total-ms <ms>] [--max-stage-ms stage=ms]|export --bundle <path>|snapshot|clients|--json|--update-check]\n       codex-plugin-doctor init [path] [--template skill-only|mcp-stdio|mcp-http|full-runtime]\n       codex-plugin-doctor init-ci [path]\n       codex-plugin-doctor init-git-hooks [path] [--force] [--json]\n       codex-plugin-doctor init-git-hooks [path] --remove [--json]\n       codex-plugin-doctor completion bash|zsh|fish\n       codex-plugin-doctor config validate <path> [--json]\n       codex-plugin-doctor self-test\n       codex-plugin-doctor list --installed\n       codex-plugin-doctor explain <finding-id>\n       codex-plugin-doctor --version\n\nFirst run:\n       codex-plugin-doctor doctor\n       codex-plugin-doctor self-test\n       codex-plugin-doctor init my-plugin\n       codex-plugin-doctor check . --runtime --explain");
+    io.writeStderr("Usage: codex-plugin-doctor check <path|--installed> [filter] [--policy codex-publish|mcp-strict|security] [--compat] [--json|--markdown|--badge-json|--badge-markdown] [--output <path>] [--history <path>] [--runtime] [--require-runtime-approval --runtime-approval-digest <digest>] [--verbose-runtime] [--explain] [--no-animations] [--ascii] [--changed-since <ref>]\n       codex-plugin-doctor audit --installed [filter] [--policy codex-publish|mcp-strict|security] [--security] [--compat] [--json] [--output <path>] [--cache] [--changed]\n       codex-plugin-doctor audit deps <path> [--policy codex-publish|mcp-strict|security] [--recommend] [--json|--sarif] [--output <path>]\n       codex-plugin-doctor mcp <path> [--json] [--output <path>]\n       codex-plugin-doctor security <path> [--policy security] [--json|--scorecard]\n       codex-plugin-doctor compat <path> [--all|--client <client>] [--json] [--scorecard] [--output <path>] [--install-preview|--apply --backup]\n       codex-plugin-doctor suppress add <path> [--fingerprint <sha256> --reason <text> --expires-at YYYY-MM-DD] [--config <path>] [--json]\n       codex-plugin-doctor suppress list <path> [--config <path>] [--json]\n       codex-plugin-doctor suppress remove <path> [--fingerprint <sha256>|--index <n>] [--config <path>] [--json]\n       codex-plugin-doctor fix <path> (--dry-run|--interactive --backup|--apply --backup)\n       codex-plugin-doctor history <history.jsonl> [--json] [--fail-on-regression]\n       codex-plugin-doctor watch <path> [--runtime] [--json] [--output <path>] [--debounce-ms <ms>] [--max-iterations <n>] [--fail-fast] [--accumulate-json <path>]\n       codex-plugin-doctor doctor [npm <package>|contract|corpus|runtime-plan <path> [--json|--markdown] [--output <path>]|runtime-policy <path> [--json] [--output <path>]|review-bundle <path> --output <dir> --sign-key-env NAME [--json] [--allow-dirty] [--allow-untagged]|review-bundle verify <bundle-dir> --target <path> --sign-key-env NAME [--json] [--output <path>] [--failures-only]|review-bundle diff --before <dir> --after <dir> [--json]|attest <path> [--sign-key-env NAME]|attest verify <attestation.json> --target <path> --sign-key-env NAME|release-evidence <path> --sign-key-env NAME [--allow-dirty] [--allow-untagged] [--require-runtime-approval --runtime-approval-digest <digest>]|release-evidence verify <evidence.json> --target <path> --sign-key-env NAME|release-evidence asset <path> --tag <tag> --output <evidence.json> --sign-key-env NAME [--upload]|mcp <path>|inspector <path>|diff --before <path> --after <path>|recommend <path>|trust <path>|perf <path> [--max-total-ms <ms>] [--max-stage-ms stage=ms]|export --bundle <path>|snapshot|clients|--json|--update-check]\n       codex-plugin-doctor init [path] [--template skill-only|mcp-stdio|mcp-http|full-runtime]\n       codex-plugin-doctor init-ci [path]\n       codex-plugin-doctor init-git-hooks [path] [--force] [--json]\n       codex-plugin-doctor init-git-hooks [path] --remove [--json]\n       codex-plugin-doctor completion bash|zsh|fish\n       codex-plugin-doctor config validate <path> [--json]\n       codex-plugin-doctor release check <path> [--json]\n       codex-plugin-doctor self-test\n       codex-plugin-doctor list --installed\n       codex-plugin-doctor explain <finding-id>\n       codex-plugin-doctor --version\n\nFirst run:\n       codex-plugin-doctor doctor\n       codex-plugin-doctor self-test\n       codex-plugin-doctor init my-plugin\n       codex-plugin-doctor check . --runtime --explain");
     io.writeStderr("Suppression governance: codex-plugin-doctor suppress list <path> [--fail-on-expired] [--fail-on-invalid] [--warn-expiring-within-days <days>]\n       codex-plugin-doctor suppress prune <path> [--apply] [--json]");
     io.writeStderr("Baseline gating: codex-plugin-doctor baseline create <path> --output <path> [--runtime]\n       codex-plugin-doctor check <path> --baseline <path>");
 }
@@ -2249,6 +2250,55 @@ export async function runCli(args, io = defaultIo, options = {}) {
         io.writeStdout(output);
         return report.status === "fail" ? 1 : 0;
     }
+    if (command === "release") {
+        const subCommand = maybePath;
+        if (subCommand !== "check") {
+            io.writeStderr("Usage: codex-plugin-doctor release check <path> [--json] [--runtime] [--require-runtime-approval --runtime-approval-digest <digest>]");
+            return 2;
+        }
+        const targetPath = remainingArgs[0] && !remainingArgs[0].startsWith("--") ? remainingArgs[0] : ".";
+        const releaseFlags = remainingArgs[0] && remainingArgs[0].startsWith("--")
+            ? remainingArgs
+            : remainingArgs.slice(1);
+        const jsonOutput = releaseFlags.includes("--json");
+        const runtimeProbeEnabled = releaseFlags.includes("--runtime");
+        const requireRuntimeApproval = releaseFlags.includes("--require-runtime-approval");
+        const runtimeApprovalDigestIndex = releaseFlags.indexOf("--runtime-approval-digest");
+        const runtimeApprovalDigest = runtimeApprovalDigestIndex === -1
+            ? null
+            : releaseFlags[runtimeApprovalDigestIndex + 1];
+        if (requireRuntimeApproval && !runtimeProbeEnabled) {
+            io.writeStderr("Runtime approval requires --runtime.");
+            return 2;
+        }
+        if (runtimeApprovalDigestIndex !== -1 &&
+            (!runtimeApprovalDigest || runtimeApprovalDigest.startsWith("--"))) {
+            io.writeStderr("Missing digest after --runtime-approval-digest.");
+            return 2;
+        }
+        if (requireRuntimeApproval) {
+            const runtimePlan = await buildDoctorRuntimePlan(targetPath);
+            const approval = evaluateRuntimeApproval(runtimePlan, {
+                required: true,
+                approvedDigest: runtimeApprovalDigest
+            });
+            if (!runtimeApprovalPassed(approval)) {
+                io.writeStderr(`${approval.message}\nCurrent runtime plan digest: ${runtimePlan.digest}`);
+                return 1;
+            }
+        }
+        const report = await buildReleaseCheck(targetPath, {
+            env: terminalContext.env,
+            platform: terminalContext.platform,
+            runtime: runtimeProbeEnabled,
+            runCheck: options.runCheckImpl
+        });
+        const output = jsonOutput
+            ? renderReleaseCheckJson(report)
+            : renderReleaseCheck(report);
+        io.writeStdout(output);
+        return report.status === "fail" ? 1 : 0;
+    }
     if (command === "suppress") {
         const parsedSuppressCommand = parseSuppressCommand([maybePath ?? "", ...remainingArgs]);
         if ("message" in parsedSuppressCommand) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "codex-plugin-doctor",
-  "version": "1.45.0",
+  "version": "1.46.1",
   "description": "CLI-first validator for Codex plugins, skills, and MCP package surfaces with runtime MCP protocol validation.",
   "type": "module",
   "main": "./dist/index.js",