codex-plugin-doctor 1.46.0 → 1.46.1

package/README.md

@@ -285,9 +285,13 @@ codex-plugin-doctor check . --badge-markdown
 codex-plugin-doctor check . --sarif --output results.sarif
 codex-plugin-doctor check . --ascii
 codex-plugin-doctor check . --no-animations
-codex-plugin-doctor check . --runtime
-codex-plugin-doctor check . --runtime --require-runtime-approval --runtime-approval-digest sha256:<approved-plan-digest>
-codex-plugin-doctor check . --config .codex-doctor.json
+codex-plugin-doctor check . --runtime
+codex-plugin-doctor check . --runtime --require-runtime-approval --runtime-approval-digest sha256:<approved-plan-digest>
+codex-plugin-doctor release check .
+codex-plugin-doctor release check . --json
+codex-plugin-doctor release check . --runtime
+codex-plugin-doctor release check . --runtime --require-runtime-approval --runtime-approval-digest sha256:<approved-plan-digest>
+codex-plugin-doctor check . --config .codex-doctor.json
 codex-plugin-doctor baseline create . --output .codex-doctor-baseline.json
 codex-plugin-doctor check . --baseline .codex-doctor-baseline.json
 codex-plugin-doctor check . --history validation-history.jsonl
@@ -406,9 +410,9 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v5
-      - uses: Esquetta/CodexPluginDoctor@v1.46.0
+      - uses: Esquetta/CodexPluginDoctor@v1.46.1
         with:
-          version: "1.46.0"
+          version: "1.46.1"
           path: .
           runtime: "true"
           policy: codex-publish
@@ -463,7 +467,9 @@ npm run prepare-release
 npm run release-check
 ```
 
-`prepare-release` runs tests, builds the TypeScript output, and performs `npm pack --dry-run`. `release-check` adds release preflight checks for a clean git tree, existing npm versions, existing version tags, tests, build, pack dry-run, fresh temp install audit, and publish dry-run.
+`prepare-release` runs tests, builds the TypeScript output, and performs `npm pack --dry-run`. `release-check` adds release preflight checks for a clean git tree, existing npm versions, existing version tags, package/lockfile/changelog version consistency, tests, build, pack dry-run, fresh temp install audit, and publish dry-run.
+
+For plugin packages, `codex-plugin-doctor release check .` performs static readiness checks by default. Runtime probing executes package-local MCP servers and therefore requires an explicit `--runtime`; protected workflows can also require the approved runtime-plan digest.
 
 Related docs:
 

package/dist/core/release-check.d.ts

@@ -1,6 +1,8 @@
+import type { CheckOptions, CheckResult } from "../domain/types.js";
 export interface ReleaseCheckReport {
     targetPath: string;
     status: "pass" | "fail";
+    runtimeProbeEnabled?: boolean;
     checks: {
         validation: {
             status: string;
@@ -24,12 +26,25 @@ export interface ReleaseCheckReport {
             status: string;
             score: number;
         };
+        metadata?: ReleaseMetadataCheck;
     };
     ready: boolean;
 }
-export declare function buildReleaseCheck(targetPath: string, options?: {
+export interface ReleaseMetadataCheck {
+    status: "pass" | "fail" | "skipped";
+    packageVersion: string | null;
+    lockfileVersion: string | null;
+    changelogVersion: boolean | null;
+    findings: string[];
+}
+export interface BuildReleaseCheckOptions {
     env?: Record<string, string | undefined>;
     platform?: NodeJS.Platform;
-}): Promise<ReleaseCheckReport>;
+    runtime?: boolean;
+    runCheck?: (targetPath: string, options: CheckOptions) => Promise<CheckResult>;
+}
+export declare function buildReleaseMetadataCheck(targetPath: string): Promise<ReleaseMetadataCheck>;
+export declare function assertReleaseMetadataSync(targetPath: string): Promise<void>;
+export declare function buildReleaseCheck(targetPath: string, options?: BuildReleaseCheckOptions): Promise<ReleaseCheckReport>;
 export declare function renderReleaseCheck(report: ReleaseCheckReport): string;
 export declare function renderReleaseCheckJson(report: ReleaseCheckReport): string;

package/dist/core/release-check.js

@@ -1,9 +1,83 @@
+import { readFile } from "node:fs/promises";
 import path from "node:path";
 import { validatePlugin } from "./validate-plugin.js";
 import { buildSecurityAudit } from "../security/security-audit.js";
 import { buildDepAudit } from "./dep-audit.js";
 import { buildCompatibilityMatrix } from "../compatibility/compatibility-matrix.js";
 import { buildTrustScore } from "../security/trust-score.js";
+async function readOptionalFile(filePath) {
+    try {
+        return await readFile(filePath, "utf8");
+    }
+    catch (error) {
+        if (error.code === "ENOENT") {
+            return null;
+        }
+        throw error;
+    }
+}
+export async function buildReleaseMetadataCheck(targetPath) {
+    const packageContent = await readOptionalFile(path.join(targetPath, "package.json"));
+    if (packageContent === null) {
+        return {
+            status: "skipped",
+            packageVersion: null,
+            lockfileVersion: null,
+            changelogVersion: null,
+            findings: []
+        };
+    }
+    const findings = [];
+    let packageVersion = null;
+    let lockfileVersion = null;
+    try {
+        const packageJson = JSON.parse(packageContent);
+        packageVersion = typeof packageJson.version === "string" ? packageJson.version : null;
+    }
+    catch {
+        findings.push("package.json is not valid JSON.");
+    }
+    if (!packageVersion) {
+        findings.push("package.json must contain a version.");
+    }
+    const lockContent = await readOptionalFile(path.join(targetPath, "package-lock.json"));
+    if (lockContent !== null) {
+        try {
+            const lock = JSON.parse(lockContent);
+            const rootVersion = lock.packages?.[""]?.version ?? lock.version;
+            lockfileVersion = typeof rootVersion === "string" ? rootVersion : null;
+        }
+        catch {
+            findings.push("package-lock.json is not valid JSON.");
+        }
+        if (!lockfileVersion) {
+            findings.push("package-lock.json must contain the root package version.");
+        }
+        else if (packageVersion && lockfileVersion !== packageVersion) {
+            findings.push(`package-lock.json version ${lockfileVersion} does not match package.json ${packageVersion}.`);
+        }
+    }
+    const changelog = await readOptionalFile(path.join(targetPath, "CHANGELOG.md"));
+    const changelogVersion = changelog === null || !packageVersion
+        ? null
+        : new RegExp(`^## \\[${packageVersion.replace(/[.*+?^${}()|[\]\\]/g, "\\$&")}\\](?:\\s|$)`, "m").test(changelog);
+    if (changelogVersion === false) {
+        findings.push(`CHANGELOG.md does not contain a ${packageVersion} release section.`);
+    }
+    return {
+        status: findings.length === 0 ? "pass" : "fail",
+        packageVersion,
+        lockfileVersion,
+        changelogVersion,
+        findings
+    };
+}
+export async function assertReleaseMetadataSync(targetPath) {
+    const metadata = await buildReleaseMetadataCheck(path.resolve(targetPath));
+    if (metadata.status === "fail") {
+        throw new Error(`Release metadata is inconsistent: ${metadata.findings.join(" ")}`);
+    }
+}
 function matrixOverallStatus(matrix) {
     const statuses = matrix.results.map((r) => r.status);
     const passCount = statuses.filter((s) => s === "pass").length;
@@ -29,11 +103,15 @@ export async function buildReleaseCheck(targetPath, options = {}) {
     const resolvedPath = path.resolve(targetPath);
     const env = options.env ?? process.env;
     const platform = options.platform ?? process.platform;
-    const validationResult = await validatePlugin(resolvedPath, { runtime: true });
+    const runtimeProbeEnabled = options.runtime ?? false;
+    const validationResult = await (options.runCheck ?? validatePlugin)(resolvedPath, {
+        runtime: runtimeProbeEnabled
+    });
     const securityResult = await buildSecurityAudit(resolvedPath);
     const depResult = await buildDepAudit(resolvedPath);
     const compatResult = await buildCompatibilityMatrix(resolvedPath, { env, platform });
     const trustResult = await buildTrustScore(resolvedPath);
+    const metadataResult = await buildReleaseMetadataCheck(resolvedPath);
     const checks = {
         validation: {
             status: validationResult.status,
@@ -56,16 +134,19 @@ export async function buildReleaseCheck(targetPath, options = {}) {
         trust: {
             status: trustResult.status,
             score: trustResult.score
-        }
+        },
+        metadata: metadataResult
     };
     const ready = checks.validation.status === "pass" &&
         checks.security.status === "pass" &&
         checks.dependencies.status !== "fail" &&
         checks.compatibility.status !== "fail" &&
-        checks.trust.status === "pass";
+        checks.trust.status === "pass" &&
+        checks.metadata.status !== "fail";
     return {
         targetPath: resolvedPath,
         status: ready ? "pass" : "fail",
+        runtimeProbeEnabled,
         checks,
         ready
     };
@@ -77,6 +158,7 @@ export function renderReleaseCheck(report) {
         "==================================",
         `Path: ${report.targetPath}`,
         `Ready: ${report.ready ? "YES" : "NO"}`,
+        `Runtime probe: ${report.runtimeProbeEnabled ? "enabled" : "disabled"}`,
         "",
         "Checks",
         "------",
@@ -85,6 +167,9 @@ export function renderReleaseCheck(report) {
         `  ${icon(report.checks.dependencies.status === "pass")}  dependencies  ${report.checks.dependencies.status}  (${report.checks.dependencies.vulnerabilities} vulns)`,
         `  ${icon(report.checks.compatibility.status === "pass")}  compatibility ${report.checks.compatibility.status}  (score: ${report.checks.compatibility.score})`,
         `  ${icon(report.checks.trust.status === "pass")}  trust         ${report.checks.trust.status}  (score: ${report.checks.trust.score})`,
+        ...(report.checks.metadata
+            ? [`  ${icon(report.checks.metadata.status !== "fail")}  metadata      ${report.checks.metadata.status}  (${report.checks.metadata.findings.length} findings)`]
+            : []),
         "",
         report.ready
             ? "All release checks passed. Ready to publish."
@@ -97,6 +182,7 @@ export function renderReleaseCheckJson(report) {
         schemaVersion: "1.0.0",
         targetPath: report.targetPath,
         status: report.status,
+        runtimeProbeEnabled: report.runtimeProbeEnabled ?? false,
         ready: report.ready,
         checks: report.checks
     }, null, 2);

package/dist/index.d.ts

@@ -29,5 +29,5 @@ export { buildDepAudit, buildDepAuditRecommendations, renderDepAudit, renderDepA
 export { initGitHooks, removeGitHooks, type InitGitHooksResult, type RemoveGitHooksResult } from "./core/init-git-hooks.js";
 export { generateCompletion, type CompletionShell } from "./core/shell-completion.js";
 export { validateConfigFile, renderConfigValidation, renderConfigValidationJson, type ConfigValidationFinding, type ConfigValidationReport } from "./core/config-validate.js";
-export { buildReleaseCheck, renderReleaseCheck, renderReleaseCheckJson, type ReleaseCheckReport } from "./core/release-check.js";
+export { assertReleaseMetadataSync, buildReleaseCheck, buildReleaseMetadataCheck, renderReleaseCheck, renderReleaseCheckJson, type BuildReleaseCheckOptions, type ReleaseMetadataCheck, type ReleaseCheckReport } from "./core/release-check.js";
 export declare function runCheck(targetPath: string, options?: CheckOptions): Promise<CheckResult>;

package/dist/index.js

@@ -29,7 +29,7 @@ export { buildDepAudit, buildDepAuditRecommendations, renderDepAudit, renderDepA
 export { initGitHooks, removeGitHooks } from "./core/init-git-hooks.js";
 export { generateCompletion } from "./core/shell-completion.js";
 export { validateConfigFile, renderConfigValidation, renderConfigValidationJson } from "./core/config-validate.js";
-export { buildReleaseCheck, renderReleaseCheck, renderReleaseCheckJson } from "./core/release-check.js";
+export { assertReleaseMetadataSync, buildReleaseCheck, buildReleaseMetadataCheck, renderReleaseCheck, renderReleaseCheckJson } from "./core/release-check.js";
 export async function runCheck(targetPath, options = {}) {
     return validatePlugin(targetPath, options);
 }

package/dist/run-cli.js

@@ -2253,7 +2253,7 @@ export async function runCli(args, io = defaultIo, options = {}) {
     if (command === "release") {
         const subCommand = maybePath;
         if (subCommand !== "check") {
-            io.writeStderr("Usage: codex-plugin-doctor release check <path> [--json]");
+            io.writeStderr("Usage: codex-plugin-doctor release check <path> [--json] [--runtime] [--require-runtime-approval --runtime-approval-digest <digest>]");
             return 2;
         }
         const targetPath = remainingArgs[0] && !remainingArgs[0].startsWith("--") ? remainingArgs[0] : ".";
@@ -2261,9 +2261,37 @@ export async function runCli(args, io = defaultIo, options = {}) {
             ? remainingArgs
             : remainingArgs.slice(1);
         const jsonOutput = releaseFlags.includes("--json");
+        const runtimeProbeEnabled = releaseFlags.includes("--runtime");
+        const requireRuntimeApproval = releaseFlags.includes("--require-runtime-approval");
+        const runtimeApprovalDigestIndex = releaseFlags.indexOf("--runtime-approval-digest");
+        const runtimeApprovalDigest = runtimeApprovalDigestIndex === -1
+            ? null
+            : releaseFlags[runtimeApprovalDigestIndex + 1];
+        if (requireRuntimeApproval && !runtimeProbeEnabled) {
+            io.writeStderr("Runtime approval requires --runtime.");
+            return 2;
+        }
+        if (runtimeApprovalDigestIndex !== -1 &&
+            (!runtimeApprovalDigest || runtimeApprovalDigest.startsWith("--"))) {
+            io.writeStderr("Missing digest after --runtime-approval-digest.");
+            return 2;
+        }
+        if (requireRuntimeApproval) {
+            const runtimePlan = await buildDoctorRuntimePlan(targetPath);
+            const approval = evaluateRuntimeApproval(runtimePlan, {
+                required: true,
+                approvedDigest: runtimeApprovalDigest
+            });
+            if (!runtimeApprovalPassed(approval)) {
+                io.writeStderr(`${approval.message}\nCurrent runtime plan digest: ${runtimePlan.digest}`);
+                return 1;
+            }
+        }
         const report = await buildReleaseCheck(targetPath, {
             env: terminalContext.env,
-            platform: terminalContext.platform
+            platform: terminalContext.platform,
+            runtime: runtimeProbeEnabled,
+            runCheck: options.runCheckImpl
         });
         const output = jsonOutput
             ? renderReleaseCheckJson(report)

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "codex-plugin-doctor",
-  "version": "1.46.0",
+  "version": "1.46.1",
   "description": "CLI-first validator for Codex plugins, skills, and MCP package surfaces with runtime MCP protocol validation.",
   "type": "module",
   "main": "./dist/index.js",