codex-plugin-doctor 1.49.0 → 1.50.0

package/README.md

@@ -427,9 +427,9 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v5
-      - uses: Esquetta/CodexPluginDoctor@v1.49.0
+      - uses: Esquetta/CodexPluginDoctor@v1.50.0
         with:
-          version: "1.49.0"
+          version: "1.50.0"
           path: .
           runtime: "true"
           policy: codex-publish
@@ -441,7 +441,7 @@ jobs:
           review-bundle-verify: "true"
 ```
 
-The action writes `codex-plugin-doctor-summary.md`, `codex-plugin-doctor-report.json`, `codex-plugin-doctor-action-manifest.json`, optional `codex-plugin-doctor.sarif`, optional `validation-corpus.json`, optional `output-contract.json`, and optional signed `review-bundle/` files to `codex-plugin-doctor-reports`, appends the Markdown report to the GitHub Actions step summary, uploads the report directory as an artifact, and then returns the real validation exit code. Review bundle generation requires a signing key environment variable such as `CODEX_PLUGIN_DOCTOR_SIGNING_KEY`. For runtime probing, SARIF output, corpus and contract artifacts, review bundle artifacts, installed plugin cache checks, CI policy presets, and pinned release examples, see [GitHub Action Usage](./docs/guides/github-action.md).
+The action writes `codex-plugin-doctor-summary.md`, `codex-plugin-doctor-report.json`, `codex-plugin-doctor-action-manifest.json`, optional `codex-plugin-doctor.sarif`, optional validation corpus and quality metrics reports, optional `output-contract.json`, and optional signed `review-bundle/` files to `codex-plugin-doctor-reports`, appends the Markdown report to the GitHub Actions step summary, uploads the report directory as an artifact, and then returns the real validation exit code. Review bundle generation requires a signing key environment variable such as `CODEX_PLUGIN_DOCTOR_SIGNING_KEY`. For runtime probing, SARIF output, corpus quality regression gates, corpus and contract artifacts, review bundle artifacts, installed plugin cache checks, CI policy presets, and pinned release examples, see [GitHub Action Usage](./docs/guides/github-action.md).
 
 To self-test this repository after cloning it:
 

package/dist/core/npm-package-doctor.d.ts

@@ -38,6 +38,17 @@ export interface DoctorNpmPackageReport {
 export interface BuildDoctorNpmPackageReportOptions {
     environment?: CompatibilityEnvironment;
 }
+export interface NpmPackEntry {
+    filename?: string;
+    name?: string;
+    version?: string;
+    files?: unknown[];
+    integrity?: string;
+    shasum?: string;
+    size?: number;
+    unpackedSize?: number;
+}
+export declare function parseNpmPackOutput(stdout: string): NpmPackEntry[];
 export declare function buildDoctorNpmPackageReport(packageSpec: string, options?: BuildDoctorNpmPackageReportOptions): Promise<DoctorNpmPackageReport>;
 export declare function renderDoctorNpmPackageReportJson(report: DoctorNpmPackageReport): string;
 export declare function renderDoctorNpmPackageReport(report: DoctorNpmPackageReport, options?: {

package/dist/core/npm-package-doctor.js

@@ -7,6 +7,16 @@ import { gunzip } from "node:zlib";
 import { buildDoctorRecommendationsFromAnalysis, buildPackageAnalysis } from "./package-analysis.js";
 const execFileAsync = promisify(execFile);
 const gunzipAsync = promisify(gunzip);
+export function parseNpmPackOutput(stdout) {
+    const parsed = JSON.parse(stdout);
+    if (Array.isArray(parsed)) {
+        return parsed.filter((entry) => typeof entry === "object" && entry !== null);
+    }
+    if (typeof parsed === "object" && parsed !== null) {
+        return Object.values(parsed).filter((entry) => typeof entry === "object" && entry !== null);
+    }
+    return [];
+}
 function npmCommand(args) {
     if (process.platform === "win32") {
         const npmCliPath = process.env.npm_execpath ??
@@ -108,8 +118,8 @@ async function packNpmPackage(packageSpec, destinationPath) {
         env: npmPackEnvironment(),
         maxBuffer: 10 * 1024 * 1024
     });
-    const packEntries = JSON.parse(stdout);
-    const metadata = packEntries[0];
+    const packEntries = parseNpmPackOutput(stdout);
+    const metadata = packEntries.find((entry) => typeof entry.filename === "string");
     if (!metadata?.filename) {
         throw new Error(`npm pack did not return a tarball for ${packageSpec}`);
     }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "codex-plugin-doctor",
-  "version": "1.49.0",
+  "version": "1.50.0",
   "description": "CLI-first validator for Codex plugins, skills, and MCP package surfaces with runtime MCP protocol validation.",
   "type": "module",
   "main": "./dist/index.js",