codex-plugin-doctor 1.52.0 → 1.54.0

package/dist/core/output-contract.js

@@ -5,6 +5,10 @@ const runtimeCapabilityStatusSchema = {
     type: "string",
     enum: ["pass", "fail", "warn", "skipped", "unsupported"]
 };
+const remoteTransportReliabilityStatusSchema = {
+    type: "string",
+    enum: ["pass", "warn", "fail", "skipped"]
+};
 const runtimeConformanceSchema = {
     type: "object",
     properties: {
@@ -35,6 +39,28 @@ const runtimeConformanceSchema = {
     ],
     additionalProperties: false
 };
+const remoteTransportReliabilitySchema = {
+    type: "object",
+    properties: {
+        getSse: remoteTransportReliabilityStatusSchema,
+        sessionPropagation: remoteTransportReliabilityStatusSchema,
+        resumability: remoteTransportReliabilityStatusSchema,
+        disconnectSafety: remoteTransportReliabilityStatusSchema,
+        sessionRestart: remoteTransportReliabilityStatusSchema,
+        termination: remoteTransportReliabilityStatusSchema,
+        overall: remoteTransportReliabilityStatusSchema
+    },
+    required: [
+        "getSse",
+        "sessionPropagation",
+        "resumability",
+        "disconnectSafety",
+        "sessionRestart",
+        "termination",
+        "overall"
+    ],
+    additionalProperties: false
+};
 const remoteRuntimeScorecardSchema = {
     type: "object",
     properties: {
@@ -48,6 +74,7 @@ const remoteRuntimeScorecardSchema = {
         },
         protocolHeaders: runtimeCapabilityStatusSchema,
         authorization: runtimeCapabilityStatusSchema,
+        reliability: remoteTransportReliabilitySchema,
         overall: {
             type: "string",
             enum: ["pass", "warn", "fail", "skipped"]
@@ -125,6 +152,52 @@ const publicSchemaDefinitions = [
             }
         }
     },
+    {
+        id: "doctor.registry.readiness.json",
+        command: "codex-plugin-doctor registry check <server.json|directory> --json",
+        outputKind: "mcp-registry-readiness",
+        required: [
+            "schemaVersion",
+            "kind",
+            "generatedAt",
+            "source",
+            "target",
+            "status",
+            "scorecard",
+            "installability",
+            "findings"
+        ],
+        properties: {
+            source: {
+                type: "string",
+                enum: ["file", "registry"]
+            },
+            status: {
+                type: "string",
+                enum: ["pass", "warn", "fail"]
+            },
+            scorecard: {
+                type: "object",
+                required: [
+                    "metadata",
+                    "ownership",
+                    "packageIntegrity",
+                    "transportReadiness",
+                    "clientInstallability",
+                    "overall"
+                ],
+                additionalProperties: false
+            },
+            installability: {
+                type: "object",
+                required: ["codex", "packageTypes", "remoteTransports"],
+                additionalProperties: true
+            },
+            findings: {
+                type: "array"
+            }
+        }
+    },
     {
         id: "doctor.audit.json",
         command: "codex-plugin-doctor audit --installed --json",

package/dist/core/release-check.d.ts

@@ -43,6 +43,8 @@ export interface BuildReleaseCheckOptions {
     runtime?: boolean;
     allowNetwork?: boolean;
     allowLocalNetwork?: boolean;
+    allowSessionLifecycle?: boolean;
+    requireRemoteReliability?: boolean;
     runtimeSandbox?: RuntimeSandboxMode;
     runCheck?: (targetPath: string, options: CheckOptions) => Promise<CheckResult>;
 }

package/dist/core/release-check.js

@@ -108,6 +108,8 @@ export async function buildReleaseCheck(targetPath, options = {}) {
         runtime: runtimeProbeEnabled,
         ...(options.allowNetwork ? { allowNetwork: true } : {}),
         ...(options.allowLocalNetwork ? { allowLocalNetwork: true } : {}),
+        ...(options.allowSessionLifecycle ? { allowSessionLifecycle: true } : {}),
+        ...(options.requireRemoteReliability ? { requireRemoteReliability: true } : {}),
         ...(options.runtimeSandbox ? { runtimeSandbox: options.runtimeSandbox } : {})
     });
     const securityResult = await buildSecurityAudit(resolvedPath);

package/dist/core/release-evidence.d.ts

@@ -113,6 +113,8 @@ export interface BuildDoctorReleaseEvidenceOptions {
     runtime?: boolean;
     allowNetwork?: boolean;
     allowLocalNetwork?: boolean;
+    allowSessionLifecycle?: boolean;
+    requireRemoteReliability?: boolean;
     sandbox?: RuntimeSandboxMode;
     environment?: CompatibilityEnvironment;
     runCheck?: (targetPath: string, options?: CheckOptions) => Promise<CheckResult>;

package/dist/core/release-evidence.js

@@ -308,6 +308,8 @@ export async function buildDoctorReleaseEvidenceReport(targetPath, options) {
             runtime: true,
             ...(options.allowNetwork ? { allowNetwork: true } : {}),
             ...(options.allowLocalNetwork ? { allowLocalNetwork: true } : {}),
+            ...(options.allowSessionLifecycle ? { allowSessionLifecycle: true } : {}),
+            ...(options.requireRemoteReliability ? { requireRemoteReliability: true } : {}),
             ...(options.sandbox ? { runtimeSandbox: options.sandbox } : {})
         }
         : {};

package/dist/core/remote-mcp-probe.d.ts

@@ -8,6 +8,7 @@ export interface RemoteMcpProbeOptions {
     requestTimeoutMs?: number;
     lookup?: RemoteLookup;
     request?: RemoteMcpRequest;
+    allowSessionLifecycle?: boolean;
 }
 export interface RemoteMcpProbeResult {
     findings: Finding[];

package/dist/core/remote-mcp-probe.js

@@ -1,6 +1,7 @@
 import { BoundedHttpError, requestBoundedHttp } from "./bounded-http-client.js";
 import { RemoteNetworkPolicyError } from "./remote-network-policy.js";
 import { checkRemoteOAuthReadiness } from "./remote-oauth-readiness.js";
+import { probeRemoteTransportReliability } from "./remote-transport-reliability.js";
 import { inspectRemoteMcpUrl } from "./remote-url-policy.js";
 import { packageVersion } from "../version.js";
 const MCP_PROTOCOL_VERSION = "2025-11-25";
@@ -85,6 +86,9 @@ function isValidInitializeResponse(message) {
         typeof message.result.serverInfo.name === "string" &&
         typeof message.result.serverInfo.version === "string");
 }
+function isInitializedNotificationAcknowledged(response) {
+    return response.statusCode === 202 && response.body.length === 0;
+}
 function validSessionId(value) {
     return value !== null && /^[\x21-\x7e]+$/.test(value);
 }
@@ -210,7 +214,7 @@ export async function probeRemoteMcpServer(serverName, rawUrl, options = {}) {
                 ...(sessionId === null ? {} : { "MCP-Session-Id": sessionId })
             }
         });
-        if (initializedResponse.statusCode < 200 || initializedResponse.statusCode >= 300) {
+        if (!isInitializedNotificationAcknowledged(initializedResponse)) {
             scorecard.protocolHeaders = "fail";
             findings.push(failure("plugin.runtime.remote.initialized.failed", `The remote MCP server \`${serverName}\` did not acknowledge the initialized notification.`, "The MCP session may not be ready for subsequent protocol traffic.", "Accept a successful HTTP response to notifications/initialized at the same MCP endpoint."));
             return finalize(scorecard, findings);
@@ -222,5 +226,59 @@ export async function probeRemoteMcpServer(serverName, rawUrl, options = {}) {
         return finalize(scorecard, findings);
     }
     scorecard.protocolHeaders = "pass";
+    const reliability = await probeRemoteTransportReliability({
+        rawUrl,
+        protocolVersion: MCP_PROTOCOL_VERSION,
+        request,
+        requestTimeoutMs: options.requestTimeoutMs,
+        requestOptions: {
+            allowLocalNetwork: options.allowLocalNetwork,
+            lookup: options.lookup
+        },
+        sessionId,
+        allowSessionLifecycle: options.allowSessionLifecycle,
+        reinitialize: async (requestWithinBudget) => {
+            const restartInitialize = await requestWithinBudget({
+                method: "POST",
+                body: initializeBody,
+                headers: {
+                    Accept: "application/json, text/event-stream",
+                    "Content-Type": "application/json"
+                },
+                stopAfter: (body) => findSseInitializeResponse(body) !== null
+            });
+            if (restartInitialize.statusCode !== 200) {
+                throw new Error("restart initialize failed");
+            }
+            const restartContentType = mediaType(responseHeader(restartInitialize.headers, "content-type"));
+            if (restartContentType !== "application/json" && restartContentType !== "text/event-stream") {
+                throw new Error("restart initialize content type invalid");
+            }
+            const replacementSessionId = responseHeader(restartInitialize.headers, "mcp-session-id");
+            if (replacementSessionId !== null && !validSessionId(replacementSessionId)) {
+                throw new Error("restart session invalid");
+            }
+            const restartMessage = parseInitializeResponse(restartInitialize.body, restartContentType);
+            if (!restartMessage || !isValidInitializeResponse(restartMessage)) {
+                throw new Error("restart initialize result invalid");
+            }
+            const restartInitialized = await requestWithinBudget({
+                method: "POST",
+                body: JSON.stringify({ jsonrpc: "2.0", method: "notifications/initialized" }),
+                headers: {
+                    Accept: "application/json, text/event-stream",
+                    "Content-Type": "application/json",
+                    "MCP-Protocol-Version": MCP_PROTOCOL_VERSION,
+                    ...(replacementSessionId === null ? {} : { "MCP-Session-Id": replacementSessionId })
+                }
+            });
+            if (!isInitializedNotificationAcknowledged(restartInitialized)) {
+                throw new Error("restart initialized failed");
+            }
+            return replacementSessionId;
+        }
+    });
+    scorecard.reliability = reliability.scorecard;
+    findings.push(...reliability.findings);
     return finalize(scorecard, findings);
 }

package/dist/core/remote-transport-reliability.d.ts

@@ -0,0 +1,18 @@
+import { type BoundedHttpRequestOptions, type BoundedHttpResponse } from "./bounded-http-client.js";
+import type { Finding, RemoteTransportReliabilityScorecard } from "../domain/types.js";
+export interface RemoteTransportReliabilityResult {
+    findings: Finding[];
+    scorecard: RemoteTransportReliabilityScorecard;
+}
+export type RemoteTransportReliabilityRequest = (options: BoundedHttpRequestOptions) => Promise<BoundedHttpResponse>;
+export interface RemoteTransportReliabilityOptions {
+    rawUrl: string;
+    protocolVersion: string;
+    request: (rawUrl: string, options?: BoundedHttpRequestOptions) => Promise<BoundedHttpResponse>;
+    requestTimeoutMs?: number;
+    requestOptions?: Pick<BoundedHttpRequestOptions, "allowLocalNetwork" | "lookup">;
+    sessionId: string | null;
+    allowSessionLifecycle?: boolean;
+    reinitialize: (request: RemoteTransportReliabilityRequest) => Promise<string | null>;
+}
+export declare function probeRemoteTransportReliability(options: RemoteTransportReliabilityOptions): Promise<RemoteTransportReliabilityResult>;

package/dist/core/remote-transport-reliability.js

@@ -0,0 +1,243 @@
+import { BoundedHttpError } from "./bounded-http-client.js";
+import { observeFirstSseEvent } from "./sse-observation.js";
+const DEFAULT_RELIABILITY_TIMEOUT_MS = 3_000;
+const MAX_RELIABILITY_REQUESTS = 6;
+function createScorecard() {
+    return {
+        getSse: "skipped",
+        sessionPropagation: "skipped",
+        resumability: "skipped",
+        disconnectSafety: "skipped",
+        sessionRestart: "skipped",
+        termination: "skipped",
+        overall: "skipped"
+    };
+}
+function finding(id, severity, message, suggestedFix) {
+    return {
+        id,
+        severity,
+        message,
+        impact: "Remote MCP transport reliability could not be verified within the configured safety bounds.",
+        suggestedFix
+    };
+}
+function responseHeader(headers, name) {
+    const value = headers[name];
+    return typeof value === "string" ? value : null;
+}
+function mediaType(value) {
+    return value?.split(";", 1)[0]?.trim().toLowerCase() ?? null;
+}
+function validSessionId(value) {
+    return value !== null && /^[\x21-\x7e]+$/.test(value);
+}
+function wait(delayMs) {
+    return new Promise((resolve) => setTimeout(resolve, delayMs));
+}
+function finalize(scorecard, findings) {
+    const statuses = Object.entries(scorecard)
+        .filter(([name]) => name !== "overall")
+        .map(([, status]) => status);
+    scorecard.overall = statuses.includes("fail")
+        ? "fail"
+        : statuses.includes("warn")
+            ? "warn"
+            : statuses.includes("pass")
+                ? "pass"
+                : "skipped";
+    return { findings, scorecard };
+}
+function isSseTimeout(error) {
+    return error instanceof BoundedHttpError
+        && error.code === "REMOTE_HTTP_TIMEOUT"
+        && error.statusCode === 200
+        && mediaType(responseHeader(error.headers ?? {}, "content-type")) === "text/event-stream";
+}
+function classifySseResponse(response, failurePrefix, findings) {
+    if (response.statusCode !== 200) {
+        findings.push(finding(`plugin.runtime.remote.reliability.${failurePrefix}.status`, "fail", "The remote MCP endpoint returned an unsupported SSE transport status.", "Return HTTP 200 for an accepted SSE transport request."));
+        return null;
+    }
+    if (mediaType(responseHeader(response.headers, "content-type")) !== "text/event-stream") {
+        findings.push(finding(`plugin.runtime.remote.reliability.${failurePrefix}.content_type`, "fail", "The remote MCP endpoint returned a non-SSE media type for an SSE transport request.", "Return text/event-stream for accepted SSE transport requests."));
+        return null;
+    }
+    return observeFirstSseEvent(response.body);
+}
+export async function probeRemoteTransportReliability(options) {
+    const scorecard = createScorecard();
+    const findings = [];
+    const timeoutMs = options.requestTimeoutMs ?? DEFAULT_RELIABILITY_TIMEOUT_MS;
+    const deadline = Date.now() + Math.min(timeoutMs, DEFAULT_RELIABILITY_TIMEOUT_MS);
+    let currentSessionId = options.sessionId;
+    let requestCount = 0;
+    let restarted = false;
+    const requestWithinBudget = async (requestOptions) => {
+        if (requestCount >= MAX_RELIABILITY_REQUESTS) {
+            throw new Error("reliability request ceiling reached");
+        }
+        const remainingMs = deadline - Date.now();
+        if (remainingMs <= 0) {
+            throw new BoundedHttpError("REMOTE_HTTP_TIMEOUT", "Remote reliability deadline elapsed.");
+        }
+        requestCount += 1;
+        return options.request(options.rawUrl, {
+            ...requestOptions,
+            ...options.requestOptions,
+            timeoutMs: Math.max(1, Math.min(remainingMs, DEFAULT_RELIABILITY_TIMEOUT_MS))
+        });
+    };
+    const send = async (method, extraHeaders = {}, stopAfter) => {
+        let sessionRestarted = false;
+        for (let attempt = 0; attempt < 2; attempt += 1) {
+            const sessionId = currentSessionId;
+            const headers = {
+                Accept: "text/event-stream",
+                "MCP-Protocol-Version": options.protocolVersion,
+                ...(sessionId === null ? {} : { "MCP-Session-Id": sessionId }),
+                ...(sessionRestarted ? {} : extraHeaders)
+            };
+            if (sessionId !== null) {
+                scorecard.sessionPropagation = "pass";
+            }
+            let response;
+            try {
+                response = await requestWithinBudget({
+                    method,
+                    headers,
+                    stopAfter
+                });
+            }
+            catch (error) {
+                return { error };
+            }
+            if (method === "GET" && sessionId !== null && response.statusCode === 404) {
+                if (restarted) {
+                    scorecard.sessionRestart = "fail";
+                    return { restartFailed: true };
+                }
+                restarted = true;
+                sessionRestarted = true;
+                currentSessionId = null;
+                try {
+                    const replacementSessionId = await options.reinitialize(requestWithinBudget);
+                    if (replacementSessionId !== null && !validSessionId(replacementSessionId)) {
+                        throw new Error("invalid replacement session");
+                    }
+                    currentSessionId = replacementSessionId;
+                    scorecard.sessionRestart = "pass";
+                }
+                catch {
+                    scorecard.sessionRestart = "fail";
+                    return { restartFailed: true };
+                }
+                continue;
+            }
+            return { response, sessionRestarted };
+        }
+        return { restartFailed: true };
+    };
+    const first = await send("GET", {}, (body) => observeFirstSseEvent(body).complete);
+    if (first.restartFailed) {
+        findings.push(finding("plugin.runtime.remote.reliability.session_restart.failed", "fail", "The remote MCP session expired and could not be restarted within the bounded probe.", "Accept a fresh initialize sequence after an expired MCP session."));
+        return finalize(scorecard, findings);
+    }
+    if (first.error) {
+        if (isSseTimeout(first.error)) {
+            scorecard.getSse = "warn";
+            scorecard.disconnectSafety = "warn";
+            findings.push(finding("plugin.runtime.remote.reliability.get.inconclusive", "warn", "The remote MCP SSE stream did not produce a complete event before the bounded observation deadline.", "Emit complete SSE event frames promptly when server-to-client streaming is supported."));
+            return finalize(scorecard, findings);
+        }
+        scorecard.getSse = "fail";
+        findings.push(finding("plugin.runtime.remote.reliability.get.failed", "fail", "The remote MCP SSE transport request could not be completed.", "Keep the Streamable HTTP transport reachable within the configured request bounds."));
+        return finalize(scorecard, findings);
+    }
+    const firstResponse = first.response;
+    if (!firstResponse) {
+        scorecard.getSse = "fail";
+        return finalize(scorecard, findings);
+    }
+    if (firstResponse.statusCode === 405) {
+        scorecard.getSse = "pass";
+    }
+    else {
+        const observation = classifySseResponse(firstResponse, "get", findings);
+        if (observation === null) {
+            scorecard.getSse = "fail";
+            return finalize(scorecard, findings);
+        }
+        if (!observation.complete) {
+            scorecard.getSse = "warn";
+            scorecard.disconnectSafety = "warn";
+            findings.push(finding("plugin.runtime.remote.reliability.get.inconclusive", "warn", "The remote MCP SSE response ended before a complete event could be observed.", "Emit complete SSE event frames when server-to-client streaming is supported."));
+            return finalize(scorecard, findings);
+        }
+        if (observation.malformed) {
+            scorecard.getSse = "fail";
+            scorecard.disconnectSafety = "fail";
+            findings.push(finding("plugin.runtime.remote.reliability.get.malformed", "fail", "The remote MCP endpoint emitted malformed SSE event framing.", "Return complete SSE events with valid id and retry fields."));
+            return finalize(scorecard, findings);
+        }
+        scorecard.getSse = "pass";
+        scorecard.disconnectSafety = "pass";
+        if (observation.eventId !== null) {
+            const remainingMs = deadline - Date.now();
+            if (observation.retryMs !== null) {
+                if (observation.retryMs >= remainingMs) {
+                    scorecard.resumability = "warn";
+                    findings.push(finding("plugin.runtime.remote.reliability.resume.inconclusive", "warn", "The remote MCP SSE retry delay exceeded the remaining bounded observation deadline.", "Advertise an SSE retry delay that fits within the configured probe deadline."));
+                    return finalize(scorecard, findings);
+                }
+                await wait(observation.retryMs);
+            }
+            const resumed = await send("GET", { "Last-Event-ID": observation.eventId }, (body) => observeFirstSseEvent(body).complete);
+            if (resumed.restartFailed) {
+                findings.push(finding("plugin.runtime.remote.reliability.session_restart.failed", "fail", "The remote MCP session expired during SSE resumability validation and could not be restarted.", "Accept one fresh initialize sequence after an expired MCP session."));
+                return finalize(scorecard, findings);
+            }
+            if (resumed.error) {
+                scorecard.resumability = isSseTimeout(resumed.error) ? "warn" : "fail";
+                findings.push(finding(isSseTimeout(resumed.error)
+                    ? "plugin.runtime.remote.reliability.resume.inconclusive"
+                    : "plugin.runtime.remote.reliability.resume.failed", isSseTimeout(resumed.error) ? "warn" : "fail", "The remote MCP SSE resume request could not be completed within the bounded probe.", "Accept one bounded SSE reconnect using Last-Event-ID."));
+                return finalize(scorecard, findings);
+            }
+            if (!resumed.response) {
+                scorecard.resumability = "fail";
+                return finalize(scorecard, findings);
+            }
+            if (resumed.sessionRestarted) {
+                scorecard.resumability = "skipped";
+            }
+            else {
+                const resumeObservation = classifySseResponse(resumed.response, "resume", findings);
+                if (resumeObservation === null || resumeObservation.malformed) {
+                    scorecard.resumability = "fail";
+                    if (resumeObservation?.malformed) {
+                        findings.push(finding("plugin.runtime.remote.reliability.resume.malformed", "fail", "The remote MCP endpoint emitted malformed SSE framing after a resume request.", "Return complete SSE events with valid id and retry fields after reconnecting."));
+                    }
+                    return finalize(scorecard, findings);
+                }
+                scorecard.resumability = resumeObservation.complete ? "pass" : "warn";
+                if (!resumeObservation.complete) {
+                    findings.push(finding("plugin.runtime.remote.reliability.resume.inconclusive", "warn", "The remote MCP SSE resume response ended before a complete event could be observed.", "Emit complete SSE events after accepting a reconnect."));
+                    return finalize(scorecard, findings);
+                }
+            }
+        }
+    }
+    if (!options.allowSessionLifecycle || currentSessionId === null) {
+        return finalize(scorecard, findings);
+    }
+    const terminated = await send("DELETE");
+    if (terminated.restartFailed || terminated.error || !terminated.response
+        || (terminated.response.statusCode !== 405 && (terminated.response.statusCode < 200 || terminated.response.statusCode >= 300))) {
+        scorecard.termination = "fail";
+        findings.push(finding("plugin.runtime.remote.reliability.termination.failed", "fail", "The remote MCP session could not be terminated with the approved lifecycle request.", "Return a successful response or HTTP 405 for a bounded MCP session DELETE request."));
+        return finalize(scorecard, findings);
+    }
+    scorecard.termination = "pass";
+    return finalize(scorecard, findings);
+}

package/dist/core/runtime-probe.d.ts

@@ -1,4 +1,4 @@
-import type { DiscoveredPackage, RuntimeProbeResult, RuntimeSandboxMode } from "../domain/types.js";
+import type { DiscoveredPackage, RuntimeProbeResult, RuntimeSandboxMode, RuntimeScorecard } from "../domain/types.js";
 import { type RemoteMcpRequest } from "./remote-mcp-probe.js";
 import type { RemoteLookup } from "./remote-network-policy.js";
 export declare function probeRuntime(discoveredPackage: DiscoveredPackage, options?: RuntimeProbeOptions): Promise<RuntimeProbeResult>;
@@ -8,8 +8,10 @@ export interface RuntimeProbeOptions {
     transcript?: (line: string) => void;
     allowNetwork?: boolean;
     allowLocalNetwork?: boolean;
+    allowSessionLifecycle?: boolean;
     remoteRequestTimeoutMs?: number;
     remoteLookup?: RemoteLookup;
     remoteRequest?: RemoteMcpRequest;
 }
+export declare function remoteReliabilityGatePassed(scorecard: RuntimeScorecard | undefined): boolean;
 export declare function probeRuntimeConfig(rootPath: string, mcpConfigPath: string, options?: RuntimeProbeOptions): Promise<RuntimeProbeResult>;

package/dist/core/runtime-probe.js

@@ -345,6 +345,17 @@ function mergeRemoteRuntimeScorecards(left, right) {
         "present-valid": 1,
         absent: 0
     };
+    const reliability = left.reliability && right.reliability
+        ? {
+            getSse: worstRuntimeStatus(left.reliability.getSse, right.reliability.getSse),
+            sessionPropagation: worstRuntimeStatus(left.reliability.sessionPropagation, right.reliability.sessionPropagation),
+            resumability: worstRuntimeStatus(left.reliability.resumability, right.reliability.resumability),
+            disconnectSafety: worstRuntimeStatus(left.reliability.disconnectSafety, right.reliability.disconnectSafety),
+            sessionRestart: worstRuntimeStatus(left.reliability.sessionRestart, right.reliability.sessionRestart),
+            termination: worstRuntimeStatus(left.reliability.termination, right.reliability.termination),
+            overall: worstRuntimeStatus(left.reliability.overall, right.reliability.overall)
+        }
+        : left.reliability ?? right.reliability;
     return {
         transport: worstRuntimeStatus(left.transport, right.transport),
         networkSafety: worstRuntimeStatus(left.networkSafety, right.networkSafety),
@@ -355,7 +366,8 @@ function mergeRemoteRuntimeScorecards(left, right) {
             : right.session,
         protocolHeaders: worstRuntimeStatus(left.protocolHeaders, right.protocolHeaders),
         authorization: worstRuntimeStatus(left.authorization, right.authorization),
-        overall: worstRuntimeStatus(left.overall, right.overall)
+        overall: worstRuntimeStatus(left.overall, right.overall),
+        ...(reliability ? { reliability } : {})
     };
 }
 function supportsTasksListProbe(protocolVersion, capabilities) {
@@ -1251,6 +1263,10 @@ export async function probeRuntime(discoveredPackage, options = {}) {
     }
     return probeRuntimeConfig(rootPath, manifest.mcpServers, options);
 }
+export function remoteReliabilityGatePassed(scorecard) {
+    return scorecard !== undefined &&
+        (scorecard.remote === undefined || scorecard.remote.reliability?.overall === "pass");
+}
 export async function probeRuntimeConfig(rootPath, mcpConfigPath, options = {}) {
     const resolvedRootPath = path.resolve(rootPath);
     const resolvedMcpConfigPath = path.resolve(resolvedRootPath, mcpConfigPath);
@@ -1296,6 +1312,7 @@ export async function probeRuntimeConfig(rootPath, mcpConfigPath, options = {})
             const remote = await probeRemoteMcpServer(serverName, url, {
                 allowNetwork: options.allowNetwork,
                 allowLocalNetwork: options.allowLocalNetwork,
+                allowSessionLifecycle: options.allowSessionLifecycle,
                 requestTimeoutMs: options.remoteRequestTimeoutMs,
                 lookup: options.remoteLookup,
                 request: options.remoteRequest

package/dist/core/sse-observation.d.ts

@@ -0,0 +1,7 @@
+export interface SseObservation {
+    complete: boolean;
+    eventId: string | null;
+    retryMs: number | null;
+    malformed: boolean;
+}
+export declare function observeFirstSseEvent(body: Buffer): SseObservation;

package/dist/core/sse-observation.js

@@ -0,0 +1,67 @@
+const MAX_SSE_FIELD_BYTES = 1_024;
+function isSafeEventId(value) {
+    return value.length > 0
+        && value.length <= MAX_SSE_FIELD_BYTES
+        && value.every((byte) => byte >= 0x21 && byte <= 0x7e);
+}
+function parseRetry(value) {
+    if (value.length === 0 || value.length > MAX_SSE_FIELD_BYTES) {
+        return null;
+    }
+    for (const byte of value) {
+        if (byte < 0x30 || byte > 0x39) {
+            return null;
+        }
+    }
+    const retryMs = Number(value.toString("ascii"));
+    return Number.isSafeInteger(retryMs) ? retryMs : null;
+}
+export function observeFirstSseEvent(body) {
+    let eventId = null;
+    let retryMs = null;
+    let malformed = false;
+    let lineStart = 0;
+    for (let index = 0; index < body.length; index += 1) {
+        if (body[index] !== 0x0a && body[index] !== 0x0d) {
+            continue;
+        }
+        const line = body.subarray(lineStart, index);
+        if (body[index] === 0x0d && body[index + 1] === 0x0a) {
+            index += 1;
+        }
+        lineStart = index + 1;
+        if (line.length === 0) {
+            return {
+                complete: true,
+                eventId: malformed ? null : eventId,
+                retryMs: malformed ? null : retryMs,
+                malformed
+            };
+        }
+        if (line[0] === 0x3a) {
+            continue;
+        }
+        const separator = line.indexOf(0x3a);
+        const field = separator === -1 ? line : line.subarray(0, separator);
+        const valueStart = separator === -1 ? line.length : separator + 1;
+        const value = line.subarray(valueStart + (line[valueStart] === 0x20 ? 1 : 0));
+        if (field.equals(Buffer.from("id"))) {
+            if (value.length === 0) {
+                eventId = null;
+            }
+            else if (isSafeEventId(value)) {
+                eventId = value.toString("ascii");
+            }
+            else {
+                malformed = true;
+            }
+        }
+        else if (field.equals(Buffer.from("retry"))) {
+            const parsedRetryMs = parseRetry(value);
+            if (parsedRetryMs !== null) {
+                retryMs = parsedRetryMs;
+            }
+        }
+    }
+    return { complete: false, eventId: null, retryMs: null, malformed: false };
+}

package/dist/core/validate-plugin.js

@@ -3,7 +3,7 @@ import path from "node:path";
 import { withFindingFingerprints } from "../reporting/finding-fingerprint.js";
 import { discoverPackage } from "./discover-package.js";
 import { inspectRemoteMcpUrl } from "./remote-url-policy.js";
-import { probeRuntime } from "./runtime-probe.js";
+import { probeRuntime, remoteReliabilityGatePassed } from "./runtime-probe.js";
 function buildFailure(id, message, impact, suggestedFix, evidence) {
     return {
         id,
@@ -446,7 +446,8 @@ export async function validatePlugin(targetPath, options = {}) {
             sandbox: options.runtimeSandbox,
             transcript: options.runtimeTranscript,
             allowNetwork: options.allowNetwork,
-            allowLocalNetwork: options.allowLocalNetwork
+            allowLocalNetwork: options.allowLocalNetwork,
+            allowSessionLifecycle: options.allowSessionLifecycle
         })
         : null;
     const findings = [
@@ -454,7 +455,7 @@ export async function validatePlugin(targetPath, options = {}) {
         ...(runtimeResult?.findings ?? [])
     ];
     const fingerprintedFindings = withFindingFingerprints(findings, discoveredPackage.rootPath);
-    const hasFailures = fingerprintedFindings.some((finding) => finding.severity === "fail");
+    const hasFailures = fingerprintedFindings.some((finding) => finding.severity === "fail") || (options.requireRemoteReliability === true && !remoteReliabilityGatePassed(runtimeResult?.scorecard));
     const hasWarnings = fingerprintedFindings.some((finding) => finding.severity === "warn");
     if (!hasFailures && !hasWarnings) {
         return {