codex-plugin-doctor 1.52.0 → 1.54.0

package/dist/domain/types.d.ts

@@ -43,6 +43,8 @@ export interface CheckOptions {
     runtime?: boolean;
     allowNetwork?: boolean;
     allowLocalNetwork?: boolean;
+    allowSessionLifecycle?: boolean;
+    requireRemoteReliability?: boolean;
     runtimeTranscript?: (line: string) => void;
     runtimeStartupTimeoutMs?: number;
     runtimeSandbox?: RuntimeSandboxMode;
@@ -103,8 +105,19 @@ export interface RemoteRuntimeScorecard {
     session: "absent" | "present-valid" | "present-invalid";
     protocolHeaders: RuntimeCapabilityStatus;
     authorization: RuntimeCapabilityStatus;
+    reliability?: RemoteTransportReliabilityScorecard;
     overall: "pass" | "warn" | "fail" | "skipped";
 }
+export type RemoteTransportReliabilityStatus = "pass" | "warn" | "fail" | "skipped";
+export interface RemoteTransportReliabilityScorecard {
+    getSse: RemoteTransportReliabilityStatus;
+    sessionPropagation: RemoteTransportReliabilityStatus;
+    resumability: RemoteTransportReliabilityStatus;
+    disconnectSafety: RemoteTransportReliabilityStatus;
+    sessionRestart: RemoteTransportReliabilityStatus;
+    termination: RemoteTransportReliabilityStatus;
+    overall: RemoteTransportReliabilityStatus;
+}
 export type McpConformanceProfile = "legacy" | "2025-11-25" | "future-compatible";
 export interface RuntimeConformanceScorecard {
     protocolVersion: string | null;

package/dist/index.d.ts

@@ -30,6 +30,7 @@ export { buildDoctorInspectorReport, renderDoctorInspectorReport, renderDoctorIn
 export { buildEcosystemAudit, renderEcosystemAudit, renderEcosystemAuditJson, type EcosystemAuditReport } from "./audit/ecosystem-audit.js";
 export { applyPolicyToDepAudit, applyPolicyToDoctorConfig, applyPolicyToSecurityAudit, parsePolicyPack, policyEnablesRuntime, policyFailsOnWarnings, policyPackNames, type PolicyPackName } from "./policy/policy-packs.js";
 export { buildGenericMcpDoctor, renderGenericMcpDoctor, renderGenericMcpDoctorJson, type GenericMcpDoctorReport } from "./mcp/generic-mcp-doctor.js";
+export { buildMcpRegistryReadiness, inspectMcpRegistryServer, registryReadinessExitCode, renderMcpRegistryReadiness, renderMcpRegistryReadinessJson, type InspectMcpRegistryOptions, type McpRegistryFinding, type McpRegistryInstallability, type McpRegistryReadinessReport, type McpRegistryScorecard } from "./core/mcp-registry.js";
 export { watchPlugin, type WatchPluginOptions, type WatchPluginResult } from "./core/watch-plugin.js";
 export { buildDepAudit, buildDepAuditRecommendations, renderDepAudit, renderDepAuditJson, renderDepAuditSarif, type DepAuditRecommendation, type DepAuditReport, type DepAuditVulnerability } from "./core/dep-audit.js";
 export { initGitHooks, removeGitHooks, type InitGitHooksResult, type RemoveGitHooksResult } from "./core/init-git-hooks.js";

package/dist/index.js

@@ -30,6 +30,7 @@ export { buildDoctorInspectorReport, renderDoctorInspectorReport, renderDoctorIn
 export { buildEcosystemAudit, renderEcosystemAudit, renderEcosystemAuditJson } from "./audit/ecosystem-audit.js";
 export { applyPolicyToDepAudit, applyPolicyToDoctorConfig, applyPolicyToSecurityAudit, parsePolicyPack, policyEnablesRuntime, policyFailsOnWarnings, policyPackNames } from "./policy/policy-packs.js";
 export { buildGenericMcpDoctor, renderGenericMcpDoctor, renderGenericMcpDoctorJson } from "./mcp/generic-mcp-doctor.js";
+export { buildMcpRegistryReadiness, inspectMcpRegistryServer, registryReadinessExitCode, renderMcpRegistryReadiness, renderMcpRegistryReadinessJson } from "./core/mcp-registry.js";
 export { watchPlugin } from "./core/watch-plugin.js";
 export { buildDepAudit, buildDepAuditRecommendations, renderDepAudit, renderDepAuditJson, renderDepAuditSarif } from "./core/dep-audit.js";
 export { initGitHooks, removeGitHooks } from "./core/init-git-hooks.js";

package/dist/mcp/generic-mcp-doctor.d.ts

@@ -17,6 +17,8 @@ export interface GenericMcpDoctorOptions {
     runtime?: boolean;
     allowNetwork?: boolean;
     allowLocalNetwork?: boolean;
+    allowSessionLifecycle?: boolean;
+    requireRemoteReliability?: boolean;
     runtimeStartupTimeoutMs?: number;
 }
 export declare function buildGenericMcpDoctor(targetPath: string, environment?: CompatibilityEnvironment, options?: GenericMcpDoctorOptions): Promise<GenericMcpDoctorReport>;

package/dist/mcp/generic-mcp-doctor.js

@@ -2,7 +2,7 @@ import { realpath, stat } from "node:fs/promises";
 import path from "node:path";
 import { buildCompatibilityMatrix, readMcpConfigPath } from "../compatibility/compatibility-matrix.js";
 import { readJsonFile } from "../core/read-json-file.js";
-import { probeRuntimeConfig } from "../core/runtime-probe.js";
+import { probeRuntimeConfig, remoteReliabilityGatePassed } from "../core/runtime-probe.js";
 import { formatFindingFingerprintLine, withFindingFingerprints } from "../reporting/finding-fingerprint.js";
 import { auditMcpServerConfig, buildSecurityAuditFromFindings } from "../security/security-audit.js";
 function buildFinding(severity, id, message, impact, suggestedFix, evidence) {
@@ -142,11 +142,14 @@ export async function buildGenericMcpDoctor(targetPath, environment = {}, option
         ? await probeRuntimeConfig(canonicalRootPath, canonicalMcpConfigPath, {
             startupTimeoutMs: options.runtimeStartupTimeoutMs,
             allowNetwork: options.allowNetwork,
-            allowLocalNetwork: options.allowLocalNetwork
+            allowLocalNetwork: options.allowLocalNetwork,
+            allowSessionLifecycle: options.allowSessionLifecycle
         })
         : null;
     const fingerprintedFindings = withFindingFingerprints([...staticFindings, ...(runtimeResult?.findings ?? [])], rootPath);
-    const status = mergeReportStatus(fingerprintedFindings, security);
+    const status = options.requireRemoteReliability === true && !remoteReliabilityGatePassed(runtimeResult?.scorecard)
+        ? "fail"
+        : mergeReportStatus(fingerprintedFindings, security);
     return {
         targetPath: rootPath,
         status,

package/dist/reporting/render-markdown-report.js

@@ -42,6 +42,19 @@ function appendRuntimeScorecard(lines, result) {
         lines.push(`| Protocol headers | ${remote.protocolHeaders.toUpperCase()} |`);
         lines.push(`| Authorization | ${remote.authorization.toUpperCase()} |`);
         lines.push(`| Overall | ${remote.overall.toUpperCase()} |`);
+        if (remote.reliability) {
+            const reliability = remote.reliability;
+            lines.push("", "## Remote Transport Reliability", "");
+            lines.push("| Check | Status |");
+            lines.push("| --- | --- |");
+            lines.push(`| GET SSE | ${reliability.getSse.toUpperCase()} |`);
+            lines.push(`| Session propagation | ${reliability.sessionPropagation.toUpperCase()} |`);
+            lines.push(`| Resumability | ${reliability.resumability.toUpperCase()} |`);
+            lines.push(`| Disconnect safety | ${reliability.disconnectSafety.toUpperCase()} |`);
+            lines.push(`| Session restart | ${reliability.sessionRestart.toUpperCase()} |`);
+            lines.push(`| Termination | ${reliability.termination.toUpperCase()} |`);
+            lines.push(`| Overall | ${reliability.overall.toUpperCase()} |`);
+        }
     }
 }
 export function buildMarkdownReport(result, options) {

package/dist/reporting/render-text-report.js

@@ -59,6 +59,17 @@ function appendRuntimeScorecard(lines, result) {
         lines.push(`protocol headers: ${remote.protocolHeaders}`);
         lines.push(`authorization: ${remote.authorization}`);
         lines.push(`overall: ${remote.overall}`);
+        if (remote.reliability) {
+            const reliability = remote.reliability;
+            lines.push("", "Remote Transport Reliability", "----------------------------");
+            lines.push(`GET SSE: ${reliability.getSse}`);
+            lines.push(`Session propagation: ${reliability.sessionPropagation}`);
+            lines.push(`Resumability: ${reliability.resumability}`);
+            lines.push(`Disconnect safety: ${reliability.disconnectSafety}`);
+            lines.push(`Session restart: ${reliability.sessionRestart}`);
+            lines.push(`Termination: ${reliability.termination}`);
+            lines.push(`Overall: ${reliability.overall}`);
+        }
     }
 }
 export function renderTextReport(result, options = {}) {

package/dist/rules/rule-catalog.js

@@ -556,6 +556,114 @@ export const ruleCatalog = [
         why: "Authorization readiness cannot be confirmed without bounded metadata responses.",
         fix: "Make protected-resource and authorization-server metadata available over HTTPS.",
         example: "Return application/json discovery metadata."
+    },
+    {
+        id: "plugin.runtime.remote.reliability.get.status",
+        category: "runtime",
+        defaultSeverity: "fail",
+        summary: "The remote MCP endpoint rejected the SSE transport request.",
+        why: "Clients cannot rely on server-to-client streaming when an accepted SSE request does not return the expected status.",
+        fix: "Return HTTP 200 with a valid SSE response, or HTTP 405 when GET streaming is not supported.",
+        example: "HTTP/1.1 405 Method Not Allowed"
+    },
+    {
+        id: "plugin.runtime.remote.reliability.get.content_type",
+        category: "runtime",
+        defaultSeverity: "fail",
+        summary: "The remote MCP endpoint returned a non-SSE media type for GET streaming.",
+        why: "Clients cannot interpret a successful streaming response unless it is declared as Server-Sent Events.",
+        fix: "Return Content-Type: text/event-stream for accepted GET streaming requests.",
+        example: "Content-Type: text/event-stream"
+    },
+    {
+        id: "plugin.runtime.remote.reliability.get.inconclusive",
+        category: "runtime",
+        defaultSeverity: "warn",
+        summary: "The remote MCP GET streaming check was inconclusive.",
+        why: "A bounded probe could not observe a complete SSE event, so streaming reliability remains uncertain.",
+        fix: "Emit complete SSE event frames promptly when server-to-client streaming is supported.",
+        example: "id: event-1\n\ndata: {}\n\n"
+    },
+    {
+        id: "plugin.runtime.remote.reliability.get.failed",
+        category: "runtime",
+        defaultSeverity: "fail",
+        summary: "The remote MCP GET streaming request could not be completed.",
+        why: "Clients cannot rely on server-to-client streaming when a bounded transport request fails.",
+        fix: "Keep the Streamable HTTP transport reachable within the configured request bounds.",
+        example: "Complete the GET request before the runtime timeout."
+    },
+    {
+        id: "plugin.runtime.remote.reliability.get.malformed",
+        category: "runtime",
+        defaultSeverity: "fail",
+        summary: "The remote MCP endpoint emitted malformed SSE framing.",
+        why: "Malformed event framing prevents clients from safely processing stream progress or reconnecting.",
+        fix: "Return complete SSE events with valid id and retry fields.",
+        example: "id: event-1\n\nevent: message\n\ndata: {}\n\n"
+    },
+    {
+        id: "plugin.runtime.remote.reliability.resume.status",
+        category: "runtime",
+        defaultSeverity: "fail",
+        summary: "The remote MCP endpoint rejected the SSE resume request.",
+        why: "Clients cannot resume a dropped stream when the reconnect response has an unexpected status.",
+        fix: "Return HTTP 200 for an accepted Last-Event-ID reconnect request.",
+        example: "HTTP/1.1 200 OK"
+    },
+    {
+        id: "plugin.runtime.remote.reliability.resume.content_type",
+        category: "runtime",
+        defaultSeverity: "fail",
+        summary: "The remote MCP endpoint returned a non-SSE media type for a resume request.",
+        why: "Clients cannot process a resumed stream unless it is declared as Server-Sent Events.",
+        fix: "Return Content-Type: text/event-stream after accepting a Last-Event-ID reconnect request.",
+        example: "Content-Type: text/event-stream"
+    },
+    {
+        id: "plugin.runtime.remote.reliability.resume.inconclusive",
+        category: "runtime",
+        defaultSeverity: "warn",
+        summary: "The remote MCP SSE resume check was inconclusive.",
+        why: "A bounded probe could not confirm a complete resumed event, so reconnect reliability remains uncertain.",
+        fix: "Emit complete SSE event frames after accepting a reconnect.",
+        example: "Return one complete SSE event after a Last-Event-ID request."
+    },
+    {
+        id: "plugin.runtime.remote.reliability.resume.failed",
+        category: "runtime",
+        defaultSeverity: "fail",
+        summary: "The remote MCP SSE resume request could not be completed.",
+        why: "Clients cannot recover from a dropped stream when a bounded reconnect fails.",
+        fix: "Accept one bounded SSE reconnect using Last-Event-ID.",
+        example: "Honor the Last-Event-ID header on one reconnect."
+    },
+    {
+        id: "plugin.runtime.remote.reliability.resume.malformed",
+        category: "runtime",
+        defaultSeverity: "fail",
+        summary: "The remote MCP endpoint emitted malformed SSE framing after reconnecting.",
+        why: "Malformed resumed events prevent clients from safely continuing stream processing.",
+        fix: "Return complete SSE events with valid id and retry fields after reconnecting.",
+        example: "Return a complete event frame after reconnecting."
+    },
+    {
+        id: "plugin.runtime.remote.reliability.session_restart.failed",
+        category: "runtime",
+        defaultSeverity: "fail",
+        summary: "The remote MCP session could not be restarted.",
+        why: "Clients cannot recover from an expired MCP session when a fresh initialization sequence fails.",
+        fix: "Accept a fresh initialize sequence after an expired MCP session.",
+        example: "Return a valid initialize response after HTTP 404 for a session-bound request."
+    },
+    {
+        id: "plugin.runtime.remote.reliability.termination.failed",
+        category: "runtime",
+        defaultSeverity: "fail",
+        summary: "The remote MCP session could not be terminated.",
+        why: "A server that advertises session lifecycle support must safely handle the approved termination request.",
+        fix: "Return a successful response or HTTP 405 for a bounded MCP session DELETE request.",
+        example: "HTTP/1.1 204 No Content"
     }
 ];
 export function findRuleDefinition(id) {

package/dist/run-cli.js

@@ -28,6 +28,7 @@ import { buildDoctorRuntimePolicyReport, renderDoctorRuntimePolicy, renderDoctor
 import { buildDoctorReviewBundle, diffDoctorReviewBundles, renderDoctorReviewBundle, renderDoctorReviewBundleDiff, renderDoctorReviewBundleDiffJson, renderDoctorReviewBundleJson, renderDoctorReviewBundleVerification, renderDoctorReviewBundleVerificationJson, verifyDoctorReviewBundle } from "./core/review-bundle.js";
 import { buildDoctorReleaseEvidenceAssetReport, buildDoctorReleaseEvidenceReport, renderDoctorReleaseEvidenceAsset, renderDoctorReleaseEvidenceAssetJson, renderDoctorReleaseEvidence, renderDoctorReleaseEvidenceJson, renderDoctorReleaseEvidenceVerification, renderDoctorReleaseEvidenceVerificationJson, verifyDoctorReleaseEvidence } from "./core/release-evidence.js";
 import { buildDoctorNpmPackageReport, renderDoctorNpmPackageReport, renderDoctorNpmPackageReportJson } from "./core/npm-package-doctor.js";
+import { buildMcpRegistryReadiness, inspectMcpRegistryServer, registryReadinessExitCode, renderMcpRegistryReadiness, renderMcpRegistryReadinessJson } from "./core/mcp-registry.js";
 import { buildDoctorRiskDiffReport, renderDoctorRiskDiffReport, renderDoctorRiskDiffReportJson } from "./core/risk-diff.js";
 import { buildDoctorInspectorReport, renderDoctorInspectorReport, renderDoctorInspectorReportJson } from "./core/inspector-bridge.js";
 import { applyFixPlan, buildFixPlan, renderApplyFixResult, renderFixPlanJsonReport, renderFixPlan } from "./core/fix-plan.js";
@@ -102,6 +103,8 @@ function parseRuntimeSandbox(flags, options = { requireRuntime: true }) {
 function parseRemoteNetworkFlags(flags, runtime) {
     let allowNetwork = false;
     let allowLocalNetwork = false;
+    let allowSessionLifecycle = false;
+    let requireRemoteReliability = false;
     for (let index = 0; index < flags.length; index += 1) {
         const flag = flags[index];
         if (flag === "--allow-network") {
@@ -120,23 +123,57 @@ function parseRemoteNetworkFlags(flags, runtime) {
             }
             allowLocalNetwork = true;
         }
-        else if (flag?.startsWith("--allow-network=") || flag?.startsWith("--allow-local-network=")) {
+        else if (flag === "--allow-session-lifecycle") {
+            if (allowSessionLifecycle)
+                return new CliUsageError("Duplicate runtime remote flag: --allow-session-lifecycle.");
+            if (flags[index + 1] && !flags[index + 1].startsWith("--")) {
+                return new CliUsageError("--allow-session-lifecycle does not accept a value.");
+            }
+            allowSessionLifecycle = true;
+        }
+        else if (flag === "--require-remote-reliability") {
+            if (requireRemoteReliability)
+                return new CliUsageError("Duplicate runtime remote flag: --require-remote-reliability.");
+            if (flags[index + 1] && !flags[index + 1].startsWith("--")) {
+                return new CliUsageError("--require-remote-reliability does not accept a value.");
+            }
+            requireRemoteReliability = true;
+        }
+        else if (flag?.startsWith("--allow-network=") ||
+            flag?.startsWith("--allow-local-network=") ||
+            flag?.startsWith("--allow-session-lifecycle=") ||
+            flag?.startsWith("--require-remote-reliability=")) {
             return new CliUsageError(`${flag.split("=", 1)[0]} does not accept a value.`);
         }
     }
+    if (allowSessionLifecycle && !runtime) {
+        return new CliUsageError("--allow-session-lifecycle requires --runtime.");
+    }
+    if (requireRemoteReliability && !runtime) {
+        return new CliUsageError("--require-remote-reliability requires --runtime and --allow-network.");
+    }
     if ((allowNetwork || allowLocalNetwork) && !runtime) {
         return new CliUsageError("--allow-network requires --runtime.");
     }
     if (allowLocalNetwork && !allowNetwork) {
         return new CliUsageError("--allow-local-network requires --allow-network.");
     }
-    return { allowNetwork, allowLocalNetwork };
+    if (allowSessionLifecycle && !allowNetwork) {
+        return new CliUsageError("--allow-session-lifecycle requires --allow-network.");
+    }
+    if (requireRemoteReliability && !allowNetwork) {
+        return new CliUsageError("--require-remote-reliability requires --runtime and --allow-network.");
+    }
+    return { allowNetwork, allowLocalNetwork, allowSessionLifecycle, requireRemoteReliability };
 }
 function printUsage(io) {
     io.writeStderr("Usage: codex-plugin-doctor check <path|--installed> [filter] [--policy codex-publish|mcp-strict|security] [--compat] [--json|--markdown|--badge-json|--badge-markdown] [--output <path>] [--history <path>] [--runtime [--allow-network [--allow-local-network]]] [--sandbox docker] [--require-runtime-approval --runtime-approval-digest <digest>] [--verbose-runtime] [--explain] [--no-animations] [--ascii] [--changed-since <ref>]\n       codex-plugin-doctor audit --installed [filter] [--policy codex-publish|mcp-strict|security] [--security] [--compat] [--json] [--output <path>] [--cache] [--changed]\n       codex-plugin-doctor audit deps <path> [--policy codex-publish|mcp-strict|security] [--recommend] [--json|--sarif] [--output <path>]\n       codex-plugin-doctor mcp <path> [--runtime [--allow-network [--allow-local-network]]] [--json] [--output <path>]\n       codex-plugin-doctor security <path> [--policy security] [--json|--scorecard]\n       codex-plugin-doctor compat <path> [--all|--client <client>] [--json] [--scorecard] [--output <path>] [--install-preview|--apply --backup]\n       codex-plugin-doctor suppress add <path> [--fingerprint <sha256> --reason <text> --expires-at YYYY-MM-DD] [--config <path>] [--json]\n       codex-plugin-doctor suppress list <path> [--config <path>] [--json]\n       codex-plugin-doctor suppress remove <path> [--fingerprint <sha256>|--index <n>] [--config <path>] [--json]\n       codex-plugin-doctor fix <path> (--dry-run|--interactive --backup|--apply --backup)\n       codex-plugin-doctor history <history.jsonl> [--json] [--fail-on-regression]\n       codex-plugin-doctor watch <path> [--runtime] [--json] [--output <path>] [--debounce-ms <ms>] [--max-iterations <n>] [--fail-fast] [--accumulate-json <path>]\n       codex-plugin-doctor doctor [npm <package>|contract|corpus [--manifest <corpus.json>] [--json] [--output <path>]|corpus metrics --manifest <corpus.json> [--json|--markdown] [--output <path>] [--min-precision <0..1>] [--min-recall <0..1>] [--max-false-positive-rate <0..1>]|runtime-plan <path> [--sandbox docker] [--json|--markdown] [--output <path>]|runtime-policy <path> [--sandbox docker] [--json] [--output <path>]|review-bundle <path> --output <dir> --sign-key-env NAME [--json] [--allow-dirty] [--allow-untagged]|review-bundle verify <bundle-dir> --target <path> --sign-key-env NAME [--json] [--output <path>] [--failures-only]|review-bundle diff --before <dir> --after <dir> [--json]|attest <path> [--sign-key-env NAME]|attest verify <attestation.json> --target <path> --sign-key-env NAME|release-evidence <path> --sign-key-env NAME [--runtime [--allow-network [--allow-local-network]]] [--sandbox docker] [--allow-dirty] [--allow-untagged] [--require-runtime-approval --runtime-approval-digest <digest>]|release-evidence verify <evidence.json> --target <path> --sign-key-env NAME|release-evidence asset <path> --tag <tag> --output <evidence.json> --sign-key-env NAME [--runtime [--allow-network [--allow-local-network]]] [--sandbox docker] [--allow-dirty] [--allow-untagged] [--require-runtime-approval --runtime-approval-digest <digest>] [--upload]|mcp <path> [--runtime [--allow-network [--allow-local-network]]]|inspector <path>|diff --before <path> --after <path>|recommend <path>|trust <path>|perf <path> [--max-total-ms <ms>] [--max-stage-ms stage=ms]|export --bundle <path>|snapshot|clients|--json|--update-check]\n       codex-plugin-doctor init [path] [--template skill-only|mcp-stdio|mcp-http|full-runtime]\n       codex-plugin-doctor init-ci [path]\n       codex-plugin-doctor init-git-hooks [path] [--force] [--json]\n       codex-plugin-doctor init-git-hooks [path] --remove [--json]\n       codex-plugin-doctor completion bash|zsh|fish\n       codex-plugin-doctor config validate <path> [--json]\n       codex-plugin-doctor release check <path> [--json] [--runtime [--allow-network [--allow-local-network]]] [--sandbox docker]\n       codex-plugin-doctor self-test\n       codex-plugin-doctor list --installed\n       codex-plugin-doctor explain <finding-id>\n       codex-plugin-doctor --version\n\nFirst run:\n       codex-plugin-doctor doctor\n       codex-plugin-doctor self-test\n       codex-plugin-doctor init my-plugin\n       codex-plugin-doctor check . --runtime --explain");
+    io.writeStderr("Registry readiness: codex-plugin-doctor registry check <server.json|directory> [--json] [--output <path>] [--require-registry-readiness]\n"
+        + "       codex-plugin-doctor registry inspect <server-name> --allow-network [--json] [--output <path>] [--require-registry-readiness]");
     io.writeStderr("Corpus quality regression: codex-plugin-doctor doctor corpus metrics diff --before <metrics.json> --after <metrics.json> [--fail-on-regression] [--json|--markdown] [--output <path>]");
     io.writeStderr("Suppression governance: codex-plugin-doctor suppress list <path> [--fail-on-expired] [--fail-on-invalid] [--warn-expiring-within-days <days>]\n       codex-plugin-doctor suppress prune <path> [--apply] [--json]");
     io.writeStderr("Baseline gating: codex-plugin-doctor baseline create <path> --output <path> [--runtime]\n       codex-plugin-doctor check <path> --baseline <path>");
+    io.writeStderr("Remote MCP runtime flags (check, mcp, release check, and doctor release-evidence): --runtime --allow-network [--allow-local-network] [--allow-session-lifecycle] [--require-remote-reliability]\n       --allow-session-lifecycle requires --runtime --allow-network and can terminate a remote session.\n       --require-remote-reliability requires --runtime --allow-network, blocks non-pass reliability, and does not grant network consent.");
 }
 const suppressUsageText = [
     "Usage:",
@@ -687,6 +724,8 @@ function buildGenericMcpDoctorCommandArgs(commandTarget, flags) {
     let runtime = false;
     let allowNetwork = false;
     let allowLocalNetwork = false;
+    let allowSessionLifecycle = false;
+    let requireRemoteReliability = false;
     for (let index = 0; index < flags.length; index += 1) {
         const flag = flags[index];
         if (flag === "--runtime") {
@@ -715,6 +754,26 @@ function buildGenericMcpDoctorCommandArgs(commandTarget, flags) {
             allowLocalNetwork = true;
             continue;
         }
+        if (flag === "--allow-session-lifecycle") {
+            if (flags[index + 1] && !flags[index + 1].startsWith("--")) {
+                return "--allow-session-lifecycle does not accept a value.";
+            }
+            allowSessionLifecycle = true;
+            continue;
+        }
+        if (flag === "--require-remote-reliability") {
+            if (flags[index + 1] && !flags[index + 1].startsWith("--")) {
+                return "--require-remote-reliability does not accept a value.";
+            }
+            requireRemoteReliability = true;
+            continue;
+        }
+        if (flag.startsWith("--allow-network=") ||
+            flag.startsWith("--allow-local-network=") ||
+            flag.startsWith("--allow-session-lifecycle=") ||
+            flag.startsWith("--require-remote-reliability=")) {
+            return `${flag.split("=", 1)[0]} does not accept a value.`;
+        }
         if (flag === "--output") {
             if (outputPath !== null) {
                 return "Duplicate MCP flag: --output.";
@@ -740,8 +799,10 @@ function buildGenericMcpDoctorCommandArgs(commandTarget, flags) {
         jsonOutput,
         outputPath,
         runtime,
-        allowNetwork,
-        allowLocalNetwork
+        allowNetwork: remoteNetwork.allowNetwork,
+        allowLocalNetwork: remoteNetwork.allowLocalNetwork,
+        allowSessionLifecycle,
+        requireRemoteReliability
     };
 }
 function parsePerformanceThresholds(flags) {
@@ -1031,7 +1092,9 @@ export async function runCli(args, io = defaultIo, options = {}) {
             }, {
                 runtime: parsedMcpArgs.runtime,
                 allowNetwork: parsedMcpArgs.allowNetwork,
-                allowLocalNetwork: parsedMcpArgs.allowLocalNetwork
+                allowLocalNetwork: parsedMcpArgs.allowLocalNetwork,
+                allowSessionLifecycle: parsedMcpArgs.allowSessionLifecycle,
+                requireRemoteReliability: parsedMcpArgs.requireRemoteReliability
             });
             const renderedReport = parsedMcpArgs.jsonOutput
                 ? renderGenericMcpDoctorJson(report)
@@ -1344,6 +1407,8 @@ export async function runCli(args, io = defaultIo, options = {}) {
                     runtime,
                     ...(remoteNetwork.allowNetwork ? { allowNetwork: true } : {}),
                     ...(remoteNetwork.allowLocalNetwork ? { allowLocalNetwork: true } : {}),
+                    ...(remoteNetwork.allowSessionLifecycle ? { allowSessionLifecycle: true } : {}),
+                    ...(remoteNetwork.requireRemoteReliability ? { requireRemoteReliability: true } : {}),
                     ...(runtimeSandbox ? { sandbox: runtimeSandbox } : {}),
                     environment: {
                         env: terminalContext.env,
@@ -1507,6 +1572,8 @@ export async function runCli(args, io = defaultIo, options = {}) {
                 runtime,
                 ...(remoteNetwork.allowNetwork ? { allowNetwork: true } : {}),
                 ...(remoteNetwork.allowLocalNetwork ? { allowLocalNetwork: true } : {}),
+                ...(remoteNetwork.allowSessionLifecycle ? { allowSessionLifecycle: true } : {}),
+                ...(remoteNetwork.requireRemoteReliability ? { requireRemoteReliability: true } : {}),
                 ...(runtimeSandbox ? { sandbox: runtimeSandbox } : {}),
                 environment: {
                     env: terminalContext.env,
@@ -2292,6 +2359,65 @@ export async function runCli(args, io = defaultIo, options = {}) {
             : renderApplyFixResult(result));
         return 0;
     }
+    if (command === "registry") {
+        const subcommand = maybePath;
+        const target = remainingArgs[0];
+        const flags = remainingArgs.slice(1);
+        if ((subcommand !== "check" && subcommand !== "inspect") || !target || target.startsWith("--")) {
+            io.writeStderr("Usage: codex-plugin-doctor registry check <server.json|directory> [--json] [--output <path>] [--require-registry-readiness]\n"
+                + "       codex-plugin-doctor registry inspect <server-name> --allow-network [--json] [--output <path>] [--require-registry-readiness]");
+            return 2;
+        }
+        const allowedFlags = new Set([
+            "--json",
+            "--output",
+            "--allow-network",
+            "--require-registry-readiness"
+        ]);
+        let outputPath = null;
+        for (let index = 0; index < flags.length; index += 1) {
+            const flag = flags[index];
+            if (!allowedFlags.has(flag)) {
+                io.writeStderr(`Unknown registry flag: ${flag}.`);
+                return 2;
+            }
+            if (flag === "--output") {
+                const value = flags[index + 1];
+                if (!value || value.startsWith("--")) {
+                    io.writeStderr("Missing path after --output.");
+                    return 2;
+                }
+                outputPath = value;
+                index += 1;
+            }
+        }
+        const allowNetwork = flags.includes("--allow-network");
+        if (subcommand === "check" && allowNetwork) {
+            io.writeStderr("--allow-network is supported only by registry inspect.");
+            return 2;
+        }
+        if (subcommand === "inspect" && !allowNetwork) {
+            io.writeStderr("registry inspect requires explicit --allow-network consent.");
+            return 2;
+        }
+        try {
+            const report = subcommand === "check"
+                ? await buildMcpRegistryReadiness(target)
+                : await inspectMcpRegistryServer(target, { allowNetwork: true });
+            const rendered = flags.includes("--json")
+                ? renderMcpRegistryReadinessJson(report)
+                : renderMcpRegistryReadiness(report);
+            if (outputPath) {
+                await writeFile(outputPath, rendered, "utf8");
+            }
+            io.writeStdout(rendered);
+            return registryReadinessExitCode(report, flags.includes("--require-registry-readiness"));
+        }
+        catch (error) {
+            io.writeStderr(`Registry inspection failed: ${error.message}`);
+            return 1;
+        }
+    }
     if (command === "security") {
         if (!maybePath || maybePath.startsWith("--")) {
             io.writeStderr("Missing target path. Usage: codex-plugin-doctor security <path> [--json|--scorecard]");
@@ -2332,7 +2458,9 @@ export async function runCli(args, io = defaultIo, options = {}) {
         }, {
             runtime: parsedMcpArgs.runtime,
             allowNetwork: parsedMcpArgs.allowNetwork,
-            allowLocalNetwork: parsedMcpArgs.allowLocalNetwork
+            allowLocalNetwork: parsedMcpArgs.allowLocalNetwork,
+            allowSessionLifecycle: parsedMcpArgs.allowSessionLifecycle,
+            requireRemoteReliability: parsedMcpArgs.requireRemoteReliability
         });
         const renderedReport = parsedMcpArgs.jsonOutput
             ? renderGenericMcpDoctorJson(report)
@@ -2653,6 +2781,8 @@ export async function runCli(args, io = defaultIo, options = {}) {
             runtime: runtimeProbeEnabled,
             ...(remoteNetwork.allowNetwork ? { allowNetwork: true } : {}),
             ...(remoteNetwork.allowLocalNetwork ? { allowLocalNetwork: true } : {}),
+            ...(remoteNetwork.allowSessionLifecycle ? { allowSessionLifecycle: true } : {}),
+            ...(remoteNetwork.requireRemoteReliability ? { requireRemoteReliability: true } : {}),
             ...(runtimeSandbox ? { runtimeSandbox } : {}),
             runCheck: options.runCheckImpl
         });
@@ -2867,6 +2997,8 @@ export async function runCli(args, io = defaultIo, options = {}) {
                     runtime: effectiveRuntimeProbeEnabled,
                     ...(remoteNetwork.allowNetwork ? { allowNetwork: true } : {}),
                     ...(remoteNetwork.allowLocalNetwork ? { allowLocalNetwork: true } : {}),
+                    ...(remoteNetwork.allowSessionLifecycle ? { allowSessionLifecycle: true } : {}),
+                    ...(remoteNetwork.requireRemoteReliability ? { requireRemoteReliability: true } : {}),
                     runtimeTranscript: effectiveRuntimeProbeEnabled && verboseRuntime
                         ? (line) => io.writeStderr(line)
                         : undefined
@@ -2938,7 +3070,9 @@ export async function runCli(args, io = defaultIo, options = {}) {
                 const pluginResult = applyDoctorConfig(await runCheckImpl(pluginRoot, {
                     runtime: effectiveRuntimeProbeEnabled,
                     ...(remoteNetwork.allowNetwork ? { allowNetwork: true } : {}),
-                    ...(remoteNetwork.allowLocalNetwork ? { allowLocalNetwork: true } : {})
+                    ...(remoteNetwork.allowLocalNetwork ? { allowLocalNetwork: true } : {}),
+                    ...(remoteNetwork.allowSessionLifecycle ? { allowSessionLifecycle: true } : {}),
+                    ...(remoteNetwork.requireRemoteReliability ? { requireRemoteReliability: true } : {})
                 }), applyPolicyToDoctorConfig(applyCheckProfile(await loadDoctorConfig(pluginRoot, configPath), checkProfile), policy));
                 io.writeStdout(`\n${pluginResult.targetPath}: ${pluginResult.status.toUpperCase()}`);
                 validatedCount += 1;
@@ -2962,6 +3096,8 @@ export async function runCli(args, io = defaultIo, options = {}) {
         runtime: effectiveRuntimeProbeEnabled,
         ...(remoteNetwork.allowNetwork ? { allowNetwork: true } : {}),
         ...(remoteNetwork.allowLocalNetwork ? { allowLocalNetwork: true } : {}),
+        ...(remoteNetwork.allowSessionLifecycle ? { allowSessionLifecycle: true } : {}),
+        ...(remoteNetwork.requireRemoteReliability ? { requireRemoteReliability: true } : {}),
         ...(runtimeSandbox ? { runtimeSandbox } : {}),
         ...(effectiveRuntimeProbeEnabled && verboseRuntime
             ? { runtimeTranscript: (line) => io.writeStderr(line) }