codex-plugin-doctor 1.53.0 → 1.55.0

package/dist/run-cli.js

@@ -28,6 +28,8 @@ import { buildDoctorRuntimePolicyReport, renderDoctorRuntimePolicy, renderDoctor
 import { buildDoctorReviewBundle, diffDoctorReviewBundles, renderDoctorReviewBundle, renderDoctorReviewBundleDiff, renderDoctorReviewBundleDiffJson, renderDoctorReviewBundleJson, renderDoctorReviewBundleVerification, renderDoctorReviewBundleVerificationJson, verifyDoctorReviewBundle } from "./core/review-bundle.js";
 import { buildDoctorReleaseEvidenceAssetReport, buildDoctorReleaseEvidenceReport, renderDoctorReleaseEvidenceAsset, renderDoctorReleaseEvidenceAssetJson, renderDoctorReleaseEvidence, renderDoctorReleaseEvidenceJson, renderDoctorReleaseEvidenceVerification, renderDoctorReleaseEvidenceVerificationJson, verifyDoctorReleaseEvidence } from "./core/release-evidence.js";
 import { buildDoctorNpmPackageReport, renderDoctorNpmPackageReport, renderDoctorNpmPackageReportJson } from "./core/npm-package-doctor.js";
+import { buildMcpRegistryReadiness, inspectMcpRegistryServer, registryReadinessExitCode, renderMcpRegistryReadiness, renderMcpRegistryReadinessJson } from "./core/mcp-registry.js";
+import { buildMcpRegistryPublicationPreflight, registryPublicationPreflightExitCode, renderMcpRegistryPublicationPreflight, renderMcpRegistryPublicationPreflightJson } from "./core/mcp-registry-preflight.js";
 import { buildDoctorRiskDiffReport, renderDoctorRiskDiffReport, renderDoctorRiskDiffReportJson } from "./core/risk-diff.js";
 import { buildDoctorInspectorReport, renderDoctorInspectorReport, renderDoctorInspectorReportJson } from "./core/inspector-bridge.js";
 import { applyFixPlan, buildFixPlan, renderApplyFixResult, renderFixPlanJsonReport, renderFixPlan } from "./core/fix-plan.js";
@@ -167,6 +169,9 @@ function parseRemoteNetworkFlags(flags, runtime) {
 }
 function printUsage(io) {
     io.writeStderr("Usage: codex-plugin-doctor check <path|--installed> [filter] [--policy codex-publish|mcp-strict|security] [--compat] [--json|--markdown|--badge-json|--badge-markdown] [--output <path>] [--history <path>] [--runtime [--allow-network [--allow-local-network]]] [--sandbox docker] [--require-runtime-approval --runtime-approval-digest <digest>] [--verbose-runtime] [--explain] [--no-animations] [--ascii] [--changed-since <ref>]\n       codex-plugin-doctor audit --installed [filter] [--policy codex-publish|mcp-strict|security] [--security] [--compat] [--json] [--output <path>] [--cache] [--changed]\n       codex-plugin-doctor audit deps <path> [--policy codex-publish|mcp-strict|security] [--recommend] [--json|--sarif] [--output <path>]\n       codex-plugin-doctor mcp <path> [--runtime [--allow-network [--allow-local-network]]] [--json] [--output <path>]\n       codex-plugin-doctor security <path> [--policy security] [--json|--scorecard]\n       codex-plugin-doctor compat <path> [--all|--client <client>] [--json] [--scorecard] [--output <path>] [--install-preview|--apply --backup]\n       codex-plugin-doctor suppress add <path> [--fingerprint <sha256> --reason <text> --expires-at YYYY-MM-DD] [--config <path>] [--json]\n       codex-plugin-doctor suppress list <path> [--config <path>] [--json]\n       codex-plugin-doctor suppress remove <path> [--fingerprint <sha256>|--index <n>] [--config <path>] [--json]\n       codex-plugin-doctor fix <path> (--dry-run|--interactive --backup|--apply --backup)\n       codex-plugin-doctor history <history.jsonl> [--json] [--fail-on-regression]\n       codex-plugin-doctor watch <path> [--runtime] [--json] [--output <path>] [--debounce-ms <ms>] [--max-iterations <n>] [--fail-fast] [--accumulate-json <path>]\n       codex-plugin-doctor doctor [npm <package>|contract|corpus [--manifest <corpus.json>] [--json] [--output <path>]|corpus metrics --manifest <corpus.json> [--json|--markdown] [--output <path>] [--min-precision <0..1>] [--min-recall <0..1>] [--max-false-positive-rate <0..1>]|runtime-plan <path> [--sandbox docker] [--json|--markdown] [--output <path>]|runtime-policy <path> [--sandbox docker] [--json] [--output <path>]|review-bundle <path> --output <dir> --sign-key-env NAME [--json] [--allow-dirty] [--allow-untagged]|review-bundle verify <bundle-dir> --target <path> --sign-key-env NAME [--json] [--output <path>] [--failures-only]|review-bundle diff --before <dir> --after <dir> [--json]|attest <path> [--sign-key-env NAME]|attest verify <attestation.json> --target <path> --sign-key-env NAME|release-evidence <path> --sign-key-env NAME [--runtime [--allow-network [--allow-local-network]]] [--sandbox docker] [--allow-dirty] [--allow-untagged] [--require-runtime-approval --runtime-approval-digest <digest>]|release-evidence verify <evidence.json> --target <path> --sign-key-env NAME|release-evidence asset <path> --tag <tag> --output <evidence.json> --sign-key-env NAME [--runtime [--allow-network [--allow-local-network]]] [--sandbox docker] [--allow-dirty] [--allow-untagged] [--require-runtime-approval --runtime-approval-digest <digest>] [--upload]|mcp <path> [--runtime [--allow-network [--allow-local-network]]]|inspector <path>|diff --before <path> --after <path>|recommend <path>|trust <path>|perf <path> [--max-total-ms <ms>] [--max-stage-ms stage=ms]|export --bundle <path>|snapshot|clients|--json|--update-check]\n       codex-plugin-doctor init [path] [--template skill-only|mcp-stdio|mcp-http|full-runtime]\n       codex-plugin-doctor init-ci [path]\n       codex-plugin-doctor init-git-hooks [path] [--force] [--json]\n       codex-plugin-doctor init-git-hooks [path] --remove [--json]\n       codex-plugin-doctor completion bash|zsh|fish\n       codex-plugin-doctor config validate <path> [--json]\n       codex-plugin-doctor release check <path> [--json] [--runtime [--allow-network [--allow-local-network]]] [--sandbox docker]\n       codex-plugin-doctor self-test\n       codex-plugin-doctor list --installed\n       codex-plugin-doctor explain <finding-id>\n       codex-plugin-doctor --version\n\nFirst run:\n       codex-plugin-doctor doctor\n       codex-plugin-doctor self-test\n       codex-plugin-doctor init my-plugin\n       codex-plugin-doctor check . --runtime --explain");
+    io.writeStderr("Registry readiness: codex-plugin-doctor registry check <server.json|directory> [--json] [--output <path>] [--require-registry-readiness]\n"
+        + "       codex-plugin-doctor registry inspect <server-name> --allow-network [--json] [--output <path>] [--require-registry-readiness]\n"
+        + "Registry publication preflight: codex-plugin-doctor registry preflight <server.json|directory> [--allow-network] [--json] [--output <path>] [--require-publish-ready]");
     io.writeStderr("Corpus quality regression: codex-plugin-doctor doctor corpus metrics diff --before <metrics.json> --after <metrics.json> [--fail-on-regression] [--json|--markdown] [--output <path>]");
     io.writeStderr("Suppression governance: codex-plugin-doctor suppress list <path> [--fail-on-expired] [--fail-on-invalid] [--warn-expiring-within-days <days>]\n       codex-plugin-doctor suppress prune <path> [--apply] [--json]");
     io.writeStderr("Baseline gating: codex-plugin-doctor baseline create <path> --output <path> [--runtime]\n       codex-plugin-doctor check <path> --baseline <path>");
@@ -2356,6 +2361,91 @@ export async function runCli(args, io = defaultIo, options = {}) {
             : renderApplyFixResult(result));
         return 0;
     }
+    if (command === "registry") {
+        const subcommand = maybePath;
+        const target = remainingArgs[0];
+        const flags = remainingArgs.slice(1);
+        if ((subcommand !== "check" && subcommand !== "inspect" && subcommand !== "preflight") || !target || target.startsWith("--")) {
+            io.writeStderr("Usage: codex-plugin-doctor registry check <server.json|directory> [--json] [--output <path>] [--require-registry-readiness]\n"
+                + "       codex-plugin-doctor registry inspect <server-name> --allow-network [--json] [--output <path>] [--require-registry-readiness]\n"
+                + "       codex-plugin-doctor registry preflight <server.json|directory> [--allow-network] [--json] [--output <path>] [--require-publish-ready]");
+            return 2;
+        }
+        const allowedFlags = new Set([
+            "--json",
+            "--output",
+            "--allow-network",
+            "--require-registry-readiness",
+            "--require-publish-ready"
+        ]);
+        let outputPath = null;
+        for (let index = 0; index < flags.length; index += 1) {
+            const flag = flags[index];
+            if (!allowedFlags.has(flag)) {
+                io.writeStderr(`Unknown registry flag: ${flag}.`);
+                return 2;
+            }
+            if (flag === "--output") {
+                const value = flags[index + 1];
+                if (!value || value.startsWith("--")) {
+                    io.writeStderr("Missing path after --output.");
+                    return 2;
+                }
+                outputPath = value;
+                index += 1;
+            }
+        }
+        const allowNetwork = flags.includes("--allow-network");
+        if (subcommand === "check" && allowNetwork) {
+            io.writeStderr("--allow-network is not supported by registry check.");
+            return 2;
+        }
+        if (subcommand === "inspect" && !allowNetwork) {
+            io.writeStderr("registry inspect requires explicit --allow-network consent.");
+            return 2;
+        }
+        if (subcommand === "preflight" && flags.includes("--require-registry-readiness")) {
+            io.writeStderr("--require-registry-readiness is supported only by registry check or registry inspect.");
+            return 2;
+        }
+        if (subcommand !== "preflight" && flags.includes("--require-publish-ready")) {
+            io.writeStderr("--require-publish-ready is supported only by registry preflight.");
+            return 2;
+        }
+        try {
+            if (subcommand === "preflight") {
+                const report = await buildMcpRegistryPublicationPreflight(target, { allowNetwork });
+                const rendered = flags.includes("--json")
+                    ? renderMcpRegistryPublicationPreflightJson(report)
+                    : renderMcpRegistryPublicationPreflight(report);
+                if (outputPath) {
+                    await writeFile(outputPath, rendered, "utf8");
+                }
+                io.writeStdout(rendered);
+                return registryPublicationPreflightExitCode(report, flags.includes("--require-publish-ready"));
+            }
+            const report = subcommand === "check"
+                ? await buildMcpRegistryReadiness(target)
+                : await inspectMcpRegistryServer(target, { allowNetwork: true });
+            const rendered = flags.includes("--json")
+                ? renderMcpRegistryReadinessJson(report)
+                : renderMcpRegistryReadiness(report);
+            if (outputPath) {
+                await writeFile(outputPath, rendered, "utf8");
+            }
+            io.writeStdout(rendered);
+            return registryReadinessExitCode(report, flags.includes("--require-registry-readiness"));
+        }
+        catch (error) {
+            if (subcommand === "preflight") {
+                io.writeStderr("Registry publication preflight failed.");
+            }
+            else {
+                io.writeStderr(`Registry inspection failed: ${error.message}`);
+            }
+            return 1;
+        }
+    }
     if (command === "security") {
         if (!maybePath || maybePath.startsWith("--")) {
             io.writeStderr("Missing target path. Usage: codex-plugin-doctor security <path> [--json|--scorecard]");

package/examples/README.md

@@ -1,94 +1,94 @@
-# Examples
-
-This folder contains manual example packs for local testing. Unlike `tests/fixtures`, these examples are meant for humans to run directly against the CLI.
-
-## Example Packs
-
-Use the smallest example that matches what you need to prove:
-
-- `codex-doctor-starter` for static manifest and skill validation.
-- `codex-doctor-runtime` for full MCP runtime probing and compatibility scoring.
-- `codex-doctor-risky` for security finding output.
-- `codex-doctor-generic-mcp` for MCP-only packages without a Codex plugin manifest.
-
-### `codex-doctor-starter`
-
-Minimal valid Codex plugin package with one skill and no runtime MCP server.
-
-Expected result:
-
-- static validation passes
-- no runtime probing needed
-
-Command:
-
-```bash
-codex-plugin-doctor check examples/codex-doctor-starter
-```
-
-### `codex-doctor-runtime`
-
-Valid Codex plugin package with:
-
-- skill metadata
-- `.mcp.json`
-- mock MCP stdio server
-- `tools/list`
-- `tools/call`
-- `resources/list`
-- `resources/read`
-- `resources/templates/list`
-- `prompts/list`
-- `prompts/get`
-
-Expected result:
-
-- static validation passes
-- runtime validation passes
-- runtime scorecard shows all supported runtime capabilities as `pass`
-
-Command:
-
-```bash
-codex-plugin-doctor check examples/codex-doctor-runtime --json --runtime --verbose-runtime
-```
-
-### `codex-doctor-risky`
-
-Intentionally flawed package for showing failure output.
-
-Expected result:
-
-- security finding for hard-coded secret
-
-Command:
-
-```bash
-codex-plugin-doctor check examples/codex-doctor-risky --ascii
-```
-
-### `codex-doctor-generic-mcp`
-
-Generic MCP package with a `.mcp.json` file and no Codex plugin manifest.
-
-Expected result:
-
-- `codex-plugin-doctor mcp` passes generic MCP static health checks
-- `codex-plugin-doctor check` still reports the missing Codex plugin manifest
-
-Command:
-
-```bash
-codex-plugin-doctor mcp examples/codex-doctor-generic-mcp
-```
-
-## Suggested Local Flow
-
-```bash
-npm install
-npm run build
-npm link
-codex-plugin-doctor check examples/codex-doctor-starter
-codex-plugin-doctor check examples/codex-doctor-runtime --json --runtime --verbose-runtime
-codex-plugin-doctor check examples/codex-doctor-risky --ascii
-```
+# Examples
+
+This folder contains manual example packs for local testing. Unlike `tests/fixtures`, these examples are meant for humans to run directly against the CLI.
+
+## Example Packs
+
+Use the smallest example that matches what you need to prove:
+
+- `codex-doctor-starter` for static manifest and skill validation.
+- `codex-doctor-runtime` for full MCP runtime probing and compatibility scoring.
+- `codex-doctor-risky` for security finding output.
+- `codex-doctor-generic-mcp` for MCP-only packages without a Codex plugin manifest.
+
+### `codex-doctor-starter`
+
+Minimal valid Codex plugin package with one skill and no runtime MCP server.
+
+Expected result:
+
+- static validation passes
+- no runtime probing needed
+
+Command:
+
+```bash
+codex-plugin-doctor check examples/codex-doctor-starter
+```
+
+### `codex-doctor-runtime`
+
+Valid Codex plugin package with:
+
+- skill metadata
+- `.mcp.json`
+- mock MCP stdio server
+- `tools/list`
+- `tools/call`
+- `resources/list`
+- `resources/read`
+- `resources/templates/list`
+- `prompts/list`
+- `prompts/get`
+
+Expected result:
+
+- static validation passes
+- runtime validation passes
+- runtime scorecard shows all supported runtime capabilities as `pass`
+
+Command:
+
+```bash
+codex-plugin-doctor check examples/codex-doctor-runtime --json --runtime --verbose-runtime
+```
+
+### `codex-doctor-risky`
+
+Intentionally flawed package for showing failure output.
+
+Expected result:
+
+- security finding for hard-coded secret
+
+Command:
+
+```bash
+codex-plugin-doctor check examples/codex-doctor-risky --ascii
+```
+
+### `codex-doctor-generic-mcp`
+
+Generic MCP package with a `.mcp.json` file and no Codex plugin manifest.
+
+Expected result:
+
+- `codex-plugin-doctor mcp` passes generic MCP static health checks
+- `codex-plugin-doctor check` still reports the missing Codex plugin manifest
+
+Command:
+
+```bash
+codex-plugin-doctor mcp examples/codex-doctor-generic-mcp
+```
+
+## Suggested Local Flow
+
+```bash
+npm install
+npm run build
+npm link
+codex-plugin-doctor check examples/codex-doctor-starter
+codex-plugin-doctor check examples/codex-doctor-runtime --json --runtime --verbose-runtime
+codex-plugin-doctor check examples/codex-doctor-risky --ascii
+```

package/examples/codex-doctor-generic-mcp/.mcp.json

@@ -1,10 +1,10 @@
-{
-  "mcpServers": {
-    "genericRuntime": {
-      "command": "node",
-      "args": [
-        "server.js"
-      ]
-    }
-  }
-}
+{
+  "mcpServers": {
+    "genericRuntime": {
+      "command": "node",
+      "args": [
+        "server.js"
+      ]
+    }
+  }
+}

package/examples/codex-doctor-generic-mcp/server.js

@@ -1 +1 @@
-process.stdin.resume();
+process.stdin.resume();

package/examples/codex-doctor-risky/.codex-plugin/plugin.json

@@ -1,7 +1,7 @@
-{
-  "name": "codex-doctor-risky",
-  "version": "1.0.0",
-  "description": "Intentionally risky sample package for showing Codex Doctor failure output.",
-  "mcpServers": "./.mcp.json"
-}
-
+{
+  "name": "codex-doctor-risky",
+  "version": "1.0.0",
+  "description": "Intentionally risky sample package for showing Codex Doctor failure output.",
+  "mcpServers": "./.mcp.json"
+}
+

package/examples/codex-doctor-risky/.mcp.json

@@ -1,12 +1,12 @@
-{
-  "mcpServers": {
-    "dangerServer": {
-      "command": "node",
-      "args": ["./mock-server.js"],
-      "env": {
-        "OPENAI_API_KEY": "sk-live-example-secret-value"
-      }
-    }
-  }
-}
-
+{
+  "mcpServers": {
+    "dangerServer": {
+      "command": "node",
+      "args": ["./mock-server.js"],
+      "env": {
+        "OPENAI_API_KEY": "sk-live-example-secret-value"
+      }
+    }
+  }
+}
+

package/examples/codex-doctor-risky/mock-server.js

@@ -1 +1 @@
-process.stdin.resume();
+process.stdin.resume();

package/examples/codex-doctor-runtime/.codex-plugin/plugin.json

@@ -1,8 +1,8 @@
-{
-  "name": "codex-doctor-runtime",
-  "version": "1.0.0",
-  "description": "Runtime-complete Codex Doctor sample plugin with MCP validation coverage.",
-  "skills": "./skills/",
-  "mcpServers": "./.mcp.json"
-}
-
+{
+  "name": "codex-doctor-runtime",
+  "version": "1.0.0",
+  "description": "Runtime-complete Codex Doctor sample plugin with MCP validation coverage.",
+  "skills": "./skills/",
+  "mcpServers": "./.mcp.json"
+}
+

package/examples/codex-doctor-runtime/.mcp.json

@@ -1,9 +1,9 @@
-{
-  "mcpServers": {
-    "doctorRuntime": {
-      "command": "node",
-      "args": ["./mock-server.js"]
-    }
-  }
-}
-
+{
+  "mcpServers": {
+    "doctorRuntime": {
+      "command": "node",
+      "args": ["./mock-server.js"]
+    }
+  }
+}
+