codex-plugin-doctor 1.77.0 → 1.79.0

package/dist/reporting/render-mcp-resource-template-diff-markdown.js

@@ -0,0 +1,39 @@
+import { markdownCodeSpan } from "./quote-server-text.js";
+import { describeResourceTemplateLocation } from "./render-mcp-resource-template-file-report.js";
+function count(value) {
+    return value === null || value === undefined ? "not compared" : String(value);
+}
+function templateIndex(value) {
+    return value === null ? "-" : String(value);
+}
+export function renderMcpResourceTemplateDiffMarkdown(report) {
+    const comparison = report.comparison;
+    const named = report.changes.some((change) => change.name !== undefined);
+    const lines = [
+        "## MCP Resource Template Definition Diff",
+        "",
+        `**Status:** \`${report.status}\` · **Comparison complete:** ${comparison.complete ? "yes" : "no"}${comparison.reason === null ? "" : ` · **Reason:** \`${comparison.reason}\``}`,
+        "",
+        "| Added | Removed | Changed | Unchanged | Breaking | Unclassified |",
+        "| --- | --- | --- | --- | --- | --- |",
+        `| ${count(comparison.added)} | ${count(comparison.removed)} | ${count(comparison.changed)} | ${count(comparison.unchanged)} | ${count(comparison.breaking)} | ${count(comparison.unclassified)} |`
+    ];
+    if (report.changes.length > 0) {
+        lines.push("", "### Changes", "", named ? "| Change | Template | Before template | After template | Fields | Impact | Reasons |" : "| Change | Before template | After template | Fields | Impact | Reasons |", named ? "| --- | --- | --- | --- | --- | --- | --- |" : "| --- | --- | --- | --- | --- | --- |", ...report.changes.map((change) => `| ${change.kind}${named ? ` | ${change.name === undefined ? "-" : markdownCodeSpan(change.name)}` : ""} | ${templateIndex(change.beforeTemplateIndex)} | ${templateIndex(change.afterTemplateIndex)} | ${change.fields.map((field) => `\`${field}\``).join(", ") || "-"} | **${change.impact}** | ${change.reasons.map((reason) => `\`${reason}\``).join(", ") || "-"} |`));
+    }
+    const located = report.changes.flatMap((change) => (change.locations ?? []).map((location) => `| ${change.name === undefined ? "-" : markdownCodeSpan(change.name)} | \`${location.reason}\` | ${location.variable === null ? "-" : markdownCodeSpan(location.variable)} |`));
+    if (located.length > 0) {
+        lines.push("", "### Locations", "", "| Template | Reason | Variable |", "| --- | --- | --- |", ...located);
+    }
+    const findings = ["before", "after"].flatMap((side) => report[side].findings.map((finding) => {
+        const locator = finding.location ? `${side} ${describeResourceTemplateLocation(finding.location)}` : side;
+        return `| ${finding.severity} | \`${finding.id}\` | ${locator} | ${finding.message} |`;
+    }));
+    if (findings.length > 0) {
+        lines.push("", "### Input Findings", "", "| Severity | Finding | Location | Message |", "| --- | --- | --- | --- |", ...findings);
+    }
+    lines.push("", named
+        ? `Template and variable names are shown because --show-names was used; URI templates, descriptions, and other values are not reported. Impact labels are ${report.coverage.impactClassification} URI template checks, not proof of compatibility.`
+        : `Template numbers are one-based positions in the before and after files; names, URI templates, and descriptions are not reported. Impact labels are ${report.coverage.impactClassification} URI template checks, not proof of compatibility.`);
+    return lines.join("\n");
+}

package/dist/reporting/render-mcp-resource-template-diff-report.d.ts

@@ -0,0 +1,2 @@
+import type { McpResourceTemplateDiffReport } from "../core/mcp-resource-template-diff.js";
+export declare function renderMcpResourceTemplateDiffReport(report: McpResourceTemplateDiffReport): string;

package/dist/reporting/render-mcp-resource-template-diff-report.js

@@ -0,0 +1,48 @@
+import { describeResourceTemplateLocation } from "./render-mcp-resource-template-file-report.js";
+import { quoteServerText } from "./quote-server-text.js";
+export function renderMcpResourceTemplateDiffReport(report) {
+    const comparison = report.comparison;
+    return [
+        "Offline MCP Resource Template Diff",
+        "==================================",
+        `Status: ${report.status}`,
+        `Scope: ${report.scope}`,
+        `Comparison complete: ${comparison.complete}`,
+        ...(comparison.reason === null ? [] : [`Reason: ${comparison.reason}`]),
+        `Added: ${comparison.added ?? "not compared"}`,
+        `Removed: ${comparison.removed ?? "not compared"}`,
+        `Changed: ${comparison.changed ?? "not compared"}`,
+        `Unchanged: ${comparison.unchanged ?? "not compared"}`,
+        `Breaking: ${comparison.breaking ?? "not compared"}`,
+        `Unclassified: ${comparison.unclassified ?? "not compared"}`,
+        `Comparison coverage: ${report.coverage.comparison}`,
+        `Definition coverage: ${report.coverage.definitions}`,
+        `Compatibility: ${report.coverage.compatibility}`,
+        `Server catalog: ${report.coverage.serverCatalog}`,
+        `Resource read: ${report.coverage.resourceRead}`,
+        `Impact classification: ${report.coverage.impactClassification}`,
+        "Only the supplied responses are compared. Impact labels are URI template heuristics: a compatible label or an unchanged result does not establish compatibility.",
+        ...["before", "after"].flatMap((side) => {
+            const source = report[side];
+            const label = side === "before" ? "Before" : "After";
+            return [
+                `${label} input: ${source.status}; templates checked: ${source.inspection.templatesChecked}; bytes read: ${source.source.bytesRead}`,
+                ...(source.inspection.reason === null ? [] : [`${label} reason: ${source.inspection.reason}`]),
+                ...source.findings.map((finding) => {
+                    const locator = finding.location ? ` [${side} ${describeResourceTemplateLocation(finding.location)}]` : "";
+                    return `${label} ${finding.severity.toUpperCase()} ${finding.id}${locator}: ${finding.message}\n  ${finding.suggestedFix}`;
+                })
+            ];
+        }),
+        ...report.changes.map((change) => {
+            const locations = [
+                ...(change.beforeTemplateIndex === null ? [] : [`before template ${change.beforeTemplateIndex}`]),
+                ...(change.afterTemplateIndex === null ? [] : [`after template ${change.afterTemplateIndex}`])
+            ];
+            const impact = `${change.impact}${change.reasons.length ? ` (${change.reasons.join(", ")})` : ""}`;
+            const name = change.name === undefined ? "" : ` ${quoteServerText(change.name)}`;
+            const at = (change.locations ?? []).map((location) => `\n  At ${location.variable === null ? "(template)" : `variable ${quoteServerText(location.variable)}`}: ${location.reason}`).join("");
+            return `${change.kind.toUpperCase()}${name} [${locations.join(" -> ")}]${change.fields.length ? `: ${change.fields.join(", ")}` : ""}\n  Impact: ${impact}${at}`;
+        })
+    ].join("\n");
+}

package/dist/reporting/render-mcp-resource-template-file-report.d.ts

@@ -0,0 +1,5 @@
+import type { ResourceTemplateCatalogLocation } from "../core/mcp-resource-template-definition.js";
+import type { McpResourceTemplateFileReport } from "../core/mcp-resource-template-file.js";
+/** Describes a finding location by one-based positions only, such as "template 2, related template 1". */
+export declare function describeResourceTemplateLocation(location: ResourceTemplateCatalogLocation): string;
+export declare function renderMcpResourceTemplateFileReport(report: McpResourceTemplateFileReport): string;

package/dist/reporting/render-mcp-resource-template-file-report.js

@@ -0,0 +1,31 @@
+/** Describes a finding location by one-based positions only, such as "template 2, related template 1". */
+export function describeResourceTemplateLocation(location) {
+    return [
+        `template ${location.templateIndex}`,
+        ...(location.relatedTemplateIndex === undefined ? [] : [`related template ${location.relatedTemplateIndex}`])
+    ].join(", ");
+}
+export function renderMcpResourceTemplateFileReport(report) {
+    return [
+        "Offline MCP Resource Template Definitions",
+        "=========================================",
+        `Status: ${report.status}`,
+        `Scope: ${report.scope}`,
+        `Source: ${report.source.kind} (${report.source.format})`,
+        `Bytes read: ${report.source.bytesRead}`,
+        `Inspection complete: ${report.inspection.complete}`,
+        `Templates checked: ${report.inspection.templatesChecked}`,
+        `More pages advertised: ${report.inspection.hasNextCursor ?? "unknown"}`,
+        ...(report.inspection.reason === null ? [] : [`Reason: ${report.inspection.reason}`]),
+        `Definition coverage: ${report.coverage.definitions}`,
+        `Discovery: ${report.coverage.discovery}`,
+        `Server catalog: ${report.coverage.serverCatalog}`,
+        `Resource read: ${report.coverage.resourceRead}`,
+        `Full conformance: ${report.coverage.fullConformance}`,
+        "Only the supplied file was inspected. Its provenance and server completeness are not established.",
+        ...report.findings.map((finding) => {
+            const locator = finding.location ? ` [${describeResourceTemplateLocation(finding.location)}]` : "";
+            return `${finding.severity.toUpperCase()} ${finding.id}${locator}: ${finding.message}\n  ${finding.suggestedFix}`;
+        })
+    ].join("\n");
+}

package/dist/run-cli.d.ts

@@ -2,8 +2,11 @@ import { discoverMcpServer } from "./core/mcp-discovery.js";
 import { captureMcpToolCatalog, inspectMcpToolCatalog } from "./core/mcp-tool-catalog.js";
 import { captureStdioMcpToolCatalog } from "./core/mcp-stdio-tool-catalog.js";
 import { captureMcpPromptCatalog, captureStdioMcpPromptCatalog } from "./core/mcp-prompt-catalog.js";
+import { captureMcpResourceTemplateCatalog, captureStdioMcpResourceTemplateCatalog } from "./core/mcp-resource-template-catalog.js";
 import { compareMcpPromptFiles } from "./core/mcp-prompt-diff.js";
 import { inspectMcpPromptFile } from "./core/mcp-prompt-file.js";
+import { compareMcpResourceTemplateFiles } from "./core/mcp-resource-template-diff.js";
+import { inspectMcpResourceTemplateFile } from "./core/mcp-resource-template-file.js";
 import { inspectMcpToolFile } from "./core/mcp-tool-file.js";
 import { compareMcpToolFiles } from "./core/mcp-tool-diff.js";
 import { buildCorpusQualityMetricsDiffReport, buildCorpusQualityMetricsReport } from "./core/corpus-quality-metrics.js";
@@ -27,9 +30,13 @@ export interface RunCliOptions {
     captureMcpToolCatalogImpl?: typeof captureMcpToolCatalog;
     captureStdioMcpToolCatalogImpl?: typeof captureStdioMcpToolCatalog;
     compareMcpPromptFilesImpl?: typeof compareMcpPromptFiles;
+    compareMcpResourceTemplateFilesImpl?: typeof compareMcpResourceTemplateFiles;
+    inspectMcpResourceTemplateFileImpl?: typeof inspectMcpResourceTemplateFile;
     inspectMcpPromptFileImpl?: typeof inspectMcpPromptFile;
     captureMcpPromptCatalogImpl?: typeof captureMcpPromptCatalog;
     captureStdioMcpPromptCatalogImpl?: typeof captureStdioMcpPromptCatalog;
+    captureMcpResourceTemplateCatalogImpl?: typeof captureMcpResourceTemplateCatalog;
+    captureStdioMcpResourceTemplateCatalogImpl?: typeof captureStdioMcpResourceTemplateCatalog;
     discoverMcpServerImpl?: typeof discoverMcpServer;
     terminalContext?: CliTerminalContext;
     runCheckImpl?: typeof runCheck;

package/dist/run-cli.js

@@ -26,8 +26,11 @@ import { discoverMcpServer } from "./core/mcp-discovery.js";
 import { captureMcpToolCatalog, inspectMcpToolCatalog } from "./core/mcp-tool-catalog.js";
 import { captureStdioMcpToolCatalog, resolveMcpStdioServer } from "./core/mcp-stdio-tool-catalog.js";
 import { captureMcpPromptCatalog, captureStdioMcpPromptCatalog } from "./core/mcp-prompt-catalog.js";
+import { captureMcpResourceTemplateCatalog, captureStdioMcpResourceTemplateCatalog } from "./core/mcp-resource-template-catalog.js";
 import { compareMcpPromptFiles } from "./core/mcp-prompt-diff.js";
 import { inspectMcpPromptFile } from "./core/mcp-prompt-file.js";
+import { compareMcpResourceTemplateFiles } from "./core/mcp-resource-template-diff.js";
+import { inspectMcpResourceTemplateFile } from "./core/mcp-resource-template-file.js";
 import { inspectMcpToolFile, isBlockedOfflinePath } from "./core/mcp-tool-file.js";
 import { saveMcpListResponse } from "./core/mcp-tool-response-file.js";
 import { compareMcpToolFiles } from "./core/mcp-tool-diff.js";
@@ -36,9 +39,13 @@ import { renderMcpToolDiffReport } from "./reporting/render-mcp-tool-diff-report
 import { renderMcpToolFileReport } from "./reporting/render-mcp-tool-file-report.js";
 import { renderMcpToolCatalogReport } from "./reporting/render-mcp-tool-catalog-report.js";
 import { renderMcpPromptCatalogReport } from "./reporting/render-mcp-prompt-catalog-report.js";
+import { renderMcpResourceTemplateCatalogReport } from "./reporting/render-mcp-resource-template-catalog-report.js";
 import { renderMcpPromptDiffMarkdown } from "./reporting/render-mcp-prompt-diff-markdown.js";
 import { renderMcpPromptDiffReport } from "./reporting/render-mcp-prompt-diff-report.js";
 import { renderMcpPromptFileReport } from "./reporting/render-mcp-prompt-file-report.js";
+import { renderMcpResourceTemplateDiffMarkdown } from "./reporting/render-mcp-resource-template-diff-markdown.js";
+import { renderMcpResourceTemplateDiffReport } from "./reporting/render-mcp-resource-template-diff-report.js";
+import { renderMcpResourceTemplateFileReport } from "./reporting/render-mcp-resource-template-file-report.js";
 import { renderMcpDiscoveryReport } from "./reporting/render-mcp-discovery-report.js";
 import { buildDoctorValidationCorpusReport, renderDoctorValidationCorpusJson, renderDoctorValidationCorpusReport } from "./core/validation-corpus.js";
 import { buildExternalValidationCorpusReport, ExternalCorpusManifestError } from "./core/external-validation-corpus.js";
@@ -122,18 +129,25 @@ const toolsDiffUsage = "Usage: codex-plugin-doctor doctor tools-diff --before <p
 const toolsFileUsage = "Usage: codex-plugin-doctor doctor tools-file <path> [--json]";
 const promptsDiffUsage = "Usage: codex-plugin-doctor doctor prompts-diff --before <path> --after <path> [--json|--markdown] [--fail-on any|breaking] [--show-names]";
 const promptsFileUsage = "Usage: codex-plugin-doctor doctor prompts-file <path> [--json]";
+const resourceTemplatesDiffUsage = "Usage: codex-plugin-doctor doctor resource-templates-diff --before <path> --after <path> [--json|--markdown] [--fail-on any|breaking] [--show-names]";
+const resourceTemplatesFileUsage = "Usage: codex-plugin-doctor doctor resource-templates-file <path> [--json]";
 const toolsUsage = "Usage: codex-plugin-doctor doctor tools <url> --allow-network [--allow-local-network] [--json] [--save-response <path>] [--bearer-token-env <NAME>]\n       codex-plugin-doctor doctor tools <path> --server <name> --runtime [--sandbox docker [--env <NAME>]...] [--require-runtime-approval [--runtime-approval-digest <digest>]] [--json] [--save-response <path>]";
+const resourceTemplatesUsage = "Usage: codex-plugin-doctor doctor resource-templates <url> --allow-network [--allow-local-network] [--json] [--save-response <path>] [--bearer-token-env <NAME>]\n       codex-plugin-doctor doctor resource-templates <path> --server <name> --runtime [--sandbox docker [--env <NAME>]...] [--require-runtime-approval [--runtime-approval-digest <digest>]] [--json] [--save-response <path>]";
 const promptsUsage = "Usage: codex-plugin-doctor doctor prompts <url> --allow-network [--allow-local-network] [--json] [--save-response <path>] [--bearer-token-env <NAME>]\n       codex-plugin-doctor doctor prompts <path> --server <name> --runtime [--sandbox docker [--env <NAME>]...] [--require-runtime-approval [--runtime-approval-digest <digest>]] [--json] [--save-response <path>]";
-const TOOL_CATALOG_COMMAND = { name: "tools", noun: "Tool", method: "tools/list", usage: toolsUsage };
-const PROMPT_CATALOG_COMMAND = { name: "prompts", noun: "Prompt", method: "prompts/list", usage: promptsUsage };
+const TOOL_CATALOG_COMMAND = { name: "tools", noun: "Tool", plural: "tools", method: "tools/list", resultKey: "tools", usage: toolsUsage };
+const PROMPT_CATALOG_COMMAND = { name: "prompts", noun: "Prompt", plural: "prompts", method: "prompts/list", resultKey: "prompts", usage: promptsUsage };
+const RESOURCE_TEMPLATE_CATALOG_COMMAND = {
+    name: "resource-templates", noun: "Resource template", plural: "resource templates",
+    method: "resources/templates/list", resultKey: "resourceTemplates", usage: resourceTemplatesUsage
+};
 const discoveryUsage = "Usage: codex-plugin-doctor doctor discover <url> --allow-network [--allow-local-network] [--json] [--bearer-token-env <NAME>]";
 const bearerTokenHelp = "--bearer-token-env reads a bearer token from the named environment variable and sends it only over HTTPS or to an approved loopback target; the token is never printed or saved.";
 const ENVIRONMENT_VARIABLE_NAME = /^[A-Za-z_][A-Za-z0-9_]*$/u;
-/** Reads init-ci --tools-diff-server, --baseline, and --sandbox; options is null when none is given. */
+/** Reads init-ci --tools-diff-server, --baseline, --prompts-baseline, and --sandbox; options is null when none is given. */
 function parseToolsDiffWorkflowOptions(flags) {
     const values = new Map();
     for (let index = 0; index < flags.length; index += 1) {
-        if (!["--tools-diff-server", "--baseline", "--sandbox"].includes(flags[index]))
+        if (!["--tools-diff-server", "--baseline", "--prompts-baseline", "--sandbox"].includes(flags[index]))
             continue;
         const value = flags[index + 1];
         const present = value !== undefined && !value.startsWith("--");
@@ -144,7 +158,7 @@ function parseToolsDiffWorkflowOptions(flags) {
     if (values.size === 0)
         return { options: null };
     if (!values.has("--tools-diff-server"))
-        return { error: "--baseline and --sandbox require --tools-diff-server." };
+        return { error: "--baseline, --prompts-baseline, and --sandbox require --tools-diff-server." };
     // Control characters would break the generated workflow lines, GitHub evaluates "${{" in any
     // workflow value, and the Action rejects values that start with "-".
     const usable = (value) => value !== undefined && value.trim() !== "" && !value.startsWith("-") && !value.includes("${{")
@@ -152,16 +166,23 @@ function parseToolsDiffWorkflowOptions(flags) {
     const server = values.get("--tools-diff-server");
     if (!usable(server))
         return { error: "--tools-diff-server requires a server name." };
-    // The workflow runs on Linux from the repository root, so the baseline is a relative POSIX path.
+    // The workflow runs on Linux from the repository root, so baselines are relative POSIX paths.
+    const relative = (value) => usable(value) && !path.posix.isAbsolute(value)
+        && !/^[A-Za-z]:/u.test(value) && !path.posix.normalize(value).split("/").includes("..");
     const baseline = (values.has("--baseline") ? values.get("--baseline") : "mcp/tools-baseline.json")?.replaceAll("\\", "/");
-    if (!usable(baseline) || path.posix.isAbsolute(baseline) || /^[A-Za-z]:/u.test(baseline)
-        || path.posix.normalize(baseline).split("/").includes("..")) {
+    if (!relative(baseline))
         return { error: "--baseline requires a relative path inside the repository." };
+    const promptsBaseline = values.has("--prompts-baseline") ? values.get("--prompts-baseline")?.replaceAll("\\", "/") : null;
+    if (promptsBaseline !== null && !relative(promptsBaseline)) {
+        return { error: "--prompts-baseline requires a relative path inside the repository." };
+    }
+    if (promptsBaseline !== null && path.posix.normalize(promptsBaseline) === path.posix.normalize(baseline)) {
+        return { error: "--prompts-baseline must differ from --baseline." };
     }
     const sandbox = values.get("--sandbox");
     if (values.has("--sandbox") && sandbox !== "docker")
         return { error: "--sandbox must be docker." };
-    return { options: { server, baseline, sandbox: sandbox === "docker" ? "docker" : null } };
+    return { options: { server, baseline, sandbox: sandbox === "docker" ? "docker" : null, promptsBaseline } };
 }
 const MAX_FORWARDED_ENVIRONMENT_VARIABLES = 32;
 const forwardedEnvironmentHelp = "--env forwards the named host environment variable into the Docker sandbox by name; Doctor never prints its value, writes it to a report, or passes it as a command argument. Native servers already inherit Doctor's environment.";
@@ -188,7 +209,7 @@ async function finishCatalogCommand(io, kind, status, output, items, cache, save
         io.writeStderr(`${kind.noun} catalog response was not saved because enumeration did not complete.`);
         return 2;
     }
-    const saved = await saveMcpListResponse(savePath, kind.name, items, cache);
+    const saved = await saveMcpListResponse(savePath, kind.resultKey, items, cache);
     if (saved.kind !== "saved") {
         io.writeStderr({
             "path-blocked": `${kind.noun} catalog response was not saved because the path is not a local file path.`,
@@ -198,7 +219,7 @@ async function finishCatalogCommand(io, kind, status, output, items, cache, save
         }[saved.kind]);
         return 2;
     }
-    io.writeStderr(`Saved a complete ${kind.method} response with ${saved.count} ${kind.name} (${saved.bytes} bytes).`);
+    io.writeStderr(`Saved a complete ${kind.method} response with ${saved.count} ${kind.plural} (${saved.bytes} bytes).`);
     return exitCode;
 }
 function finishToolCatalogCommand(io, snapshot, json, savePath) {
@@ -209,6 +230,10 @@ function finishPromptCatalogCommand(io, snapshot, json, savePath) {
     const report = snapshot.report;
     return finishCatalogCommand(io, PROMPT_CATALOG_COMMAND, report.status, json ? JSON.stringify(report, null, 2) : renderMcpPromptCatalogReport(report), snapshot.prompts, snapshot.cache, savePath);
 }
+function finishResourceTemplateCatalogCommand(io, snapshot, json, savePath) {
+    const report = snapshot.report;
+    return finishCatalogCommand(io, RESOURCE_TEMPLATE_CATALOG_COMMAND, report.status, json ? JSON.stringify(report, null, 2) : renderMcpResourceTemplateCatalogReport(report), snapshot.templates, snapshot.cache, savePath);
+}
 async function runHttpCatalogCommand(url, flags, io, env, kind, run) {
     const allowedFlags = new Set(["--allow-network", "--allow-local-network", "--json"]);
     const switches = [];
@@ -509,14 +534,17 @@ function parseRemoteNetworkFlags(flags, runtime) {
     return { allowNetwork, allowLocalNetwork, allowSessionLifecycle, requireRemoteReliability };
 }
 function printUsage(io) {
-    io.writeStderr("Usage: codex-plugin-doctor check <path|--installed> [filter] [--policy codex-publish|mcp-strict|security] [--compat] [--json|--markdown|--badge-json|--badge-markdown] [--output <path>] [--history <path>] [--runtime [--allow-network [--allow-local-network]]] [--sandbox docker] [--require-runtime-approval --runtime-approval-digest <digest>] [--verbose-runtime] [--explain] [--no-animations] [--ascii] [--changed-since <ref>] [--fail-on <rule-id>]\n       codex-plugin-doctor audit --installed [filter] [--policy codex-publish|mcp-strict|security] [--security] [--compat] [--json] [--output <path>] [--cache] [--changed]\n       codex-plugin-doctor audit deps <path> [--policy codex-publish|mcp-strict|security] [--recommend] [--json|--sarif] [--output <path>]\n       codex-plugin-doctor mcp <path> [--runtime [--allow-network [--allow-local-network]]] [--json] [--output <path>]\n       codex-plugin-doctor security <path> [--policy security] [--json|--scorecard]\n       codex-plugin-doctor compat <path> [--all|--client <client>] [--json] [--scorecard] [--output <path>] [--install-preview|--apply --backup]\n       codex-plugin-doctor suppress add <path> [--fingerprint <sha256> --reason <text> --expires-at YYYY-MM-DD] [--config <path>] [--json]\n       codex-plugin-doctor suppress list <path> [--config <path>] [--json]\n       codex-plugin-doctor suppress remove <path> [--fingerprint <sha256>|--index <n>] [--config <path>] [--json]\n       codex-plugin-doctor fix <path> (--dry-run|--interactive --backup|--apply --backup)\n       codex-plugin-doctor history <history.jsonl> [--json] [--fail-on-regression]\n       codex-plugin-doctor watch <path> [--runtime] [--json] [--output <path>] [--debounce-ms <ms>] [--max-iterations <n>] [--fail-fast] [--accumulate-json <path>]\n       codex-plugin-doctor doctor [npm <package>|contract|corpus [--manifest <corpus.json>] [--json] [--output <path>]|corpus metrics --manifest <corpus.json> [--json|--markdown] [--output <path>] [--min-precision <0..1>] [--min-recall <0..1>] [--max-false-positive-rate <0..1>]|runtime-plan <path> [--sandbox docker] [--json|--markdown] [--output <path>]|runtime-policy <path> [--sandbox docker] [--json] [--output <path>]|review-bundle <path> --output <dir> --sign-key-env NAME [--json] [--allow-dirty] [--allow-untagged]|review-bundle verify <bundle-dir> --target <path> --sign-key-env NAME [--json] [--output <path>] [--failures-only]|review-bundle diff --before <dir> --after <dir> [--json]|attest <path> [--sign-key-env NAME]|attest verify <attestation.json> --target <path> --sign-key-env NAME|release-evidence <path> --sign-key-env NAME [--runtime [--allow-network [--allow-local-network]]] [--sandbox docker] [--allow-dirty] [--allow-untagged] [--require-runtime-approval --runtime-approval-digest <digest>]|release-evidence verify <evidence.json> --target <path> --sign-key-env NAME|release-evidence asset <path> --tag <tag> --output <evidence.json> --sign-key-env NAME [--runtime [--allow-network [--allow-local-network]]] [--sandbox docker] [--allow-dirty] [--allow-untagged] [--require-runtime-approval --runtime-approval-digest <digest>] [--upload]|mcp <path> [--runtime [--allow-network [--allow-local-network]]]|inspector <path>|diff --before <path> --after <path>|recommend <path>|trust <path>|perf <path> [--max-total-ms <ms>] [--max-stage-ms stage=ms]|export --bundle <path>|snapshot|clients|--json|--update-check]\n       codex-plugin-doctor init [path] [--template skill-only|mcp-stdio|mcp-http|full-runtime]\n       codex-plugin-doctor init-ci [path] [--tools-diff-server <name> [--baseline <path>] [--sandbox docker]]\n       codex-plugin-doctor init-git-hooks [path] [--force] [--json]\n       codex-plugin-doctor init-git-hooks [path] --remove [--json]\n       codex-plugin-doctor completion bash|zsh|fish\n       codex-plugin-doctor config validate <path> [--json]\n       codex-plugin-doctor release check <path> [--json] [--runtime [--allow-network [--allow-local-network]]] [--sandbox docker]\n       codex-plugin-doctor self-test\n       codex-plugin-doctor list --installed\n       codex-plugin-doctor explain <finding-id>\n       codex-plugin-doctor --version\n\nFirst run:\n       codex-plugin-doctor doctor\n       codex-plugin-doctor self-test\n       codex-plugin-doctor init my-plugin\n       codex-plugin-doctor check . --runtime --explain");
+    io.writeStderr("Usage: codex-plugin-doctor check <path|--installed> [filter] [--policy codex-publish|mcp-strict|security] [--compat] [--json|--markdown|--badge-json|--badge-markdown] [--output <path>] [--history <path>] [--runtime [--allow-network [--allow-local-network]]] [--sandbox docker] [--require-runtime-approval --runtime-approval-digest <digest>] [--verbose-runtime] [--explain] [--no-animations] [--ascii] [--changed-since <ref>] [--fail-on <rule-id>]\n       codex-plugin-doctor audit --installed [filter] [--policy codex-publish|mcp-strict|security] [--security] [--compat] [--json] [--output <path>] [--cache] [--changed]\n       codex-plugin-doctor audit deps <path> [--policy codex-publish|mcp-strict|security] [--recommend] [--json|--sarif] [--output <path>]\n       codex-plugin-doctor mcp <path> [--runtime [--allow-network [--allow-local-network]]] [--json] [--output <path>]\n       codex-plugin-doctor security <path> [--policy security] [--json|--scorecard]\n       codex-plugin-doctor compat <path> [--all|--client <client>] [--json] [--scorecard] [--output <path>] [--install-preview|--apply --backup]\n       codex-plugin-doctor suppress add <path> [--fingerprint <sha256> --reason <text> --expires-at YYYY-MM-DD] [--config <path>] [--json]\n       codex-plugin-doctor suppress list <path> [--config <path>] [--json]\n       codex-plugin-doctor suppress remove <path> [--fingerprint <sha256>|--index <n>] [--config <path>] [--json]\n       codex-plugin-doctor fix <path> (--dry-run|--interactive --backup|--apply --backup)\n       codex-plugin-doctor history <history.jsonl> [--json] [--fail-on-regression]\n       codex-plugin-doctor watch <path> [--runtime] [--json] [--output <path>] [--debounce-ms <ms>] [--max-iterations <n>] [--fail-fast] [--accumulate-json <path>]\n       codex-plugin-doctor doctor [npm <package>|contract|corpus [--manifest <corpus.json>] [--json] [--output <path>]|corpus metrics --manifest <corpus.json> [--json|--markdown] [--output <path>] [--min-precision <0..1>] [--min-recall <0..1>] [--max-false-positive-rate <0..1>]|runtime-plan <path> [--sandbox docker] [--json|--markdown] [--output <path>]|runtime-policy <path> [--sandbox docker] [--json] [--output <path>]|review-bundle <path> --output <dir> --sign-key-env NAME [--json] [--allow-dirty] [--allow-untagged]|review-bundle verify <bundle-dir> --target <path> --sign-key-env NAME [--json] [--output <path>] [--failures-only]|review-bundle diff --before <dir> --after <dir> [--json]|attest <path> [--sign-key-env NAME]|attest verify <attestation.json> --target <path> --sign-key-env NAME|release-evidence <path> --sign-key-env NAME [--runtime [--allow-network [--allow-local-network]]] [--sandbox docker] [--allow-dirty] [--allow-untagged] [--require-runtime-approval --runtime-approval-digest <digest>]|release-evidence verify <evidence.json> --target <path> --sign-key-env NAME|release-evidence asset <path> --tag <tag> --output <evidence.json> --sign-key-env NAME [--runtime [--allow-network [--allow-local-network]]] [--sandbox docker] [--allow-dirty] [--allow-untagged] [--require-runtime-approval --runtime-approval-digest <digest>] [--upload]|mcp <path> [--runtime [--allow-network [--allow-local-network]]]|inspector <path>|diff --before <path> --after <path>|recommend <path>|trust <path>|perf <path> [--max-total-ms <ms>] [--max-stage-ms stage=ms]|export --bundle <path>|snapshot|clients|--json|--update-check]\n       codex-plugin-doctor init [path] [--template skill-only|mcp-stdio|mcp-http|full-runtime]\n       codex-plugin-doctor init-ci [path] [--tools-diff-server <name> [--baseline <path>] [--prompts-baseline <path>] [--sandbox docker]]\n       codex-plugin-doctor init-git-hooks [path] [--force] [--json]\n       codex-plugin-doctor init-git-hooks [path] --remove [--json]\n       codex-plugin-doctor completion bash|zsh|fish\n       codex-plugin-doctor config validate <path> [--json]\n       codex-plugin-doctor release check <path> [--json] [--runtime [--allow-network [--allow-local-network]]] [--sandbox docker]\n       codex-plugin-doctor self-test\n       codex-plugin-doctor list --installed\n       codex-plugin-doctor explain <finding-id>\n       codex-plugin-doctor --version\n\nFirst run:\n       codex-plugin-doctor doctor\n       codex-plugin-doctor self-test\n       codex-plugin-doctor init my-plugin\n       codex-plugin-doctor check . --runtime --explain");
     io.writeStderr(discoveryUsage);
     io.writeStderr(toolsUsage);
     io.writeStderr(promptsUsage);
+    io.writeStderr(resourceTemplatesUsage);
     io.writeStderr(toolsFileUsage);
     io.writeStderr(toolsDiffUsage);
     io.writeStderr(promptsFileUsage);
     io.writeStderr(promptsDiffUsage);
+    io.writeStderr(resourceTemplatesFileUsage);
+    io.writeStderr(resourceTemplatesDiffUsage);
     io.writeStderr("Registry readiness: codex-plugin-doctor registry check <server.json|directory> [--json] [--output <path>] [--require-registry-readiness]\n"
         + "       codex-plugin-doctor registry inspect <server-name> --allow-network [--json] [--output <path>] [--require-registry-readiness]\n"
         + "Registry publication preflight: codex-plugin-doctor registry preflight <server.json|directory> [--allow-network] [--json] [--output <path>] [--require-publish-ready]");
@@ -1480,10 +1508,10 @@ export async function runCli(args, io = defaultIo, options = {}) {
         (command === "doctor" &&
             (["runtime-plan", "runtime-policy"].includes(maybePath ?? "") ||
                 (maybePath === "release-evidence" && remainingArgs[0] !== "verify") ||
-                ((maybePath === "tools" || maybePath === "prompts") && remainingArgs.includes("--server")))) ||
+                (["tools", "prompts", "resource-templates"].includes(maybePath ?? "") && remainingArgs.includes("--server")))) ||
         (command === "init-ci" && args.includes("--tools-diff-server"));
     if (args.includes("--sandbox") && !runtimeSandboxSupported) {
-        io.writeStderr("--sandbox is supported only by single-package check, release check, runtime-plan, runtime-policy, release-evidence, doctor tools --server, doctor prompts --server, and init-ci --tools-diff-server.");
+        io.writeStderr("--sandbox is supported only by single-package check, release check, runtime-plan, runtime-policy, release-evidence, doctor tools --server, doctor prompts --server, doctor resource-templates --server, and init-ci --tools-diff-server.");
         return 2;
     }
     if (command === "--version" || command === "-v" || command === "version") {
@@ -1565,6 +1593,24 @@ export async function runCli(args, io = defaultIo, options = {}) {
             }
             return runOfflineFileCommand(remainingArgs, io, promptsFileUsage, options.inspectMcpPromptFileImpl ?? inspectMcpPromptFile, renderMcpPromptFileReport);
         }
+        if (maybePath === "resource-templates-diff") {
+            if (remainingArgs.length === 1 && remainingArgs[0] === "--help") {
+                io.writeStdout(`${resourceTemplatesDiffUsage}\nCompares two saved MCP resources/templates/list responses offline. Changes are classified heuristically as breaking, compatible, or unclassified; no resource is read and compatibility is not tested.\n--fail-on breaking exits 1 only for breaking or unclassified changes (default: any change or input warning).
+--show-names adds template names and the variable behind each reason; reports omit both, and never include URI templates, so keep the flag out of public output such as pull request comments.`);
+                return 0;
+            }
+            return runOfflineDiffCommand(remainingArgs, io, resourceTemplatesDiffUsage, (beforePath, afterPath, showNames) => {
+                const compare = options.compareMcpResourceTemplateFilesImpl ?? compareMcpResourceTemplateFiles;
+                return showNames ? compare(beforePath, afterPath, { showNames: true }) : compare(beforePath, afterPath);
+            }, (report, markdown) => markdown ? renderMcpResourceTemplateDiffMarkdown(report) : renderMcpResourceTemplateDiffReport(report));
+        }
+        if (maybePath === "resource-templates-file") {
+            if (remainingArgs.length === 1 && remainingArgs[0] === "--help") {
+                io.writeStdout(`${resourceTemplatesFileUsage}\nInspects one saved UTF-8 MCP resources/templates/list response. No server connection or resource read.`);
+                return 0;
+            }
+            return runOfflineFileCommand(remainingArgs, io, resourceTemplatesFileUsage, options.inspectMcpResourceTemplateFileImpl ?? inspectMcpResourceTemplateFile, renderMcpResourceTemplateFileReport);
+        }
         if (maybePath === "tools") {
             if (remainingArgs.length === 1 && remainingArgs[0] === "--help") {
                 io.writeStdout(`${toolsUsage}\nTool catalog structure only; tools are not executed.\n--server starts the named stdio server from the package MCP configuration after explicit --runtime consent and stops it after reading the tool list.\n${forwardedEnvironmentHelp}\n--save-response writes a complete enumeration as one tools/list response for doctor tools-file and tools-diff; nothing is written when enumeration is incomplete.\n${bearerTokenHelp}`);
@@ -1600,6 +1646,21 @@ export async function runCli(args, io = defaultIo, options = {}) {
             }
             return runHttpCatalogCommand(target, flags, io, terminalContext.env, PROMPT_CATALOG_COMMAND, async (url, catalogOptions, json, savePath) => finishPromptCatalogCommand(io, await (options.captureMcpPromptCatalogImpl ?? captureMcpPromptCatalog)(url, catalogOptions), json, savePath));
         }
+        if (maybePath === "resource-templates") {
+            if (remainingArgs.length === 1 && remainingArgs[0] === "--help") {
+                io.writeStdout(`${resourceTemplatesUsage}\nResource template catalog structure only; no resource is read.\n--server starts the named stdio server from the package MCP configuration after explicit --runtime consent and stops it after reading the resource template list.\n${forwardedEnvironmentHelp}\n--save-response writes a complete enumeration as one resources/templates/list response for doctor resource-templates-file and resource-templates-diff; nothing is written when enumeration is incomplete.\n${bearerTokenHelp}`);
+                return 0;
+            }
+            const [target, ...flags] = remainingArgs;
+            if (!target || target.startsWith("-")) {
+                io.writeStderr(resourceTemplatesUsage);
+                return 2;
+            }
+            if (flags.includes("--server")) {
+                return runStdioCatalogCommand(target, flags, io, terminalContext.env, RESOURCE_TEMPLATE_CATALOG_COMMAND, async (server, captureOptions, json, savePath) => finishResourceTemplateCatalogCommand(io, await (options.captureStdioMcpResourceTemplateCatalogImpl ?? captureStdioMcpResourceTemplateCatalog)(server, captureOptions), json, savePath));
+            }
+            return runHttpCatalogCommand(target, flags, io, terminalContext.env, RESOURCE_TEMPLATE_CATALOG_COMMAND, async (url, catalogOptions, json, savePath) => finishResourceTemplateCatalogCommand(io, await (options.captureMcpResourceTemplateCatalogImpl ?? captureMcpResourceTemplateCatalog)(url, catalogOptions), json, savePath));
+        }
         if (maybePath === "discover") {
             if (remainingArgs.length === 1 && remainingArgs[0] === "--help") {
                 io.writeStdout(`${discoveryUsage}\nHTTP discovery only; runtime behavior is not tested.\n${bearerTokenHelp}`);
@@ -2882,13 +2943,16 @@ export async function runCli(args, io = defaultIo, options = {}) {
             return 2;
         }
         if (toolsDiff.options !== null) {
-            const { server, baseline, sandbox } = toolsDiff.options;
+            const { server, baseline, sandbox, promptsBaseline } = toolsDiff.options;
             const toolsResult = await initToolsDiffWorkflow(targetPath, toolsDiff.options);
             io.writeStdout([
                 "Initialized Codex Plugin Doctor tool diff workflow",
                 `Root: ${toolsResult.rootPath}`,
                 `Workflow: ${toolsResult.workflowPath}`,
-                `Capture and commit a baseline at ${baseline}, for example with: codex-plugin-doctor doctor tools ${JSON.stringify(targetPath)} --server ${JSON.stringify(server)} --runtime${sandbox === "docker" ? " --sandbox docker" : ""} --save-response ${JSON.stringify(path.join(targetPath, baseline))}`
+                `Capture and commit a baseline at ${baseline}, for example with: codex-plugin-doctor doctor tools ${JSON.stringify(targetPath)} --server ${JSON.stringify(server)} --runtime${sandbox === "docker" ? " --sandbox docker" : ""} --save-response ${JSON.stringify(path.join(targetPath, baseline))}`,
+                ...(promptsBaseline === null ? [] : [
+                    `Capture and commit a prompt baseline at ${promptsBaseline}, for example with: codex-plugin-doctor doctor prompts ${JSON.stringify(targetPath)} --server ${JSON.stringify(server)} --runtime${sandbox === "docker" ? " --sandbox docker" : ""} --save-response ${JSON.stringify(path.join(targetPath, promptsBaseline))}`
+                ])
             ].join("\n"));
             return 0;
         }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "codex-plugin-doctor",
-  "version": "1.77.0",
+  "version": "1.79.0",
   "description": "CLI-first validator for Codex plugins, skills, and MCP package surfaces with runtime MCP protocol validation.",
   "type": "module",
   "main": "./dist/index.js",