v1.56.0 - Package size analysis

Added

• \doctor size [--json]\ — analyzes plugin package size, flags large files (>1 MB) and oversized packages (>10 MB warn, >50 MB fail)
• Skips common build/dependency directories (node_modules, .git, dist, coverage, .cache, build)
• \�uildDoctorSize(),
  enderDoctorSize(),
  enderDoctorSizeJson()\ public API exports
• 8 new tests in \ ests/doctor-size.test.ts\

Report details

• Total package size and file count
• Top 10 largest files sorted by size
• Human-readable size formatting (B/KB/MB/GB)
• Status: pass (under 10 MB), warn (10-50 MB or large files), fail (over 50 MB)

v1.55.0 - Registry Publication Preflight

Added

• Added registry preflight for offline publication planning and opt-in public npm and official MCP Registry metadata verification.
• Added immutable version availability classification for first publications, new versions, and already-published versions.
• Added the additive doctor.registry.preflight.json contract with a fixed, non-executing publisher plan.

Security

• Network access remains opt-in and limited to fixed public metadata hosts.
• Rejects ambiguous npm declarations, identity mismatches, malformed SRI metadata, and untrusted Registry response shapes.
• Never authenticates, publishes, downloads tarballs, executes package scripts, or exposes local paths and remote response content.

v1.54.0 - MCP Registry Readiness

Added

• Offline MCP Registry readiness scorecards for metadata, ownership, package integrity, transport readiness, and client installability.
• Explicit-consent exact-name inspection against the official MCP Registry.
• Non-executing Codex configuration previews and optional GitHub Action readiness gating.

Changed

• Added the backward-compatible doctor.registry.readiness.json output-contract surface.
• Historical official Registry schema URLs now produce compatibility warnings instead of false failures.

Security

• Live inspection is constrained to the fixed official Registry endpoint through the bounded HTTP client.
• Local checks remain offline; live checks require --allow-network.
• Literal embedded secrets and unsafe package or transport declarations are rejected.

Full changelog: https://github.com/Esquetta/CodexPluginDoctor/blob/v1.54.0/CHANGELOG.md

v1.53.0 - Remote MCP Transport Reliability

Adds bounded Streamable HTTP GET/SSE reliability checks, secure session propagation and single restart handling, event resumability without cross-session cursor reuse, and exact MCP initialized-notification acknowledgement validation. Introduces opt-in single-session DELETE cleanup, strict remote reliability gates for CLI and GitHub Actions, additive reliability scorecards, and cross-output redaction for session, event, retry, and SSE content.

v1.52.0 - Remote MCP Readiness

Adds opt-in Streamable HTTP MCP initialization checks with explicit network consent, loopback-only local consent, SSRF-resistant DNS/IP and peer validation, bounded redirect-free requests, OAuth metadata discovery-only readiness, runtime approval/reporting integration, and GitHub Action controls. Also preserves release-evidence JSON/API compatibility and remediates the development dependency audit finding.

Codex Plugin Doctor v1.51.0

Full Changelog: v1.50.0...v1.51.0

v1.50.0

Added

• GitHub Action inputs for private corpus metrics manifests, retained baselines, and opt-in regression gates.
• Public-safe corpus metrics and regression report artifacts with Action outputs and manifest entries.

Fixed

• npm 12 keyed-object metadata support for doctor npm package analysis and release fresh-install checks.

Security

• Corpus metric paths are passed through step environment variables.
• Private snapshots, manifests, source material, evidence, and review notes remain excluded from uploaded reports.
• Incomplete corpus quality gate input combinations fail with exit 2.

v1.49.0

Adds deterministic corpus quality regression comparisons for release gating.

Highlights:

• New doctor corpus metrics diff --before --after command
• Optional --fail-on-regression CI gate
• Stable corpusDigest identities prevent cross-corpus comparisons
• Exact count-based precision, recall, and false-positive share deltas
• Redacted text, Markdown, JSON, and public output-contract surfaces
• Fail-closed validation for malformed, incomplete, oversized, or inconsistent reports

See CHANGELOG.md for the full release notes.

v1.48.0

Adds deterministic real-world corpus quality metrics for precision, recall, and reviewed false-positive share.

Highlights:

• New doctor corpus metrics --manifest command
• Optional quality thresholds with text, Markdown, JSON, and file output
• Public doctor.validation.corpus.metrics contract
• Strict snapshot containment, provenance, review completeness, and report redaction controls

See CHANGELOG.md for the full release notes.

Codex Plugin Doctor v1.47.0

Full Changelog: v1.46.1...v1.47.0