Skip to content

feat(doctor): verify installed plugin version truth - #35

Merged
beefiker merged 8 commits into
mainfrom
codex/installed-plugin-truth
Jul 23, 2026
Merged

feat(doctor): verify installed plugin version truth#35
beefiker merged 8 commits into
mainfrom
codex/installed-plugin-truth

Conversation

@beefiker

Copy link
Copy Markdown
Owner

Summary

  • add a bounded, read-only codex plugin list --json authority check for the exact superloopy@beefiker installation
  • make confirmed version mismatches fail installed scope while remaining informational in source scope
  • sanitize malformed, duplicate, oversized, or control-bearing authority data without exposing raw output
  • add deterministic cross-platform CLI coverage and update Superloopy to 0.12.4

Why

This follows merged PR #34 by closing the remaining gap between the Superloopy version executing doctor and the version Codex reports as installed. Cache directories and wrapper siblings remain advisory only.

The existing installed-scope CLI tests also assumed a healthy live Codex installation. They now assert returned doctor truth or use isolated authority fixtures, so a developer's stale local plugin cannot make the suite nondeterministic.

Validation

  • npm test — 678 passed, 0 failed
  • focused installed-plugin and doctor tests — 37 passed, 0 failed
  • source doctor exits 0 with a local mismatch reported as informational
  • isolated installed doctor exits 0 for current and 1 for confirmed mismatch
  • npm pack --dry-run --json --ignore-scripts includes src/installed-plugin-truth.js
  • all release surfaces report 0.12.4
  • git diff --check origin/main...HEAD

@beefiker
beefiker merged commit 25ba5b4 into main Jul 23, 2026
6 checks passed

@chatgpt-codex-connector chatgpt-codex-connector Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 068dc8aedc

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

  • Open a pull request for review
  • Mark a draft as ready
  • Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

Comment on lines +18 to +21
result = spawnSyncImpl("codex", ["plugin", "list", "--json"], {
encoding: "utf8",
maxBuffer: MAX_OUTPUT_BYTES,
shell: false,

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

P2 Badge Route Windows Codex shim through cmd.exe

On Windows installs where the Codex CLI is available as the usual npm-generated codex.cmd, this direct spawnSync("codex", ...) with shell: false cannot execute the shim (Node documents that .cmd files need a shell or explicit cmd.exe). The probe then returns authority_unavailable, so superloopy doctor --scope installed never gates a real stale superloopy@beefiker mismatch for those Windows users; use the same Windows shim routing pattern as the existing spawn helper for this command.

Useful? React with 👍 / 👎.

maxBuffer: MAX_OUTPUT_BYTES,
shell: false,
stdio: ["ignore", "pipe", "pipe"],
timeout: DEFAULT_TIMEOUT_MS,

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

P2 Badge Escalate hung Codex probes after timeout

When the codex plugin list child wedges or traps SIGTERM, spawnSync does not actually bound this check at five seconds; it sends the timeout kill signal and then waits for the child to exit. In that scenario superloopy doctor can hang indefinitely on this informational authority probe, unlike the existing model-catalog probe that escalates to SIGKILL, so use an async child with the same terminate-and-escalate pattern instead of relying on the sync timeout alone.

Useful? React with 👍 / 👎.

Comment on lines +52 to +56
if (entry.version === executingVersion) {
return {
ok: true,
informational: true,
state: "current",

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

P2 Badge Do not mark disabled plugins current

If Codex reports superloopy@beefiker with installed: true, enabled: false, and a matching version, this branch still returns state: "current" and installed-scope doctor exits successfully. In that disabled-plugin state Codex will not load Superloopy's hooks/skills even though the version matches, so the installed health check should report a non-current/failing state instead of telling users the Codex installation is healthy.

Useful? React with 👍 / 👎.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant