@subbly/plugin-lint 0.0.2 → 0.0.3

package/CHANGELOG.md

@@ -1,5 +1,11 @@
 # @subbly/plugin-lint
 
+## 0.0.3
+
+### Patch Changes
+
+- A connector marker may carry a `tools` allowlist beside `auth`, and `auth` becomes optional. `tools` is a non-empty array of unique tool names, 1-100 characters each. A marker with neither field is rejected, as the builder refresh rejects it. Rule ids `connector/marker` and `connector/tools` join `connector/auth`.
+
 ## 0.0.2
 
 ### Patch Changes

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@subbly/plugin-lint",
-  "version": "0.0.2",
+  "version": "0.0.3",
   "private": false,
   "type": "module",
   "description": "The Subbly marketplace release gate, offline. Lints marketplace.json, plugin manifests, mcp.json, skills, agents and automations.",

package/src/report.mjs

@@ -64,7 +64,9 @@ export const RULES = {
   'setup/missing-install-skill': 'setup: true requires a skills/install skill',
 
   // connectors and mcp.json
-  'connector/auth': 'a connector marker is exactly { "auth": "oauth" }',
+  'connector/marker': 'a connector marker holds auth, tools or both, and nothing else',
+  'connector/auth': 'auth, when present, is exactly "oauth"',
+  'connector/tools': 'tools is a non-empty array of unique tool names, 1-100 characters each',
   'connector/name-length': 'connector names are 1-100 characters',
   'connector/undefined-server': 'a declared connector needs a matching mcp.json server',
   'connector/no-mcp': 'declaring a connector requires an mcp.json',

package/src/rules.mjs

@@ -564,7 +564,7 @@ function lintSchedule(report, file, pos, label, schedule) {
 function lintConnectors(report, file, at, check, ns, ext) {
   if (ext.connectors === undefined) return []
   if (!isObject(ext.connectors)) {
-    report.error('connector/auth', file, `${ns}.connectors: expected object, received ${typeOf(ext.connectors)}`, at(`${ns}.connectors`))
+    report.error('connector/marker', file, `${ns}.connectors: expected object, received ${typeOf(ext.connectors)}`, at(`${ns}.connectors`))
     return []
   }
 
@@ -577,18 +577,46 @@ function lintConnectors(report, file, at, check, ns, ext) {
       report.error('connector/name-length', file, `${label}: connector name must be 1-100 characters`, at(p, { key: true }))
     }
     if (!isObject(marker)) {
-      report.error('connector/auth', file, `${label}: expected object, received ${typeOf(marker)}`, at(p))
+      report.error('connector/marker', file, `${label}: expected object, received ${typeOf(marker)}`, at(p))
       continue
     }
-    check.strictKeys('connector/auth', p, marker, ['auth'], label)
-    if (marker.auth !== 'oauth') {
+    check.strictKeys('connector/marker', p, marker, ['auth', 'tools'], label)
+    if (marker.auth === undefined && marker.tools === undefined) {
+      report.error('connector/marker', file, `${label}: declare auth, tools or both`, at(p))
+    }
+    if (marker.auth !== undefined && marker.auth !== 'oauth') {
       report.error('connector/auth', file, `${label}.auth: expected "oauth", received ${JSON.stringify(marker.auth)}`, at(`${p}.auth`))
     }
+    if (marker.tools !== undefined) {
+      lintToolAllowlist(report, file, at, check, `${p}.tools`, `${label}.tools`, marker.tools)
+    }
     names.push(name)
   }
   return names
 }
 
+function lintToolAllowlist(report, file, at, check, p, label, tools) {
+  if (!Array.isArray(tools)) {
+    report.error('connector/tools', file, `${label}: expected array, received ${typeOf(tools)}`, at(p))
+    return
+  }
+  if (tools.length === 0) {
+    report.error('connector/tools', file, `${label}: must name at least one tool`, at(p))
+    return
+  }
+  const seen = new Set()
+  for (const [index, tool] of tools.entries()) {
+    if (!check.string('connector/tools', `${p}.${index}`, tool, { min: 1, max: 100, label: `${label}[${index}]` })) {
+      continue
+    }
+    if (seen.has(tool)) {
+      report.error('connector/tools', file, `${label}[${index}]: duplicate tool name "${tool}"`, at(`${p}.${index}`))
+      continue
+    }
+    seen.add(tool)
+  }
+}
+
 // --- mcp.json --------------------------------------------------------------
 
 function lintMcp(root, entry, manifest, report) {