toolfactory 0.1.1

package/src/surfaces/mcp-registry.test.ts

@@ -0,0 +1,99 @@
+import { describe, expect, it } from "vitest";
+import type { Operation, Project } from "../model.js";
+import { registryName, surface } from "./mcp-registry.js";
+
+const echo: Operation = { name: "echo", inputSchema: { type: "object" }, requires: [] };
+
+function project(overrides: Partial<Project> = {}): Project {
+  return {
+    root: "/repo",
+    tool: {
+      schemaVersion: 1,
+      identity: "plugin.json",
+      binding: "typescript",
+      surfaces: ["mcp-registry", "mcp"],
+      bundle: { runtime: "package" },
+      tests: { examples: {} },
+      ...overrides.tool,
+    },
+    identity: {
+      name: "hello",
+      version: "1.2.0",
+      description: "Say hello",
+      repository: "https://github.com/GoatInAHat/hello-tool",
+      ...overrides.identity,
+    },
+    identityExtra: {},
+    operations: [echo],
+    toolfactoryVersion: "0.1.0",
+    packageManager: "npm",
+    ...overrides,
+  };
+}
+
+function files(target: Project): Record<string, string> {
+  return Object.fromEntries(
+    surface.plan(target).map((file) => [file.path, file.kind === "file" ? file.content : ""]),
+  );
+}
+
+describe("mcp-registry Dockerfile", () => {
+  it("labels the image with server.json's own name, in the final stage, per binding", () => {
+    const ts = files(project());
+    const server = JSON.parse(ts["server.json"] ?? "{}");
+    expect(server.name).toBe("io.github.GoatInAHat/hello");
+    const stages = ts.Dockerfile?.split(/\nFROM /) ?? [];
+    expect(stages.at(-1)).toContain(`LABEL io.modelcontextprotocol.server.name="${server.name}"`);
+
+    const py = files(project({ tool: { ...project().tool, binding: "python" } }));
+    const pyServer = JSON.parse(py["server.json"] ?? "{}");
+    const pyStages = py.Dockerfile?.split(/\nFROM /) ?? [];
+    expect(pyStages.at(-1)).toContain(
+      `LABEL io.modelcontextprotocol.server.name="${pyServer.name}"`,
+    );
+  });
+
+  it("runs the kernel's mcp entrypoint directly, independent of the packaging step", () => {
+    const ts = files(project({ packageManager: "pnpm" }));
+    expect(ts.Dockerfile).toContain('ENTRYPOINT ["node","dist/toolfactory/mcp.js"]');
+    expect(ts.Dockerfile).toContain("RUN corepack enable");
+    expect(ts.Dockerfile).toContain("pnpm install --frozen-lockfile");
+
+    const npmBuilt = files(project({ packageManager: "npm" }));
+    expect(npmBuilt.Dockerfile).toContain("npm ci");
+    expect(npmBuilt.Dockerfile).not.toContain("corepack enable");
+
+    const py = files(project({ tool: { ...project().tool, binding: "python" } }));
+    expect(py.Dockerfile).toContain('ENTRYPOINT ["python","-m","hello.toolfactory.mcp"]');
+  });
+});
+
+describe("mcp-registry server.json oci package", () => {
+  it("adds an oci entry with a lowercased ghcr.io identifier, unconditionally", () => {
+    const server = JSON.parse(files(project())["server.json"] ?? "{}");
+    const oci = server.packages.find((pkg: { registryType: string }) => pkg.registryType === "oci");
+    expect(oci).toMatchObject({
+      registryType: "oci",
+      identifier: "ghcr.io/goatinahat/hello:1.2.0",
+      transport: { type: "stdio" },
+    });
+    // No `npm`/`pypi` surface selected, yet the oci entry is still present.
+    expect(server.packages).toHaveLength(1);
+  });
+
+  it("adds the npm entry alongside oci once `npm` is also selected", () => {
+    const server = JSON.parse(
+      files(project({ tool: { ...project().tool, surfaces: ["mcp-registry", "mcp", "npm"] } }))[
+        "server.json"
+      ] ?? "{}",
+    );
+    expect(server.packages.map((pkg: { registryType: string }) => pkg.registryType)).toEqual([
+      "npm",
+      "oci",
+    ]);
+  });
+
+  it("still throws registryName's error when the identity carries no GitHub repository", () => {
+    expect(() => registryName({ identity: { name: "hello" } })).toThrow(/GitHub repository/);
+  });
+});

package/src/surfaces/mcp-registry.ts

@@ -0,0 +1,190 @@
+/**
+ * MCP Registry: `server.json` plus the package ownership marker, and the root `Dockerfile`
+ * that makes the OCI leg of `server.json` real. Publishing is the `mcp-publisher` Go binary
+ * and, for the image, `docker/build-push-action`, both in CI; nothing runs here.
+ */
+import { pythonPackage } from "../bindings/python.js";
+import { KERNEL_DIR } from "../bindings/typescript.js";
+import { githubOwner, projectName } from "../identity/name.js";
+import type { Project, Surface } from "../model.js";
+import {
+  compact,
+  configProperties,
+  envName,
+  has,
+  isSensitive,
+  json,
+  npmName,
+  pypiName,
+  requiredConfig,
+} from "./shared.js";
+
+export const SERVER_SCHEMA_ID =
+  "https://static.modelcontextprotocol.io/schemas/2025-12-11/server.schema.json";
+
+/** `owner` from the identity file's GitHub repository, or the error every registry name needs it for. */
+function requireGithubOwner(identity: { repository?: string }): string {
+  const owner = githubOwner(identity.repository);
+  if (!owner) {
+    throw new Error(
+      'Surface "mcp-registry" needs a GitHub repository URL in the identity file to derive io.github.<owner>/<name>.',
+    );
+  }
+  return owner;
+}
+
+export function registryName(project: { identity: { name: string; repository?: string } }): string {
+  return projectName.mcpRegistry(project.identity.name, requireGithubOwner(project.identity));
+}
+
+/** The registry schema caps description at 100 characters; cut at a word boundary. */
+export function registryDescription(text: string): string {
+  if (text.length <= 100) return text;
+  const cut = text.slice(0, 100);
+  return cut.slice(0, Math.max(cut.lastIndexOf(" "), 1)).replace(/[\s,;:/-]+$/, "");
+}
+
+/** `ghcr.io` requires a lowercase path; the canonical name N is already lowercase (`NAME_PATTERN`). */
+export function ociImage(project: Project, owner: string): string {
+  const version = project.identity.version ?? "0.0.0";
+  return `ghcr.io/${owner.toLowerCase()}/${project.identity.name}:${version}`;
+}
+
+/**
+ * The kernel's own `mcp` entrypoint (stdio, the only transport the image can serve —
+ * `mcp.ts`/`mcp.py` binds no host flag), invoked directly so the image never depends on
+ * whether `cli` or `mcp` happen to be selected: `kernel()` writes this file for every project
+ * regardless of surface selection (`src/project/plan.ts`).
+ */
+function dockerEntrypoint(project: Project): string[] {
+  return project.tool.binding === "python"
+    ? ["python", "-m", `${pythonPackage(project)}.toolfactory.mcp`]
+    : ["node", `${KERNEL_DIR.replace(/^src\//, "dist/")}/mcp.js`];
+}
+
+const NODE_IMAGE = "node:24-alpine";
+const PYTHON_IMAGE = "python:3.12-slim-bookworm";
+const UV_IMAGE = "ghcr.io/astral-sh/uv:python3.12-bookworm-slim";
+
+/** What each package manager spells inside the build stage; mirrors `workflows.ts`'s own table. */
+const DOCKER_PACKAGE_MANAGERS: Record<
+  "npm" | "pnpm",
+  { lockfile: string; corepack: boolean; install: string; build: string; prune: string }
+> = {
+  npm: {
+    lockfile: "package-lock.json",
+    corepack: false,
+    install: "npm ci",
+    build: "npm run build",
+    prune: "npm prune --omit=dev",
+  },
+  pnpm: {
+    lockfile: "pnpm-lock.yaml",
+    corepack: true,
+    install: "pnpm install --frozen-lockfile",
+    build: "pnpm run build",
+    prune: "pnpm prune --prod",
+  },
+};
+
+/**
+ * The root `Dockerfile`, stdio only (§4.1: no `--host` flag exists to bind past loopback), one
+ * multi-stage build per binding. `label` is `server.json`'s own `name`, byte for byte — the MCP
+ * registry's OCI ownership check reads it back out of the image config (`LABEL`, final stage).
+ */
+export function dockerfileTemplate(project: Project, label: string): string {
+  if (project.tool.binding === "python") {
+    return `# syntax=docker/dockerfile:1
+FROM ${UV_IMAGE} AS build
+WORKDIR /app
+COPY pyproject.toml ./
+COPY src ./src
+RUN uv sync --no-dev
+
+FROM ${PYTHON_IMAGE}
+LABEL io.modelcontextprotocol.server.name="${label}"
+WORKDIR /app
+COPY --from=build /app/.venv ./.venv
+COPY --from=build /app/src ./src
+COPY --from=build /app/pyproject.toml ./
+ENV PATH="/app/.venv/bin:$PATH"
+ENTRYPOINT ${JSON.stringify(dockerEntrypoint(project))}
+`;
+  }
+  const pm = DOCKER_PACKAGE_MANAGERS[project.packageManager ?? "npm"];
+  return `# syntax=docker/dockerfile:1
+FROM ${NODE_IMAGE} AS build
+WORKDIR /app
+${pm.corepack ? "RUN corepack enable\n" : ""}COPY package.json ${pm.lockfile} ./
+RUN ${pm.install}
+COPY . .
+RUN ${pm.build} && ${pm.prune}
+
+FROM ${NODE_IMAGE}
+LABEL io.modelcontextprotocol.server.name="${label}"
+WORKDIR /app
+COPY --from=build /app/node_modules ./node_modules
+COPY --from=build /app/dist ./dist
+COPY --from=build /app/package.json ./
+ENTRYPOINT ${JSON.stringify(dockerEntrypoint(project))}
+`;
+}
+
+export const surface: Surface = {
+  id: "mcp-registry",
+  plan(project) {
+    const { identity } = project;
+    const version = identity.version ?? "0.0.0";
+    const owner = requireGithubOwner(identity);
+    const name = projectName.mcpRegistry(identity.name, owner);
+    const environmentVariables = Object.entries(configProperties(project)).map(([key, property]) =>
+      compact({
+        name: envName(key),
+        description: property.description,
+        isRequired: requiredConfig(project).includes(key) || undefined,
+        isSecret: isSensitive(property) || undefined,
+      }),
+    );
+    const withEnv = <T extends Record<string, unknown>>(entry: T) =>
+      compact({
+        ...entry,
+        environmentVariables: environmentVariables.length ? environmentVariables : undefined,
+      });
+    const pkg =
+      project.tool.binding === "python"
+        ? {
+            registryType: "pypi",
+            identifier: pypiName(project),
+            version,
+            transport: { type: "stdio" },
+          }
+        : {
+            registryType: "npm",
+            identifier: npmName(project),
+            version,
+            transport: { type: "stdio" },
+          };
+    // The OCI leg is unconditional: the root Dockerfile it names ships from every mcp-registry
+    // selection (the kernel's mcp.ts/mcp.py already exists for every project, D10), unlike the
+    // npm/pypi entry, which only exists when that distribution surface is also selected.
+    const oci = withEnv({
+      registryType: "oci",
+      identifier: ociImage(project, owner),
+      transport: { type: "stdio" },
+    });
+    const packages = [...(has(project, "npm") || has(project, "pypi") ? [withEnv(pkg)] : []), oci];
+    const server = compact({
+      $schema: SERVER_SCHEMA_ID,
+      name,
+      description: registryDescription(identity.description ?? identity.name),
+      version,
+      repository: identity.repository ? { url: identity.repository, source: "github" } : undefined,
+      websiteUrl: identity.homepage,
+      packages,
+    });
+    return [
+      { kind: "file", path: "server.json", content: json(server) },
+      { kind: "file", path: "Dockerfile", content: dockerfileTemplate(project, name) },
+    ];
+  },
+};

package/src/surfaces/mcpb.test.ts

@@ -0,0 +1,112 @@
+import { describe, expect, it } from "vitest";
+import { NODE_ENGINES } from "../bindings/typescript.js";
+import type { Operation, Project } from "../model.js";
+import { MCPB_PIN, surface as mcpb } from "./mcpb.js";
+
+const echo: Operation = {
+  name: "echo",
+  description: "Echoes.",
+  inputSchema: { type: "object" },
+  requires: [],
+};
+const browse: Operation = {
+  name: "browse",
+  inputSchema: { type: "object" },
+  requires: ["browser"],
+};
+
+const project: Project = {
+  root: "/repo",
+  tool: {
+    schemaVersion: 1,
+    identity: "plugin.json",
+    binding: "typescript",
+    surfaces: ["mcp", "npm", "mcpb"],
+    bundle: { runtime: "package" },
+    tests: { examples: {} },
+    config: {
+      properties: {
+        apiKey: { type: "string", title: "API key", "x-toolfactory": { sensitive: true } },
+        region: { type: "string", description: "Service region." },
+      },
+      required: ["apiKey"],
+    },
+  },
+  identity: {
+    name: "hello.tool",
+    version: "0.1.0",
+    description: "Says hello.",
+    author: { name: "Ada" },
+    homepage: "https://example.com",
+    repository: "https://github.com/ada/hello",
+    license: "MIT",
+  },
+  identityExtra: {},
+  operations: [echo, browse],
+  toolfactoryVersion: "0.1.0",
+  packageManager: "npm",
+};
+
+const [manifestFile, ...rest] = mcpb.plan(project);
+if (manifestFile?.kind !== "file") throw new Error("expected one whole file");
+const manifest = JSON.parse(manifestFile.content) as Record<string, unknown>;
+
+describe("mcpb", () => {
+  it("is one manifest: the built kernel entry under ${__dirname}, config as user_config, the operations MCP serves", () => {
+    expect(rest).toEqual([]);
+    expect(manifestFile.path).toBe("hosts/mcpb/manifest.json");
+    expect(manifest).toEqual({
+      manifest_version: "0.2",
+      name: "hello.tool",
+      display_name: "hello.tool",
+      version: "0.1.0",
+      description: "Says hello.",
+      author: { name: "Ada" },
+      homepage: "https://example.com",
+      documentation: "https://example.com",
+      repository: { type: "git", url: "https://github.com/ada/hello" },
+      license: "MIT",
+      server: {
+        type: "node",
+        // The npm tarball's built entry, the same file the mcp-registry Dockerfile runs.
+        entry_point: "dist/toolfactory/mcp.js",
+        mcp_config: {
+          command: "node",
+          args: ["${__dirname}/dist/toolfactory/mcp.js"],
+          // Claude Desktop substitutes these from the settings UI `user_config` generates.
+          env: { APIKEY: "${user_config.apiKey}", REGION: "${user_config.region}" },
+        },
+      },
+      // `browse` needs a host capability MCP cannot serve, so the install UI must not list it.
+      tools: [{ name: "echo", description: "Echoes." }],
+      user_config: {
+        apiKey: {
+          type: "string",
+          title: "API key",
+          description: "apiKey",
+          required: true,
+          sensitive: true,
+        },
+        region: { type: "string", title: "region", description: "Service region." },
+      },
+      compatibility: { runtimes: { node: NODE_ENGINES } },
+    });
+    // No privacy_policies unless tool.json names them (see the module docs).
+    expect(manifestFile.content).not.toContain("privacy_policies");
+  });
+
+  it("declares the kernel's own Node floor, and refuses a binding whose package is not the bundle", () => {
+    expect(() => mcpb.plan({ ...project, tool: { ...project.tool, binding: "python" } })).toThrow(
+      /requires the typescript binding/,
+    );
+
+    expect(mcpb.validate?.(project)).toEqual([
+      {
+        label: "mcpb validate",
+        command: "npx",
+        args: ["-y", `@anthropic-ai/mcpb@${MCPB_PIN}`, "validate", "hosts/mcpb/manifest.json"],
+        cwd: "/repo",
+      },
+    ]);
+  });
+});

package/src/surfaces/mcpb.ts

@@ -0,0 +1,130 @@
+/**
+ * MCPB (MCP Bundle): the one-click `.mcpb` Claude Desktop installs, and the only channel
+ * Anthropic's Connectors Directory takes a *local* server through.
+ *
+ * A bundle is a zip whose root is the server plus its dependencies plus a `manifest.json`. That
+ * root is a staging tree, not the repository: the payload is exactly the npm tarball with
+ * production dependencies installed into it, which `src/project/gate.ts` builds under
+ * `dist/mcpb/` at package time. So this surface emits one tracked file — the manifest — and the
+ * packaging step copies it in; nothing here duplicates what `npm pack` already decides ships.
+ *
+ * `manifest_version` is `0.2`, which is what `mcpb init` itself writes for a new bundle (0.3 and
+ * 0.4 exist, and add icon variants, localization and the `uv` server type — none of which this
+ * projection uses) and the floor Anthropic's directory submission requires.
+ *
+ * `privacy_policies` (the URLs of the privacy policies of the services a bundle talks to, which
+ * Anthropic's directory submission requires) comes from `tool.json` `mcpb.privacyPolicies`; a
+ * homepage is not one, so nothing is invented when the key is absent.
+ */
+import { KERNEL_DIR, NODE_ENGINES } from "../bindings/typescript.js";
+import type { Project, Surface } from "../model.js";
+import { compact, configProperties, envName, isSensitive, json, mcpVerdict } from "./shared.js";
+
+export const HOST_DIR = "hosts/mcpb";
+export const MANIFEST_PATH = `${HOST_DIR}/manifest.json`;
+
+/**
+ * The `@anthropic-ai/mcpb` release `validate()` and the packaging step run. Pinned so the gate is
+ * reproducible; Renovate bumps this constant (`renovate.json` `customManagers`).
+ */
+export const MCPB_PIN = "2.1.2";
+
+/** What `mcpb init` writes for a new bundle, and the floor the directory submission requires. */
+export const MANIFEST_VERSION = "0.2";
+
+/**
+ * The kernel's built `mcp` entry inside the bundle root — the same file the `mcp-registry`
+ * surface's Dockerfile runs, because both start from the published package's `dist/`.
+ */
+function entryPoint(): string {
+  // A function, not a module-level constant: `mcpb` sits in an import cycle with the
+  // TypeScript binding, and a `const` derived from another module's `const` at evaluation
+  // time is only defined for one of the two possible orders.
+  return `${KERNEL_DIR.replace(/^src\//, "dist/")}/mcp.js`;
+}
+
+/**
+ * `compatibility.runtimes.node`: the kernel's own floor, mirroring the TypeScript scaffold's
+ * `engines.node` (`mcpb.test.ts` fails when the two drift apart). Claude Desktop ships a Node it
+ * runs bundles with, and reads this to refuse a bundle that one is too old for.
+ */
+
+/** JSON Schema types `user_config` has a field type for; anything else is collected as text. */
+const USER_CONFIG_TYPES = new Set(["string", "number", "boolean"]);
+
+export const surface: Surface = {
+  id: "mcpb",
+  plan(project: Project) {
+    if (project.tool.binding !== "typescript") {
+      // A python bundle would have to vendor an interpreter's site-packages into the bundle root
+      // (Claude Desktop ships Node, not Python), which `npm pack` plus `npm install` gives the
+      // TypeScript binding for free and `uv` gives no equivalent of.
+      throw new Error(
+        'Surface "mcpb" requires the typescript binding: a bundle root is the npm tarball with its production dependencies installed into it.',
+      );
+    }
+    const { identity } = project;
+    const properties = configProperties(project);
+    const required = new Set(project.tool.config?.required as string[] | undefined);
+    const userConfig = Object.entries(properties).map(([key, property]) => [
+      key,
+      compact({
+        type: USER_CONFIG_TYPES.has(property.type as string) ? property.type : "string",
+        title: (property.title as string | undefined) ?? key,
+        description: (property.description as string | undefined) ?? key,
+        required: required.has(key) || undefined,
+        sensitive: isSensitive(property) || undefined,
+      }),
+    ]);
+    // Claude Desktop substitutes `${user_config.K}` from the settings UI it generates, so the
+    // kernel reads its configuration from the same environment names it does everywhere else.
+    const env = Object.fromEntries(
+      Object.keys(properties).map((key) => [envName(key), `\${user_config.${key}}`]),
+    );
+    const manifest = compact({
+      manifest_version: MANIFEST_VERSION,
+      name: identity.name,
+      display_name: identity.name,
+      version: identity.version,
+      description: identity.description,
+      author: identity.author?.name ? identity.author : { name: identity.name },
+      homepage: identity.homepage,
+      documentation: identity.homepage,
+      repository: identity.repository ? { type: "git", url: identity.repository } : undefined,
+      license: identity.license,
+      privacy_policies: project.tool.mcpb?.privacyPolicies,
+      keywords: identity.keywords,
+      server: {
+        type: "node",
+        entry_point: entryPoint(),
+        // `${__dirname}` is the installed bundle's own directory: an install is an unzip
+        // somewhere else, so nothing in the launch may be repository-relative.
+        mcp_config: compact({
+          command: "node",
+          args: [`\${__dirname}/${entryPoint()}`],
+          env: Object.keys(env).length ? env : undefined,
+        }),
+      },
+      // Exactly the operations the kernel's own `tools/list` serves (§4.3): the manifest is what
+      // the install UI shows before the server ever runs, so it must not promise more.
+      tools: project.operations
+        .filter((operation) => mcpVerdict(operation).kind !== "excluded")
+        .map((operation) => compact({ name: operation.name, description: operation.description })),
+      user_config: userConfig.length ? Object.fromEntries(userConfig) : undefined,
+      compatibility: { runtimes: { node: NODE_ENGINES } },
+    });
+    return [{ kind: "file", path: MANIFEST_PATH, content: json(manifest) }];
+  },
+  validate(project) {
+    return [
+      {
+        label: "mcpb validate",
+        command: "npx",
+        args: ["-y", `@anthropic-ai/mcpb@${MCPB_PIN}`, "validate", MANIFEST_PATH],
+        cwd: project.root,
+      },
+    ];
+  },
+  // The bundle carries MCP tool calls and nothing else: the rule is the `mcp` surface's own.
+  verdict: mcpVerdict,
+};

package/src/surfaces/npm.ts

@@ -0,0 +1,78 @@
+/**
+ * npm package: identity projected into package.json (merge; the author owns the rest),
+ * the CLI bin, and the MCP Registry ownership marker.
+ */
+
+import { githubSlug } from "../hosts/github.js";
+import type { Surface } from "../model.js";
+import { registryName } from "./mcp-registry.js";
+import { compact, has, npmName } from "./shared.js";
+import { WEB_DIR } from "./web.js";
+
+/**
+ * npm's object form. A bare URL string is only valid as one of npm's shorthands, so `publint`
+ * rejects the one an identity file carries; the slug keeps its authored case, because GitHub
+ * owner and repository names are case-preserving.
+ */
+function repositoryField(
+  repository: string | undefined,
+): { type: string; url: string } | undefined {
+  if (!repository) return undefined;
+  const slug = githubSlug(repository);
+  return { type: "git", url: slug ? `git+https://github.com/${slug}.git` : repository };
+}
+
+export const surface: Surface = {
+  id: "npm",
+  plan(project) {
+    if (project.tool.binding !== "typescript") {
+      throw new Error('Surface "npm" requires the typescript binding.');
+    }
+    const { identity } = project;
+    const authored = project.tool.identity === "package.json";
+    const patch = compact({
+      name: authored ? undefined : npmName(project),
+      version: authored ? undefined : identity.version,
+      description: authored ? undefined : identity.description,
+      license: authored ? undefined : identity.license,
+      homepage: authored ? undefined : identity.homepage,
+      repository: authored ? undefined : repositoryField(identity.repository),
+      keywords: authored ? undefined : identity.keywords,
+      type: "module",
+      bin:
+        has(project, "cli") || has(project, "mcp")
+          ? { [identity.name]: "./dist/toolfactory/cli.js" }
+          : undefined,
+      // `web/dist` only with the `web` surface: the kernel serves the built page from inside
+      // the installed package, so `npx <tool> mcp --http --open` works without a checkout.
+      files: [
+        "dist",
+        "src",
+        "schemas",
+        ...(has(project, "web") ? [`${WEB_DIR}/dist`] : []),
+        "README.md",
+        "LICENSE",
+      ],
+      mcpName: has(project, "mcp-registry") ? registryName(project) : undefined,
+    });
+    return [{ kind: "merge", path: "package.json", format: "json", patch, owned: ["bin"] }];
+  },
+  validate(project) {
+    return [
+      {
+        label: "npm pack",
+        command: "npm",
+        args: ["pack", "--dry-run", "--ignore-scripts"],
+        cwd: project.root,
+      },
+      {
+        // The publishing linter: it packs the tarball and reads it the way npm, the CDNs and the
+        // bundlers do. `--strict` because its default exit code is 0 even with warnings.
+        label: "publint",
+        command: "npx",
+        args: ["--yes", "publint", "--strict"],
+        cwd: project.root,
+      },
+    ];
+  },
+};