oz0 plugin lint

For: Operators and developers looking up a command.

Check a plugin the way the edge does before it installs one: oz0-plugin.yaml (unknown fields are errors), the agents it lists, its skills and the files they refer to. Each finding says how to fix it. A folder without oz0-plugin.yaml that is one part on its own (a Markdown agent or a flow file that says apiVersion: oz0/v1, or a SKILL.md) is checked with the manifest the loader generates for it.

--fix applies the fixes that are edits of the plugin's YAML (such as input: text on an agent that declares no input, a misspelt field's name or the nearest file to one that is missing), keeping each file's comments and layout, and checks again. From v1.0, an agent that declares neither its input nor its output is an error here, while installs still take it.

Lint also warns about names that may clash with other plugins': tool IDs and agent names that start with neither the plugin's name nor its first dash-separated segment, generic names such as github or search, and the oz0_ and oz0- prefixes of the verified plugins.

With a measured tool listing (tools.listing.json, which plugin test writes), it estimates what each agent's tool definitions cost per model request, warns above 1,500 tokens per function (tools.tokens), and fails when an agent's tool definitions pass its budget (limits.tool_tokens, 8,000 by default; with tool_loading: lazy, the two discovery tools and its built-ins) or all the plugin's functions pass the manifest's tool_tokens (16,000 by default), naming the biggest functions (tools.budget).

A Python or Node project without uv.lock or package-lock.json is a warning here and refused at install. Exits non-zero on errors. It checks the plugin on its own and cannot see a tenant: plugin preview and the install check that its agent names and tool IDs are free there, since each belongs to one plugin per tenant.

Lint also checks the house rules of how a plugin is structured (OZ-S001 and on: the manifest's kind, a connector without business logic, a capability without credentials of its own, writes behind approval, exact egress, names, connections instead of pasted secrets, output schemas, exact uses:, no LiteLLM, the AI Act's Annex III areas, references to another plugin's parts that name it); the docs page How to structure plugins explains each by its ID.

They are warnings, except LiteLLM, which is an error; --verified lints at the level verified plugins are held to, where every one is an error and the measured tool listing must hold every tool and be measured from the plugin's files as they are.

Lint checks the README the hub's page shows against these limits:

• At most 64 KiB of README text.
• At most 20 images from the package: at most 1 MiB and 4,096 pixels a side each, and 5 MiB together. Only PNG, JPEG, WebP or GIF.
• At most 10 Mermaid diagrams of at most 5,000 characters each.

It also checks the licence files against the manifest's license: (an SPDX expression). These checks apply to every plugin:

• A limit passed or a file that reads as another licence is an error here, as in plugin pack and hub submit.
• A missing licence file is a warning here and an error at hub submit.
• Installs take them all as warnings but a license: that is not SPDX.

The docs page Plugin limits explains each by its code.

Usage

oz0 plugin lint [dir] [flags]

Flags

Inherited flags

See all oz0 commands and the global flags.