Skip to content
This repository was archived by the owner on Nov 4, 2026. It is now read-only.

Repository navigation
This repository was archived by the owner on Nov 4, 2026. It is now read-only.

@object-ui/console 是第三个「声明 license: MIT 却不带许可证文本发布」的包 —— #3696 的普查口径只数了 packages/*,漏掉 apps/* #3702

Closed
#3703
Closed
@object-ui/console 是第三个「声明 license: MIT 却不带许可证文本发布」的包 —— #3696 的普查口径只数了 packages/*,漏掉 apps/*#3702
#3703
Labels
pm:blockedpm:queue

Description

@yinlianghui
yinlianghui
opened on Aug 7, 2026

发现于 #3696 的实施。不在该单完成范围内(#3696 的标题与文件面都只点名 react-runtime / sdui-parser 两个包),单独记录。

事实(origin/main 3e601773e)

#3696 正文说「38 个已发布(非 private)包里,36 个有 LICENSE 文件,2 个没有」。这个口径只展开了 packages/*。pnpm-workspace.yaml 的 packages: 块实际有四个根:packages/*、examples/*、apps/*、docs。按全部四个根重新普查:

数量
工作区包总数 45
非 private 39
非 private 且声明 license 字段 39(全部为 MIT)
其中没有 LICENSE 文件 3

那 3 个是:

包 目录 private license publishConfig LICENSE 文件
@object-ui/react-runtime packages/react-runtime 否 MIT 无 无 → #3696 修
@object-ui/sdui-parser packages/sdui-parser 否 MIT 无 无 → #3696 修
@object-ui/console apps/console 否 MIT {"access":"public"} 无 ← 本条

@object-ui/console 确实是发布物,不是「恰好没写 private 的内部 app」

四条独立佐证:

  1. package.json 显式写了 "publishConfig": {"access": "public"} —— 这是主动声明要公开发布,比「没写 private」强得多。
  2. 有 "version": "17.3.0",与其余 38 个已发布包同版本线。
  3. .changeset/config.json 的 fixed 组里列着 @object-ui/console —— 它随整组一起 bump、一起发版。
  4. 有 prepublishOnly 脚本,且 files 明确列了 dist、plugin.ts、plugin.js、plugin.d.ts、README.md。

所以它与另外两个包处在完全相同的状态:manifest 声明 MIT,tarball 里没有 MIT 要求随分发附带的许可证与版权声明。

与 #3696 的关系:已被其门禁看见并挂账,不是漏网

#3696 的 PR 给 scripts/__tests__/package-files-exist.test.ts 加了那道「非 private 且声明 license 的包必须有许可证文本」的门禁。该门禁的判据是派生的(不是硬编码包名单),所以它同样会点名 apps/console。为了不让门禁一落地就是红的、又不越出 #3696 的文件面,apps/console 被写进了该门禁自带的 ratchet 基线 KNOWN_LICENSE_TEXT_MISSING,并指向本条 issue。

那是个双向 ratchet(与同文件里 #3663 的 KNOWN_MISSING 同形):

  • 新出现的同类缺陷 → 直接红,不经基线;
  • 基线里的条目一旦修好 → 也红,提示「删掉这一行把进度存档」。

也就是说本条被修时必须同时删掉基线里那一行,否则门禁转红。修法与 #3696 完全一致,预计一个文件:

cp LICENSE apps/console/LICENSE

(仓根 LICENSE 与另外 37 份在 git 里是同一个 blob cf2ca28574caca42deafdee0ea935fc2e2823427,逐字节复制即可 —— #3662 / #3687 已证)

外加删 KNOWN_LICENSE_TEXT_MISSING 里的 apps/console 一行。

为什么 files 不含 LICENSE 不影响修法

同 #3696 正文已论证的那条 npm 语义:LICENSE 属于 npm 无视 files 恒定收录的清单。本次在 #3696 的实施中对这条做了实测(在 packages/sdui-parser 上逐个改名跑 npm pack --dry-run):

文件名 是否进 tarball
LICENSE / License / LICENCE / LICENSE.md / LICENSE.txt 收录
copying 收录
NOTICE 不收录
CHANGELOG.md 不收录
NOTALICENSE 不收录(对照组)

所以 apps/console 只要把文件放进去就会被带上,不需要改 files。

检索

按关键字(LICENSE、console、许可证)与文件路径(apps/console)检索当前 open issues,除 #3696 本身外无覆盖此事的条目,故独立立此条。未挂为 #3696 的子条目,因为它的修复不落在 #3696 的完成范围内 —— #3696 的 PR 合并后即关闭,而 apps/console 仍缺文件。

Blocked-by: objectui#3703

Generated by Claude Code

Activity

  1. yinlianghui commented on Aug 7, 2026

    @yinlianghui
    yinlianghui
    on Aug 7, 2026 – with Claude
    ContributorAuthor

    门禁与基线已随 #3696 的 PR #3703 落地(draft)。本条对应的基线条目在 scripts/__tests__/package-files-exist.test.ts:

    const KNOWN_LICENSE_TEXT_MISSING: Record< string, { issue: string } > = {
  'apps/console': { issue: 'objectui#3702' },
};

    该 ratchet 的双向性在 #3703 里做过实测(逆向验证 C):建出 apps/console/LICENSE 后,the objectui#3696 license baseline only shrinks 立即转红并点名 —— 所以修本条时必须同时删掉上面那一行,否则门禁红。

    × the objectui#3696 license baseline only shrinks
apps/console (objectui#3702): expected [ 'apps/console' ] to deeply equal []
 Tests  1 failed | 10 passed (11)

    完整修法两步:cp LICENSE apps/console/LICENSE,删基线行。无需改 apps/console/package.json 的 files(npm 恒定收录 LICENSE,#3703 已在本仓实测)。

    Generated by Claude Code

  2. claude
    added
    pm:blocked
    pm:queue
    on Aug 7, 2026

  3. claude commented on Aug 7, 2026

    @claude
    claudeBot
    on Aug 7, 2026 – with Claude
    Contributor

    Triage: pm:queue + pm:blocked — objectui seat, no domain:* (sibling repos are whole-repo seats), Blocked-by: objectui#3703.

    Classification — concrete defect, landing site named to the line. Two files, both verified against origin/main:

    1. apps/console/LICENSE — create it by byte-copying the repo-root LICENSE (single blob cf2ca285…, shared by 37 existing copies; established by fix(plugin-tree): 补上 package.json files 已声明、但仓库里不存在的 LICENSE (#3647) #3662 / fix(cli,create-plugin): 删掉两包 files 里声明的 templates —— 该目录从未存在过 (#3665) #3687).
    2. scripts/__tests__/package-files-exist.test.ts — delete the 'apps/console': { issue: 'objectui#3702' } entry from KNOWN_LICENSE_TEXT_MISSING.

    Nothing here needs a ruling: the package is unambiguously a published artifact (explicit publishConfig.access: public, versioned on the same 17.3.0 line, listed in the .changeset/config.json fixed group, has prepublishOnly), and the npm semantics that make the fix sufficient were measured in-repo rather than assumed (the npm pack --dry-run matrix in the body: LICENSE is collected regardless of files, NOTICE/CHANGELOG.md are not).

    Why pm:blocked rather than plain queue. The second half of the fix — removing the baseline row — can only be done after PR #3703 lands, because that PR is what introduces both the gate and the row. The dependency is not cosmetic: the ratchet is bidirectional, so if this issue's LICENSE file merged first and #3703 merged second, #3703 would arrive on main carrying a baseline entry asserting a file that already exists, and the objectui#3696 license baseline only shrinks would go red on main — the shared-damage shape that Operational note 10 is about. The two also collide on scripts/__tests__/package-files-exist.test.ts directly, so they serialize on file面 as well. #3703 is currently open and still draft.

    Not a duplicate of #3696, and deliberately not filed as its sub-issue. #3696 names react-runtime / sdui-parser in both its title and its declared file面; apps/console sits outside its completion scope and would still be missing the file the moment #3696 closes. Keyword sweep over open issues/PRs in all three repos (LICENSE, console, 许可证, path apps/console) turns up nothing else covering it.

    target:v17 deliberately withheld — flagged for the maintainer rather than decided unilaterally. The identical defect on the other two packages (#3696) carries no release-board label, and marking one half of one defect class while the larger, already-in-flight half stays off the board would make the board less honest, not more. If the maintainer reads "published package declares MIT, ships no license text" as criterion ② (declared ≠ enforced on a public surface), the label belongs on #3696 first and on this issue with it; that call is recorded in this round's wrap-up.

    Stale-premise check. apps/console/package.json on origin/main still carries license: MIT with publishConfig.access: public and no LICENSE file; PR #3703 (which introduces the gate and the baseline row) is open, unmerged, draft as of this round.

    本评论来自分诊座位 Routine（#5474 试点），不构成认领。

    Generated by Claude Code

  4. yinlianghui
    added 2 commits that reference this issue on Aug 7, 2026

    fix(react-runtime,sdui-parser): 补上两包声明了 MIT 却从未随包发布的许可证文本 (#3696)

    5a6c34b

    fix(console): 补上 @object-ui/console 的许可证文本并把基线清空 (#3702)

    86e51cc
  5. yinlianghui
    closed this as completedin #3703on Aug 7, 2026
  6. akarma-synetal
    added a commit that references this issue on Aug 10, 2026

    fix(react-runtime,sdui-parser,console): 补上三包声明了 MIT 却从未随包发布的许可证文本,并加门…

    2267d63
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

No one assigned

    Labels

    pm:blockedpm:queue

    Type

    No type

    Projects

    No projects

      Milestone

      No milestone

      Relationships

      None yet

      Development

      No branches or pull requests

      Issue actions