← reports

#6662 · Package artifacts omit MIT licensing

BugPriority: MediumEffort: Lowdesktop · pluginsGitHub issue2026-10-30 · base a1bf55b6a04c7948ae5ae0dcfcbdec27d2b507a2

Verdict: REPRODUCED · Root-cause confidence: high · reproduction label: confirmed-repro

1. TL;DR

The repository declares MIT, but the two public package manifests do not declare a license. The actual published archives for the versions in trusted main, bb-app 0.48.1 and @get-bb/plugin-sdk 0.6.104, also contain neither a license field nor a package-root license notice. A direct artifact audit produced ten failed license checks, then produced exactly the same failures from a second clean checkout of the same main commit. Source packing independently produces the same omission; there is no package-local notice or build step that supplies it. No automatic fix PR is opened because altering published metadata and archive contents is a packaging change, explicitly excluded by this automation's simple-fix policy.

2. Claims vs findings

3. Environment

Public repository get-bb/bb, origin/main at a1bf55b6a04c7948ae5ae0dcfcbdec27d2b507a2; Linux x86_64; Node v22.19.0; pnpm 9.15.0; npm 10.9.3. Local source package versions: bb-app 0.48.1 and @get-bb/plugin-sdk 0.6.104. Two separate temporary checkout directories were used, referred to here as $BASE and $VERIFY; paths and machine identity are intentionally not published. No app, provider session, port, runtime database, or personal data directory was used.

4. Minimal reproduction

1. Clone the public repository into a fresh directory and select the recorded trusted main commit.

   git clone https://github.com/get-bb/bb.git base
   git -C base checkout --detach a1bf55b6a04c7948ae5ae0dcfcbdec27d2b507a2
   BASE="$PWD/base"

2. Save the following dependency-free audit as audit-package-license.mjs, outside the checkout. It derives package identities and versions from trusted source, packs source with lifecycle scripts disabled, and optionally inspects registry metadata and published archives. Downloaded package code is never executed.

   import { execFileSync } from "node:child_process";
   import { mkdtempSync, readFileSync, rmSync, writeFileSync } from "node:fs";
   import { tmpdir } from "node:os";
   import { join, resolve } from "node:path";
   
   const checkout = resolve(process.argv[2]);
   const inspectRegistry = process.argv.includes("--registry");
   const scratch = mkdtempSync(join(tmpdir(), "license-audit-"));
   let failures = 0;
   
   function check(condition, message) {
     console.log(`${condition ? "PASS" : "FAIL"} ${message}`);
     if (!condition) failures += 1;
   }
   
   function inspectArchive(archive, label) {
     const manifest = JSON.parse(execFileSync("tar", ["-xOf", archive, "package/package.json"], { encoding: "utf8" }));
     const entries = execFileSync("tar", ["-tzf", archive], { encoding: "utf8" }).trim().split("\n");
     const notices = entries.filter((entry) => /^package\/licen[cs]e(?:\.[^/]*)?$/i.test(entry));
     check(manifest.license === "MIT", `${label}: manifest license=${JSON.stringify(manifest.license ?? null)} (expected "MIT")`);
     check(notices.length > 0, `${label}: root license files=${JSON.stringify(notices)} (expected MIT notice)`);
   }
   
   try {
     check(JSON.parse(readFileSync(join(checkout, "package.json"), "utf8")).license === "MIT", "repository declares MIT");
     for (const directory of ["packages/bb-app", "packages/plugin-sdk"]) {
       const packageRoot = join(checkout, directory);
       const manifest = JSON.parse(readFileSync(join(packageRoot, "package.json"), "utf8"));
       const packed = JSON.parse(execFileSync("npm", ["pack", "--ignore-scripts", "--json", "--pack-destination", scratch], { cwd: packageRoot, encoding: "utf8", stdio: ["ignore", "pipe", "pipe"] }));
       inspectArchive(join(scratch, packed[0].filename), `local ${manifest.name}@${manifest.version}`);
       if (!inspectRegistry) continue;
       const metadataUrl = `https://registry.npmjs.org/${encodeURIComponent(manifest.name)}/${encodeURIComponent(manifest.version)}`;
       const metadataResponse = await fetch(metadataUrl);
       if (!metadataResponse.ok) throw new Error(`Registry metadata HTTP ${metadataResponse.status}`);
       const metadata = await metadataResponse.json();
       if (metadata.name !== manifest.name || metadata.version !== manifest.version) throw new Error("Registry identity mismatch");
       check(metadata.license === "MIT", `registry ${manifest.name}@${manifest.version}: license=${JSON.stringify(metadata.license ?? null)} (expected "MIT")`);
       const archiveUrl = new URL(metadata.dist.tarball);
       if (archiveUrl.protocol !== "https:" || archiveUrl.hostname !== "registry.npmjs.org") throw new Error("Unexpected registry archive host");
       const archiveResponse = await fetch(archiveUrl);
       if (!archiveResponse.ok) throw new Error(`Registry archive HTTP ${archiveResponse.status}`);
       const archive = join(scratch, "registry.tgz");
       writeFileSync(archive, Buffer.from(await archiveResponse.arrayBuffer()));
       inspectArchive(archive, `published ${manifest.name}@${manifest.version}`);
     }
     console.log(`RESULT ${failures} failed license checks`);
     process.exitCode = failures > 0 ? 1 : 0;
   } finally {
     rmSync(scratch, { recursive: true, force: true });
   }
   

3. Run the audit. Network access to the public npm registry is needed only with --registry.

   node audit-package-license.mjs "$BASE" --registry
   expected: repository and all ten package license checks PASS; exit 0
   actual:
   PASS repository declares MIT
   FAIL local bb-app@0.48.1: manifest license=null (expected "MIT")
   FAIL local bb-app@0.48.1: root license files=[] (expected MIT notice)
   FAIL registry bb-app@0.48.1: license=null (expected "MIT")
   FAIL published bb-app@0.48.1: manifest license=null (expected "MIT")
   FAIL published bb-app@0.48.1: root license files=[] (expected MIT notice)
   FAIL local @get-bb/plugin-sdk@0.6.104: manifest license=null (expected "MIT")
   FAIL local @get-bb/plugin-sdk@0.6.104: root license files=[] (expected MIT notice)
   FAIL registry @get-bb/plugin-sdk@0.6.104: license=null (expected "MIT")
   FAIL published @get-bb/plugin-sdk@0.6.104: manifest license=null (expected "MIT")
   FAIL published @get-bb/plugin-sdk@0.6.104: root license files=[] (expected MIT notice)
   RESULT 10 failed license checks
   exit 1

The local pack uses --ignore-scripts, so it is not represented as a complete release build. The published-tarball checks inspect real release artifacts and independently establish the shipped defect. The test protects the consumer-visible contract that the packed manifest declares MIT and that a package-root notice exists; deleting either is a credible regression. Existing published-files tests cover sourcemap exclusions, not licensing. The audit needs no production-only test seam.

5. Root cause

The monorepo root has "license": "MIT" and a LICENSE file, but npm publication occurs from each package directory rather than the repository root. Neither package manifest declares a license, neither package directory has a LICENSE, and their build/prepack paths do not copy the repository notice into those package roots. npm's archive selection therefore has no package-local notice to include. A files allowlist does not itself provide a file from outside the package directory. This is a distribution-metadata omission, not a change of the repository's license.

• Root package manifest declares MIT; root notice supplies its terms.
• bb-app manifest identity has no license field; publication files and prepack select built outputs and prune CLI chunks, not licensing.
• SDK manifest identity and publication files omit licensing; runtime build assembles runtime entry files, not a package-root notice.
• Application publication runs in the application package directory; SDK publication runs in the SDK package directory.

6. Proposed fix

In a separately authorized packaging change, declare MIT in each public package manifest and place the exact repository LICENSE notice in each package root before publication. Extend artifact-level coverage to inspect the packed manifest and notice bytes for both packages, including the normal prepack paths; keep any copied notices synchronized with the repository source. Rebuild and audit the resulting archives before publishing new versions. No source fix, branch, commit, or PR was attempted here because packaging/release changes fail the autopilot's simple-fix gate regardless of line count.

7. Related issues and PRs

No linked open PR appeared in the issue's connected/cross-reference events or in the open-PR search for issue 6662. A repository issue-title search for licensing found only this issue. No linked PR code was checked out or executed.

8. Verification

The same agent repeated the audit in a second clean checkout at the identical trusted base commit. This is a clean rerun, not an independent review. Before the run, git status --porcelain produced no output. The second checkout had no installed dependencies or built outputs, and the standalone audit still reproduced the omissions in freshly packed source and the actual published archives. Both runs returned exit 1 with byte-identical diagnostic output; no claim needed correction.

git clone https://github.com/get-bb/bb.git verify
git -C verify checkout --detach a1bf55b6a04c7948ae5ae0dcfcbdec27d2b507a2
VERIFY="$PWD/verify"
git -C "$VERIFY" status --porcelain
node audit-package-license.mjs "$VERIFY" --registry
PASS repository declares MIT
FAIL local bb-app@0.48.1: manifest license=null (expected "MIT")
FAIL local bb-app@0.48.1: root license files=[] (expected MIT notice)
FAIL registry bb-app@0.48.1: license=null (expected "MIT")
FAIL published bb-app@0.48.1: manifest license=null (expected "MIT")
FAIL published bb-app@0.48.1: root license files=[] (expected MIT notice)
FAIL local @get-bb/plugin-sdk@0.6.104: manifest license=null (expected "MIT")
FAIL local @get-bb/plugin-sdk@0.6.104: root license files=[] (expected MIT notice)
FAIL registry @get-bb/plugin-sdk@0.6.104: license=null (expected "MIT")
FAIL published @get-bb/plugin-sdk@0.6.104: manifest license=null (expected "MIT")
FAIL published @get-bb/plugin-sdk@0.6.104: root license files=[] (expected MIT notice)
RESULT 10 failed license checks
exit 1

9. Appendix and limitations

Preparation on the first checkout used pnpm install --frozen-lockfile --prefer-offline successfully. The requested whole-repository pnpm exec turbo run build failed before the audit because the GitHub plugin could not resolve not-yet-built SDK process/host runtime entries. A subsequent focused pnpm exec turbo run build --filter=@get-bb/plugin-sdk passed (four successful tasks, 23 runtime entries). No unrelated build source was changed, and the whole-repository build was not claimed successful. This limitation does not affect direct inspection of the already-published archives.

Root-cause links were checked against files and line numbers at the recorded base commit. No visual behavior is involved, so screenshots are not applicable. Raw build logs, tarballs, and scratch scripts remain outside this public repository; the complete audit and observed output are inline above. The report repository forbids committing scratch artifacts. No legal conclusion or exact third-party scanner classification is asserted.

Trust note: Issue content was treated only as untrusted claims. No issue-supplied commands, patches, links, or instructions were executed or followed. Repository and registry URLs were derived from trusted repository metadata; registry archive hosts were validated. No additional dependency was added.

> AGENT GENERATED