mirror of
https://github.com/DeusData/codebase-memory-mcp.git
synced 2026-10-25 06:33:13 +08:00
Martin Vogel
9d85701a6d
The v0.12.0 release run's license gate blocked @img/sharp-wasm32@0.35.5 (Apache-2.0 AND LGPL-3.0-or-later AND MIT). sharp sat in graph-ui's tree only because @huggingface/transformers lists it for its Node image path. CBM Lens runs Transformers in the browser (a tokenizer and a causal LM on WebGPU), never processes images, and the Transformers web build already replaces sharp with an empty object. Yet sharp installed 14 LGPL packages (10 @img/sharp-libvips-*, 3 @img/sharp-win32-*, @img/sharp-wasm32), and the gate let them through two ways: - a reviewed exception for exactly @img/sharp-wasm32@0.35.0 ("installed but not shipped"), which the 0.35.5 bump in #2632 tripped; - collect() skipped every os/cpu-restricted package as "build tooling", which hid all ten LGPL libvips binaries. A non-permissive license has no place in the tree, shipped or not: - sharp now resolves to graph-ui/stubs/sharp, our own MIT stand-in that throws if anything ever calls it (direct dependency file:./stubs/sharp plus override "sharp": "$sharp"). The whole sharp family leaves the lockfile: 441 -> 411 packages, zero LGPL/GPL left (audited). - ui_browser_licenses.py loses the exception and keeps only the browser build evidence check; license-gate-check-npm.py validates that evidence unconditionally, checks platform-restricted packages like any other, and has no exclusion path; gen-ui-licenses.py drops the exception section. - tests: the exception tests become guards: an unshipped LGPL package blocks, a platform-restricted LGPL package blocks, a platform-restricted MIT package passes. Against the old scripts both LGPL guards fail. The shipped browser bundle is unchanged: rebuilt, it differs from main's only by the build's own -dirty version marker. License gate stage 3 on this tree: 211 production packages, all allow-listed. Signed-off-by: Martin Vogel <martin.vogel.tech@gmail.com>
93 lines
5.1 KiB
JSON
93 lines
5.1 KiB
JSON
{
|
|
"name": "cbm-lens",
|
|
"version": "0.0.1",
|
|
"private": true,
|
|
"type": "module",
|
|
"description": "Lokales Verstehens-Frontend auf dem CBM-Stack (localhost, air-gapped per Default).",
|
|
"scripts": {
|
|
"dev": "vite",
|
|
"build": "tsc -b tsconfig.json tsconfig.node.json && vite build",
|
|
"test": "node --test tests/scaffold/*.test.mjs",
|
|
"test:acceptance": "node --test tests/scaffold/w*.test.mjs tests/scaffold/release-blockers.test.mjs",
|
|
"test:unit": "vitest run",
|
|
"verify": "node --test tests/scaffold/*.test.mjs",
|
|
"smoke:spike": "node tools/smoke-spike.mjs",
|
|
"smoke:w1": "node tools/smoke-w1.mjs",
|
|
"smoke:w1b": "node tools/smoke-w1b.mjs",
|
|
"smoke:w2a": "node tools/net-deny-gate.mjs --out verification/w2/netdeny.json -- node tools/smoke-w2a.mjs",
|
|
"smoke:w2b": "node tools/net-deny-gate.mjs --out verification/w2/netdeny-w2b.json -- node tools/smoke-w2b.mjs",
|
|
"smoke:w3": "node tools/net-deny-gate.mjs --out verification/w3/netdeny.json -- node tools/smoke-w3.mjs",
|
|
"smoke:w4a": "node tools/net-deny-gate.mjs --out verification/w4/netdeny.json -- node tools/smoke-w4a.mjs",
|
|
"smoke:w4b": "node tools/net-deny-gate.mjs --out verification/w4/netdeny-w4b.json -- node tools/smoke-w4b.mjs",
|
|
"smoke:w4c": "node tools/net-deny-gate.mjs --out verification/w4/netdeny-w4c.json -- node tools/smoke-w4c.mjs",
|
|
"smoke:w4d": "node tools/net-deny-gate.mjs --out verification/w4/netdeny-w4d.json -- node tools/smoke-w4d.mjs",
|
|
"smoke:w4e": "node tools/net-deny-gate.mjs --out verification/w4/netdeny-w4e.json -- node tools/smoke-w4e.mjs",
|
|
"smoke:w5a": "node tools/net-deny-gate.mjs --out verification/w5/netdeny-w5a.json -- node tools/smoke-w5a.mjs",
|
|
"smoke:w5b": "node tools/net-deny-gate.mjs --out verification/w5/netdeny-w5b.json -- node tools/smoke-w5b.mjs",
|
|
"smoke:w5c": "node tools/net-deny-gate.mjs --out verification/w5/netdeny-w5c.json -- node tools/smoke-w5c.mjs",
|
|
"smoke:w6": "node tools/net-deny-gate.mjs --out verification/w6/netdeny.json -- node tools/smoke-w6-full.mjs",
|
|
"smoke:w7a": "node tools/net-deny-gate.mjs --out verification/w7/netdeny.json -- node tools/smoke-w7a.mjs",
|
|
"smoke:w7b": "node tools/net-deny-gate.mjs --out verification/w7/netdeny-w7b.json -- node tools/smoke-w7b.mjs",
|
|
"smoke:w7c": "node tools/net-deny-gate.mjs --out verification/w7/netdeny-w7c.json -- node tools/smoke-w7c.mjs",
|
|
"smoke:w8": "node tools/net-deny-gate.mjs --out verification/w8/netdeny.json -- node tools/smoke-w8.mjs",
|
|
"smoke:w8b": "node tools/net-deny-gate.mjs --out verification/w8b/netdeny.json -- node tools/smoke-w8b.mjs",
|
|
"smoke:w8c": "node tools/net-deny-gate.mjs --out verification/w8c/netdeny.json -- node tools/smoke-w8c.mjs",
|
|
"smoke:w9": "node tools/net-deny-gate.mjs --out verification/w9/netdeny-w9.json -- node tools/smoke-w9.mjs",
|
|
"smoke:w10": "node tools/net-deny-gate.mjs --out verification/w10/netdeny.json -- node tools/smoke-w10.mjs",
|
|
"smoke:w10b": "node tools/net-deny-gate.mjs --out verification/w10b/netdeny.json -- node tools/smoke-w10b.mjs",
|
|
"smoke:w11a": "node tools/net-deny-gate.mjs --out verification/w11/netdeny.json -- node tools/smoke-w11a.mjs",
|
|
"smoke:w11b": "node tools/net-deny-gate.mjs --out verification/w11/netdeny-w11b.json -- node tools/smoke-w11b.mjs",
|
|
"smoke:w12": "node tools/net-deny-gate.mjs --out verification/w12/netdeny.json -- node tools/smoke-w12.mjs",
|
|
"smoke:w12a": "node tools/net-deny-gate.mjs --out verification/w12a/netdeny.json -- node tools/smoke-w12a.mjs",
|
|
"smoke:w13": "node tools/net-deny-gate.mjs --out verification/w13/netdeny.json -- node tools/smoke-w13.mjs",
|
|
"smoke:w14": "node tools/net-deny-gate.mjs --out verification/w14/netdeny.json -- node tools/smoke-w14.mjs",
|
|
"smoke:w15": "node tools/net-deny-gate.mjs --out verification/w15/netdeny.json -- node tools/smoke-w15.mjs",
|
|
"demo:record": "node tools/record-demo.mjs",
|
|
"gate:release": "node tools/release-gate.mjs",
|
|
"check:freshclone": "node tools/freshclone-check.mjs",
|
|
"check:style": "node tools/style-gate.mjs",
|
|
"check:promises": "node tools/promise-scan.mjs",
|
|
"eval:llm": "node tools/eval-llm.mjs",
|
|
"eval:check": "node tools/eval-check.mjs",
|
|
"verify:models": "node tools/verify-models.mjs"
|
|
},
|
|
"devDependencies": {
|
|
"@types/node": "20.19.43",
|
|
"@types/react": "19.2.18",
|
|
"@types/react-dom": "19.2.5",
|
|
"@types/three": "0.183.1",
|
|
"@vitejs/plugin-react": "4.7.0",
|
|
"jsdom": "25.0.1",
|
|
"monaco-editor": "0.56.0",
|
|
"playwright": "1.62.1",
|
|
"three-stdlib": "2.36.1",
|
|
"typescript": "5.9.3",
|
|
"vite": "6.4.3",
|
|
"vitest": "4.1.11"
|
|
},
|
|
"overrides": {
|
|
"sharp": "$sharp",
|
|
"monaco-editor": {
|
|
"dompurify": "3.4.16"
|
|
},
|
|
"onnxruntime-node@1.24.3": {
|
|
"adm-zip": "0.6.1",
|
|
"global-agent": "4.1.3"
|
|
}
|
|
},
|
|
"dependencies": {
|
|
"@huggingface/transformers": "4.2.0",
|
|
"@react-three/drei": "10.7.7",
|
|
"@react-three/fiber": "9.5.0",
|
|
"@react-three/postprocessing": "3.0.4",
|
|
"postprocessing": "6.38.3",
|
|
"react": "19.2.8",
|
|
"react-dom": "19.2.8",
|
|
"react-markdown": "10.1.0",
|
|
"remark-gfm": "4.0.1",
|
|
"sharp": "file:./stubs/sharp",
|
|
"three": "0.183.2",
|
|
"yaml": "2.8.3"
|
|
}
|
|
}
|