finding(create-plugin): the scaffolded package.json declares "license": "MIT" while the generator writes no LICENSE file

[baozhoutao]

Found while running the mandatory measurement for objectui#7524 (that card is about the emitted vitest test block; this is a different defect in the same file, deliberately left alone there).

What the generator emits. packages/create-plugin/src/templates.ts:

• buildPackageJson writes license: 'MIT' into the generated manifest, unconditionally and without prompting the author;
• buildPluginFiles writes nine files — package.json, tsconfig.json, vite.config.ts, vitest.setup.ts, README.md and four sources — and none of them is a LICENSE;
• the generated manifest declares no files array, so npm pack takes the default set.

So an author who publishes a freshly scaffolded plugin ships a tarball that claims MIT and carries no licence text.

Measured on a9e6f04b4: running the real scaffolder into packages/ and then pnpm exec vitest run scripts/__tests__/ turns scripts/__tests__/package-files-exist.test.ts red with, verbatim:

@object-ui/plugin-NAME (packages/plugin-NAME) declares "license": "MIT" but has no LICENSE file

(the package name is spelled here as a placeholder word, not with angle brackets — GitHub eats those). That pin is this repo's own rule (objectui#3696), so on its own it only demonstrates the shape locally. The same tarball goes to npm for the generator's actual audience, where no gate of ours looks at it at all.

Needs triage, not a guess — two separate questions:

1. Should the generator write a LICENSE file, or should it stop hard-coding a licence for someone else's package? It asserts MIT on an author's work without ever asking. Those two answers point in opposite directions.
2. objectui#3647 was the identical shape inside this repo and was settled by shipping the text. Whether that answer transfers to a foreign author's package is a product decision.

Deliberately out of scope for the objectui#7524 PR: that card's dispatch ruling holds the scaffolder's published output constant, so this was recorded rather than changed.

Attribution as prose (not a footer block): generated by Claude Code, seat session session_01FhBNJcLRZLe8M87VcUgpKr.

[os-zhuang]

Triage routing — into the decision box

Labels needs-user-decision finding domain:ui priority:p3 · Type Task

Lane — domain:ui. packages/create-plugin is a published objectui library. ⛔ Not domain:devx: the artefact in question is not our engineering surface, it is someone else's published package, which is the whole reason this is hard.

Re-measured on 83d4fda16 — confirmed. packages/create-plugin/src/templates.ts:136 — license: 'MIT', — written into the generated manifest unconditionally, without prompting. LICENSE appears in that file only in its own copyright headers (:6, :386, :422, :471, :496), never as an emitted file. The generated manifest declares no files array, so npm pack takes the default set.

⇒ an author who publishes a freshly scaffolded plugin ships a tarball that claims MIT and carries no licence text.

Why needs-user-decision and not pm:queue. The card's question 1 is not a choice between two implementations of one intent — the two answers point in opposite directions, and one of them is a statement about a third party's legal position:

Should the generator write a LICENSE file, or should it stop hard-coding a licence for someone else's package? It asserts MIT on an author's work without ever asking.

⛔ That is not a seat's call. Asserting a licence on work this project does not own is the kind of decision that belongs to a person, and it does not get more decidable by being small.

---

Decision

Option A — write the LICENSE file

Emit MIT text alongside the manifest that claims it. Consistent with objectui#3647, which settled the identical shape inside this repo by shipping the text.

• Cost. Keeps asserting MIT on a foreign author's package. It makes the tarball self-consistent without making the assertion any more consented-to.

Option B — stop hard-coding the licence

Omit license, or prompt for it.

• Cost. A manifest with no license field draws an npm warning and reads as unlicensed (all rights reserved) by default — arguably a worse default for the ecosystem, and it puts a decision in front of an author who wanted a scaffold.

Option C — A plus a prompt

Ask, default to MIT, emit whatever is chosen.

• Cost. One more question in the scaffolder, on the path where the author has the least context.

四棱卡面

① 项目长远合理性 — 现状是唯一不自洽的一个:manifest 声称 MIT,tarball 里没有那份文本。A 与 B 各自自洽,C 最自洽。⇒ 不动是三个选项里最差的一个。

② 实际业务拉动 — 未测得。脚手架的实际使用量分诊席看不到,这正是强制置信缺口那一条。

③ 防 AI 犯错 — 一个 agent 用脚手架建包并发布,不会去核对 LICENSE 是否存在;它会相信 manifest。A 或 C 让 manifest 说的是真的。

④ 创业阶段不扩散 — A 是一个文件模板;C 多一次交互;B 最小但把问题推给作者。三者都不大。

强制置信缺口

分诊席无法测量的一项:**已经用这个脚手架发布出去的包有多少,它们的 tarball 里有没有 LICENSE。**仓内为零证据,仓外未知。这个数字不改变哪个选项正确,但决定这张卡是「以后别再犯」还是「已经在外面了」。⛔ 不要把仓内没有证据当作外面没有发生。

推荐

**A 或 C。**⛔ 不推荐 B:「不声明」在 npm 生态里默认读作保留所有权利,对一个想要脚手架的作者来说是更坏的默认值,而本卡的出发点是替作者着想。A 与 C 之间取决于是否愿意在脚手架里多问一句 —— 这一句正是「有没有征得同意」的全部区别。

维护者速读

我们的插件脚手架生成的 package.json 里写死了 "license": "MIT",但不生成 LICENSE 文件。作者拿它去 npm 发布,包就声称是 MIT 授权、却没有授权原文 —— 而且我们从来没问过作者愿不愿意用 MIT。

三条路:补上 MIT 原文(和我们仓内自己的做法一致);或者干脆不替别人写授权(但 npm 会因此当作"保留所有权利");或者建包时问一句、默认 MIT。

请选一个:A(补文件)、B(不写授权)、还是 C(问一句)?

---

Grade p3. Nothing runs wrongly and nothing is destroyed; the cost is a published artefact that misdescribes itself. Re-grade to p2 if a scaffolded plugin is found published on npm in this state — that turns "our generator could" into "our generator did".

⚠️ The measurement's own limit, which the card states honestly and I am keeping: running the real scaffolder into packages/ turns scripts/__tests__/package-files-exist.test.ts red with the verbatim message "declares "license": "MIT" but has no LICENSE file". That pin is this repo's own rule (objectui#3696), so it demonstrates the shape locally only. ⛔ It is not evidence about the published tarball — the same tarball goes to npm for the generator's actual audience, where no gate of ours looks at it at all. Do not cite the red pin as though it were coverage.

Question 2 is the crux and is what makes this a decision rather than a port. objectui#3647 settled the identical shape inside this repo by shipping the text. Whether that answer transfers to a foreign author's package is exactly the product judgement above — ⛔ do not treat #3647 as precedent that settles this.

Correctly out of scope for objectui#7524 — that card's dispatch ruling holds the scaffolder's published output constant, so recording rather than changing was right.

Triage seat only — no claim, no dispatch, no code, ⛔ no adjudication.

---

Generated by Claude Code

[os-zhuang]

Ruling recorded — C: the scaffolder asks for the licence, defaults to MIT, and writes the matching LICENSE text; non-interactive runs take the default (director seat, decision batch #91, 2026-09-08)

Provenance (who / verbatim / where): maintainer, live PM chat with the director seat (session_01TezFG8ZMrNH6n5VTNpPpdH), standing delegation 「继续决策」 — rule per the presented recommendation; reversible by the maintainer. Triage 5583373397 recommended A or C; this seat picks C.

Ruled. A manifest that claims a licence must ship its text, and a licence asserted on someone else's package must have been chosen by them. One prompt with a sensible default (npm init's own shape) is the whole difference between A and consent; the cost is one question on the scaffold path, and --yes / non-TTY runs take MIT and write the text. ⛔ B refused: an unlicensed manifest reads as all-rights-reserved on npm, the worse default for the author the card is written for.

Execution: domain:ui, packages/create-plugin templates; Clause-②: yes (the scaffolder's emitted file set and prompt sequence are its published behaviour); @object-ui/create-plugin minor. Grade p3 stays; re-grade to p2 only if a scaffolded package is found on npm in the claimed-but-textless state.

---

Generated by Claude Code

[os-zhuang]

Claim: PM loop round 2
Session: session_01611D6ZaRaMmwTNQmSbk8MH
Branch: claude/issue-8041-create-plugin-licence-prompt
Worktree: objectui-issue-8041
Domain: domain:ui
File surface: packages/create-plugin/src/** (templates.ts — buildPackageJson and buildPluginFiles — plus the prompt sequence) + packages/create-plugin/**/__tests__/ (stop on breach; explain in the report)
Container & model: S 级但不机械 ⇒ 按 M 待遇, mode:subagent, model: opus (= TIER_DEFAULT, read from objectstack:scripts/pm/dispatch-gates.mjs:10348). ⛔ Gate family derived by hand — no dispatch-gates.mjs in objectui
Clause-②: yes — carried verbatim from the director-seat ruling: "the scaffolder's emitted file set and prompt sequence are its published behaviour". needs:contract-review attached to this card in the same stroke as this claim, per the carrier rule.
Thread-read: 5583986682 (the ruling, decision batch #91, 2026-09-08T10:50:42Z) — the newest comment on this card at the moment this claim is written
Serial constraints cleared: no open objectui PR touches packages/create-plugin/** at 2026-09-09T05:4xZ. objectui#7524 (the card whose dispatch held the scaffolder's published output constant) is not in flight; this card is the one authorised to move it.

⚠️ Landing note the reviewing seat must not lose: CONTRACT_REVIEW_TIER (claude-fable-5-1) is measured UNAVAILABLE this shift (HTTP 429, request req_011CesHk4obaXbWbyLv7N2N9). The Clause-② review therefore falls to TIER_DEFAULT under the quota-exhaustion exemption — ⛔ no lower — and that downgrade is recorded on the PR and in the round report, ⛔ not buried in a PASS.

---

Generated by Claude Code

[os-zhuang]

os-dev-report

{
  "issue": 8041,
  "status": "done",
  "branch": "claude/issue-8041-create-plugin-licence-prompt",
  "pr": "https://github.com/objectstack-ai/objectui/pull/8779",
  "premise_still_valid": true,
  "summary": "Ruling C implemented in packages/create-plugin: a fourth prompt 'License:' (select over MIT / Apache-2.0 / BSD-3-Clause / ISC, MIT preselected), a new src/licenses.ts carrying each licence's full text copied VERBATIM from a canonical on-disk copy, and a tenth emitted file LICENSE whose text matches whatever was chosen. resolveLicenseId is total, so a non-TTY stdin, a cancelled prompt and any unrecognised value all resolve to MIT and STILL write the text; there is no input for which the generator emits a claim it cannot honour. The manifest license field, the README '## License' line and the licence named in the four emitted source headers all read the one resolved id, so a scaffolded package names one licence rather than two. Option B was not built: the ruling refused it on the record. Zone 3 assumptions all re-derived and CONFIRMED on the base c03d03bb2 — templates.ts:136 is still exactly `license: 'MIT',`, buildPackageJson is at :131 and buildPluginFiles at :520, the generated manifest declares NO files array (so npm's default set packs LICENSE* and the emitted file really ships), and the package-files-exist pin really does go red on a base-scaffolded package. No sanitizer truncation found on this card: the body and all three comments came back whole over REST, footers intact, and the HTML comment `os-decision-facets` inside triage 5583373397 survived verbatim.",
  "clause_2_emitted_file_set": {
    "before": "9 — package.json, tsconfig.json, vite.config.ts, vitest.setup.ts, README.md, src/index.tsx, src/PascalImpl.tsx, src/types.ts, src/PascalImpl.test.tsx",
    "after": "10 — the same nine plus LICENSE. The SET is the same ten for every licence choice; only the LICENSE's contents vary. Measured by running the real built CLI both ways, not read off the source.",
    "other_emitted_files_changed": "none in shape. Content changed in exactly five, all of them licence claims: package.json's `license` value, README.md's '## License' line, and the licence NAME on line 5 of the four emitted src/ file headers (which already pointed at 'the LICENSE file in the root directory of this source tree' — a file that did not exist until now)."
  },
  "clause_2_prompt_sequence": {
    "before": "3 — (1) 'Plugin name (without prefix):' text, asked only when no positional argument; (2) 'Plugin description:' text; (3) 'Author name:' text",
    "after": "4 — (1)(2)(3) byte-identical, then (4) 'License:' select over MIT / Apache-2.0 / BSD-3-Clause / ISC with MIT preselected (initial index 0)",
    "cli_options_changed": "none. -d/--description and -a/--author untouched; no --license and no --yes added — the ruling asked for a prompt with a default, not new published flags."
  },
  "gates": {
    "derivation": "By hand — objectui has neither scripts/pm/dispatch-gates.mjs nor os-verify-lock.sh. Derived from what the diff touches (packages/create-plugin/src/**, its README, .changeset/): the package's own suite + type-check + lint; every scripts/__tests__ file that reads create-plugin (found by `grep -rln create-plugin scripts/`); the changeset trio; and the repo-wide static checks in ci.yml/lint.yml that read any edited file.",
    "pnpm exec vitest run packages/create-plugin/": "0 — Test Files 2 passed (2), Tests 29 passed (29)",
    "pnpm --filter @object-ui/create-plugin type-check": "0 — tsc --noEmit && tsc -p tsconfig.test.json, script name echoed (objectui spells it type-check, hyphenated)",
    "pnpm --filter @object-ui/create-plugin lint": "0",
    "pnpm exec vitest run scripts/__tests__/{package-files-exist,one-authority-per-exported-name-6273,check-doc-snippet-emitted-census,doc-version-claims,check-published-tsconfig-tooling-exclude}.test.ts": "0 — Test Files 5 passed (5), Tests 111 passed (111)",
    "node scripts/check-changeset-presence.mjs": "0 — '3 source file(s) of 1 released package(s) changed, and this change declares 1 changeset(s)'",
    "node scripts/check-changeset-fixed.mjs": "0",
    "node scripts/check-changeset-no-major.mjs": "0 — 'No changeset declares a major bump.'",
    "node scripts/check-control-bytes.mjs": "0",
    "node scripts/check-package-self-import.mjs": "0",
    "node scripts/check-phantom-dependencies.mjs": "0",
    "node scripts/check-unused-dependencies.mjs": "0",
    "node scripts/check-unreferenced-sources.mjs": "0",
    "node scripts/check-published-dist-tooling.mjs": "0",
    "node scripts/check-published-tsconfig-tooling-exclude.mjs": "0",
    "node scripts/check-side-effects-array.mjs": "0",
    "node scripts/check-lockfile-integrity.mjs": "0",
    "pnpm type-check:scripts": "0",
    "manual control-byte sweep": "0 hits — grep -naP over every edited file",
    "NOT MEASURED (derived, then found to have an unmet prerequisite — read as NOT-RUN, not as green and not as red)": "check-readme-exports exit 1 and check-doc-example-types / check-doc-snippet-types exit 2 (those scripts define exit 2 as 'PRECONDITION NOT MET — the program was NOT run'). All three require a built tree and name four to thirty-four OTHER packages as unbuilt; none names create-plugin, and this diff edits no document under content/docs/. A repo-wide build for a documentation check is CI's run, not this branch's.",
    "ci_status": "in_progress — reported at draft-PR time, per the dispatch contract; CI convergence is the PM's read."
  },
  "line_budget": "not applicable — this diff touches no skills/** file. Size for the record: 7 files, +716 / -7. The 407-line src/licenses.ts is 340 lines of verbatim licence text (Apache-2.0 alone is 201) plus 67 lines of docblock, types and three small functions.",
  "files_changed": [
    "packages/create-plugin/src/licenses.ts (new, 407 lines)",
    "packages/create-plugin/src/templates.ts (+68/-6)",
    "packages/create-plugin/src/index.ts (+13/-1)",
    "packages/create-plugin/src/__tests__/licenses.test.ts (new, 183 lines)",
    "packages/create-plugin/src/__tests__/templates.test.ts (+2)",
    "packages/create-plugin/README.md (+9)",
    ".changeset/8041-create-plugin-licence-prompt.md (new, minor)"
  ],
  "tests": "Pinned by what the generator EMITS, per the evidence bar. (1) End-to-end, the real built CLI driven through a pty: default path (Enter x3) prints '✔ License: › MIT' and writes ten files including LICENSE, manifest '\"license\": \"MIT\"', LICENSE opening 'MIT License' / 'Copyright (c) 2026 the @object-ui/plugin-heatmap authors'; non-default path (author 'Jane Doe', arrow-down, Enter) prints '✔ License: › Apache-2.0', manifest '\"license\": \"Apache-2.0\"', README 'Apache-2.0 © Jane Doe', headers 'licensed under the Apache-2.0 license', and the emitted LICENSE DIFFS CLEAN against the canonical Apache-2.0 text once the filled appendix line is put back to its bracketed form. (2) CONTROL, used as a control and NOT as the acceptance criterion (triage 5583373397 is explicit it proves the shape locally only): scaffolding into packages/ with the PRE-FIX generator — base sources bundled from c03d03bb2 with esbuild — turns scripts/__tests__/package-files-exist.test.ts red, exit 1, 'Tests 1 failed | 17 passed (18)', verbatim '@object-ui/plugin-licencecontrol (packages/plugin-licencecontrol) declares \"license\": \"MIT\" but has no LICENSE file'; re-scaffolded with this branch's generator the same command is 'Tests 18 passed (18)', exit 0. Scratch package removed, git status clean. (3) ABLATION: `LICENSE: buildLicenseFile(vars)` deleted from buildPluginFiles ON DISK and PROVED to have landed before anything was read — anchor grep -c 1 to 0, blob hash da3a0e81 to 58a03b57, both non-empty and different — then `pnpm exec vitest run packages/create-plugin/` gave exit 1, 'Tests 6 failed | 23 passed (29)' (five in licenses.test.ts, one in templates.test.ts). Restored through an EXIT/INT/TERM trap using `git checkout HEAD -- path` (never bare: the index was dirty), and the restore verified BY STATE, not by exit code — on-disk blob equals HEAD:packages/create-plugin/src/templates.ts, `git diff HEAD` empty, `git status` clean, re-run 'Tests 29 passed (29)'. No dist preflight was owed: the tests import '../templates' by relative path, so the mutation is on the module actually under test.",
  "mcp_calls": "3 — one search_issues (dedupe for the out-of-scope finding, after REST /search/* returned 403 by design; declared channel switch), one issue_write create (#8778), one issue_write update (PR labels). Everything else — the card, all comments, the label read-backs, the PR body read-back — went over repo-scoped REST, which this seat probed as reachable (HTTP 200) before choosing it. A fourth call is this comment.",
  "open_questions": [],
  "out_of_scope_findings": [
    "filed as #8778: the four emitted source-file headers also stamp `Copyright (c) YEAR-present ObjectStack Inc.` onto the author's own plugin code — same file, one line from the line this PR moves. Not fixed here: the in-place-fix exemption fails its second condition (the correct value is a product decision with three live candidates, not a mechanical substitution). After this PR it is the only false statement left in that header block. Dedupe: one targeted search_issues, whose result set demonstrably contained this card (#8041) as the control hit, returned no existing card for it.",
    "noted, not filed: README.md's emitted `## License` line renders as `MIT © ` with a trailing space when the optional author prompt is left blank — the same blank-author path the LICENSE copyright holder now handles explicitly. Left alone because fixing it means changing an emitted file outside the licence question's minimal footprint, and it is cosmetic where the LICENSE one was not. Carrier: whoever takes #8778, which has to answer the same blank-author question for the header block."
  ],
  "deviations": [
    "No `--pair N` exit code is reportable: that is an objectstack scripts/pm/ tool and objectui has no scripts/pm/ directory. `needs:contract-review` was attached to PR #8779 in the same stroke as opening it, per the Clause-② carrier rule, and verified by a comparative read-back (all four labels present, none stripped, none added by another actor).",
    "Gate family derived by hand, as the dispatch instructed; the derivation method is recorded under gates.derivation so it can be re-walked rather than trusted.",
    "REST /search/* is 403 by design on this seat (repo-scoped egress). The one MCP search_issues call is the declared substitute and was validated by a control hit, not assumed.",
    "The changeset is `minor` and not `major` even though the emitted contract changes: scripts/check-changeset-no-major.mjs forbids `major` outside the synchronized @objectstack bump, so a deliberately breaking change ships `minor` with the break spelled out in the body.",
    "The licence picker deliberately offers four licences and no free-text or 'other' option. A licence the generator cannot write is one it must not offer — an escape hatch would rebuild this card's exact defect one level up. Apache-2.0 is included because its verbatim text was available on disk to copy; nothing was transcribed from memory.",
    "packages/create-plugin/README.md was updated (emitted file tree gains LICENSE, prompt list gains License). Not scope creep: it documented both surfaces Clause-② names as published behaviour, so leaving it would have shipped a stale published contract."
  ]
}

Attribution as prose, not a footer block: generated by Claude Code, development seat session_01611D6ZaRaMmwTNQmSbk8MH, on the PM claim already standing on this card.

---

Generated by Claude Code