diff --git a/LICENSE b/LICENSE index 15e4064fdb..287dc44984 100644 --- a/LICENSE +++ b/LICENSE @@ -236,6 +236,92 @@ OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE. +anomalyco/opencode (adapted source) + +Source: https://github.com/anomalyco/opencode +Revision: fc80874f45a595ff6874a4d36b1090f6a64424d2 +Copyright (c) 2025 opencode +License: MIT + +Maka's tool-output truncation (packages/runtime/src/tool-output.ts) and +string-edit matching strategies (packages/runtime/src/edit-replace.ts) include +adaptations of this software. Each file marks the adapted portion in its header; +the surrounding Maka source stays under this repository's Apache-2.0 license. + +opencode's edit.ts credits cline diff-apply and the gemini-cli editCorrector +upstream of itself. The escape-normalizing replacer in edit-replace.ts shares +the first eight branches of its escape set, in order, with gemini-cli's +editCorrector.ts, which is Copyright 2025 Google LLC under Apache-2.0; opencode +added a ninth branch and changed the pattern, and Maka took the result from +opencode. The chain is recorded in full rather than stopping at the nearest +upstream. + +The following MIT License applies to the adapted material: + +MIT License + +Copyright (c) 2025 opencode + +Permission is hereby granted, free of charge, to any person obtaining a copy +of this software and associated documentation files (the "Software"), to deal +in the Software without restriction, including without limitation the rights +to use, copy, modify, merge, publish, distribute, sublicense, and/or sell +copies of the Software, and to permit persons to whom the Software is +furnished to do so, subject to the following conditions: + +The above copyright notice and this permission notice shall be included in all +copies or substantial portions of the Software. + +THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR +IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, +FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE +AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER +LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, +OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE +SOFTWARE. + + +sst/models.dev (generated model catalog snapshot) + +Source: https://models.dev/api.json +Repository: https://github.com/sst/models.dev +Copyright (c) 2025 models.dev +License: MIT + +packages/core/src/model-metadata.generated.ts and +packages/runtime/src/telemetry/model-pricing.generated.ts are generated from the +models.dev catalog by scripts/sync-model-metadata.mjs and are redistributed with +Maka. They copy and transform selected model and provider metadata from that +catalog, including upstream display names and descriptive text, lifecycle status +values, reasoning effort options, context and output limits, modalities, and +prices. Field selection and ordering are the generator's; it narrows most of +what it emits to the providers Maka supports, and keeps every provider in the +catalog in its provider directory. The following MIT License applies to the +material taken from upstream: + +MIT License + +Copyright (c) 2025 models.dev + +Permission is hereby granted, free of charge, to any person obtaining a copy +of this software and associated documentation files (the "Software"), to deal +in the Software without restriction, including without limitation the rights +to use, copy, modify, merge, publish, distribute, sublicense, and/or sell +copies of the Software, and to permit persons to whom the Software is +furnished to do so, subject to the following conditions: + +The above copyright notice and this permission notice shall be included in all +copies or substantial portions of the Software. + +THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR +IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, +FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE +AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER +LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, +OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE +SOFTWARE. + + Geist and Geist Mono (bundled webfonts) Source: https://github.com/vercel/geist-font diff --git a/apps/desktop/resources/licenses/npm/THIRD_PARTY_NOTICES.txt b/apps/desktop/resources/licenses/npm/THIRD_PARTY_NOTICES.txt index 14303bed11..a5adfeec03 100644 --- a/apps/desktop/resources/licenses/npm/THIRD_PARTY_NOTICES.txt +++ b/apps/desktop/resources/licenses/npm/THIRD_PARTY_NOTICES.txt @@ -416,146 +416,6 @@ Apache License See the License for the specific language governing permissions and limitations under the License. -THIRD-PARTY COMPONENTS - -trycua/cua cursor-overlay - -Source: https://github.com/trycua/cua -Revision: 8c921b2b3bf13494724ead4f0a814d80c56a7e8b -Copyright (c) 2025 Cua AI, Inc. -License: MIT - -Maka's agent-cursor renderer and palette include adaptations of this component. -The following MIT License applies to that material: - -MIT License - -Copyright (c) 2025 Cua AI, Inc. - -Permission is hereby granted, free of charge, to any person obtaining a copy -of this software and associated documentation files (the "Software"), to deal -in the Software without restriction, including without limitation the rights -to use, copy, modify, merge, publish, distribute, sublicense, and/or sell -copies of the Software, and to permit persons to whom the Software is -furnished to do so, subject to the following conditions: - -The above copyright notice and this permission notice shall be included in all -copies or substantial portions of the Software. - -THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR -IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, -FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE -AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER -LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, -OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE -SOFTWARE. - - -Geist and Geist Mono (bundled webfonts) - -Source: https://github.com/vercel/geist-font -Emitted by: @fontsource-variable/geist 5.3.0, @fontsource-variable/geist-mono 5.3.0 -Copyright 2024 The Geist Project Authors -License: SIL Open Font License, Version 1.1 - -Maka's desktop renderer bundle embeds Geist Variable and Geist Mono Variable -webfont files. The packages that carry them are build-time dependencies, but -the `.woff2` files themselves are emitted into the renderer bundle and are -therefore redistributed in binary artifacts. The upstream license text for -that material follows verbatim: - -This Font Software is licensed under the SIL Open Font License, Version 1.1. -This license is copied below, and is also available with a FAQ at: -http://scripts.sil.org/OFL - - ------------------------------------------------------------ -SIL OPEN FONT LICENSE Version 1.1 - 26 February 2007 ------------------------------------------------------------ - -PREAMBLE -The goals of the Open Font License (OFL) are to stimulate worldwide -development of collaborative font projects, to support the font creation -efforts of academic and linguistic communities, and to provide a free and -open framework in which fonts may be shared and improved in partnership -with others. - -The OFL allows the licensed fonts to be used, studied, modified and -redistributed freely as long as they are not sold by themselves. The -fonts, including any derivative works, can be bundled, embedded, -redistributed and/or sold with any software provided that any reserved -names are not used by derivative works. The fonts and derivatives, -however, cannot be released under any other type of license. The -requirement for fonts to remain under this license does not apply -to any document created using the fonts or their derivatives. - -DEFINITIONS -"Font Software" refers to the set of files released by the Copyright -Holder(s) under this license and clearly marked as such. This may -include source files, build scripts and documentation. - -"Reserved Font Name" refers to any names specified as such after the -copyright statement(s). - -"Original Version" refers to the collection of Font Software components as -distributed by the Copyright Holder(s). - -"Modified Version" refers to any derivative made by adding to, deleting, -or substituting -- in part or in whole -- any of the components of the -Original Version, by changing formats or by porting the Font Software to a -new environment. - -"Author" refers to any designer, engineer, programmer, technical -writer or other person who contributed to the Font Software. - -PERMISSION & CONDITIONS -Permission is hereby granted, free of charge, to any person obtaining -a copy of the Font Software, to use, study, copy, merge, embed, modify, -redistribute, and sell modified and unmodified copies of the Font -Software, subject to the following conditions: - -1) Neither the Font Software nor any of its individual components, -in Original or Modified Versions, may be sold by itself. - -2) Original or Modified Versions of the Font Software may be bundled, -redistributed and/or sold with any software, provided that each copy -contains the above copyright notice and this license. These can be -included either as stand-alone text files, human-readable headers or -in the appropriate machine-readable metadata fields within text or -binary files as long as those fields can be easily viewed by the user. - -3) No Modified Version of the Font Software may use the Reserved Font -Name(s) unless explicit written permission is granted by the corresponding -Copyright Holder. This restriction only applies to the primary font name as -presented to the users. - -4) The name(s) of the Copyright Holder(s) or the Author(s) of the Font -Software shall not be used to promote, endorse or advertise any -Modified Version, except to acknowledge the contribution(s) of the -Copyright Holder(s) and the Author(s) or with their explicit written -permission. - -5) The Font Software, modified or unmodified, in part or in whole, -must be distributed entirely under this license, and must not be -distributed under any other license. The requirement for fonts to -remain under this license does not apply to any document created -using the Font Software. - -TERMINATION -This license becomes null and void if any of the above conditions are -not met. - -DISCLAIMER -THE FONT SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, -EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO ANY WARRANTIES OF -MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT -OF COPYRIGHT, PATENT, TRADEMARK, OR OTHER RIGHT. IN NO EVENT SHALL THE -COPYRIGHT HOLDER BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, -INCLUDING ANY GENERAL, SPECIAL, INDIRECT, INCIDENTAL, OR CONSEQUENTIAL -DAMAGES, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING -FROM, OUT OF THE USE OR INABILITY TO USE THE FONT SOFTWARE OR FROM -OTHER DEALINGS IN THE FONT SOFTWARE. - ================================================================================ Package: @ant-design/icons-svg@4.5.0 diff --git a/package.json b/package.json index ae908c681e..418e60f146 100644 --- a/package.json +++ b/package.json @@ -59,7 +59,7 @@ "test:product-release": "node --test scripts/product-release.test.mjs scripts/product-release-artifacts.test.mjs scripts/product-release-authority.test.mjs", "generate:windows-cargo-notices": "node scripts/generate-windows-cargo-notices.mjs", "check:windows-cargo-notices": "node scripts/generate-windows-cargo-notices.mjs --check", - "check:release": "npm run check:stale && npm run check:third-party-notices && npm run check:cli-third-party-notices && npm run check:product-release-identity && node --test scripts/product-release.test.mjs scripts/product-release-artifacts.test.mjs scripts/product-release-authority.test.mjs scripts/release-cli-file-policy.test.mjs scripts/release-cli-artifact-policy.test.mjs scripts/release-cli-eval-support.test.mjs scripts/release-cli-publication.test.mjs scripts/release-cli-runtime-host-diagnostics.test.mjs scripts/release-cli-workflow-policy.test.mjs scripts/verify-packaged-app.test.mjs scripts/third-party-closure.test.mjs", + "check:release": "npm run check:stale && npm run check:third-party-notices && npm run check:cli-third-party-notices && npm run check:product-release-identity && node --test scripts/product-release.test.mjs scripts/product-release-artifacts.test.mjs scripts/product-release-authority.test.mjs scripts/release-cli-file-policy.test.mjs scripts/release-cli-artifact-policy.test.mjs scripts/release-cli-eval-support.test.mjs scripts/release-cli-publication.test.mjs scripts/release-cli-runtime-host-diagnostics.test.mjs scripts/release-cli-workflow-policy.test.mjs scripts/verify-packaged-app.test.mjs scripts/third-party-closure.test.mjs scripts/generate-third-party-notices.test.mjs", "package:macos-arm64": "node scripts/package-macos-arm64.mjs", "verify:macos-arm64": "node scripts/verify-macos-arm64-dmg.mjs", "package:windows-x64": "node scripts/package-windows-x64.mjs", diff --git a/packages/cli/THIRD_PARTY_NOTICES.txt b/packages/cli/THIRD_PARTY_NOTICES.txt index 2ce144b7df..18f5c80568 100644 --- a/packages/cli/THIRD_PARTY_NOTICES.txt +++ b/packages/cli/THIRD_PARTY_NOTICES.txt @@ -415,146 +415,6 @@ Apache License See the License for the specific language governing permissions and limitations under the License. -THIRD-PARTY COMPONENTS - -trycua/cua cursor-overlay - -Source: https://github.com/trycua/cua -Revision: 8c921b2b3bf13494724ead4f0a814d80c56a7e8b -Copyright (c) 2025 Cua AI, Inc. -License: MIT - -Maka's agent-cursor renderer and palette include adaptations of this component. -The following MIT License applies to that material: - -MIT License - -Copyright (c) 2025 Cua AI, Inc. - -Permission is hereby granted, free of charge, to any person obtaining a copy -of this software and associated documentation files (the "Software"), to deal -in the Software without restriction, including without limitation the rights -to use, copy, modify, merge, publish, distribute, sublicense, and/or sell -copies of the Software, and to permit persons to whom the Software is -furnished to do so, subject to the following conditions: - -The above copyright notice and this permission notice shall be included in all -copies or substantial portions of the Software. - -THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR -IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, -FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE -AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER -LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, -OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE -SOFTWARE. - - -Geist and Geist Mono (bundled webfonts) - -Source: https://github.com/vercel/geist-font -Emitted by: @fontsource-variable/geist 5.3.0, @fontsource-variable/geist-mono 5.3.0 -Copyright 2024 The Geist Project Authors -License: SIL Open Font License, Version 1.1 - -Maka's desktop renderer bundle embeds Geist Variable and Geist Mono Variable -webfont files. The packages that carry them are build-time dependencies, but -the `.woff2` files themselves are emitted into the renderer bundle and are -therefore redistributed in binary artifacts. The upstream license text for -that material follows verbatim: - -This Font Software is licensed under the SIL Open Font License, Version 1.1. -This license is copied below, and is also available with a FAQ at: -http://scripts.sil.org/OFL - - ------------------------------------------------------------ -SIL OPEN FONT LICENSE Version 1.1 - 26 February 2007 ------------------------------------------------------------ - -PREAMBLE -The goals of the Open Font License (OFL) are to stimulate worldwide -development of collaborative font projects, to support the font creation -efforts of academic and linguistic communities, and to provide a free and -open framework in which fonts may be shared and improved in partnership -with others. - -The OFL allows the licensed fonts to be used, studied, modified and -redistributed freely as long as they are not sold by themselves. The -fonts, including any derivative works, can be bundled, embedded, -redistributed and/or sold with any software provided that any reserved -names are not used by derivative works. The fonts and derivatives, -however, cannot be released under any other type of license. The -requirement for fonts to remain under this license does not apply -to any document created using the fonts or their derivatives. - -DEFINITIONS -"Font Software" refers to the set of files released by the Copyright -Holder(s) under this license and clearly marked as such. This may -include source files, build scripts and documentation. - -"Reserved Font Name" refers to any names specified as such after the -copyright statement(s). - -"Original Version" refers to the collection of Font Software components as -distributed by the Copyright Holder(s). - -"Modified Version" refers to any derivative made by adding to, deleting, -or substituting -- in part or in whole -- any of the components of the -Original Version, by changing formats or by porting the Font Software to a -new environment. - -"Author" refers to any designer, engineer, programmer, technical -writer or other person who contributed to the Font Software. - -PERMISSION & CONDITIONS -Permission is hereby granted, free of charge, to any person obtaining -a copy of the Font Software, to use, study, copy, merge, embed, modify, -redistribute, and sell modified and unmodified copies of the Font -Software, subject to the following conditions: - -1) Neither the Font Software nor any of its individual components, -in Original or Modified Versions, may be sold by itself. - -2) Original or Modified Versions of the Font Software may be bundled, -redistributed and/or sold with any software, provided that each copy -contains the above copyright notice and this license. These can be -included either as stand-alone text files, human-readable headers or -in the appropriate machine-readable metadata fields within text or -binary files as long as those fields can be easily viewed by the user. - -3) No Modified Version of the Font Software may use the Reserved Font -Name(s) unless explicit written permission is granted by the corresponding -Copyright Holder. This restriction only applies to the primary font name as -presented to the users. - -4) The name(s) of the Copyright Holder(s) or the Author(s) of the Font -Software shall not be used to promote, endorse or advertise any -Modified Version, except to acknowledge the contribution(s) of the -Copyright Holder(s) and the Author(s) or with their explicit written -permission. - -5) The Font Software, modified or unmodified, in part or in whole, -must be distributed entirely under this license, and must not be -distributed under any other license. The requirement for fonts to -remain under this license does not apply to any document created -using the Font Software. - -TERMINATION -This license becomes null and void if any of the above conditions are -not met. - -DISCLAIMER -THE FONT SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, -EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO ANY WARRANTIES OF -MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT -OF COPYRIGHT, PATENT, TRADEMARK, OR OTHER RIGHT. IN NO EVENT SHALL THE -COPYRIGHT HOLDER BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, -INCLUDING ANY GENERAL, SPECIAL, INDIRECT, INCIDENTAL, OR CONSEQUENTIAL -DAMAGES, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING -FROM, OUT OF THE USE OR INABILITY TO USE THE FONT SOFTWARE OR FROM -OTHER DEALINGS IN THE FONT SOFTWARE. - ================================================================================ Package: @earendil-works/pi-tui@0.83.0 diff --git a/packages/core/src/model-metadata.generated.ts b/packages/core/src/model-metadata.generated.ts index 4d1bddfefc..e90b12ba2a 100644 --- a/packages/core/src/model-metadata.generated.ts +++ b/packages/core/src/model-metadata.generated.ts @@ -1,4 +1,10 @@ // Generated by scripts/sync-model-metadata.mjs from https://models.dev/api.json. +// Upstream: sst/models.dev (https://github.com/sst/models.dev), MIT, +// Copyright (c) 2025 models.dev. See LICENSE, THIRD-PARTY COMPONENTS. +// Snapshot: sha256 of the provider and model data extracted from api.json, +// 31a0e05d9aacc509205c399e20e2f1571438b88a6f32a496b0da7fad2eb6a356. +// models.dev serves a rolling document, so this identifies the extracted +// payload rather than a revision that can be fetched back. // Do not edit by hand; put access-path-specific facts in model-metadata.ts. import type { ModelMetadata } from './model-metadata.js'; diff --git a/packages/runtime/src/edit-replace.ts b/packages/runtime/src/edit-replace.ts index 7a47f2f41f..1865c1cf52 100644 --- a/packages/runtime/src/edit-replace.ts +++ b/packages/runtime/src/edit-replace.ts @@ -18,14 +18,27 @@ // function operates on a string — binary-*file* byte safety is the caller's I/O // concern. // -// Strategies are adapted from opencode's edit.ts (sourced from cline diff-apply -// + gemini-cli editCorrector). We keep the three distinctly-reachable full-span -// matchers (line-trimmed, whitespace-normalized, escape-normalized) and omit: +// ATTRIBUTION: the fuzzy matching strategies below are adapted from opencode's +// edit.ts (packages/opencode/src/tool/edit.ts, which credits cline diff-apply + +// gemini-cli editCorrector upstream of it). We keep the three +// distinctly-reachable full-span matchers (line-trimmed, whitespace-normalized, +// escape-normalized) and omit: // - indentation-flexible and trimmed-boundary, which are strictly shadowed by // line-trimmed / whitespace-normalized here (they add no reachable match); // - block-anchor and context-aware, which match on partial signal (first/last // line + similarity) and need a tuned similarity threshold — deliberately // deferred to keep wrong-location risk out. +// The escape-normalizing replacer is the closest to upstream: the regular +// expression and its nine branches are carried over unchanged. +// +// Source: https://github.com/anomalyco/opencode +// Revision: fc80874f45a595ff6874a4d36b1090f6a64424d2 +// License: MIT +// Copyright: Copyright (c) 2025 opencode +// +// Scope: the adapted material only; the rest is Maka source under the +// repository Apache-2.0 license, so there is no whole-file SPDX identifier. +// See LICENSE, THIRD-PARTY COMPONENTS for the notice and the upstream chain. export type EditMatchStrategy = 'exact' | 'line-trimmed' | 'whitespace' | 'escape'; diff --git a/packages/runtime/src/telemetry/model-pricing.generated.ts b/packages/runtime/src/telemetry/model-pricing.generated.ts index 253522026d..02277709ff 100644 --- a/packages/runtime/src/telemetry/model-pricing.generated.ts +++ b/packages/runtime/src/telemetry/model-pricing.generated.ts @@ -1,4 +1,10 @@ // Generated by scripts/sync-model-metadata.mjs from https://models.dev/api.json. +// Upstream: sst/models.dev (https://github.com/sst/models.dev), MIT, +// Copyright (c) 2025 models.dev. See LICENSE, THIRD-PARTY COMPONENTS. +// Snapshot: sha256 of the provider and model data extracted from api.json, +// 31a0e05d9aacc509205c399e20e2f1571438b88a6f32a496b0da7fad2eb6a356. +// models.dev serves a rolling document, so this identifies the extracted +// payload rather than a revision that can be fetched back. // Do not edit by hand; special access-path pricing belongs in builtin-pricing.ts. import type { PricingConfig } from '@maka/core/usage-stats/types'; diff --git a/packages/runtime/src/tool-output.ts b/packages/runtime/src/tool-output.ts index da595f00b5..7d01c08884 100644 --- a/packages/runtime/src/tool-output.ts +++ b/packages/runtime/src/tool-output.ts @@ -14,9 +14,20 @@ // it is safe to repeat) redirecting to a file, then Read/Grep that file; // otherwise work from the kept window. // -// Adapted from opencode's truncate.output() (packages/opencode/src/tool/ -// truncate.ts): same byte+line budget and head/tail windowing, minus the file -// spill + retention machinery. +// ATTRIBUTION: truncateToolOutput below is adapted from opencode's +// truncate.output() (packages/opencode/src/tool/truncate.ts): same byte+line +// budget and head/tail windowing, minus the file spill + retention machinery. +// Maka adds byte-safe single-line slicing, trailing-newline handling, and the +// recovery hint above. +// +// Source: https://github.com/anomalyco/opencode +// Revision: fc80874f45a595ff6874a4d36b1090f6a64424d2 +// License: MIT +// Copyright: Copyright (c) 2025 opencode +// +// Scope: the adapted material only; the rest is Maka source under the +// repository Apache-2.0 license, so there is no whole-file SPDX identifier. +// See LICENSE, THIRD-PARTY COMPONENTS for the notice and the upstream chain. export interface TruncateToolOutputOptions { /** Max retained lines before truncation kicks in. Default 2000. */ diff --git a/scripts/ci-test-plan.mjs b/scripts/ci-test-plan.mjs index 5f614786ce..9b00166b40 100644 --- a/scripts/ci-test-plan.mjs +++ b/scripts/ci-test-plan.mjs @@ -61,6 +61,7 @@ const CLI_PACKAGE_FILES = new Set([ 'scripts/apply-dependency-patches.mjs', 'scripts/clean-paths.mjs', 'scripts/generate-third-party-notices.mjs', + 'scripts/generate-third-party-notices.test.mjs', 'scripts/install-electron-with-retry.mjs', 'scripts/npm-spawn.mjs', 'scripts/smoke-release-cli-package.mjs', diff --git a/scripts/generate-third-party-notices.mjs b/scripts/generate-third-party-notices.mjs index caf27eec53..9a3cf936d6 100644 --- a/scripts/generate-third-party-notices.mjs +++ b/scripts/generate-third-party-notices.mjs @@ -228,7 +228,18 @@ function readLicenseFiles(directory) { function overrideLicenseText(packageKey, selectedLicense) { if (selectedLicense === 'Apache-2.0' && APACHE_TEXT_OVERRIDE_KEYS.has(packageKey)) { - return normalizeText(readFileSync(join(repoRoot, 'LICENSE'), 'utf8')); + // Only the license text itself stands in for the package's missing copy. + // LICENSE also carries Maka's own third-party section, and letting that + // through would file every entry in it under this one package. `split` + // returns the whole string when the delimiter is absent, which would + // reinstate exactly that bug, so the delimiter is required rather than + // assumed. + const rootLicense = readFileSync(join(repoRoot, 'LICENSE'), 'utf8'); + const [apacheText, thirdParty] = rootLicense.split('\nTHIRD-PARTY COMPONENTS\n'); + if (thirdParty === undefined) { + throw new Error('LICENSE has no THIRD-PARTY COMPONENTS section header to truncate at'); + } + return normalizeText(apacheText); } const copyrightNotice = MIT_COPYRIGHT_OVERRIDES.get(packageKey); if (selectedLicense === 'MIT' && copyrightNotice) return MIT_TEXT(copyrightNotice); diff --git a/scripts/generate-third-party-notices.test.mjs b/scripts/generate-third-party-notices.test.mjs new file mode 100644 index 0000000000..c8537d65f4 --- /dev/null +++ b/scripts/generate-third-party-notices.test.mjs @@ -0,0 +1,33 @@ +import assert from 'node:assert/strict'; +import { spawnSync } from 'node:child_process'; +import { readFileSync } from 'node:fs'; +import { dirname, join } from 'node:path'; +import { fileURLToPath } from 'node:url'; +import { test } from 'node:test'; + +const root = dirname(dirname(fileURLToPath(import.meta.url))); + +test('keeps a version-pinned Apache override scoped to the Apache license', () => { + const result = spawnSync( + process.execPath, + ['scripts/generate-third-party-notices.mjs', '--check'], + { + cwd: root, + encoding: 'utf8', + }, + ); + assert.equal(result.status, 0, result.stderr); + + const notices = readFileSync( + join(root, 'apps/desktop/resources/licenses/npm/THIRD_PARTY_NOTICES.txt'), + 'utf8', + ); + // Match the package without its version: the override is version-pinned in + // the generator, but pinning the version here too would fail on every + // routine dependency bump rather than on the leak this test guards. + const providerUtils = notices + .split('\n================================================================================\n') + .find((section) => section.includes('Package: @ai-sdk/provider-utils@')); + assert.ok(providerUtils, 'provider-utils notice section must exist'); + assert.doesNotMatch(providerUtils, /THIRD-PARTY COMPONENTS/); +}); diff --git a/scripts/sync-model-metadata.mjs b/scripts/sync-model-metadata.mjs index 0843ed66bd..88d731859e 100644 --- a/scripts/sync-model-metadata.mjs +++ b/scripts/sync-model-metadata.mjs @@ -1,3 +1,4 @@ +import { createHash } from 'node:crypto'; import { readFile, writeFile } from 'node:fs/promises'; import { pathToFileURL } from 'node:url'; @@ -85,14 +86,13 @@ export async function main(argv = process.argv) { const pricingOutputPath = option('--pricing-output', argv) ?? (outputPath === DEFAULT_OUTPUT ? DEFAULT_PRICING_OUTPUT : undefined); - const catalog = JSON.parse( - inputPath - ? await readFile(inputPath, 'utf8') - : await fetch(SOURCE_URL, { signal: AbortSignal.timeout(10_000) }).then((response) => { - if (!response.ok) throw new Error(`models.dev returned HTTP ${response.status}`); - return response.text(); - }), - ); + const sourceText = inputPath + ? await readFile(inputPath, 'utf8') + : await fetch(SOURCE_URL, { signal: AbortSignal.timeout(10_000) }).then((response) => { + if (!response.ok) throw new Error(`models.dev returned HTTP ${response.status}`); + return response.text(); + }); + const catalog = JSON.parse(sourceText); const generated = {}; const generatedPricing = []; @@ -149,10 +149,35 @@ export async function main(argv = process.argv) { } } + // Hashing api.json would make the digest move whenever any provider changes, + // including the ~40 this generator drops, producing header-only diffs that + // say nothing about the file they sit in. Hashing the extracted payload + // instead makes the digest describe what actually ships and keeps the + // generator a pure function of its input: same api.json, same bytes out. + // + // Every export derived from the catalog is covered. A digest over a subset + // would sit in a header claiming to describe the file while upstream changes + // to the uncovered exports left it unmoved. + const snapshot = { + digest: createHash('sha256') + .update( + JSON.stringify({ + metadata: generated, + modelProviderOverrides: generatedModelProviderOverrides, + providerFacts: generatedProviders, + directory, + pricing: generatedPricing, + }), + ) + .digest('hex'), + }; + const providerTypeUnion = Object.keys(PROVIDERS).map(JSON.stringify).join(' | '); const lines = [ - '// Generated by scripts/sync-model-metadata.mjs from https://models.dev/api.json.', - '// Do not edit by hand; put access-path-specific facts in model-metadata.ts.', + ...snapshotHeader( + snapshot, + '// Do not edit by hand; put access-path-specific facts in model-metadata.ts.', + ), "import type { ModelMetadata } from './model-metadata.js';", '', `export const GENERATED_MODELS_DEV_METADATA: Record<${providerTypeUnion}, Record> = {`, @@ -188,7 +213,7 @@ export async function main(argv = process.argv) { lines.push('};', ''); await writeFile(outputPath, lines.join('\n')); if (pricingOutputPath) { - await writeFile(pricingOutputPath, buildPricingModule(generatedPricing)); + await writeFile(pricingOutputPath, buildPricingModule(generatedPricing, snapshot)); } } @@ -352,10 +377,29 @@ function optionalPriceNumber(providerType, modelId, value, field) { return value === undefined ? undefined : priceNumber(providerType, modelId, value, field); } -function buildPricingModule(pricing) { +// Every generated file states where its content came from and which exact +// payload produced it, so the fixed source stays identifiable after models.dev +// has moved on. The upstream copyright line is required by its MIT license and +// is repeated in LICENSE under THIRD-PARTY COMPONENTS. +function snapshotHeader(snapshot, handEditLine) { + return [ + `// Generated by scripts/sync-model-metadata.mjs from ${SOURCE_URL}.`, + '// Upstream: sst/models.dev (https://github.com/sst/models.dev), MIT,', + '// Copyright (c) 2025 models.dev. See LICENSE, THIRD-PARTY COMPONENTS.', + '// Snapshot: sha256 of the provider and model data extracted from api.json,', + `// ${snapshot.digest}.`, + '// models.dev serves a rolling document, so this identifies the extracted', + '// payload rather than a revision that can be fetched back.', + handEditLine, + ]; +} + +function buildPricingModule(pricing, snapshot) { const lines = [ - '// Generated by scripts/sync-model-metadata.mjs from https://models.dev/api.json.', - '// Do not edit by hand; special access-path pricing belongs in builtin-pricing.ts.', + ...snapshotHeader( + snapshot, + '// Do not edit by hand; special access-path pricing belongs in builtin-pricing.ts.', + ), "import type { PricingConfig } from '@maka/core/usage-stats/types';", '', 'export const GENERATED_MODEL_PRICING: readonly PricingConfig[] = [',