fix(plugin-tree): 补上 package.json files 已声明、但仓库里不存在的 LICENSE (#3647) by yinlianghui · Pull Request #3662 · objectstack-ai/objectui

yinlianghui · 2026-08-07T17:40:13Z

问题

@object-ui/plugin-tree 的 package.json 在 files 里点名要打包 LICENSE,但 packages/plugin-tree/LICENSE 根本不存在。npm 对 files 里缺失的条目是静默跳过的 —— 不报错、不警告,于是 npm publish 与 CI 一路绿灯,而每一个已发布的 tarball 都没有它自己 manifest 承诺要带的 MIT 许可证文本。

在 origin/main 上实测 39 个包(38 个可发布 + 1 个 private),plugin-tree 是唯一「声明了 LICENSE 却没有该文件」的包:

包	`private`	`files` 是否含 LICENSE	文件是否存在
`plugin-tree`	false	✅ 声明了	❌ 缺失 ← 本 PR
`react-runtime` / `sdui-parser`	false	❌ 未声明(`files` 只有 `dist`)	❌
`vscode-extension`	true(不发 npm)	无 `files`	❌
其余 35 个	false	✅	✅

react-runtime / sdui-parser 属于打包策略问题(要不要给所有已发布包补 LICENSE),issue 正文已把它与本单分开,本 PR 不碰。

改动

只新增一个文件:packages/plugin-tree/LICENSE。

内容是仓根 LICENSE 的逐字节副本。先实测过一致性 —— 根 LICENSE 与 35 个兄弟包的 LICENSE 共 36 份,在 git 里是同一个 blob:

$ git ls-tree -r origin/main | grep -E 'LICENSE$' | awk '{print $3}' | sort | uniq -c
36 cf2ca28574caca42deafdee0ea935fc2e2823427

验收:`npm pack --dry-run` 前后对照

验收标准不是「文件存在」,而是它确实进入 tarball 清单。在 packages/plugin-tree/ 下实测:

修改前(预测:清单无 LICENSE — 命中):

npm notice Tarball Contents
npm notice 21.9kB CHANGELOG.md
npm notice 1.7kB README.md
npm notice 1.9kB package.json
npm notice total files: 3

修改后(预测:LICENSE 进入清单 — 命中):

npm notice Tarball Contents
npm notice 21.9kB CHANGELOG.md
npm notice 1.1kB LICENSE
npm notice 1.7kB README.md
npm notice 1.9kB package.json
npm notice total files: 4

total files 3 → 4,unpacked size 25.5 kB → 26.5 kB。

两点说明,免得清单读起来有歧义:

清单里没有 dist/,是因为这是一棵全新 worktree、该包尚未构建。这不影响本次验收 —— npm 对 LICENSE 的收录与 dist 是否存在互相独立。
作为对照,同样未构建的兄弟包 plugin-timeline 跑同一条命令,清单里是有 1.1kB LICENSE 的 —— 证明差异来自文件本身的有无,而不是命令或环境。

补充一条 npm 语义:LICENSE 属于 npm 无视 files 也总是收录的文件之一,所以 files 里那条 "LICENSE" 声明本身是冗余但无害的;真正的修复就是把文件补上,不需要动 package.json(本 PR 也确实没动)。

关于 changeset:判定为不加,依据如下

仓规明文:AGENTS.md 第 151 行 —— 「功能改进(feature)需写 changeset;纯 bug 修复不需要」。本 PR 是纯打包缺陷修复。
直接先例:PR feat(scripts): check-doc-links 扫描面第四扩 packages/*/README.md,并付清入场价的 11 条死链 (#3622) #3649(修 check-doc-links 扫描面第四扩 packages/*/README.md：入场价是另外 11 条死链（实测），不是 #3603 正文的 9 条 #3622)改了 7 个已发布包的 README.md,README 同样在各包 files 里、同样改变 tarball 内容,该 PR 未加 changeset。
修复不会被搁浅:.changeset/config.json 把 39 个包放在同一个 fixed 组,任何一个 changeset 都会带着 plugin-tree 一起 bump 并重新发布。当前已有 16 个待发 changeset,下一次发版本就会把这份 LICENSE 带上 npm —— 不需要本 PR 自带 changeset 来触发。
反过来,为补一个文件而新增 changeset,会让 39 个包整组 bump 一个版本,收益与代价不成比例。

历史上唯一一个新增 packages/*/LICENSE 的提交是仓库初始导入(30ac2e1,一次性加入全部文件),不构成单包补 LICENSE 的先例。

顺带发现(未在本 PR 处理,已另行开单)

plugin-tree 的 README.md 是 38 个已发布包里唯一没有 ## License 小节的 —— 也正因如此,check-doc-links 扫描面第四扩 packages/*/README.md：入场价是另外 11 条死链（实测），不是 #3603 正文的 9 条 #3622/feat(scripts): check-doc-links 扫描面第四扩 packages/*/README.md,并付清入场价的 11 条死链 (#3622) #3649 那轮针对 packages/*/README.md 的死链扫描发现不了这个缺失(它连指向 ./LICENSE 的链接都没有,自然没有死链可查)。
仓库没有任何门禁校验「files 里声明的条目在磁盘上真实存在」或「已发布包都带 LICENSE」。这正是本缺陷能长期静默存在的原因。

🤖 Generated with Claude Code

https://claude.ai/code/session_01GTRjn8xBqp75dk7kFupVRt

Generated by Claude Code

…lready declares (#3647) `@object-ui/plugin-tree` lists "LICENSE" in package.json `files`, but packages/plugin-tree/LICENSE did not exist. npm silently skips missing `files` entries, so publish and CI both stayed green while every released tarball shipped without the MIT text its own manifest promised — the only one of 36 publishable packages in that state. The added file is a byte-identical copy of the repository root LICENSE (git blob cf2ca28), which is the exact same blob all 35 sibling packages already carry. Verified with `npm pack --dry-run` in packages/plugin-tree: before 3 files (no LICENSE), after 4 files including 1.1kB LICENSE. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01GTRjn8xBqp75dk7kFupVRt

vercel · 2026-08-07T17:40:20Z

The latest updates on your projects. Learn more about Vercel for GitHub.

1 Skipped Deployment

Project	Deployment	Actions	Updated (UTC)
objectui	Ignored		Aug 7, 2026 5:40pm

github-actions · 2026-08-07T17:41:39Z

✅ Console Performance Budget

Metric	Value	Budget
Main entry (gzip)	28.1 KB	350 KB
Entry file	`index-DchYFue2.js`	—
Status	PASS	—

📦 Bundle Size Report

Package	Size	Gzipped
app-shell (index.js)	8.66KB	3.13KB
app-shell (runtime-config.js)	7.42KB	2.32KB
app-shell (types.js)	0.01KB	0.04KB
app-shell (urlParams.js)	7.57KB	2.97KB
auth (AuthContext.js)	0.31KB	0.24KB
auth (AuthGuard.js)	1.17KB	0.53KB
auth (AuthProvider.js)	22.10KB	4.37KB
auth (AuthShell.js)	3.49KB	1.40KB
auth (ForgotPasswordForm.js)	12.21KB	3.45KB
auth (LoginForm.js)	18.13KB	5.39KB
auth (PreviewBanner.js)	0.90KB	0.50KB
auth (RegisterForm.js)	6.64KB	2.21KB
auth (SocialSignInButtons.js)	9.60KB	3.89KB
auth (UserMenu.js)	3.40KB	1.22KB
auth (auth-gate-events.js)	1.29KB	0.66KB
auth (authStyles.js)	5.04KB	1.72KB
auth (createAuthClient.js)	35.76KB	9.11KB
auth (createAuthenticatedFetch.js)	4.37KB	1.69KB
auth (index.js)	2.35KB	1.07KB
auth (org-roles.js)	6.66KB	2.78KB
auth (phone-identifier.js)	1.11KB	0.66KB
auth (types.js)	0.59KB	0.35KB
auth (useAuth.js)	4.91KB	0.87KB
auth (useIsWorkspaceAdmin.js)	1.61KB	0.85KB
collaboration (CommentThread.js)	26.07KB	7.56KB
collaboration (LiveCursors.js)	3.17KB	1.27KB
collaboration (PresenceAvatars.js)	6.49KB	2.64KB
collaboration (PresenceProvider.js)	2.79KB	1.13KB
collaboration (index.js)	1.65KB	0.73KB
collaboration (useCollaborationTranslation.js)	6.05KB	2.52KB
collaboration (useCommentSearch.js)	1.98KB	0.88KB
collaboration (useConflictResolution.js)	7.75KB	1.86KB
collaboration (useMentionNotifications.js)	1.81KB	0.68KB
collaboration (usePresence.js)	6.33KB	1.84KB
collaboration (useRealtimeSubscription.js)	7.91KB	2.01KB
components (index.js)	480.72KB	105.64KB
core (index.js)	2.96KB	1.13KB
create-plugin (index.js)	9.28KB	2.98KB
data-objectstack (index.js)	137.51KB	35.11KB
fields (index.js)	230.87KB	56.83KB
i18n (LocalizationContext.js)	1.76KB	0.96KB
i18n (currency.js)	1.22KB	0.64KB
i18n (i18n.js)	4.32KB	1.77KB
i18n (index.js)	2.65KB	1.06KB
i18n (pickLocalized.js)	1.70KB	0.83KB
i18n (provider.js)	9.48KB	3.27KB
i18n (useObjectLabel.js)	26.14KB	6.07KB
i18n (useSafeTranslation.js)	4.52KB	1.96KB
layout (index.js)	38.53KB	10.71KB
mobile (MobileProvider.js)	0.92KB	0.49KB
mobile (ResponsiveContainer.js)	0.94KB	0.38KB
mobile (breakpoints.js)	1.51KB	0.70KB
mobile (createOfflineDataSource.js)	5.61KB	1.74KB
mobile (index.js)	1.50KB	0.62KB
mobile (offlineQueue.js)	3.91KB	1.35KB
mobile (pwa.js)	0.97KB	0.49KB
mobile (serviceWorker.js)	1.48KB	0.62KB
mobile (serviceWorkerSource.js)	3.41KB	1.48KB
mobile (useBreakpoint.js)	1.54KB	0.65KB
mobile (useGesture.js)	6.96KB	1.98KB
mobile (useOfflineSync.js)	1.99KB	0.72KB
mobile (usePullToRefresh.js)	2.53KB	0.85KB
mobile (useResponsive.js)	0.71KB	0.42KB
mobile (useResponsiveConfig.js)	1.36KB	0.63KB
mobile (useSpecGesture.js)	4.32KB	1.64KB
mobile (useTouchTarget.js)	1.01KB	0.54KB
permissions (MePermissionsProvider.js)	8.75KB	3.06KB
permissions (PermissionContext.js)	0.31KB	0.25KB
permissions (PermissionGuard.js)	0.89KB	0.45KB
permissions (PermissionProvider.js)	3.67KB	1.12KB
permissions (evaluator.js)	4.41KB	1.44KB
permissions (index.js)	0.91KB	0.41KB
permissions (store.js)	0.91KB	0.42KB
permissions (useFieldPermissions.js)	1.28KB	0.52KB
permissions (usePermissions.js)	1.55KB	0.71KB
plugin-ai (index.js)	15.71KB	3.79KB
plugin-calendar (index.js)	44.98KB	12.37KB
plugin-charts (index.js)	61.04KB	17.31KB
plugin-chatbot (index.js)	180.09KB	42.72KB
plugin-dashboard (index.js)	115.50KB	29.96KB
plugin-designer (index.js)	210.51KB	42.51KB
plugin-detail (index.js)	232.79KB	57.42KB
plugin-editor (index.js)	2.46KB	1.10KB
plugin-form (index.js)	112.10KB	27.10KB
plugin-gantt (index.js)	162.55KB	39.57KB
plugin-grid (index.js)	186.61KB	49.34KB
plugin-kanban (index.js)	48.30KB	13.28KB
plugin-list (index.js)	105.12KB	25.48KB
plugin-map (index.js)	16.81KB	5.24KB
plugin-markdown (index.js)	13.72KB	4.69KB
plugin-report (index.js)	40.58KB	10.58KB
plugin-timeline (index.js)	25.76KB	7.33KB
plugin-tree (index.js)	8.50KB	2.88KB
plugin-view (index.js)	84.03KB	20.55KB
providers (DataSourceProvider.js)	0.75KB	0.39KB
providers (MetadataProvider.js)	1.37KB	0.59KB
providers (ThemeProvider.js)	1.90KB	0.85KB
providers (UploadProvider.js)	11.71KB	3.53KB
providers (index.js)	0.44KB	0.22KB
providers (types.js)	0.01KB	0.04KB
react-runtime (index.js)	5.67KB	2.37KB
react (LazyPluginLoader.js)	3.77KB	1.33KB
react (SchemaRenderer.js)	19.28KB	6.38KB
react (data-invalidation.js)	5.05KB	2.08KB
react (index.js)	1.02KB	0.55KB
react (spec-input.js)	0.20KB	0.18KB
sdui-parser (codegen.js)	4.09KB	1.74KB
sdui-parser (index.js)	4.47KB	2.03KB
sdui-parser (parse.js)	10.04KB	2.82KB
sdui-parser (types.js)	0.29KB	0.24KB
sdui-parser (validate.js)	4.69KB	1.48KB
types (ai.js)	0.20KB	0.17KB
types (api-types.js)	0.20KB	0.18KB
types (app.js)	2.87KB	0.99KB
types (base.js)	0.20KB	0.18KB
types (blocks.js)	0.20KB	0.18KB
types (complex.js)	0.20KB	0.18KB
types (crud.js)	0.20KB	0.18KB
types (data-display.js)	0.20KB	0.18KB
types (data-protocol.js)	0.20KB	0.19KB
types (data.js)	0.20KB	0.18KB
types (designer.js)	1.87KB	0.85KB
types (disclosure.js)	0.20KB	0.18KB
types (error-code.js)	1.54KB	0.88KB
types (feedback.js)	0.20KB	0.18KB
types (field-types.js)	0.20KB	0.18KB
types (form.js)	0.20KB	0.18KB
types (http-retry.js)	4.32KB	2.02KB
types (index.js)	2.71KB	1.34KB
types (layout.js)	0.20KB	0.18KB
types (managed-by.js)	0.19KB	0.18KB
types (mobile.js)	2.59KB	1.31KB
types (navigation.js)	0.20KB	0.18KB
types (objectql.js)	0.20KB	0.18KB
types (overlay.js)	0.20KB	0.18KB
types (permissions.js)	0.20KB	0.18KB
types (plugin-scope.js)	0.20KB	0.18KB
types (record-components.js)	0.20KB	0.19KB
types (record-semantics.js)	1.28KB	0.67KB
types (registry.js)	0.20KB	0.18KB
types (reports.js)	0.20KB	0.18KB
types (spec-report.js)	5.05KB	1.93KB
types (system-fields.js)	3.33KB	1.54KB
types (theme.js)	0.20KB	0.18KB
types (ui-action.js)	3.40KB	1.71KB
types (views.js)	0.20KB	0.18KB
types (widget.js)	0.20KB	0.18KB

Size Limits

✅ Core packages should be < 50KB gzipped
✅ Component packages should be < 100KB gzipped
⚠️ Plugin packages should be < 150KB gzipped

…d READMEs carry (objectstack-ai#3664) (objectstack-ai#3695) `packages/plugin-tree/README.md` was the only one of the 38 published packages that had a README but no `## License` section. Census over origin/main: - 38 published (non-private) packages - 37 have a README (`sdui-parser` has none — out of scope, see objectstack-ai#3647) - 36 of those 37 carry `## License`; plugin-tree was the sole omission The section is copied verbatim from the dominant form, 32 of the 36: ## License MIT — see [LICENSE](./LICENSE). The four minority spellings are `MIT` (types, react-runtime) and `MIT © ObjectStack Inc.` (plugin-timeline, plugin-chatbot). The issue suggested plugin-timeline as the exemplar, but that form is 1-of-36 and carries no `./LICENSE` link at all — the majority form is both the convention and the one that gives the link gate something to check. Position matches too: final section, as in 34 of the 36 (plugin-view and types continue past it). This also closes the gap objectstack-ai#3664 identified: `check-doc-links.mjs` scan root 7 (`packages/*/README.md`, `disk` rule) resolves relative hrefs as repository paths, so the new `./LICENSE` link is now mechanically checked against the file PR objectstack-ai#3662 landed. Previously the README linked nothing, which is exactly why the objectstack-ai#3622/objectstack-ai#3649 dead-link sweep could not detect the missing LICENSE — no link, no dead link. Verified the new link is load-bearing rather than vacuously green: temporarily removing `packages/plugin-tree/LICENSE` turns the gate red with `packages/plugin-tree/README.md:50 -> ./LICENSE` (exit 1); restoring it returns `Links are valid across 7 scan roots` (exit 0). No changeset: documentation-only, matching the precedent of PR objectstack-ai#3662 (which added this same package's LICENSE, likewise shipped in the tarball) and PR objectstack-ai#3688 (36 package READMEs), neither of which carried one. Fixesobjectstack-ai#3664 Claude-Session: https://claude.ai/code/session_01GTRjn8xBqp75dk7kFupVRt Co-authored-by: Claude <noreply@anthropic.com>

github-actionsBot added the plugin label Aug 7, 2026

This was referenced Aug 7, 2026
没有门禁校验「package.json 的 files 条目在磁盘上真实存在」——npm 静默跳过缺失条目,#3647 因此长期无人察觉 #3663
Closed
packages/plugin-tree/README.md 是 38 个已发布包里唯一没有 ## License 小节的 #3664
Closed

yinlianghui marked this pull request as ready for review August 7, 2026 17:44

yinlianghui mentioned this pull request Aug 7, 2026
@object-ui/plugin-tree 的 package.json files 声明了 LICENSE,但 packages/plugin-tree/LICENSE 不存在——已发布包缺失它自己声明要带的许可证文本 #3647
Closed

yinlianghui added this pull request to the merge queue Aug 7, 2026

Merged via the queue into main with commit dae1ac4Aug 7, 2026
18 checks passed

yinlianghui deleted the claude/issue-3647-plugin-tree-license branch August 7, 2026 17:45

Navigation Menu

Uh oh!

fix(plugin-tree): 补上 package.json files 已声明、但仓库里不存在的 LICENSE (#3647) - #3662

fix(plugin-tree): 补上 package.json files 已声明、但仓库里不存在的 LICENSE (#3647)#3662
yinlianghui merged 1 commit into
mainfrom
claude/issue-3647-plugin-tree-license

yinlianghui commented Aug 7, 2026

Uh oh!

vercelBot commented Aug 7, 2026

Uh oh!

github-actionsBot commented Aug 7, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Uh oh!

Conversation

yinlianghui commented Aug 7, 2026

问题

改动

验收:npm pack --dry-run 前后对照

关于 changeset:判定为不加,依据如下

顺带发现(未在本 PR 处理,已另行开单)

Uh oh!

vercelBot commented Aug 7, 2026

Uh oh!

github-actionsBot commented Aug 7, 2026

✅ Console Performance Budget

📦 Bundle Size Report

Size Limits

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

验收:`npm pack --dry-run` 前后对照