Fix dependency license discovery for Bun isolated installs

Closed
DI
1d ago
+122-2

Change

Make the JavaScript license gate inspect dependencies installed by Bun's isolated linker.

After a normal bun install --frozen-lockfile, the existing glob discovers zero package manifests in this workspace: it skips both the hidden .bun store and the package links. Consequently, bun run licenses can succeed without checking any installed dependency.

Enable hidden-directory and symlink traversal, retain the existing package-identity deduplication, and restrict auditing to installed package-root manifests. The last restriction matters because published packages also contain internal CommonJS/ESM package.json files that specify module format and have no independent license metadata.

Run seven real CLI regression fixtures through the existing licenses command. They cover direct and transitive isolated dependencies, linked private workspaces, duplicate links and cycles, ordinary missing/disallowed licenses, internal module-format manifests with nested dependencies, and allowed/private packages.

The dependency versions, allowlist, license-expression handling, and private-package exemption are unchanged.

Validation

  • bun install --frozen-lockfile: passed; no lockfile changes.
  • Final regression fixtures against the unchanged checker: 2 passed, 5 failed.
  • bun test scripts/check-js-licenses.test.mjs with the fix: 7 passed, 0 failed, 15 assertions, on Linux with Bun 1.4.3.
  • Actual installed-package inventory: 120 unique audited packages across 422 package-root paths; 63 internal/non-root manifests excluded. The original glob reports zero paths on the same installation.
  • cargo update --workspace --locked --offline: passed, zero package updates.
  • bun scripts/check-boundaries.mjs, buf lint, syntax checks for both changed scripts, git diff --check, and a redacted Gitleaks scan of the staged patch: passed.

The actual license audit now fails on the previously hidden argparse@2.0.1: Python-2.0 result. This is an existing installed dependency rejected by the existing allowlist. The fix neither adds that license to the policy nor suppresses the finding; the allowlist/dependency decision remains separate from repairing discovery.

Other repository checks report existing failures outside this change: check-metadata.mjs stops at fuzz/guest-negative-control.py; Rust and Protobuf formatting checks report unchanged files; tsc -p scripts --pretty false reports 31 diagnostics in other scripts/generated-import paths and none in the changed license scripts. Full Rust/runtime and generated-package qualification is not claimed for this scripts-only change.

  • On macOS arm64 with Bun 1.4.0, the frozen install, all 7 CLI regressions, and the boundary check also pass. The actual audit reports the same existing argparse license-policy failure.

Disclosure

  • No third-party source is imported; no provenance entry is required.
  • No generated descriptor or private namespace is added.
  • No private source, protocol, credential, or operational evidence is included.
  • The commit includes a DCO sign-off.
  • README authorship item: not applicable; no README file is changed.

Summary by cubic

Fixes the JavaScript license gate so it discovers packages installed by Bun's isolated linker instead of skipping the entire frozen installation silently.

  • Traverses hidden .bun stores and symlinks and audits only package-root manifests, so internal module-format package.json files are not flagged as missing licenses.
  • Adds seven CLI regression fixtures covering isolated, linked, cyclic, and nested dependency layouts and runs them from bun run licenses.
  • The gate now reports the previously hidden argparse@2.0.1 (Python-2.0), an existing allowlist rejection; the fix changes discovery only, not license policy.