DFSG NEW review for node-monacopilot version 1.1.15+ds-1

Summary

• Licensing is DFSG-compliant and debian/copyright is accurate: Yes
• Packaging is of good quality: Yes
• Issues: 0 blocker, 0 important, 2 minor
• debian/watch: version 5
• debian/copyright: machine-readable
• Scan before the review: nothing found

Licensing

MIT/Expat throughout. debian/copyright is DEP-5 with the current Format URL, a Files: * catch-all (2024 Arshad Yaseen) and a debian/* stanza (2026 Emfox Zhou), and carries the full Expat text since the licence is not in /usr/share/common-licenses. The tree holds no other licence: no second LICENSE/COPYING, no vendored third-party code, no SPDX headers, no built or binary files. The only imperfection is that the Mistral AI copyright in the types the Debian patch adds is recorded in a Comment under the debian/* stanza rather than in the Copyright of the stanza that covers the file (minor).

Packaging

Clean, conventional pkg-js-tools packaging at debhelper compat 14 with Rules-Requires-Root: no: dh-sequence-nodejs, a two-package split (provider core without Monaco vs the editor half) that is explained in README.Debian, autopkgtest-pkg-nodejs with its own pkg-js test, DEP-3 patches, README.source for the +ds repack, gbp.conf, salsa-ci.yml, upstream/metadata and a properly versioned initial changelog. All Build-Depends resolve (node-monaco-editor is built by monaco-editor 0.47.0+ds-1 waiting in NEW, and its version satisfies the bound). Only a deprecated get-orig-source target (minor) is worth raising.

Issues

1. [minor] [licensing] Mistral AI is named only in a Comment under the debian/* stanza, not in the Copyright of the stanza covering packages/core/src/types/mistral-fim.ts

• Files: debian/copyright:18-24, packages/core/src/types/mistral-fim.ts:10
• Basis: checked, in the package or with a reference tool
• Evidence: Comment (debian/* stanza): debian/patches/0001-local-mistral-fim-types.patch adds packages/core/src/types/mistral-fim.ts at build time. ... Copyright Mistral AI, also under this licence. -- while the stanza that actually matches that file is Files: * / Copyright: 2024 Arshad Yaseen.
• Problem: packages/core/src/types/mistral-fim.ts is added by the Debian patch and its FIM request/response types are derived from @mistralai/mistralai 1.5.0 (Derived from @mistralai/mistralai 1.5.0, Copyright Mistral AI, MIT licence in the file header), so Mistral AI holds copyright in part of it. The Files: * stanza that covers the file names only Arshad Yaseen, and the stanza whose Comment names Mistral AI (debian/*) does not apply to that path, so debian/copyright does not accurately state the holders of that file (copyright-format 1.0 section 5.2 / 6.6).
• Fix: Give that path its own stanza, e.g. Files: packages/core/src/types/mistral-fim.ts with Copyright: 2024 Arshad Yaseen and Copyright: Mistral AI and License: Expat, and drop the Comment.

2. [minor] [packaging] debian/rules ships a get-orig-source target, which Policy removed in 4.1.4

• Files: debian/rules:9-10, debian/get-orig-source
• Basis: checked, in the package or with a reference tool
• Evidence: Policy A10.18 (version 4.1.4), section 4.9: The "get-orig-source" rules target has been removed. Packages should transition to "debian/watch" and use uscan where possible.
• Problem: The target is no longer part of the Policy interface, and the +ds drop list it needs is duplicated verbatim in debian/get-orig-source (DROP=) and in the Files-Excluded field of debian/copyright, with only a comment asking that they be kept in step; uscan keeps the exclusion list in one place. Only a Policy should, so minor.
• Fix: Drop the get-orig-source target and debian/get-orig-source, or keep the script as a clearly out-of-tree maintainer helper, and let uscan produce the repacked orig tarball.

Verified

• Whole upstream tree covered (63 files, .pc/ excluded): ~40 TypeScript sources under packages/core/src and packages/monacopilot/src, 6 files under the two tests/ directories, two package.json, two tsup.config.ts, two README.md, root LICENSE, package.json, tsconfig.json, pnpm-lock.yaml, pnpm-workspace.yaml and six dotfiles (.eslintrc.json, .prettierrc, .prettierignore, .commitlintrc.json, .npmrc, .gitignore); every one of them was listed, and every source file that could carry a notice was read or grepped.
• Licensing evidence grepped across the tree for Copyright/(C)/SPDX-License-Identifier/Licensed under/Permission is hereby granted/GNU/Apache/Mozilla/public domain/All rights reserved: the only hits are the root LICENSE (MIT License / Copyright (c) 2024 Arshad Yaseen), the same holder in both packages/*/package.json ("license": "MIT", author fields) and the Mistral AI notice in the patched file. No subdirectory LICENSE/COPYING/NOTICE/AUTHORS exists, no vendored third-party code, no SPDX headers.
• Prescan dfsg-author-check: 63 files scanned, every holder found is named in debian/copyright; it listed no file for me to account for, and I found no holder in the tree beyond Arshad Yaseen (Files: *) and Mistral AI.
• No built, minified, binary, class, jar, .so, .pyc, exe, font, image, PDF or generated-without-input file in the tree; the build output (debian/build-result/) exists only after debian/build.sh runs and debian/clean removes it. The only large file is pnpm-lock.yaml (303 KB), a package-manager lock file with no code in it.
• Files-Excluded names docs, playground, .github, scripts, .husky, bump.config.ts, CODE_OF_CONDUCT.md, CONTRIBUTING.md; none of them is present in the unpacked tree, so the list matches what the repack removed. The same list is in debian/get-orig-source.
• debian/copyright stanza coverage: debian/* (last stanza) overrides Files: * for every path under debian/, and * matches everything else (copyright-format 6.9), so no file is uncovered; the Format URL is the current 1.0 one and the Expat text is included in full because MIT/Expat is not in /usr/share/common-licenses.
• Build-Depends resolve: node-esbuild is provided by esbuild 0.28.2-1, rollup is 3.30.0-7, node-rollup-plugin-dts 6.5.1-1, node-typescript 6.0.3-2, dh-sequence-nodejs is provided by dh-nodejs 0.17.14; python3 is genuinely used, by the package.json filter in debian/build.sh.
• node-monaco-editor is not in the archive lists yet, but apt-cache reports it is built by monaco-editor 0.47.0+ds-1 waiting in ftp-master's NEW queue; 0.47.0 satisfies both (>= 0.41.0) and (<< 0.53), so this is not a fault.
• debian/tests/pkg-js/api.test.js checked assertion by assertion against the sources: PROVIDERS/MODEL_IDS/PROVIDER_MODEL_MAP/PROVIDER_ENDPOINT_MAP in packages/core/src/llm/base.ts, the Please provide the mistral API key. and Please provide required Copilot options messages and their order (validate.params before validate.inputs) in validator.ts and copilot.ts, DEFAULT_COPILOT_MAX_TOKENS/STOP_SEQUENCE in defaults.ts, logger exported from index.ts, and Copilot/CompletionCopilot/registerCompletion in packages/monacopilot/src/index.ts. All match, so the test is consistent with the tree.
• The patch adds only packages/core/src/types/mistral-fim.ts and rewrites one import in packages/core/src/types/llm.ts to import type ... from './mistral-fim'; it has DEP-3 headers (Description, Origin: vendor, Forwarded: not-needed) and is disclosed in README.source and debian/copyright.
• Packaging read in full: control, rules, changelog, copyright, README.Debian, README.source, get-orig-source, clean, build.sh, tsconfig.core.json, tsconfig.monacopilot.json, rollup.dts.cjs, gbp.conf, salsa-ci.yml, upstream/metadata, source/format, patches/series, the patch, and debian/tests/pkg-js/{test,api.test.js,require-name}. Standards-Version 4.7.4 against the reviewing system's Policy 4.7.4.1: first two components equal, not an issue.
• debian/rules leaves override_dh_auto_test empty and README.source says the checks run under autopkgtest; the tests it would otherwise run need the installed modules, and from compat 13 dh skips that override under nocheck anyway (debhelper 14.5, dh_auto_test: The dh command sequencer will now skip all hook and override targets for dh_auto_test ... when DEB_BUILD_OPTIONS lists the relevant nocheck), so nothing is lost in a nocheck build.
• uscan found upstream releases with debian/watch; a newer upstream version is available (upstream 1.3.1, packaged 1.1.15+ds), which is not a fault of the package.

Not confirmed

• No build was run: I could not check whether tsc resolves monaco-editor/esm/vs/editor/editor.api out of the node-monaco-editor package waiting in NEW (its file list is not in the archive lists), nor whether esbuild's TypeScript import elision drops that type-only import from the built monacopilot modules, as README.Debian asserts (No Monaco module is loaded at run time); the package's own api.test.js requiring the module is what would show it.
• File modes are not readable with the tools here. debian/rules invokes debian/get-orig-source as a command, so that file needs the execute bit; debian/tests/pkg-js/test does not, since pkg-js-tools runs it through /bin/sh -ex (Debian::Debhelper::Buildsystem::nodejs).

Proposed changes

None.