Review: node-monacopilot 1.1.15+ds-1
Package Information
| Description | provider plumbing behind monacopilot This is the half of monacopilot that knows how to talk to an LLM: it builds the fill-in-the-middle request for a given prompt, sends it, and turns the response back into completion text. It also holds the small helpers the editor-facing half reuses, such as text truncation and the request cache. It knows nothing about Monaco and imports no editor code, so it is usable on its own from a script. Node.js is an event-based server-side JavaScript engine. |
|---|---|
| Maintainer | Debian Javascript Maintainers <pkg-javascript-devel@lists.alioth.debian.org> |
| Changed By | Emfox Zhou <emfox@debian.org> |
| Sponsor | emfox@debian.org |
| Distribution | unstable |
| Architecture | all |
| VCS | git: https://salsa.debian.org/js-team/node-monacopilot.git (browse) |
| Closes | #1152051 |
| Tracker | https://tracker.debian.org/pkg/node-monacopilot |
| Uploaded | 10 days ago |
New Package Report
.changes
| Architecture | source all |
|---|---|
| Distribution | unstable |
| Date | Sun, 25 Oct 2026 20:00:00 +0800 |
| Source | node-monacopilot |
| Version | 1.1.15+ds-1 |
| Changed-By | Emfox Zhou <emfox@debian.org> |
Changelog
node-monacopilot (1.1.15+ds-1) unstable; urgency=medium . * Initial release. (Closes: #1152051)
.dsc
| Section | javascript |
|---|---|
| Priority | optional |
| Component | main |
| Package-List | node-monacopilot deb javascript optional arch=all node-monacopilot-core deb javascript optional arch=all |
debian/copyright
Format: https://www.debian.org/doc/packaging-manuals/copyright-format/1.0/
Upstream-Name: monacopilot
Source: https://github.com/arshad-yaseen/monacopilot
Files-Excluded: docs
playground
.github
scripts
.husky
bump.config.ts
CODE_OF_CONDUCT.md
CONTRIBUTING.md
Files: *
Copyright: 2024 Arshad Yaseen
License: Expat
Files: packages/core/src/types/mistral-fim.ts
Copyright: 2026 Emfox Zhou <emfox@debian.org>
2024 Mistral AI
License: Apache-2.0
Files: debian/*
Copyright: 2026 Emfox Zhou <emfox@debian.org>
License: Expat
License: Expat
Permission is hereby granted, free of charge, to any person obtaining a copy
of this software and associated documentation files (the "Software"), to deal
in the Software without restriction, including without limitation the rights
to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
copies of the Software, and to permit persons to whom the Software is
furnished to do so, subject to the following conditions:
.
The above copyright notice and this permission notice shall be included in
all copies or substantial portions of the Software.
.
THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
THE SOFTWARE.
License: Apache-2.0
On Debian systems, the complete text of the Apache License 2.0 can be found
in /usr/share/common-licenses/Apache-2.0.
DFSG Assistant LLM REVIEW 0 blocker, 0 important, 3 minor
This is an LLM based review using a Debian Inference based workflow. It was not written by a member of the DFSG team and has not been checked by one. It is not a decision on the package: it may be wrong, and it may have missed things.
Reviewed 10 days ago.
Report
DFSG NEW review for node-monacopilot version 1.1.15+ds-1
Summary
- Licensing is DFSG-compliant and
debian/copyrightis accurate: Yes - Packaging is of good quality: Yes
- Issues: 0 blocker, 0 important, 3 minor
- debian/watch: version 5
- debian/copyright: machine-readable
- Scan before the review: nothing found
Licensing
debian/copyright is DEP-5 (Format line exactly the current URL) and matches the tree. Files: * is Expat for 2024 Arshad Yaseen, matching LICENSE; packages/core/src/types/mistral-fim.ts is Apache-2.0, jointly 2026 Emfox Zhou (the patch author) and 2024 Mistral AI (the file is derived from @mistralai/mistralai 1.5.0 and added by debian/patches/0001); debian/* is Expat. The full Expat text is present and Apache-2.0 points to /usr/share/common-licenses/Apache-2.0. No other holder or licence appears anywhere in the tree, there is no non-free wording, no vendored third-party source, and the two licences are compatible. The scan's only candidate, mistral-fim.ts, is exactly the file its Apache-2.0 stanza names.
Packaging
Careful packaging: compat 14 with dh-sequence-nodejs, a two-package split into /usr/share/nodejs/monacopilot and /usr/share/nodejs/@monacopilot/core with matching Depends, a DEP-3 patch, autopkgtest, salsa CI, upstream metadata and a consistent orig/debian tarball pair. All build dependencies exist in unstable (node-esbuild via esbuild 0.28.2, node-rollup-plugin-dts 6.5.1, node-typescript 6.0.3, rollup 3.30.0, node-monaco-editor 0.47.0+ds-1), Standards-Version 4.7.4 is current, and skipping the upstream vitest suite is justified since vitest is not packaged. What remains is minor: an inaccurate sentence in one long description, an over-tight monaco-editor upper bound that contradicts the package's own comment, and the missing Multi-Arch: foreign on the two arch:all packages.
Issues
minor packaging 1. node-monaco-editor (<< 0.53) is tighter than the breakage the package itself documents (0.57) ◂
- Files:
debian/control:10,debian/control:42,debian/build.sh:17 - Basis: checked, in the package or with a reference tool
- Evidence: Build-Depends and node-monacopilot's Depends both carry
node-monaco-editor (<< 0.53); debian/build.sh:17 saysmonaco 0.57 dropped InlineCompletionsProvider.freeInlineCompletions, which the sources use. - Problem: One of the two is wrong. If the bound is a slip for 0.57, both packages become uninstallable when node-monaco-editor moves to 0.53 although the API they use survives, and because node-monacopilot Depends on it that update would have to wait or drop the package. If 0.53 is the real limit, the comment gives the wrong reason and the incompatibility is undocumented.
- Fix: Set the bound to the first version that actually breaks (0.57 according to the package's own note) or drop it, and say why it is there.
minor packaging 2. node-monacopilot-core's description promises the request cache and text truncation, which live in node-monacopilot ◂
- Files:
debian/control:30,packages/core/src/index.ts,packages/monacopilot/src/classes/cache.ts,packages/monacopilot/src/utils/text.ts - Basis: checked, in the package or with a reference tool
- Evidence:
It also holds the small helpers the editor-facing half reuses, such as text truncation and the request cache. - Problem: packages/core/src/index.ts exports only Copilot, logger, the DEFAULT_* constants, llm/base and the types; there is no cache anywhere under packages/core/src,
truncateTextToMaxLinesis in packages/monacopilot/src/utils/text.ts and CompletionCache in packages/monacopilot/src/classes/cache.ts. Someone choosing between the two packages is told that core contains code it does not. - Fix: Describe what core really provides (the Copilot base class, the provider handler, logger and defaults) and move the helpers sentence to node-monacopilot or drop it.
minor packaging 3. Both Architecture: all packages omit Multi-Arch: foreign ◂
- Files:
debian/control:23,debian/control:38 - Basis: inferred from what was read, not seen directly
- Evidence: Both binary stanzas say
Architecture: alland neither has a Multi-Arch field. - Problem: Policy 5.6.34.2 says architecture-independent packages are not implicitly treated as Multi-Arch: foreign, and the JavaScript team marks its arch:all modules that way (rollup, node-typescript, node-rollup-plugin-dts, node-fetch and node-magic-string all declare Multi-Arch: foreign). Without it, node-monacopilot-core cannot satisfy a dependency from a package being built for another architecture, so a cross-build of anything that build-depends on these modules fails.
- Fix: Add
Multi-Arch: foreignto both binary package stanzas.
Verified ◂
- Read every file under debian/: control, rules, changelog, copyright, clean, gbp.conf, build.sh, README.Debian, rollup.dts.cjs, tsconfig.core.json, tsconfig.monacopilot.json, salsa-ci.yml, source/format, source/lintian-overrides, tests/pkg-js/{test,require-name,api.test.js}, upstream/metadata, patches/series and patches/0001-local-mistral-fim-types.patch.
- debian/copyright is machine-readable:
Format: https://www.debian.org/doc/packaging-manuals/copyright-format/1.0/, stanzas Files: * (Expat, 2024 Arshad Yaseen), packages/core/src/types/mistral-fim.ts (Apache-2.0, 2026 Emfox Zhou / 2024 Mistral AI) and debian/* (Expat); the Expat text is reproduced in full and Apache-2.0 points at /usr/share/common-licenses/Apache-2.0. - Scan item packages/core/src/types/mistral-fim.ts: this is the file created by debian/patches/0001, derived from @mistralai/mistralai 1.5.0, and its own header says
Derived from @mistralai/mistralai 1.5.0, Copyright 2024 Mistral AI, Apache-2.0. The Files stanza for that exact path names Mistral AI and Apache-2.0, so the holder is not missing. - Inventoried the upstream tree (63 files, excluding .pc/ and debian/): all TypeScript, Markdown, JSON and YAML; no built, minified or generated artefacts, no PDFs, no vendored third-party tree. The only non-relative imports are monaco-editor (types only) and vitest in the test files. LICENSE is the Expat/MIT text that Files: * states; package.json 'license' fields agree.
- Searched the tree for restrictive wording (non-commercial, no derivative, research/evaluation only, JSON 'evil', public domain, all rights reserved) and for GPL/LGPL/MPL/CC notices: no matches beyond the Apache-2.0 header above. pnpm-lock.yaml is a lock file (metadata), covered by Files: *.
- Every Files-Excluded entry (docs, playground, .github, scripts, .husky, bump.config.ts, CODE_OF_CONDUCT.md, CONTRIBUTING.md) is genuinely absent: the orig tarball (top-level directory arshad-yaseen-monacopilot-6c00011) contains only the files present in the tree, so no excluded file is shipped.
- Build dependencies resolve: node-esbuild is provided by esbuild 0.28.2-1, node-rollup-plugin-dts 6.5.1-1, node-typescript 6.0.3-2, rollup 3.30.0-7, and node-monaco-editor 0.47.0+ds-1 satisfies both >= 0.41.0 and << 0.53. python3 is used by build.sh.
- build.sh is coherent: the tsconfig outDir/rootDir values are relative to debian/ and land in debian/build-result, which is what the script copies; debian/clean removes debian/build-result and node_modules; the monacopilot declarations resolve @monacopilot/core through the symlink to core's already-built package.json.
- Patch 0001 has DEP-3 headers (Description, Origin: vendor, Forwarded: not-needed), switches llm.ts to the local type file, and the source-level lintian override for superfluous-file-pattern matches the comment that lintian does not apply patches.
- At compat 14 dh_gencontrol adds relationship substvars itself, so node-monacopilot-core's lone
Depends: ${misc:Depends}is complete; the empty override_dh_auto_test is correct because dh skips that target under nocheck at compat >= 13. - Autopkgtest: Testsuite autopkgtest-pkg-nodejs plus debian/tests/pkg-js/{test,require-name,api.test.js}, which load both installed CJS modules and exercise argument validation. The upstream vitest suite is not run, and no binary named vitest or node-vitest exists in the package lists or the NEW queue.
- uscan found upstream releases with
debian/watch; a newer upstream version is available (upstream1.3.1, packaged1.1.15+ds), which is not a fault of the package. - Every pointer of
debian/copyrightto /usr/share/common-licenses names a file that is there (Apache-2.0).
Not confirmed ◂
- File modes could not be read with the available tools; debian/tests/pkg-js/test is invoked by the pkg-js runner with /bin/sh, so executability would not matter.
- The ITP number #1152051 and the changelog date in debian/changelog were not checked against the BTS.
- node-monaco-editor is not installed on the reviewing system, so its 0.47 type definitions were not inspected; the sources are taken to type-check against them (upstream's devDependency is ^0.52), and no build failure is claimed.
Proposed changes ◂
None.
Uploader's response to the LLM review
The uploader rejected this upload in response to the review.
Review Information
rejected — allocated to dfsg-uploader 10 days ago, started 10 days ago, completed 10 days ago.
Final Comment
The uploader rejected this upload in response to the automated (LLM) review of it, so that they can fix the problems it found and upload again.
Other Reviews of this Package
| Version | Hash | Allocated | Completed | Reviewer | Status | Details |
|---|---|---|---|---|---|---|
| 1.1.15+ds-1 | 53115a1f… | 2026-10-28 14:05 | 2026-10-28 14:05 | dfsg-uploader | rejected | VIEW |
| 1.1.15+ds-1 | 16f1fae6… | 2026-10-28 17:52 | 2026-10-28 17:52 | dfsg-uploader | rejected | VIEW |
| 1.1.15+ds-1 | 709aa0cc… | 2026-10-29 10:01 | 2026-10-29 10:02 | mechtilde | accepted | VIEW |