Review: node-monacopilot 1.1.15+ds-1

Package Information

Description	provider plumbing behind monacopilot This is the half of monacopilot that knows how to talk to an LLM: it builds the fill-in-the-middle request for a given prompt, sends it, and turns the response back into completion text. It provides the Copilot base class, the provider handler, the logger and the shared defaults. It knows nothing about Monaco and imports no editor code, so it is usable on its own from a script. Node.js is an event-based server-side JavaScript engine.
Maintainer	Debian Javascript Maintainers <pkg-javascript-devel@lists.alioth.debian.org>
Changed By	Emfox Zhou <emfox@debian.org>
Sponsor	emfox@debian.org
Distribution	unstable
Architecture	all
VCS	git: https://salsa.debian.org/js-team/node-monacopilot.git (browse)
Closes	#1152051
Tracker	https://tracker.debian.org/pkg/node-monacopilot
Uploaded	10 days ago

New Package Report

.changes◂

Distribution	unstable
Date	Sun, 25 Oct 2026 20:00:00 +0800
Source	node-monacopilot
Version	1.1.15+ds-1
Changed-By	Emfox Zhou <emfox@debian.org>
Architecture	source all

Changelog◂

node-monacopilot (1.1.15+ds-1) unstable; urgency=medium
 .
   * Initial release. (Closes: #1152051)

.dsc◂

Priority	optional
Component	main
Package-List	node-monacopilot deb javascript optional arch=all node-monacopilot-core deb javascript optional arch=all
Section	javascript

debian/copyright◂

Format: https://www.debian.org/doc/packaging-manuals/copyright-format/1.0/
Upstream-Name: monacopilot
Source: https://github.com/arshad-yaseen/monacopilot
Files-Excluded: docs
 playground
 .github
 scripts
 .husky
 bump.config.ts
 CODE_OF_CONDUCT.md
 CONTRIBUTING.md

Files: *
Copyright: 2024 Arshad Yaseen
License: Expat

Files: packages/core/src/types/mistral-fim.ts
Copyright: 2026 Emfox Zhou <emfox@debian.org>
           2024 Mistral AI
License: Apache-2.0

Files: debian/*
Copyright: 2026 Emfox Zhou <emfox@debian.org>
License: Expat

License: Expat
 Permission is hereby granted, free of charge, to any person obtaining a copy
 of this software and associated documentation files (the "Software"), to deal
 in the Software without restriction, including without limitation the rights
 to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
 copies of the Software, and to permit persons to whom the Software is
 furnished to do so, subject to the following conditions:
 .
 The above copyright notice and this permission notice shall be included in
 all copies or substantial portions of the Software.
 .
 THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
 IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
 FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
 AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
 LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
 OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
 THE SOFTWARE.

License: Apache-2.0
 On Debian systems, the complete text of the Apache License 2.0 can be found
 in /usr/share/common-licenses/Apache-2.0.

DFSG Assistant LLM REVIEW 0 blocker, 0 important, 0 minor

This is an LLM based review using a Debian Inference based workflow. It was not written by a member of the DFSG team and has not been checked by one. It is not a decision on the package: it may be wrong, and it may have missed things.

Reviewed 9 days ago.

Report◂

DFSG NEW review for node-monacopilot version 1.1.15+ds-1

Summary

Licensing is DFSG-compliant and debian/copyright is accurate: Yes
Packaging is of good quality: Yes
Issues: 0 blocker, 0 important, 0 minor
debian/watch: version 5
debian/copyright: machine-readable
Scan before the review: nothing found

Licensing

debian/copyright is in DEP-5 format and complete. The root LICENSE, both package.json files and the whole tree are Expat/MIT held by 2024 Arshad Yaseen; the only exception is packages/core/src/types/mistral-fim.ts, added by debian/patches/0001 and derived from Apache-2.0 @mistralai/mistralai, which has its own stanza naming both 2024 Mistral AI and 2026 Emfox Zhou. Both licences are free and mutually compatible, the Expat text is reproduced and Apache-2.0 is correctly pointed at /usr/share/common-licenses/Apache-2.0. No non-free wording, unattributed third-party code or extra licence file was found anywhere in the tree.

Packaging

The packaging is coherent and complete: dh compat 14 with dh-sequence-nodejs, a documented build (esbuild + tsc + rollup-plugin-dts) replacing upstream's tsup/pnpm flow, a manual install override that puts the two modules in the right /usr/share/nodejs paths, and debian/clean removing every artefact. All Build-Depends exist in the archive, the two arch:all binary packages are split and depend on each other and on node-monaco-editor correctly, the patch has DEP-3 headers, Standards-Version is current, and there is a working autopkgtest. The +ds repack is recorded and the excluded paths are genuinely absent from the orig tarball.

Issues

None.

Verified ◂

Read every file under debian/ in full. debian/copyright is copyright-format 1.0: header with Upstream-Name/Source/Files-Excluded, a Files: * stanza (Expat, 2024 Arshad Yaseen), an override for packages/core/src/types/mistral-fim.ts (Apache-2.0, 2024 Mistral AI and 2026 Emfox Zhou), a debian/* stanza, and stand-alone Expat and Apache-2.0 License paragraphs.
Prescan file packages/core/src/types/mistral-fim.ts:10: the line Derived from @mistralai/mistralai 1.5.0, Copyright 2024 Mistral AI, Apache-2.0. is the header comment of the file added by debian/patches/0001. It is not a missing holder: that file's own Files stanza already names 2024 Mistral AI (with 2026 Emfox Zhou) under Apache-2.0.
Grep of the whole tree (excluding .pc/ and debian/) for Copyright, (C), ©, SPDX-License-Identifier, Licensed under, GNU GPL/LGPL/AGPL, Apache, MPL, BSD, ISC, public domain, All rights reserved and for non-commercial, no-modification, Commons Clause, Good-not-Evil, SSPL, BUSL and CC-BY-NC/ND wording found only the root LICENSE (MIT, 2024 Arshad Yaseen) and the mistral-fim.ts header. No other LICENSE/COPYING/NOTICE/AUTHORS file exists in the tree.
The paths named in Files-Excluded (docs, playground, .github, scripts, .husky, bump.config.ts, CODE_OF_CONDUCT.md, CONTRIBUTING.md) are absent from node-monacopilot_1.1.15+ds.orig.tar.gz, whose contents otherwise match this tree apart from debian/ and the quilt patch; none of them remains in the source.
No built, minified, binary or generated file ships in the source tree: the packages contain only TypeScript sources, tests, package metadata and pnpm-lock.yaml; all JavaScript and declarations are produced at build time by debian/build.sh.
Every Build-Depends resolves in the archive: dh-sequence-nodejs (provided by dh-nodejs 0.17.14), node-esbuild (provided by esbuild 0.28.2-1), node-monaco-editor 0.47.0 (within >= 0.41.0 and << 0.53), node-rollup-plugin-dts 6.5.1, node-typescript 6.0.3, rollup 3.30.0; python3 is used by the package.json pruning heredoc.
Standards-Version 4.7.4 has the first two components of Policy 4.7.4.1, the installed Policy version, so it is current (not an issue of any severity).
The node-monaco-editor upper bound is justified by the source: packages/monacopilot/src/types/monaco.ts:1 imports monaco-editor/esm/vs/editor/editor.api and packages/monacopilot/src/completions-provider.ts:53 implements freeInlineCompletions, which the comment says 0.53 removed; it is the reason both the Build-Depends and the binary Depends carry (<< 0.53).
Build and install flow checked against the installed pkg-js-tools: Sequence/nodejs.pm forces --buildsystem=nodejs, whose configure() only links /usr/share/nodejs into node_modules; clean() removes those links; dh_missing at compat 14 defaults to --fail-missing, but override_dh_auto_install copies straight into the package directories, so debian/tmp stays empty and dh_missing has nothing to report.
debian/build.sh, debian/tsconfig.core.json, debian/tsconfig.monacopilot.json and debian/rollup.dts.cjs agree on paths: tsc emits debian/build-result//types, rollup writes /build/index.d.ts, and esbuild writes /build/index.js and index.mjs; debian/clean removes both debian/build-result/ and node_modules/.
Read debian/tests/pkg-js/test and api.test.js: they link @monacopilot/core and monacopilot from /usr/share/nodejs and check the exported API and argument validation with node --test; they need no network or display.
Changelog, gbp.conf, salsa-ci.yml, upstream/metadata, source/format (3.0 quilt), source/lintian-overrides and the single DEP-3 patch with its series file are consistent with each other and with debian/control.
uscan found upstream releases with debian/watch; a newer upstream version is available (upstream 1.3.1, packaged 1.1.15+ds), which is not a fault of the package.
Every pointer of debian/copyright to /usr/share/common-licenses names a file that is there (Apache-2.0).

Not confirmed ◂

The Vcs-Git/Vcs-Browser repositories and the ITP number #1152051 in debian/changelog could not be fetched or checked from the reviewing system; the fields themselves are well formed.
node-monaco-editor is not installed on the reviewing system, so the exact typing path esm/vs/editor/editor.api used by the shipped .d.ts could not be inspected; the package's documentation of that dependency is consistent with the source and nothing points to a fault.

Proposed changes ◂

None.

Uploader's response to the LLM review

The uploader was emailed about the review 9 days ago.

Review Information

accepted — allocated to mechtilde 9 days ago, started 9 days ago, completed 9 days ago.

Final Comment

Other Reviews of this Package

Version	Hash	Allocated	Completed	Reviewer	Status	Details
1.1.15+ds-1	53115a1f…	2026-10-28 14:05	2026-10-28 14:05	dfsg-uploader	rejected	VIEW
1.1.15+ds-1	16f1fae6…	2026-10-28 17:52	2026-10-28 17:52	dfsg-uploader	rejected	VIEW
1.1.15+ds-1	4ea9d8a4…	2026-10-28 23:31	2026-10-28 23:31	dfsg-uploader	rejected	VIEW

Back to Dashboard | View all reviews for this package