boost-skill-cli 1.0.265__tar.gz → 1.0.267__tar.gz

{boost_skill_cli-1.0.265 → boost_skill_cli-1.0.267}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: boost-skill-cli
-Version: 1.0.265
+Version: 1.0.267
 Summary: boost — Homebrew for AI coding skills
 Author: Jonathan Reyes
 License: GNU GENERAL PUBLIC LICENSE

{boost_skill_cli-1.0.265 → boost_skill_cli-1.0.267}/boost_cli/_version.py

@@ -18,7 +18,7 @@ version_tuple: tuple[int | str, ...]
 commit_id: str | None
 __commit_id__: str | None
 
-__version__ = version = '1.0.265'
-__version_tuple__ = version_tuple = (1, 0, 265)
+__version__ = version = '1.0.267'
+__version_tuple__ = version_tuple = (1, 0, 267)
 
 __commit_id__ = commit_id = None

{boost_skill_cli-1.0.265 → boost_skill_cli-1.0.267}/boost_cli/commands/discovery.py

@@ -16,6 +16,7 @@ import threading
 import time
 import urllib.parse
 from pathlib import Path
+from typing import Any, Dict, List
 
 from .. import cliparse, spin
 from ..core import (
@@ -217,7 +218,8 @@ def cmd_index(argv):
     if not shutil.which("gh"):
         raise BoostError("the GitHub CLI (gh) is required to build the index",
                         hint="brew install gh && gh auth login")
-    items, total = [], 0
+    items: List[dict] = []
+    total = 0
     pages = min((max(1, args.limit) + 99) // 100, 10)  # code search caps at 1000
     for page in range(1, pages + 1):
         spin.progress(page, pages, "searching GitHub for SKILL.md")
@@ -399,7 +401,7 @@ def cmd_recommend(argv):
         raise BoostError("no skills in any tap to recommend from",
                         hint="add registries with `boost tap --defaults`")
     stack = detect_stack(target)
-    agg = {}
+    agg: Dict[str, Dict[str, Any]] = {}
     for kw in stack["keywords"]:
         for e, s in catalog.search(kw, entries):
             rec = agg.setdefault(e["name"], {"entry": e, "score": 0,
@@ -420,10 +422,15 @@ def cmd_recommend(argv):
     if stack["frameworks"]:
         line += " · frameworks: " + ", ".join(stack["frameworks"])
     out.info(out.role("%s  (%s)" % (line, _tilde(target)), "muted"))
-    shown = ranked[:args.limit]
+    shown: List[Dict[str, Any]] = ranked[:args.limit]
     if not shown:
-        shown = [{"entry": e, "score": 0, "because": {"curated"}}
-                 for e in entries if e.get("curated")][:args.limit]
+        # Annotated rather than inlined: an unannotated literal of mixed value
+        # types infers dict[str, object], which then makes every r["entry"][…]
+        # read below an error about indexing `object`.
+        curated: List[Dict[str, Any]] = [
+            {"entry": e, "score": 0, "because": {"curated"}}
+            for e in entries if e.get("curated")]
+        shown = curated[:args.limit]
         if not shown:
             out.info("no recommendations for this stack — try `boost search <keyword>`")
             return 0
@@ -680,7 +687,7 @@ def _browse_tui(curses, entries):
     """Run the curses UI. Returns the list of entries picked for install
     (one or more, via multi-select), or None if the user quit without picking.
     """
-    state = {"picks": None}
+    state: Dict[str, Any] = {"picks": None}
     categories = _tap_categories()
     desc_cache: dict = {}
     loading: set = set()
@@ -889,7 +896,7 @@ def cmd_trending(argv):
                     out.truncate(e["description"], descw))
                    for e in sorted(curated, key=operator.itemgetter("name"))[:args.limit]])
         return 0
-    agg = {}
+    agg: Dict[str, Any] = {}
     for ev in evs:  # most-recent-first, so first ts per subject is the latest
         name = ev.get("subject") or "?"
         rec = agg.setdefault(name, {"count": 0, "last": ev.get("ts", "")})
@@ -951,7 +958,7 @@ def cmd_stats(argv):
         out.kv("sha256", str(lock.get("sha256", ""))[:12])
         if size is not None:
             out.kv("size", util.human_size(size))
-    else:
+    elif cat:   # no lock means the guard above found a catalog entry
         out.kv("version", cat["version"])
         out.kv("tap", cat["tap"])
         out.kv("description", cat["description"])

{boost_skill_cli-1.0.265 → boost_skill_cli-1.0.267}/boost_cli/commands/info.py

@@ -14,6 +14,7 @@ import sys
 import textwrap
 import webbrowser
 from pathlib import Path
+from typing import Dict, List
 
 from .. import cliparse
 from ..core import (
@@ -126,8 +127,8 @@ def _kind_table(heading, items, extra=None):
     ``(column, key)`` pair for a per-kind column (e.g. a workflow's slot); the
     count line reuses the heading's trailing noun (`installed rules` -> `rule`)."""
     out.heading(heading)
-    headers = ("NAME", "VERSION", "TAP", "AGENTS")
-    rows = []
+    headers: tuple = ("NAME", "VERSION", "TAP", "AGENTS")  # `extra` adds a 5th
+    rows: List[tuple] = []   # 4 columns, or 5 when `extra` adds one
     for name in sorted(items):
         e = items[name]
         row = [name, e.get("version", "?"), e.get("tap", "?"),
@@ -179,7 +180,7 @@ def cmd_list(argv):
         return 0
     if skills:
         out.heading("installed skills")
-        rows = []
+        rows: List[tuple] = []   # 5 columns here, 4 for project skills below
         for name in sorted(skills):
             e = skills[name]
             # Aurora-tinted flags — now that table() aligns by visible width,
@@ -227,7 +228,8 @@ def cmd_info(argv):
     if lock:
         matches = catalog.find(name)
         same_tap = [e for e in matches if e["tap"] == lock.get("tap")]
-        cat = (same_tap or matches or [None])[0]
+        candidates = same_tap or matches
+        cat = candidates[0] if candidates else None
     else:
         cat = catalog.resolve_one(name)   # raises if unknown anywhere
 
@@ -245,7 +247,7 @@ def cmd_info(argv):
         except BoostError:
             skill_dir = None
     desc = str((cat or {}).get("description") or "")
-    meta = {}
+    meta: dict = {}
     skill_text = ""
     if skill_dir and (skill_dir / "SKILL.md").exists():
         skill_text = _read(skill_dir / "SKILL.md")
@@ -308,11 +310,11 @@ def cmd_info(argv):
             out.kv("latest", out.role(latest, "warn", bold=True)
                    + out.role("  (update available)", "muted"))
     else:
-        out.kv("latest", str(cat.get("version", "?")))
-    out.kv("tap", (lock or cat).get("tap", "?"))
+        out.kv("latest", str((cat or {}).get("version", "?")))
+    out.kv("tap", (lock or cat or {}).get("tap", "?"))
     if lock and sdir.is_dir():
         out.kv("store", _tilde(sdir))
-    src = lock.get("source_dir") if lock else cat.get("rel_dir")
+    src = lock.get("source_dir") if lock else (cat or {}).get("rel_dir")
     if src:
         out.kv("source", _tilde(src))
     if lock:
@@ -343,7 +345,9 @@ def cmd_info(argv):
         # A skill that needs an MCP server is useless without it, so this belongs
         # next to capabilities: both answer "what does this expect of my setup?"
         out.kv("mcp servers", ", ".join(r["name"] for r in mcp_servers))
-    if score is not None:
+    # All three are set together under `if skill_dir` above; naming that here
+    # states the invariant instead of leaving it for a reader to reconstruct.
+    if score is not None and size is not None and files is not None:
         out.kv("quality", "%d/100" % score)
         out.kv("size", util.human_size(size))
         out.kv("files", str(files))
@@ -715,7 +719,9 @@ def cmd_deps(argv):
             out.info("  conflicts: %s %s" % (c_name, state))
         return 1 if problems else 0
 
-    unmet, pairs, seen = [], [], set()
+    unmet: List[dict] = []
+    pairs: List[list] = []   # JSON-dumped, so lists rather than tuples
+    seen: set = set()
     for name in sorted(inst):
         meta = _skill_meta(name) or {}
         unmet.extend(
@@ -769,7 +775,7 @@ def cmd_tag(argv):
     mods = operands[1:]
 
     if args.list_all:
-        mapping = {}
+        mapping: Dict[str, List[str]] = {}
         for name, e in sorted(lockfile.installed().items()):
             for t in e.get("tags") or []:
                 mapping.setdefault(t, []).append(name)

{boost_skill_cli-1.0.265 → boost_skill_cli-1.0.267}/boost_cli/commands/quality.py

@@ -15,7 +15,7 @@ from contextlib import suppress
 from datetime import datetime, timedelta, timezone
 from itertools import starmap
 from pathlib import Path
-from typing import List, Optional, Tuple
+from typing import Any, Dict, List, Optional, Tuple
 
 from .. import cliparse
 from ..core import (
@@ -431,7 +431,7 @@ def cmd_lint(argv):
             out.info("nothing to lint")
         return 0
 
-    results = []
+    results: List[Dict[str, Any]] = []
     for name, sdir in targets:
         score, notes = util.score_skill(sdir)
         meta, _ = _read_skill(sdir)
@@ -679,8 +679,8 @@ def cmd_conflict(argv):
     args = ap.parse_args(argv)
 
     installed = _iter_installed()
-    rules = []   # (skill, line, polarity, stem set)
-    declared = []
+    rules: List[Tuple[str, str, str, set]] = []   # skill, line, polarity, stems
+    declared: List[Tuple[str, str]] = []           # skill, conflicting skill
     installed_names = {n for n, _e in installed}
     for name, _entry in installed:
         meta, body = _read_skill(store.skill_store_dir(name))
@@ -705,12 +705,16 @@ def cmd_conflict(argv):
             if stem:
                 rules.append((name, raw.strip(), polarity, stem))
 
-    pairs, seen = [], set()
+    pairs: List[Dict[str, str]] = []
+    seen: set = set()   # holds both key shapes below, declared and heuristic
     for da, db in declared:
-        key = (*tuple(sorted((da, db))), "declared")
-        if key in seen:
+        # Two different key SHAPES share `seen` — a flat triple here, a pair of
+        # (skill, line) pairs below. Distinct names because reusing one made the
+        # second `sorted()` type-check against the first one's element type.
+        dkey = (*tuple(sorted((da, db))), "declared")
+        if dkey in seen:
             continue
-        seen.add(key)
+        seen.add(dkey)
         pairs.append({"kind": "declared", "a": da, "b": db,
                       "a_line": "frontmatter declares conflicts: %s" % db,
                       "b_line": ""})
@@ -720,10 +724,10 @@ def cmd_conflict(argv):
                 continue
             small = min(len(a_stem), len(b_stem))
             if small and len(a_stem & b_stem) / small >= _CONFLICT_OVERLAP:
-                key = tuple(sorted(((a_skill, a_line), (b_skill, b_line))))
-                if key in seen:
+                hkey = tuple(sorted(((a_skill, a_line), (b_skill, b_line))))
+                if hkey in seen:
                     continue
-                seen.add(key)
+                seen.add(hkey)
                 pairs.append({"kind": "heuristic", "a": a_skill, "b": b_skill,
                               "a_line": a_line, "b_line": b_line})
 

{boost_skill_cli-1.0.265 → boost_skill_cli-1.0.267}/boost_cli/commands/safety.py

@@ -12,6 +12,7 @@ import json
 import re
 import time
 from contextlib import suppress
+from typing import Any, Dict, List
 
 from .. import cliparse
 from ..core import (
@@ -299,7 +300,7 @@ def cmd_verify(argv):
                             hint="see what is with `boost list`")
     user_names = [n for n in (args.names or []) if n in lockfile.installed()]
 
-    results = []
+    results: List[Dict[str, Any]] = []
     for name, entry in _iter_installed(user_names or (None if not args.names else [])):
         missing_fields = [f for f in ("version", "tap", "sha256", "installed_at")
                           if not entry.get(f)]
@@ -381,13 +382,13 @@ def cmd_quarantine(argv):
 
     if args.list_mode:
         rows = []
-        for name, entry in _iter_installed():
-            if not entry.get("quarantined"):
+        for name, rec in _iter_installed():
+            if not rec.get("quarantined"):
                 continue
             evs = journal.events(action="quarantine", subject=name)
             since = util.rel_time(evs[0].get("ts", "")) if evs else "?"
-            rows.append((name, entry.get("version", "?"),
-                         entry.get("tap", "?"), since))
+            rows.append((name, rec.get("version", "?"),
+                         rec.get("tap", "?"), since))
         if not rows:
             out.info("no skills in quarantine")
             return 0

{boost_skill_cli-1.0.265 → boost_skill_cli-1.0.267}/boost_skill_cli.egg-info/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: boost-skill-cli
-Version: 1.0.265
+Version: 1.0.267
 Summary: boost — Homebrew for AI coding skills
 Author: Jonathan Reyes
 License: GNU GENERAL PUBLIC LICENSE

{boost_skill_cli-1.0.265 → boost_skill_cli-1.0.267}/boost_skill_cli.egg-info/SOURCES.txt

@@ -333,6 +333,7 @@ scripts/build_command_reference.py
 scripts/build_registries.py
 scripts/build_roadmap.py
 scripts/check_anchors.py
+scripts/check_licenses.py
 scripts/check_required_checks.py
 scripts/ensure_eval_corpus.sh
 scripts/eval_explain.py
@@ -426,6 +427,7 @@ tests/unit/test_ai.py
 tests/unit/test_capabilities.py
 tests/unit/test_catalog.py
 tests/unit/test_check_anchors.py
+tests/unit/test_check_licenses.py
 tests/unit/test_claude_settings.py
 tests/unit/test_cliparse.py
 tests/unit/test_command_reference_fresh.py

{boost_skill_cli-1.0.265 → boost_skill_cli-1.0.267}/pyproject.toml

@@ -177,6 +177,15 @@ files = ["boost_cli"]
 module = "boost_cli._version"
 ignore_missing_imports = true
 
+# Every cmd_* function takes a bare `argv`, and mypy's default mode skips the
+# BODY of any function with an untyped parameter — so the required "zero mypy
+# errors" gate was checking almost none of the CLI's dispatch logic. This turns
+# body checking on for the command layer without demanding annotated signatures
+# (76 of them), which would be churn for no extra checking.
+[[tool.mypy.overrides]]
+module = "boost_cli.commands.*"
+check_untyped_defs = true
+
 [tool.pytest.ini_options]
 testpaths = ["tests"]
 addopts = "-q -p no:cacheprovider"

{boost_skill_cli-1.0.265 → boost_skill_cli-1.0.267}/requirements/release-tools.in

@@ -15,3 +15,7 @@ twine
 check-wheel-contents
 pyroma
 pip-audit
+# SPDX license compliance of a resolved closure (licenses.yml). Pinned for the
+# same reason as the rest: a verdict that changes on an upstream release of the
+# scanner is a verdict about the scanner, not about the dependencies.
+pip-licenses

{boost_skill_cli-1.0.265 → boost_skill_cli-1.0.267}/requirements/release-tools.txt

@@ -483,6 +483,10 @@ pip-audit==2.10.1 \
     --hash=sha256:1eb4565d19ebe5d48996f4b770b4d2b32887e12cb12cfa637f1a064011b55ffc \
     --hash=sha256:99ef3f600a317c1945f1e89e227ef26e1c2d618429b8bd3fa6f4f7c440c4611a
     # via -r requirements/release-tools.in
+pip-licenses==5.5.5 \
+    --hash=sha256:60750c006adf7a0910347b726e8ee9fee3bc8d2e7c8307a5c4ec0776c8e2a276 \
+    --hash=sha256:f4c4c6d9e6a03612cf59f29f19dc8ab54904d82e055b8e191498f2279a224e14
+    # via -r requirements/release-tools.in
 pip-requirements-parser==32.0.1 \
     --hash=sha256:4659bc2a667783e7a15d190f6fccf8b2486685b6dba4c19c3876314769c57526 \
     --hash=sha256:b4fa3a7a0be38243123cf9d1f3518da10c51bdb165a2b2985566247f9155a7d3
@@ -491,6 +495,10 @@ platformdirs==4.11.0 \
     --hash=sha256:0555d18370482847566ffabcaa53ad7c6c1c29f195989ae1ed634a05f76ea1e0 \
     --hash=sha256:360ccded2b7fce0af0ff80cc8f5942a1c5d99b0e856033acb030bfc634709e74
     # via pip-audit
+prettytable==3.18.0 \
+    --hash=sha256:439217116152244369caf3d9f1caf2f9fe29b03bd79e88d2928c8e718c95d680 \
+    --hash=sha256:b3346e0e6f79180833aebaac088ae926340586cf6d7d991b9eb125b65f72313a
+    # via pip-licenses
 py-serializable==2.1.0 \
     --hash=sha256:9d5db56154a867a9b897c0163b33a793c804c80cee984116d02d49e4578fc103 \
     --hash=sha256:b56d5d686b5a03ba4f4db5e769dc32336e142fc3bd4d68a8c25579ebb0a67304
@@ -767,6 +775,10 @@ urllib3==2.7.0 \
     #   id
     #   requests
     #   twine
+wcwidth==0.8.2 \
+    --hash=sha256:91fbef97204b96a3d4d421609b80340b760cf33e26da123ff243d76b1fda8dda \
+    --hash=sha256:d63947694a0539a1d51e01eda7caf800c291020e6cdd7e28ad7b14dd33ad4f85
+    # via prettytable
 wheel-filename==1.4.2 \
     --hash=sha256:3fa599046443d4ca830d06e3d180cd0a675d5871af0a68daa5623318bb4d17e3 \
     --hash=sha256:87891c465dcbb40b40394a906f01a93214bdd51aa5d25e3a9a59cae62bc298fd

boost_skill_cli-1.0.267/scripts/check_licenses.py

@@ -0,0 +1,108 @@
+#!/usr/bin/env python3
+"""Fail when a resolved dependency's licence is incompatible with GPL-3.0.
+
+`pip-audit` gates known CVEs; nothing gated licence *terms*. boost's shipped
+runtime is stdlib-only, so the exposure is entirely in the opt-in extras —
+`[eval]` alone resolves to 94 packages, including the pinned langchain stack —
+and none of them had ever been checked against the project's own GPL-3.0.
+
+Reads ``pip-licenses --format=json`` (stdin, or a path) rather than shelling out,
+so the check is a pure function of its input and can be unit-tested without a
+resolved environment.
+
+Why not ``pip-licenses --fail-on``: it compares the declared licence string
+exactly, and that string is not a well-formed identifier. Real values observed
+in boost's own `[eval]` closure:
+
+    ragas      -> "UNKNOWN"                     (no licence metadata at all)
+    tiktoken   -> "MIT License\\n\\nCopyright (c) 2022 OpenAI, …"  (the whole text)
+    sqlite-vec -> "MIT License, Apache License, Version 2.0"       (two, comma-joined)
+
+so matching is done here by regex over the whole field instead.
+
+Usage:
+    pip-licenses --format=json | python3 scripts/check_licenses.py
+    python3 scripts/check_licenses.py licenses.json
+"""
+from __future__ import annotations
+
+import json
+import re
+import sys
+from typing import List, Tuple
+
+# (pattern, why). Matched case-insensitively against the whole declared licence
+# string. Deliberately short: the aim is high-confidence incompatibility, not a
+# taxonomy. LGPL, MPL and EPL are all fine to *consume* from a GPL-3.0 project
+# and are not listed.
+DENIED: Tuple[Tuple[str, str], ...] = (
+    (r"affero|\bagpl\b",
+     "AGPL adds network-use copyleft that GPL-3.0 does not carry"),
+    # GPLv2-*only* cannot be combined with GPL-3.0. "v2 or later" / "GPLv2+"
+    # can (it permits taking v3), so both spellings are excluded explicitly.
+    (r"gplv2(?!\+)|gpl-2\.0(?!-or-later)|general public license v2 \(",
+     "GPLv2-only is incompatible with GPL-3.0"),
+    (r"proprietary|all rights reserved|\bsspl\b|commons clause|\bbusl\b",
+     "not an open-source licence"),
+)
+
+# Packages whose *metadata* omits a licence even though the project has one.
+# Each needs the upstream licence named, so the exception is auditable rather
+# than a silence. Anything undeclared and unlisted fails.
+UNDECLARED_OK = {
+    # https://github.com/explodinggradients/ragas — Apache-2.0 in the repo;
+    # the published wheel carries no License field or classifier.
+    "ragas": "Apache-2.0 upstream; wheel metadata omits it",
+}
+
+_UNDECLARED = re.compile(r"^\s*(unknown|none|)\s*$", re.IGNORECASE)
+
+
+def is_undeclared(licence: str) -> bool:
+    """True when the package declared no licence at all."""
+    return bool(_UNDECLARED.match(licence or ""))
+
+
+def violations(rows: List[dict]) -> List[str]:
+    """Human-readable problems in a ``pip-licenses --format=json`` payload."""
+    problems = []
+    for row in rows:
+        name = str(row.get("Name", "?"))
+        licence = str(row.get("License", ""))
+        if is_undeclared(licence):
+            if name.lower() not in UNDECLARED_OK:
+                problems.append(
+                    "%s declares no licence — add it to UNDECLARED_OK with the "
+                    "upstream licence, or drop the dependency" % name)
+            continue
+        for pattern, why in DENIED:
+            if re.search(pattern, licence, re.IGNORECASE):
+                problems.append("%s: %s (%s)" % (
+                    name, why, licence.splitlines()[0][:60]))
+                break
+    return problems
+
+
+def main(argv: List[str]) -> int:
+    raw = (open(argv[0], encoding="utf-8").read() if argv
+           else sys.stdin.read())
+    try:
+        rows = json.loads(raw)
+    except ValueError as e:
+        print("::error::could not parse pip-licenses JSON: %s" % e)
+        return 2
+    if not isinstance(rows, list) or not rows:
+        # An empty scan is not a pass: it means the environment was never
+        # populated, which is how a licence gate quietly stops gating.
+        print("::error::no packages in the licence report — nothing was scanned")
+        return 2
+
+    problems = violations(rows)
+    for p in problems:
+        print("::error::%s" % p)
+    print("checked %d package(s): %d problem(s)" % (len(rows), len(problems)))
+    return 1 if problems else 0
+
+
+if __name__ == "__main__":
+    sys.exit(main(sys.argv[1:]))

{boost_skill_cli-1.0.265 → boost_skill_cli-1.0.267}/tests/functional/test_cli_discovery.py

@@ -986,6 +986,17 @@ class TestStats:
         assert "Sync commits and PRs to Jira tickets" in r.out
         assert "0 installs · 0 updates · 0 uninstalls" in r.out
 
+    def test_installed_but_no_longer_in_any_tap(self, boost, installed):
+        # The asymmetric case: `lock` exists, `cat` is None. cmd_stats guards
+        # "neither" and then relies on that guard two screens later — enabling
+        # check_untyped_defs on the command layer is what surfaced the reliance,
+        # so it gets a test rather than an implicit invariant.
+        boost("untap", "fixture-tap", "--force")
+        r = boost("stats", "brainstorming")
+        assert "1.4.0" in r.out              # version from the lock
+        assert "not installed" not in r.out
+        assert "0 installs" in r.out or "installs" in r.out
+
     def test_unknown(self, boost, tapped):
         r = boost("stats", "nope", expect=1)
         assert "no skill named 'nope' installed or in any tap" in r.err

boost_skill_cli-1.0.267/tests/unit/test_check_licenses.py

@@ -0,0 +1,163 @@
+"""Unit tests: scripts/check_licenses.py — the SPDX compatibility gate.
+
+Driven against the licence strings dependencies *actually* publish, not against
+tidy identifiers. Every awkward value below was observed in boost's own
+resolved closures, which is the whole reason the check matches by regex instead
+of using ``pip-licenses --fail-on``.
+"""
+from __future__ import annotations
+
+import importlib.util
+import json
+from pathlib import Path
+
+import pytest
+
+SCRIPT = Path(__file__).resolve().parents[2] / "scripts" / "check_licenses.py"
+
+# Verbatim from `pip-licenses --format=json` over `pip install .[eval]`.
+TIKTOKEN = ("MIT License\n\nCopyright (c) 2022 OpenAI, Shantanu Jain\n\n"
+            "Permission is hereby granted, free of charge, …")
+SQLITE_VEC = "MIT License, Apache License, Version 2.0"
+
+
+@pytest.fixture(scope="module")
+def mod():
+    spec = importlib.util.spec_from_file_location("check_licenses", SCRIPT)
+    m = importlib.util.module_from_spec(spec)
+    assert spec.loader is not None
+    spec.loader.exec_module(m)
+    return m
+
+
+def rows(*pairs):
+    return [{"Name": n, "Version": "1.0", "License": lic} for n, lic in pairs]
+
+
+class TestPermissiveLicencesPass:
+    @pytest.mark.parametrize("licence", [
+        "MIT", "MIT License", "BSD License", "BSD-3-Clause", "Apache-2.0",
+        "Apache Software License", "Python Software Foundation License",
+        "PSF-2.0", "MIT-CMU", "Apache-2.0 OR BSD-2-Clause",
+        "BSD-3-Clause AND 0BSD AND MIT AND Zlib AND CC0-1.0",
+        "MPL-2.0 AND (Apache-2.0 OR MIT)",
+        "Mozilla Public License 2.0 (MPL 2.0)",
+        SQLITE_VEC, TIKTOKEN,
+    ])
+    def test_no_violation(self, mod, licence):
+        assert mod.violations(rows(("pkg", licence))) == []
+
+    def test_lgpl_and_mpl_are_fine_to_consume(self, mod):
+        # Weak copyleft is not a problem for a GPL-3.0 project, and banning it
+        # would fail builds for no reason.
+        assert mod.violations(rows(
+            ("a", "GNU Lesser General Public License v3 (LGPLv3)"),
+            ("b", "GNU Lesser General Public License v2 or later (LGPLv2+)"),
+            ("c", "Mozilla Public License 2.0 (MPL 2.0)"),
+            ("d", "Eclipse Public License 2.0"))) == []
+
+    def test_gplv3_and_gplv2_or_later_pass(self, mod):
+        # GPL-3.0 is the project's own licence; "v2 or later" permits taking
+        # v3, so both combine cleanly. Only v2-*only* does not.
+        assert mod.violations(rows(
+            ("a", "GNU General Public License v3 (GPLv3)"),
+            ("b", "GNU General Public License v2 or later (GPLv2+)"),
+            ("c", "GPL-2.0-or-later"))) == []
+
+
+class TestIncompatibleLicencesFail:
+    @pytest.mark.parametrize("licence", [
+        "GNU Affero General Public License v3",
+        "AGPL-3.0", "AGPL-3.0-only", "agpl-3.0-or-later",
+    ])
+    def test_agpl(self, mod, licence):
+        [problem] = mod.violations(rows(("pkg", licence)))
+        assert "network-use copyleft" in problem
+        assert problem.startswith("pkg: ")
+
+    @pytest.mark.parametrize("licence", [
+        "GNU General Public License v2 (GPLv2)", "GPL-2.0", "GPL-2.0-only",
+    ])
+    def test_gplv2_only(self, mod, licence):
+        [problem] = mod.violations(rows(("pkg", licence)))
+        assert "GPLv2-only" in problem
+
+    @pytest.mark.parametrize("licence", [
+        "Other/Proprietary License", "Proprietary", "All Rights Reserved",
+        "SSPL-1.0", "BUSL-1.1", "MIT with Commons Clause",
+    ])
+    def test_non_open_source(self, mod, licence):
+        [problem] = mod.violations(rows(("pkg", licence)))
+        assert "not an open-source licence" in problem
+
+    def test_a_multi_line_licence_reports_only_its_first_line(self, mod):
+        # A whole licence text in the failure message would bury the finding.
+        [problem] = mod.violations(rows(
+            ("pkg", "Other/Proprietary License\n\nblah\n" * 40)))
+        assert "\n" not in problem
+        assert len(problem) < 200
+
+    def test_every_offender_is_reported_not_just_the_first(self, mod):
+        problems = mod.violations(rows(("a", "AGPL-3.0"), ("b", "MIT"),
+                                       ("c", "Other/Proprietary License")))
+        assert len(problems) == 2
+        assert problems[0].startswith("a: ") and problems[1].startswith("c: ")
+
+    def test_a_package_is_reported_once_even_if_it_trips_twice(self, mod):
+        [problem] = mod.violations(rows(("pkg", "AGPL-3.0 AND Proprietary")))
+        assert problem.startswith("pkg: ")
+
+
+class TestUndeclaredLicences:
+    @pytest.mark.parametrize("licence", ["UNKNOWN", "unknown", "", "  ", "None"])
+    def test_recognised_as_undeclared(self, mod, licence):
+        assert mod.is_undeclared(licence) is True
+
+    @pytest.mark.parametrize("licence", ["MIT", "Unknown Software License"])
+    def test_not_undeclared(self, mod, licence):
+        assert mod.is_undeclared(licence) is False
+
+    def test_an_undeclared_package_fails_by_default(self, mod):
+        [problem] = mod.violations(rows(("mystery", "UNKNOWN")))
+        assert "declares no licence" in problem
+
+    def test_the_documented_exception_passes(self, mod):
+        # ragas is Apache-2.0 upstream; its wheel carries no License field.
+        assert mod.violations(rows(("ragas", "UNKNOWN"))) == []
+        assert "ragas" in mod.UNDECLARED_OK
+
+    def test_every_exception_names_the_upstream_licence(self, mod):
+        # An allowlist entry with no reason is indistinguishable from silence.
+        for pkg, reason in mod.UNDECLARED_OK.items():
+            assert reason.strip(), pkg
+            assert pkg == pkg.lower(), "keys are matched lowercased"
+
+
+class TestMain:
+    def test_a_clean_report_exits_zero(self, mod, tmp_path, capsys):
+        p = tmp_path / "l.json"
+        p.write_text(json.dumps(rows(("a", "MIT"))), encoding="utf-8")
+        assert mod.main([str(p)]) == 0
+        assert "1 package(s): 0 problem(s)" in capsys.readouterr().out
+
+    def test_a_violation_exits_one_with_an_annotation(self, mod, tmp_path,
+                                                      capsys):
+        p = tmp_path / "l.json"
+        p.write_text(json.dumps(rows(("a", "AGPL-3.0"))), encoding="utf-8")
+        assert mod.main([str(p)]) == 1
+        assert "::error::a: AGPL" in capsys.readouterr().out
+
+    def test_an_empty_report_is_a_failure_not_a_pass(self, mod, tmp_path,
+                                                     capsys):
+        # This is how a licence gate quietly stops gating: the environment was
+        # never populated, every package passes, the step goes green.
+        p = tmp_path / "l.json"
+        p.write_text("[]", encoding="utf-8")
+        assert mod.main([str(p)]) == 2
+        assert "nothing was scanned" in capsys.readouterr().out
+
+    def test_unparseable_input_is_a_failure(self, mod, tmp_path, capsys):
+        p = tmp_path / "l.json"
+        p.write_text("not json", encoding="utf-8")
+        assert mod.main([str(p)]) == 2
+        assert "could not parse" in capsys.readouterr().out