morluto/rea

Fork 0

mirror of https://github.com/morluto/rea.git synced 2026-11-05 06:45:22 +00:00

[PR #2082] [MERGED] docs: clarify responsible use and preserve third-party notices #5012

New issue

Closed

opened 2026-10-31 00:57:59 +00:00 by bsakaguchi · 0 comments

bsakaguchi commented

2026-10-31 00:57:59 +00:00

Owner

📋 Pull Request Information

Original PR: https://github.com/morluto/rea/pull/2082
Author: @N0zoM1z0
Created: 10/12/2026
Status: ✅ Merged
Merged: 10/12/2026
Merged by: @N0zoM1z0

Base: main ← Head: feat/responsible-use-20261012

📝 Commits (2)

479a0e1 docs: clarify responsible use and preserve third-party notices
c921c6e chore: sync main test fixes before CI

📊 Changes

38 files changed (+14310 additions, -7 deletions)

View changed files

📝 DISCLAIMER.md (+123 -5)
📝 README.md (+18 -1)
📝 README_ar.md (+16 -0)
📝 README_de.md (+16 -0)
📝 README_es.md (+16 -0)
📝 README_fa.md (+16 -0)
📝 README_fr.md (+16 -0)
📝 README_id.md (+16 -0)
📝 README_it.md (+16 -0)
📝 README_ja.md (+16 -0)
📝 README_ko.md (+16 -0)
📝 README_pl.md (+16 -0)
📝 README_pt-BR.md (+16 -0)
📝 README_ru.md (+16 -0)
📝 README_th.md (+16 -0)
📝 README_tr.md (+16 -0)
📝 README_uk.md (+16 -0)
📝 README_vi.md (+16 -0)
📝 README_zh-TW.md (+11 -0)
📝 README_zh.md (+11 -0)

...and 18 more files

📄 Description

Summary

Published npm packages currently omit the DISCLAIMER.md linked by the README, and the License section does not explain third-party or commercial-tool rights. Ship the statement and preserved licensing records, clarify responsibility across versions and distribution channels, and credit the upstream projects behind REA's integrations.

Problem and expected behavior

Installing the package should retain its responsible-use statement and third-party notices. Users should be able to distinguish REA's MIT grant from the licenses for Ghidra, JADX, other upstream code, and separately obtained IDA/Hex-Rays, Hopper and JEB tools. Historical versions and alternative distribution channels should not imply project endorsement of illegal activity or retroactively change existing licenses.

This is a maintainer-requested documentation enhancement; there is no separate issue.

Change and scope

Expand the existing disclaimer while preserving main's responsible-use and community support policy; use consistent 80-column prose.
Keep README edits within Disclaimer and License, including the localized entries.
Add a third-party attribution index, a 561-entry locked npm inventory, runtime copyright/license/NOTICE texts, and preserved reference licenses with source URLs and SHA-256 digests.
State that commercial tools require lawful access and appropriate vendor rights, including permitted trials, automation and output sharing.
Include the disclaimer, notices and licenses/ in the npm files list. Installation, lifecycle scripts, setup, CLI/MCP behavior, dependencies and skill instructions are unchanged.

Contract and boundary impact

Semantic owner and earliest changed stage: project documentation and npm publication file inventory.
CLI and MCP/tool-catalog contract: none.
Provider, bridge, target-format, or platform compatibility: none.
Evidence, artifact, provenance, or reconstruction contract: none; licensing records identify their sources and collection limits.
Process execution, authorization, cleanup, or containment impact: none; no added confirmation, acceptance gate or runtime check.
Generated metadata, package, or installation impact: npm includes the documentation and notice texts; generated catalogs, skill content and installation behavior are unchanged.

Evidence and regression coverage

Tests added or updated: none; this change does not alter runtime behavior.
Base evidence: the prior npm publication inventory omitted DISCLAIMER.md; the resulting archive retains the documentation and license files.
User-visible CLI/MCP output: not applicable.
Remaining proof gaps: upstream metadata is not a legal certification. clean-git-ref@2.0.1 and minimisted@2.0.1 omit original copyright documents; the records explicitly identify these gaps. External-engine and Windows-toolchain notice snapshots do not replace the terms of the actual distribution a user obtains.

Validation performed

npm run check — passed typecheck, lint, formatting, unused-code and architecture checks.
npm run docs:check — passed generated metadata and documentation facts checks.
npm run verify:package — passed package installation/update, CLI/MCP, setup/uninstall, repository skill and cleanup verification on Linux.
npm pack --dry-run --json --silent — confirmed all 20 documentation/license files are present in the npm inventory.
Manual assertions — confirmed README changes stay in the two footer sections; package fields outside files and installation/runtime/skill source are unchanged; all lockfile entries are inventoried and preserved upstream texts match their recorded SHA-256 values. Upstream whitespace is retained verbatim in license texts.

Compatibility, safety, and release

Breaking changes or migration steps: none.
Real Hopper/Ghidra, browser, or OS coverage: no new real-provider claims; package workflows ran on Linux. No provider behavior changed.
Package or release metadata impact: documentation files are added to the tarball; version, dependencies, lifecycle scripts and runtime metadata are unchanged.
Security, privacy, process, or containment review: the statement describes lawful use and support boundaries, preserves existing software-license grants, and adds no enforcement or consent flow.

Review checklist

This PR addresses a maintainer-requested documentation enhancement.
The PR has one focused outcome and a Conventional Commit title.
The absence of a separate issue is explained above.
Validation covers the publication change; no runtime regression tests are needed.
Owning documentation and package file inventory are updated; no generated artifacts are committed.
User-visible CLI/MCP changes are not applicable.
The final diff contains no credentials, runtime edits, unrelated cleanup or claims of complete legal certification.

_{🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.}

## 📋 Pull Request Information **Original PR:** https://github.com/morluto/rea/pull/2082 **Author:** [@N0zoM1z0](https://github.com/N0zoM1z0) **Created:** 10/12/2026 **Status:** ✅ Merged **Merged:** 10/12/2026 **Merged by:** [@N0zoM1z0](https://github.com/N0zoM1z0) **Base:** `main` ← **Head:** `feat/responsible-use-20261012` --- ### 📝 Commits (2) - [`479a0e1`](https://github.com/morluto/rea/commit/479a0e1113ed48bf64a65b558751d56fc76b22f2) docs: clarify responsible use and preserve third-party notices - [`c921c6e`](https://github.com/morluto/rea/commit/c921c6e249b4083cdd2a88ce4e641c611ae8b3ff) chore: sync main test fixes before CI ### 📊 Changes **38 files changed** (+14310 additions, -7 deletions) <details> <summary>View changed files</summary> 📝 `DISCLAIMER.md` (+123 -5) 📝 `README.md` (+18 -1) 📝 `README_ar.md` (+16 -0) 📝 `README_de.md` (+16 -0) 📝 `README_es.md` (+16 -0) 📝 `README_fa.md` (+16 -0) 📝 `README_fr.md` (+16 -0) 📝 `README_id.md` (+16 -0) 📝 `README_it.md` (+16 -0) 📝 `README_ja.md` (+16 -0) 📝 `README_ko.md` (+16 -0) 📝 `README_pl.md` (+16 -0) 📝 `README_pt-BR.md` (+16 -0) 📝 `README_ru.md` (+16 -0) 📝 `README_th.md` (+16 -0) 📝 `README_tr.md` (+16 -0) 📝 `README_uk.md` (+16 -0) 📝 `README_vi.md` (+16 -0) 📝 `README_zh-TW.md` (+11 -0) 📝 `README_zh.md` (+11 -0) _...and 18 more files_ </details> ### 📄 Description ## Summary Published npm packages currently omit the `DISCLAIMER.md` linked by the README, and the License section does not explain third-party or commercial-tool rights. Ship the statement and preserved licensing records, clarify responsibility across versions and distribution channels, and credit the upstream projects behind REA's integrations. ## Problem and expected behavior Installing the package should retain its responsible-use statement and third-party notices. Users should be able to distinguish REA's MIT grant from the licenses for Ghidra, JADX, other upstream code, and separately obtained IDA/Hex-Rays, Hopper and JEB tools. Historical versions and alternative distribution channels should not imply project endorsement of illegal activity or retroactively change existing licenses. This is a maintainer-requested documentation enhancement; there is no separate issue. ## Change and scope - Expand the existing disclaimer while preserving main's responsible-use and community support policy; use consistent 80-column prose. - Keep README edits within Disclaimer and License, including the localized entries. - Add a third-party attribution index, a 561-entry locked npm inventory, runtime copyright/license/NOTICE texts, and preserved reference licenses with source URLs and SHA-256 digests. - State that commercial tools require lawful access and appropriate vendor rights, including permitted trials, automation and output sharing. - Include the disclaimer, notices and `licenses/` in the npm `files` list. Installation, lifecycle scripts, setup, CLI/MCP behavior, dependencies and skill instructions are unchanged. ## Contract and boundary impact - Semantic owner and earliest changed stage: project documentation and npm publication file inventory. - CLI and MCP/tool-catalog contract: none. - Provider, bridge, target-format, or platform compatibility: none. - Evidence, artifact, provenance, or reconstruction contract: none; licensing records identify their sources and collection limits. - Process execution, authorization, cleanup, or containment impact: none; no added confirmation, acceptance gate or runtime check. - Generated metadata, package, or installation impact: npm includes the documentation and notice texts; generated catalogs, skill content and installation behavior are unchanged. ## Evidence and regression coverage - Tests added or updated: none; this change does not alter runtime behavior. - Base evidence: the prior npm publication inventory omitted `DISCLAIMER.md`; the resulting archive retains the documentation and license files. - User-visible CLI/MCP output: not applicable. - Remaining proof gaps: upstream metadata is not a legal certification. `clean-git-ref@2.0.1` and `minimisted@2.0.1` omit original copyright documents; the records explicitly identify these gaps. External-engine and Windows-toolchain notice snapshots do not replace the terms of the actual distribution a user obtains. ## Validation performed - `npm run check` — passed typecheck, lint, formatting, unused-code and architecture checks. - `npm run docs:check` — passed generated metadata and documentation facts checks. - `npm run verify:package` — passed package installation/update, CLI/MCP, setup/uninstall, repository skill and cleanup verification on Linux. - `npm pack --dry-run --json --silent` — confirmed all 20 documentation/license files are present in the npm inventory. - Manual assertions — confirmed README changes stay in the two footer sections; package fields outside `files` and installation/runtime/skill source are unchanged; all lockfile entries are inventoried and preserved upstream texts match their recorded SHA-256 values. Upstream whitespace is retained verbatim in license texts. ## Compatibility, safety, and release - Breaking changes or migration steps: none. - Real Hopper/Ghidra, browser, or OS coverage: no new real-provider claims; package workflows ran on Linux. No provider behavior changed. - Package or release metadata impact: documentation files are added to the tarball; version, dependencies, lifecycle scripts and runtime metadata are unchanged. - Security, privacy, process, or containment review: the statement describes lawful use and support boundaries, preserves existing software-license grants, and adds no enforcement or consent flow. ## Review checklist - [x] This PR addresses a maintainer-requested documentation enhancement. - [x] The PR has one focused outcome and a Conventional Commit title. - [x] The absence of a separate issue is explained above. - [x] Validation covers the publication change; no runtime regression tests are needed. - [x] Owning documentation and package file inventory are updated; no generated artifacts are committed. - [x] User-visible CLI/MCP changes are not applicable. - [x] The final diff contains no credentials, runtime edits, unrelated cleanup or claims of complete legal certification. --- <sub>🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.</sub>

bsakaguchi

2026-10-31 00:57:59 +00:00

closed this issue
added the
pull-request
label

bsakaguchi referenced this issue

2026-11-01 21:42:38 +00:00

[PR #5012] [MERGED] docs(setup): clarify prebuild-install warning from optional dependencies (#4881) #6730

No milestone

No project

No assignees

1 participant

Notifications

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference

morluto/rea#5012

No description provided.

Rows
Columns