/wbLicense — Live Demo ()
This is what /wbLicense actually does on wb-labs as the workspace stands today (2026-05-05). The matrix below mirrors the exhaustive simulation, but every cell is filled from the live state of the repo.
1. Live target
| Field | Live value |
|---|---|
| Target package | core2/packages/wb-core |
| Current license | Proprietary (header referencing "WBC Inc.") |
| Tier | Enterprise — copyleft dependencies are hard-blocked |
| Source files in scope | 18 .js files under src/ |
| Header status | 12 files have outdated headers (old entity name), 6 have no header |
2. What each argument resolves to today
| Argument | Live resolution |
|---|---|
/wbLicense packages/wb-core -a | Audits wb-core's node_modules. Scans ~180 transitive deps. |
/wbLicense packages/wb-core/src/WBC.js | Checks/injects header on a single file. |
/wbLicense apps/* -a | Cross-app compliance sweep: demo, md, wbc-ui. |
/wbLicense packages/wb-core/src/*.js -i="proprietary" | Mass header injection across all source files. |
3. Per-flag behavior, applied live
| Flag | If invoked now |
|---|---|
/wbLicense packages/wb-core -a | Scans 180 deps. Reports compliance status per dependency. |
/wbLicense src/*.js -i="proprietary" | Updates 12 stale headers, injects 6 new ones. |
/wbLicense src/*.js -i="proprietary" -d | Dry-run: previews all changes without writing. |
/wbLicense packages/wb-core -g | Creates/updates LICENSE and NOTICE files at package root. |
4. Pipelines
/wbLicense Live Execution Simulator
Compliance audit before release
/wbLicense packages/wb-core -a> /wbLicense packages/wb-core -a[SYSTEM] Auditing packages/wb-core dependency tree...
[CRAWL] 180 transitive dependencies resolved.
[REPORT]
| Status | Count | Details |
|---|---|---|
| ✅ Allowed (MIT/Apache/BSD/ISC) | 177 | Clean |
| ⚠️ Review (no license) | 2 | `legacy-helper@0.3.1`, `internal-shim@1.0.0` |
| ❌ Blocked | 1 | `deep-merge-gpl@2.0.0` (GPL-3.0) |
[ALERT]
❌ BLOCKED: `deep-merge-gpl@2.0.0` — GNU GPL v3.
Location: node_modules/deep-merge-gpl/
Required by: wbc-theme-engine@1.2.0 → deep-merge-gpl
⚠️ REVIEW: `legacy-helper@0.3.1` — no license field in package.json.
Risk: Unknown. Contact maintainer or inspect source.
[HALT] Enterprise-tier package. GPL dependency is a compliance violation.
Action: Replace `deep-merge-gpl` with `deepmerge` (MIT) or `lodash.merge`.
💠 Pipeline Compliance audit before release
💠 Pipeline Mass header update
💠 Pipeline Cross-app audit for the full monorepo
5. What would refuse today
| Trigger | Live response |
|---|---|
/wbLicense src/config.json -i="MIT" | ⚠️ Cannot inject comments into JSON format. Skipping. |
/wbLicense packages/wb-core -i="custom" | ❌ Template 'custom' not found. Available: MIT, proprietary, apache. |
/wbLicense packages/wb-core -a -i="MIT" | Allowed. Audit runs first. If audit halts (GPL detected), injection is skipped. Audit is the gate. |
/wbLicense packages/wb-core -a with no node_modules/ | ❌ No node_modules found. Run npm install first. |
The pattern: /wbLicense protects IP by failing closed. Ambiguity escalates to human review. Clear violations halt execution. Header injection is smart about file formats and existing headers. The tier system determines severity — same dependency, different risk level depending on the package's commercial classification.