fix(build): retain multiple license notices for one package

[juliusmarminge]

A package containing code under multiple licenses needs every applicable notice. Package overrides currently support only one generated notice. Accept multiple notices while preserving the existing singular configuration, and reject conflicting notice sources.

This extracts the V2 generator fix without its provider-specific dependency entries. Focused license-generation tests verify both licenses and copyright attributions survive. Scripts typecheck and targeted lint pass. No visual UI change.

Model: GPT-6. Harness: Codex.

---

Summary by CodeRabbit

• New Features

  • Package license notices can now include multiple generated notices in a single combined SPDX expression.
  • Combined notices preserve each package’s attribution and license text.

• Bug Fixes

  • Improved validation rejects conflicting notice configuration options instead of producing ambiguous results.
  • Existing single-notice configurations continue to work as before.

[macroscopeapp]

Approvability

Verdict: Approved at aba72e4

Macroscope's review found this PR approvable — This is a focused build-time license-generation fix that adds an opt-in multi-notice configuration while preserving existing singular configurations. It is self-contained, backward-compatible, and covered by targeted tests, with impact limited to generated license manifests.

^{You can add or adjust custom eligibility rules. Learn more.}

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Team

Run ID: 7115e84a-0179-463b-adf6-dc324690a600

📥 Commits

Reviewing files that changed from the base of the PR and between ccad9f6 and aba72e4.

📒 Files selected for processing (2)

• scripts/lib/third-party-licenses.test.ts
• scripts/lib/third-party-licenses.ts

Included review availability: Your plan provides up to 10 included reviews per hour; 2 remain after this review.

---

📝 Walkthrough

Walkthrough

Package notice overrides now support multiple generated notices. Legacy singular values remain supported through array normalization. Validation rejects conflicting notice sources, and tests cover aggregation and configuration errors.

Changes

Generated Notice Arrays

Layer / File(s)	Summary
Override normalization and validation scripts/lib/third-party-licenses.ts, scripts/lib/third-party-licenses.test.ts	Package overrides accept generatedNotices arrays, normalize legacy generatedNotice values, and reject multiple notice sources.
Notice aggregation and generation scripts/lib/third-party-licenses.ts, scripts/lib/third-party-licenses.test.ts	Notice collection and rendering use generated-notice arrays. Tests verify ordered SPDX text and copyright aggregation.

Priority: ⬇️ Low

Estimated code review effort: 2 (Simple) | ~10 minutes

Change: Bug fix

Merge Risk: ⚪ Minimal · up to aba72

The updated configuration behavior preserves the documented requirement that generated notice arrays contain at least one item. No actionable merge risk remains.

🚥 Pre-merge checks | ✅ 4 | ❌ 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Docstring Coverage	⚠️ Warning	Docstring coverage is 0.00% which is insufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff. Analyzed 3 functions across 2 files.	Write docstrings for the functions missing them to satisfy the coverage threshold.

✅ Passed checks (4 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title clearly states the main change: retaining multiple license notices for one package.
Description check	✅ Passed	The description explains what changed, why it changed, the test coverage, validation results, and that there are no UI changes. It does not use the template headings or include the checklist, but it p…
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

• Fix all pre-merge checks with AI

✨ Finishing Touches 💡 1

📝 Generate docstrings 💡

• Commit to this branch
• Create a new PR

🧪 Generate unit tests (beta)

• Commit to this branch
• Create a new PR

---

_{Comment @coderabbitai help to get the list of available commands.}

[github-actions]

Thread transfer impact

✅ Thread transfer remains within every enforced ceiling.

Provider	Metric	Main baseline	This PR	Impact	PR ceiling
Codex	Total thread wire	13.5 KiB	13.5 KiB	+3 B (+0.0%)	15.1 KiB	✅
Codex	Thread snapshot wire	7.1 KiB	7.1 KiB	+1 B (+0.0%)	7.3 KiB	✅
Codex	Live turn WebSocket wire	6.5 KiB	6.5 KiB	+2 B (+0.0%)	7.8 KiB	✅
Codex	Live turn WebSocket decoded	56.2 KiB	56.3 KiB	+44 B (+0.1%)	66.4 KiB	✅
Codex	Live turn messages	9	10	+1 (+11.1%)	21	✅
Claude	Total thread wire	13.5 KiB	13.5 KiB	+5 B (+0.0%)	15.1 KiB	✅
Claude	Thread snapshot wire	7.1 KiB	7.1 KiB	+2 B (+0.0%)	7.3 KiB	✅
Claude	Live turn WebSocket wire	6.4 KiB	6.4 KiB	+3 B (+0.0%)	7.8 KiB	✅
Claude	Live turn WebSocket decoded	57.0 KiB	57.0 KiB	0 B (0.0%)	66.4 KiB	✅
Claude	Live turn messages	9	9	0 (0.0%)	21	✅

Baseline: ccad9f6 · PR result: aba72e4 · Source CI: success

Scenario and decoded snapshot size

10 historical turns, 5 command tools per turn, 878.9 KiB retained MCP result per historical turn, and a 1.05 MiB retained result in the measured turn.

• Codex decoded thread snapshot: 114.0 KiB
• Claude decoded thread snapshot: 114.7 KiB

Updated in place by a trusted workflow. PR artifacts are strictly validated and never executed.