From e07d121f7a362c8da19f50cd87e02d43cf102a59 Mon Sep 17 00:00:00 2001
From: Joob1n <Joob1n@outlook.com>
Date: Tue, 18 Aug 2026 22:54:48 +0800
Subject: [PATCH] fix(release): carry DISCLAIMER-WIP in the npm CLI tarball
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Apache Incubator policy requires podling releases to carry the
incubating disclaimer, and #3141 wired it into every desktop artifact —
but the npm CLI publication chain landed on main in parallel, so the
next CLI tarball would have shipped without it. The staging copy step
now places DISCLAIMER-WIP next to LICENSE/NOTICE, the npm files
whitelist and the staging/packed-files assertions require it, the
installed-package smoke checks it end to end, and the CLI package
validation workflow triggers on changes to the disclaimer itself.

Reported by @hqhq1025 in the #3141 post-merge review.

Generated-by: Claude Code
Claude-Session: https://claude.ai/code/session_014ajaRxC4jydavY9nYUFj5J
---
 .github/workflows/cli-package-validation.yml | 2 ++
 scripts/release-cli-package.mjs              | 6 ++++++
 scripts/smoke-release-cli-package.mjs        | 3 +++
 3 files changed, 11 insertions(+)

diff --git a/.github/workflows/cli-package-validation.yml b/.github/workflows/cli-package-validation.yml
index 6eae6d16f0..ae25fed517 100644
--- a/.github/workflows/cli-package-validation.yml
+++ b/.github/workflows/cli-package-validation.yml
@@ -10,6 +10,7 @@ on:
       - '.npmrc'
       - 'LICENSE'
       - 'NOTICE'
+      - 'DISCLAIMER-WIP'
       - 'package.json'
       - 'package-lock.json'
       - 'patches/**'
@@ -38,6 +39,7 @@ on:
       - '.npmrc'
       - 'LICENSE'
       - 'NOTICE'
+      - 'DISCLAIMER-WIP'
       - 'package.json'
       - 'package-lock.json'
       - 'patches/**'
diff --git a/scripts/release-cli-package.mjs b/scripts/release-cli-package.mjs
index 26fa2a710b..88bec20310 100644
--- a/scripts/release-cli-package.mjs
+++ b/scripts/release-cli-package.mjs
@@ -446,6 +446,9 @@ function copyReleaseDocuments() {
   copyFileSync(join(cliSource, 'README.zh-CN.md'), join(stageRoot, 'README.zh-CN.md'));
   copyFileSync(join(repoRoot, 'LICENSE'), join(stageRoot, 'LICENSE'));
   copyFileSync(join(repoRoot, 'NOTICE'), join(stageRoot, 'NOTICE'));
+  // Incubator policy: podling releases carry the incubating disclaimer, kept
+  // next to LICENSE/NOTICE. The npm tarball is a release like the installers.
+  copyFileSync(join(repoRoot, 'DISCLAIMER-WIP'), join(stageRoot, 'DISCLAIMER-WIP'));
   copyFileSync(
     join(cliSource, 'THIRD_PARTY_NOTICES.txt'),
     join(stageRoot, 'THIRD_PARTY_NOTICES.txt'),
@@ -497,6 +500,7 @@ function writeReleaseManifest(cli, publishable) {
       'README.zh-CN.md',
       'LICENSE',
       'NOTICE',
+      'DISCLAIMER-WIP',
       'THIRD_PARTY_NOTICES.txt',
     ],
     dependencies,
@@ -510,6 +514,7 @@ function validateStaging() {
   const required = [
     'dist/cli.js',
     'README.zh-CN.md',
+    'DISCLAIMER-WIP',
     'node_modules/@maka/runtime/dist/workers/filesystem-worker.js',
     'node_modules/@maka/runtime-host/dist/execution-candidate-main.js',
     'packages/eval/dist/harbor-external-subject.js',
@@ -603,6 +608,7 @@ function validatePackedFiles(files, expectedDependencyManifests) {
   }
   const requiredPacked = [
     'dist/cli.js',
+    'DISCLAIMER-WIP',
     'node_modules/@maka/runtime/dist/workers/filesystem-worker.js',
     'node_modules/@maka/runtime-host/dist/execution-candidate-main.js',
     'packages/eval/harbor/relay_agent.py',
diff --git a/scripts/smoke-release-cli-package.mjs b/scripts/smoke-release-cli-package.mjs
index 5d3d03112b..5ddb489c32 100644
--- a/scripts/smoke-release-cli-package.mjs
+++ b/scripts/smoke-release-cli-package.mjs
@@ -213,6 +213,9 @@ function validateReleaseArtifact(path) {
 
 function validateInstalledRuntimeFiles(packageRoot) {
   for (const path of [
+    // Incubator policy: the installed package carries the incubating
+    // disclaimer next to LICENSE/NOTICE, like every other Maka release.
+    'DISCLAIMER-WIP',
     'node_modules/@maka/runtime/dist/workers/filesystem-worker.js',
     'node_modules/@maka/runtime-host/dist/execution-candidate-main.js',
     'node_modules/@maka/eval/dist/index.js',