Skip to content
Open
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
29 changes: 29 additions & 0 deletions bucket/dyad.json
Original file line number Diff line number Diff line change
@@ -0,0 +1,29 @@
{
"version": "0.32.0",
"description": "Free, local, open-source AI app builder",
"homepage": "https://dyad.sh",
"license": "Apache-2.0",
Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Potential issue | 🟡 Minor

🧩 Analysis chain

🏁 Script executed:

#!/bin/bash
# Check for LICENSE files in the repository
echo "=== Searching for LICENSE files ==="
fd -i "license" -t f | head -20

echo ""
echo "=== Checking repository structure ==="
git ls-files | grep -i license | head -10

echo ""
echo "=== Checking GitHub API for license ==="
curl -s https://api.github.com/repos/dyad-sh/dyad | jq -r '.license.spdx_id // .license'

Repository: ScoopInstaller/Extras

Length of output: 282


🏁 Script executed:

cat LICENSE

Repository: ScoopInstaller/Extras

Length of output: 1298


🌐 Web query:

dyad project license Apache-2.0 github

💡 Result:

The official dyad repo (dyad-sh/dyad) uses Apache‑2.0 for all code outside src/pro; code in src/pro is under the Functional Source License 1.1 (not Apache). [1][2]

Sources:

  • dyad-sh/dyad README/license notes. [1]
  • Example fork showing Apache-2.0 labeling. [2]

The Apache-2.0 license declaration is incomplete.

The dyad project uses a dual license model: Apache-2.0 for code outside src/pro, and Functional Source License 1.1 for code in src/pro. The manifest should either list both licenses or document the mixed license arrangement.

🤖 Prompt for AI Agents
In @bucket/dyad.json at line 5, The package manifest currently lists only
"Apache-2.0"; update the license declaration to reflect the dual-license
arrangement by either replacing the single "license" value with a "licenses"
array that includes both "Apache-2.0" and "FSL-1.1" (or similar identifier for
Functional Source License 1.1), or add a clear "license" string describing the
mixed licensing (e.g., "Apache-2.0 (src/* except src/pro) + FSL-1.1 (src/pro)");
ensure the change is made in the manifest's license field so consumers and
tooling can detect the mixed-license model.

"architecture": {
"64bit": {
"url": "https://github.com/dyad-sh/dyad/releases/download/v0.32.0/dyad-0.32.0-full.nupkg",
"hash": "b200d4a17b67551e029247f37c9082ada05cc9f6a09a07cad7145c9d3e3511a1"
Comment on lines +8 to +9
Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Potential issue | 🟡 Minor

🧩 Analysis chain

🏁 Script executed:

#!/bin/bash
set -e

echo "=== Verifying dyad release artifacts ==="

# Check if .nupkg file exists and verify hash
echo -e "\n1. Downloading and verifying .nupkg file..."
if curl -sL -f "https://github.com/dyad-sh/dyad/releases/download/v0.32.0/dyad-0.32.0-full.nupkg" -o /tmp/dyad.nupkg 2>/dev/null; then
    echo "✓ .nupkg file downloaded successfully"
    actual_hash=$(sha256sum /tmp/dyad.nupkg | awk '{print $1}')
    expected_hash="b200d4a17b67551e029247f37c9082ada05cc9f6a09a07cad7145c9d3e3511a1"
    echo "  Expected: $expected_hash"
    echo "  Actual:   $actual_hash"
    if [ "$actual_hash" = "$expected_hash" ]; then
        echo "  ✓ Hash matches!"
    else
        echo "  ✗ Hash MISMATCH!"
    fi
    
    # Inspect package structure
    echo -e "\n2. Inspecting .nupkg structure (looking for lib/net45 and dyad.exe)..."
    unzip -l /tmp/dyad.nupkg 2>/dev/null | grep -i "lib.*net45\|dyad\.exe" || echo "  No matching files found with those patterns"
    
    echo -e "\n3. Full file listing in .nupkg:"
    unzip -l /tmp/dyad.nupkg 2>/dev/null | head -30
    
    rm /tmp/dyad.nupkg
else
    echo "✗ Failed to download .nupkg file"
fi

# Check if .Setup.exe file exists
echo -e "\n4. Checking if .Setup.exe file exists..."
if curl -sL -I "https://github.com/dyad-sh/dyad/releases/download/v0.32.0/dyad-0.32.0.Setup.exe" 2>/dev/null | head -1 | grep -q "200\|302"; then
    echo "✓ .Setup.exe file exists"
else
    echo "✗ .Setup.exe file not found or not accessible"
fi

Repository: ScoopInstaller/Extras

Length of output: 42409


The .nupkg file is valid and accessible; verify the hash externally.

The .nupkg file successfully downloads and contains the correct structure (lib\net45\dyad.exe present). Using a NuGet package instead of the .Setup.exe is a legitimate approach for Scoop portable installation as it avoids running an installer.

However, the hash b200d4a17b67551e029247f37c9082ada05cc9f6a09a07cad7145c9d3e3511a1 could not be verified in this environment due to tool limitations. Please confirm this hash is correct by verifying it locally:

(Get-FileHash "dyad-0.32.0-full.nupkg" -Algorithm SHA256).Hash

If the hash does not match, update the manifest accordingly.

}
},
"extract_dir": "lib\\net45",
"shortcuts": [
[
"dyad.exe",
"Dyad"
]
],
"checkver": {
"github": "https://github.com/dyad-sh/dyad"
},
"autoupdate": {
"architecture": {
"64bit": {
"url": "https://github.com/dyad-sh/dyad/releases/download/v$version/dyad-$version-full.nupkg"
}
}
}
}