License report

Know what licenses you ship before legal asks: one read-only agent per package ecosystem lists every dependency's license, then one agent flags anything that needs a human decision.

warning

This report is an inventory, not legal advice. Agents can misread a license file or miss a dual license. Send anything flagged to whoever owns licensing for your company.

One agent per ecosystem

From a terminal in the repo's workspace, start one agent for each package manager the repo uses:

beswarm agent start --name lic-npm --agent claude --group licenses --no-focus \
  --prompt "Read-only. Using package.json and the lockfile, list every production dependency, direct and transitive, with version and license. Read the license from the package itself, not just the registry metadata. Write a table to reports/licenses/npm.md."
beswarm agent start --name lic-py --agent codex --group licenses --no-focus \
  --prompt "Read-only. Same task for the Python dependencies in pyproject.toml and its lockfile. Write to reports/licenses/python.md."

Don't let agents install anything to answer the question. Lockfiles and the packages already on disk are enough.

Flag what needs a decision

beswarm agent wait lic-npm --until done,blocked --timeout 1800
beswarm agent wait lic-py --until done,blocked --timeout 1800
 
beswarm agent start --name lic-review --agent claude --group licenses \
  --prompt "Read everything in reports/licenses/. Write reports/licenses/summary.md: counts per license, then a flagged list of anything copyleft (GPL, AGPL, LGPL, MPL), unknown, missing, custom or dual-licensed, with the package that pulls it in. Don't decide whether a flagged license is acceptable — just explain why it was flagged." \
  --wait --timeout 1200

Keep it current

Run the same agents from a cron job after dependency upgrades, as in Nightly checks, and diff the new summary against the last one. A new flagged license is the change worth reading.