From 600419bed31b199527f908c16fcfe0da94812e20 Mon Sep 17 00:00:00 2001
From: Dmitry Ng <19asdek91@gmail.com>
Date: Sun, 29 Mar 2026 18:48:06 +0300
Subject: [PATCH] feat: add license compliance documentation and reporting
 tools

- Introduce CONTRIBUTING.md for license compliance guidelines for developers.
- Update Dockerfile to generate license reports for frontend and backend dependencies.
- Add scripts for generating license reports and include them in the Docker build process.
- Create README.md and .gitignore files in the licenses directory for better organization.
- Update go.mod and go.sum to use the latest versions of vxcontrol dependencies.

This enhances the project's compliance with licensing requirements and improves dependency management.
---
 CONTRIBUTING.md              | 67 ++++++++++++++++++++++++++++++++++++
 Dockerfile                   | 17 +++++++++
 README.md                    | 26 ++++----------
 backend/go.mod               |  4 +--
 backend/go.sum               |  8 ++---
 licenses/.gitignore          |  5 +++
 licenses/README.md           | 43 +++++++++++++++++++++++
 scripts/generate-licenses.sh | 50 +++++++++++++++++++++++++++
 8 files changed, 195 insertions(+), 25 deletions(-)
 create mode 100644 CONTRIBUTING.md
 create mode 100644 licenses/.gitignore
 create mode 100644 licenses/README.md
 create mode 100755 scripts/generate-licenses.sh

diff --git a/CONTRIBUTING.md b/CONTRIBUTING.md
new file mode 100644
index 00000000..883a2527
--- /dev/null
+++ b/CONTRIBUTING.md
@@ -0,0 +1,67 @@
+# License Compliance Guide
+
+## Overview
+
+PentAGI is **MIT licensed** and all dependencies use MIT-compatible licenses.
+
+## For Developers
+
+### Adding New Dependencies
+
+When adding new dependencies, ensure they use compatible licenses:
+
+#### Approved Licenses
+- MIT
+- Apache-2.0
+- BSD-2-Clause, BSD-3-Clause
+- ISC
+- MPL-2.0 (if used without modification)
+- 0BSD (public domain)
+
+#### Incompatible Licenses
+- GPL, LGPL, AGPL (without special exception)
+- CC-BY-SA (for code, OK for data)
+- Proprietary/Commercial licenses
+
+### Before Merging PR
+
+1. Update dependencies:
+   ```bash
+   cd backend && go mod tidy
+   cd ../frontend && npm install
+   ```
+
+2. Generate license reports:
+   ```bash
+   ./scripts/generate-licenses.sh
+   ```
+   
+   This script automatically collects license information from all dependencies and saves them to the `licenses/` directory. See [licenses/README.md](../licenses/README.md) for details.
+
+3. Scan for issues:
+   ```bash
+   osv-scanner scan --experimental-licenses="MIT,Apache-2.0,BSD-2-Clause,BSD-3-Clause,ISC,MPL-2.0" backend
+   osv-scanner scan --experimental-licenses="MIT,Apache-2.0,BSD-2-Clause,BSD-3-Clause,ISC,MPL-2.0" frontend
+   ```
+
+### License Verification Tools
+
+- **osv-scanner** - Security and license scanning (recommended)
+- **license-checker** - npm license verification
+- **go-licenses** - Go module license extraction (install: `go install github.com/google/go-licenses@latest`)
+- **go list** - Go module inspection
+
+## For Docker Builds
+
+License reports are automatically generated during Docker builds:
+- Backend reports in `/opt/pentagi/licenses/backend/`
+  - `dependencies.txt` - List of all Go modules
+  - `licenses.csv` - Detailed license information (generated by go-licenses)
+- Frontend reports in `/opt/pentagi/licenses/frontend/`
+  - `dependencies.json` - Complete npm dependency tree
+  - `licenses.json` - Detailed license data
+  - `licenses.csv` - License summary
+
+## Questions?
+
+Contact: **info@pentagi.com** or **info@vxcontrol.com**
diff --git a/Dockerfile b/Dockerfile
index ca928c41..6f94453d 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -31,6 +31,12 @@ COPY frontend/ .
 RUN --mount=type=cache,target=/root/.npm \
     npm ci --include=dev
 
+# Generate license report for frontend dependencies
+RUN npm install -g license-checker && \
+    mkdir -p /licenses/frontend && \
+    license-checker --production --json > /licenses/frontend/licenses.json && \
+    license-checker --production --csv > /licenses/frontend/licenses.csv
+
 # Build frontend with optimizations and parallel processing
 RUN npm run build -- \
     --mode production \
@@ -71,6 +77,15 @@ COPY backend/ .
 RUN --mount=type=cache,target=/go/pkg/mod \
     go mod download && go mod verify
 
+# Install go-licenses tool for license extraction
+RUN --mount=type=cache,target=/go/pkg/mod \
+    go install github.com/google/go-licenses@latest
+
+# Generate license reports for backend dependencies
+RUN mkdir -p /licenses/backend && \
+    go list -m all > /licenses/backend/dependencies.txt && \
+    GOROOT=$(go env GOROOT) GOTOOLCHAIN=auto go-licenses csv ./cmd/pentagi > /licenses/backend/licenses.csv 2>/dev/null || true
+
 # Compile main application binary with embedded version metadata
 RUN go build -trimpath \
     -ldflags "\
@@ -137,6 +152,8 @@ COPY --from=api-builder /ctester /opt/pentagi/bin/ctester
 COPY --from=api-builder /ftester /opt/pentagi/bin/ftester
 COPY --from=api-builder /etester /opt/pentagi/bin/etester
 COPY --from=frontend-compiler /app/ui/dist /opt/pentagi/fe
+COPY --from=api-builder /licenses/backend /opt/pentagi/licenses/backend
+COPY --from=frontend-compiler /licenses/frontend /opt/pentagi/licenses/frontend
 
 # Copy provider configuration files
 COPY examples/configs/custom-openai.provider.yml /opt/pentagi/conf/
diff --git a/README.md b/README.md
index fe34c6a2..5defc219 100644
--- a/README.md
+++ b/README.md
@@ -3344,30 +3344,18 @@ This project is made possible thanks to the following research and developments:
 
 ## License
 
-### PentAGI Core License
+**PentAGI** is licensed under the [MIT License](LICENSE).
 
-**PentAGI Core**: Licensed under [MIT License](LICENSE)  
 Copyright (c) 2025 PentAGI Development Team
 
-### VXControl Cloud SDK Integration
+### Third-Party Dependencies
 
-**VXControl Cloud SDK Integration**: This repository integrates [VXControl Cloud SDK](https://github.com/vxcontrol/cloud) under a **special licensing exception** that applies **ONLY** to the official PentAGI project.
+All third-party dependencies use MIT-compatible licenses. See [licenses/](licenses/) directory for detailed license reports.
 
-#### Official PentAGI Project
-- This official repository: `https://github.com/vxcontrol/pentagi`
-- Official releases distributed by VXControl LLC-FZ
-- Code used under direct authorization from VXControl LLC-FZ
+### VXControl Cloud Services
 
-#### ⚠️ Important for Forks and Third-Party Use
+⚠️ **Note:** While the VXControl Cloud SDK code is MIT licensed, accessing **VXControl Cloud Services** (threat intelligence, AI support, premium features) requires a separate License Key and compliance with [Terms of Service](https://github.com/vxcontrol/cloud#license-and-terms).
 
-If you fork this project or create derivative works, the VXControl SDK components are subject to **AGPL-3.0** license terms. You must either:
+The SDK code itself is free to use - service access requires registration.
 
-1. **Remove VXControl SDK integration**
-2. **Open source your entire application** (comply with AGPL-3.0 copyleft terms)
-3. **Obtain a commercial license** from VXControl LLC
-
-#### Commercial Licensing
-
-For commercial use of VXControl Cloud SDK in proprietary applications, contact:
-- **Email**: info@vxcontrol.com  
-- **Subject**: "VXControl Cloud SDK Commercial License"
+For questions contact: **info@pentagi.com** or **info@vxcontrol.com**
diff --git a/backend/go.mod b/backend/go.mod
index 8d445cb3..e60573d4 100644
--- a/backend/go.mod
+++ b/backend/go.mod
@@ -49,8 +49,8 @@ require (
 	github.com/swaggo/gin-swagger v1.3.0
 	github.com/swaggo/swag v1.8.7
 	github.com/vektah/gqlparser/v2 v2.5.19
-	github.com/vxcontrol/cloud v0.0.0-20250927184507-e8b7ea3f9ba1
-	github.com/vxcontrol/graphiti-go-client v0.0.0-20260203202314-a1540b4a652f
+	github.com/vxcontrol/cloud v0.9.0
+	github.com/vxcontrol/graphiti-go-client v0.9.0
 	github.com/vxcontrol/langchaingo v0.1.14-update.5
 	github.com/wasilibs/go-re2 v1.10.0
 	github.com/xeipuuv/gojsonschema v1.2.0
diff --git a/backend/go.sum b/backend/go.sum
index a98135f0..44073481 100644
--- a/backend/go.sum
+++ b/backend/go.sum
@@ -624,10 +624,10 @@ github.com/vmihailenco/tagparser v0.1.2 h1:gnjoVuB/kljJ5wICEEOpx98oXMWPLj22G67Vb
 github.com/vmihailenco/tagparser v0.1.2/go.mod h1:OeAg3pn3UbLjkWt+rN9oFYB6u/cQgqMEUPoW2WPyhdI=
 github.com/vmihailenco/tagparser/v2 v2.0.0 h1:y09buUbR+b5aycVFQs/g70pqKVZNBmxwAhO7/IwNM9g=
 github.com/vmihailenco/tagparser/v2 v2.0.0/go.mod h1:Wri+At7QHww0WTrCBeu4J6bNtoV6mEfg5OIWRZA9qds=
-github.com/vxcontrol/cloud v0.0.0-20250927184507-e8b7ea3f9ba1 h1:qx2SF3lrUBFSMylsk6jMVEI1AWOTIDHTz3ddMQ0ryCw=
-github.com/vxcontrol/cloud v0.0.0-20250927184507-e8b7ea3f9ba1/go.mod h1:AeiQFqiMgJJAXy6FYXtDS2a3P/PMB56iiBNY2vGrZhQ=
-github.com/vxcontrol/graphiti-go-client v0.0.0-20260203202314-a1540b4a652f h1:5RzZ9isUxs51yYrcwop1MeDJMTX3aLAKqYi6taOVpZc=
-github.com/vxcontrol/graphiti-go-client v0.0.0-20260203202314-a1540b4a652f/go.mod h1:6UHL5uqAKp4KAdziva4qgcAxFtBzU05Hm/BAo4NkAuo=
+github.com/vxcontrol/cloud v0.9.0 h1:p7xYTgUctbY8w6YfhugNzvfi3/0EQoZGumMe67keAng=
+github.com/vxcontrol/cloud v0.9.0/go.mod h1:AeiQFqiMgJJAXy6FYXtDS2a3P/PMB56iiBNY2vGrZhQ=
+github.com/vxcontrol/graphiti-go-client v0.9.0 h1:3GxpFmQoHmz/d7/9tyEqD8+S99v2cuqG1UEmrbAFrLU=
+github.com/vxcontrol/graphiti-go-client v0.9.0/go.mod h1:6UHL5uqAKp4KAdziva4qgcAxFtBzU05Hm/BAo4NkAuo=
 github.com/vxcontrol/langchaingo v0.1.14-update.5 h1:QIib3znyGg/YnRSRB3ZMxwwfRE2vy+xZ2gDH6zwj9fk=
 github.com/vxcontrol/langchaingo v0.1.14-update.5/go.mod h1:fJal4XqJsYXRFTbAPJpwcJdztea9+1174fSDYacgctU=
 github.com/wasilibs/go-re2 v1.10.0 h1:vQZEBYZOCA9jdBMmrO4+CvqyCj0x4OomXTJ4a5/urQ0=
diff --git a/licenses/.gitignore b/licenses/.gitignore
new file mode 100644
index 00000000..c1a03555
--- /dev/null
+++ b/licenses/.gitignore
@@ -0,0 +1,5 @@
+backend-dependencies.txt
+backend-licenses.csv
+frontend-dependencies.json
+frontend-licenses.csv
+frontend-licenses.json
diff --git a/licenses/README.md b/licenses/README.md
new file mode 100644
index 00000000..1ebe08ab
--- /dev/null
+++ b/licenses/README.md
@@ -0,0 +1,43 @@
+# Third-Party Licenses
+
+This directory contains license information for all PentAGI dependencies.
+
+## Quick Start
+
+Run the generator script to create/update license reports (run from project root):
+
+```bash
+./scripts/generate-licenses.sh
+```
+
+## Generated Files
+
+### Backend (Go)
+- `backend-dependencies.txt` - Complete list of Go modules
+- `backend-licenses.csv` - Detailed license information (CSV format)
+
+### Frontend (npm)
+- `frontend-dependencies.json` - Complete npm dependency tree (JSON)
+- `frontend-licenses.json` - Detailed license data (JSON)
+- `frontend-licenses.csv` - License data (CSV)
+
+**Note:** 
+- Backend reports require `go-licenses` tool: `go install github.com/google/go-licenses@latest`
+- Frontend reports require `npm ci` in the frontend directory first.
+
+## License
+
+PentAGI is licensed under **MIT License**.
+
+All third-party dependencies use MIT-compatible licenses:
+- MIT, Apache-2.0, BSD-2-Clause, BSD-3-Clause, ISC, MPL-2.0, 0BSD
+
+## Docker Builds
+
+License reports are automatically generated during Docker builds and included in the final image at `/opt/pentagi/licenses/`.
+
+## More Information
+
+- Project License: [../LICENSE](../LICENSE)
+- Legal Notices: [../NOTICE](../NOTICE)
+- Full Documentation: [../README.md](../README.md)
diff --git a/scripts/generate-licenses.sh b/scripts/generate-licenses.sh
new file mode 100755
index 00000000..c25491dd
--- /dev/null
+++ b/scripts/generate-licenses.sh
@@ -0,0 +1,50 @@
+#!/bin/bash
+#
+# Generate license reports for PentAGI dependencies
+#
+
+set -e
+
+cd "$(dirname "$0")/.."
+LICENSES_DIR="./licenses"
+
+mkdir -p "$LICENSES_DIR"
+
+echo "Generating license reports..."
+
+# Backend (Go)
+echo "→ Backend..."
+cd backend
+
+# Generate module list
+go list -m all > "../$LICENSES_DIR/backend-dependencies.txt"
+
+# Generate detailed license report using go-licenses
+if command -v go-licenses &> /dev/null; then
+    echo "  Generating detailed license report with go-licenses..."
+    GOROOT=$(go env GOROOT) GOTOOLCHAIN=auto go-licenses csv ./cmd/pentagi > "../$LICENSES_DIR/backend-licenses.csv" 2>/dev/null || {
+        echo "  go-licenses failed, install it with: go install github.com/google/go-licenses@latest"
+    }
+else
+    echo "  go-licenses not found, install it with: go install github.com/google/go-licenses@latest"
+fi
+
+cd ..
+
+# Frontend (npm)
+echo "→ Frontend..."
+cd frontend
+if [ -d "node_modules" ]; then
+    npm ls --production --json > "../$LICENSES_DIR/frontend-dependencies.json" 2>/dev/null || true
+    
+    if command -v license-checker &> /dev/null; then
+        license-checker --production --json > "../$LICENSES_DIR/frontend-licenses.json" 2>/dev/null || true
+        license-checker --production --csv > "../$LICENSES_DIR/frontend-licenses.csv" 2>/dev/null || true
+    fi
+else
+    echo "  Run 'npm ci' in frontend/ for detailed reports"
+fi
+cd ..
+
+echo "Done! Reports saved in: $LICENSES_DIR/"
+ls -1 "$LICENSES_DIR/" | grep -v -E "(README|gitignore)" | sed 's/^/   - /'