So I hit download, and I got a .deb file.

Installing a .deb requires root. Okay, a coding agent that wants root access. I know almost no one is good at supply chain security unless it is their core business, 2500 companies hacked this week for using LiteLLM, etc. So I look around for source code links and come up empty.

So, I am supposed to just give a random binary on a website that may or may not be malware depending on what NPM dependencies are in play, and give it root access, and trust whatever unknown CI/CD system that builds it to be able to execute any commands on my system with root privileges, and I am not even allowed to review the code?

That is an amount of trust I would not even extend to family, and you are asking for it from every single user.

So I asked a local LLM to decompile it for me, the 198 dependencies, and license compliance.

From here I could have it write an extensive test suite, delete the code, have LLM re-write the code to pass all the tests, then open source the result myself.

I am probably not actually going to do this, but anyone could. Proprietary software is no longer a moat, and for something like this it just makes your software very hard to trust. Clean room code laundering is so easy now you might as well open source it yourself.