#3323 Registry: hide extensions with no license from browsing (show-unlicensed toggle for 60 days; search API default unchanged)

Part 1 of 6 of the extension license requirement (#3323–#3328). Plan: Extension license proposal (https://claude.ai/code/artifact/8c256b86-ce33-4898-8b70-223ec3b827f2).

Problem

36 of 1,759 public extensions have no license on their latest version: no LICENSE file and no registry license setting. Their pages and search results give an installer no terms. Seth's decision (2026-10-12): hide unlicensed extensions from browsing now, with a "show unlicensed" option that is removed after 60 days.

Change

• Rescore first. Rescore the 32 public extensions that have never been scored (available: false, reason: not_scored), so none is hidden only because it was never scored. They include @hivemq/1password/item (150k pulls), @stack72/system-extensions (147k), @bixu/launchd (48k) and @stack72/letsencrypt-certificate (33k).
• Transitional rule for "licensed". Until day 60 (#3327), an extension counts as licensed if its latest version declares license: in the manifest or ships a LICENSE file. The registry license setting (Scorecard owner panel) does not count: it is being removed (#3326). Only 2 extensions use it (@evrardjp/openbao-configurator, @jamesakeech/mongodb-datastore, both MIT); check whether they also ship a LICENSE file, and list them if they would be hidden.
• Website listing and search (routes/extensions/index.tsx). Hide unlicensed extensions by default. Add a "show unlicensed" toggle.
• Extension page. It stays reachable by its address, with a "no license declared" banner that tells the owner how to fix it.
• Search API (/api/v1/extensions/search). Add an opt-in licensed=true parameter. The default stays unchanged. swamp's auto-resolver (findExtensionForType) falls back to this search when a model type's name doesn't match its extension. Older CLIs can't send a new parameter, so hiding by default would break their installs.
• Never hide from pull, install, checksum, versions, info or the collective extensions API.

Acceptance

• The listing, the toggle and the banner each behave as above for: licensed by file, licensed by setting, licensed by manifest field, unlicensed, and never-scored-then-rescored.
• The search API's default output is unchanged. licensed=true filters.
• A UAT item covers the listing, the toggle and the banner (swamp-uat Playwright).

Notes

• Before release: Seth to decide on outreach to @hivemq (9 of the 36, including @hivemq/linear with 190,832 pulls; a paying Team collective).
• The toggle comes out at day 60: issue #3327.