kevchess15/deepseek-harness
1
1
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions 1
deepseek-harness/THIRD_PARTY_NOTICES.md

205 lines
16 KiB
Markdown
Raw Normal View History

docs: generate THIRD_PARTY_NOTICES.md and gate it in doc-sync Replace the hand-written inventory with scripts/gen-third-party-notices.ts, verified fresh by a doc-sync leaf gate. Tier by declaring workspace area rather than manifest section, so test-support runtime declarations stay dev-only and every mountable plugin's dependencies are disclosed as runtime; list the pnpm-patched packages; point the Python closure at uv.lock. Re-record the translation-prompt snapshot the README link invalidated.
2026-07-30 07:27:13 -07:00
<!-- Generated by scripts/gen-third-party-notices.ts — do not edit by hand.
Run `pnpm run gen-third-party-notices` to regenerate. -->
docs: add THIRD_PARTY_NOTICES.md disclosing third-party dependencies List direct dependencies by tier (vendored Cordis sources, runtime npm, dev-only npm, Python SDK, build-time tools) with upstream links and licenses, and link it from the License section of both READMEs.
2026-07-29 21:29:49 -07:00
# Third-Party Notices
Adopt MIT for DSH packages
2026-08-13 01:46:57 +08:00
DeepSeek Harness is licensed under [MIT](LICENSE). It depends on the third-party software listed below. Each project remains under its own license; nothing in this file changes those terms.
docs: add THIRD_PARTY_NOTICES.md disclosing third-party dependencies List direct dependencies by tier (vendored Cordis sources, runtime npm, dev-only npm, Python SDK, build-time tools) with upstream links and licenses, and link it from the License section of both READMEs.
2026-07-29 21:29:49 -07:00
refactor(infra): keep Codex notices direct
2026-08-15 05:26:12 +08:00
This file lists **direct** dependencies declared by the workspace and the explicitly disclosed official Claude Code platform payload closure. It is generated from the workspace manifests by `scripts/gen-third-party-notices.ts`: a pre-commit hook regenerates it whenever a staged file changes one of its inputs, and `scripts/gen-third-party-notices.spec.ts` asserts in the test lane that the committed bytes match. Deleting a manifest runs no hook, so that case is caught by the assertion instead. Run `pnpm run verify-third-party-notices` for the standalone check.
docs: fix notices template claim and close generator omission paths The template still described the removed doc-sync gate; it now states the pre-commit + test-lane mechanism that actually runs. Read the nested native/landlock-run/packages manifests, accept PEP 508 requirements with no version or with a marker, and reject a vendor/README.md table that stops covering a vendored directory instead of dropping it silently. Extend the pre-commit glob to the generator and the build-time pin source; record the deletion trigger gap the test lane backstops.
2026-07-30 09:23:00 -07:00
fix(landlock-run): close release integration gaps (review round 2)
2026-08-06 10:52:46 +08:00
The complete npm transitive closure, including the Landlock launcher workspace, is recorded with exact pinned versions in [`pnpm-lock.yaml`](pnpm-lock.yaml) — inspect it with `pnpm licenses list`. The Python closure is recorded separately in [`python/sdk/uv.lock`](python/sdk/uv.lock).
docs: add THIRD_PARTY_NOTICES.md disclosing third-party dependencies List direct dependencies by tier (vendored Cordis sources, runtime npm, dev-only npm, Python SDK, build-time tools) with upstream links and licenses, and link it from the License section of both READMEs.
2026-07-29 21:29:49 -07:00
## Vendored source (`vendor/`)
build(vendor): rescope the vendored Cordis packages into @deepseek-ai Machine-produced by `pnpm run rescope-vendor --apply` plus the regeneration it prints: `pnpm install` for the lockfile, `pnpm run gen-third-party-notices`, `verify-translation-pairing --write` for the touched bilingual pairs, `gen-doc-graphs`, and one typert snapshot whose ids embed character offsets. `pnpm run rescope-vendor --check` verifies the result. Renames nine vendored packages (cordis, cosmokit, schemastery and the six @cordisjs plugins) and every reference that resolves them: manifest names and dependency keys, module specifiers including declare-module merges, cordis.yml plugin names, tsconfig paths, every Markdown fence, and `docs/` prose. Directory names, upstream versions, and dependency ranges are unchanged, so vendor/README.md still reads as an upstream snapshot; its manifest table gains an upstream-name column so THIRD_PARTY_NOTICES keeps MIT attribution pointed at each fork's origin. The tutorial tier follows the rename end to end: its yaml fences named plugins the Loader can no longer resolve, its `ts ignore-check` fences disagreed with the compiled fences beside them, and its prose quoted both. The contracts that told readers to keep upstream names — the root convention and the vendoring cookbook's tree comment and manifest invariant — now say to rescope instead. Two rules read `@deepseek-ai/` as "another workspace plugin": the client bundle purity gate now names the vendored libraries a browser bundle inlines, and the files where a bare `cordis` is an agent-preset id keep that product data.
2026-08-10 22:04:06 +08:00
The Cordis framework and its foundation libraries are source-vendored into this repository rather than consumed from npm, and republished under the `@deepseek-ai` scope. All are MIT-licensed; each directory preserves its upstream `LICENSE` file. Exact upstream commits and local modifications are recorded in [`vendor/README.md`](vendor/README.md).
| Package | Upstream name | Upstream | License |
| --- | --- | --- | --- |
| `@deepseek-ai/cosmokit` | `cosmokit` | [github.com/deepseek-harness/cosmokit](https://github.com/deepseek-harness/cosmokit) | MIT |
| `@deepseek-ai/schemastery` | `schemastery` | [github.com/deepseek-harness/schemastery](https://github.com/deepseek-harness/schemastery) | MIT |
| `@deepseek-ai/cordis` | `cordis` | [github.com/cordiverse/cordis](https://github.com/cordiverse/cordis) | MIT |
| `@deepseek-ai/cordis-plugin-loader` | `@cordisjs/plugin-loader` | [github.com/cordiverse/cordis](https://github.com/cordiverse/cordis) | MIT |
| `@deepseek-ai/cordis-plugin-include` | `@cordisjs/plugin-include` | [github.com/deepseek-harness/cordis](https://github.com/deepseek-harness/cordis) | MIT |
| `@deepseek-ai/cordis-plugin-group` | `@cordisjs/plugin-group` | [github.com/deepseek-harness/cordis](https://github.com/deepseek-harness/cordis) | MIT |
| `@deepseek-ai/cordis-plugin-timer` | `@cordisjs/plugin-timer` | [github.com/deepseek-harness/cordis](https://github.com/deepseek-harness/cordis) | MIT |
| `@deepseek-ai/cordis-plugin-hmr` | `@cordisjs/plugin-hmr` | [github.com/deepseek-harness/cordis](https://github.com/deepseek-harness/cordis) | MIT |
| `@deepseek-ai/cordis-plugin-logger-console` | `@cordisjs/plugin-logger-console` | [github.com/deepseek-harness/cordis](https://github.com/deepseek-harness/cordis) | MIT |
docs: add THIRD_PARTY_NOTICES.md disclosing third-party dependencies List direct dependencies by tier (vendored Cordis sources, runtime npm, dev-only npm, Python SDK, build-time tools) with upstream links and licenses, and link it from the License section of both READMEs.
2026-07-29 21:29:49 -07:00
## Runtime npm dependencies
cleanup: remove managed source installer
2026-08-10 15:20:52 +08:00
External packages that a workspace package resolves at runtime. The tier covers every plugin a user can mount from `cordis.yml` — not only what the `dsh` CLI, Web UI, and Python SDK runtime load by default.
docs: add THIRD_PARTY_NOTICES.md disclosing third-party dependencies List direct dependencies by tier (vendored Cordis sources, runtime npm, dev-only npm, Python SDK, build-time tools) with upstream links and licenses, and link it from the License section of both READMEs.
2026-07-29 21:29:49 -07:00
| Package | License |
| --- | --- |
| [`@agentclientprotocol/sdk`](https://github.com/agentclientprotocol/typescript-sdk) | Apache-2.0 |
feat(subagent): add Claude Code provider
2026-08-04 20:57:55 +08:00
| [`@anthropic-ai/claude-agent-sdk`](https://github.com/anthropics/claude-agent-sdk-typescript) | SEE LICENSE IN README.md |
| [`@anthropic-ai/sdk`](https://github.com/anthropics/anthropic-sdk-typescript) | MIT |
docs: add THIRD_PARTY_NOTICES.md disclosing third-party dependencies List direct dependencies by tier (vendored Cordis sources, runtime npm, dev-only npm, Python SDK, build-time tools) with upstream links and licenses, and link it from the License section of both READMEs.
2026-07-29 21:29:49 -07:00
| [`@babel/code-frame`](https://github.com/babel/babel) | MIT |
| [`@earendil-works/pi-ai`](https://github.com/earendil-works/pi) | MIT |
| [`@joplin/turndown-plugin-gfm`](https://github.com/laurent22/joplin-turndown-plugin-gfm) | MIT |
fix(typert): satisfy workspace static gates
2026-08-05 23:18:35 +08:00
| [`@jridgewell/gen-mapping`](https://github.com/jridgewell/sourcemaps) | MIT |
docs: add THIRD_PARTY_NOTICES.md disclosing third-party dependencies List direct dependencies by tier (vendored Cordis sources, runtime npm, dev-only npm, Python SDK, build-time tools) with upstream links and licenses, and link it from the License section of both READMEs.
2026-07-29 21:29:49 -07:00
| [`@modelcontextprotocol/sdk`](https://github.com/modelcontextprotocol/typescript-sdk) | MIT |
feat(webworker): browser worker host runtime and the vfs image packer Two private experimental packages run the whole harness tree inside one dedicated Web Worker. dsh-experimental-webworker-runtime owns the in-memory VFS (BigInt stats with per-path identity and strictly increasing mtimes), the CommonJS wrapper loader over a lazily-evaluated builtin table whose shims typecheck against Node's own module types, the postMessage tunnel speaking plain HTTP, the AsyncLocalStorage runtime, and the worker assembly. dsh-experimental-webworker-packer lowers every module body at pack time against the shared wrapper contract, sweeps the profile closure by static reachability, and writes a deterministically gzip-compressed tar the worker inflates through the browser's native DecompressionStream while it downloads.
2026-08-20 19:19:07 +08:00
| [`@noble/hashes`](https://github.com/paulmillr/noble-hashes) | MIT |
feat(webhook): create workspace sessions from GitHub events
2026-08-22 23:44:56 +08:00
| [`@octokit/webhooks`](https://github.com/octokit/webhooks.js) | MIT |
feat(subagent): make Codex provider directly installable
2026-08-15 03:25:43 +08:00
| [`@openai/codex`](https://github.com/openai/codex) | Apache-2.0 |
docs: add THIRD_PARTY_NOTICES.md disclosing third-party dependencies List direct dependencies by tier (vendored Cordis sources, runtime npm, dev-only npm, Python SDK, build-time tools) with upstream links and licenses, and link it from the License section of both READMEs.
2026-07-29 21:29:49 -07:00
| [`@opentelemetry/api`](https://github.com/open-telemetry/opentelemetry-js) | Apache-2.0 |
| [`@opentelemetry/api-logs`](https://github.com/open-telemetry/opentelemetry-js) | Apache-2.0 |
| [`@opentelemetry/exporter-logs-otlp-http`](https://github.com/open-telemetry/opentelemetry-js) | Apache-2.0 |
| [`@opentelemetry/otlp-exporter-base`](https://github.com/open-telemetry/opentelemetry-js) | Apache-2.0 |
| [`@opentelemetry/resources`](https://github.com/open-telemetry/opentelemetry-js) | Apache-2.0 |
| [`@opentelemetry/sdk-logs`](https://github.com/open-telemetry/opentelemetry-js) | Apache-2.0 |
| [`@shikijs/langs`](https://github.com/shikijs/shiki) | MIT |
| [`@standard-schema/spec`](https://github.com/standard-schema/standard-schema) | MIT |
feat(trajectory): virtualize long session histories
2026-08-04 13:57:19 +08:00
| [`@tanstack/react-virtual`](https://github.com/TanStack/virtual) | MIT |
feat: markdown 增量解析
2026-08-06 13:56:43 +08:00
| [`@types/mdast`](https://github.com/DefinitelyTyped/DefinitelyTyped) | MIT |
feat(fs-search): spawn the packaged ripgrep binary through the subprocess seam glob/grep now run the @vscode/ripgrep binary via ctx.subprocess with a plain argv vector: no system rg install, no shell layer, unconditional registration. The load-time command -v rg probe and the bash-seam coupling are removed; timeouts ride the cooperative exec.signal plus the seam's terminate escalation. The fs-glob-sampling ACP snapshot executes the real packaged binary against an mtime-pinned fixture. Adds the packaged-ripgrep-search Agent Note, updates the roster-note facts and both shipped-composition e2es, and regenerates the doc catalogs and third-party notices (surfacing pre-existing manifest drift plus the new @vscode/ripgrep row; the notices generator also learns pnpm 11's truncated virtual-store names).
2026-08-01 18:04:38 +08:00
| [`@vscode/ripgrep`](https://github.com/microsoft/vscode-ripgrep) | MIT |
fix(terminal-bash): handle terminal protocol replies Unix PowerShell emits cursor-position requests while PSReadLine starts and redraws prompts. The subprocess PTY is only a transport, so those requests went unanswered. Startup could then accept the dsh> literal echoed from its setup source as a rendered prompt, and later sends were lost or clipped. Feed raw PTY output into a zero-scrollback @xterm/headless state machine and write generated replies through the provider-owned terminal handle. Drain replies before caller input, repeat foreground inspection when terminal activity races the sample, and retain send ownership until parser and reply work quiesce. Coalesce raw chunks behind one active parser write so large Windows output cannot create thousands of queued parse callbacks. Publish pwsh only from backend stdin_read evidence and start one timeoutMs deadline before the complete startup retry loop, so inferred-idle follow-ups cannot reset the bound. Dispose the emulator when the terminal or cleanup fails. Document the fail-loud ConstrainedLanguage path and add focused coverage for split queries, reply ordering, foreground resampling, failure containment, batching, timeout, and disposal.
2026-08-23 19:24:50 +08:00
| [`@xterm/headless`](https://github.com/xtermjs/xterm.js) | MIT |
feat(webworker): browser worker host runtime and the vfs image packer Two private experimental packages run the whole harness tree inside one dedicated Web Worker. dsh-experimental-webworker-runtime owns the in-memory VFS (BigInt stats with per-path identity and strictly increasing mtimes), the CommonJS wrapper loader over a lazily-evaluated builtin table whose shims typecheck against Node's own module types, the postMessage tunnel speaking plain HTTP, the AsyncLocalStorage runtime, and the worker assembly. dsh-experimental-webworker-packer lowers every module body at pack time against the shared wrapper contract, sweeps the profile closure by static reachability, and writes a deterministically gzip-compressed tar the worker inflates through the browser's native DecompressionStream while it downloads.
2026-08-20 19:19:07 +08:00
| [`@yarnpkg/parsers`](https://github.com/yarnpkg/berry) | BSD-2-Clause |
| [`acorn`](https://github.com/acornjs/acorn) | MIT |
docs: add THIRD_PARTY_NOTICES.md disclosing third-party dependencies List direct dependencies by tier (vendored Cordis sources, runtime npm, dev-only npm, Python SDK, build-time tools) with upstream links and licenses, and link it from the License section of both READMEs.
2026-07-29 21:29:49 -07:00
| [`anser`](https://github.com/IonicaBizau/anser) | MIT |
feat(webworker): browser worker host runtime and the vfs image packer Two private experimental packages run the whole harness tree inside one dedicated Web Worker. dsh-experimental-webworker-runtime owns the in-memory VFS (BigInt stats with per-path identity and strictly increasing mtimes), the CommonJS wrapper loader over a lazily-evaluated builtin table whose shims typecheck against Node's own module types, the postMessage tunnel speaking plain HTTP, the AsyncLocalStorage runtime, and the worker assembly. dsh-experimental-webworker-packer lowers every module body at pack time against the shared wrapper contract, sweeps the profile closure by static reachability, and writes a deterministically gzip-compressed tar the worker inflates through the browser's native DecompressionStream while it downloads.
2026-08-20 19:19:07 +08:00
| [`buffer`](https://github.com/feross/buffer) | MIT |
docs: add THIRD_PARTY_NOTICES.md disclosing third-party dependencies List direct dependencies by tier (vendored Cordis sources, runtime npm, dev-only npm, Python SDK, build-time tools) with upstream links and licenses, and link it from the License section of both READMEs.
2026-07-29 21:29:49 -07:00
| [`chokidar`](https://github.com/paulmillr/chokidar) | MIT |
| [`clsx`](https://github.com/lukeed/clsx) | MIT |
| [`commander`](https://github.com/tj/commander.js) | MIT |
| [`diff`](https://github.com/kpdecker/jsdiff) | BSD-3-Clause |
fix(rebase): migrate the replayed E2B branch onto the rebased parent The linear replay carried old-lineage content over parent-owned files; this checkpoint restores them and adapts the branch to the parent's post-rebase seam: - restore all pty/lsp/subprocess/code-runtime surfaces to the parent's exact content (this branch claims none of them) and drop the net-zero code-runtime-e2b/pty-e2b/lsp-e2b residue and its registrations - widen serializeRemoteEnvironment to the seam's NodeJS.ProcessEnv tombstone contract: an explicit undefined removes an ambient entry - migrate the two E2B fixture Agent stubs to the Inbox-model interface and Session.create - re-apply the branch's gen-doc-graphs roles, THIRD_PARTY_NOTICES e2b row, and packages/README group row (trimmed to the doc budget); regenerate catalogs and re-record bilingual pairings
2026-08-07 21:04:33 +08:00
| [`e2b`](https://github.com/e2b-dev/e2b) | MIT |
docs: add THIRD_PARTY_NOTICES.md disclosing third-party dependencies List direct dependencies by tier (vendored Cordis sources, runtime npm, dev-only npm, Python SDK, build-time tools) with upstream links and licenses, and link it from the License section of both READMEs.
2026-07-29 21:29:49 -07:00
| [`eventsource-parser`](https://github.com/rexxars/eventsource-parser) | MIT |
feat(apiproxy): host session-log download surface Streams one ZIP of the root session artifact plus each subagent descendant verbatim (the persistence readRaw bytes) from GET /api/session.export as a host-only download — no wire envelope, absent from IApiClient. The downloads domain owns the query schema, the fetch handler answers the GET alongside the SSE routes, and compression runs on the host with fflate's streaming Zip API.
2026-08-10 17:47:24 +08:00
| [`fflate`](https://github.com/101arrowz/fflate) | MIT |
docs: add THIRD_PARTY_NOTICES.md disclosing third-party dependencies List direct dependencies by tier (vendored Cordis sources, runtime npm, dev-only npm, Python SDK, build-time tools) with upstream links and licenses, and link it from the License section of both READMEs.
2026-07-29 21:29:49 -07:00
| [`immer`](https://github.com/immerjs/immer) | MIT |
| [`js-yaml`](https://github.com/nodeca/js-yaml) | MIT |
feat(web): render TeX math in Markdown
2026-08-01 00:05:23 -07:00
| [`katex`](https://github.com/KaTeX/KaTeX) | MIT |
docs: add THIRD_PARTY_NOTICES.md disclosing third-party dependencies List direct dependencies by tier (vendored Cordis sources, runtime npm, dev-only npm, Python SDK, build-time tools) with upstream links and licenses, and link it from the License section of both READMEs.
2026-07-29 21:29:49 -07:00
| [`koffi`](https://github.com/Koromix/koffi) | MIT |
| [`mdast-util-from-markdown`](https://github.com/syntax-tree/mdast-util-from-markdown) | MIT |
| [`mdast-util-gfm`](https://github.com/syntax-tree/mdast-util-gfm) | MIT |
feat: markdown 增量解析
2026-08-06 13:56:43 +08:00
| [`mdast-util-math`](https://github.com/syntax-tree/mdast-util-math) | MIT |
fix(web): render CJK-adjacent strong emphasis
2026-08-06 11:17:17 +08:00
| [`micromark-core-commonmark`](https://github.com/micromark/micromark/tree/main/packages/micromark-core-commonmark) | MIT |
docs: add THIRD_PARTY_NOTICES.md disclosing third-party dependencies List direct dependencies by tier (vendored Cordis sources, runtime npm, dev-only npm, Python SDK, build-time tools) with upstream links and licenses, and link it from the License section of both READMEs.
2026-07-29 21:29:49 -07:00
| [`micromark-extension-gfm`](https://github.com/micromark/micromark-extension-gfm) | MIT |
fix(ui): render common TeX math delimiters
2026-08-05 14:08:58 +08:00
| [`micromark-extension-math`](https://github.com/micromark/micromark-extension-math) | MIT |
| [`micromark-factory-space`](https://github.com/micromark/micromark/tree/main/packages/micromark-factory-space) | MIT |
| [`micromark-util-character`](https://github.com/micromark/micromark/tree/main/packages/micromark-util-character) | MIT |
fix(web): render CJK-adjacent strong emphasis
2026-08-06 11:17:17 +08:00
| [`micromark-util-classify-character`](https://github.com/micromark/micromark/tree/main/packages/micromark-util-classify-character) | MIT |
feat: markdown 增量解析
2026-08-06 13:56:43 +08:00
| [`micromark-util-sanitize-uri`](https://github.com/micromark/micromark/tree/main/packages/micromark-util-sanitize-uri) | MIT |
fix(ui): render common TeX math delimiters
2026-08-05 14:08:58 +08:00
| [`micromark-util-symbol`](https://github.com/micromark/micromark/tree/main/packages/micromark-util-symbol) | MIT |
| [`micromark-util-types`](https://github.com/micromark/micromark/tree/main/packages/micromark-util-types) | MIT |
docs: add THIRD_PARTY_NOTICES.md disclosing third-party dependencies List direct dependencies by tier (vendored Cordis sources, runtime npm, dev-only npm, Python SDK, build-time tools) with upstream links and licenses, and link it from the License section of both READMEs.
2026-07-29 21:29:49 -07:00
| [`node-addon-require-builtin`](https://www.npmjs.com/package/node-addon-require-builtin) | MIT |
| [`node-pty`](https://github.com/microsoft/node-pty) | MIT |
feat(web,cli): open the ready Web UI by default
2026-08-14 13:44:36 +08:00
| [`open`](https://github.com/sindresorhus/open) | MIT |
docs: add THIRD_PARTY_NOTICES.md disclosing third-party dependencies List direct dependencies by tier (vendored Cordis sources, runtime npm, dev-only npm, Python SDK, build-time tools) with upstream links and licenses, and link it from the License section of both READMEs.
2026-07-29 21:29:49 -07:00
| [`picomatch`](https://github.com/micromatch/picomatch) | MIT |
| [`react`](https://github.com/facebook/react) | MIT |
| [`react-dom`](https://github.com/facebook/react) | MIT |
feat(webworker): support fs watches and confinement
2026-08-23 20:35:25 +08:00
| [`readable-stream`](https://github.com/nodejs/readable-stream) | MIT |
fix(python-sdk): resolve packaged proxies from real module entries The packaged dsh launcher must expose installation modules to profile-local plugins without writing symlinks into pkg's virtual filesystem. The first review fix selected ESM exports correctly in ordinary Node, but real carrier execution exposed package metadata and VFS behavior that a synthetic tree did not cover: executable and declaration packages have no import entry, legacy main fields rely on Node probing, and pkg's Windows VFS prevents filesystem package-scope resolution from seeing exports such as zod/mini and @google/genai/web. Resolve explicit exports directly from each installed manifest with the maintained resolve.exports package under Node import conditions. Publish only package-local candidate files that exist, reject escaping or malformed targets, preserve the package installation URL without realpath, and keep Node's legacy resolver only for exports-less packages. This avoids pkg filesystem package lookup entirely while retaining fail-loud behavior for broken runtime entries. Add regression coverage for import-only, nested, symlinked, zod-style, and genai-style condition maps; unavailable and types-only entries; invalid and escaping targets; executable/declaration packages; extensionless main; and legacy index fallback. profile.ts remains at 100% statements, branches, functions, and lines. Update the bilingual package and Agent Note contracts, replace the runtime dependency and generated notice, and regenerate the lockfile through pnpm.
2026-08-23 19:59:49 +08:00
| [`resolve.exports`](https://github.com/lukeed/resolve.exports) | MIT |
Merge remote-tracking branch 'origin/master' into worktree/web-multimodal-image-input # Conflicts: # packages/client/runtime/README.i18n.yaml # packages/client/ui-conversation/README.i18n.yaml # packages/client/ui-conversation/README.md # packages/client/ui-conversation/README.zh.md # packages/client/ui-conversation/src/client/chat/MessageItem.tsx
2026-07-31 18:18:07 +08:00
| [`sharp`](https://github.com/lovell/sharp) | Apache-2.0 |
docs: add THIRD_PARTY_NOTICES.md disclosing third-party dependencies List direct dependencies by tier (vendored Cordis sources, runtime npm, dev-only npm, Python SDK, build-time tools) with upstream links and licenses, and link it from the License section of both READMEs.
2026-07-29 21:29:49 -07:00
| [`shiki`](https://github.com/shikijs/shiki) | MIT |
| [`supports-color`](https://github.com/chalk/supports-color) | MIT |
| [`tsx`](https://github.com/privatenumber/tsx) | MIT |
| [`turndown`](https://github.com/mixmark-io/turndown) | MIT |
| [`typescript`](https://github.com/microsoft/TypeScript) | Apache-2.0 |
| [`use-sync-external-store`](https://github.com/facebook/react) | MIT |
docs: refresh third-party notices
2026-08-04 16:25:49 +08:00
| [`ws`](https://github.com/websockets/ws) | MIT |
docs: add THIRD_PARTY_NOTICES.md disclosing third-party dependencies List direct dependencies by tier (vendored Cordis sources, runtime npm, dev-only npm, Python SDK, build-time tools) with upstream links and licenses, and link it from the License section of both READMEs.
2026-07-29 21:29:49 -07:00
| [`yaml`](https://github.com/eemeli/yaml) | ISC |
| [`zod`](https://github.com/colinhacks/zod) | MIT |
| [`zustand`](https://github.com/pmndrs/zustand) | MIT |
docs: generate THIRD_PARTY_NOTICES.md and gate it in doc-sync Replace the hand-written inventory with scripts/gen-third-party-notices.ts, verified fresh by a doc-sync leaf gate. Tier by declaring workspace area rather than manifest section, so test-support runtime declarations stay dev-only and every mountable plugin's dependencies are disclosed as runtime; list the pnpm-patched packages; point the Python closure at uv.lock. Re-record the translation-prompt snapshot the README link invalidated.
2026-07-30 07:27:13 -07:00
pnpm applies local patches to the following packages at install time, so shipped artifacts carry modified copies; each patch file is the complete record of the modification:
docs: update node-pty patch notice
2026-08-13 18:02:39 +08:00
- `node-pty@1.2.0-beta.15` — [`patches/node-pty@1.2.0-beta.15.patch`](patches/node-pty@1.2.0-beta.15.patch)
docs: generate THIRD_PARTY_NOTICES.md and gate it in doc-sync Replace the hand-written inventory with scripts/gen-third-party-notices.ts, verified fresh by a doc-sync leaf gate. Tier by declaring workspace area rather than manifest section, so test-support runtime declarations stay dev-only and every mountable plugin's dependencies are disclosed as runtime; list the pnpm-patched packages; point the Python closure at uv.lock. Re-record the translation-prompt snapshot the README link invalidated.
2026-07-30 07:27:13 -07:00
feat(subagent): add Claude Code provider
2026-08-04 20:57:55 +08:00
## Official Claude Code platform payloads
The project owner authorizes distribution of every version of the official `@anthropic-ai/claude-agent-sdk` package and the official Claude Code CLI/platform payloads that each version declares through `optionalDependencies`. This identity-scoped authorization does not classify their declared terms as permissive and does not cover any unrelated runtime package; version, declared-license, and payload-set changes still require the ordinary dependency, lockfile, compatibility, terms, and notices review.
The installed SDK 0.3.220 declares the following optional platform packages. Each carries the official Claude Code 2.1.220 executable; the package identities and versions come from the SDK manifest, while the declared license field is verified against the platform payload installed for the current host.
| Optional platform package | Version | Declared license |
| --- | --- | --- |
| [`@anthropic-ai/claude-agent-sdk-darwin-arm64`](https://www.npmjs.com/package/@anthropic-ai/claude-agent-sdk-darwin-arm64) | 0.3.220 | SEE LICENSE IN LICENSE.md |
| [`@anthropic-ai/claude-agent-sdk-darwin-x64`](https://www.npmjs.com/package/@anthropic-ai/claude-agent-sdk-darwin-x64) | 0.3.220 | SEE LICENSE IN LICENSE.md |
| [`@anthropic-ai/claude-agent-sdk-linux-arm64`](https://www.npmjs.com/package/@anthropic-ai/claude-agent-sdk-linux-arm64) | 0.3.220 | SEE LICENSE IN LICENSE.md |
| [`@anthropic-ai/claude-agent-sdk-linux-arm64-musl`](https://www.npmjs.com/package/@anthropic-ai/claude-agent-sdk-linux-arm64-musl) | 0.3.220 | SEE LICENSE IN LICENSE.md |
| [`@anthropic-ai/claude-agent-sdk-linux-x64`](https://www.npmjs.com/package/@anthropic-ai/claude-agent-sdk-linux-x64) | 0.3.220 | SEE LICENSE IN LICENSE.md |
| [`@anthropic-ai/claude-agent-sdk-linux-x64-musl`](https://www.npmjs.com/package/@anthropic-ai/claude-agent-sdk-linux-x64-musl) | 0.3.220 | SEE LICENSE IN LICENSE.md |
| [`@anthropic-ai/claude-agent-sdk-win32-arm64`](https://www.npmjs.com/package/@anthropic-ai/claude-agent-sdk-win32-arm64) | 0.3.220 | SEE LICENSE IN LICENSE.md |
| [`@anthropic-ai/claude-agent-sdk-win32-x64`](https://www.npmjs.com/package/@anthropic-ai/claude-agent-sdk-win32-x64) | 0.3.220 | SEE LICENSE IN LICENSE.md |
docs: add THIRD_PARTY_NOTICES.md disclosing third-party dependencies List direct dependencies by tier (vendored Cordis sources, runtime npm, dev-only npm, Python SDK, build-time tools) with upstream links and licenses, and link it from the License section of both READMEs.
2026-07-29 21:29:49 -07:00
## Development-only npm dependencies
docs: evaluate SPDX conjunctions and read every Python manifest Reject a copyleft conjunct in an expression like '(MIT OR Apache-2.0) AND GPL-3.0-only', which a permissive-alternative search accepted. Discover python/*/pyproject.toml by glob, accept single-quoted TOML literals, and fail on a requirement whose name cannot be read. Say that the development tier records who declares a package rather than what a build bundles, since a runtime dependency can pull one in transitively, and sync the contributor guide's pre-commit list.
2026-07-30 19:54:27 -07:00
External packages **directly declared** only by repository tooling, test infrastructure, the documentation site, the demo leaves, or the native launcher's build workspace. No shipped surface names them itself. A package here may still be pulled in transitively by a runtime dependency — `pnpm-lock.yaml` is the authority on the full closure — so this tier records who declares a package, not what a build ultimately bundles.
docs: add THIRD_PARTY_NOTICES.md disclosing third-party dependencies List direct dependencies by tier (vendored Cordis sources, runtime npm, dev-only npm, Python SDK, build-time tools) with upstream links and licenses, and link it from the License section of both READMEs.
2026-07-29 21:29:49 -07:00
| Package | License |
| --- | --- |
| [`@braintree/sanitize-url`](https://github.com/braintree/sanitize-url) | MIT |
| [`@modelcontextprotocol/server-everything`](https://github.com/modelcontextprotocol/servers) | MIT / Apache-2.0 |
| [`@modelcontextprotocol/server-filesystem`](https://github.com/modelcontextprotocol/servers) | MIT / Apache-2.0 |
| [`@stylistic/eslint-plugin`](https://github.com/eslint-stylistic/eslint-stylistic) | MIT |
docs: generate THIRD_PARTY_NOTICES.md and gate it in doc-sync Replace the hand-written inventory with scripts/gen-third-party-notices.ts, verified fresh by a doc-sync leaf gate. Tier by declaring workspace area rather than manifest section, so test-support runtime declarations stay dev-only and every mountable plugin's dependencies are disclosed as runtime; list the pnpm-patched packages; point the Python closure at uv.lock. Re-record the translation-prompt snapshot the README link invalidated.
2026-07-30 07:27:13 -07:00
| [`@testing-library/dom`](https://github.com/testing-library/dom-testing-library) | MIT |
| [`@testing-library/react`](https://github.com/testing-library/react-testing-library) | MIT |
| [`@types/babel__code-frame`](https://github.com/DefinitelyTyped/DefinitelyTyped) | MIT |
| [`@types/js-yaml`](https://github.com/DefinitelyTyped/DefinitelyTyped) | MIT |
| [`@types/jsdom`](https://github.com/DefinitelyTyped/DefinitelyTyped) | MIT |
| [`@types/node`](https://github.com/DefinitelyTyped/DefinitelyTyped) | MIT |
| [`@types/picomatch`](https://github.com/DefinitelyTyped/DefinitelyTyped) | MIT |
| [`@types/react`](https://github.com/DefinitelyTyped/DefinitelyTyped) | MIT |
| [`@types/react-dom`](https://github.com/DefinitelyTyped/DefinitelyTyped) | MIT |
feat(webworker): support fs watches and confinement
2026-08-23 20:35:25 +08:00
| [`@types/readable-stream`](https://github.com/DefinitelyTyped/DefinitelyTyped) | MIT |
fix(notices): validate SPDX expressions strictly
2026-07-31 17:16:08 +08:00
| [`@types/spdx-expression-parse`](https://github.com/DefinitelyTyped/DefinitelyTyped) | MIT |
docs: generate THIRD_PARTY_NOTICES.md and gate it in doc-sync Replace the hand-written inventory with scripts/gen-third-party-notices.ts, verified fresh by a doc-sync leaf gate. Tier by declaring workspace area rather than manifest section, so test-support runtime declarations stay dev-only and every mountable plugin's dependencies are disclosed as runtime; list the pnpm-patched packages; point the Python closure at uv.lock. Re-record the translation-prompt snapshot the README link invalidated.
2026-07-30 07:27:13 -07:00
| [`@types/turndown`](https://github.com/DefinitelyTyped/DefinitelyTyped) | MIT |
feat(webworker): browser worker host runtime and the vfs image packer Two private experimental packages run the whole harness tree inside one dedicated Web Worker. dsh-experimental-webworker-runtime owns the in-memory VFS (BigInt stats with per-path identity and strictly increasing mtimes), the CommonJS wrapper loader over a lazily-evaluated builtin table whose shims typecheck against Node's own module types, the postMessage tunnel speaking plain HTTP, the AsyncLocalStorage runtime, and the worker assembly. dsh-experimental-webworker-packer lowers every module body at pack time against the shared wrapper contract, sweeps the profile closure by static reachability, and writes a deterministically gzip-compressed tar the worker inflates through the browser's native DecompressionStream while it downloads.
2026-08-20 19:19:07 +08:00
| [`@types/use-sync-external-store`](https://github.com/DefinitelyTyped/DefinitelyTyped) | MIT |
docs: refresh third-party notices
2026-08-04 16:25:49 +08:00
| [`@types/ws`](https://github.com/DefinitelyTyped/DefinitelyTyped) | MIT |
docs: add THIRD_PARTY_NOTICES.md disclosing third-party dependencies List direct dependencies by tier (vendored Cordis sources, runtime npm, dev-only npm, Python SDK, build-time tools) with upstream links and licenses, and link it from the License section of both READMEs.
2026-07-29 21:29:49 -07:00
| [`@vitejs/plugin-react`](https://github.com/vitejs/vite-plugin-react) | MIT |
| [`@vitest/coverage-v8`](https://github.com/vitest-dev/vitest) | MIT |
| [`@yarnpkg/cli-dist`](https://github.com/yarnpkg/berry) | BSD-2-Clause |
| [`cytoscape`](https://github.com/cytoscape/cytoscape.js) | MIT |
| [`cytoscape-cose-bilkent`](https://github.com/cytoscape/cytoscape.js-cose-bilkent) | MIT |
| [`dayjs`](https://github.com/iamkun/dayjs) | MIT |
| [`debug`](https://github.com/debug-js/debug) | MIT |
| [`esbuild`](https://github.com/evanw/esbuild) | MIT |
| [`eslint-plugin-sonarjs`](https://github.com/SonarSource/SonarJS) | LGPL-3.0-only |
docs: generate THIRD_PARTY_NOTICES.md and gate it in doc-sync Replace the hand-written inventory with scripts/gen-third-party-notices.ts, verified fresh by a doc-sync leaf gate. Tier by declaring workspace area rather than manifest section, so test-support runtime declarations stay dev-only and every mountable plugin's dependencies are disclosed as runtime; list the pnpm-patched packages; point the Python closure at uv.lock. Re-record the translation-prompt snapshot the README link invalidated.
2026-07-30 07:27:13 -07:00
| [`execa`](https://github.com/sindresorhus/execa) | MIT |
docs: add THIRD_PARTY_NOTICES.md disclosing third-party dependencies List direct dependencies by tier (vendored Cordis sources, runtime npm, dev-only npm, Python SDK, build-time tools) with upstream links and licenses, and link it from the License section of both READMEs.
2026-07-29 21:29:49 -07:00
| [`fast-check`](https://github.com/dubzzz/fast-check) | MIT |
feat(webworker): browser worker host runtime and the vfs image packer Two private experimental packages run the whole harness tree inside one dedicated Web Worker. dsh-experimental-webworker-runtime owns the in-memory VFS (BigInt stats with per-path identity and strictly increasing mtimes), the CommonJS wrapper loader over a lazily-evaluated builtin table whose shims typecheck against Node's own module types, the postMessage tunnel speaking plain HTTP, the AsyncLocalStorage runtime, and the worker assembly. dsh-experimental-webworker-packer lowers every module body at pack time against the shared wrapper contract, sweeps the profile closure by static reachability, and writes a deterministically gzip-compressed tar the worker inflates through the browser's native DecompressionStream while it downloads.
2026-08-20 19:19:07 +08:00
| [`http-server`](https://github.com/http-party/http-server) | MIT |
ci: print exact uncovered locations when the coverage gate fails The per-file 100% thresholds name only the failing file. A custom istanbul reporter now prints one clickable path:line:col record per uncovered statement, branch path, and function, right above the threshold errors, in both the CI coverage lane and local test:coverage runs (they share this config). CJS because istanbul-reports loads custom reporters with a bare require() outside the tsx/ESM pipeline.
2026-08-06 03:18:17 +08:00
| [`istanbul-lib-report`](https://github.com/istanbuljs/istanbuljs) | BSD-3-Clause |
docs: add THIRD_PARTY_NOTICES.md disclosing third-party dependencies List direct dependencies by tier (vendored Cordis sources, runtime npm, dev-only npm, Python SDK, build-time tools) with upstream links and licenses, and link it from the License section of both READMEs.
2026-07-29 21:29:49 -07:00
| [`jscpd`](https://github.com/kucherenko/jscpd) | MIT |
| [`jsdom`](https://github.com/jsdom/jsdom) | MIT |
| [`knip`](https://github.com/webpro-nl/knip) | ISC |
| [`lefthook`](https://github.com/evilmartians/lefthook) | MIT |
| [`lightningcss`](https://github.com/parcel-bundler/lightningcss) | MPL-2.0 |
| [`mermaid`](https://github.com/mermaid-js/mermaid) | MIT |
| [`oxlint`](https://github.com/oxc-project/oxc) | MIT |
| [`oxlint-tsgolint`](https://github.com/oxc-project/tsgolint) | MIT |
| [`playwright`](https://github.com/microsoft/playwright) | Apache-2.0 |
| [`publint`](https://github.com/publint/publint) | MIT |
fix(notices): parse Python manifests as TOML
2026-07-31 17:12:41 +08:00
| [`smol-toml`](https://github.com/squirrelchat/smol-toml) | BSD-3-Clause |
fix(notices): validate SPDX expressions strictly
2026-07-31 17:16:08 +08:00
| [`spdx-expression-parse`](https://github.com/jslicense/spdx-expression-parse.js) | MIT |
docs: add THIRD_PARTY_NOTICES.md disclosing third-party dependencies List direct dependencies by tier (vendored Cordis sources, runtime npm, dev-only npm, Python SDK, build-time tools) with upstream links and licenses, and link it from the License section of both READMEs.
2026-07-29 21:29:49 -07:00
| [`tsdown`](https://github.com/rolldown/tsdown) | MIT |
| [`typescript-language-server`](https://github.com/typescript-language-server/typescript-language-server) | Apache-2.0 |
| [`vite`](https://github.com/vitejs/vite) | MIT |
| [`vite-tsconfig-paths`](https://github.com/aleclarson/vite-tsconfig-paths) | MIT |
| [`vitepress`](https://github.com/vuejs/vitepress) | MIT |
| [`vitepress-plugin-mermaid`](https://github.com/emersonbottero/vitepress-plugin-mermaid) | MIT |
docs: generate THIRD_PARTY_NOTICES.md and gate it in doc-sync Replace the hand-written inventory with scripts/gen-third-party-notices.ts, verified fresh by a doc-sync leaf gate. Tier by declaring workspace area rather than manifest section, so test-support runtime declarations stay dev-only and every mountable plugin's dependencies are disclosed as runtime; list the pnpm-patched packages; point the Python closure at uv.lock. Re-record the translation-prompt snapshot the README link invalidated.
2026-07-30 07:27:13 -07:00
| [`vitest`](https://github.com/vitest-dev/vitest) | MIT |
docs: add THIRD_PARTY_NOTICES.md disclosing third-party dependencies List direct dependencies by tier (vendored Cordis sources, runtime npm, dev-only npm, Python SDK, build-time tools) with upstream links and licenses, and link it from the License section of both READMEs.
2026-07-29 21:29:49 -07:00
`eslint-plugin-sonarjs` (LGPL-3.0-only) and `lightningcss` (MPL-2.0) run only as development tooling; their code is not linked into or distributed with any DeepSeek Harness artifact.
## Python SDK dependencies (`python/`)
docs: generate THIRD_PARTY_NOTICES.md and gate it in doc-sync Replace the hand-written inventory with scripts/gen-third-party-notices.ts, verified fresh by a doc-sync leaf gate. Tier by declaring workspace area rather than manifest section, so test-support runtime declarations stay dev-only and every mountable plugin's dependencies are disclosed as runtime; list the pnpm-patched packages; point the Python closure at uv.lock. Re-record the translation-prompt snapshot the README link invalidated.
2026-07-30 07:27:13 -07:00
Direct dependencies of the `pyproject.toml` manifests, plus `uv` as the development workflow tool.
docs: add THIRD_PARTY_NOTICES.md disclosing third-party dependencies List direct dependencies by tier (vendored Cordis sources, runtime npm, dev-only npm, Python SDK, build-time tools) with upstream links and licenses, and link it from the License section of both READMEs.
2026-07-29 21:29:49 -07:00
| Package | License | Role |
| --- | --- | --- |
| [`hatchling`](https://github.com/pypa/hatch) | MIT | build backend |
fix(python): rename SDK distribution
2026-08-10 19:45:54 +08:00
| [`pydantic`](https://github.com/pydantic/pydantic) | MIT | runtime dependency of `deepseek-harness-sdk` |
docs: add THIRD_PARTY_NOTICES.md disclosing third-party dependencies List direct dependencies by tier (vendored Cordis sources, runtime npm, dev-only npm, Python SDK, build-time tools) with upstream links and licenses, and link it from the License section of both READMEs.
2026-07-29 21:29:49 -07:00
| [`pytest`](https://github.com/pytest-dev/pytest) | MIT | test-only |
| [`uv`](https://github.com/astral-sh/uv) | MIT / Apache-2.0 | development workflow tool |
## Fetched at build time
| Package | License | Role |
| --- | --- | --- |
| [`@yao-pkg/pkg`](https://github.com/yao-pkg/pkg) | MIT | invoked by `scripts/build-exe-for-python-sdk.ts` to assemble the single-file SDK runtime executable |
refactor(landlock-run): unify workspace release (review round 1)
2026-08-06 10:23:26 +08:00
## First-party native packages
docs: add THIRD_PARTY_NOTICES.md disclosing third-party dependencies List direct dependencies by tier (vendored Cordis sources, runtime npm, dev-only npm, Python SDK, build-time tools) with upstream links and licenses, and link it from the License section of both READMEs.
2026-07-29 21:29:49 -07:00
fix(landlock-run): publish under deepseek scope
2026-08-06 14:41:17 +08:00
`@deepseek-ai/node-addon-landlock-run` (and its platform packages) is built and released from this repository under BSD 3-Clause. It is listed here for completeness; it is first-party, not third-party.
Reference in a new issue Copy permalink