Coder/deepseek-harness
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

docs: evaluate SPDX conjunctions and read every Python manifest

Browse Source 
Reject a copyleft conjunct in an expression like '(MIT OR Apache-2.0)
AND GPL-3.0-only', which a permissive-alternative search accepted.
Discover python/*/pyproject.toml by glob, accept single-quoted TOML
literals, and fail on a requirement whose name cannot be read. Say that
the development tier records who declares a package rather than what a
build bundles, since a runtime dependency can pull one in transitively,
and sync the contributor guide's pre-commit list.
This commit is contained in:
ZiyaZhang
2026-07-30 19:54:27 -07:00
parent 9f9d6fc0e2
commit 421594472a
6 changed files with 52 additions and 23 deletions
Download Patch File Download Diff File Expand all files Collapse all files

5
THIRD_PARTY_NOTICES.md
View File

@@ -5,7 +5,7 @@
DeepSeek Harness is licensed under [BSD 3-Clause](LICENSE). It depends on the third-party open-source software listed below. Each project remains under its own license; nothing in this file changes those terms.
This file lists **direct** dependencies declared by the workspace. It is generated from the workspace manifests by `scripts/gen-third-party-notices.ts`: a pre-commit hook regenerates it whenever a manifest changes, and `scripts/gen-third-party-notices.spec.ts` asserts in the test lane that the committed bytes match. Run `pnpm run verify-third-party-notices` for the standalone check.
This file lists **direct** dependencies declared by the workspace. It is generated from the workspace manifests by `scripts/gen-third-party-notices.ts`: a pre-commit hook regenerates it whenever a staged file changes one of its inputs, and `scripts/gen-third-party-notices.spec.ts` asserts in the test lane that the committed bytes match. Deleting a manifest runs no hook, so that case is caught by the assertion instead. Run `pnpm run verify-third-party-notices` for the standalone check.
The complete npm transitive closure, with exact pinned versions, is recorded in [`pnpm-lock.yaml`](pnpm-lock.yaml) — inspect it with `pnpm licenses list`. The Python closure is recorded in [`python/sdk/uv.lock`](python/sdk/uv.lock), and the Landlock launcher workspace keeps its own in [`native/landlock-run/pnpm-lock.yaml`](native/landlock-run/pnpm-lock.yaml).
@@ -87,7 +87,7 @@ pnpm applies local patches to the following packages at install time, so shipped
## Development-only npm dependencies
External packages declared only by repository tooling, test infrastructure, the documentation site, the demo leaves, or the native launcher's build workspace. They are not part of any shipped runtime artifact.
External packages **directly declared** only by repository tooling, test infrastructure, the documentation site, the demo leaves, or the native launcher's build workspace. No shipped surface names them itself. A package here may still be pulled in transitively by a runtime dependency — `pnpm-lock.yaml` is the authority on the full closure — so this tier records who declares a package, not what a build ultimately bundles.
| Package | License |
| --- | --- |
@@ -140,7 +140,6 @@ External packages declared only by repository tooling, test infrastructure, the
`eslint-plugin-sonarjs` (LGPL-3.0-only) and `lightningcss` (MPL-2.0) run only as development tooling; their code is not linked into or distributed with any DeepSeek Harness artifact.
## Python SDK dependencies (`python/`)
Direct dependencies of the `pyproject.toml` manifests, plus `uv` as the development workflow tool.