Files

imccyu 1fae5dc40e fix(scripts): disclose browser-bundled packages as shipped

Moving react, shiki, katex and the markdown pipeline to devDependencies took
them out of the notices runtime tier, which tiers by declaring section — yet
their code is inside lib/client.js and the shell dist. The generator now learns
what the browser artifacts carry from the real build configs: each client bundle
through its own tsdown config, the shell through apps/web's Vite config, with a
recorder that resolves each bare specifier, notes the package behind it, and
stops there. About three seconds, and only packages a resolved file backs, so a
bundler's virtual module is not mistaken for a shipped one.

Net effect on the file: the type-only packages @types/mdast and
micromark-util-types move to the development tier, because neither ships code.

2026-08-14 22:24:23 +08:00

16 KiB

Raw Blame History

Third-Party Notices

DeepSeek Harness is licensed under MIT. It depends on the third-party software listed below. Each project remains under its own license; nothing in this file changes those terms.

This file lists direct dependencies declared by the workspace and the explicitly disclosed official Claude platform payload closure. It is generated from the workspace manifests by scripts/gen-third-party-notices.ts: a pre-commit hook regenerates it whenever a staged file changes one of its inputs, and scripts/gen-third-party-notices.spec.ts asserts in the test lane that the committed bytes match. Deleting a manifest runs no hook, so that case is caught by the assertion instead. Run pnpm run verify-third-party-notices for the standalone check.

The complete npm transitive closure, including the Landlock launcher workspace, is recorded with exact pinned versions in pnpm-lock.yaml — inspect it with pnpm licenses list. The Python closure is recorded separately in python/sdk/uv.lock.

Vendored source (`vendor/`)

The Cordis framework and its foundation libraries are source-vendored into this repository rather than consumed from npm, and republished under the @deepseek-ai scope. All are MIT-licensed; each directory preserves its upstream LICENSE file. Exact upstream commits and local modifications are recorded in vendor/README.md.

Package	Upstream name	Upstream	License
`@deepseek-ai/cosmokit`	`cosmokit`	github.com/deepseek-harness/cosmokit	MIT
`@deepseek-ai/schemastery`	`schemastery`	github.com/deepseek-harness/schemastery	MIT
`@deepseek-ai/cordis`	`cordis`	github.com/cordiverse/cordis	MIT
`@deepseek-ai/cordis-plugin-loader`	`@cordisjs/plugin-loader`	github.com/cordiverse/cordis	MIT
`@deepseek-ai/cordis-plugin-include`	`@cordisjs/plugin-include`	github.com/deepseek-harness/cordis	MIT
`@deepseek-ai/cordis-plugin-group`	`@cordisjs/plugin-group`	github.com/deepseek-harness/cordis	MIT
`@deepseek-ai/cordis-plugin-timer`	`@cordisjs/plugin-timer`	github.com/deepseek-harness/cordis	MIT
`@deepseek-ai/cordis-plugin-hmr`	`@cordisjs/plugin-hmr`	github.com/deepseek-harness/cordis	MIT
`@deepseek-ai/cordis-plugin-logger-console`	`@cordisjs/plugin-logger-console`	github.com/deepseek-harness/cordis	MIT

Runtime npm dependencies

External packages that reach a user: a workspace package resolves them at runtime, or a published browser artifact carries a copy of their code. The tier covers every plugin a user can mount from cordis.yml — not only what the dsh CLI, Web UI, and Python SDK runtime load by default — and the packages the client build inlines into a plugin bundle or the shell dist, which are declared as devDependencies because nothing on a user's machine resolves their specifiers.

Package	License
`@agentclientprotocol/sdk`	Apache-2.0
`@anthropic-ai/claude-agent-sdk`	SEE LICENSE IN README.md
`@anthropic-ai/sdk`	MIT
`@babel/code-frame`	MIT
`@earendil-works/pi-ai`	MIT
`@joplin/turndown-plugin-gfm`	MIT
`@jridgewell/gen-mapping`	MIT
`@modelcontextprotocol/sdk`	MIT
`@opentelemetry/api`	Apache-2.0
`@opentelemetry/api-logs`	Apache-2.0
`@opentelemetry/exporter-logs-otlp-http`	Apache-2.0
`@opentelemetry/otlp-exporter-base`	Apache-2.0
`@opentelemetry/resources`	Apache-2.0
`@opentelemetry/sdk-logs`	Apache-2.0
`@shikijs/langs`	MIT
`@standard-schema/spec`	MIT
`@tanstack/react-virtual`	MIT
`@vscode/ripgrep`	MIT
`anser`	MIT
`chokidar`	MIT
`clsx`	MIT
`commander`	MIT
`diff`	BSD-3-Clause
`e2b`	MIT
`eventsource-parser`	MIT
`fflate`	MIT
`immer`	MIT
`js-yaml`	MIT
`katex`	MIT
`koffi`	MIT
`mdast-util-from-markdown`	MIT
`mdast-util-gfm`	MIT
`mdast-util-math`	MIT
`micromark-core-commonmark`	MIT
`micromark-extension-gfm`	MIT
`micromark-extension-math`	MIT
`micromark-factory-space`	MIT
`micromark-util-character`	MIT
`micromark-util-classify-character`	MIT
`micromark-util-sanitize-uri`	MIT
`micromark-util-symbol`	MIT
`node-addon-require-builtin`	MIT
`node-pty`	MIT
`picomatch`	MIT
`react`	MIT
`react-dom`	MIT
`sharp`	Apache-2.0
`shiki`	MIT
`supports-color`	MIT
`tsx`	MIT
`turndown`	MIT
`typescript`	Apache-2.0
`use-sync-external-store`	MIT
`ws`	MIT
`yaml`	ISC
`zod`	MIT
`zustand`	MIT

pnpm applies local patches to the following packages at install time, so shipped artifacts carry modified copies; each patch file is the complete record of the modification:

node-pty@1.1.0 — patches/node-pty@1.1.0.patch

Official Claude Code platform payloads

The project owner authorizes distribution of every version of the official @anthropic-ai/claude-agent-sdk package and the official Claude Code CLI/platform payloads that each version declares through optionalDependencies. This identity-scoped authorization does not classify their declared terms as permissive and does not cover any unrelated runtime package; version, declared-license, and payload-set changes still require the ordinary dependency, lockfile, compatibility, terms, and notices review.

The installed SDK 0.3.220 declares the following optional platform packages. Each carries the official Claude Code 2.1.220 executable; the package identities and versions come from the SDK manifest, while the declared license field is verified against the platform payload installed for the current host.

Optional platform package	Version	Declared license
`@anthropic-ai/claude-agent-sdk-darwin-arm64`	0.3.220	SEE LICENSE IN LICENSE.md
`@anthropic-ai/claude-agent-sdk-darwin-x64`	0.3.220	SEE LICENSE IN LICENSE.md
`@anthropic-ai/claude-agent-sdk-linux-arm64`	0.3.220	SEE LICENSE IN LICENSE.md
`@anthropic-ai/claude-agent-sdk-linux-arm64-musl`	0.3.220	SEE LICENSE IN LICENSE.md
`@anthropic-ai/claude-agent-sdk-linux-x64`	0.3.220	SEE LICENSE IN LICENSE.md
`@anthropic-ai/claude-agent-sdk-linux-x64-musl`	0.3.220	SEE LICENSE IN LICENSE.md
`@anthropic-ai/claude-agent-sdk-win32-arm64`	0.3.220	SEE LICENSE IN LICENSE.md
`@anthropic-ai/claude-agent-sdk-win32-x64`	0.3.220	SEE LICENSE IN LICENSE.md

Development-only npm dependencies

External packages directly declared only by repository tooling, test infrastructure, the documentation site, the demo leaves, or the native launcher's build workspace, and carried by no published artifact. No shipped surface names them itself. A package here may still be pulled in transitively by a runtime dependency — pnpm-lock.yaml is the authority on the full closure — so this tier records who declares a package, not what a build ultimately bundles.

Package	License
`@braintree/sanitize-url`	MIT
`@modelcontextprotocol/server-everything`	MIT / Apache-2.0
`@modelcontextprotocol/server-filesystem`	MIT / Apache-2.0
`@openai/codex`	Apache-2.0
`@stylistic/eslint-plugin`	MIT
`@testing-library/dom`	MIT
`@testing-library/react`	MIT
`@types/babel__code-frame`	MIT
`@types/js-yaml`	MIT
`@types/jsdom`	MIT
`@types/mdast`	MIT
`@types/node`	MIT
`@types/picomatch`	MIT
`@types/react`	MIT
`@types/react-dom`	MIT
`@types/spdx-expression-parse`	MIT
`@types/turndown`	MIT
`@types/ws`	MIT
`@vitejs/plugin-react`	MIT
`@vitest/coverage-v8`	MIT
`@yarnpkg/cli-dist`	BSD-2-Clause
`cytoscape`	MIT
`cytoscape-cose-bilkent`	MIT
`dayjs`	MIT
`debug`	MIT
`esbuild`	MIT
`eslint-plugin-sonarjs`	LGPL-3.0-only
`execa`	MIT
`fast-check`	MIT
`istanbul-lib-report`	BSD-3-Clause
`jscpd`	MIT
`jsdom`	MIT
`knip`	ISC
`lefthook`	MIT
`lightningcss`	MPL-2.0
`mermaid`	MIT
`micromark-util-types`	MIT
`oxlint`	MIT
`oxlint-tsgolint`	MIT
`playwright`	Apache-2.0
`publint`	MIT
`smol-toml`	BSD-3-Clause
`spdx-expression-parse`	MIT
`tsdown`	MIT
`typescript-language-server`	Apache-2.0
`vite`	MIT
`vite-tsconfig-paths`	MIT
`vitepress`	MIT
`vitepress-plugin-mermaid`	MIT
`vitest`	MIT

eslint-plugin-sonarjs (LGPL-3.0-only) and lightningcss (MPL-2.0) run only as development tooling; their code is not linked into or distributed with any DeepSeek Harness artifact.

Python SDK dependencies (`python/`)

Direct dependencies of the pyproject.toml manifests, plus uv as the development workflow tool.

Package	License	Role
`hatchling`	MIT	build backend
`pydantic`	MIT	runtime dependency of `deepseek-harness-sdk`
`pytest`	MIT	test-only
`uv`	MIT / Apache-2.0	development workflow tool

Fetched at build time

Package	License	Role
`@yao-pkg/pkg`	MIT	invoked by `scripts/build-exe-for-python-sdk.ts` to assemble the single-file SDK runtime executable

First-party native packages

@deepseek-ai/node-addon-landlock-run (and its platform packages) is built and released from this repository under BSD 3-Clause. It is listed here for completeness; it is first-party, not third-party.

16 KiB Raw Blame History