mirror of https://github.com/deepseek-ai/deepseek-harness synced 2026-08-15 21:04:50 +00:00

Files

ZiyaZhang 6427660dca docs: fix notices template claim and close generator omission paths

The template still described the removed doc-sync gate; it now states the
pre-commit + test-lane mechanism that actually runs. Read the nested
native/landlock-run/packages manifests, accept PEP 508 requirements with
no version or with a marker, and reject a vendor/README.md table that
stops covering a vendored directory instead of dropping it silently.
Extend the pre-commit glob to the generator and the build-time pin
source; record the deletion trigger gap the test lane backstops.

2026-07-30 09:23:00 -07:00

11 KiB

Raw Blame History

Third-Party Notices

DeepSeek Harness is licensed under BSD 3-Clause. It depends on the third-party open-source software listed below. Each project remains under its own license; nothing in this file changes those terms.

This file lists direct dependencies declared by the workspace. It is generated from the workspace manifests by scripts/gen-third-party-notices.ts: a pre-commit hook regenerates it whenever a manifest changes, and scripts/gen-third-party-notices.spec.ts asserts in the test lane that the committed bytes match. Run pnpm run verify-third-party-notices for the standalone check.

The complete npm transitive closure, with exact pinned versions, is recorded in pnpm-lock.yaml — inspect it with pnpm licenses list. The Python closure is recorded in python/sdk/uv.lock, and the Landlock launcher workspace keeps its own in native/landlock-run/pnpm-lock.yaml.

Vendored source (`vendor/`)

The Cordis framework and its foundation libraries are source-vendored into this repository rather than consumed from npm. All are MIT-licensed; each directory preserves its upstream LICENSE file. Exact upstream commits and local modifications are recorded in vendor/README.md.

Package	Upstream	License
`cosmokit`	github.com/deepseek-harness/cosmokit	MIT
`schemastery`	github.com/deepseek-harness/schemastery	MIT
`cordis`	github.com/cordiverse/cordis	MIT
`@cordisjs/plugin-loader`	github.com/cordiverse/cordis	MIT
`@cordisjs/plugin-include`	github.com/deepseek-harness/cordis	MIT
`@cordisjs/plugin-group`	github.com/deepseek-harness/cordis	MIT
`@cordisjs/plugin-timer`	github.com/deepseek-harness/cordis	MIT
`@cordisjs/plugin-hmr`	github.com/deepseek-harness/cordis	MIT
`@cordisjs/plugin-logger-console`	github.com/deepseek-harness/cordis	MIT

Runtime npm dependencies

External packages that a workspace package resolves at runtime. scripts/install.sh installs this repository itself, so the tier covers every plugin a user can mount from cordis.yml — not only what the dsh CLI/TUI, the Web UI, and the Python SDK runtime load by default.

Package	License
`@agentclientprotocol/sdk`	Apache-2.0
`@babel/code-frame`	MIT
`@clack/core`	MIT
`@clack/prompts`	MIT
`@earendil-works/pi-ai`	MIT
`@earendil-works/pi-tui`	MIT
`@joplin/turndown-plugin-gfm`	MIT
`@modelcontextprotocol/sdk`	MIT
`@opentelemetry/api`	Apache-2.0
`@opentelemetry/api-logs`	Apache-2.0
`@opentelemetry/exporter-logs-otlp-http`	Apache-2.0
`@opentelemetry/otlp-exporter-base`	Apache-2.0
`@opentelemetry/resources`	Apache-2.0
`@opentelemetry/sdk-logs`	Apache-2.0
`@shikijs/langs`	MIT
`@standard-schema/spec`	MIT
`anser`	MIT
`chokidar`	MIT
`clsx`	MIT
`commander`	MIT
`diff`	BSD-3-Clause
`eventsource-parser`	MIT
`handlebars`	MIT
`immer`	MIT
`js-yaml`	MIT
`jsonc-parser`	MIT
`koffi`	MIT
`mdast-util-from-markdown`	MIT
`mdast-util-gfm`	MIT
`micromark-extension-gfm`	MIT
`node-addon-require-builtin`	MIT
`node-pty`	MIT
`picomatch`	MIT
`react`	MIT
`react-dom`	MIT
`react-markdown`	MIT
`remark-gfm`	MIT
`saxes`	ISC
`shiki`	MIT
`supports-color`	MIT
`tsx`	MIT
`turndown`	MIT
`typescript`	Apache-2.0
`use-sync-external-store`	MIT
`yaml`	ISC
`zod`	MIT
`zustand`	MIT

pnpm applies local patches to the following packages at install time, so shipped artifacts carry modified copies; each patch file is the complete record of the modification:

@earendil-works/pi-tui@0.80.7 — patches/@earendil-works__pi-tui@0.80.7.patch
node-pty@1.1.0 — patches/node-pty@1.1.0.patch

Development-only npm dependencies

External packages declared only by repository tooling, test infrastructure, the documentation site, the demo leaves, or the native launcher's build workspace. They are not part of any shipped runtime artifact.

Package	License
`@braintree/sanitize-url`	MIT
`@modelcontextprotocol/server-everything`	MIT / Apache-2.0
`@modelcontextprotocol/server-filesystem`	MIT / Apache-2.0
`@stylistic/eslint-plugin`	MIT
`@testing-library/dom`	MIT
`@testing-library/react`	MIT
`@types/babel__code-frame`	MIT
`@types/js-yaml`	MIT
`@types/jsdom`	MIT
`@types/mdast`	MIT
`@types/node`	MIT
`@types/picomatch`	MIT
`@types/react`	MIT
`@types/react-dom`	MIT
`@types/turndown`	MIT
`@typescript-eslint/parser`	MIT
`@vitejs/plugin-react`	MIT
`@vitest/coverage-v8`	MIT
`@xterm/headless`	MIT
`@yarnpkg/cli-dist`	BSD-2-Clause
`cytoscape`	MIT
`cytoscape-cose-bilkent`	MIT
`dayjs`	MIT
`debug`	MIT
`esbuild`	MIT
`eslint`	MIT
`eslint-plugin-sonarjs`	LGPL-3.0-only
`execa`	MIT
`fast-check`	MIT
`jscpd`	MIT
`jsdom`	MIT
`knip`	ISC
`lefthook`	MIT
`lightningcss`	MPL-2.0
`mermaid`	MIT
`oxlint`	MIT
`oxlint-tsgolint`	MIT
`playwright`	Apache-2.0
`publint`	MIT
`tsdown`	MIT
`typescript-language-server`	Apache-2.0
`vite`	MIT
`vite-tsconfig-paths`	MIT
`vitepress`	MIT
`vitepress-plugin-mermaid`	MIT
`vitest`	MIT

eslint-plugin-sonarjs (LGPL-3.0-only) and lightningcss (MPL-2.0) run only as development tooling; their code is not linked into or distributed with any DeepSeek Harness artifact.

Python SDK dependencies (`python/`)

Direct dependencies of the pyproject.toml manifests, plus uv as the development workflow tool.

Package	License	Role
`hatchling`	MIT	build backend
`pydantic`	MIT	runtime dependency of `deepseek-harness`
`pytest`	MIT	test-only
`uv`	MIT / Apache-2.0	development workflow tool

Fetched at build time

Package	License	Role
`@yao-pkg/pkg`	MIT	invoked by `scripts/build-exe-for-python-sdk.ts` to assemble the single-file SDK runtime executable

First-party sibling releases

node-addon-landlock-run (and its platform packages) is released from a DeepSeek Harness sibling repository under BSD 3-Clause. It is listed here for completeness; it is first-party, not third-party.

11 KiB Raw Blame History