2026-07-30 07:27:13 -07:00
<!-- Generated by scripts/gen-third-party-notices.ts — do not edit by hand.
Run `pnpm run gen-third-party-notices` to regenerate. -->
2026-07-29 21:29:49 -07:00
# Third-Party Notices
DeepSeek Harness is licensed under [BSD 3-Clause ](LICENSE ). It depends on the third-party open-source software listed below. Each project remains under its own license; nothing in this file changes those terms.
2026-07-30 19:54:27 -07:00
This file lists **direct ** dependencies declared by the workspace. It is generated from the workspace manifests by `scripts/gen-third-party-notices.ts` : a pre-commit hook regenerates it whenever a staged file changes one of its inputs, and `scripts/gen-third-party-notices.spec.ts` asserts in the test lane that the committed bytes match. Deleting a manifest runs no hook, so that case is caught by the assertion instead. Run `pnpm run verify-third-party-notices` for the standalone check.
2026-07-30 09:23:00 -07:00
The complete npm transitive closure, with exact pinned versions, is recorded in [`pnpm-lock.yaml` ](pnpm-lock.yaml ) — inspect it with `pnpm licenses list` . The Python closure is recorded in [`python/sdk/uv.lock` ](python/sdk/uv.lock ), and the Landlock launcher workspace keeps its own in [`native/landlock-run/pnpm-lock.yaml` ](native/landlock-run/pnpm-lock.yaml ).
2026-07-29 21:29:49 -07:00
## Vendored source (`vendor/`)
The Cordis framework and its foundation libraries are source-vendored into this repository rather than consumed from npm. All are MIT-licensed; each directory preserves its upstream `LICENSE` file. Exact upstream commits and local modifications are recorded in [`vendor/README.md` ](vendor/README.md ).
| Package | Upstream | License |
| --- | --- | --- |
2026-07-30 07:27:13 -07:00
| `cosmokit` | [github.com/deepseek-harness/cosmokit ](https://github.com/deepseek-harness/cosmokit ) | MIT |
| `schemastery` | [github.com/deepseek-harness/schemastery ](https://github.com/deepseek-harness/schemastery ) | MIT |
| `cordis` | [github.com/cordiverse/cordis ](https://github.com/cordiverse/cordis ) | MIT |
| `@cordisjs/plugin-loader` | [github.com/cordiverse/cordis ](https://github.com/cordiverse/cordis ) | MIT |
| `@cordisjs/plugin-include` | [github.com/deepseek-harness/cordis ](https://github.com/deepseek-harness/cordis ) | MIT |
| `@cordisjs/plugin-group` | [github.com/deepseek-harness/cordis ](https://github.com/deepseek-harness/cordis ) | MIT |
| `@cordisjs/plugin-timer` | [github.com/deepseek-harness/cordis ](https://github.com/deepseek-harness/cordis ) | MIT |
| `@cordisjs/plugin-hmr` | [github.com/deepseek-harness/cordis ](https://github.com/deepseek-harness/cordis ) | MIT |
| `@cordisjs/plugin-logger-console` | [github.com/deepseek-harness/cordis ](https://github.com/deepseek-harness/cordis ) | MIT |
2026-07-29 21:29:49 -07:00
## Runtime npm dependencies
2026-07-30 07:27:13 -07:00
External packages that a workspace package resolves at runtime. `scripts/install.sh` installs this repository itself, so the tier covers every plugin a user can mount from `cordis.yml` — not only what the `dsh` CLI/TUI, the Web UI, and the Python SDK runtime load by default.
2026-07-29 21:29:49 -07:00
| Package | License |
| --- | --- |
| [`@agentclientprotocol/sdk` ](https://github.com/agentclientprotocol/typescript-sdk ) | Apache-2.0 |
| [`@babel/code-frame` ](https://github.com/babel/babel ) | MIT |
| [`@clack/core` ](https://github.com/bombshell-dev/clack ) | MIT |
| [`@clack/prompts` ](https://github.com/bombshell-dev/clack ) | MIT |
| [`@earendil-works/pi-ai` ](https://github.com/earendil-works/pi ) | MIT |
| [`@earendil-works/pi-tui` ](https://github.com/earendil-works/pi ) | MIT |
| [`@joplin/turndown-plugin-gfm` ](https://github.com/laurent22/joplin-turndown-plugin-gfm ) | MIT |
| [`@modelcontextprotocol/sdk` ](https://github.com/modelcontextprotocol/typescript-sdk ) | MIT |
| [`@opentelemetry/api` ](https://github.com/open-telemetry/opentelemetry-js ) | Apache-2.0 |
| [`@opentelemetry/api-logs` ](https://github.com/open-telemetry/opentelemetry-js ) | Apache-2.0 |
| [`@opentelemetry/exporter-logs-otlp-http` ](https://github.com/open-telemetry/opentelemetry-js ) | Apache-2.0 |
| [`@opentelemetry/otlp-exporter-base` ](https://github.com/open-telemetry/opentelemetry-js ) | Apache-2.0 |
| [`@opentelemetry/resources` ](https://github.com/open-telemetry/opentelemetry-js ) | Apache-2.0 |
| [`@opentelemetry/sdk-logs` ](https://github.com/open-telemetry/opentelemetry-js ) | Apache-2.0 |
| [`@shikijs/langs` ](https://github.com/shikijs/shiki ) | MIT |
| [`@standard-schema/spec` ](https://github.com/standard-schema/standard-schema ) | MIT |
| [`anser` ](https://github.com/IonicaBizau/anser ) | MIT |
| [`chokidar` ](https://github.com/paulmillr/chokidar ) | MIT |
| [`clsx` ](https://github.com/lukeed/clsx ) | MIT |
| [`commander` ](https://github.com/tj/commander.js ) | MIT |
| [`diff` ](https://github.com/kpdecker/jsdiff ) | BSD-3-Clause |
2026-07-30 19:46:26 -07:00
| [`dotenv` ](https://github.com/motdotla/dotenv ) | BSD-2-Clause |
2026-07-29 21:29:49 -07:00
| [`eventsource-parser` ](https://github.com/rexxars/eventsource-parser ) | MIT |
| [`handlebars` ](https://github.com/handlebars-lang/handlebars.js ) | MIT |
| [`immer` ](https://github.com/immerjs/immer ) | MIT |
| [`js-yaml` ](https://github.com/nodeca/js-yaml ) | MIT |
| [`jsonc-parser` ](https://github.com/microsoft/node-jsonc-parser ) | MIT |
2026-08-01 00:05:23 -07:00
| [`katex` ](https://github.com/KaTeX/KaTeX ) | MIT |
2026-07-29 21:29:49 -07:00
| [`koffi` ](https://github.com/Koromix/koffi ) | MIT |
| [`mdast-util-from-markdown` ](https://github.com/syntax-tree/mdast-util-from-markdown ) | MIT |
| [`mdast-util-gfm` ](https://github.com/syntax-tree/mdast-util-gfm ) | MIT |
| [`micromark-extension-gfm` ](https://github.com/micromark/micromark-extension-gfm ) | MIT |
| [`node-addon-require-builtin` ](https://www.npmjs.com/package/node-addon-require-builtin ) | MIT |
| [`node-pty` ](https://github.com/microsoft/node-pty ) | MIT |
| [`picomatch` ](https://github.com/micromatch/picomatch ) | MIT |
| [`react` ](https://github.com/facebook/react ) | MIT |
| [`react-dom` ](https://github.com/facebook/react ) | MIT |
| [`react-markdown` ](https://github.com/remarkjs/react-markdown ) | MIT |
2026-08-01 00:05:23 -07:00
| [`rehype-katex` ](https://github.com/remarkjs/remark-math/tree/main/packages/rehype-katex ) | MIT |
2026-07-29 21:29:49 -07:00
| [`remark-gfm` ](https://github.com/remarkjs/remark-gfm ) | MIT |
2026-08-01 00:05:23 -07:00
| [`remark-math` ](https://github.com/remarkjs/remark-math/tree/main/packages/remark-math ) | MIT |
2026-07-29 21:29:49 -07:00
| [`saxes` ](https://github.com/lddubeau/saxes ) | ISC |
| [`shiki` ](https://github.com/shikijs/shiki ) | MIT |
| [`supports-color` ](https://github.com/chalk/supports-color ) | MIT |
| [`tsx` ](https://github.com/privatenumber/tsx ) | MIT |
| [`turndown` ](https://github.com/mixmark-io/turndown ) | MIT |
| [`typescript` ](https://github.com/microsoft/TypeScript ) | Apache-2.0 |
| [`use-sync-external-store` ](https://github.com/facebook/react ) | MIT |
| [`yaml` ](https://github.com/eemeli/yaml ) | ISC |
| [`zod` ](https://github.com/colinhacks/zod ) | MIT |
| [`zustand` ](https://github.com/pmndrs/zustand ) | MIT |
2026-07-30 07:27:13 -07:00
pnpm applies local patches to the following packages at install time, so shipped artifacts carry modified copies; each patch file is the complete record of the modification:
- `@earendil-works/pi-tui@0.80.7` — [`patches/@earendil-works__pi-tui@0.80.7.patch` ](patches/@earendil-works__pi-tui@0.80.7.patch )
- `node-pty@1.1.0` — [`patches/node-pty@1.1.0.patch` ](patches/node-pty@1.1.0.patch )
2026-07-29 21:29:49 -07:00
## Development-only npm dependencies
2026-07-30 19:54:27 -07:00
External packages **directly declared ** only by repository tooling, test infrastructure, the documentation site, the demo leaves, or the native launcher's build workspace. No shipped surface names them itself. A package here may still be pulled in transitively by a runtime dependency — `pnpm-lock.yaml` is the authority on the full closure — so this tier records who declares a package, not what a build ultimately bundles.
2026-07-29 21:29:49 -07:00
| Package | License |
| --- | --- |
| [`@braintree/sanitize-url` ](https://github.com/braintree/sanitize-url ) | MIT |
| [`@modelcontextprotocol/server-everything` ](https://github.com/modelcontextprotocol/servers ) | MIT / Apache-2.0 |
| [`@modelcontextprotocol/server-filesystem` ](https://github.com/modelcontextprotocol/servers ) | MIT / Apache-2.0 |
| [`@stylistic/eslint-plugin` ](https://github.com/eslint-stylistic/eslint-stylistic ) | MIT |
2026-07-30 07:27:13 -07:00
| [`@testing-library/dom` ](https://github.com/testing-library/dom-testing-library ) | MIT |
| [`@testing-library/react` ](https://github.com/testing-library/react-testing-library ) | MIT |
| [`@types/babel__code-frame` ](https://github.com/DefinitelyTyped/DefinitelyTyped ) | MIT |
| [`@types/js-yaml` ](https://github.com/DefinitelyTyped/DefinitelyTyped ) | MIT |
| [`@types/jsdom` ](https://github.com/DefinitelyTyped/DefinitelyTyped ) | MIT |
| [`@types/mdast` ](https://github.com/DefinitelyTyped/DefinitelyTyped ) | MIT |
| [`@types/node` ](https://github.com/DefinitelyTyped/DefinitelyTyped ) | MIT |
| [`@types/picomatch` ](https://github.com/DefinitelyTyped/DefinitelyTyped ) | MIT |
| [`@types/react` ](https://github.com/DefinitelyTyped/DefinitelyTyped ) | MIT |
| [`@types/react-dom` ](https://github.com/DefinitelyTyped/DefinitelyTyped ) | MIT |
2026-07-31 17:16:08 +08:00
| [`@types/spdx-expression-parse` ](https://github.com/DefinitelyTyped/DefinitelyTyped ) | MIT |
2026-07-30 07:27:13 -07:00
| [`@types/turndown` ](https://github.com/DefinitelyTyped/DefinitelyTyped ) | MIT |
2026-07-29 21:29:49 -07:00
| [`@typescript-eslint/parser` ](https://github.com/typescript-eslint/typescript-eslint ) | MIT |
| [`@vitejs/plugin-react` ](https://github.com/vitejs/vite-plugin-react ) | MIT |
| [`@vitest/coverage-v8` ](https://github.com/vitest-dev/vitest ) | MIT |
| [`@xterm/headless` ](https://github.com/xtermjs/xterm.js ) | MIT |
| [`@yarnpkg/cli-dist` ](https://github.com/yarnpkg/berry ) | BSD-2-Clause |
| [`cytoscape` ](https://github.com/cytoscape/cytoscape.js ) | MIT |
| [`cytoscape-cose-bilkent` ](https://github.com/cytoscape/cytoscape.js-cose-bilkent ) | MIT |
| [`dayjs` ](https://github.com/iamkun/dayjs ) | MIT |
| [`debug` ](https://github.com/debug-js/debug ) | MIT |
| [`esbuild` ](https://github.com/evanw/esbuild ) | MIT |
| [`eslint` ](https://github.com/eslint/eslint ) | MIT |
| [`eslint-plugin-sonarjs` ](https://github.com/SonarSource/SonarJS ) | LGPL-3.0-only |
2026-07-30 07:27:13 -07:00
| [`execa` ](https://github.com/sindresorhus/execa ) | MIT |
2026-07-29 21:29:49 -07:00
| [`fast-check` ](https://github.com/dubzzz/fast-check ) | MIT |
| [`jscpd` ](https://github.com/kucherenko/jscpd ) | MIT |
| [`jsdom` ](https://github.com/jsdom/jsdom ) | MIT |
| [`knip` ](https://github.com/webpro-nl/knip ) | ISC |
| [`lefthook` ](https://github.com/evilmartians/lefthook ) | MIT |
| [`lightningcss` ](https://github.com/parcel-bundler/lightningcss ) | MPL-2.0 |
| [`mermaid` ](https://github.com/mermaid-js/mermaid ) | MIT |
| [`oxlint` ](https://github.com/oxc-project/oxc ) | MIT |
| [`oxlint-tsgolint` ](https://github.com/oxc-project/tsgolint ) | MIT |
| [`playwright` ](https://github.com/microsoft/playwright ) | Apache-2.0 |
| [`publint` ](https://github.com/publint/publint ) | MIT |
2026-07-31 17:12:41 +08:00
| [`smol-toml` ](https://github.com/squirrelchat/smol-toml ) | BSD-3-Clause |
2026-07-31 17:16:08 +08:00
| [`spdx-expression-parse` ](https://github.com/jslicense/spdx-expression-parse.js ) | MIT |
2026-07-29 21:29:49 -07:00
| [`tsdown` ](https://github.com/rolldown/tsdown ) | MIT |
| [`typescript-language-server` ](https://github.com/typescript-language-server/typescript-language-server ) | Apache-2.0 |
| [`vite` ](https://github.com/vitejs/vite ) | MIT |
| [`vite-tsconfig-paths` ](https://github.com/aleclarson/vite-tsconfig-paths ) | MIT |
| [`vitepress` ](https://github.com/vuejs/vitepress ) | MIT |
| [`vitepress-plugin-mermaid` ](https://github.com/emersonbottero/vitepress-plugin-mermaid ) | MIT |
2026-07-30 07:27:13 -07:00
| [`vitest` ](https://github.com/vitest-dev/vitest ) | MIT |
2026-07-29 21:29:49 -07:00
`eslint-plugin-sonarjs` (LGPL-3.0-only) and `lightningcss` (MPL-2.0) run only as development tooling; their code is not linked into or distributed with any DeepSeek Harness artifact.
## Python SDK dependencies (`python/`)
2026-07-30 07:27:13 -07:00
Direct dependencies of the `pyproject.toml` manifests, plus `uv` as the development workflow tool.
2026-07-29 21:29:49 -07:00
| Package | License | Role |
| --- | --- | --- |
| [`hatchling` ](https://github.com/pypa/hatch ) | MIT | build backend |
2026-07-30 07:27:13 -07:00
| [`pydantic` ](https://github.com/pydantic/pydantic ) | MIT | runtime dependency of `deepseek-harness` |
2026-07-29 21:29:49 -07:00
| [`pytest` ](https://github.com/pytest-dev/pytest ) | MIT | test-only |
| [`uv` ](https://github.com/astral-sh/uv ) | MIT / Apache-2.0 | development workflow tool |
## Fetched at build time
| Package | License | Role |
| --- | --- | --- |
| [`@yao-pkg/pkg` ](https://github.com/yao-pkg/pkg ) | MIT | invoked by `scripts/build-exe-for-python-sdk.ts` to assemble the single-file SDK runtime executable |
## First-party sibling releases
`node-addon-landlock-run` (and its platform packages) is released from a DeepSeek Harness sibling repository under BSD 3-Clause. It is listed here for completeness; it is first-party, not third-party.
