diff --git a/THIRD_PARTY_NOTICES.md b/THIRD_PARTY_NOTICES.md index b03dad17cd..a62d3ed8ac 100644 --- a/THIRD_PARTY_NOTICES.md +++ b/THIRD_PARTY_NOTICES.md @@ -5,7 +5,7 @@ DeepSeek Harness is licensed under [MIT](LICENSE). It depends on the third-party software listed below. Each project remains under its own license; nothing in this file changes those terms. -This file lists **direct** dependencies declared by the workspace and the explicitly disclosed official Claude Code and Codex platform payload closures. It is generated from the workspace manifests by `scripts/gen-third-party-notices.ts`: a pre-commit hook regenerates it whenever a staged file changes one of its inputs, and `scripts/gen-third-party-notices.spec.ts` asserts in the test lane that the committed bytes match. Deleting a manifest runs no hook, so that case is caught by the assertion instead. Run `pnpm run verify-third-party-notices` for the standalone check. +This file lists **direct** dependencies declared by the workspace and the explicitly disclosed official Claude Code platform payload closure. It is generated from the workspace manifests by `scripts/gen-third-party-notices.ts`: a pre-commit hook regenerates it whenever a staged file changes one of its inputs, and `scripts/gen-third-party-notices.spec.ts` asserts in the test lane that the committed bytes match. Deleting a manifest runs no hook, so that case is caught by the assertion instead. Run `pnpm run verify-third-party-notices` for the standalone check. The complete npm transitive closure, including the Landlock launcher workspace, is recorded with exact pinned versions in [`pnpm-lock.yaml`](pnpm-lock.yaml) — inspect it with `pnpm licenses list`. The Python closure is recorded separately in [`python/sdk/uv.lock`](python/sdk/uv.lock). @@ -114,20 +114,6 @@ The installed SDK 0.3.220 declares the following optional platform packages. Eac | [`@anthropic-ai/claude-agent-sdk-win32-x64`](https://www.npmjs.com/package/@anthropic-ai/claude-agent-sdk-win32-x64) | 0.3.220 | SEE LICENSE IN LICENSE.md | -## Official Codex platform payloads - -The installed `@openai/codex` wrapper 0.147.0 declares the following optional-dependency aliases. Every alias resolves to an official platform-specific `@openai/codex` version that carries the native Codex CLI and its bundled resources; the declared license is verified against the payload installed for the current host. - -| Optional dependency alias | Published package | Version | Declared license | -| --- | --- | --- | --- | -| `@openai/codex-darwin-arm64` | [`@openai/codex`](https://www.npmjs.com/package/@openai/codex/v/0.147.0-darwin-arm64) | 0.147.0-darwin-arm64 | Apache-2.0 | -| `@openai/codex-darwin-x64` | [`@openai/codex`](https://www.npmjs.com/package/@openai/codex/v/0.147.0-darwin-x64) | 0.147.0-darwin-x64 | Apache-2.0 | -| `@openai/codex-linux-arm64` | [`@openai/codex`](https://www.npmjs.com/package/@openai/codex/v/0.147.0-linux-arm64) | 0.147.0-linux-arm64 | Apache-2.0 | -| `@openai/codex-linux-x64` | [`@openai/codex`](https://www.npmjs.com/package/@openai/codex/v/0.147.0-linux-x64) | 0.147.0-linux-x64 | Apache-2.0 | -| `@openai/codex-win32-arm64` | [`@openai/codex`](https://www.npmjs.com/package/@openai/codex/v/0.147.0-win32-arm64) | 0.147.0-win32-arm64 | Apache-2.0 | -| `@openai/codex-win32-x64` | [`@openai/codex`](https://www.npmjs.com/package/@openai/codex/v/0.147.0-win32-x64) | 0.147.0-win32-x64 | Apache-2.0 | - - ## Development-only npm dependencies External packages **directly declared** only by repository tooling, test infrastructure, the documentation site, the demo leaves, or the native launcher's build workspace. No shipped surface names them itself. A package here may still be pulled in transitively by a runtime dependency — `pnpm-lock.yaml` is the authority on the full closure — so this tier records who declares a package, not what a build ultimately bundles. diff --git a/scripts/gen-third-party-notices.spec.ts b/scripts/gen-third-party-notices.spec.ts index 363328ca2f..479a2f13b1 100644 --- a/scripts/gen-third-party-notices.spec.ts +++ b/scripts/gen-third-party-notices.spec.ts @@ -4,10 +4,7 @@ import { tmpdir } from 'node:os' import { describe, expect, it } from 'vitest' import { CLAUDE_AGENT_SDK_PACKAGE, - CODEX_PACKAGE, claudeDistributionFromManifest, - codexDistributionFromManifest, - codexDistributionFromInstalledPackage, collectPythonDependencies, isOwnerAuthorizedRuntime, isPermissive, @@ -334,94 +331,6 @@ describe('official Claude distribution authorization', () => { }) }) -describe('official Codex platform payloads', () => { - it('derives versioned packages from the wrapper aliases', () => { - expect(codexDistributionFromManifest({ - name: CODEX_PACKAGE, - version: '9.8.7', - optionalDependencies: { - '@openai/codex-linux-x64': 'npm:@openai/codex@9.8.7-linux-x64', - '@openai/codex-darwin-arm64': 'npm:@openai/codex@9.8.7-darwin-arm64', - }, - })).toEqual({ - wrapperVersion: '9.8.7', - payloads: [ - { alias: '@openai/codex-darwin-arm64', version: '9.8.7-darwin-arm64' }, - { alias: '@openai/codex-linux-x64', version: '9.8.7-linux-x64' }, - ], - }) - }) - - it('rejects a wrong identity, missing payloads, and non-official aliases', () => { - expect(() => codexDistributionFromManifest({ - name: '@openai/unrelated', - version: '1.0.0', - optionalDependencies: { - '@openai/codex-linux-x64': 'npm:@openai/codex@1.0.0-linux-x64', - }, - })).toThrow(`expected ${CODEX_PACKAGE} manifest`) - expect(() => codexDistributionFromManifest({ - name: CODEX_PACKAGE, - version: '1.0.0', - })).toThrow('declares no optional platform payloads') - expect(() => codexDistributionFromManifest({ - name: CODEX_PACKAGE, - version: '1.0.0', - optionalDependencies: { - '@openai/unrelated': 'npm:@openai/codex@1.0.0-linux-x64', - }, - })).toThrow('outside its platform alias namespace') - expect(() => codexDistributionFromManifest({ - name: CODEX_PACKAGE, - version: '1.0.0', - optionalDependencies: { - '@openai/codex-linux-x64': '1.0.0', - }, - })).toThrow('does not alias an official versioned payload') - }) - - it('resolves installed payload aliases from the wrapper package', () => { - const fixtureRoot = mkdtempSync(join(tmpdir(), 'dsh-notices-codex-wrapper-')) - try { - const wrapperPath = join( - fixtureRoot, - 'node_modules/@openai/codex/package.json', - ) - mkdirSync(resolve(wrapperPath, '..'), { recursive: true }) - writeFileSync(wrapperPath, JSON.stringify({ - name: CODEX_PACKAGE, - version: '9.8.7', - optionalDependencies: { - '@openai/codex-darwin-arm64': 'npm:@openai/codex@9.8.7-darwin-arm64', - '@openai/codex-linux-x64': 'npm:@openai/codex@9.8.7-linux-x64', - }, - })) - for (const platform of ['darwin-arm64', 'linux-x64']) { - const payloadPath = join( - fixtureRoot, - `node_modules/@openai/codex-${platform}/package.json`, - ) - mkdirSync(resolve(payloadPath, '..'), { recursive: true }) - writeFileSync(payloadPath, JSON.stringify({ - name: CODEX_PACKAGE, - version: `9.8.7-${platform}`, - license: 'Apache-2.0', - })) - } - - expect(codexDistributionFromInstalledPackage(wrapperPath)).toEqual({ - wrapperVersion: '9.8.7', - payloads: [ - { alias: '@openai/codex-darwin-arm64', version: '9.8.7-darwin-arm64' }, - { alias: '@openai/codex-linux-x64', version: '9.8.7-linux-x64' }, - ], - }) - } finally { - rmSync(fixtureRoot, { recursive: true, force: true }) - } - }) -}) - describe('manifestPatterns', () => { it('derives globs from the declared members, so a new member area is read', () => { expect(manifestPatterns(['packages/*/*', 'tools/*', 'native/landlock-run', 'native/landlock-run/packages/*'])).toEqual([ diff --git a/scripts/gen-third-party-notices.ts b/scripts/gen-third-party-notices.ts index 314c9b1b28..3362251f1e 100644 --- a/scripts/gen-third-party-notices.ts +++ b/scripts/gen-third-party-notices.ts @@ -9,7 +9,6 @@ */ import { existsSync, globSync, readdirSync, readFileSync, writeFileSync } from 'node:fs' -import { createRequire } from 'node:module' import { resolve } from 'node:path' import * as yaml from 'js-yaml' import { parse as parseToml, type TomlTableWithoutBigInt, type TomlValueWithoutBigInt } from 'smol-toml' @@ -51,9 +50,6 @@ const FIRST_PARTY = new Set([ export const CLAUDE_AGENT_SDK_PACKAGE = '@anthropic-ai/claude-agent-sdk' const CLAUDE_PLATFORM_PACKAGE_PREFIX = `${CLAUDE_AGENT_SDK_PACKAGE}-` const CLAUDE_PLATFORM_DECLARED_LICENSE = 'SEE LICENSE IN LICENSE.md' -export const CODEX_PACKAGE = '@openai/codex' -const CODEX_PLATFORM_ALIAS_PREFIX = `${CODEX_PACKAGE}-` -const CODEX_DECLARED_LICENSE = 'Apache-2.0' /** * Whether a non-permissive runtime declaration has an identity-scoped owner @@ -198,18 +194,6 @@ export interface ClaudeDistribution { readonly payloads: ClaudePlatformPayload[] } -/** One optional-dependency alias for an official Codex platform payload. */ -export interface CodexPlatformPayload { - readonly alias: string - readonly version: string -} - -/** Current Codex wrapper and platform payload facts from the official manifest. */ -export interface CodexDistribution { - readonly wrapperVersion: string - readonly payloads: CodexPlatformPayload[] -} - function requiredManifestString( value: string | undefined, field: string, @@ -259,91 +243,6 @@ export function claudeDistributionFromManifest( return { sdkVersion, claudeCodeVersion, payloads } } -/** Derive official Codex platform aliases and published package versions. */ -export function codexDistributionFromManifest( - manifest: VirtualManifest, -): CodexDistribution { - if (manifest.name !== CODEX_PACKAGE) { - throw new Error( - `gen-third-party-notices: expected ${CODEX_PACKAGE} manifest, got ${JSON.stringify(manifest.name)}.`, - ) - } - const wrapperVersion = manifest.version - if (wrapperVersion === undefined || wrapperVersion.length === 0) { - throw new Error(`gen-third-party-notices: ${CODEX_PACKAGE} has no version.`) - } - const entries = Object.entries(manifest.optionalDependencies ?? {}) - if (entries.length === 0) { - throw new Error(`gen-third-party-notices: ${CODEX_PACKAGE} declares no optional platform payloads.`) - } - const payloads = entries.map(([alias, spec]) => { - if (!alias.startsWith(CODEX_PLATFORM_ALIAS_PREFIX)) { - throw new Error( - `gen-third-party-notices: ${CODEX_PACKAGE} optional dependency ${alias} is outside its platform alias namespace.`, - ) - } - const prefix = `npm:${CODEX_PACKAGE}@` - if (!spec.startsWith(prefix) || spec.length === prefix.length) { - throw new Error( - `gen-third-party-notices: ${CODEX_PACKAGE} optional dependency ${alias} does not alias an official versioned payload.`, - ) - } - return { alias, version: spec.slice(prefix.length) } - }).sort((left, right) => left.alias.localeCompare(right.alias)) - return { wrapperVersion, payloads } -} - -function requireManifest( - requireFrom: NodeJS.Require, - name: string, -): VirtualManifest | undefined { - let packageJsonPath: string - try { - packageJsonPath = requireFrom.resolve(`${name}/package.json`) - } catch (error: unknown) { - if (error instanceof Error && 'code' in error && error.code === 'MODULE_NOT_FOUND') { - return undefined - } - throw error - } - return JSON.parse(readFileSync(packageJsonPath, 'utf8')) as VirtualManifest -} - -/** - * Derive and verify the Codex distribution from the wrapper package's own - * Node resolution context. - * @param packageJsonPath - absolute manifest path for the installed wrapper. - * @returns the wrapper version and all declared platform aliases. - */ -export function codexDistributionFromInstalledPackage( - packageJsonPath: string, -): CodexDistribution { - const manifest = JSON.parse(readFileSync(packageJsonPath, 'utf8')) as VirtualManifest - const distribution = codexDistributionFromManifest(manifest) - const requireFromWrapper = createRequire(packageJsonPath) - let installedPayloads = 0 - for (const payload of distribution.payloads) { - const installed = requireManifest(requireFromWrapper, payload.alias) - if (installed === undefined) continue - installedPayloads += 1 - if ( - installed.name !== CODEX_PACKAGE - || installed.version !== payload.version - || installed.license !== CODEX_DECLARED_LICENSE - ) { - throw new Error( - `gen-third-party-notices: installed ${payload.alias} does not match its official ${CODEX_PACKAGE}@${payload.version} payload and ${CODEX_DECLARED_LICENSE} license.`, - ) - } - } - if (installedPayloads === 0) { - throw new Error( - 'gen-third-party-notices: no Codex platform payload is installed; install optional dependencies before regenerating.', - ) - } - return distribution -} - /** * Resolve one package's manifest inside a pnpm virtual store. The prefix scan * matches ordinary `@scope+name@version` directory names; pnpm 11 truncates @@ -434,20 +333,6 @@ function collectClaudeDistribution(): ClaudeDistribution { return distribution } -function collectCodexDistribution(): CodexDistribution { - const requireFromProvider = createRequire(resolve( - root, - 'packages/subagent/subagent-codex/package.json', - )) - let packageJsonPath: string - try { - packageJsonPath = requireFromProvider.resolve(`${CODEX_PACKAGE}/package.json`) - } catch { - throw new Error(`gen-third-party-notices: cannot resolve ${CODEX_PACKAGE}; run \`pnpm install\`.`) - } - return codexDistributionFromInstalledPackage(packageJsonPath) -} - /** Normalize a manifest repository/homepage value to a browsable https URL. */ function normalizeRepo(raw: string | undefined): string | undefined { if (raw === undefined || raw === '') return undefined @@ -771,24 +656,6 @@ ${rows.join('\n')} ` } -function renderCodexDistribution( - distribution: CodexDistribution | undefined, -): string { - if (distribution === undefined) return '' - const rows = distribution.payloads.map(payload => ( - `| \`${payload.alias}\` | [\`${CODEX_PACKAGE}\`](https://www.npmjs.com/package/${CODEX_PACKAGE}/v/${payload.version}) | ${payload.version} | ${CODEX_DECLARED_LICENSE} |` - )) - return ` -## Official Codex platform payloads - -The installed \`${CODEX_PACKAGE}\` wrapper ${distribution.wrapperVersion} declares the following optional-dependency aliases. Every alias resolves to an official platform-specific \`${CODEX_PACKAGE}\` version that carries the native Codex CLI and its bundled resources; the declared license is verified against the payload installed for the current host. - -| Optional dependency alias | Published package | Version | Declared license | -| --- | --- | --- | --- | -${rows.join('\n')} -` -} - /** * Render the complete notices document. * @returns the exact bytes `THIRD_PARTY_NOTICES.md` must hold. @@ -806,10 +673,6 @@ export function render(): string { ) ? collectClaudeDistribution() : undefined - const codexDistribution = runtimeDeps.some(dep => dep.name === CODEX_PACKAGE) - ? collectCodexDistribution() - : undefined - const nonPermissiveDev = devDeps.filter(dep => !isPermissive(dep.license)) // A copyleft license reaching a shipped surface is a distribution decision, // not a rendering detail; the notices cannot quietly absorb it. @@ -829,7 +692,7 @@ export function render(): string { DeepSeek Harness is licensed under [MIT](LICENSE). It depends on the third-party software listed below. Each project remains under its own license; nothing in this file changes those terms. -This file lists **direct** dependencies declared by the workspace and the explicitly disclosed official Claude Code and Codex platform payload closures. It is generated from the workspace manifests by \`scripts/gen-third-party-notices.ts\`: a pre-commit hook regenerates it whenever a staged file changes one of its inputs, and \`scripts/gen-third-party-notices.spec.ts\` asserts in the test lane that the committed bytes match. Deleting a manifest runs no hook, so that case is caught by the assertion instead. Run \`pnpm run verify-third-party-notices\` for the standalone check. +This file lists **direct** dependencies declared by the workspace and the explicitly disclosed official Claude Code platform payload closure. It is generated from the workspace manifests by \`scripts/gen-third-party-notices.ts\`: a pre-commit hook regenerates it whenever a staged file changes one of its inputs, and \`scripts/gen-third-party-notices.spec.ts\` asserts in the test lane that the committed bytes match. Deleting a manifest runs no hook, so that case is caught by the assertion instead. Run \`pnpm run verify-third-party-notices\` for the standalone check. The complete npm transitive closure, including the Landlock launcher workspace, is recorded with exact pinned versions in [\`pnpm-lock.yaml\`](pnpm-lock.yaml) — inspect it with \`pnpm licenses list\`. The Python closure is recorded separately in [\`python/sdk/uv.lock\`](python/sdk/uv.lock). @@ -851,7 +714,6 @@ pnpm applies local patches to the following packages at install time, so shipped ${patchedLines.join('\n')} ${renderClaudeDistribution(claudeDistribution)} -${renderCodexDistribution(codexDistribution)} ## Development-only npm dependencies