mirror of https://github.com/deepseek-ai/deepseek-harness.git synced 2026-08-29 04:26:38 +00:00

Files

T

ZiyaZhang 19606bc331 docs: generate THIRD_PARTY_NOTICES.md and gate it in doc-sync

Replace the hand-written inventory with scripts/gen-third-party-notices.ts,
verified fresh by a doc-sync leaf gate. Tier by declaring workspace area
rather than manifest section, so test-support runtime declarations stay
dev-only and every mountable plugin's dependencies are disclosed as
runtime; list the pnpm-patched packages; point the Python closure at
uv.lock. Re-record the translation-prompt snapshot the README link
invalidated.

2026-07-30 07:27:13 -07:00

11 KiB

Raw Blame History

Third-Party Notices

DeepSeek Harness is licensed under BSD 3-Clause. It depends on the third-party open-source software listed below. Each project remains under its own license; nothing in this file changes those terms.

This file lists direct dependencies declared by the workspace, generated from the workspace manifests by scripts/gen-third-party-notices.ts and verified fresh by pnpm run verify-third-party-notices (part of doc-sync). The complete npm transitive closure, with exact pinned versions, is recorded in pnpm-lock.yaml (inspect it with pnpm licenses list); the Python closure is recorded in python/sdk/uv.lock.

Vendored source (`vendor/`)

The Cordis framework and its foundation libraries are source-vendored into this repository rather than consumed from npm. All are MIT-licensed; each directory preserves its upstream LICENSE file. Exact upstream commits and local modifications are recorded in vendor/README.md.

Package	Upstream	License
`cosmokit`	github.com/deepseek-harness/cosmokit	MIT
`schemastery`	github.com/deepseek-harness/schemastery	MIT
`cordis`	github.com/cordiverse/cordis	MIT
`@cordisjs/plugin-loader`	github.com/cordiverse/cordis	MIT
`@cordisjs/plugin-include`	github.com/deepseek-harness/cordis	MIT
`@cordisjs/plugin-group`	github.com/deepseek-harness/cordis	MIT
`@cordisjs/plugin-timer`	github.com/deepseek-harness/cordis	MIT
`@cordisjs/plugin-hmr`	github.com/deepseek-harness/cordis	MIT
`@cordisjs/plugin-logger-console`	github.com/deepseek-harness/cordis	MIT

Runtime npm dependencies

External packages that a workspace package resolves at runtime. scripts/install.sh installs this repository itself, so the tier covers every plugin a user can mount from cordis.yml — not only what the dsh CLI/TUI, the Web UI, and the Python SDK runtime load by default.

Package	License
`@agentclientprotocol/sdk`	Apache-2.0
`@babel/code-frame`	MIT
`@clack/core`	MIT
`@clack/prompts`	MIT
`@earendil-works/pi-ai`	MIT
`@earendil-works/pi-tui`	MIT
`@joplin/turndown-plugin-gfm`	MIT
`@modelcontextprotocol/sdk`	MIT
`@opentelemetry/api`	Apache-2.0
`@opentelemetry/api-logs`	Apache-2.0
`@opentelemetry/exporter-logs-otlp-http`	Apache-2.0
`@opentelemetry/otlp-exporter-base`	Apache-2.0
`@opentelemetry/resources`	Apache-2.0
`@opentelemetry/sdk-logs`	Apache-2.0
`@shikijs/langs`	MIT
`@standard-schema/spec`	MIT
`anser`	MIT
`chokidar`	MIT
`clsx`	MIT
`commander`	MIT
`diff`	BSD-3-Clause
`eventsource-parser`	MIT
`handlebars`	MIT
`immer`	MIT
`js-yaml`	MIT
`jsonc-parser`	MIT
`koffi`	MIT
`mdast-util-from-markdown`	MIT
`mdast-util-gfm`	MIT
`micromark-extension-gfm`	MIT
`node-addon-require-builtin`	MIT
`node-pty`	MIT
`picomatch`	MIT
`react`	MIT
`react-dom`	MIT
`react-markdown`	MIT
`remark-gfm`	MIT
`saxes`	ISC
`shiki`	MIT
`supports-color`	MIT
`tsx`	MIT
`turndown`	MIT
`typescript`	Apache-2.0
`use-sync-external-store`	MIT
`yaml`	ISC
`zod`	MIT
`zustand`	MIT

pnpm applies local patches to the following packages at install time, so shipped artifacts carry modified copies; each patch file is the complete record of the modification:

@earendil-works/pi-tui@0.80.7 — patches/@earendil-works__pi-tui@0.80.7.patch
node-pty@1.1.0 — patches/node-pty@1.1.0.patch

Development-only npm dependencies

External packages declared only by repository tooling, test infrastructure, the documentation site, the demo leaves, or the native launcher's build workspace. They are not part of any shipped runtime artifact.

Package	License
`@braintree/sanitize-url`	MIT
`@modelcontextprotocol/server-everything`	MIT / Apache-2.0
`@modelcontextprotocol/server-filesystem`	MIT / Apache-2.0
`@stylistic/eslint-plugin`	MIT
`@testing-library/dom`	MIT
`@testing-library/react`	MIT
`@types/babel__code-frame`	MIT
`@types/js-yaml`	MIT
`@types/jsdom`	MIT
`@types/mdast`	MIT
`@types/node`	MIT
`@types/picomatch`	MIT
`@types/react`	MIT
`@types/react-dom`	MIT
`@types/turndown`	MIT
`@typescript-eslint/parser`	MIT
`@vitejs/plugin-react`	MIT
`@vitest/coverage-v8`	MIT
`@xterm/headless`	MIT
`@yarnpkg/cli-dist`	BSD-2-Clause
`cytoscape`	MIT
`cytoscape-cose-bilkent`	MIT
`dayjs`	MIT
`debug`	MIT
`esbuild`	MIT
`eslint`	MIT
`eslint-plugin-sonarjs`	LGPL-3.0-only
`execa`	MIT
`fast-check`	MIT
`jscpd`	MIT
`jsdom`	MIT
`knip`	ISC
`lefthook`	MIT
`lightningcss`	MPL-2.0
`mermaid`	MIT
`oxlint`	MIT
`oxlint-tsgolint`	MIT
`playwright`	Apache-2.0
`publint`	MIT
`tsdown`	MIT
`typescript-language-server`	Apache-2.0
`vite`	MIT
`vite-tsconfig-paths`	MIT
`vitepress`	MIT
`vitepress-plugin-mermaid`	MIT
`vitest`	MIT

eslint-plugin-sonarjs (LGPL-3.0-only) and lightningcss (MPL-2.0) run only as development tooling; their code is not linked into or distributed with any DeepSeek Harness artifact.

Python SDK dependencies (`python/`)

Direct dependencies of the pyproject.toml manifests, plus uv as the development workflow tool.

Package	License	Role
`hatchling`	MIT	build backend
`pydantic`	MIT	runtime dependency of `deepseek-harness`
`pytest`	MIT	test-only
`uv`	MIT / Apache-2.0	development workflow tool

Fetched at build time

Package	License	Role
`@yao-pkg/pkg`	MIT	invoked by `scripts/build-exe-for-python-sdk.ts` to assemble the single-file SDK runtime executable

First-party sibling releases

node-addon-landlock-run (and its platform packages) is released from a DeepSeek Harness sibling repository under BSD 3-Clause. It is listed here for completeness; it is first-party, not third-party.

11 KiB Raw Blame History