mirror of https://github.com/deepseek-ai/deepseek-harness.git synced 2026-09-14 04:01:35 +00:00

Files

T

imccyu c732dedc69 fix(python): stop the packaged runtime from hijacking spawned node commands

@yao-pkg/pkg's SEA bootstrap rewrites child_process commands named node --
including the string after a -c flag, exactly the Bash tool's bash -c form --
to the executable itself and stamps PKG_EXECPATH into every child
environment, so a model-issued 'node --version' silently booted the dsh CLI
instead of the machine's Node. Pin the packager as an exact root
devDependency invoked through pnpm exec and patch out the single
patchChildProcess call from the SEA bootstrap bundle; packaged children now
resolve node through PATH like any other process. The third-party notices
drop the build-time tools section: the packager is now a declared, patched
devDependency, so the manifest and patch tiers disclose it.

2026-09-02 21:36:23 +08:00

17 KiB

Raw Blame History

Third-Party Notices

DeepSeek Harness is licensed under MIT. It depends on the third-party software listed below. Each project remains under its own license; nothing in this file changes those terms.

This file lists direct dependencies declared by the workspace and the explicitly disclosed official Claude Code platform payload closure. It is generated from the workspace manifests by scripts/gen-third-party-notices.ts: a pre-commit hook regenerates it whenever a staged file changes one of its inputs, and scripts/gen-third-party-notices.spec.ts asserts in the test lane that the committed bytes match. Deleting a manifest runs no hook, so that case is caught by the assertion instead. Run pnpm run verify-third-party-notices for the standalone check.

The complete npm transitive closure, including the Landlock launcher workspace, is recorded with exact pinned versions in pnpm-lock.yaml — inspect it with pnpm licenses list. The Python closure is recorded separately in python/sdk/uv.lock.

Vendored source (`vendor/`)

The Cordis framework and its foundation libraries are source-vendored into this repository rather than consumed from npm, and republished under the @deepseek-ai scope. All are MIT-licensed; each directory preserves its upstream LICENSE file. Exact upstream commits and local modifications are recorded in vendor/README.md.

Package	Upstream name	Upstream	License
`@deepseek-ai/cosmokit`	`cosmokit`	github.com/deepseek-harness/cosmokit	MIT
`@deepseek-ai/schemastery`	`schemastery`	github.com/deepseek-harness/schemastery	MIT
`@deepseek-ai/cordis`	`cordis`	github.com/cordiverse/cordis	MIT
`@deepseek-ai/cordis-plugin-loader`	`@cordisjs/plugin-loader`	github.com/cordiverse/cordis	MIT
`@deepseek-ai/cordis-plugin-include`	`@cordisjs/plugin-include`	github.com/deepseek-harness/cordis	MIT
`@deepseek-ai/cordis-plugin-group`	`@cordisjs/plugin-group`	github.com/deepseek-harness/cordis	MIT
`@deepseek-ai/cordis-plugin-timer`	`@cordisjs/plugin-timer`	github.com/deepseek-harness/cordis	MIT
`@deepseek-ai/cordis-plugin-hmr`	`@cordisjs/plugin-hmr`	github.com/deepseek-harness/cordis	MIT
`@deepseek-ai/cordis-plugin-logger-console`	`@cordisjs/plugin-logger-console`	github.com/deepseek-harness/cordis	MIT

Runtime npm dependencies

External packages that a workspace package resolves at runtime. The tier covers every plugin a user can mount from cordis.yml — not only what the dsh CLI, Web UI, and Python SDK runtime load by default.

Package	License
`@agentclientprotocol/sdk`	Apache-2.0
`@anthropic-ai/claude-agent-sdk`	SEE LICENSE IN README.md
`@anthropic-ai/sdk`	MIT
`@babel/code-frame`	MIT
`@earendil-works/pi-ai`	MIT
`@joplin/turndown-plugin-gfm`	MIT
`@jridgewell/gen-mapping`	MIT
`@lexical/history`	MIT
`@lexical/plain-text`	MIT
`@lexical/text`	MIT
`@lexical/utils`	MIT
`@modelcontextprotocol/sdk`	MIT
`@noble/hashes`	MIT
`@octokit/webhooks`	MIT
`@openai/codex`	Apache-2.0
`@opentelemetry/api`	Apache-2.0
`@opentelemetry/api-logs`	Apache-2.0
`@opentelemetry/exporter-logs-otlp-http`	Apache-2.0
`@opentelemetry/otlp-exporter-base`	Apache-2.0
`@opentelemetry/resources`	Apache-2.0
`@opentelemetry/sdk-logs`	Apache-2.0
`@shikijs/langs`	MIT
`@standard-schema/spec`	MIT
`@tanstack/react-virtual`	MIT
`@types/mdast`	MIT
`@vscode/ripgrep`	MIT
`@xterm/headless`	MIT
`@yarnpkg/parsers`	BSD-2-Clause
`acorn`	MIT
`anser`	MIT
`buffer`	MIT
`chokidar`	MIT
`clsx`	MIT
`commander`	MIT
`compression`	MIT
`diff`	BSD-3-Clause
`e2b`	MIT
`eventsource-parser`	MIT
`fflate`	MIT
`immer`	MIT
`ipaddr.js`	MIT
`js-yaml`	MIT
`katex`	MIT
`koffi`	MIT
`lexical`	MIT
`mdast-util-from-markdown`	MIT
`mdast-util-gfm`	MIT
`mdast-util-math`	MIT
`micromark-core-commonmark`	MIT
`micromark-extension-gfm`	MIT
`micromark-extension-math`	MIT
`micromark-factory-space`	MIT
`micromark-util-character`	MIT
`micromark-util-classify-character`	MIT
`micromark-util-sanitize-uri`	MIT
`micromark-util-symbol`	MIT
`micromark-util-types`	MIT
`negotiator`	MIT
`node-addon-require-builtin`	MIT
`node-pty`	MIT
`open`	MIT
`picomatch`	MIT
`react`	MIT
`react-dom`	MIT
`readable-stream`	MIT
`resolve.exports`	MIT
`sharp`	Apache-2.0
`shiki`	MIT
`supports-color`	MIT
`tsx`	MIT
`turndown`	MIT
`typescript`	Apache-2.0
`undici`	MIT
`use-sync-external-store`	MIT
`ws`	MIT
`yaml`	ISC
`zod`	MIT
`zustand`	MIT

pnpm applies local patches to the following packages at install time, so shipped artifacts carry modified copies; each patch file is the complete record of the modification:

@yao-pkg/pkg@6.21.0 — patches/@yao-pkg__pkg@6.21.0.patch
node-pty@1.2.0-beta.15 — patches/node-pty@1.2.0-beta.15.patch

Official Claude Code platform payloads

The project owner authorizes distribution of every version of the official @anthropic-ai/claude-agent-sdk package and the official Claude Code CLI/platform payloads that each version declares through optionalDependencies. This identity-scoped authorization does not classify their declared terms as permissive and does not cover any unrelated runtime package; version, declared-license, and payload-set changes still require the ordinary dependency, lockfile, compatibility, terms, and notices review.

The installed SDK 0.3.241 declares the following optional platform packages. Each carries the official Claude Code 2.1.241 executable; the package identities and versions come from the SDK manifest, while the declared license field is verified against the platform payload installed for the current host.

Optional platform package	Version	Declared license
`@anthropic-ai/claude-agent-sdk-darwin-arm64`	0.3.241	SEE LICENSE IN LICENSE.md
`@anthropic-ai/claude-agent-sdk-darwin-x64`	0.3.241	SEE LICENSE IN LICENSE.md
`@anthropic-ai/claude-agent-sdk-linux-arm64`	0.3.241	SEE LICENSE IN LICENSE.md
`@anthropic-ai/claude-agent-sdk-linux-arm64-musl`	0.3.241	SEE LICENSE IN LICENSE.md
`@anthropic-ai/claude-agent-sdk-linux-x64`	0.3.241	SEE LICENSE IN LICENSE.md
`@anthropic-ai/claude-agent-sdk-linux-x64-musl`	0.3.241	SEE LICENSE IN LICENSE.md
`@anthropic-ai/claude-agent-sdk-win32-arm64`	0.3.241	SEE LICENSE IN LICENSE.md
`@anthropic-ai/claude-agent-sdk-win32-x64`	0.3.241	SEE LICENSE IN LICENSE.md

Development-only npm dependencies

External packages directly declared only by repository tooling, test infrastructure, the documentation site, the demo leaves, or the native launcher's build workspace. No shipped surface names them itself. A package here may still be pulled in transitively by a runtime dependency — pnpm-lock.yaml is the authority on the full closure — so this tier records who declares a package, not what a build ultimately bundles.

Package	License
`@braintree/sanitize-url`	MIT
`@lexical/headless`	MIT
`@modelcontextprotocol/server-everything`	MIT / Apache-2.0
`@modelcontextprotocol/server-filesystem`	MIT / Apache-2.0
`@stylistic/eslint-plugin`	MIT
`@testing-library/dom`	MIT
`@testing-library/react`	MIT
`@types/babel__code-frame`	MIT
`@types/compression`	MIT
`@types/js-yaml`	MIT
`@types/jsdom`	MIT
`@types/negotiator`	MIT
`@types/node`	MIT
`@types/picomatch`	MIT
`@types/react`	MIT
`@types/react-dom`	MIT
`@types/readable-stream`	MIT
`@types/spdx-expression-parse`	MIT
`@types/turndown`	MIT
`@types/use-sync-external-store`	MIT
`@types/ws`	MIT
`@vitejs/plugin-react`	MIT
`@vitest/coverage-v8`	MIT
`@yao-pkg/pkg`	MIT
`@yarnpkg/cli-dist`	BSD-2-Clause
`cytoscape`	MIT
`cytoscape-cose-bilkent`	MIT
`dayjs`	MIT
`debug`	MIT
`esbuild`	MIT
`eslint-plugin-sonarjs`	LGPL-3.0-only
`execa`	MIT
`fast-check`	MIT
`http-server`	MIT
`istanbul-lib-report`	BSD-3-Clause
`jscpd`	MIT
`jsdom`	MIT
`lefthook`	MIT
`lightningcss`	MPL-2.0
`mermaid`	MIT
`oxlint`	MIT
`oxlint-tsgolint`	MIT
`playwright`	Apache-2.0
`publint`	MIT
`smol-toml`	BSD-3-Clause
`spdx-expression-parse`	MIT
`tsdown`	MIT
`typescript-language-server`	Apache-2.0
`vite`	MIT
`vite-tsconfig-paths`	MIT
`vitepress`	MIT
`vitepress-plugin-mermaid`	MIT
`vitest`	MIT

eslint-plugin-sonarjs (LGPL-3.0-only) and lightningcss (MPL-2.0) run only as development tooling; their code is not linked into or distributed with any DeepSeek Harness artifact.

Python SDK dependencies (`python/`)

Direct dependencies of the pyproject.toml manifests, plus uv as the development workflow tool.

Package	License	Role
`hatchling`	MIT	build backend
`pydantic`	MIT	runtime dependency of `deepseek-harness-sdk`
`pytest`	MIT	test-only
`uv`	MIT / Apache-2.0	development workflow tool

First-party native packages

@deepseek-ai/node-addon-landlock-run (and its platform packages) is built and released from this repository under BSD 3-Clause. It is listed here for completeness; it is first-party, not third-party.

17 KiB Raw Blame History