DeepSeek/deepseek-harness
1
0 Fork 0
mirror of https://github.com/deepseek-ai/deepseek-harness.git synced 2026-10-26 16:55:08 +00:00
Code Issues Packages Projects Releases Wiki Activity
Files
a53ecb2f3a06ff28c7851bec93372dff2cfc9af6
deepseek-harness/THIRD_PARTY_NOTICES.md
T
_Kerman 427d62d4a7 fix(ptc-runtime-node): fail fast on mismatched bootstraps and late replies 
- Reject a control line that does not start with "{", so another
  release's length-prefixed frame fails as a protocol error instead of
  waiting for a newline until the deadline.
- Bump SSH_PROTOCOL_VERSION to 3: executable helpers embed the PTC
  worker, so an older helper is now rejected while connecting.
- Send a small error instead of a late binding result from a finished
  persistent evaluation, so it cannot overflow the pipe shared with
  the next evaluation.
- Leave per-call binding waits pending after the result instead of
  rejecting them; unawaited calls crashed the child and leaked the
  trace into the result logs.
- Pin birpc to 4.2.0 so the host and the bundled child agree, and
  regenerate THIRD_PARTY_NOTICES.md.
- Update stale frame wording.
2026-10-20 16:06:50 +08:00

25 KiB
Raw Blame History

Third-Party Notices

DeepSeek Harness is licensed under MIT. It depends on the third-party software listed below. Each project remains under its own license; nothing in this file changes those terms.

This file lists direct dependencies declared by the workspace, the explicitly disclosed official Claude Code platform payload closure, and the Bundled Python distributions. It is generated by scripts/gen-third-party-notices.ts, and scripts/gen-third-party-notices.spec.ts asserts in the test lane that the committed bytes match. Run pnpm run gen-third-party-notices after changing one of its inputs, or pnpm run verify-third-party-notices for the standalone check.

The complete npm transitive closure, including the Landlock launcher workspace, is recorded with exact pinned versions in pnpm-lock.yaml — inspect it with pnpm licenses list. The Python SDK closure is recorded separately in python/sdk/uv.lock.

Vendored source (vendor/)

The Cordis framework and its foundation libraries are source-vendored into this repository rather than consumed from npm, and republished under the @deepseek-ai scope. All are MIT-licensed; each directory preserves its upstream LICENSE file. Exact upstream commits and local modifications are recorded in vendor/README.md.

Package Upstream name Source License
@deepseek-ai/cosmokit cosmokit vendor/cosmokit MIT
@deepseek-ai/schemastery schemastery vendor/schemastery MIT
@deepseek-ai/cordis cordis vendor/cordis MIT
@deepseek-ai/cordis-plugin-loader @cordisjs/plugin-loader vendor/loader MIT
@deepseek-ai/cordis-plugin-include @cordisjs/plugin-include vendor/include MIT
@deepseek-ai/cordis-plugin-group @cordisjs/plugin-group vendor/group MIT
@deepseek-ai/cordis-plugin-timer @cordisjs/plugin-timer vendor/timer MIT
@deepseek-ai/cordis-plugin-hmr @cordisjs/plugin-hmr vendor/hmr MIT
@deepseek-ai/cordis-plugin-logger-console @cordisjs/plugin-logger-console vendor/logger-console MIT

Runtime npm dependencies

External packages installed for runtime use or embedded in distributed Host or browser artifacts. Browser inputs are resolved through the shipping tsdown and Vite configurations, independently of npm dependency sections. Host embedding declarations identify the distributing package and its embedded dependencies. The tier covers every plugin a user can mount from cordis.yml — not only what the dsh CLI, Web UI, and Python SDK runtime load by default.

Package License
@agentclientprotocol/sdk Apache-2.0
@anthropic-ai/claude-agent-sdk SEE LICENSE IN README.md
@anthropic-ai/sdk MIT
@babel/code-frame MIT
@botiverse/oar Apache-2.0
@browserbasehq/stagehand MIT
@deepseek-ai/libreoffice-kit MPL-2.0
@earendil-works/pi-ai MIT
@earendil-works/pi-coding-agent MIT
@eslint-community/regexpp MIT
@fortune-sheet/core MIT
@fortune-sheet/react MIT
@joplin/turndown-plugin-gfm MIT
@jridgewell/gen-mapping MIT
@js-temporal/polyfill ISC
@lexical/history MIT
@lexical/plain-text MIT
@lexical/text MIT
@lexical/utils MIT
@modelcontextprotocol/client MIT
@modelcontextprotocol/sdk MIT
@noble/hashes MIT
@octokit/webhooks MIT
@openai/codex Apache-2.0
@opentelemetry/api Apache-2.0
@opentelemetry/api-logs Apache-2.0
@opentelemetry/core Apache-2.0
@opentelemetry/otlp-exporter-base Apache-2.0
@opentelemetry/otlp-transformer Apache-2.0
@opentelemetry/resources Apache-2.0
@opentelemetry/sdk-logs Apache-2.0
@playwright/mcp Apache-2.0
@puppeteer/browsers Apache-2.0
@shikijs/langs MIT
@standard-schema/spec MIT
@tanstack/react-virtual MIT
@trycua/cua-driver MIT
@vscode/ripgrep MIT
@xterm/addon-fit MIT
@xterm/addon-serialize MIT
@xterm/headless MIT
@xterm/xterm MIT
@yarnpkg/parsers BSD-2-Clause
acorn MIT
ajv MIT
anser MIT
big.js MIT
birpc MIT
buffer MIT
chokidar MIT
chrome-devtools-frontend BSD-3-Clause
chrome-devtools-mcp Apache-2.0
clsx MIT
commander MIT
compression MIT
cross-spawn MIT
diff BSD-3-Clause
dompurify (MPL-2.0 OR Apache-2.0)
electron-updater MIT
eventsource-parser MIT
exceljs MIT
execa MIT
fast-xml-parser MIT
fflate MIT
got MIT
hosted-git-info ISC
immer MIT
ipaddr.js MIT
js-yaml MIT
katex MIT
koffi MIT
lexical MIT
mdast-util-from-markdown MIT
mdast-util-gfm MIT
mdast-util-math MIT
micromark-core-commonmark MIT
micromark-extension-gfm MIT
micromark-extension-math MIT
micromark-factory-space MIT
micromark-util-character MIT
micromark-util-classify-character MIT
micromark-util-sanitize-uri MIT
micromark-util-symbol MIT
mime-types MIT
minisearch MIT
negotiator MIT
node-addon-require-builtin MIT
node-pty MIT
open MIT
p-limit MIT
papaparse MIT
pdfjs-dist Apache-2.0
picomatch MIT
react MIT
react-dom MIT
readable-stream MIT
resolve.exports MIT
semver ISC
serve-static MIT
sharp Apache-2.0
sherpa-onnx-node Apache-2.0
shiki MIT
simple-icons CC0-1.0
string_decoder MIT
supports-color MIT
tar BlueOak-1.0.0
tsx MIT
turndown MIT
typescript Apache-2.0
undici MIT
use-sync-external-store MIT
which ISC
ws MIT
xlsx Apache-2.0
yaml ISC
zod MIT
zustand MIT

pnpm applies local patches to the following packages at install time, so shipped artifacts carry modified copies; each patch file is the complete record of the modification:

Chrome DevTools frontend

The optional experimental Inspector distributes a locally compiled copy of chrome-devtools-frontend 1.0.1638082, from upstream revision 0e1186138ed519d9659c1874bf6375eca4483c72. The build includes the Chromium BSD-3-Clause license and the third-party license and notice files supplied by the npm source. The Chromium root license does not replace those dependencies' licenses.

Official Claude Code platform payloads

The project owner authorizes distribution of every version of the official @anthropic-ai/claude-agent-sdk package and the official Claude Code CLI/platform payloads that each version declares through optionalDependencies. This identity-scoped authorization does not classify their declared terms as permissive and does not cover any unrelated runtime package; version, declared-license, and payload-set changes still require the ordinary dependency, lockfile, compatibility, terms, and notices review.

The installed SDK 0.3.263 declares the following optional platform packages. Each carries the official Claude Code 2.1.263 executable; the package identities and versions come from the SDK manifest, while the declared license field is verified against the platform payload installed for the current host.

Optional platform package Version Declared license
@anthropic-ai/claude-agent-sdk-darwin-arm64 0.3.263 SEE LICENSE IN LICENSE.md
@anthropic-ai/claude-agent-sdk-darwin-x64 0.3.263 SEE LICENSE IN LICENSE.md
@anthropic-ai/claude-agent-sdk-linux-arm64 0.3.263 SEE LICENSE IN LICENSE.md
@anthropic-ai/claude-agent-sdk-linux-arm64-musl 0.3.263 SEE LICENSE IN LICENSE.md
@anthropic-ai/claude-agent-sdk-linux-x64 0.3.263 SEE LICENSE IN LICENSE.md
@anthropic-ai/claude-agent-sdk-linux-x64-musl 0.3.263 SEE LICENSE IN LICENSE.md
@anthropic-ai/claude-agent-sdk-win32-arm64 0.3.263 SEE LICENSE IN LICENSE.md
@anthropic-ai/claude-agent-sdk-win32-x64 0.3.263 SEE LICENSE IN LICENSE.md

LibreOffice conversion kit

@deepseek-ai/libreoffice-kit, @deepseek-ai/libreoffice-kit-wasm, @deepseek-ai/libreoffice-kit-darwin-arm64, @deepseek-ai/libreoffice-kit-darwin-x64, @deepseek-ai/libreoffice-kit-win32-arm64, @deepseek-ai/libreoffice-kit-win32-x64 declare MPL-2.0, which remains outside the permissive-license allowlist; the notices check accepts only these package identities at those terms. The distribution decision records the source obligations.

The kit repository supplies the corresponding LibreOffice source pin, modifications, build instructions, Node API, and artifact validation. Its engine packages retain their license and third-party notices; the Node API retains its MPL-2.0 declaration and NOTICE. Recipients must have access to those corresponding sources and notices.

Development-only npm dependencies

External packages directly declared for development, tests, types, or tooling, without a runtime installation or distribution inside a Host or browser bundle. A package here may still be pulled in transitively by a runtime dependency — pnpm-lock.yaml is the authority on that full closure.

Package License
@braintree/sanitize-url MIT
@electron/get MIT
@electron/notarize MIT
@lexical/headless MIT
@modelcontextprotocol/node MIT
@modelcontextprotocol/server MIT
@modelcontextprotocol/server-everything MIT / Apache-2.0
@modelcontextprotocol/server-filesystem MIT / Apache-2.0
@panzoom/panzoom MIT
@stylistic/eslint-plugin MIT
@testing-library/dom MIT
@testing-library/react MIT
@types/babel__code-frame MIT
@types/big.js MIT
@types/compression MIT
@types/hosted-git-info MIT
@types/js-yaml MIT
@types/jsdom MIT
@types/mdast MIT
@types/mime-types MIT
@types/negotiator MIT
@types/node MIT
@types/papaparse MIT
@types/picomatch MIT
@types/react MIT
@types/react-dom MIT
@types/readable-stream MIT
@types/semver MIT
@types/serve-static MIT
@types/spdx-expression-parse MIT
@types/turndown MIT
@types/use-sync-external-store MIT
@types/ws MIT
@vitejs/plugin-react MIT
@vitest/coverage-v8 MIT
@vitest/spy MIT
@yao-pkg/pkg MIT
@yarnpkg/cli-dist BSD-2-Clause
app-builder-lib MIT
cos-nodejs-sdk-v5 ISC
cytoscape MIT
cytoscape-cose-bilkent MIT
dayjs MIT
debug MIT
electron MIT
electron-builder MIT
esbuild MIT
eslint-plugin-sonarjs LGPL-3.0-only
extract-zip BSD-2-Clause
fast-check MIT
http-server MIT
istanbul-lib-report BSD-3-Clause
jscpd MIT
jsdom MIT
lefthook MIT
lightningcss MPL-2.0
mermaid MIT
micromark-util-types MIT
oxlint MIT
oxlint-tsgolint MIT
playwright Apache-2.0
pnpm MIT
publint MIT
selfsigned MIT
smol-toml BSD-3-Clause
spdx-expression-parse MIT
tsdown MIT
typescript-language-server Apache-2.0
vite MIT
vite-tsconfig-paths MIT
vitepress MIT
vitepress-plugin-mermaid MIT
vitest MIT
vue MIT

eslint-plugin-sonarjs (LGPL-3.0-only) and lightningcss (MPL-2.0) run only as development tooling; their code is not linked into or distributed with any DeepSeek Harness artifact.

Python SDK dependencies (python/)

Direct dependencies of the pyproject.toml manifests, plus uv as the development workflow tool.

Package License Role
hatchling MIT build backend
pillow MIT-CMU Python project dependency
pydantic MIT runtime dependency of deepseek-harness-sdk
pytest MIT test-only
uv MIT / Apache-2.0 development workflow tool

Bundled Python distributions

The shared runtime lock records each distribution version and the wheel download hashes. The table includes every entry in pythonPackages, including transitive dependencies. Wheel extraction preserves distribution metadata and the license and notice files supplied by each archive. Project licenses below do not enumerate the separate licenses of native libraries bundled inside wheels.

Distribution Locked version Project license
et-xmlfile 2.0.0 MIT
lxml 6.1.3 BSD-3-Clause
numpy 2.3.5 BSD-3-Clause
openpyxl 3.1.5 MIT
pandas 3.0.1 BSD-3-Clause
pillow 12.3.0 MIT-CMU
python-dateutil 2.9.0.post0 Apache-2.0 OR BSD-3-Clause
python-docx 1.2.0 MIT
python-pptx 1.0.2 MIT
six 1.17.0 MIT
typing-extensions 4.16.0 PSF-2.0
tzdata 2025.2 Apache-2.0
xlsxwriter 3.2.9 BSD-2-Clause

First-party native packages

@deepseek-ai/node-addon-system (and its platform packages) is built and released from this repository under BSD 3-Clause. It is listed here for completeness; it is first-party, not third-party.

Reference in new issue View Git Blame Copy Permalink