Third-Party Notices

September 6, 2026 · View on GitHub

DeepSeek Harness is licensed under MIT. It depends on the third-party software listed below. Each project remains under its own license; nothing in this file changes those terms.

This file lists direct dependencies declared by the workspace and the explicitly disclosed official Claude Code platform payload closure. It is generated from the workspace manifests by scripts/gen-third-party-notices.ts: a pre-commit hook regenerates it whenever a staged file changes one of its inputs, and scripts/gen-third-party-notices.spec.ts asserts in the test lane that the committed bytes match. Deleting a manifest runs no hook, so that case is caught by the assertion instead. Run pnpm run verify-third-party-notices for the standalone check.

The complete npm transitive closure, including the Landlock launcher workspace, is recorded with exact pinned versions in pnpm-lock.yaml — inspect it with pnpm licenses list. The Python closure is recorded separately in python/sdk/uv.lock.

Vendored source (`vendor/`)

The Cordis framework and its foundation libraries are source-vendored into this repository rather than consumed from npm, and republished under the @deepseek-ai scope. All are MIT-licensed; each directory preserves its upstream LICENSE file. Exact upstream commits and local modifications are recorded in vendor/README.md.

Package	Upstream name	Upstream	License
`@deepseek-ai/cosmokit`	`cosmokit`	github.com/deepseek-harness/cosmokit	MIT
`@deepseek-ai/schemastery`	`schemastery`	github.com/deepseek-harness/schemastery	MIT
`@deepseek-ai/cordis`	`cordis`	github.com/cordiverse/cordis	MIT
`@deepseek-ai/cordis-plugin-loader`	`@cordisjs/plugin-loader`	github.com/cordiverse/cordis	MIT
`@deepseek-ai/cordis-plugin-include`	`@cordisjs/plugin-include`	github.com/deepseek-harness/cordis	MIT
`@deepseek-ai/cordis-plugin-group`	`@cordisjs/plugin-group`	github.com/deepseek-harness/cordis	MIT
`@deepseek-ai/cordis-plugin-timer`	`@cordisjs/plugin-timer`	github.com/deepseek-harness/cordis	MIT
`@deepseek-ai/cordis-plugin-hmr`	`@cordisjs/plugin-hmr`	github.com/deepseek-harness/cordis	MIT
`@deepseek-ai/cordis-plugin-logger-console`	`@cordisjs/plugin-logger-console`	github.com/deepseek-harness/cordis	MIT

Runtime npm dependencies

External packages that a workspace package resolves at runtime. The tier covers every plugin a user can mount from cordis.yml — not only what the dsh CLI, Web UI, and Python SDK runtime load by default.

Package	License
`@agentclientprotocol/sdk`	Apache-2.0
`@anthropic-ai/claude-agent-sdk`	SEE LICENSE IN README.md
`@anthropic-ai/sdk`	MIT
`@babel/code-frame`	MIT
`@earendil-works/pi-ai`	MIT
`@joplin/turndown-plugin-gfm`	MIT
`@jridgewell/gen-mapping`	MIT
`@lexical/history`	MIT
`@lexical/plain-text`	MIT
`@lexical/text`	MIT
`@lexical/utils`	MIT
`@modelcontextprotocol/sdk`	MIT
`@noble/hashes`	MIT
`@octokit/webhooks`	MIT
`@openai/codex`	Apache-2.0
`@opentelemetry/api`	Apache-2.0
`@opentelemetry/api-logs`	Apache-2.0
`@opentelemetry/exporter-logs-otlp-http`	Apache-2.0
`@opentelemetry/otlp-exporter-base`	Apache-2.0
`@opentelemetry/resources`	Apache-2.0
`@opentelemetry/sdk-logs`	Apache-2.0
`@shikijs/langs`	MIT
`@standard-schema/spec`	MIT
`@tanstack/react-virtual`	MIT
`@types/mdast`	MIT
`@vscode/ripgrep`	MIT
`@xterm/headless`	MIT
`@yarnpkg/parsers`	BSD-2-Clause
`acorn`	MIT
`anser`	MIT
`buffer`	MIT
`chokidar`	MIT
`clsx`	MIT
`commander`	MIT
`compression`	MIT
`diff`	BSD-3-Clause
`e2b`	MIT
`eventsource-parser`	MIT
`fflate`	MIT
`immer`	MIT
`ipaddr.js`	MIT
`js-yaml`	MIT
`katex`	MIT
`koffi`	MIT
`lexical`	MIT
`mdast-util-from-markdown`	MIT
`mdast-util-gfm`	MIT
`mdast-util-math`	MIT
`micromark-core-commonmark`	MIT
`micromark-extension-gfm`	MIT
`micromark-extension-math`	MIT
`micromark-factory-space`	MIT
`micromark-util-character`	MIT
`micromark-util-classify-character`	MIT
`micromark-util-sanitize-uri`	MIT
`micromark-util-symbol`	MIT
`micromark-util-types`	MIT
`negotiator`	MIT
`node-addon-require-builtin`	MIT
`node-pty`	MIT
`open`	MIT
`picomatch`	MIT
`playwright-core`	Apache-2.0
`react`	MIT
`react-dom`	MIT
`readable-stream`	MIT
`resolve.exports`	MIT
`sharp`	Apache-2.0
`shiki`	MIT
`supports-color`	MIT
`tsx`	MIT
`turndown`	MIT
`typescript`	Apache-2.0
`undici`	MIT
`use-sync-external-store`	MIT
`ws`	MIT
`yaml`	ISC
`zod`	MIT
`zustand`	MIT

pnpm applies local patches to the following packages at install time, so shipped artifacts carry modified copies; each patch file is the complete record of the modification:

app-builder-lib@26.15.3 — patches/app-builder-lib@26.15.3.patch
node-pty@1.2.0-beta.15 — patches/node-pty@1.2.0-beta.15.patch

Official Claude Code platform payloads

The project owner authorizes distribution of every version of the official @anthropic-ai/claude-agent-sdk package and the official Claude Code CLI/platform payloads that each version declares through optionalDependencies. This identity-scoped authorization does not classify their declared terms as permissive and does not cover any unrelated runtime package; version, declared-license, and payload-set changes still require the ordinary dependency, lockfile, compatibility, terms, and notices review.

The installed SDK 0.3.241 declares the following optional platform packages. Each carries the official Claude Code 2.1.241 executable; the package identities and versions come from the SDK manifest, while the declared license field is verified against the platform payload installed for the current host.

Optional platform package	Version	Declared license
`@anthropic-ai/claude-agent-sdk-darwin-arm64`	0.3.241	SEE LICENSE IN LICENSE.md
`@anthropic-ai/claude-agent-sdk-darwin-x64`	0.3.241	SEE LICENSE IN LICENSE.md
`@anthropic-ai/claude-agent-sdk-linux-arm64`	0.3.241	SEE LICENSE IN LICENSE.md
`@anthropic-ai/claude-agent-sdk-linux-arm64-musl`	0.3.241	SEE LICENSE IN LICENSE.md
`@anthropic-ai/claude-agent-sdk-linux-x64`	0.3.241	SEE LICENSE IN LICENSE.md
`@anthropic-ai/claude-agent-sdk-linux-x64-musl`	0.3.241	SEE LICENSE IN LICENSE.md
`@anthropic-ai/claude-agent-sdk-win32-arm64`	0.3.241	SEE LICENSE IN LICENSE.md
`@anthropic-ai/claude-agent-sdk-win32-x64`	0.3.241	SEE LICENSE IN LICENSE.md

Development-only npm dependencies

External packages directly declared only by repository tooling, test infrastructure, the documentation site, the demo leaves, or the native launcher's build workspace. No shipped surface names them itself. A package here may still be pulled in transitively by a runtime dependency — pnpm-lock.yaml is the authority on the full closure — so this tier records who declares a package, not what a build ultimately bundles.

Package	License
`@braintree/sanitize-url`	MIT
`@lexical/headless`	MIT
`@modelcontextprotocol/server-everything`	MIT / Apache-2.0
`@modelcontextprotocol/server-filesystem`	MIT / Apache-2.0
`@stylistic/eslint-plugin`	MIT
`@testing-library/dom`	MIT
`@testing-library/react`	MIT
`@types/babel__code-frame`	MIT
`@types/compression`	MIT
`@types/js-yaml`	MIT
`@types/jsdom`	MIT
`@types/negotiator`	MIT
`@types/node`	MIT
`@types/picomatch`	MIT
`@types/react`	MIT
`@types/react-dom`	MIT
`@types/readable-stream`	MIT
`@types/spdx-expression-parse`	MIT
`@types/turndown`	MIT
`@types/use-sync-external-store`	MIT
`@types/ws`	MIT
`@vitejs/plugin-react`	MIT
`@vitest/coverage-v8`	MIT
`@xterm/addon-fit`	MIT
`@xterm/xterm`	MIT
`@yarnpkg/cli-dist`	BSD-2-Clause
`cytoscape`	MIT
`cytoscape-cose-bilkent`	MIT
`dayjs`	MIT
`debug`	MIT
`electron`	MIT
`electron-builder`	MIT
`esbuild`	MIT
`eslint-plugin-sonarjs`	LGPL-3.0-only
`execa`	MIT
`fast-check`	MIT
`http-server`	MIT
`istanbul-lib-report`	BSD-3-Clause
`jscpd`	MIT
`jsdom`	MIT
`lefthook`	MIT
`lightningcss`	MPL-2.0
`mermaid`	MIT
`oxlint`	MIT
`oxlint-tsgolint`	MIT
`playwright`	Apache-2.0
`publint`	MIT
`smol-toml`	BSD-3-Clause
`spdx-expression-parse`	MIT
`tsdown`	MIT
`typescript-language-server`	Apache-2.0
`vite`	MIT
`vite-tsconfig-paths`	MIT
`vitepress`	MIT
`vitepress-plugin-mermaid`	MIT
`vitest`	MIT
`vue`	MIT

eslint-plugin-sonarjs (LGPL-3.0-only) and lightningcss (MPL-2.0) run only as development tooling; their code is not linked into or distributed with any DeepSeek Harness artifact.

Python SDK dependencies (`python/`)

Direct dependencies of the pyproject.toml manifests, plus uv as the development workflow tool.

Package	License	Role
`hatchling`	MIT	build backend
`pydantic`	MIT	runtime dependency of `deepseek-harness-sdk`
`pytest`	MIT	test-only
`uv`	MIT / Apache-2.0	development workflow tool

Fetched at build time

Package	License	Role
`@yao-pkg/pkg`	MIT	invoked by `scripts/build-exe-for-python-sdk.ts` to assemble the single-file SDK runtime executable

First-party native packages

@deepseek-ai/node-addon-landlock-run (and its platform packages) is built and released from this repository under BSD 3-Clause. It is listed here for completeness; it is first-party, not third-party.

Vendored source (vendor/)