@ckanner/flywheel 0.32.1 → 0.33.1

package/plugins/dsh/THIRD_PARTY_NOTICES.md

@@ -0,0 +1,42 @@
+# Third-party notices
+
+## DeepSeek Harness UI patterns
+
+Flywheel's plugin-owned Button, Input, and ongoing StateDot treatments are
+adapted from DeepSeek Harness at commit
+`b830ec950faba0a46dda564be3e2d854afed94f1`:
+
+- `packages/client/ui-primitives/src/Button.tsx` and its stylesheet
+- `packages/client/ui-primitives/src/Input.tsx` and its stylesheet
+- `packages/client/ui-primitives/src/StateDot.tsx` and its stylesheet
+
+[Upstream source](https://github.com/deepseek-ai/deepseek-harness/tree/b830ec950faba0a46dda564be3e2d854afed94f1/packages/client/ui-primitives/src)
+
+These adapted portions retain the upstream MIT license below. Flywheel's own
+source is also licensed under MIT; see [LICENSE](LICENSE).
+
+MIT License
+
+Copyright (c) 2026 DeepSeek
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.
+
+## Bundled Codex Pro public package
+
+This distribution bundles `dsh-subagent-codex-pro@0.9.0`, Copyright (c) 2026 ckanner, under the MIT License. Its complete license is retained at `node_modules/dsh-subagent-codex-pro/LICENSE` inside the packed plugin. Source identity and tarball integrity are recorded in `vendor/README.md` and `vendor/codex-pro.json` in the source repository. The bundled package is the upstream public machine API implementation, including its compiled supervisor; it contains no native Codex executable or user credentials.

package/plugins/dsh/vendor/README.md

@@ -0,0 +1,17 @@
+# Bundled public Codex Pro source candidate
+
+Flywheel imports `dsh-subagent-codex-pro/machine` from the actual public package **0.9.0**. In the source checkout, this directory contains that package's reviewed npm tarball, not a replacement wrapper or a fabricated registry download.
+
+- Source: [37da3d75de32b809c4fb1a631ccc15191f3d87f9](https://github.com/ckanner/dsh-subagent-codex-pro/commit/37da3d75de32b809c4fb1a631ccc15191f3d87f9)
+- Source tree: `00df1042b0010dc37ce8ab6048f75a434325962c`
+- SHA-256: `4a86380fdde0d7f2673c4b1f2d5c8682cf61d6a4b83deb65eab8fe76f6032198`
+- npm integrity: `sha512-NtguC96kZVgKOMHv7kSiFVEZ4thjorHS1ZrNFQwbBLEBU2jOSWkFGlXk+BILPuxALUKkJJ4E1DSbA2+JG3gM0Q==`
+- Package license: MIT, Copyright (c) 2026 ckanner; the original `LICENSE` is present in the tarball and installed package.
+
+The source candidate adds lifecycle v1, durable acknowledgements, an independent supervisor journal, and read-only recovery. It has not been represented as a published registry version. The runtime dependency remains exactly `0.9.0`; the build-harness lock resolves `file:vendor/…tgz` and the root lock resolves `file:plugins/dsh/vendor/…tgz`, both with its actual integrity. `npm ci --ignore-scripts` materializes it, and `bundledDependencies` includes that package in Flywheel's complete tarball. A user installing the checked Flywheel candidate therefore does not need to download or assume the bytes of a registry `0.9.0` release. No native Codex executable, login data, or credentials are bundled.
+
+The tarball was built with Node 24.22.1/npm 12.2.1 from the pinned tree, using the upstream lockfile, `npm run build`, and `npm pack --ignore-scripts`. Upstream public API, compiled supervisor, and clean npm-install tests cover these bytes. Flywheel additionally runs its real worker/Go bridge and actual single-package installation checks. The package manager uses the lock integrity; `codex-pro.json` records source provenance separately.
+
+Claude Code Pro **0.4.0** remains an optional peer and is not bundled. Its matching source candidate is [ec0b99176b67512f3ca1838ec2a349dcb0189214](https://github.com/ckanner/dsh-subagent-claude-code-pro/commit/ec0b99176b67512f3ca1838ec2a349dcb0189214), with tarball SHA-256 `125951f39d27a87072a9dc20c622a19089ad7ba84b69ba6228e1fbb03f46f581`. CI builds that immutable source, verifies the exact package hash, and installs it before running Claude-specific gates.
+
+This is source-candidate packaging. It neither publishes the upstream packages nor changes Flywheel's npm `latest` tag.

package/plugins/dsh/vendor/codex-pro.json

@@ -0,0 +1,16 @@
+{
+  "package": "dsh-subagent-codex-pro",
+  "version": "0.9.0",
+  "repository": "https://github.com/ckanner/dsh-subagent-codex-pro",
+  "sourceCommit": "37da3d75de32b809c4fb1a631ccc15191f3d87f9",
+  "sourceTree": "00df1042b0010dc37ce8ab6048f75a434325962c",
+  "tarball": "dsh-subagent-codex-pro-0.9.0.tgz",
+  "sha256": "4a86380fdde0d7f2673c4b1f2d5c8682cf61d6a4b83deb65eab8fe76f6032198",
+  "integrity": "sha512-NtguC96kZVgKOMHv7kSiFVEZ4thjorHS1ZrNFQwbBLEBU2jOSWkFGlXk+BILPuxALUKkJJ4E1DSbA2+JG3gM0Q==",
+  "license": "MIT",
+  "registryReleaseVerified": false,
+  "toolchain": {
+    "node": "24.22.1",
+    "npm": "12.2.1"
+  }
+}