@crowdedkingdoms/crowdy-dsh 0.2.0-dev.1

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 CrowdedKingdoms
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -0,0 +1,175 @@
+# `@crowdedkingdoms/crowdy-dsh`
+
+[DeepSeek Harness](https://github.com/deepseek-ai/deepseek-harness) (`dsh`)
+plugins whose filesystem is a **Crowdy Studio project**, plus the build that
+packs them — with the stock harness web UI — into a static artifact that runs
+**entirely in the player's browser**. Crowdy Studio embeds that artifact as the
+agent pane; the harness edits the project through the game API exactly as the
+Studio editor does, and calls the model through the tier's metered model
+endpoint with the player's own app token.
+
+Replaces the Crowdy Agent orchestrator in the CK API and the CrowdyJS agent
+dock (CrowdyJS 16). The page side of the bridge lives in CrowdyJS
+(`@crowdedkingdoms/crowdyjs/crowdy-dsh`); [`src/bridge/protocol.ts`](src/bridge/protocol.ts)
+and its CrowdyJS mirror must stay in step.
+
+## How it fits together
+
+```text
+game page (the-construct)                 iframe /dsh/index.html            Web Worker
+┌──────────────────────────┐   postMessage  ┌──────────────────┐  tunnel   ┌─────────────────────────┐
+│ CrowdyJS Studio panel    │ ─────────────► │ crowdy-boot.ts   │ ────────► │ dsh plugin tree          │
+│  DshPane + bridge (page) │   boot files   │ + stock web UI   │           │  crowdy-fs  (ctx.fs)     │
+│  screenshots, draft test │ ◄────────────  │                  │           │  crowdy-bridge           │
+│  game observe, projects  │ BroadcastChannel ────────────────────────────►│  crowdy-tools, search    │
+└──────────────────────────┘                └──────────────────┘           │  attachment-crowdy       │
+            │ fetch (app token)                                             │  crowdy-persist (OPFS)   │
+            ▼                                                               └──────────┬──────────────┘
+      ck-api: crowdyStudio* / crowdyStudioGitHub* ◄───────────────────────────────────┘ fetch (app token)
+      ck-api: POST /v1/model/chat/completions  (metered, fronts OpenRouter) ◄──────────┘
+```
+
+| Seam | Stock | Here |
+|---|---|---|
+| `ctx.fs` | `dsh-fs-sandbox` over the local disk | [`./fs`](src/fs/crowdy-file-system.ts): the project. GitHub-bound projects read/write the bound repository (SHA-guarded) and mirror to Studio; unbound projects use Studio files (`expectedRevision`). `captures/` and `context/` are in-memory scratch dirs the page fills. |
+| `ctx.attachments` | `dsh-attachment-local` (sharp) | [`./attachments`](src/attachments/crowdy-attachment-store.ts): in-memory, header-sniffed dimensions; the browser worker has no native image codec. |
+| agent preset | `standard` | [`presets/crowdy`](presets/crowdy/agent.cordis.yml): file tools, in-memory `glob`/`grep`, `sdk_lookup`, and the Studio tools below. No shell, no web, no subagents. |
+| page link | — | [`./bridge`](src/bridge/index.ts): `ctx.crowdyBridge`, a `BroadcastChannel` to the Studio page ([protocol](src/bridge/protocol.ts)). |
+| tools | — | [`./tools`](src/tools/index.ts): `draft_test`, `deploy_live` (approval-gated), `screenshot`, `runtime_status`, `client_logs`, `game_observe`, `project_list/open/create`. The page executes them with the player's authority. |
+| model route | pi-ai | `llm-deepseek` (direct fetch; pi-ai is a stub in the worker) pointed at the tier model endpoint via `settings.yaml`. |
+| persistence | disk | [`./persist`](src/persist/index.ts): mirrors `home/sessions`, `home/storages`, `settings.yaml` to OPFS; the page restores them as a boot overlay. |
+
+## Boot contract (what the embedding page provides)
+
+The iframe posts `{type:'crowdy-dsh:ready'}`; the page answers with:
+
+```ts
+iframe.contentWindow.postMessage({
+  type: 'crowdy-dsh:boot',
+  files: {
+    'crowdy.json': JSON.stringify({ graphqlUrl, appId, projectId, bridgeChannel, bridgeNonce, githubFirst: true, root: '/dsh/workspace', persistScope }),
+    'settings.yaml': `llm-deepseek:\n  apiKeyEnv: CROWDY_APP_TOKEN\n  baseURL: ${modelBaseUrl}\n  thinking: disabled\n  models: [...]\nagent-default-model:\n  provider: deepseek-official\n  model: ${defaultModel}\n`,
+  },
+  nonce: bridgeNonce,    // one-time secret; every bridge frame carries it
+  persistScope,          // OPFS directory, e.g. `${appId}/${userId}`
+  mount: '/dsh/workspace',
+}, location.origin)
+```
+
+then joins `new BroadcastChannel(bridgeChannel)` as the `page` side and answers
+the requests in [`protocol.ts`](src/bridge/protocol.ts). The app token is NOT
+in the seed files: the page sends it in `page.hello` and again in `page.token`
+when it refreshes, the worker holds it in memory as `CROWDY_APP_TOKEN` (which
+the model route reads per request), and the first project load waits up to 5 s
+for it. Nothing writes it to the virtual filesystem or OPFS, and the Crowdy
+filesystem backend serves only the project mount, so `read_file` cannot reach
+the environment. `page.project` switches projects, `page.saved` invalidates
+cached files. Both sides drop frames without the boot nonce: a
+`BroadcastChannel` is reachable by every same-origin script. CrowdyJS
+implements the page side in `src/crowdy-dsh/`; it also confirms a live deploy
+with the player on the page before running it.
+
+Headers the host must send (verified with `crossOriginIsolated === true`):
+game page CSP unchanged except `frame-src 'self'`; every `/dsh/*` response
+carries `script-src 'self' 'unsafe-eval' 'unsafe-inline' blob:`,
+`connect-src 'self' blob:`, `worker-src 'self' blob:`, `frame-ancestors 'self'`
+(the worker compiles pre-lowered module bodies with `new Function`; the harness
+document runs its own client module system). The API and model endpoints must
+be same-origin or in `connect-src`.
+
+## Building the artifact
+
+Requires Node **22.19+** and pnpm (corepack). The upstream DeepSeek Harness is a
+**sibling checkout** at the tag pinned in [`upstream.json`](upstream.json)
+(`dsh-v0.1.5-rc.2`), not a submodule; this repo carries none.
+
+```bash
+nvm use 22
+bash scripts/checkout-upstream.sh    # clones ../deepseek-harness at the pin, or verifies it
+bash scripts/build-image.sh          # ~6 min first time (builds upstream), then ~30 s
+# SKIP_UPSTREAM=1 to reuse a built upstream; UPSTREAM_DIR=... to point elsewhere
+# CROWDYJS_DIST=../CrowdyJS/dist to bundle a local, not-yet-published SDK
+```
+
+CI does the same when the declared `@crowdedkingdoms/crowdyjs` pin is not on
+the registry yet: it builds the SDK from the branch named by
+`crowdyDsh.sdkSourceBranch` in `package.json` (falling back to a CrowdyJS
+branch of the same name, then the target branch, then `dev`) and bundles that.
+`build-image.sh` refuses a local SDK whose version differs from the pin
+(prerelease suffix aside; `CROWDYJS_ALLOW_MISMATCH=1` for a local experiment).
+Once the pin publishes, the hint is inert; drop it with the next SDK bump.
+
+`dist/dsh-web/` is the artifact: `index.html` (the stock web client plus
+`web/crowdy-boot.ts`), `assets/`, `preview/` (worker bundle + the packed
+`vfs-image.tar.gz`, ~7 MB), `BUILD.json` (package version, this repo's commit,
+upstream tag and commit, the CrowdyJS the worker bundles, sha256 of every file),
+`LICENSE.deepseek-harness` and `THIRD_PARTY_NOTICES.md`. Serve it under
+`/dsh/` of the game origin.
+
+The build refuses an artifact that names the builder's home directory or the
+upstream checkout path (`//#region` markers and `patched by` comments are
+rewritten to `<upstream>`), a tier API host (the bundled SDK slice replaces the
+generated `default-origin` with empty origins; the page always supplies
+`graphqlUrl`), or the DeepSeek telemetry collector (the plugin is disabled in
+the profile). Source maps are not shipped.
+
+What the script does: copies this package into `<upstream>/packages/crowdy/`,
+copies `presets/crowdy` into the shipped preset root, `pnpm install`, builds
+and runs the tests, bundles the CrowdyJS slice
+([`scripts/bundle-sdk.mjs`](scripts/bundle-sdk.mjs) — the package root would
+drag Monaco and tree-sitter into the image), builds the page with
+[`web/vite.crowdy.config.ts`](web/vite.crowdy.config.ts), packs `web` +
+[`profile/crowdy-web.patch.yml`](profile/crowdy-web.patch.yml) with
+[`scripts/pack-image.ts`](scripts/pack-image.ts), then scrubs, checks and stamps
+with [`scripts/finish-artifact.mjs`](scripts/finish-artifact.mjs) and stages
+the npm package in `dist/npm/` with [`scripts/stage-npm.mjs`](scripts/stage-npm.mjs).
+
+## Shipping it
+
+`@crowdedkingdoms/crowdy-dsh` is published to npm by
+[`.github/workflows/publish.yml`](.github/workflows/publish.yml) on an
+environment-prefixed tag on one of the three long-lived branches, the
+CrowdyJS convention: `dev/v0.2.0` publishes `0.2.0-dev.N` under `@dev`,
+`test/v0.2.0` publishes `0.2.0-test.N` under `@test`, `prod/v0.2.0` publishes
+`0.2.0` under `@latest`. The `guard` job refuses a tag whose commit is not on
+the branch the prefix names (`scripts/ci/resolve-release-tier.sh`). Publishing
+uses npm Trusted Publishing (OIDC) with provenance; there is no token. Every
+push and pull request builds and tests ([`ci.yml`](.github/workflows/ci.yml));
+only a tag publishes. The published
+manifest has no runtime dependencies (the `@deepseek-ai` workspace siblings
+become optional peers) because a game installs it for `dist/dsh-web/` alone:
+
+```bash
+npm i -D @crowdedkingdoms/crowdy-dsh@dev
+# prebuild: copy node_modules/@crowdedkingdoms/crowdy-dsh/dist/dsh-web -> public/dsh (gitignored)
+```
+
+The CrowdyJS major the worker bundles must match the one the page runs;
+`bundle-sdk.mjs` refuses otherwise. Bump the `@crowdedkingdoms/crowdyjs`
+devDependency together with the game pins.
+
+## Developing
+
+Inside the upstream workspace (after one `build-image.sh`):
+
+```bash
+cd ../deepseek-harness/packages/crowdy/crowdy-dsh
+pnpm run build && pnpm run test      # node:test, 82 tests: fs semantics, GitHub store, bridge, attachments, search
+```
+
+Developer cockpit on Node (no browser, no page tools):
+
+```bash
+cp .env.example .env && set -a && . ./.env && set +a
+node lib/scripts/probe.js            # connectivity: store choice, files, guarded write with --write
+dsh --profile web --patch ./profile/crowdy-node.patch.yml
+```
+
+## Known limitations
+
+- Experimental upstream packages (`webworker-runtime`, `webworker-packer`) are
+  private and may change; the tag is pinned and the build fails loud.
+- Attachments are in memory: a reload keeps the session text but not the pixels.
+- GitHub-bound projects cannot delete files from here (the Contents API path
+  is not wrapped); the Studio panel or GitHub can.
+- The developer cockpit needs a real, empty mount directory (`CROWDY_MOUNT`).

package/dist/dsh-web/BUILD.json

@@ -0,0 +1,118 @@
+{
+  "package": "@crowdedkingdoms/crowdy-dsh",
+  "version": "0.2.0",
+  "builtAt": "2026-09-12T12:57:06.868Z",
+  "source": {
+    "repository": "CrowdedKingdoms/crowdy-dsh",
+    "commit": "8d2c72733bb269e518515d6df0997d618c6f8457",
+    "dirty": false
+  },
+  "upstream": {
+    "repository": "https://github.com/deepseek-ai/deepseek-harness.git",
+    "tag": "dsh-v0.1.5-rc.2",
+    "commit": "fb2c4b9e698e30edb738bca4cf0618587db7d203",
+    "license": "MIT"
+  },
+  "crowdyjs": {
+    "name": "@crowdedkingdoms/crowdyjs",
+    "version": "16.0.0",
+    "source": "CROWDYJS_DIST"
+  },
+  "files": {
+    "assets/client-Dbm2RGSD.js": "sha256:61fac496cef7bb89d3ac9d248943a7789c7ddfedc76c242aa635620b8ae80047",
+    "assets/fonts/KaTeX_AMS-Regular-BQhdFMY1.woff2": "sha256:0cdd387c9590a1a9f9794560022dbb59654a7d86f187aa0c81495ad42d3a7308",
+    "assets/fonts/KaTeX_AMS-Regular-DMm9YOAa.woff": "sha256:30da91e84c893f875e252689faebdc590b2871145e8adc7f9a9d4dbd8ce0b251",
+    "assets/fonts/KaTeX_AMS-Regular-DRggAlZN.ttf": "sha256:68534840bcfdd2bffb6f0e8deb48684dd01e7f04ea2813267577afb906de1d13",
+    "assets/fonts/KaTeX_Caligraphic-Bold-ATXxdsX0.ttf": "sha256:07d8e303ce4fc12b4bb54f1004170dd190a1f3db45d400fe68060df3e0897268",
+    "assets/fonts/KaTeX_Caligraphic-Bold-BEiXGLvX.woff": "sha256:1ae6bd7475590e97e7f145a89e09ccde322f7a6bc0b91607b1c8b8ee28290fed",
+    "assets/fonts/KaTeX_Caligraphic-Bold-Dq_IR9rO.woff2": "sha256:de7701e42cf1f4cf0b766c03fb27977207eee2f4fd5d76fa82188406da43ea4c",
+    "assets/fonts/KaTeX_Caligraphic-Regular-CTRA-rTL.woff": "sha256:3398dd02302557a793f2863f88e02d96ce10df2abffa07c8e9fa90775116e65c",
+    "assets/fonts/KaTeX_Caligraphic-Regular-Di6jR-x-.woff2": "sha256:5d53e70ad607c2352162dec9e0923fb54ecdafaccbf604cd8dcf7d00facb989b",
+    "assets/fonts/KaTeX_Caligraphic-Regular-wX97UBjC.ttf": "sha256:ed0b74372feefcbb9c0666b2e210da37b7e49fa7fbbf3eeb11db5f693dacfbb7",
+    "assets/fonts/KaTeX_Fraktur-Bold-BdnERNNW.ttf": "sha256:9163df9c7122432e6495b4229fa9071cf9ae86a758ae5efc4924ec2e1a6dbce1",
+    "assets/fonts/KaTeX_Fraktur-Bold-BsDP51OF.woff": "sha256:9be7ceb88004ab8ad124082246fbfcca4091e36385d4ec6ed1df67375dad50fb",
+    "assets/fonts/KaTeX_Fraktur-Bold-CL6g_b3V.woff2": "sha256:74444efd593c005e3f4573b44524704c0af0a937fe911cca9e94068d0d140d3f",
+    "assets/fonts/KaTeX_Fraktur-Regular-CB_wures.ttf": "sha256:1e6f9579e90e2cac37f8f60a597c436e075c114385652b7cbeb0dec0421291b3",
+    "assets/fonts/KaTeX_Fraktur-Regular-CTYiF6lA.woff2": "sha256:51814d270d06ff0255dba0799994fa4d8c84d11f09951d47595f4abb1f3602dc",
+    "assets/fonts/KaTeX_Fraktur-Regular-Dxdc4cR9.woff": "sha256:5e28753be717dac97f559f49bc10be9cf3c124ddcabda6659d11cb68febc6463",
+    "assets/fonts/KaTeX_Main-Bold-Cx986IdX.woff2": "sha256:0f60d1b897938ec918c8ce073092411baf9438f6739465693ff18b0f9d20b021",
+    "assets/fonts/KaTeX_Main-Bold-Jm3AIy58.woff": "sha256:c76c5d696297d51b9cb1639c7da4334f0e7dec81b42b11213b5e25ef671bb822",
+    "assets/fonts/KaTeX_Main-Bold-waoOVXN0.ttf": "sha256:138ac28d1663b3037e9c5f52371fa5c63d8324f4a38d22cd573e6ea3a3fd0cf8",
+    "assets/fonts/KaTeX_Main-BoldItalic-DxDJ3AOS.woff2": "sha256:99cd42a3c072d918f2f44984a807cf7aa16e13545fd0875fc07c6c65f99e715b",
+    "assets/fonts/KaTeX_Main-BoldItalic-DzxPMmG6.ttf": "sha256:70ee1f64a20f2048c21940ef46d0144fd215baa953ca69afd1e31e98544f708f",
+    "assets/fonts/KaTeX_Main-BoldItalic-SpSLRI95.woff": "sha256:a6f7ec0d846ac7ad975adb8959c37ed49b94acbc4ae436db9ce9e20287e4a64c",
+    "assets/fonts/KaTeX_Main-Italic-3WenGoN9.ttf": "sha256:0d85ae7cc30f23790a7f1a58c4a112fdca8aae769b6ba11429af1d98b1b6cb3a",
+    "assets/fonts/KaTeX_Main-Italic-BMLOBm91.woff": "sha256:f1d6ef86f3b11a528bd5185199bd2443ecb2b0dead96d88674b5a2c12be24bdf",
+    "assets/fonts/KaTeX_Main-Italic-NWA7e6Wa.woff2": "sha256:97479ca6cce906abc961ecac96faa5f9ca2e61b8e7670d475826bcdee9a7c267",
+    "assets/fonts/KaTeX_Main-Regular-B22Nviop.woff2": "sha256:c2342cd8b869e01752a9321dc17213fc40d4d04c79688c1d43f2cf316abd7866",
+    "assets/fonts/KaTeX_Main-Regular-Dr94JaBh.woff": "sha256:c6368d87e8a1a3a5d337623d83d8dc4b868f242a9ad476237d6f8d1e0f168cdc",
+    "assets/fonts/KaTeX_Main-Regular-ypZvNtVU.ttf": "sha256:d0332f52868370fd83ae7fa46470f90c8f2eab2fcf12bc4f88080b340c95a830",
+    "assets/fonts/KaTeX_Math-BoldItalic-B3XSjfu4.ttf": "sha256:f9377ab0271cda59af24bcffbd46a4d0c8a3572ffafdbb38de2ad5ea7b0d5ee5",
+    "assets/fonts/KaTeX_Math-BoldItalic-CZnvNsCZ.woff2": "sha256:dc47344dbb6cb5b655c8460d561f4df5f501b90c804ad3c6cec65fe322351ab1",
+    "assets/fonts/KaTeX_Math-BoldItalic-iY-2wyZ7.woff": "sha256:850c0af5c2238497febaf5e461d880bf458c341f42f4f330f1b1ab5698b1998e",
+    "assets/fonts/KaTeX_Math-Italic-DA0__PXp.woff": "sha256:8a8d244581371912b8f3f5a23e2437cb2a59cd9bcaebb0346e722c05737a2571",
+    "assets/fonts/KaTeX_Math-Italic-flOr_0UB.ttf": "sha256:08ce98e51b04d58945a301e639e02b6998af29fdfd61a7b8afdd07bbfc479d4a",
+    "assets/fonts/KaTeX_Math-Italic-t53AETM-.woff2": "sha256:7af58c5ec8f132a2ddde9027c6d7814decce4d3b822a11192a42a20e2e973264",
+    "assets/fonts/KaTeX_SansSerif-Bold-CFMepnvq.ttf": "sha256:1ece03f79f95277d57dc7f6b435a74e1379b0d46104a8530286b60ff49369ea0",
+    "assets/fonts/KaTeX_SansSerif-Bold-D1sUS0GD.woff2": "sha256:e99ae51144bf1232efcc1bfe5add36262c6866b0faab24fa75740e1b98577a62",
+    "assets/fonts/KaTeX_SansSerif-Bold-DbIhKOiC.woff": "sha256:ece03cfd83e22c212cdef66feb8442d25a083beb988db3f1883f3f9738d750ba",
+    "assets/fonts/KaTeX_SansSerif-Italic-C3H0VqGB.woff2": "sha256:00b26ac825e2095056396e0553b8ac26d3f8ad158c3826e28b4c45b385c4714a",
+    "assets/fonts/KaTeX_SansSerif-Italic-DN2j7dab.woff": "sha256:91ee67500cc0129aa0ace3ac5c61ff1692102f0f31d02b69347fba35dcb75bf2",
+    "assets/fonts/KaTeX_SansSerif-Italic-YYjJ1zSn.ttf": "sha256:3931dd81faed86ba021bb2bbdc36f5bed9a38d6b4f4077aca59b265aa1b02083",
+    "assets/fonts/KaTeX_SansSerif-Regular-BNo7hRIc.ttf": "sha256:f36ea897e19f4a2e571d1e900e4e3710e438deb05a842486045ba0a3e616a4ad",
+    "assets/fonts/KaTeX_SansSerif-Regular-CS6fqUqJ.woff": "sha256:11e4dc8a6471ff6d6ee561d53d10fde8f7489e798257ff449c5d37c197435605",
+    "assets/fonts/KaTeX_SansSerif-Regular-DDBCnlJ7.woff2": "sha256:68e8c73ef42afd3ccec58bf0fba302cce448938e7fc020a5e31f8a952eee1342",
+    "assets/fonts/KaTeX_Script-Regular-C5JkGWo-.ttf": "sha256:1c67f068fea8bb09bf099c088b1cf64bd27516a6e07f4684344873564bb66a67",
+    "assets/fonts/KaTeX_Script-Regular-D3wIWfF6.woff2": "sha256:036d4e95149b69ff9bcc0cd55771efeb25ffa3947293e69acd78d5ac328c684b",
+    "assets/fonts/KaTeX_Script-Regular-D5yQViql.woff": "sha256:d96cdf2b3bdd4d64a8fd5f74a4c467f123a8a73931cd435889f08ffaf9bf947a",
+    "assets/fonts/KaTeX_Size1-Regular-C195tn64.woff": "sha256:c943cc986384f59e86bea5fd7dc50a9c4dfe567a7c05eb40d6790720dead97c9",
+    "assets/fonts/KaTeX_Size1-Regular-Dbsnue_I.ttf": "sha256:95b6d2f1a50173bfedb8c63e1d1c99b10427d0a4df4201cb44513b226951a22b",
+    "assets/fonts/KaTeX_Size1-Regular-mCD8mA8B.woff2": "sha256:6b47c40166b6dbe21a5dfca7718413f2147fd2399be1ba605d8ad39cedf25dfe",
+    "assets/fonts/KaTeX_Size2-Regular-B7gKUWhC.ttf": "sha256:a6b2099fb555c60e3a0db3a08842ebf1d732c6eb4e4bf44913613bed4fc4e39b",
+    "assets/fonts/KaTeX_Size2-Regular-Dy4dx90m.woff2": "sha256:d04c54219f9eaec6d4d4fd42dfb28785975a4794d6b2fc71e566b9cd6db842dd",
+    "assets/fonts/KaTeX_Size2-Regular-oD1tc_U0.woff": "sha256:2014c523c3210bcc166648c4d4cc57f05b747df07a24277bf71c51e67dc79e3d",
+    "assets/fonts/KaTeX_Size3-Regular-CTq5MqoE.woff": "sha256:6ab6b62e9b62dae2c00dd90f791bd10950be0ecc3490d7d6045f51c2e8fe0949",
+    "assets/fonts/KaTeX_Size3-Regular-DgpXs0kz.ttf": "sha256:500e04d54f0d51666332c9d2089aa803be22aa878eca539e59fa53c6e522b082",
+    "assets/fonts/KaTeX_Size4-Regular-BF-4gkZK.woff": "sha256:99f9c6750b489c9462bf04900bd3f939df9b829339daaaaa99ef5495cdddea58",
+    "assets/fonts/KaTeX_Size4-Regular-Dl5lxZxV.woff2": "sha256:a4af7d414440a1c1790825cfb700cf9cf43b0f2c4b04f0ebc523011ad9853ec0",
+    "assets/fonts/KaTeX_Size4-Regular-DWFBv043.ttf": "sha256:c647367d1dd4e162468717d020e1fc0f1dc5c26ebfdffbe55261713bf88c5877",
+    "assets/fonts/KaTeX_Typewriter-Regular-C0xS9mPB.woff": "sha256:e14fed02b1aba7ce9f5afd5844b5d0321b22351febc720e0de8b8723527609f7",
+    "assets/fonts/KaTeX_Typewriter-Regular-CO6r4hn1.woff2": "sha256:71d517d67827787cfabdf186914cc3358eda539e37931941f2b2fd4a21f68c0b",
+    "assets/fonts/KaTeX_Typewriter-Regular-D3Ib7_Hf.ttf": "sha256:f01f3e87d9c6a61c0c081ceb577abd864eb00a612f7ac1620dd6915fad2ef5aa",
+    "assets/index-BKQ_L1z6.js": "sha256:ae6b5df63da1ac26890eeb1847272005ab3860048d8fb46de1d08732861703c3",
+    "assets/index-DPX2bQLO.css": "sha256:655002ec23f62f51efeed3e3a5fd612ae57f04597de7b00ddfd4c17238749454",
+    "assets/langs/c-BIGW1oBm.js": "sha256:9c06263922b97a0e5890b832e23d44f3c0da54430ac6f971aa0ede8f4c2b8b66",
+    "assets/langs/cpp-DIPi6g--.js": "sha256:e8e90a01d5632251be2784ecea9b061cf05f962db1c8684a8bae6480eba88823",
+    "assets/langs/csharp-DSvCPggb.js": "sha256:8443ef70cc6fec2de601c15c548ab1890e9bbc71a21ba9c216de77481c3cb6d6",
+    "assets/langs/css-CLj8gQPS.js": "sha256:69ee0204c2c40a92b8368049da700f0d08d40f5274809cfb624fd09e73eb32ee",
+    "assets/langs/go-C27-OAKa.js": "sha256:a6c3f73f1abb778ef3f5e489db1942542dc88ddac5b111ff55813fa1655dd23c",
+    "assets/langs/html-CfGypltT.js": "sha256:15ce12410bda36a36fe67290bd2ed65ab32f90c9624554f129632613843e43d0",
+    "assets/langs/ini-BEwlwnbL.js": "sha256:d72bde3de42bb1ef3268bd65afedecf54747c208ac24335f7c6b4456924091c1",
+    "assets/langs/java-CylS5w8V.js": "sha256:934a0e63cf4cefb991100f15c42fdc60aaee3c7036a7ba6cb10ce5a6322a7ae9",
+    "assets/langs/kotlin-BdnUsdx6.js": "sha256:99d81f485d9366a1f3f8c84b0fc5cee69b0d28d6c8f7f1e8dac29e554e80d24f",
+    "assets/langs/less-B1dDrJ26.js": "sha256:50c4bace8838379b74e0a22dab369c3cb81b57ba1b5b17ea5af8668f8290e8bf",
+    "assets/langs/lua-BaeVxFsk.js": "sha256:b218901041a92a152f51a7f3f74f26120e931e258abb1c73bcee551721015f67",
+    "assets/langs/markdown-Cvjx9yec.js": "sha256:d9a83df9f57287a1f3594d5231480ea90a14adf7a8550c7a57930c3cf5b3f47d",
+    "assets/langs/mdx-Cmh6b_Ma.js": "sha256:8b88c45af52bcc95513e479bfce5b068d91f60a811acf8bb614bbb071d0e1151",
+    "assets/langs/php-DJl5gRdb.js": "sha256:c2f5205e0694b71750105b62bc4cd03699d4e458d2eb7e45a21788687736a986",
+    "assets/langs/python-B6aJPvgy.js": "sha256:1c6725168b498ade965cf0d8723c600fc9bf0de74988b6191106b304b571aaae",
+    "assets/langs/ruby-5eNB0pDK.js": "sha256:e9e3739ee4458e3f2d7522cf1f64a0e3d103d77b09c6ed500ea0e886a2b0904c",
+    "assets/langs/rust-B1yitclQ.js": "sha256:c02d27696b07c37fa2cac9de826a967a30401a33959cd891ebbf11d5bf245ce3",
+    "assets/langs/scss-D5BDwBP9.js": "sha256:d873165bb797f0547966aa681ade9af96c06ec17c2b0c12708303d9ace461753",
+    "assets/langs/sql-CRqJ_cUM.js": "sha256:60e00dca0f03a580d3717adbb9c730772e750909dc8c78408051091278eda6c0",
+    "assets/langs/swift-D82vCrfD.js": "sha256:db1c1476b58bc8b4ed86fe585ad9191fcb55b7ad851144e7d60af1836f49c26a",
+    "assets/langs/toml-vGWfd6FD.js": "sha256:aeb916b96e9eb064aa87c8f765abfded0ab0d53aefa3aa9b90cc1af4d1ad75d2",
+    "assets/langs/xml-sdJ4AIDG.js": "sha256:d41d94621a62727ad56943d2d7e04e820c2642c3a9c246eb10e7d6e6e89d1fed",
+    "assets/langs/yaml-Buea-lGh.js": "sha256:8aad9cddbe3602b06b194e66d021aa63d715df01cf94e8ffcac810e48f0529e3",
+    "assets/vendor-BNsW4eBh.css": "sha256:9860041e810431da5a6b83e63f883ab8ff4fc49b4af3fc76681b46f778783a9f",
+    "assets/vendor-CCJJTK99.js": "sha256:38f95ea3ff85b49dc4d8f237db208bbaedd2cb8c31611215c246dde41786ff21",
+    "crowdy.html": "sha256:e8d7dc25b4f49bcd37ee293317516aa1aa234e64321e824f44f0eca69935acfe",
+    "favicon.svg": "sha256:c61a62a9d47d8660f9cfe08aac6775ff0476f7d6c5053f7659c1f8493fd6d814",
+    "index.html": "sha256:e8d7dc25b4f49bcd37ee293317516aa1aa234e64321e824f44f0eca69935acfe",
+    "manifest.webmanifest": "sha256:9b54d57eea00f2fdd1affe6e7999a4209a515755f12ac1a3299da2d55e178d4c",
+    "preview/bootstrap-CYECZNXt.js": "sha256:9f303a0485c0badfdd19fad0c357ef050c5b9a343744ab5bf0c70015e7d95092",
+    "preview/crowdy-boot-D0e56jZN.js": "sha256:b08fc35fb3a549662388c88fa99dd0dbbc7e553e6d6cccac74c50a6967af88ef",
+    "preview/vfs-image.tar.gz": "sha256:1e8d03ad47b957b074a0b68a575d64f69a76e62c1f6da32ff23051ba4128554c",
+    "preview/worker-C8-_ANaz.js": "sha256:81099e5732dfe0c32bacd5897316b7956c5a0a22da01b4a0c6e21d0a3b9d9aa1"
+  }
+}

package/dist/dsh-web/LICENSE.deepseek-harness

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 DeepSeek
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/dist/dsh-web/THIRD_PARTY_NOTICES.md

@@ -0,0 +1,226 @@
+<!-- Generated by scripts/gen-third-party-notices.ts — do not edit by hand.
+     Run `pnpm run gen-third-party-notices` to regenerate. -->
+
+# Third-Party Notices
+
+DeepSeek Harness is licensed under [MIT](LICENSE). It depends on the third-party software listed below. Each project remains under its own license; nothing in this file changes those terms.
+
+This file lists **direct** dependencies declared by the workspace and the explicitly disclosed official Claude Code platform payload closure. It is generated from the workspace manifests by `scripts/gen-third-party-notices.ts`: a pre-commit hook regenerates it whenever a staged file changes one of its inputs, and `scripts/gen-third-party-notices.spec.ts` asserts in the test lane that the committed bytes match. Deleting a manifest runs no hook, so that case is caught by the assertion instead. Run `pnpm run verify-third-party-notices` for the standalone check.
+
+The complete npm transitive closure, including the Landlock launcher workspace, is recorded with exact pinned versions in [`pnpm-lock.yaml`](pnpm-lock.yaml) — inspect it with `pnpm licenses list`. The Python closure is recorded separately in [`python/sdk/uv.lock`](python/sdk/uv.lock).
+
+## Vendored source (`vendor/`)
+
+The Cordis framework and its foundation libraries are source-vendored into this repository rather than consumed from npm, and republished under the `@deepseek-ai` scope. All are MIT-licensed; each directory preserves its upstream `LICENSE` file. Exact upstream commits and local modifications are recorded in [`vendor/README.md`](vendor/README.md).
+
+| Package | Upstream name | Upstream | License |
+| --- | --- | --- | --- |
+| `@deepseek-ai/cosmokit` | `cosmokit` | [github.com/deepseek-harness/cosmokit](https://github.com/deepseek-harness/cosmokit) | MIT |
+| `@deepseek-ai/schemastery` | `schemastery` | [github.com/deepseek-harness/schemastery](https://github.com/deepseek-harness/schemastery) | MIT |
+| `@deepseek-ai/cordis` | `cordis` | [github.com/cordiverse/cordis](https://github.com/cordiverse/cordis) | MIT |
+| `@deepseek-ai/cordis-plugin-loader` | `@cordisjs/plugin-loader` | [github.com/cordiverse/cordis](https://github.com/cordiverse/cordis) | MIT |
+| `@deepseek-ai/cordis-plugin-include` | `@cordisjs/plugin-include` | [github.com/deepseek-harness/cordis](https://github.com/deepseek-harness/cordis) | MIT |
+| `@deepseek-ai/cordis-plugin-group` | `@cordisjs/plugin-group` | [github.com/deepseek-harness/cordis](https://github.com/deepseek-harness/cordis) | MIT |
+| `@deepseek-ai/cordis-plugin-timer` | `@cordisjs/plugin-timer` | [github.com/deepseek-harness/cordis](https://github.com/deepseek-harness/cordis) | MIT |
+| `@deepseek-ai/cordis-plugin-hmr` | `@cordisjs/plugin-hmr` | [github.com/deepseek-harness/cordis](https://github.com/deepseek-harness/cordis) | MIT |
+| `@deepseek-ai/cordis-plugin-logger-console` | `@cordisjs/plugin-logger-console` | [github.com/deepseek-harness/cordis](https://github.com/deepseek-harness/cordis) | MIT |
+
+## Runtime npm dependencies
+
+External packages installed for runtime use or distributed inside the prebuilt browser artifacts. Browser inputs are resolved through the shipping tsdown and Vite configurations, independently of npm dependency sections. The tier covers every plugin a user can mount from `cordis.yml` — not only what the `dsh` CLI, Web UI, and Python SDK runtime load by default.
+
+| Package | License |
+| --- | --- |
+| [`@agentclientprotocol/sdk`](https://github.com/agentclientprotocol/typescript-sdk) | Apache-2.0 |
+| [`@anthropic-ai/claude-agent-sdk`](https://github.com/anthropics/claude-agent-sdk-typescript) | SEE LICENSE IN README.md |
+| [`@anthropic-ai/sdk`](https://github.com/anthropics/anthropic-sdk-typescript) | MIT |
+| [`@babel/code-frame`](https://github.com/babel/babel) | MIT |
+| [`@earendil-works/pi-ai`](https://github.com/earendil-works/pi) | MIT |
+| [`@joplin/turndown-plugin-gfm`](https://github.com/laurent22/joplin-turndown-plugin-gfm) | MIT |
+| [`@jridgewell/gen-mapping`](https://github.com/jridgewell/sourcemaps) | MIT |
+| [`@lexical/history`](https://github.com/facebook/lexical) | MIT |
+| [`@lexical/plain-text`](https://github.com/facebook/lexical) | MIT |
+| [`@lexical/text`](https://github.com/facebook/lexical) | MIT |
+| [`@lexical/utils`](https://github.com/facebook/lexical) | MIT |
+| [`@modelcontextprotocol/sdk`](https://github.com/modelcontextprotocol/typescript-sdk) | MIT |
+| [`@noble/hashes`](https://github.com/paulmillr/noble-hashes) | MIT |
+| [`@octokit/webhooks`](https://github.com/octokit/webhooks.js) | MIT |
+| [`@openai/codex`](https://github.com/openai/codex) | Apache-2.0 |
+| [`@opentelemetry/api`](https://github.com/open-telemetry/opentelemetry-js) | Apache-2.0 |
+| [`@opentelemetry/api-logs`](https://github.com/open-telemetry/opentelemetry-js) | Apache-2.0 |
+| [`@opentelemetry/exporter-logs-otlp-http`](https://github.com/open-telemetry/opentelemetry-js) | Apache-2.0 |
+| [`@opentelemetry/otlp-exporter-base`](https://github.com/open-telemetry/opentelemetry-js) | Apache-2.0 |
+| [`@opentelemetry/resources`](https://github.com/open-telemetry/opentelemetry-js) | Apache-2.0 |
+| [`@opentelemetry/sdk-logs`](https://github.com/open-telemetry/opentelemetry-js) | Apache-2.0 |
+| [`@shikijs/langs`](https://github.com/shikijs/shiki) | MIT |
+| [`@standard-schema/spec`](https://github.com/standard-schema/standard-schema) | MIT |
+| [`@tanstack/react-virtual`](https://github.com/TanStack/virtual) | MIT |
+| [`@vscode/ripgrep`](https://github.com/microsoft/vscode-ripgrep) | MIT |
+| [`@xterm/headless`](https://github.com/xtermjs/xterm.js) | MIT |
+| [`@yarnpkg/parsers`](https://github.com/yarnpkg/berry) | BSD-2-Clause |
+| [`acorn`](https://github.com/acornjs/acorn) | MIT |
+| [`anser`](https://github.com/IonicaBizau/anser) | MIT |
+| [`buffer`](https://github.com/feross/buffer) | MIT |
+| [`chokidar`](https://github.com/paulmillr/chokidar) | MIT |
+| [`clsx`](https://github.com/lukeed/clsx) | MIT |
+| [`commander`](https://github.com/tj/commander.js) | MIT |
+| [`compression`](https://github.com/expressjs/compression) | MIT |
+| [`diff`](https://github.com/kpdecker/jsdiff) | BSD-3-Clause |
+| [`e2b`](https://github.com/e2b-dev/e2b) | MIT |
+| [`electron-updater`](https://github.com/electron-userland/electron-builder) | MIT |
+| [`eventsource-parser`](https://github.com/rexxars/eventsource-parser) | MIT |
+| [`fflate`](https://github.com/101arrowz/fflate) | MIT |
+| [`immer`](https://github.com/immerjs/immer) | MIT |
+| [`ipaddr.js`](https://github.com/whitequark/ipaddr.js) | MIT |
+| [`js-yaml`](https://github.com/nodeca/js-yaml) | MIT |
+| [`katex`](https://github.com/KaTeX/KaTeX) | MIT |
+| [`koffi`](https://github.com/Koromix/koffi) | MIT |
+| [`lexical`](https://github.com/facebook/lexical) | MIT |
+| [`mdast-util-from-markdown`](https://github.com/syntax-tree/mdast-util-from-markdown) | MIT |
+| [`mdast-util-gfm`](https://github.com/syntax-tree/mdast-util-gfm) | MIT |
+| [`mdast-util-math`](https://github.com/syntax-tree/mdast-util-math) | MIT |
+| [`micromark-core-commonmark`](https://github.com/micromark/micromark/tree/main/packages/micromark-core-commonmark) | MIT |
+| [`micromark-extension-gfm`](https://github.com/micromark/micromark-extension-gfm) | MIT |
+| [`micromark-extension-math`](https://github.com/micromark/micromark-extension-math) | MIT |
+| [`micromark-factory-space`](https://github.com/micromark/micromark/tree/main/packages/micromark-factory-space) | MIT |
+| [`micromark-util-character`](https://github.com/micromark/micromark/tree/main/packages/micromark-util-character) | MIT |
+| [`micromark-util-classify-character`](https://github.com/micromark/micromark/tree/main/packages/micromark-util-classify-character) | MIT |
+| [`micromark-util-sanitize-uri`](https://github.com/micromark/micromark/tree/main/packages/micromark-util-sanitize-uri) | MIT |
+| [`micromark-util-symbol`](https://github.com/micromark/micromark/tree/main/packages/micromark-util-symbol) | MIT |
+| [`mime-types`](https://github.com/jshttp/mime-types) | MIT |
+| [`negotiator`](https://github.com/jshttp/negotiator) | MIT |
+| [`node-addon-require-builtin`](https://www.npmjs.com/package/node-addon-require-builtin) | MIT |
+| [`node-pty`](https://github.com/microsoft/node-pty) | MIT |
+| [`open`](https://github.com/sindresorhus/open) | MIT |
+| [`pdfjs-dist`](https://github.com/mozilla/pdf.js) | Apache-2.0 |
+| [`picomatch`](https://github.com/micromatch/picomatch) | MIT |
+| [`react`](https://github.com/facebook/react) | MIT |
+| [`react-dom`](https://github.com/facebook/react) | MIT |
+| [`readable-stream`](https://github.com/nodejs/readable-stream) | MIT |
+| [`resolve.exports`](https://github.com/lukeed/resolve.exports) | MIT |
+| [`semver`](https://github.com/npm/node-semver) | ISC |
+| [`sharp`](https://github.com/lovell/sharp) | Apache-2.0 |
+| [`shiki`](https://github.com/shikijs/shiki) | MIT |
+| [`supports-color`](https://github.com/chalk/supports-color) | MIT |
+| [`tsx`](https://github.com/privatenumber/tsx) | MIT |
+| [`turndown`](https://github.com/mixmark-io/turndown) | MIT |
+| [`typescript`](https://github.com/microsoft/TypeScript) | Apache-2.0 |
+| [`undici`](https://github.com/nodejs/undici) | MIT |
+| [`use-sync-external-store`](https://github.com/facebook/react) | MIT |
+| [`ws`](https://github.com/websockets/ws) | MIT |
+| [`yaml`](https://github.com/eemeli/yaml) | ISC |
+| [`zod`](https://github.com/colinhacks/zod) | MIT |
+| [`zustand`](https://github.com/pmndrs/zustand) | MIT |
+
+pnpm applies local patches to the following packages at install time, so shipped artifacts carry modified copies; each patch file is the complete record of the modification:
+
+- `@yao-pkg/pkg@6.21.0` — [`patches/@yao-pkg__pkg@6.21.0.patch`](patches/@yao-pkg__pkg@6.21.0.patch)
+- `node-pty@1.2.0-beta.15` — [`patches/node-pty@1.2.0-beta.15.patch`](patches/node-pty@1.2.0-beta.15.patch)
+
+## Official Claude Code platform payloads
+
+The project owner authorizes distribution of every version of the official `@anthropic-ai/claude-agent-sdk` package and the official Claude Code CLI/platform payloads that each version declares through `optionalDependencies`. This identity-scoped authorization does not classify their declared terms as permissive and does not cover any unrelated runtime package; version, declared-license, and payload-set changes still require the ordinary dependency, lockfile, compatibility, terms, and notices review.
+
+The installed SDK 0.3.263 declares the following optional platform packages. Each carries the official Claude Code 2.1.263 executable; the package identities and versions come from the SDK manifest, while the declared license field is verified against the platform payload installed for the current host.
+
+| Optional platform package | Version | Declared license |
+| --- | --- | --- |
+| [`@anthropic-ai/claude-agent-sdk-darwin-arm64`](https://www.npmjs.com/package/@anthropic-ai/claude-agent-sdk-darwin-arm64) | 0.3.263 | SEE LICENSE IN LICENSE.md |
+| [`@anthropic-ai/claude-agent-sdk-darwin-x64`](https://www.npmjs.com/package/@anthropic-ai/claude-agent-sdk-darwin-x64) | 0.3.263 | SEE LICENSE IN LICENSE.md |
+| [`@anthropic-ai/claude-agent-sdk-linux-arm64`](https://www.npmjs.com/package/@anthropic-ai/claude-agent-sdk-linux-arm64) | 0.3.263 | SEE LICENSE IN LICENSE.md |
+| [`@anthropic-ai/claude-agent-sdk-linux-arm64-musl`](https://www.npmjs.com/package/@anthropic-ai/claude-agent-sdk-linux-arm64-musl) | 0.3.263 | SEE LICENSE IN LICENSE.md |
+| [`@anthropic-ai/claude-agent-sdk-linux-x64`](https://www.npmjs.com/package/@anthropic-ai/claude-agent-sdk-linux-x64) | 0.3.263 | SEE LICENSE IN LICENSE.md |
+| [`@anthropic-ai/claude-agent-sdk-linux-x64-musl`](https://www.npmjs.com/package/@anthropic-ai/claude-agent-sdk-linux-x64-musl) | 0.3.263 | SEE LICENSE IN LICENSE.md |
+| [`@anthropic-ai/claude-agent-sdk-win32-arm64`](https://www.npmjs.com/package/@anthropic-ai/claude-agent-sdk-win32-arm64) | 0.3.263 | SEE LICENSE IN LICENSE.md |
+| [`@anthropic-ai/claude-agent-sdk-win32-x64`](https://www.npmjs.com/package/@anthropic-ai/claude-agent-sdk-win32-x64) | 0.3.263 | SEE LICENSE IN LICENSE.md |
+
+
+## Development-only npm dependencies
+
+External packages **directly declared** for development, tests, types, or tooling, without a runtime installation or browser-build relationship. A package here may still be pulled in transitively by a runtime dependency — `pnpm-lock.yaml` is the authority on that full closure.
+
+| Package | License |
+| --- | --- |
+| [`@aws-sdk/client-s3`](https://github.com/aws/aws-sdk-js-v3) | Apache-2.0 |
+| [`@braintree/sanitize-url`](https://github.com/braintree/sanitize-url) | MIT |
+| [`@electron/notarize`](https://github.com/electron/notarize) | MIT |
+| [`@lexical/headless`](https://github.com/facebook/lexical) | MIT |
+| [`@modelcontextprotocol/server-everything`](https://github.com/modelcontextprotocol/servers) | MIT / Apache-2.0 |
+| [`@modelcontextprotocol/server-filesystem`](https://github.com/modelcontextprotocol/servers) | MIT / Apache-2.0 |
+| [`@stylistic/eslint-plugin`](https://github.com/eslint-stylistic/eslint-stylistic) | MIT |
+| [`@testing-library/dom`](https://github.com/testing-library/dom-testing-library) | MIT |
+| [`@testing-library/react`](https://github.com/testing-library/react-testing-library) | MIT |
+| [`@types/babel__code-frame`](https://github.com/DefinitelyTyped/DefinitelyTyped) | MIT |
+| [`@types/compression`](https://github.com/DefinitelyTyped/DefinitelyTyped) | MIT |
+| [`@types/js-yaml`](https://github.com/DefinitelyTyped/DefinitelyTyped) | MIT |
+| [`@types/jsdom`](https://github.com/DefinitelyTyped/DefinitelyTyped) | MIT |
+| [`@types/mdast`](https://github.com/DefinitelyTyped/DefinitelyTyped) | MIT |
+| [`@types/mime-types`](https://github.com/DefinitelyTyped/DefinitelyTyped) | MIT |
+| [`@types/negotiator`](https://github.com/DefinitelyTyped/DefinitelyTyped) | MIT |
+| [`@types/node`](https://github.com/DefinitelyTyped/DefinitelyTyped) | MIT |
+| [`@types/picomatch`](https://github.com/DefinitelyTyped/DefinitelyTyped) | MIT |
+| [`@types/react`](https://github.com/DefinitelyTyped/DefinitelyTyped) | MIT |
+| [`@types/react-dom`](https://github.com/DefinitelyTyped/DefinitelyTyped) | MIT |
+| [`@types/readable-stream`](https://github.com/DefinitelyTyped/DefinitelyTyped) | MIT |
+| [`@types/semver`](https://github.com/DefinitelyTyped/DefinitelyTyped) | MIT |
+| [`@types/spdx-expression-parse`](https://github.com/DefinitelyTyped/DefinitelyTyped) | MIT |
+| [`@types/turndown`](https://github.com/DefinitelyTyped/DefinitelyTyped) | MIT |
+| [`@types/use-sync-external-store`](https://github.com/DefinitelyTyped/DefinitelyTyped) | MIT |
+| [`@types/ws`](https://github.com/DefinitelyTyped/DefinitelyTyped) | MIT |
+| [`@vitejs/plugin-react`](https://github.com/vitejs/vite-plugin-react) | MIT |
+| [`@vitest/coverage-v8`](https://github.com/vitest-dev/vitest) | MIT |
+| [`@yao-pkg/pkg`](https://github.com/yao-pkg/pkg) | MIT |
+| [`@yarnpkg/cli-dist`](https://github.com/yarnpkg/berry) | BSD-2-Clause |
+| [`app-builder-lib`](https://github.com/electron-userland/electron-builder) | MIT |
+| [`cytoscape`](https://github.com/cytoscape/cytoscape.js) | MIT |
+| [`cytoscape-cose-bilkent`](https://github.com/cytoscape/cytoscape.js-cose-bilkent) | MIT |
+| [`dayjs`](https://github.com/iamkun/dayjs) | MIT |
+| [`debug`](https://github.com/debug-js/debug) | MIT |
+| [`electron`](https://github.com/electron/electron) | MIT |
+| [`electron-builder`](https://github.com/electron-userland/electron-builder) | MIT |
+| [`esbuild`](https://github.com/evanw/esbuild) | MIT |
+| [`eslint-plugin-sonarjs`](https://github.com/SonarSource/SonarJS) | LGPL-3.0-only |
+| [`execa`](https://github.com/sindresorhus/execa) | MIT |
+| [`extract-zip`](https://github.com/maxogden/extract-zip) | BSD-2-Clause |
+| [`fast-check`](https://github.com/dubzzz/fast-check) | MIT |
+| [`http-server`](https://github.com/http-party/http-server) | MIT |
+| [`istanbul-lib-report`](https://github.com/istanbuljs/istanbuljs) | BSD-3-Clause |
+| [`jscpd`](https://github.com/kucherenko/jscpd) | MIT |
+| [`jsdom`](https://github.com/jsdom/jsdom) | MIT |
+| [`lefthook`](https://github.com/evilmartians/lefthook) | MIT |
+| [`lightningcss`](https://github.com/parcel-bundler/lightningcss) | MPL-2.0 |
+| [`mermaid`](https://github.com/mermaid-js/mermaid) | MIT |
+| [`micromark-util-types`](https://github.com/micromark/micromark/tree/main/packages/micromark-util-types) | MIT |
+| [`msgpackr`](http://github.com/kriszyp/msgpackr) | MIT |
+| [`oxlint`](https://github.com/oxc-project/oxc) | MIT |
+| [`oxlint-tsgolint`](https://github.com/oxc-project/tsgolint) | MIT |
+| [`playwright`](https://github.com/microsoft/playwright) | Apache-2.0 |
+| [`pnpm`](https://github.com/pnpm/pnpm) | MIT |
+| [`publint`](https://github.com/publint/publint) | MIT |
+| [`smol-toml`](https://github.com/squirrelchat/smol-toml) | BSD-3-Clause |
+| [`spdx-expression-parse`](https://github.com/jslicense/spdx-expression-parse.js) | MIT |
+| [`tar`](https://github.com/isaacs/node-tar) | BlueOak-1.0.0 |
+| [`tsdown`](https://github.com/rolldown/tsdown) | MIT |
+| [`typescript-language-server`](https://github.com/typescript-language-server/typescript-language-server) | Apache-2.0 |
+| [`vite`](https://github.com/vitejs/vite) | MIT |
+| [`vite-tsconfig-paths`](https://github.com/aleclarson/vite-tsconfig-paths) | MIT |
+| [`vitepress`](https://github.com/vuejs/vitepress) | MIT |
+| [`vitepress-plugin-mermaid`](https://github.com/emersonbottero/vitepress-plugin-mermaid) | MIT |
+| [`vitest`](https://github.com/vitest-dev/vitest) | MIT |
+
+`eslint-plugin-sonarjs` (LGPL-3.0-only) and `lightningcss` (MPL-2.0) run only as development tooling; their code is not linked into or distributed with any DeepSeek Harness artifact.
+
+## Python SDK dependencies (`python/`)
+
+Direct dependencies of the `pyproject.toml` manifests, plus `uv` as the development workflow tool.
+
+| Package | License | Role |
+| --- | --- | --- |
+| [`hatchling`](https://github.com/pypa/hatch) | MIT | build backend |
+| [`pydantic`](https://github.com/pydantic/pydantic) | MIT | runtime dependency of `deepseek-harness-sdk` |
+| [`pytest`](https://github.com/pytest-dev/pytest) | MIT | test-only |
+| [`uv`](https://github.com/astral-sh/uv) | MIT / Apache-2.0 | development workflow tool |
+
+## First-party native packages
+
+`@deepseek-ai/node-addon-system` (and its platform packages) is built and released from this repository under BSD 3-Clause. It is listed here for completeness; it is first-party, not third-party.