@deepailab/dal-remote-daemon 0.1.0 → 0.1.1

package/NOTICE

@@ -191,11 +191,31 @@ Modifications by DeepAILab LLC
   The daemon, its web UI and every dependency it loads are bundled into the
   npm package @deepailab/dal-remote-daemon, which `dal remote enable`
   installs without install scripts and runs as a per-user service.
+  The brand starts only the built-in plugins its shell configuration lists
+  (none for DAL Code), so the daemon starts no plugin processes for the
+  providers the brand hides.
   New files:
     packages/remote-daemon/bin/dal-remote-daemon.mjs
     packages/remote-daemon/scripts/build-package.mjs
     packages/remote-daemon/.gitignore
   Changed files:
-    package.json
+    package.json, shell-config/dal.json, scripts/shell-config.mjs
+    packages/protocol/src/shell-config.gen.ts
+    packages/server/src/server/plugins/builtin/index.ts (+ test)
+
+2026-10-18  Provider SDKs loaded on use; licence check for the daemon package
+  Provider SDKs (Claude, ACP, OpenCode) load when their provider is first
+  used and report "not included in this build" when absent, so the phone
+  daemon package carries only the SDKs of the providers the brand shows.
+  The package build refuses any bundled package without a permissive
+  licence and lists every bundled package's licence in
+  THIRD-PARTY-NOTICES.md.
+  New files:
+    packages/server/src/server/agent/providers/provider-sdk.ts (+ test)
+  Changed files:
+    packages/server/src/server/agent/providers/acp-agent.ts,
+    cursor-acp-agent.ts, claude/query.ts, claude/rewind.ts,
+    opencode-agent.ts, opencode/event-consumer.ts, opencode/v2/runtime.ts
+    packages/remote-daemon/scripts/build-package.mjs
 
 2026-10-18  This NOTICE file

package/THIRD-PARTY-NOTICES.md

@@ -0,0 +1,192 @@
+# Third-party notices
+
+@deepailab/dal-remote-daemon@0.1.1 bundles the packages below. Each keeps its own licence;
+its licence and notice files are in its directory under node_modules/.
+
+| Package | Version | Licence | Licence files |
+|---|---|---|---|
+| @agentclientprotocol/sdk | 1.4.0 | Apache-2.0 | node_modules/@getpaseo/plugin/node_modules/@agentclientprotocol/sdk/LICENSE |
+| @codemirror/language | 6.12.4 | MIT | node_modules/@codemirror/language/LICENSE |
+| @codemirror/legacy-modes | 6.5.3 | MIT | node_modules/@codemirror/legacy-modes/LICENSE |
+| @codemirror/state | 6.7.1 | MIT | node_modules/@codemirror/state/LICENSE |
+| @codemirror/view | 6.43.6 | MIT | node_modules/@codemirror/view/LICENSE |
+| @esbuild/darwin-arm64 | 0.25.12 | MIT | - |
+| @esbuild/darwin-x64 | 0.25.12 | MIT | - |
+| @esbuild/linux-arm64 | 0.25.12 | MIT | - |
+| @esbuild/linux-x64 | 0.25.12 | MIT | - |
+| @getpaseo/client | 0.12.0-beta.1 | Apache-2.0 | node_modules/@getpaseo/client/LICENSE, node_modules/@getpaseo/client/NOTICE |
+| @getpaseo/highlight | 0.12.0-beta.1 | Apache-2.0 | node_modules/@getpaseo/highlight/LICENSE, node_modules/@getpaseo/highlight/NOTICE |
+| @getpaseo/plugin | 0.12.0-beta.1 | Apache-2.0 | node_modules/@getpaseo/plugin/LICENSE, node_modules/@getpaseo/plugin/NOTICE |
+| @getpaseo/protocol | 0.12.0-beta.1 | Apache-2.0 | node_modules/@getpaseo/protocol/LICENSE, node_modules/@getpaseo/protocol/NOTICE |
+| @getpaseo/relay | 0.12.0-beta.1 | Apache-2.0 | node_modules/@getpaseo/relay/LICENSE, node_modules/@getpaseo/relay/NOTICE |
+| @getpaseo/server | 0.12.0-beta.1 | Apache-2.0 | node_modules/@deepailab/dal-remote-server/LICENSE, node_modules/@deepailab/dal-remote-server/NOTICE |
+| @hono/node-server | 1.19.14 | MIT | node_modules/@hono/node-server/LICENSE |
+| @isaacs/ttlcache | 2.1.4 | BlueOak-1.0.0 | - |
+| @lezer/common | 1.5.1 | MIT | node_modules/@lezer/common/LICENSE |
+| @lezer/cpp | 1.1.5 | MIT | node_modules/@lezer/cpp/LICENSE |
+| @lezer/css | 1.3.1 | MIT | node_modules/@lezer/css/LICENSE |
+| @lezer/go | 1.0.1 | MIT | node_modules/@lezer/go/LICENSE |
+| @lezer/highlight | 1.2.3 | MIT | node_modules/@lezer/highlight/LICENSE |
+| @lezer/html | 1.3.13 | MIT | node_modules/@lezer/html/LICENSE |
+| @lezer/java | 1.1.3 | MIT | node_modules/@lezer/java/LICENSE |
+| @lezer/javascript | 1.5.4 | MIT | node_modules/@lezer/javascript/LICENSE |
+| @lezer/json | 1.0.3 | MIT | node_modules/@lezer/json/LICENSE |
+| @lezer/lr | 1.4.8 | MIT | node_modules/@lezer/lr/LICENSE |
+| @lezer/markdown | 1.6.3 | MIT | node_modules/@lezer/markdown/LICENSE |
+| @lezer/php | 1.0.5 | MIT | node_modules/@lezer/php/LICENSE |
+| @lezer/python | 1.1.18 | MIT | node_modules/@lezer/python/LICENSE |
+| @lezer/rust | 1.0.2 | MIT | node_modules/@lezer/rust/LICENSE |
+| @lezer/xml | 1.0.6 | MIT | node_modules/@lezer/xml/LICENSE |
+| @lezer/yaml | 1.0.4 | MIT | node_modules/@lezer/yaml/LICENSE |
+| @marijn/find-cluster-break | 1.0.2 | MIT | node_modules/@marijn/find-cluster-break/LICENSE |
+| @modelcontextprotocol/sdk | 1.29.0 | MIT | node_modules/@modelcontextprotocol/sdk/LICENSE |
+| @pinojs/redact | 0.4.0 | MIT | node_modules/@pinojs/redact/LICENSE |
+| @xterm/headless | 6.0.0 | MIT | - |
+| accepts | 1.3.8 | MIT | node_modules/accepts/LICENSE |
+| ajv-formats | 3.0.1 | MIT | node_modules/@modelcontextprotocol/sdk/node_modules/ajv-formats/LICENSE |
+| ajv | 8.20.0 | MIT | - |
+| ajv | 8.20.0 | MIT | node_modules/@modelcontextprotocol/sdk/node_modules/ajv/LICENSE |
+| ansi-regex | 6.2.2 | MIT | - |
+| array-flatten | 1.1.1 | MIT | node_modules/array-flatten/LICENSE |
+| atomic-sleep | 1.0.0 | MIT | node_modules/atomic-sleep/LICENSE |
+| base64-js | 1.5.1 | MIT | node_modules/base64-js/LICENSE |
+| bcryptjs | 3.0.3 | BSD-3-Clause | node_modules/bcryptjs/LICENSE |
+| body-parser | 1.20.4 | MIT | node_modules/body-parser/LICENSE |
+| buffer-from | 1.1.2 | MIT | node_modules/buffer-from/LICENSE |
+| bytes | 3.1.2 | MIT | node_modules/bytes/LICENSE |
+| call-bind-apply-helpers | 1.0.2 | MIT | node_modules/call-bind-apply-helpers/LICENSE |
+| call-bound | 1.0.4 | MIT | node_modules/call-bound/LICENSE |
+| colorette | 2.0.20 | MIT | node_modules/colorette/LICENSE.md |
+| content-disposition | 0.5.4 | MIT | node_modules/content-disposition/LICENSE |
+| content-type | 1.0.5 | MIT | node_modules/content-type/LICENSE |
+| cookie-signature | 1.0.7 | MIT | - |
+| cookie | 0.7.2 | MIT | node_modules/cookie/LICENSE |
+| crelt | 1.0.6 | MIT | node_modules/crelt/LICENSE |
+| cross-spawn | 7.0.6 | MIT | node_modules/cross-spawn/LICENSE |
+| dateformat | 4.6.3 | MIT | node_modules/dateformat/LICENSE |
+| debug | 2.6.9 | MIT | node_modules/body-parser/node_modules/debug/LICENSE |
+| debug | 2.6.9 | MIT | node_modules/express/node_modules/debug/LICENSE |
+| debug | 2.6.9 | MIT | node_modules/send/node_modules/debug/LICENSE |
+| depd | 2.0.0 | MIT | node_modules/depd/LICENSE |
+| destroy | 1.2.0 | MIT | node_modules/destroy/LICENSE |
+| dijkstrajs | 1.0.3 | MIT | node_modules/dijkstrajs/LICENSE.md |
+| dunder-proto | 1.0.1 | MIT | node_modules/dunder-proto/LICENSE |
+| ee-first | 1.1.1 | MIT | node_modules/ee-first/LICENSE |
+| encodeurl | 2.0.0 | MIT | node_modules/encodeurl/LICENSE |
+| end-of-stream | 1.4.5 | MIT | node_modules/end-of-stream/LICENSE |
+| entities | 2.0.3 | BSD-2-Clause | node_modules/markdown-it/node_modules/entities/LICENSE |
+| es-define-property | 1.0.1 | MIT | node_modules/es-define-property/LICENSE |
+| es-errors | 1.3.0 | MIT | node_modules/es-errors/LICENSE |
+| es-object-atoms | 1.1.1 | MIT | node_modules/es-object-atoms/LICENSE |
+| esbuild | 0.25.12 | MIT | - |
+| escape-html | 1.0.3 | MIT | node_modules/escape-html/LICENSE |
+| etag | 1.8.1 | MIT | node_modules/etag/LICENSE |
+| eventsource-parser | 3.0.6 | MIT | node_modules/eventsource-parser/LICENSE |
+| eventsource | 3.0.7 | MIT | node_modules/eventsource/LICENSE |
+| express | 4.22.1 | MIT | node_modules/express/LICENSE |
+| fast-copy | 4.0.2 | MIT | node_modules/fast-copy/LICENSE |
+| fast-deep-equal | 3.1.3 | MIT | node_modules/fast-deep-equal/LICENSE |
+| fast-safe-stringify | 2.1.1 | MIT | node_modules/fast-safe-stringify/LICENSE |
+| fast-uri | 3.1.2 | BSD-3-Clause | node_modules/fast-uri/LICENSE |
+| finalhandler | 1.3.2 | MIT | node_modules/express/node_modules/finalhandler/LICENSE |
+| forwarded | 0.2.0 | MIT | node_modules/forwarded/LICENSE |
+| fresh | 0.5.2 | MIT | node_modules/fresh/LICENSE |
+| function-bind | 1.1.2 | MIT | node_modules/function-bind/LICENSE |
+| get-intrinsic | 1.3.0 | MIT | node_modules/get-intrinsic/LICENSE |
+| get-proto | 1.0.1 | MIT | node_modules/get-proto/LICENSE |
+| gopd | 1.2.0 | MIT | node_modules/gopd/LICENSE |
+| has-symbols | 1.1.0 | MIT | node_modules/has-symbols/LICENSE |
+| hasown | 2.0.2 | MIT | node_modules/hasown/LICENSE |
+| http-errors | 2.0.1 | MIT | node_modules/http-errors/LICENSE |
+| iconv-lite | 0.4.24 | MIT | node_modules/body-parser/node_modules/iconv-lite/LICENSE |
+| iconv-lite | 0.4.24 | MIT | node_modules/raw-body/node_modules/iconv-lite/LICENSE |
+| inherits | 2.0.4 | ISC | node_modules/inherits/LICENSE |
+| ipaddr.js | 1.9.1 | MIT | node_modules/ipaddr.js/LICENSE |
+| isexe | 2.0.0 | ISC | node_modules/isexe/LICENSE |
+| isexe | 3.1.5 | BlueOak-1.0.0 | - |
+| json-schema-traverse | 1.0.0 | MIT | node_modules/json-schema-traverse/LICENSE |
+| lezer-elixir | 1.1.3 | Apache-2.0 | node_modules/lezer-elixir/LICENSE |
+| linkify-it | 2.2.0 | MIT | node_modules/linkify-it/LICENSE |
+| lru-cache | 11.5.1 | BlueOak-1.0.0 | - |
+| markdown-it | 10.0.0 | MIT | node_modules/markdown-it/LICENSE |
+| math-intrinsics | 1.1.0 | MIT | node_modules/math-intrinsics/LICENSE |
+| mdurl | 1.0.1 | MIT | node_modules/mdurl/LICENSE |
+| media-typer | 0.3.0 | MIT | node_modules/media-typer/LICENSE |
+| merge-descriptors | 1.0.3 | MIT | node_modules/merge-descriptors/LICENSE |
+| methods | 1.1.2 | MIT | node_modules/methods/LICENSE |
+| mime-db | 1.52.0 | MIT | node_modules/mime-types/node_modules/mime-db/LICENSE |
+| mime-types | 2.1.35 | MIT | node_modules/mime-types/LICENSE |
+| mime | 1.6.0 | MIT | node_modules/send/node_modules/mime/LICENSE |
+| mnemonic-id | 3.2.7 | MIT | node_modules/mnemonic-id/LICENSE |
+| ms | 2.0.0 | MIT | node_modules/body-parser/node_modules/ms/license.md |
+| ms | 2.0.0 | MIT | node_modules/express/node_modules/ms/license.md |
+| ms | 2.0.0 | MIT | node_modules/send/node_modules/debug/node_modules/ms/license.md |
+| ms | 2.1.3 | MIT | node_modules/ms/license.md |
+| negotiator | 0.6.3 | MIT | node_modules/negotiator/LICENSE |
+| node-pty | 1.2.0-beta.15 | MIT | - |
+| object-inspect | 1.13.4 | MIT | node_modules/object-inspect/LICENSE |
+| on-exit-leak-free | 2.1.2 | MIT | node_modules/on-exit-leak-free/LICENSE |
+| on-finished | 2.4.1 | MIT | node_modules/on-finished/LICENSE |
+| once | 1.4.0 | ISC | node_modules/once/LICENSE |
+| openai | 6.44.0 | Apache-2.0 | - |
+| p-limit | 7.3.0 | MIT | - |
+| p-throttle | 8.1.0 | MIT | node_modules/p-throttle/license |
+| parseurl | 1.3.3 | MIT | node_modules/parseurl/LICENSE |
+| path-key | 3.1.1 | MIT | node_modules/path-key/license |
+| path-to-regexp | 0.1.13 | MIT | node_modules/path-to-regexp/LICENSE |
+| pino-abstract-transport | 3.0.0 | MIT | node_modules/pino-abstract-transport/LICENSE |
+| pino-pretty | 13.1.3 | MIT | node_modules/pino-pretty/LICENSE |
+| pino-std-serializers | 7.1.0 | MIT | node_modules/pino-std-serializers/LICENSE |
+| pino | 10.3.1 | MIT | node_modules/pino/LICENSE |
+| pkce-challenge | 5.0.1 | MIT | node_modules/pkce-challenge/LICENSE |
+| pngjs | 5.0.0 | MIT | node_modules/qrcode/node_modules/pngjs/LICENSE |
+| proxy-addr | 2.0.7 | MIT | node_modules/proxy-addr/LICENSE |
+| pump | 3.0.4 | MIT | node_modules/pump/LICENSE |
+| qrcode | 1.5.4 | MIT | node_modules/qrcode/license |
+| qs | 6.14.2 | BSD-3-Clause | node_modules/qs/LICENSE.md |
+| quick-format-unescaped | 4.0.4 | MIT | node_modules/quick-format-unescaped/LICENSE |
+| range-parser | 1.2.1 | MIT | node_modules/range-parser/LICENSE |
+| raw-body | 2.5.3 | MIT | node_modules/raw-body/LICENSE |
+| real-require | 0.2.0 | MIT | node_modules/real-require/LICENSE.md |
+| rotating-file-stream | 3.2.9 | MIT | node_modules/rotating-file-stream/LICENSE |
+| safe-buffer | 5.2.1 | MIT | node_modules/safe-buffer/LICENSE |
+| safe-stable-stringify | 2.5.0 | MIT | node_modules/safe-stable-stringify/LICENSE |
+| safer-buffer | 2.1.2 | MIT | node_modules/safer-buffer/LICENSE |
+| secure-json-parse | 4.1.0 | BSD-3-Clause | node_modules/secure-json-parse/LICENSE |
+| semver | 7.8.5 | ISC | - |
+| semver | 7.8.5 | ISC | node_modules/@getpaseo/protocol/node_modules/semver/LICENSE |
+| send | 0.19.2 | MIT | node_modules/send/LICENSE |
+| serve-static | 1.16.3 | MIT | node_modules/serve-static/LICENSE |
+| setprototypeof | 1.2.0 | ISC | node_modules/setprototypeof/LICENSE |
+| shebang-command | 2.0.0 | MIT | node_modules/shebang-command/license |
+| shebang-regex | 3.0.0 | MIT | node_modules/shebang-regex/license |
+| side-channel-list | 1.0.0 | MIT | node_modules/side-channel-list/LICENSE |
+| side-channel-map | 1.0.1 | MIT | node_modules/side-channel-map/LICENSE |
+| side-channel-weakmap | 1.0.2 | MIT | node_modules/side-channel-weakmap/LICENSE |
+| side-channel | 1.1.0 | MIT | node_modules/side-channel/LICENSE |
+| sonic-boom | 4.2.1 | MIT | node_modules/sonic-boom/LICENSE |
+| source-map-support | 0.5.21 | MIT | node_modules/source-map-support/LICENSE.md |
+| source-map | 0.6.1 | BSD-3-Clause | node_modules/source-map-support/node_modules/source-map/LICENSE |
+| split2 | 4.2.0 | ISC | node_modules/split2/LICENSE |
+| statuses | 2.0.2 | MIT | node_modules/statuses/LICENSE |
+| strip-ansi | 7.1.2 | MIT | - |
+| style-mod | 4.1.3 | MIT | node_modules/style-mod/LICENSE |
+| thread-stream | 4.0.0 | MIT | node_modules/thread-stream/LICENSE |
+| toidentifier | 1.0.1 | MIT | node_modules/toidentifier/LICENSE |
+| tree-kill | 1.2.2 | MIT | node_modules/tree-kill/LICENSE |
+| tweetnacl | 1.0.3 | Unlicense | node_modules/tweetnacl/AUTHORS.md, node_modules/tweetnacl/LICENSE |
+| type-is | 1.6.18 | MIT | node_modules/type-is/LICENSE |
+| typescript | 5.9.3 | Apache-2.0 | node_modules/typescript/LICENSE.txt |
+| uc.micro | 1.0.6 | MIT | node_modules/uc.micro/LICENSE.txt |
+| unpipe | 1.0.0 | MIT | node_modules/unpipe/LICENSE |
+| utils-merge | 1.0.1 | MIT | node_modules/utils-merge/LICENSE |
+| uuid | 9.0.1 | MIT | node_modules/uuid/LICENSE.md |
+| vary | 1.1.2 | MIT | node_modules/vary/LICENSE |
+| w3c-keyname | 2.2.8 | MIT | node_modules/w3c-keyname/LICENSE |
+| which | 2.0.2 | ISC | node_modules/which/LICENSE |
+| which | 5.0.0 | ISC | - |
+| wrappy | 1.0.2 | ISC | node_modules/wrappy/LICENSE |
+| ws | 8.20.0 | MIT | node_modules/ws/LICENSE |
+| yocto-queue | 1.2.2 | MIT | - |
+| zod-to-json-schema | 3.25.1 | ISC | node_modules/zod-to-json-schema/LICENSE |
+| zod | 4.4.3 | MIT | node_modules/zod/LICENSE |

package/node_modules/@deepailab/dal-remote-server/NOTICE

@@ -191,11 +191,31 @@ Modifications by DeepAILab LLC
   The daemon, its web UI and every dependency it loads are bundled into the
   npm package @deepailab/dal-remote-daemon, which `dal remote enable`
   installs without install scripts and runs as a per-user service.
+  The brand starts only the built-in plugins its shell configuration lists
+  (none for DAL Code), so the daemon starts no plugin processes for the
+  providers the brand hides.
   New files:
     packages/remote-daemon/bin/dal-remote-daemon.mjs
     packages/remote-daemon/scripts/build-package.mjs
     packages/remote-daemon/.gitignore
   Changed files:
-    package.json
+    package.json, shell-config/dal.json, scripts/shell-config.mjs
+    packages/protocol/src/shell-config.gen.ts
+    packages/server/src/server/plugins/builtin/index.ts (+ test)
+
+2026-10-18  Provider SDKs loaded on use; licence check for the daemon package
+  Provider SDKs (Claude, ACP, OpenCode) load when their provider is first
+  used and report "not included in this build" when absent, so the phone
+  daemon package carries only the SDKs of the providers the brand shows.
+  The package build refuses any bundled package without a permissive
+  licence and lists every bundled package's licence in
+  THIRD-PARTY-NOTICES.md.
+  New files:
+    packages/server/src/server/agent/providers/provider-sdk.ts (+ test)
+  Changed files:
+    packages/server/src/server/agent/providers/acp-agent.ts,
+    cursor-acp-agent.ts, claude/query.ts, claude/rewind.ts,
+    opencode-agent.ts, opencode/event-consumer.ts, opencode/v2/runtime.ts
+    packages/remote-daemon/scripts/build-package.mjs
 
 2026-10-18  This NOTICE file

package/node_modules/@deepailab/dal-remote-server/dist/server/server/agent/providers/acp-agent.js

@@ -5,7 +5,7 @@ import { homedir } from "node:os";
 import path from "node:path";
 import { Readable, Writable } from "node:stream";
 import { terminateWithTreeKill } from "../../../utils/tree-kill.js";
-import { ClientSideConnection, PROTOCOL_VERSION, } from "@agentclientprotocol/sdk";
+import { loadProviderSdk } from "./provider-sdk.js";
 import { getAgentStreamEventTurnId, } from "../agent-sdk-types.js";
 import { raceProviderRefreshAbort, runProviderRefreshActivity, } from "../provider-refresh-deadline.js";
 import { isDefaultAgentCreateConfigUnattended, resolveDefaultAgentCreateConfig, } from "../create-agent-mode.js";
@@ -808,7 +808,7 @@ export class ACPAgentClient {
             });
         });
         const stream = createLoggedNdJsonStream(Writable.toWeb(child.stdin), Readable.toWeb(child.stdout), { logger: this.logger, provider: this.provider });
-        const connection = new ClientSideConnection(() => client, stream);
+        const connection = new (acpSdk().ClientSideConnection)(() => client, stream);
         return {
             child,
             connection,
@@ -830,7 +830,7 @@ export class ACPAgentClient {
         try {
             return await this.runACPRequest(() => Promise.race([
                 transport.connection.initialize({
-                    protocolVersion: PROTOCOL_VERSION,
+                    protocolVersion: acpSdk().PROTOCOL_VERSION,
                     clientCapabilities: buildACPClientCapabilities(this.clientCapabilityMeta, configuredOptions.clientCapabilities ?? this.clientCapabilities),
                     clientInfo: { name: SHELL_CONFIG.productName, version: "dev" },
                 }),
@@ -1981,14 +1981,14 @@ export class ACPAgentSession {
             }
         });
         const stream = createLoggedNdJsonStream(Writable.toWeb(child.stdin), Readable.toWeb(child.stdout), { logger: this.logger, provider: this.provider });
-        const connection = new ClientSideConnection(() => this, stream);
+        const connection = new (acpSdk().ClientSideConnection)(() => this, stream);
         // Take ownership before initialize so the outer initialization guard can
         // close the process even when the ACP handshake itself rejects.
         this.child = child;
         this.connection = connection;
         const initialize = await this.runACPRequest(() => Promise.race([
             connection.initialize({
-                protocolVersion: PROTOCOL_VERSION,
+                protocolVersion: acpSdk().PROTOCOL_VERSION,
                 clientCapabilities: buildACPClientCapabilities(this.clientCapabilityMeta, this.clientCapabilities),
                 clientInfo: { name: SHELL_CONFIG.productName, version: "dev" },
             }),
@@ -2995,4 +2995,8 @@ async function terminateChildProcess(child, timeoutMs, terminate) {
         child.stderr.destroy();
     }
 }
+/** The ACP SDK, loaded when an ACP provider first starts (it is not in every build). */
+function acpSdk() {
+    return loadProviderSdk("ACP", "@agentclientprotocol/sdk");
+}
 //# sourceMappingURL=acp-agent.js.map

package/node_modules/@deepailab/dal-remote-server/dist/server/server/agent/providers/claude/query.js

@@ -1,7 +1,7 @@
-import { query } from "@anthropic-ai/claude-agent-sdk";
 import { createProviderEnv, createProviderEnvSpec, } from "../../provider-launch-config.js";
 import { buildSelfNodeCommand } from "../../../paseo-env.js";
 import { spawnProcess } from "../../../../utils/spawn.js";
+import { loadProviderSdk } from "../provider-sdk.js";
 function isChildProcessWithStreams(child) {
     return child.stdin !== null && child.stdout !== null && child.stderr !== null;
 }
@@ -77,7 +77,8 @@ function applyRuntimeSettingsToClaudeOptions(options, context) {
     };
 }
 export function claudeQuery(input, context = {}) {
-    const launchQuery = context.queryFactory ?? query;
+    const launchQuery = context.queryFactory ??
+        loadProviderSdk("Claude", "@anthropic-ai/claude-agent-sdk").query;
     return launchQuery({
         ...input,
         options: applyRuntimeSettingsToClaudeOptions(input.options, context),

package/node_modules/@deepailab/dal-remote-server/dist/server/server/agent/providers/claude/rewind.js

@@ -1,11 +1,11 @@
 import { appendFile, readFile } from "node:fs/promises";
 import path from "node:path";
-import { forkSession as claudeForkSession, } from "@anthropic-ai/claude-agent-sdk";
+import { loadProviderSdk } from "../provider-sdk.js";
 // On its own, the SDK looks for the session under the daemon's CLAUDE_CONFIG_DIR, while a
 // provider can point Claude Code at another one. Forking through a store rooted at the
 // transcript's folder reads the session where Claude Code wrote it and writes the fork beside it.
 export const realClaudeRewindSdk = {
-    forkSession: (sessionId, options) => claudeForkSession(sessionId, {
+    forkSession: (sessionId, options) => loadProviderSdk("Claude", "@anthropic-ai/claude-agent-sdk").forkSession(sessionId, {
         upToMessageId: options.upToMessageId,
         sessionStore: projectFolderSessionStore(path.dirname(options.transcriptPath)),
     }),

package/node_modules/@deepailab/dal-remote-server/dist/server/server/agent/providers/cursor-acp-agent.js

@@ -1,7 +1,7 @@
-import { zSessionConfigOption } from "@agentclientprotocol/sdk/dist/schema/zod.gen.js";
 import { z } from "zod";
 import { deriveSelectorOptions, } from "./acp-agent.js";
 import { GenericACPAgentClient } from "./generic-acp-agent.js";
+import { loadProviderSdk } from "./provider-sdk.js";
 const CURSOR_INITIAL_COMMANDS_WAIT_TIMEOUT_MS = 10000;
 const CURSOR_CLIENT_CAPABILITY_META = {
     parameterizedModelPicker: true,
@@ -14,13 +14,17 @@ export const CURSOR_FAST_FEATURE_OPTION = {
     tooltip: "Select Cursor fast mode",
     icon: "zap",
 };
-const CursorModelCatalogSchema = z.object({
-    models: z.array(z.object({
-        value: z.string().min(1),
-        name: z.string(),
-        configOptions: z.array(zSessionConfigOption),
-    })),
-});
+// Built on first use: the ACP SDK's schemas are not in every build.
+function cursorModelCatalogSchema() {
+    const { zSessionConfigOption } = loadProviderSdk("Cursor", "@agentclientprotocol/sdk/dist/schema/zod.gen.js");
+    return z.object({
+        models: z.array(z.object({
+            value: z.string().min(1),
+            name: z.string(),
+            configOptions: z.array(zSessionConfigOption),
+        })),
+    });
+}
 // Cursor model switches persist CLI preferences, even in a throwaway probe session.
 // Its extension returns each model's parameter definitions without selecting it.
 export async function resolveCursorCatalogModels({ connection, models, provider, runRequest, }) {
@@ -42,7 +46,7 @@ export async function resolveCursorCatalogModels({ connection, models, provider,
 async function fetchCursorModelCatalog(connection) {
     try {
         const response = await connection.extMethod("cursor/list_available_models", {});
-        return CursorModelCatalogSchema.parse(response);
+        return cursorModelCatalogSchema().parse(response);
     }
     catch (error) {
         const extensionUnavailable = typeof error === "object" && error !== null && "code" in error && error.code === -32601;

package/node_modules/@deepailab/dal-remote-server/dist/server/server/agent/providers/opencode/event-consumer.js

@@ -1,4 +1,4 @@
-import { createOpencodeClient, } from "@opencode-ai/sdk/v2/client";
+import { loadProviderSdk } from "../provider-sdk.js";
 const FIRST_RECORD_WATCHDOG_MS = 5000;
 const WATCHDOG_MS = 30000;
 const MAX_BACKOFF_MS = 5000;
@@ -35,7 +35,7 @@ export class OpenCodeEventConsumer {
         this.closed = false;
         this.client =
             options.createClient?.(options.serverUrl) ??
-                createOpencodeClient({ baseUrl: options.serverUrl });
+                loadProviderSdk("OpenCode", "@opencode-ai/sdk/v2/client").createOpencodeClient({ baseUrl: options.serverUrl });
         this.logger = options.logger;
         this.timing = options.timing ?? systemTiming;
         this.readyPromise = new Promise((resolve, reject) => {

package/node_modules/@deepailab/dal-remote-server/dist/server/server/agent/providers/opencode/v2/runtime.js

@@ -1,9 +1,9 @@
 import { decorateOpenCodeV2Env, materializeOpenCodeV2Plugin } from "../bridge.js";
 import { resolvePaseoHome } from "../../../../paseo-home.js";
-import { OpenCode } from "@opencode/client";
 import { randomBytes } from "node:crypto";
 import { mkdir } from "node:fs/promises";
 import { spawnProcess } from "../../../../../utils/spawn.js";
+import { loadProviderSdk } from "../../provider-sdk.js";
 import { terminateWithTreeKill } from "../../../../../utils/tree-kill.js";
 import { createProviderEnvSpec, resolveProviderLaunch, } from "../../../provider-launch-config.js";
 import { resolveOpenCodeHomeDir } from "../paths.js";
@@ -194,6 +194,7 @@ export class V2Runtime {
                 // Drain stderr without retaining provider output that may contain credentials.
                 process.stderr?.on("data", () => undefined);
             });
+            const { OpenCode } = loadProviderSdk("OpenCode", "@opencode/client");
             const client = OpenCode.make({
                 baseUrl: url,
                 headers: {

package/node_modules/@deepailab/dal-remote-server/dist/server/server/agent/providers/opencode-agent.js

@@ -1,5 +1,5 @@
 import { validateProviderOptions } from "../provider-options.js";
-import { createOpencodeClient, } from "@opencode-ai/sdk/v2/client";
+import { loadProviderSdk } from "./provider-sdk.js";
 import fs from "node:fs/promises";
 import { randomBytes, randomUUID } from "node:crypto";
 import { isDeepStrictEqual } from "node:util";
@@ -967,7 +967,7 @@ export const __openCodeInternals = {
     },
 };
 function createSdkOpenCodeClient(options) {
-    return createOpencodeClient(options);
+    return loadProviderSdk("OpenCode", "@opencode-ai/sdk/v2/client").createOpencodeClient(options);
 }
 export class OpenCodeAgentClient {
     constructor(logger, runtimeSettings, deps = {}) {

package/node_modules/@deepailab/dal-remote-server/dist/server/server/agent/providers/provider-sdk.js

@@ -0,0 +1,46 @@
+import { createRequire } from "node:module";
+import { fileURLToPath } from "node:url";
+const requireModule = createRequire(import.meta.url);
+/**
+ * A provider whose SDK this build does not ship. A white-label build carries only the SDKs of the
+ * providers its brand shows (shell-config `providers.visible`); the others fail here, on first use,
+ * instead of when the daemon starts.
+ */
+export class ProviderSdkNotIncludedError extends Error {
+    constructor(provider, specifier, cause) {
+        super(`此版本不包含 ${provider}（${provider} is not included in this build: ${specifier}）`, {
+            cause,
+        });
+        this.name = "ProviderSdkNotIncludedError";
+        this.provider = provider;
+        this.specifier = specifier;
+    }
+}
+function isMissingModule(error) {
+    const code = error instanceof Error ? Reflect.get(error, "code") : undefined;
+    return code === "ERR_MODULE_NOT_FOUND" || code === "MODULE_NOT_FOUND";
+}
+const loaded = new Map();
+/**
+ * Loads a provider's SDK when the provider is first used. Synchronous (ESM through require), so
+ * provider classes keep their synchronous constructors and factories. `T` is the module's type,
+ * written as `typeof import("<specifier>")`.
+ */
+export function loadProviderSdk(provider, specifier) {
+    const cached = loaded.get(specifier);
+    if (cached)
+        return cached;
+    let file;
+    try {
+        file = fileURLToPath(import.meta.resolve(specifier));
+    }
+    catch (error) {
+        if (isMissingModule(error))
+            throw new ProviderSdkNotIncludedError(provider, specifier, error);
+        throw error;
+    }
+    const module = requireModule(file);
+    loaded.set(specifier, module);
+    return module;
+}
+//# sourceMappingURL=provider-sdk.js.map

package/node_modules/@deepailab/dal-remote-server/package.json

@@ -69,8 +69,6 @@
     "access": "public"
   },
   "dependencies": {
-    "@agentclientprotocol/sdk": "^0.17.1",
-    "@anthropic-ai/claude-agent-sdk": "0.3.246",
     "@getpaseo/client": "0.12.0-beta.1",
     "@getpaseo/highlight": "0.12.0-beta.1",
     "@getpaseo/plugin": "0.12.0-beta.1",
@@ -78,8 +76,6 @@
     "@getpaseo/relay": "0.12.0-beta.1",
     "@isaacs/ttlcache": "^2.1.4",
     "@modelcontextprotocol/sdk": "1.29.0",
-    "@opencode-ai/sdk": "1.14.46",
-    "@opencode/client": "2.0.10",
     "@xterm/headless": "^6.0.0",
     "ajv": "^8.20.0",
     "bcryptjs": "^3.0.3",
@@ -108,5 +104,6 @@
   },
   "overrides": {
     "lightningcss": "1.30.1"
-  }
+  },
+  "license": "Apache-2.0"
 }

package/node_modules/@getpaseo/client/NOTICE

@@ -191,11 +191,31 @@ Modifications by DeepAILab LLC
   The daemon, its web UI and every dependency it loads are bundled into the
   npm package @deepailab/dal-remote-daemon, which `dal remote enable`
   installs without install scripts and runs as a per-user service.
+  The brand starts only the built-in plugins its shell configuration lists
+  (none for DAL Code), so the daemon starts no plugin processes for the
+  providers the brand hides.
   New files:
     packages/remote-daemon/bin/dal-remote-daemon.mjs
     packages/remote-daemon/scripts/build-package.mjs
     packages/remote-daemon/.gitignore
   Changed files:
-    package.json
+    package.json, shell-config/dal.json, scripts/shell-config.mjs
+    packages/protocol/src/shell-config.gen.ts
+    packages/server/src/server/plugins/builtin/index.ts (+ test)
+
+2026-10-18  Provider SDKs loaded on use; licence check for the daemon package
+  Provider SDKs (Claude, ACP, OpenCode) load when their provider is first
+  used and report "not included in this build" when absent, so the phone
+  daemon package carries only the SDKs of the providers the brand shows.
+  The package build refuses any bundled package without a permissive
+  licence and lists every bundled package's licence in
+  THIRD-PARTY-NOTICES.md.
+  New files:
+    packages/server/src/server/agent/providers/provider-sdk.ts (+ test)
+  Changed files:
+    packages/server/src/server/agent/providers/acp-agent.ts,
+    cursor-acp-agent.ts, claude/query.ts, claude/rewind.ts,
+    opencode-agent.ts, opencode/event-consumer.ts, opencode/v2/runtime.ts
+    packages/remote-daemon/scripts/build-package.mjs
 
 2026-10-18  This NOTICE file

package/node_modules/@getpaseo/client/package.json

@@ -34,5 +34,6 @@
     "@getpaseo/protocol": "0.12.0-beta.1",
     "@getpaseo/relay": "0.12.0-beta.1",
     "zod": "^4.4.3"
-  }
+  },
+  "license": "Apache-2.0"
 }

package/node_modules/@getpaseo/highlight/NOTICE

@@ -191,11 +191,31 @@ Modifications by DeepAILab LLC
   The daemon, its web UI and every dependency it loads are bundled into the
   npm package @deepailab/dal-remote-daemon, which `dal remote enable`
   installs without install scripts and runs as a per-user service.
+  The brand starts only the built-in plugins its shell configuration lists
+  (none for DAL Code), so the daemon starts no plugin processes for the
+  providers the brand hides.
   New files:
     packages/remote-daemon/bin/dal-remote-daemon.mjs
     packages/remote-daemon/scripts/build-package.mjs
     packages/remote-daemon/.gitignore
   Changed files:
-    package.json
+    package.json, shell-config/dal.json, scripts/shell-config.mjs
+    packages/protocol/src/shell-config.gen.ts
+    packages/server/src/server/plugins/builtin/index.ts (+ test)
+
+2026-10-18  Provider SDKs loaded on use; licence check for the daemon package
+  Provider SDKs (Claude, ACP, OpenCode) load when their provider is first
+  used and report "not included in this build" when absent, so the phone
+  daemon package carries only the SDKs of the providers the brand shows.
+  The package build refuses any bundled package without a permissive
+  licence and lists every bundled package's licence in
+  THIRD-PARTY-NOTICES.md.
+  New files:
+    packages/server/src/server/agent/providers/provider-sdk.ts (+ test)
+  Changed files:
+    packages/server/src/server/agent/providers/acp-agent.ts,
+    cursor-acp-agent.ts, claude/query.ts, claude/rewind.ts,
+    opencode-agent.ts, opencode/event-consumer.ts, opencode/v2/runtime.ts
+    packages/remote-daemon/scripts/build-package.mjs
 
 2026-10-18  This NOTICE file

package/node_modules/@getpaseo/highlight/package.json

@@ -40,5 +40,6 @@
     "@lezer/xml": "^1.0.6",
     "@lezer/yaml": "^1.0.4",
     "lezer-elixir": "^1.1.2"
-  }
+  },
+  "license": "Apache-2.0"
 }

package/node_modules/@getpaseo/plugin/NOTICE

@@ -191,11 +191,31 @@ Modifications by DeepAILab LLC
   The daemon, its web UI and every dependency it loads are bundled into the
   npm package @deepailab/dal-remote-daemon, which `dal remote enable`
   installs without install scripts and runs as a per-user service.
+  The brand starts only the built-in plugins its shell configuration lists
+  (none for DAL Code), so the daemon starts no plugin processes for the
+  providers the brand hides.
   New files:
     packages/remote-daemon/bin/dal-remote-daemon.mjs
     packages/remote-daemon/scripts/build-package.mjs
     packages/remote-daemon/.gitignore
   Changed files:
-    package.json
+    package.json, shell-config/dal.json, scripts/shell-config.mjs
+    packages/protocol/src/shell-config.gen.ts
+    packages/server/src/server/plugins/builtin/index.ts (+ test)
+
+2026-10-18  Provider SDKs loaded on use; licence check for the daemon package
+  Provider SDKs (Claude, ACP, OpenCode) load when their provider is first
+  used and report "not included in this build" when absent, so the phone
+  daemon package carries only the SDKs of the providers the brand shows.
+  The package build refuses any bundled package without a permissive
+  licence and lists every bundled package's licence in
+  THIRD-PARTY-NOTICES.md.
+  New files:
+    packages/server/src/server/agent/providers/provider-sdk.ts (+ test)
+  Changed files:
+    packages/server/src/server/agent/providers/acp-agent.ts,
+    cursor-acp-agent.ts, claude/query.ts, claude/rewind.ts,
+    opencode-agent.ts, opencode/event-consumer.ts, opencode/v2/runtime.ts
+    packages/remote-daemon/scripts/build-package.mjs
 
 2026-10-18  This NOTICE file