Files
deepseek-harness/vendor
Tianyi Cui 7f024a1a9d Document the codebase thoroughly and tighten type safety
Docs: per-folder README.md for packages/ (family overview + one per
package: service, events, API, extension points, TODOs), examples/,
and examples/echo-agent/; folder-level AGENTS.md (+ CLAUDE.md
symlinks) for packages/ and vendor/; module-level doc comments in
every packages/*/src file; richer JSDoc on all exported API
(event side effects, disposal contracts, error behavior). Root
AGENTS.md gains a "Type Safety and Documentation" policy section:
the codebase aims to be very type-safe and well documented; type
gymnastics are acceptable in core packages when they improve
plugin-author DX; verbose docs are fine as long as they stay strictly
in sync with the code.

Type safety: removed the upstream-inherited "noImplicitAny": false
from tsconfig.base.json — packages/* now compile under full strict
mode; vendor/loader and vendor/include set it locally (vendor/cordis
already did). Eliminated every `: any` / `as any` from packages and
examples (catch clauses use unknown + a CodedError narrowing type;
event data access uses discriminated-union narrowing).

Typed tool schemas: new @deepseek-ai/dsh-tools schema DSL —
SchemaSpec with per-property `required: true` booleans, type-level
InferArgs<S>, a runtime SchemaSpec → JSON Schema converter, and
defineTool() so first-party tools get typed execute(args) with zero
casts (raw JSON Schema still accepted for MCP interop; chosen over
schemastery because it targets JSON Schema generation directly).
echo-tool and all test tools migrated; +7 tests.
2026-06-11 13:01:00 +08:00
..

Vendored Packages

This directory contains source-vendored copies of the Cordis framework and its foundation libraries. They are copied into this monorepo instead of being depended on via npm, so that the harness fully owns its framework layer (auditable, patchable, pinned).

All vendored packages keep their original npm names (they are resolved through Yarn workspaces) and are marked private: true — they are never published from this repo. Upstream MIT LICENSE files are preserved in each package directory.

Manifest

Upstream workspace: cordis-workspace (local checkout: ~/repos/cordis-workspace).

Directory npm name Version Upstream repo Commit
cosmokit/ cosmokit 1.8.1 https://github.com/deepseek-harness/cosmokit 16f6fc058ade66e8ac5da0033d35a8d0f279f544
schemastery/ schemastery 3.18.0 https://github.com/deepseek-harness/schemastery (packages/core) e67cee00ad725bd1534aee930a979ea3eec6f698
cordis/ cordis 4.0.0-rc.6 https://github.com/deepseek-harness/cordis (packages/core) abb0a307cb1d3b0947f455d590cf5ba922d4caa4
loader/ @cordisjs/plugin-loader 1.0.0-rc.4 https://github.com/deepseek-harness/cordis (packages/loader) abb0a307cb1d3b0947f455d590cf5ba922d4caa4
include/ @cordisjs/plugin-include 1.0.4 https://github.com/deepseek-harness/cordis (packages/include) abb0a307cb1d3b0947f455d590cf5ba922d4caa4
group/ @cordisjs/plugin-group 1.0.0 https://github.com/deepseek-harness/cordis (packages/group) abb0a307cb1d3b0947f455d590cf5ba922d4caa4
timer/ @cordisjs/plugin-timer 1.1.2 https://github.com/deepseek-harness/cordis (packages/timer) abb0a307cb1d3b0947f455d590cf5ba922d4caa4
hmr/ @cordisjs/plugin-hmr 1.0.15 https://github.com/deepseek-harness/cordis (packages/hmr) abb0a307cb1d3b0947f455d590cf5ba922d4caa4
logger-console/ @cordisjs/plugin-logger-console 1.0.0 https://github.com/deepseek-harness/cordis (packages/logger-console) abb0a307cb1d3b0947f455d590cf5ba922d4caa4

Third-party dependencies of the vendored packages stay on npm: @standard-schema/spec, js-yaml, chokidar, picomatch, @babel/code-frame, supports-color.

Intentionally not vendored (verified unused by this set): reggol, @cordisjs/utils, @cordisjs/element, @cordisjs/unyaml (dev-time YAML import hook only).

Local modifications

Keep this log exhaustive — every divergence from upstream must be listed.

  1. hmr/src/index.ts: removed the ./locales/en-US.yml / ./locales/zh-CN.yml imports, the .i18n({...}) call on the Config schema, and the src/locales/ directory. Rationale: those imports require a runtime YAML loader hook (@cordisjs/unyaml) that we do not vendor; the i18n texts only localize config descriptions.
  2. All package.json files: regenerated — added private: true, added src to files and a ./src/* export where missing, removed upstream devDependencies/scripts/repository fields. Dependency and peer-dependency ranges preserved.
  3. All tsconfig.json files: regenerated to extend the repo-root tsconfig.base.json and declare project references.

Sync procedure

To update a vendored package from upstream:

  1. In the upstream workspace, note git rev-parse HEAD of the relevant submodule.
  2. Copy the package's src/ (and bin.js, README.md, LICENSE if changed) over the vendored directory.
  3. Re-apply the local modifications listed above (or drop them if upstream made them unnecessary — update the log either way).
  4. Update the version and commit hash in the manifest table.
  5. Run yarn install && yarn test && yarn build at the repo root.