# Third-Party Licenses

HolyCode includes third-party software distributed within the Docker image.

Each component below keeps its original license and source information.

HolyCode's own source code is licensed under MIT (see LICENSE).

This notice is installed at `/usr/local/share/holycode/THIRD-PARTY-NOTICES`.

It records the components called out by HolyCode's build policy; it is not a

general legal-compliance audit of every transitive package.

## OpenCode (opencode-ai)

- License: MIT

- Copyright: Anomaly

- Source: https://github.com/anomalyco/opencode

- npm: https://www.npmjs.com/package/opencode-ai/v/1.19.5

- Website: https://opencode.ai

- Version: 1.19.5

OpenCode is the core AI coding agent bundled in HolyCode. It is installed

via npm as a global package and runs as an s6-overlay supervised process.

HolyCode does not modify OpenCode's source code.

## opencode-claude-auth (optional plugin)

- License: MIT

- Copyright: Griffin Martin

- Source: https://github.com/griffinmartin/opencode-claude-auth

- npm: https://www.npmjs.com/package/opencode-claude-auth/v/2.2.1

- Version: 2.2.1

Optional OpenCode plugin that bridges Claude Code OAuth credentials into

OpenCode. Not installed by default. Enabled via ENABLE_CLAUDE_AUTH=true

environment variable. HolyCode includes the exact `2.2.1` npm payload in the

image after registry-integrity verification, then installs it offline at

container startup when enabled. HolyCode does not modify this plugin.

Note: This plugin impersonates the Claude CLI at the HTTP level to pass

Anthropic OAuth validation. Use at your own risk regarding Anthropic's

Terms of Service.

## oh-my-openagent (optional plugin)

- License: SUL-1.0

- Copyright: Yeongyu Kim

- Source: https://github.com/code-yeongyu/oh-my-openagent

- npm: https://www.npmjs.com/package/oh-my-openagent

Optional OpenCode plugin for multi-agent orchestration. Not installed by

default. HolyCode-managed installation is currently suspended.

ENABLE_OH_MY_OPENAGENT=true stops startup with a migration message and does

not modify existing user configuration. After the flag is removed, the first

successful start removes the legacy active entry from OpenCode configuration while

preserving plugin settings, skills, and cached package files. HolyCode does not

distribute or modify this plugin.

## s6-overlay

- License: ISC

- Source: https://github.com/just-containers/s6-overlay

## Node.js

- License: MIT

- Source: https://github.com/nodejs/node

## OpenSpec

- License: MIT

- Source: https://github.com/Fission-AI/OpenSpec

- npm: https://www.npmjs.com/package/@fission-ai/openspec/v/1.14.3

- Version: 1.14.3

Installed as the pinned global CLI. Telemetry is disabled in the image, and

project initialization occurs only when you explicitly run

`openspec init --tools opencode`.

## npm CLI

- License: Artistic-2.0

- Source: https://github.com/npm/cli

- Version: 12.2.2

### npm bundled node-gyp and Undici

- Licenses: MIT (node-gyp and Undici)

- Sources: https://github.com/nodejs/node-gyp and https://github.com/nodejs/undici

- Versions: 13.0.0 and 6.29.1

The official npm 12.2.2 payload owns node-gyp 13.0.0 and Undici 6.29.1.

HolyCode uses that payload without dependency overlays. Paperclip owns a

separate Undici copy.

## PM2

- License: AGPL-3.0

- Source: https://github.com/Unitech/pm2/tree/v7.1.2

- npm: https://www.npmjs.com/package/pm2/v/7.1.2

- Artifact: https://registry.npmjs.org/pm2/-/pm2-7.1.2.tgz

- Version: 7.1.2

### PM2 bundled js-yaml

- License: MIT

- Source: https://github.com/nodeca/js-yaml

- npm: https://www.npmjs.com/package/js-yaml/v/4.3.2

- Version: 4.3.2

The official PM2 7.1.2 payload owns js-yaml 4.3.2. Its graph has no get-uri

or basic-ftp. HolyCode does not replace these dependencies or rewrite their

installed declarations.

## Prisma

- License: Apache-2.0

- Source: https://github.com/prisma/prisma

- Version: 7.10.1

The published Prisma 7.10.1 graph includes deepmerge-ts 8.0.2 and mysql2

3.24.4. HolyCode installs and verifies those normal upstream dependencies

without replacing packages or materializing type peers.

## Debian GNU/Linux

- License: Multiple free-software licenses by package

- Source: https://www.debian.org/distrib/packages

- Base: Trixie 13

## Chromium

- License: BSD-3-Clause

- Source: https://chromium.googlesource.com/chromium/src

Installed via Debian's apt package manager. Used for headless browser

automation via Playwright and Puppeteer.

## Playwright

- License: Apache-2.0

- Copyright: Microsoft Corporation

- Source: https://github.com/microsoft/playwright

- Version: 1.64.1

Installed via pip. Uses the system Chromium binary, not Playwright's

bundled browsers.

HolyCode also vendors Playwright's Docker seccomp profile at

`config/chromium-seccomp.json` under the same Apache-2.0 license. The profile

permits the namespace syscalls required by Chromium's sandbox.

## Claude Code CLI

- License: SEE LICENSE IN README.md

- npm: https://www.npmjs.com/package/@anthropic-ai/claude-code/v/2.1.318

- Artifact: https://registry.npmjs.org/@anthropic-ai/claude-code/-/claude-code-2.1.318.tgz

- Legal agreements: https://code.claude.com/docs/en/legal-and-compliance

- Version: 2.1.318

Installed from the pinned npm package `@anthropic-ai/[email protected]`.

The pinned package must retain its `LICENSE.md` legal-agreements notice.

Final native image validation must prove that the installed CLI and

Linux native payload carry the same notice. This is artifact evidence, not a

permissive SPDX license classification.

Used for Claude subscription authentication flows when

ENABLE_CLAUDE_AUTH=true.

## Paperclip

- License: MIT

- Source: https://github.com/paperclipai/paperclip

- Release: https://github.com/paperclipai/paperclip/releases/tag/v2026.831.1

- npm: https://www.npmjs.com/package/paperclipai

- Catalog npm: https://www.npmjs.com/package/@paperclipai/skills-catalog

Installed via npm as the global package `[email protected]`. Paperclip includes

@paperclipai/skills-catalog through its published package set, which HolyCode

uses for the Skills page. HolyCode validates the package version, integrity,

architecture, and lifecycle-script body before running the exact embedded PostgreSQL

postinstall needed to hydrate its packaged library symlinks. Paperclip then runs as

an unprivileged user. Used only when ENABLE_PAPERCLIP=true.

### Paperclip-scoped Cursor SDK 1.3.1

- License: Cursor SDK License (use subject to Cursor's Terms of Service)

- Copyright: Anysphere Inc.

- Source: https://github.com/cursor/cursor

- npm: https://www.npmjs.com/package/@cursor/sdk/v/1.3.1

The published npm payload includes `LICENSE.md` with the Cursor SDK License

notice. Paperclip's Cursor adapter resolves `@cursor/sdk 1.3.1` through its

`^1.0.28` declaration. The installed SDK no longer declares Connect's Node

transport. This records the bundled notice; it is not legal clearance for

Cursor service use.

### Paperclip-scoped jsdom 30.1.3 and Undici 8.12.4

- License: MIT (each package includes its own license text)

- Sources: https://github.com/jsdom/jsdom and https://github.com/nodejs/undici

- npm: https://www.npmjs.com/package/jsdom/v/30.1.3 and https://www.npmjs.com/package/undici/v/8.12.4

Paperclip's server resolves jsdom 30.1.3; jsdom declares `undici ^8.12.1` and

currently resolves Undici 8.12.4. HolyCode checks that owner graph and exercises

jsdom's loopback URL fetch. It no longer replaces Undici or changes an installed

Connect dependency declaration.

## GitHub CLI (gh)

- License: MIT

- Copyright: GitHub, Inc.

- Source: https://github.com/cli/cli

- Version: 2.103.3

Installed from the official upstream Linux release archive after SHA-256

verification.

## lazygit

- License: MIT

- Copyright: Jesse Duffield

- Source: https://github.com/jesseduffield/lazygit

- Version: 0.66.2

Installed from the official upstream Linux release archive after SHA-256

verification.

## NumPy

- License: BSD-3-Clause AND 0BSD AND MIT AND Zlib AND CC0-1.0

- Source: https://github.com/numpy/numpy

- Version: 2.5.4

## pandas

- License: BSD-3-Clause plus bundled third-party license texts

- Source: https://github.com/pandas-dev/pandas

- Version: 3.0.6

The installed pandas distribution includes its primary license and bundled

third-party notices in one license file. This notice does not reduce that file

to a single blanket license.

## Python lock transitive updates

The clean-resolved Python lock also includes these changed transitive packages:

| Package | Version | License | Source |

| --- | --- | --- | --- |

| contourpy | 1.4.0 | BSD-3-Clause | https://github.com/contourpy/contourpy |

| greenlet | 3.5.6 | MIT AND PSF-2.0 | https://github.com/python-greenlet/greenlet |

| idna | 3.20 | BSD-3-Clause | https://github.com/kjd/idna |

| opentelemetry-api | 1.45.1 | Apache-2.0 | https://github.com/open-telemetry/opentelemetry-python |

| urllib3 | 2.8.0 | MIT | https://github.com/urllib3/urllib3 |

## Packaging

- License: Apache-2.0 OR BSD-2-Clause

- Source: https://github.com/pypa/packaging

- Version: 26.3

## pip and its vendored packages

- License: MIT (pip); each vendored package retains its own license

- Source: https://github.com/pypa/pip

- Version: 26.3

HolyCode uses the official, unmodified pip 26.3 wheel, including its vendored

msgpack 1.2.4 (Apache-2.0), pkg_resources from setuptools 70.3.0 (MIT),

urllib3 2.8.0 (MIT), and certifi 2026.10.23 (MPL-2.0).

The offline packaging seed uses that same official wheel. HolyCode does not

rebuild pip or repair its vendored source or RECORD.

Vendored sources: https://github.com/msgpack/msgpack-python,

https://github.com/pypa/setuptools, https://github.com/urllib3/urllib3,

and https://github.com/certifi/python-certifi.

## Wrangler

- License: Apache-2.0 OR MIT

- Source: https://github.com/cloudflare/workers-sdk

- Version: 4.157.0

Wrangler owns Miniflare 5.20261103.0-beta, workerd 1.20261103.1, and esbuild

0.28.2. The

installed package manifests declare MIT for Miniflare and Apache-2.0 for

workerd. Their selected npm package roots do not include license files, so this

notice does not claim bundled license text for them. The final AMD64 and ARM64

images must verify the installed package roots and separate workerd payloads.

## pnpm

- License: MIT

- Source: https://github.com/pnpm/pnpm

- Version: 12.16.1

The selected package manifest declares MIT. Its npm package has no license file

at the package root, so this notice does not claim one is bundled.

## Prettier

- License: MIT

- Source: https://github.com/prettier/prettier

- Version: 3.9.10

## tsx

- License: MIT

- Source: https://github.com/privatenumber/tsx

- Version: 4.23.15

## Vite

- License: MIT

- Source: https://github.com/vitejs/vite

- Version: 8.3.5

## Lighthouse

- License: Apache-2.0

- Source: https://github.com/GoogleChrome/lighthouse

- Version: 13.6.0

## Lighthouse trace engine transitive dependency

- License: BSD-3-Clause

- Source: https://www.npmjs.com/package/@paulirish/trace_engine/v/0.0.67

- Version: 0.0.67

## Lighthouse third-party-web transitive dependency

- License: MIT

- Source: https://github.com/patrickhulce/third-party-web

- Version: 0.30.0

Lighthouse declares `third-party-web` as `*`; HolyCode checks the selected

0.30.0 graph without rewriting that declaration. Lighthouse 13.6.0 does not

include legacy-javascript.

## ESLint

- License: MIT

- Source: https://github.com/eslint/eslint

- Version: 10.13.0

## drizzle-kit

- License: MIT

- Source: https://github.com/drizzle-team/drizzle-orm

- Version: 0.31.11

### Miniflare bundled Sharp 0.35.5 installed-byte verification

- License: Apache-2.0

- Source: https://github.com/lovell/sharp/releases/tag/v0.35.5

- Version: 0.35.5

Miniflare directly owns Sharp 0.35.5. HolyCode verifies the installed Sharp,

matching architecture, and prebuilt libvips package bytes against their

integrity-verified registry payloads. libvips 1.3.4 remains

LGPL-3.0-or-later.

## delta

- License: MIT

- Copyright: Dan Davison

- Source: https://github.com/dandavison/delta

- Version: 0.20.1

## eza

- License: MIT

- Copyright: eza community

- Source: https://github.com/eza-community/eza

## ripgrep

- License: MIT / Unlicense (dual)

- Copyright: Andrew Gallant

- Source: https://github.com/BurntSushi/ripgrep

## fd

- License: MIT / Apache-2.0 (dual)

- Copyright: David Peter

- Source: https://github.com/sharkdp/fd

## fzf

- License: MIT

- Copyright: Junegunn Choi

- Source: https://github.com/junegunn/fzf

- Version: 0.74.5

Installed from the official upstream Linux release archive after SHA-256

verification.

## bat

- License: MIT / Apache-2.0 (dual)

- Copyright: David Peter

- Source: https://github.com/sharkdp/bat

## tmux

- License: ISC

- Source: https://github.com/tmux/tmux

For the exact installed package inventory, inspect the release SBOM assets and

the Docker image together with this notice.