# THIRD_PARTY_LICENSES

This file is generated by `scripts/generate-third-party-artifacts.sh`.

## Scope

This file lists third-party components directly referenced by this repository for local development and runtime tooling.

Included:

- Python development dependencies declared in `pyproject.toml`.
- npm packages invoked via `npx` from repository scripts.
- Required tooling explicitly installed by repo checks/CI (`uv`, `shellcheck`, `nils-cli`).

Not included:

- Full transitive dependency trees of package managers.
- Baseline host tools not installed by this repository (for example `git`, `zsh`, `node`).

## Version Policy

- `pinned`: spec resolves to a fixed version in repo-owned declarations.
- `floating`: spec intentionally tracks non-fixed versions (for example `>=` ranges, `@latest`, formula latest).

## Third-Party Components

| Component | Ecosystem | Declared spec in repo | Version policy | License | Upstream |
| --- | --- | --- | --- | --- | --- |
| `pytest` | PyPI | `pytest>=7.0` | floating (pytest>=7.0) | `MIT` | [pytest-dev/pytest](https://github.com/pytest-dev/pytest) |
| `semgrep` | PyPI | `semgrep==1.148.0` | pinned (1.148.0) | `LGPL-2.1-or-later` | [semgrep/semgrep](https://github.com/semgrep/semgrep) |
| `mypy` | PyPI | `mypy>=1.0` | floating (mypy>=1.0) | `MIT` | [python/mypy](https://github.com/python/mypy) |
| `ruff` | PyPI | `ruff>=0.1.0` | floating (ruff>=0.1.0) | `MIT` | [astral-sh/ruff](https://github.com/astral-sh/ruff) |
| `pyright (Python wrapper)` | PyPI | `pyright>=1.1.0` | floating (pyright>=1.1.0) | `MIT` | [RobertCraigie/pyright-python](https://github.com/RobertCraigie/pyright-python) |
| `uv` | GitHub Action / Homebrew formula | `astral-sh/setup-uv@v8.1.0 / brew install uv` | pinned (action v8.1.0) + floating (formula latest) | `MIT OR Apache-2.0` | [astral-sh/uv](https://github.com/astral-sh/uv) |
| `@playwright/cli` | npm via npx --package | `@playwright/cli@latest` | floating (@latest) | `Apache-2.0` | [microsoft/playwright-cli](https://github.com/microsoft/playwright-cli) |
| `agent-browser` | npm via npx --package | `agent-browser@latest` | floating (@latest) | `Apache-2.0` | [vercel-labs/agent-browser](https://github.com/vercel-labs/agent-browser) |
| `rumdl` | npm via npx | `rumdl@0.1.62` | pinned (0.1.62) | `MIT` | [rvben/rumdl](https://github.com/rvben/rumdl) |
| `shellcheck` | Homebrew / apt | `brew install shellcheck / apt-get install -y shellcheck` | floating (package-manager resolved) | `GPL-3.0-or-later` | [koalaman/shellcheck](https://github.com/koalaman/shellcheck) |
| `nils-cli` | Homebrew formula | `brew install nils-cli` | floating (formula latest) | `MIT OR Apache-2.0` | [graysurf/nils-cli](https://github.com/graysurf/nils-cli) |

## Declaration Sources

- `pyproject.toml`
- `uv.lock`
- `.rumdl.toml`
- `scripts/ci/markdownlint-audit.sh`
- `skills/tools/browser/runtime/playwright/scripts/playwright_cli.sh`
- `skills/tools/browser/runtime/agent-browser/scripts/agent-browser.sh`
- `scripts/lint.sh`
- `.github/workflows/lint.yml`
- `scripts/install-homebrew-nils-cli.sh`
- `Dockerfile`

## Deterministic Input Fingerprints

- `pyproject.toml` SHA256: `5938b57eee95d46f2ecb628ad7f75fbd91319008ca60ec5896027204b109d75b`
- `uv.lock` SHA256: `f54b10b832b02ca3a14cdbbcc4239161f0a482b41d60adb06be52cc8733350cd`
- `.rumdl.toml` SHA256: `31667aa68116c0811cc8afcfa726ab5b6da25deb47cf737e54c51a7910a9cf5d`
- `scripts/ci/markdownlint-audit.sh` SHA256: `5169a51a9770a4b236201b5a6e26cc935f10e37e480267076c2315b21b420d53`
- `skills/tools/browser/runtime/playwright/scripts/playwright_cli.sh` SHA256: `36a188349ae575e2ffd7fe47cad0f8b86317032f4f7bd75a1598b5d16eddf4e0`
- `skills/tools/browser/runtime/agent-browser/scripts/agent-browser.sh` SHA256: `c9daa00c327c0258d8496b1e8a5cea3827af9cb73ee357682b670918ce7a1d94`
- `scripts/lint.sh` SHA256: `9b5c184d47de4213abb0e49eb39b80814c811edfdf6f06285142e20c56b770ea`
- `.github/workflows/lint.yml` SHA256: `911fbe8631dc7b64d30a3e1b030274b7a2f96ac27e1a36c5267eb8c94f4a742f`
- `scripts/install-homebrew-nils-cli.sh` SHA256: `60a844d5bc666bf54d9f91ead661cd76c98e432ecc6ec00e6f50fd2456fe0748`
- `Dockerfile` SHA256: `7ff26a38312cd006497c12ce054f6074dba3592402ae4f0d52bca5cd123abce6`
