Skip to content

THIRD_PARTY.md

Latest commit

 

History

History
128 lines (102 loc) · 6.84 KB

THIRD_PARTY.md

File metadata and controls

128 lines (102 loc) · 6.84 KB

Third-Party Licenses

This project vendors third-party code. We are grateful to the authors and maintainers of these projects for making their work freely available. Every vendored component directory carries the upstream LICENSE (or COPYING / NOTICE) file alongside the sources.

Tree-sitter Runtime

The tree-sitter C runtime is vendored in internal/cbm/vendored/ts_runtime/.

  • Project: tree-sitter
  • License: MIT
  • Copyright: (c) 2018–2024 Max Brunsfeld

The shared scanner helpers in internal/cbm/vendored/common/ (scanner.h, tag.h) originate from tree-sitter-html (MIT, (c) 2014 Max Brunsfeld) and carry that project's LICENSE in internal/cbm/vendored/common/.

The core runtime headers in internal/cbm/vendored/common/tree_sitter/ (alloc.h, array.h, parser.h) are part of the tree-sitter C runtime (tree-sitter, MIT, (c) 2018 Max Brunsfeld) and carry their own LICENSE in that directory.

Tree-sitter Grammars

158 pre-generated parsers are vendored in internal/cbm/vendored/grammars/<lang>/ (generated parser.c plus scanner.c where applicable, compiled statically). Each grammar is the work of its upstream authors and each grammar directory contains the upstream LICENSE file.

The canonical provenance record — upstream repository, pinned commit, and cross-registry verification status for every grammar — is internal/cbm/vendored/grammars/MANIFEST.md.

License summary:

  • Nearly all grammars are MIT-licensed.
  • clojure (sogaiu/tree-sitter-clojure) is CC0-1.0; fennel is CC0-1.0; jinja2 and just are Apache-2.0; pine is ISC (declared by its upstream).
  • The grammars authored in-house for this project (cobol, form, janet, magma, protobuf, wolfram) are MIT under the project's own license, (c) DeusData. Six further grammars (assembly, cfml, cfscript, dotenv, pine, qml) are self-maintained forks that retain their original upstream authors' licenses — see the manifest for per-grammar provenance.

Vendored C/C++ Libraries

Library Path License Project
SQLite 3 vendored/sqlite3/ Public Domain sqlite.org
mimalloc vendored/mimalloc/ MIT microsoft/mimalloc
yyjson vendored/yyjson/ MIT ibireme/yyjson
xxHash vendored/xxhash/ BSD-2-Clause Cyan4973/xxHash
TRE vendored/tre/ BSD-2-Clause laurikari/tre
LZ4 internal/cbm/vendored/lz4/ BSD-2-Clause (library files) lz4/lz4
Zstandard internal/cbm/vendored/zstd/ BSD-3-Clause (dual BSD / GPLv2 — BSD selected) facebook/zstd
simplecpp internal/cbm/vendored/simplecpp/ 0BSD danmar/simplecpp
Verstable internal/cbm/vendored/verstable/ MIT JacksonAllan/Verstable
wyhash internal/cbm/vendored/wyhash/ Unlicense (public domain) wangyi-fudan/wyhash

The graph-UI HTTP server is a first-party implementation (src/ui/httpd.c + src/ui/http_server.c) — no third-party HTTP library is used.

Embedded Model Data

Semantic vector search uses static token embeddings derived from the nomic-embed-code model, vendored in vendored/nomic/:

See vendored/nomic/NOTICE for the exact derivation procedure (per-token inference + int8 quantization via scripts/extract_nomic_vectors.py).

Hybrid LSP — Reference Language Servers

The Hybrid LSP layer (internal/cbm/lsp/) is an original C implementation written for this project. It contains no source code from any language server. Its type-resolution behavior is structurally inspired by, and validated for output compatibility against, the published behavior of the following language servers and language specifications. They are listed here as acknowledgment; their licenses are noted for reference:

Language Reference implementation / specification Upstream license
TypeScript / JavaScript tsserver (microsoft/TypeScript), typescript-go Apache-2.0
Python pyright MIT
Go gopls (golang/tools) BSD-3-Clause
PHP PHP language reference + Composer PSR-4 autoloading specification —
C# Roslyn (dotnet/roslyn) MIT
C / C++ clangd (llvm/llvm-project) Apache-2.0 WITH LLVM-exception
Java Java Language Specification; output parity with Eclipse JDT LS EPL-2.0 (reference only)
Kotlin Kotlin language specification; fwcd/kotlin-language-server MIT
Rust rust-analyzer MIT OR Apache-2.0

Standard-library type data

The stdlib type registries in internal/cbm/lsp/generated/ were produced as follows:

  • Python (python_stdlib_data.c) — generated from python/typeshed type stubs (commit a7912d521e16ff63caf7a8b64b9072542be36777), Apache-2.0, (c) the typeshed contributors. The generator is scripts/gen-py-stdlib.py.
  • Go (go_stdlib_data.c) — generated by introspecting the public API of the Go standard library (golang/go, BSD-3-Clause).
  • Java, Kotlin, C#, PHP, C/C++, Rust — hand-curated from public API documentation and language specifications; no upstream source code was extracted or transcribed.

Embedded Graph UI

Release binaries built with --with-ui embed the compiled graph-ui/ frontend bundle. Its npm dependencies (React, three.js, @react-three/*, radix-ui, lucide-react, tailwindcss, and friends) are all under permissive licenses (MIT / ISC / Apache-2.0 / Zlib); the exact set is recorded in graph-ui/package.json and graph-ui/package-lock.json, and the per-package license texts of the production bundle are appended to the THIRD_PARTY_NOTICES.md shipped inside the -ui release archives (generated by scripts/gen-ui-licenses.py).