This directory contains source-vendored copies of the Cordis framework and its foundation libraries. They are copied into this monorepo instead of being depended on via npm, so that the harness fully owns its framework layer (auditable, patchable, pinned).

All vendored packages use the @deepseek-ai scope (cordis → @deepseek-ai/cordis, @cordisjs/plugin-<x> → @deepseek-ai/cordis-plugin-<x>). The manifest table records upstream versions and source commits; each package manifest carries its Harness release version and publication metadata. References to vendored packages use workspace:~, so local builds resolve the workspace packages and published ranges permit patch updates within the same minor version. Upstream MIT LICENSE files are preserved in each package directory.

This file covers the manifest, the local-modification log, and the procedure for updating an existing vendored package. To add a new one, see the cookbook guide: docs/cookbook/adding-a-vendored-package.md.

The proposed Cordis rc.11 upgrade plan records the package scope, PR dependencies and intended disposition of the local modifications.

Manifest

Upstream workspace: cordis-workspace (local checkout: ~/repos/cordis-workspace).

Directory	npm name	Upstream name	Version	Upstream repo	Commit
`cosmokit/`	`@deepseek-ai/cosmokit`	`cosmokit`	1.8.1	https://github.com/deepseek-harness/cosmokit	`16f6fc058ade66e8ac5da0033d35a8d0f279f544`
`schemastery/`	`@deepseek-ai/schemastery`	`schemastery`	3.18.0	https://github.com/deepseek-harness/schemastery (`packages/core`)	`e67cee00ad725bd1534aee930a979ea3eec6f698`
`cordis/`	`@deepseek-ai/cordis`	`cordis`	4.0.0-rc.11	https://github.com/cordiverse/cordis (`packages/core`)	`0b96d9fd517b998e44e2209560c9e5f0671ce933`
`loader/`	`@deepseek-ai/cordis-plugin-loader`	`@cordisjs/plugin-loader`	1.0.0-rc.8	https://github.com/cordiverse/cordis (`packages/loader`)	`0b96d9fd517b998e44e2209560c9e5f0671ce933`
`include/`	`@deepseek-ai/cordis-plugin-include`	`@cordisjs/plugin-include`	1.1.1	https://github.com/cordiverse/cordis (`packages/include`)	`0b96d9fd517b998e44e2209560c9e5f0671ce933`
`group/`	`@deepseek-ai/cordis-plugin-group`	`@cordisjs/plugin-group`	1.0.0	https://github.com/deepseek-harness/cordis (`packages/group`)	`abb0a307cb1d3b0947f455d590cf5ba922d4caa4`
`timer/`	`@deepseek-ai/cordis-plugin-timer`	`@cordisjs/plugin-timer`	1.1.4	https://github.com/cordiverse/cordis (`packages/timer`)	`0b96d9fd517b998e44e2209560c9e5f0671ce933`
`hmr/`	`@deepseek-ai/cordis-plugin-hmr`	`@cordisjs/plugin-hmr`	1.0.15	https://github.com/deepseek-harness/cordis (`packages/hmr`)	`abb0a307cb1d3b0947f455d590cf5ba922d4caa4`
`logger-console/`	`@deepseek-ai/cordis-plugin-logger-console`	`@cordisjs/plugin-logger-console`	1.0.0	https://github.com/deepseek-harness/cordis (`packages/logger-console`)	`abb0a307cb1d3b0947f455d590cf5ba922d4caa4`

Third-party dependencies of the vendored packages stay on npm: @standard-schema/spec, js-yaml, chokidar, picomatch, @babel/code-frame, supports-color, node-addon-require-builtin.

Intentionally not vendored (verified unused by this set): reggol, @cordisjs/utils, @cordisjs/element, @cordisjs/unyaml (dev-time YAML import hook only).

Local modifications

Keep this log exhaustive — every divergence from upstream must be listed. Each entry has a stable ID: remove an entry when its divergence no longer exists, and never renumber or reuse IDs. The next new entry is V28.

V1 · hmr/src/index.ts: removed the ./locales/en-US.yml / ./locales/zh-CN.yml imports, the .i18n({...}) call on the Config schema, and the src/locales/ directory. Rationale: those imports require a runtime YAML loader hook (@cordisjs/unyaml) that we do not vendor; the i18n texts only localize config descriptions.
V2 · All package.json files: regenerated for Harness releases with scoped names, release versions, publication metadata, precise bundled-runtime and lib/types/**/*.d.ts / .d.ts.map file entries, source exports where applicable, and declaration metadata pointing at lib/types. References within the vendored set use workspace:~. HMR declares esbuild as a direct dev dependency for its imported BuildFailure type, and Loader requires node-addon-require-builtin@^0.1.4 to match published app runtimes.
V3 · All tsconfig.json files: regenerated to extend the repo-root tsconfig.base.json, emit TypeScript intermediates to lib/types, and declare project references.
V4 · Vendored TypeScript source internal specifiers: changed local relative imports/exports from upstream's specifier shape to explicit .ts specifiers so TypeScript rewrites emitted JS to .js while declarations keep explicit, NodeNext-safe .ts specifiers. This includes loader/src/config/isolate.ts using declare module './entry.ts'. Type-only dependencies use import type or inline type modifiers so ESM output does not retain erased interfaces.
V5 · schemastery/tsdown.config.ts and logger-console/tsdown.config.ts: ours, not upstream files — per-package build-shape overrides (dual ESM+CJS output; separate node/browser entries) for the repo-root tsdown build. They read the JS emitted under lib/types and then write the publish runtime entries under lib/. Like the regenerated tsconfigs, they are not part of the upstream sync surface.
V6 · cordis/src/fiber.ts lifecycle hardening: locally closes three reentrant disposal gaps. An effect's owner-list wrapper is registered before its setup body runs, so an unload begun from inside setup awaits setup and every collected cleanup; synchronous setup failure removes the wrapper and rolls back collected cleanup. Async cleanup stays owner-visible until quiescence, and Cordis's internal effect composition joins an already-running cleanup while repeated public disposer calls retain their upstream single-shot result. Effect creation is rejected while the owner is UNLOADING (while PENDING and LOADING remain legal), preventing cleanup-time registrations from escaping the unload snapshot. Child fibers register and receive their parent-owned disposer before internal/plugin publication, resolve dependency declarations added by that notification before activation, drain effects attached while pending, and contain teardown-notification failures per observer so one callback cannot starve peers or interrupt ownership cleanup.
V7 · Cordis, Loader and Timer JSDoc enrichment: added @param/@returns tags and contract documentation (disposal semantics, waterfall veto, bail conditions, error cases) across the public plugin-author surface — Context (class, statics, and the Context interface properties incl. root), module re-exports, shared utility helpers, EventsService, Fiber, RegistryService, ReflectService, Service, LoggerService and their declare module './context.ts' overloads. Loader documentation covers loader/src/{index,internal,config/entry,config/group,config/isolate,config/tree,config/utils}.ts, including entry ownership, tree mutation methods, and the !!js discriminator. The upstream EventsService.dispatch() deprecation annotation is omitted: DSH enumerates callbacks to contain each observer failure independently, which the typed dispatch methods do not provide. Timer retains its local class and helper summaries; its README is local documentation because the upstream package has none. Comment-only; no code changes. Motivation: the website API-reference generator renders these docs and hard-errors on undocumented members. Retire this entry when the enrichment is upstreamed to the fork.
V9 · hmr/src/index.ts module-watcher readiness and native paths: realpath the existing watch base, classify framework modules and attach listeners before reporting readiness, and compare config paths using both canonical and configured spellings. This preserves Node module-cache identity across Windows short-name paths and filesystem aliases. The main watcher uses ignoreInitial: true so startup reads do not trigger another refresh; exact profile patch watching is owned by packages/boot/hmr/src/watch-config.ts. The Include change listener logs a rejected Include.refresh() instead of leaving the rejection unhandled; the rejection reports unsaved runtime changes while Include keeps its running tree. Covered by packages/boot/hmr/tests/watch-config.spec.ts and scripts/cordis-vendor-hmr-include.spec.ts.
V10 · Vendored Node-compatible TypeScript: marked erased imports explicitly across cordis, loader, include, hmr, and schemastery so Node's native TypeScript transform does not request types as runtime exports. Schemastery's source uses an ESM default export and its package declares type: module. Conditional exports select .mjs for import and .cjs for require; without them, concurrent imports under module-hook hosts reach the CJS entry and can race its require of ESM Cosmokit (ERR_REQUIRE_ESM_RACE_CONDITION).
V11 · Include patch and YAML exports: include/src/index.ts exports upstream applyPatches as applyEntryPatches and the !!js YAML dialect as entryListSchema, so dsh --dump-config composes entries with the same algorithm that mounting uses. Covered by packages/boot/app-boot/tests/config-reload.spec.ts and scripts/cordis-entry-commit.spec.ts.
V14 · Include persistence results: include/src/index.ts keeps an error for unsaved journal changes. flush() retries pending writes and rejects while changes remain unsaved; stop() returns the same result and always stops the child tree; a later successful flush clears previous errors. A failed refresh() can also reject while runtime changes remain unsaved. Patch-owned changes route to the parent Include, so callers that need them persisted must flush that parent too. The constructor omits upstream's ctx.hmr.watch(this.filename, () => this.refresh()) registration because neither HMR provider exposes watch(); both find each Include by scanning loader entries for its filename and call refresh(). Ordinary Fiber teardown keeps its error containment. Covered by scripts/cordis-include-journal.spec.ts and packages/host/directory-picker-auto/tests/loader-composition.spec.ts.
V15 · Configuration access across Core, Loader, Include and HMR: rc.11 Core owns raw Fiber.config, internal/config(fiber, next), internal/commit and awaited internal/update(config, next). Root-fiber candidate resolution remains available without a plugin schema. Local rawConfig, resolveConfig(candidate) and effectiveConfig accessors retain the DSH consumer API. Fiber caches the object passed to activation or a successful update that keeps the instance; candidate resolution is pure, failed or superseded updates cannot replace the cache, and volatile updates retain references. Loader resolves only entry roots and excludes Group/Include tree carriers, so nested !!js expressions wait for their own injections. Include retains its tree-carrier marker and public patch exports, and HMR transfers raw config through the accessors. Covered by scripts/cordis-config-access.spec.ts, scripts/cordis-core-lifecycle.spec.ts and the boot/HMR suites.
V16 · cordis/package.json publishes src: added src to the files list, joining the other eight vendored packages. Cordis declares "./src/*": "./src/*" in its exports, so a tarball without src publishes an export map pointing at absent files; the release change judgement also reads files to decide whether a diff reaches the payload, and a package whose only published paths are build output has no tracked path to match.
V17 · @deepseek-ai rescope: every vendored manifest name, every internal dependency entry among the vendored set, and every module specifier that reaches them use the scoped names in the manifest table's npm name column. Directory names, version numbers, and dependency ranges are unchanged, and no upstream runtime identifier is renamed — Symbol.for('schemastery') and Schemastery's vendor: metadata field keep their upstream values. Re-apply with pnpm run rescope-vendor --apply after a sync; the table's two name columns are the mapping, restated for consumers in docs/rescope.md.
V22 · Volatile config across cosmokit, schemastery, cordis, and loader: Cosmokit supplies immutable references and framework-owned commits; deepEqual treats two references as equal, propagates strict comparison into arrays, compares every array slot with holes treated as undefined, handles cycles conservatively, compares URLs by normalized href, and compares other opaque objects by identity in strict mode. Schemastery adds .volatile(), optional/default inference, placement validation without eager lazy-schema expansion (a lazy inner is validated once when built), metadata-free serialized node compatibility, serialized metadata, reference-aware simplification, unsupported volatile values reported as ValidationError with their path, and .default() accepting the raw input type Partial<S> because a volatile field makes the output type carry references. Loader's save path calls simplify with its schema receiver (unparse.call), an independent fix for the unbound-this call. Cordis exports consumer types without changing Fiber lifecycle. Loader compares raw options strictly in Entry.update; for a config-only change on an active fiber it calls the pure equalExceptVolatile function in config/diff.ts, which narrows the Standard Schema to Schemastery's Schema type (a new type-only @deepseek-ai/schemastery dependency of loader) and recursively skips fixed volatile paths using schema metadata without executing config hooks or validation. Missing or null object nodes compare using their declared defaults, including nodes without volatile descendants; schema backedges retain raw comparison. Entry passes its actual schema and preserves ordinary context and custom-update lifecycles. For a volatile-only change, Entry._commitVolatile takes the canonical fiber entry.fiber.ctx.fiber (Entry.fiber holds the registry wrapper), re-parses the raw config through Fiber.resolveConfig(), compares ordinary effective values, commits references and emits the instance-local loader/volatile-update declared in loader/src/index.ts; a changed ordinary effective value falls back to the ordinary remount, and an invalid candidate is logged while the raw config stays retained for the next activation. Cosmokit provides reference enumeration and commits, and simplify is called with its schema receiver. The package READMEs document these additions; schema tests live in scripts/volatile-config.spec.ts, Loader runtime and real-file tests in scripts/loader-volatile-update.spec.ts, and code replacement tests in the HMR module suite.
V23 · loader/src/config/entry.ts module identity: retains each entry's raw import result as moduleNamespace, before plugin export normalization. HMR matches that object to Node's cached module namespace and updates it after a successful reload. EntryTree.import() keeps its existing arguments and return value; loader/README.md documents the additive field.
V24 · timer/locale/{en,zh}.json display metadata: local English and Chinese titles and descriptions for the Settings plugin inventory. timer/package.json exports and publishes these locale resources.
V25 · Loader lifecycle adaptations: before a combined context/config update, Loader refreshes dependencies locally, which prevents activation against stale isolation bindings; disabled-entry updates await disposal. Failed fibers require an explicit update after correcting their input or dependencies. Core retains the effect hardening in V6; rc.11 owns dependency teardown ordering and superseded-activation handling.
V26 · loader/src/config/tree.ts cross-tree moves: backports cordiverse/cordis#271, merged after v4.0.0-rc.11. When EntryTree.update() moves an entry into a group of another tree, the entry and the same-tree members of its group move their store registrations to the target tree, and the move is rejected before either tree changes when the target tree already holds one of their ids. The source tree receives a removal and the target tree a creation, without legacy or from. In rc.11 the entry stays registered in the source tree and the target receives an update with legacy, so the Include journal writes a partial row and reconciling the target file creates a second Entry. Retire this entry when the vendored Loader includes the upstream fix. Covered by scripts/cordis-include-journal.spec.ts.
V27 · loader/src/config/tree.ts explicit ids with :: ensureId() accepts explicit ids containing EntryTree.sep; upstream rejects them. Generated bundles from @deepseek-ai/dsh-creation-recommendations prefix their row ids with <package name>:, and installed profiles already contain such rows. resolve() still splits ids on :, so these entries cannot be addressed by nested path. Covered by scripts/cordis-entry-commit.spec.ts and packages/experimental/creation-recommendations/tests/loader-composition.spec.ts.

Resolver adaptations

Relative to the resolver source in Cordis v4.0.0-rc.11:

Web build imports: loader/src/resolve.ts uses default imports for Node builtin modules to support the Web shell's browser externalization. The shell supplies its own module loader.
Package-scope cache keys: loader/src/resolve.ts normalizes directory paths with path.resolve() before finding the package scope. A root config and a nested config in the same package therefore share the same cached resolver promise and helper-file write. Covered by scripts/cordis-loader-resolve.spec.ts.

Sync procedure

To update a vendored package from upstream:

In the upstream workspace, note git rev-parse HEAD of the relevant submodule.
Copy the package's src/ (and bin.js, README.md, LICENSE if changed) over the vendored directory.
Re-apply the local modifications listed above (or drop them if upstream made them unnecessary — update the log either way).
Update the version and commit hash in the manifest table.
Run pnpm install && pnpm run test && pnpm run build at the repo root.