THIRD-PARTY-NOTICES

# Third-Party Licenses

HolyCode includes third-party software distributed within the Docker image.
Each component below keeps its original license and source information.
HolyCode's own source code is licensed under MIT (see LICENSE).

## OpenCode (opencode-ai)

- License: MIT
- Copyright: Anomaly
- Source: https://github.com/anomalyco/opencode
- npm: https://www.npmjs.com/package/opencode-ai
- Website: https://opencode.ai

OpenCode is the core AI coding agent bundled in HolyCode. It is installed
via npm as a global package and runs as an s6-overlay supervised process.
HolyCode does not modify OpenCode's source code.

## opencode-claude-auth (optional plugin)

- License: MIT
- Copyright: Griffin Martin
- Source: https://github.com/griffinmartin/opencode-claude-auth

Optional OpenCode plugin that bridges Claude Code OAuth credentials into
OpenCode. Not installed by default. Enabled via ENABLE_CLAUDE_AUTH=true
environment variable. Auto-installed by OpenCode's plugin system at
container startup when enabled. HolyCode does not modify this plugin.

Note: This plugin impersonates the Claude CLI at the HTTP level to pass
Anthropic OAuth validation. Use at your own risk regarding Anthropic's
Terms of Service.

## oh-my-openagent (optional plugin)

- License: SUL-1.0
- Copyright: Yeongyu Kim
- Source: https://github.com/code-yeongyu/oh-my-openagent
- npm: https://www.npmjs.com/package/oh-my-openagent

Optional OpenCode plugin for multi-agent orchestration. Not installed by
default. Enabled via ENABLE_OH_MY_OPENAGENT=true environment variable.
Auto-installed by OpenCode's plugin system at container startup when
enabled. HolyCode does not modify this plugin.

## s6-overlay

- License: ISC
- Source: https://github.com/just-containers/s6-overlay

## Node.js

- License: MIT
- Source: https://github.com/nodejs/node

## npm CLI

- License: Artistic-2.0
- Source: https://github.com/npm/cli
- Version: 12.0.1

## Debian GNU/Linux

- License: Multiple free-software licenses by package
- Source: https://www.debian.org/distrib/packages
- Base: Trixie 13

## Chromium

- License: BSD-3-Clause
- Source: https://chromium.googlesource.com/chromium/src

Installed via Debian's apt package manager. Used for headless browser
automation via Playwright and Puppeteer.

## Playwright

- License: Apache-2.0
- Copyright: Microsoft Corporation
- Source: https://github.com/microsoft/playwright

Installed via pip. Uses the system Chromium binary, not Playwright's
bundled browsers.

HolyCode also vendors Playwright's Docker seccomp profile at
`config/chromium-seccomp.json` under the same Apache-2.0 license. The profile
permits the namespace syscalls required by Chromium's sandbox.

## Claude Code CLI

- License: SEE LICENSE IN README.md
- npm: https://www.npmjs.com/package/@anthropic-ai/claude-code
- Version: 2.1.216

Installed from the pinned npm package `@anthropic-ai/claude-code@2.1.216`.
Used for Claude subscription authentication flows when
ENABLE_CLAUDE_AUTH=true.

## Paperclip

- License: MIT
- Source: https://github.com/paperclipai/paperclip
- npm: https://www.npmjs.com/package/paperclipai
- Catalog npm: https://www.npmjs.com/package/@paperclipai/skills-catalog

Installed via npm as the global package `paperclipai@2026.707.0`. Paperclip includes
@paperclipai/skills-catalog through its published package set, which HolyCode
uses for the Skills page. HolyCode validates the package version, integrity,
architecture, and lifecycle-script body before running the exact embedded PostgreSQL
postinstall needed to hydrate its packaged library symlinks. Paperclip then runs as
an unprivileged user. Used only when ENABLE_PAPERCLIP=true.

## GitHub CLI (gh)

- License: MIT
- Copyright: GitHub, Inc.
- Source: https://github.com/cli/cli
- Version: 2.96.0 (`b300f2ec7ec9dc9addc39b2ad88c54097ded7ca0`)

Built from the exact upstream tag with Go 1.26.5 because the official 2.96.0
package was compiled before the Go standard-library fix for CVE-2026-39822.

## lazygit

- License: MIT
- Copyright: Jesse Duffield
- Source: https://github.com/jesseduffield/lazygit
- Version: 0.63.1

## NumPy

- License: BSD-3-Clause AND 0BSD AND MIT AND Zlib AND CC0-1.0
- Source: https://github.com/numpy/numpy
- Version: 2.5.1

## Packaging

- License: Apache-2.0 OR BSD-2-Clause
- Source: https://github.com/pypa/packaging
- Version: 26.2

## Wrangler

- License: Apache-2.0 OR MIT
- Source: https://github.com/cloudflare/workers-sdk
- Version: 4.112.0

## delta

- License: MIT
- Copyright: Dan Davison
- Source: https://github.com/dandavison/delta

## eza

- License: MIT
- Copyright: eza community
- Source: https://github.com/eza-community/eza

## ripgrep

- License: MIT / Unlicense (dual)
- Copyright: Andrew Gallant
- Source: https://github.com/BurntSushi/ripgrep

## fd

- License: MIT / Apache-2.0 (dual)
- Copyright: David Peter
- Source: https://github.com/sharkdp/fd

## fzf

- License: MIT
- Copyright: Junegunn Choi
- Source: https://github.com/junegunn/fzf

## bat

- License: MIT / Apache-2.0 (dual)
- Copyright: David Peter
- Source: https://github.com/sharkdp/bat

## tmux

- License: ISC
- Source: https://github.com/tmux/tmux

For a complete list of installed packages and their licenses, inspect the
Docker image directly or refer to the Dockerfile.