AGENTS.md

1# cmux Browser contributor notes
2 
3The Chromium-based cmux Browser product: a source overlay and build harness, not a Chromium checkout. Never vendor Chromium, generated build output, signed applications, update keys, or private builder configuration here.
4 
5## Repository boundaries
6 
7- Resolve the cmux TUI backend from `../cmux-tui` and Ghostty from the repository's `../ghostty` gitlink.
8- Keep Chromium overlay paths under `overlay/` identical to their destination paths in a Chromium source tree.
9- Derive paths from the monorepo and Browser roots. No developer home directories, private hostnames, tailnet addresses, or volume paths.
10- Pin Chromium with a full commit ID and preserve enough build metadata to reproduce every distributed binary.
11 
12## Licensing and provenance
13 
14Every imported or new source file has a recorded provenance and license. Do not apply the repository's default license over third-party material.
15 
16- Manaflow rights-controlled files use GPL-3.0-or-later. Commercial terms may be offered separately only for portions whose necessary rights Manaflow controls; authorship alone is not proof of that control.
17- Chromium-derived files retain Chromium's BSD-3-Clause notice.
18- Helium-derived files retain GPL-3.0-only provenance and the exact source revision. Helium-derived code is not available under Manaflow's commercial license.
19- Other bundled dependencies retain their own terms and must appear in the generated notices and corresponding-source manifest.
20 
21When changing a shipped dependency, update its exact revision or digest, source URL, license text, and source-offer record in the same change. A build must fail closed if any shipped file has no license mapping.
22 
23Do not add a nested copy of the root `LICENSE`; it could be read as licensing third-party or mixed-origin files commercially. Use per-file notices, exact provenance, and a generated release composition manifest.
24 
25## Validation
26 
27Run the fast host, patch-fixture, script, and protocol tests before review. Release candidates additionally require a full Chromium build, generated Chromium third-party notices, bundle-license verification, and the macOS XCUITest terminal-render suite against the exact packaged cmux and Ghostty revisions.
28 
29Never run untrusted pull-request code on a self-hosted builder with private network access or signing credentials.
30