THIRD_PARTY_NOTICES.md
Rama main · réplica de lectura del repositorio original.
# Third-party notices
Kindred's original source is MIT licensed; see LICENSE. Dependency licenses remain
their own. Cargo.lock in the server and desktop directories records exact Rust
dependency versions. Tauri is distributed under MIT or Apache-2.0 terms. The
official OpenAI Codex CLI is an external Apache-2.0 dependency and is not bundled
in the source or Windows download; its release includes its own notices.
Wall-clock schedules use chrono 0.4.45 and chrono-tz 0.10.4, with IANA time-zone
data compiled into the server. Their license texts and those of the seven added
Rust packages are retained in third-party/rust-scheduling-LICENSES.txt.
Plain-text notification previews use pulldown-cmark. Bot portraits use resvg,
usvg and tiny-skia. License texts and exact source links for their added Rust
dependencies are retained in third-party/rust-notifications-LICENSES.txt and
provided alongside the 0.48.21 binary release. These dependencies are unmodified.
The optional server-side Pi harness uses @earendil-works/pi-coding-agent and
@earendil-works/pi-ai 0.85.1 (MIT), plus their transitive dependencies. Exact
versions, integrity hashes and declared licenses are recorded in
harness/pi/package-lock.json. deploy/install-pi.sh installs these packages
separately with their included license files, together with Node.js 24.14.0.
Node.js is MIT licensed with third-party components identified in the installed
node/LICENSE. Neither Node.js nor the npm dependency tree is bundled in the
source ZIP or Windows package.
The Windows binary package includes Microsoft's WebView2Loader.dll, obtained from
the webview2-com-sys dependency. Microsoft WebView2 SDK license terms apply to that
component; see the included WebView2-LICENSE.txt. The installed WebView2 Runtime is
a separate Microsoft component. The desktop window uses that existing runtime.
Debian, Chromium, Openbox, Xvfb, OpenSSH, ImageMagick, and other guest packages are
installed separately through Debian repositories and retain their package licenses.
The VM image and Codex CLI are not included in the source ZIP or Windows package.
This preview has not undergone a complete release license audit.
The browser bundle includes noVNC 1.7.0 (MPL-2.0, with permissively licensed
components identified in its notices), DOMPurify 3.4.15 (Apache-2.0 or MPL-2.0),
and marked 18.0.11 (MIT). License texts are in third-party/. The complete unmodified
noVNC source used for this bundle, including bundled pako and its licenses, is
provided in third-party/novnc-1.7.0-source.tar.gz. Its MPL-covered files retain their
license; Kindred's separate original code is MIT. tools/frontend/build.mjs and its
lockfile reproduce the combined vendor bundle. ui/vendor.js.LEGAL.txt contains
additional retained notices. Source is also available from
https://registry.npmjs.org/@novnc/novnc/-/novnc-1.7.0.tgz.
The OpenAI Blossom marks in ui/openai-black.svg and ui/openai-white.svg are
unmodified assets from https://cdn.openai.com/brand/OpenAI-Logos-2025.zip,
used only to identify the OpenAI provider. The marks belong to OpenAI; see
https://openai.com/brand/ for its design guidelines and usage terms. They are
not part of Kindred's MIT artwork license and do not imply endorsement.
The connector marks bundled in ui/app.js are from Simple Icons (CC0 1.0 Universal),
retrieved from https://github.com/simple-icons/simple-icons on 2026-09-09.
The included license is ui/connector-icons-LICENSE.md. Brand marks identify their
respective services; trademark rights remain with their owners and no endorsement
is implied. Unknown services use an initial badge.
Local dictation bundles Kindred's resident worker linked with whisper.cpp/ggml
(MIT), pinned at commit 371b5a7561823ab2bb32142d2751e35e7534727b. Windows
includes Vulkan and CPU builds; macOS builds Metal and CPU workers; Linux x86_64
builds portable CPU and AVX2 workers. Khronos
Vulkan and SPIR-V header notices and MinGW/GCC runtime notices are retained
inside the Windows runtime archive and in third-party/. GCC runtime code is
distributed under its runtime library exception. The model weights are downloaded
only through the user's explicit + action, with exact sizes and SHA-256 checks.
Whisper model and whisper.cpp licenses are retained in third-party/whisper-LICENSE
and third-party/whisper-cpp-LICENSE. Build sources, pinned upstream revisions, and
the bundled runtime manifest are in desktop/dictation/.
Konsole and its dependencies are installed separately from Debian packages,
without recommended desktop packages. Their complete package license notices
remain under /usr/share/doc in the VM. Kindred's terminal profile and color
scheme are original configuration files and do not modify Konsole itself.
Chat artifact rendering bundles React and React DOM 19.2.4, their scheduler,
Babel standalone 7.28.5 (MIT), and highlight.js 11.11.1 (BSD-3-Clause).
Exact dependency versions are pinned in tools/frontend/package-lock.json.
Full licenses are retained in third-party/artifact-rendering-LICENSES.txt;
additional bundled notices are in ui/artifact-vendor.js.LEGAL.txt.
Additional connector marks retrieved on 2026-09-10: QuickBooks from Simple Icons 15.16.0 and Microsoft Outlook from Simple Icons 11.15.0 (CC0 1.0 Universal). Brand names and marks identify their connected services; they do not imply endorsement.
The monday.com identifier mark is adapted from its public website asset (retrieved 2026-09-10): https://cdn.prod.website-files.com/656da6fea306219773d04208/69f1f07236c38c800a45a687_monday-logo.svg . It is used to identify the connected service.
Additional service identifiers use Simple Icons (CC0), pinned to 15.16.0 or 11.15.0 for archived marks. Marks identify the connected services; their respective owners retain trademark rights.
- https://raw.githubusercontent.com/simple-icons/simple-icons/15.16.0/icons/googledocs.svg
- https://raw.githubusercontent.com/simple-icons/simple-icons/15.16.0/icons/googlesheets.svg
- https://raw.githubusercontent.com/simple-icons/simple-icons/15.16.0/icons/googleslides.svg
- https://raw.githubusercontent.com/simple-icons/simple-icons/15.16.0/icons/googletasks.svg
- https://raw.githubusercontent.com/simple-icons/simple-icons/15.16.0/icons/googlechat.svg
- https://raw.githubusercontent.com/simple-icons/simple-icons/15.16.0/icons/googlemeet.svg
- https://raw.githubusercontent.com/simple-icons/simple-icons/15.16.0/icons/googleforms.svg
- https://raw.githubusercontent.com/simple-icons/simple-icons/15.16.0/icons/zoom.svg
- https://raw.githubusercontent.com/simple-icons/simple-icons/15.16.0/icons/salesforce.svg
- https://raw.githubusercontent.com/simple-icons/simple-icons/11.15.0/icons/microsoftteams.svg
- https://raw.githubusercontent.com/simple-icons/simple-icons/15.16.0/icons/notion.svg
- https://raw.githubusercontent.com/simple-icons/simple-icons/15.16.0/icons/asana.svg
- https://raw.githubusercontent.com/simple-icons/simple-icons/15.16.0/icons/trello.svg
- https://raw.githubusercontent.com/simple-icons/simple-icons/15.16.0/icons/github.svg
- https://raw.githubusercontent.com/simple-icons/simple-icons/15.16.0/icons/zendesk.svg
The UI bundles the Inter 4.1 variable font, regular and italic, under the SIL
Open Font License 1.1. The full license is ui/fonts/LICENSE.txt; the pinned
upstream revision, source URLs and SHA-256 hashes are in ui/fonts/SOURCE.json.
Local document previews bundle Mammoth (DOCX), ExcelJS and SSF (XLSX), fflate
(archive size checks), and Mozilla PDF.js (PDF). Renderers and workers are
packaged locally; no hosted document viewer receives file contents. Versions
and transitive dependencies are pinned in tools/frontend/package-lock.json.
Full dependency license texts are in third-party/document-preview-LICENSES.txt.
## Liberation Mono
The bundled Liberation Mono fonts are distributed under the SIL Open Font License
1.1. The license and source/hash receipts are in ui/fonts/Liberation-LICENSE.txt
and ui/fonts/Liberation-SOURCE.json.
## Cua Driver in the standalone server
The included standalone server uses a Kindred policy build of Cua Driver 0.33.4
(MIT), upstream tag `cua-driver-rs-v0.33.4`, source
`ba0033a661101669c60ce05f1fe5753bf8bad748`. It runs inside the dedicated Linux
bot guest, rather than the host desktop. Exact selected archive/executable hashes
and upstream provenance are in the standalone bundle's deploy/cua-driver-manifest.json.
The MIT license, policy patch and build recipe are in third-party/cua-driver/.
Automatic browser setup and consent input are disabled. Cua Spaces/FSL components
and optional perception/model extensions are excluded. Runtime dependencies retain the licenses
of the guest Debian packages. The driver uses the verified offline payload; its
telemetry and update checks are disabled, and optional history is not enabled.
## DM Sans and Manrope
The optional desktop interface fonts DM Sans and Manrope are bundled under the
SIL Open Font License 1.1. Full licenses and pinned source/hash receipts are in
ui/fonts/DMSans-LICENSE.txt, ui/fonts/DMSans-SOURCE.json,
ui/fonts/Manrope-LICENSE.txt and ui/fonts/Manrope-SOURCE.json.
## Supplied Grok Bot artwork and renderer
Kindred incorporates the owner-supplied Grok Bot artwork pack recovered from the shipped Grok Bot 0.75.0 client: body geometry, motion recipes, expressions, morphs and recovered rendering code. These are incorporated third-party material, not original Kindred artwork. Exact archive and recovered-file hashes are recorded in `ui/avatar-runtime/PROVENANCE.json`. Kindred provides the shipping catalog, legacy compatibility, activity classification and lifecycle adapter. The original pack remains unchanged in intake evidence; production exposes only 25 regular bodies and has no seasonal selection or switching. This attribution does not assert a new license grant. Existing Kindred tribute artwork remains separate.