THIRD-PARTY.md
Rama main · réplica de lectura del repositorio original.
# Third-party components
This project is AGPL-3.0-only. **The dependency worth knowing about before a legal
review is the one that is not open source at all**, and that is what this file is
for.
There is deliberately no table of every dependency and its license here. `package.json`
and `pnpm-lock.yaml` are that list, they are machine-readable, and they cannot go
stale — a hand-written copy beside them can, and would, and nothing here would
catch it. Run `pnpm licenses list` for a current one.
## The one that is not open source
`pnpm install` fetches **`@anthropic-ai/claude-agent-sdk`**, which declares
`"license": "SEE LICENSE IN README.md"` — a proprietary license, not an OSI one.
It arrives as a transitive dependency of `@agentclientprotocol/claude-agent-acp`,
which is itself Apache-2.0. The platform binaries it declares
(`@anthropic-ai/claude-agent-sdk-<platform>-<arch>`, `SEE LICENSE IN LICENSE.md`)
are **excluded**: every one is named in `pnpm-workspace.yaml`'s `overrides` with
`-`, so no binary of it lands in `node_modules` — the JavaScript package alone
does.
Three facts bound what that means here:
- **No code from it is ever loaded.** The daemon spawns an agent as a subprocess
over ACP, and nothing in `src/`, `packages/control-plane` or `packages/web`
imports it. Two comments in `src/acp/agents.ts` name it — the `ULTRACODE_SETTING`
docblock, quoting the SDK's own note on that session flag, and the `AGENT_LOGIN`
docblock, recording where the `claude` binary used to ship — and a comment loads
nothing. The one place in this repository that *resolves* it is
`scripts/pincheck.ts`, through the adapter, to read the manifest beside its
entry point — the platform packages it declares, held against the overrides
list above. A resolve returns a filename; it evaluates nothing. This is called
out because a grep for the package name finds those three places, and a reader
who had been told there is "no import anywhere" would reasonably read one as a
contradiction.
- The **published container image contains none of it**, and that is asserted
rather than intended: `scripts/imagecheck.ts` fails if any
`@agentclientprotocol`, `@anthropic-ai`, `@modelcontextprotocol`, `@openai` or
`opencode-*` package reaches the image. The last of those was the heaviest —
`opencode-ai`'s install unpacked one ~144 MB platform executable — and is no
longer a dependency at all; the pattern stays as the guard. The control plane
and the relay are the only things this project publishes as an artifact, and
neither spawns an agent.
- It is only needed to run `claude`. A deployment using `kimi`, `codex` or
`opencode`, or one that only runs the control plane, does not need it. The
`claude` CLI itself is not in this tree at all: `deploy/agents.sh` installs it
from the vendor — or, under `--source npm`, from the npm registry as
`@anthropic-ai/claude-code` — under the vendor's own terms, exactly as a
`curl | sh` install of it in a terminal would be.
If a fully-permissive dependency tree is a requirement for you, drop
`@agentclientprotocol/claude-agent-acp` from the root `package.json`; the other
three agents keep working, and `pnpm pincheck` will tell you which adapters are
actually installed.
Using the agents themselves is subject to each vendor's own terms, which this
project neither grants nor restricts.
## Everything else
Permissively licensed, and the manifests are the record: MIT, Apache-2.0,
BSD-3-Clause and ISC across the runtime and build dependencies. Nothing else in
the tree carries a license that restricts redistribution, and the AGPL obligations
this project takes on are its own rather than inherited.
## Text adapted from elsewhere
Not a dependency and not code, but it arrives under somebody else's licence and a
legal review asks about it, which is what this file is for. The three documents in
`packages/web/src/legal/` — Terms of Use, Acceptable Use Policy, Privacy Policy —
are adapted rather than written from nothing.
| Source | Licence | Used by |
|---|---|---|
| [37signals open-source policies](https://github.com/basecamp/policies) | [CC BY 4.0](https://creativecommons.org/licenses/by/4.0/) | All three documents: structure and much of the wording |
| [`github/site-policy`](https://github.com/github/site-policy) | [CC0 1.0](https://creativecommons.org/publicdomain/zero/1.0/) | The Acceptable Use Policy's restriction lists |
**CC BY 4.0 asks for the attribution where the work is read**, so it is rendered
on each page as well as recorded here, and `webcheck` asserts every field of that
credit. The CC0-licensed text owes nothing and is credited anyway — telling the
two apart at a glance is the mistake that would turn a courtesy into a breach.
⚠ **These documents name one operator and are that operator's terms, not this
software's.** A fork serving them unchanged is making a statement about a party
with no relationship to its users; the header of `legal.ts` says so where the value
is, in `SOURCE_URL`'s shape.
## Marks drawn in the app
The six harness icons (`packages/web/src/ui/AgentIcons.tsx`) are their vendors'
marks — Anthropic's Claude, OpenAI's Codex, Moonshot AI's Kimi, opencode's, xAI's
Grok and Anysphere's Cursor — and belong to them. They are drawn only to name the
program a session runs, never as this project's own. The SVG paths are as published in
[`@lobehub/icons-static-svg`](https://github.com/lobehub/lobe-icons) 1.95.1, MIT,
Copyright (c) 2023 LobeHub.
## Cryptography
⚠ **This section changed, and the change is the reason it exists.** It read *"this
project bundles no cryptographic library of its own and implements no algorithm"*
for as long as there was no end-to-end encryption. Both halves of that are now
qualified rather than true, and a legal review that found the old sentence beside
the current tree would rightly stop.
**Primitives still come from libraries, and no algorithm is implemented here.**
`node:crypto` does Ed25519 token signing and scrypt password hashing; `node:tls`
carries the SMTP client. The end-to-end encryption between the app and a daemon
adds four audited, zero-dependency packages, all MIT:
| Package | Version | Provides |
|---|---|---|
| [`@noble/curves`](https://github.com/paulmillr/noble-curves) | 2.4.0 | X25519 |
| [`@noble/ciphers`](https://github.com/paulmillr/noble-ciphers) | 2.4.0 | ChaCha20-Poly1305 |
| [`@noble/hashes`](https://github.com/paulmillr/noble-hashes) | 2.4.0 | BLAKE2s, HMAC |
| [`x25519-dalek`](https://github.com/dalek-cryptography/curve25519-dalek) | 3.0.0 | X25519 in the native shell, so a device's private key never crosses into the webview |
That is a real change in posture for a project whose control plane runs on three
dependencies in total, and it is recorded here rather than left in a manifest.
**What *is* assembled here is a published protocol, not a primitive.**
`packages/protocol/src/noise.ts` implements the handshake described by the Noise
Protocol Framework (revision 34), pattern `IK`, suite
`Noise_IK_25519_ChaChaPoly_BLAKE2s`. No primitive is written: the state machine is
the part a library would otherwise have supplied, and `pnpm protocolcheck` drives
it byte-for-byte against the official cross-implementation test vectors in both
roles, with fixed ephemerals. The vectors themselves are vendored at
`packages/protocol/vectors/noise.txt` from the `snow` project's published
cross-implementation file (Noise is a public-domain specification; the vector file
is distributed under snow's own permissive terms).
**And for export control**, which is what the paragraph below was always for: the
algorithms used are standard, published and widely available — X25519, ChaCha20-
Poly1305, BLAKE2s, Ed25519, scrypt — and none is authored here. This is publicly
available open-source software, published as source to anybody who wants it, which
is the category most jurisdictions treat as needing no license for distribution. It
is stated because "uses cryptography" is a question a legal review asks and an
unanswered one costs somebody a week.