GGitHubCompact CLAUDE.md and skills docs (#8990)

8c8c2bac创建于 7月27日历史提交

文件	最后提交记录	最后更新时间
overlay	feat(browser): import terminal host protocol core Import the audited host protocol implementation, API, and host-only test byte-for-byte from private archive tag cmux-browser-public-snapshot-20260722-slice1 at commit 0821bef9ec386799dc80f7ef67263d31461c2b4a. Record exact source blobs and SHA-256 digests in SOURCE_SNAPSHOT.md.	2 个月前
scripts	ci(browser): enforce desktop GPL policy	2 个月前
AGENTS.md	Compact CLAUDE.md and skills docs (#8990) * Compact CLAUDE.md and skills docs Cut ~2k lines of duplication without dropping actionable rules. CLAUDE.md (267 -> 103): `reload.sh --tag` was explained four separate times; now once. Dropped the Ghostty submodule and Release sections, which restated the cmux-ghostty and cmux-release skills, and removed the file:// deeplink block, which contradicted the rule that chat output uses http://127.0.0.1:17320/<tag> and never a file:// URL. Pitfalls compressed from paragraphs to one line each, pointing at the owning skill. skills/ (4849 -> 2819 across 20 skills): the dominant waste was SKILL.md files restating their own references/ verbatim. Kept one canonical statement with expansion in references/. Three rules the root file carried had no skill that covered them, so they moved into cmux-architecture rather than being lost: SPM package group folders with check-workspace-package-groups.py, the Package.resolved tracking policy, and "feature flag means a remote PostHog runtime flag" via CmuxFeatureFlags. The cmuxTests pbxproj wiring requirement was promoted from a reference file into cmux-testing, and the shortcut policy moved into cmux-keyboard-shortcuts with its duplicate removed from cmux-localization. Stale references fixed: - `cd cmuxd && zig build` referenced a directory with zero tracked files; the daemon is Go at daemon/remote/cmd/cmuxd-remote. - Changelog page is web/app/[locale]/(landing)/docs/changelog/page.tsx, and configuration is under the same (landing) segment. - Package CmuxSocketControl does not exist; the real one is CmuxControlSocket, cited twice as the exemplar to copy. - Two rg commands in the localization audit were double-escaped and passed `--` as if it were a glob flag, so they matched nothing and silently passed the audit. Left untouched: the auto-generated cmux-settings reference files, which would drift from their generator. * Dedupe release slash commands release.md, release-local.md, and release-nightly.md each restated the same version-bump and changelog procedure (450 -> 192 lines total). release.md is now the canonical command doc holding the shared prep, changelog guidelines, and contributor-credit format; the other two state only their delta (local build-sign-upload.sh path, and no-PR direct-to- main path with the homebrew-cmux submodule pointer commit). Stale and incorrect instructions fixed: - All three pointed at docs-site/content/docs/changelog.mdx. There is no docs-site/ in the repo; the changelog page renders from CHANGELOG.md. - release.md said to hand-edit 'typically 4 occurrences' of MARKETING_VERSION in project.pbxproj. That leaves CURRENT_PROJECT_VERSION stale, which Sparkle requires to be monotonic and which release-pretag-guard.sh rejects. Unified on scripts/bump-version.sh, which bumps both. - Documented build-sign-upload.sh --allow-overwrite, which matters because pushing a v* tag also fires release.yml, so a local upload can race CI for the same assets. * Address review findings on submodule remotes and build links - tagged-builds.md still told contributors to build chat links from the absolute .app path with a file:// URL, contradicting the rule in CLAUDE.md that chat links use http://127.0.0.1:17320/<tag>. - cmux-ghostty said 'origin is upstream and manaflow is the fork' and pushed to a 'manaflow' remote. .gitmodules points every submodule at manaflow-ai/*, and no checkout has a 'manaflow' remote, so those commands would fail. Both the skill and submodule-safety.md now tell you to check git remote -v, and document adding an explicit 'upstream' remote for syncing from ghostty-org. - submodule-safety.md verified ancestry against <remote>/main even when a feature branch was pushed. Now checks the branch actually pushed. - release.md credited @lawrencechen; the account is @lawrencecchen. Skipped, with reasons: the ~/.agents/skills vs ~/.codex/skills split in cmux-customization is the documented convention (normal install vs skills.sh install), matching cmux-diagnostics. Adding per-entry attribution to the un-credited changelog example entry would contradict the policy three lines above it, which exempts core-team work.	1 个月前
IMPORT_PROVENANCE.md	docs(browser): bound commercial license scope	2 个月前
README.md	ci(browser): enforce desktop GPL policy	2 个月前
SOURCE_SNAPSHOT.md	feat(browser): import terminal host protocol core Import the audited host protocol implementation, API, and host-only test byte-for-byte from private archive tag cmux-browser-public-snapshot-20260722-slice1 at commit 0821bef9ec386799dc80f7ef67263d31461c2b4a. Record exact source blobs and SHA-256 digests in SOURCE_SNAPSHOT.md.	2 个月前

cmux Browser

cmux Browser combines Chromium web surfaces with Ghostty terminal frontends backed by the cmux TUI process. It is being moved into this repository so the Browser, its terminal protocol, and its exact Ghostty dependency can be built and reviewed from one public source tree.

The Browser is maintained as a small source overlay and patch set against an exact Chromium revision. Chromium itself is not vendored into this repository.

Import status

The public import is staged deliberately:

establish the provenance, licensing, and reproducibility contract;
import one curated source snapshot without private Git history;
make monorepo-relative build and dependency changes in reviewable commits;
add public CI and release-compliance gates; and
publish a Browser artifact only after the full build and UI matrix passes.

The source snapshot is not release-ready until every item in IMPORT_PROVENANCE.md is resolved.

Current public slices

The first source slice is the host-compilable browser-to-cmux-TUI protocol core:

overlay/chrome/browser/cmux_term/cmux_tui_protocol.{h,cc}
overlay/chrome/browser/cmux_term/cmux_tui_protocol_test.cc

It covers protocol identity, durable-registry revision fencing, ordered workspace events, input backpressure, resize coalescing, replay palette filtering, and JSON-lines framing.

The second source slice adds the host-compilable binary protocol shared by the terminal-host process and each renderer:

overlay/chrome/services/cmux_terminal_renderer/public/cpp/cmux_terminal_host_protocol.{h,cc}
overlay/chrome/services/cmux_terminal_renderer/public/cpp/cmux_terminal_host_protocol_test.cc

It covers framed streaming, authenticated renderer grants, bootstrap and snapshot payloads, sparse terminal colors and cursor state, viewer-size acknowledgements, and protocol error handling. Run both slices without Chromium:

./cmux-browser/scripts/run-host-tests.sh

That command first runs a fail-closed desktop license check: the project package declarations and Manaflow-owned Browser source areas must remain GPL-3.0-or-later, and an AGPL SPDX declaration is rejected. Explanatory AGPL discussion in the policy documents remains allowed.

The exact private source object and imported blob identities are recorded in SOURCE_SNAPSHOT.md. Later slices remain gated by IMPORT_PROVENANCE.md.

Planned layout

overlay/ mirrors paths in the Chromium source tree.
patches/ contains reviewable changes to existing Chromium files.
scripts/ bootstraps, applies, builds, tests, packages, and verifies the pinned product.
tests/ contains UI and end-to-end coverage.
tools/ contains focused local test harnesses.
docs/ contains durable architecture and contributor documentation.

License

This import does not change cmux's root license. Browser code for which Manaflow controls the necessary rights is available under GPL-3.0-or-later. Manaflow may separately offer commercial terms only for those rights-controlled portions. This is not a blanket dual-license claim over the Browser binary or every file in this directory.

Third-party and derived files retain their original licenses. In particular, Chromium-derived material is BSD-3-Clause, Helium-derived material and uBlock Origin are GPL-3.0-only, and Ghostty and Bonsplit are MIT; none is relicensed merely by being stored or distributed with the Browser.

AGPL is not the default for the desktop Browser. Its additional protection is aimed at modified software offered for remote network use, while GPL already requires source for distributed desktop forks. A future hosted service may use AGPL as a separately reviewed component decision, but changing this directory to AGPL would require a distinct policy and legal review.

Manaflow may offer later versions of code for which it controls the copyright under different terms. That does not revoke the rights already granted for a published GPL version, and it does not extend to third-party code or outside contributions without the necessary relicensing rights.

See IMPORT_PROVENANCE.md for the import boundary and the repository's THIRD_PARTY_LICENSES.md for the current cmux dependency inventory. That root inventory is not a complete Browser binary notice bundle; target-specific Browser notices remain a release gate.