license: release Nexus Terminal under the GNU AGPL v3

- LICENSE: the GNU Affero General Public License, version 3 (verbatim
  from gnu.org).
- SPDX-License-Identifier: AGPL-3.0-only plus a copyright line on every
  first-party source file (Rust, shell, Python, PHP); vendored crates keep
  their own licenses.
- Cargo manifests carry license/authors/repository; the macOS bundle
  copyright and the About page state the license and link the source.
- Release zips (and the macOS app bundle) include LICENSE.
- README: License section.

rust/Cargo.toml

@@ -6,6 +6,9 @@ exclude = ["fuzz"]
 [workspace.package]
 version = "3.0.2"
 edition = "2024"
+license = "AGPL-3.0-only"
+authors = ["Andy Dixon <andy@dixon.cx>"]
+repository = "https://github.com/andydixon/nexus"
 
 [profile.dev.package."*"]
 opt-level = 2

rust/app/Cargo.toml

@@ -2,6 +2,9 @@
 name = "nexus"
 version.workspace = true
 edition.workspace = true
+license.workspace = true
+authors.workspace = true
+repository.workspace = true
 build = "build.rs"
 
 [[bin]]

rust/app/build.rs

@@ -1,3 +1,6 @@
+// SPDX-License-Identifier: AGPL-3.0-only
+// Copyright (C) 2026 Andy Dixon
+
 //! Embeds the icon and version info into the Windows executable.
 fn main() {
     println!("cargo:rerun-if-changed=../packaging/windows/nexus.ico");

rust/app/src/app.rs

@@ -1,3 +1,6 @@
+// SPDX-License-Identifier: AGPL-3.0-only
+// Copyright (C) 2026 Andy Dixon
+
 //! The main window: title bar, connection sidebar, tab strip and workspace (terminals, split
 //! panes, protocol viewers), right dock (SFTP or the profile editor), status bar, command
 //! palette, prompts and toasts. Session events from nexus-core are drained here every frame.

rust/app/src/chrome.rs

@@ -1,3 +1,6 @@
+// SPDX-License-Identifier: AGPL-3.0-only
+// Copyright (C) 2026 Andy Dixon
+
 //! Window chrome: custom title bar, status bar, command palette, credential and host-key
 //! prompts, the main window's modal dialogs, toasts and resize edges.
 

rust/app/src/desktop_view.rs

@@ -1,3 +1,6 @@
+// SPDX-License-Identifier: AGPL-3.0-only
+// Copyright (C) 2026 Andy Dixon
+
 //! Remote desktop viewer for VNC and RDP: the remote framebuffer as a texture, with mouse,
 //! keyboard and clipboard input. Input is expressed in X keysyms and VNC pointer masks (VNC's own
 //! terms); `Remote` translates them for RDP. Toolbar after the web build's `vnc.js` (status,

rust/app/src/forwards.rs

@@ -1,3 +1,6 @@
+// SPDX-License-Identifier: AGPL-3.0-only
+// Copyright (C) 2026 Andy Dixon
+
 //! Port forwards dialog for a live SSH session: list, stop, add.
 
 use crate::chrome::modal;

rust/app/src/github_view.rs

@@ -1,3 +1,6 @@
+// SPDX-License-Identifier: AGPL-3.0-only
+// Copyright (C) 2026 Andy Dixon
+
 //! GitHub repository browser: owner groups of repo cards with ZIP download and Visit. Port of
 //! `github.js`.
 

rust/app/src/irc_view.rs

@@ -1,3 +1,6 @@
+// SPDX-License-Identifier: AGPL-3.0-only
+// Copyright (C) 2026 Andy Dixon
+
 //! IRC client view: room tabs, message log, composer and room/user lists. Port of `irc.js`;
 //! lines are `ircformat::format_event` spans drawn in the terminal theme's colours.
 

rust/app/src/main.rs

@@ -1,3 +1,6 @@
+// SPDX-License-Identifier: AGPL-3.0-only
+// Copyright (C) 2026 Andy Dixon
+
 //! Nexus Terminal: SSH, Telnet, RAW TCP, Serial, VNC, IRC, GitHub and local terminals in one
 //! native window. `nexus-terminal [--theme pro|midnight|light] [--screenshot out.png] [--size WxH]`.
 #![cfg_attr(not(debug_assertions), windows_subsystem = "windows")]

rust/app/src/osc.rs

@@ -1,3 +1,6 @@
+// SPDX-License-Identifier: AGPL-3.0-only
+// Copyright (C) 2026 Andy Dixon
+
 //! Finds the OSC sequences the VT parser ignores but Nexus uses: OSC 133 (shell integration
 //! marks: prompt, command, output, finished with exit status) and OSC 7 (the shell's working
 //! directory). Sequences may be split across reads, so the scanner keeps state between chunks.

rust/app/src/profile_editor.rs

@@ -1,3 +1,6 @@
+// SPDX-License-Identifier: AGPL-3.0-only
+// Copyright (C) 2026 Andy Dixon
+
 //! Profile editor (right dock): create and edit every protocol's settings. A port of the
 //! `profiles.js` drawer plus the Serial protocol. Switching protocol keeps the common fields
 //! (including the group), and list editors keep unsaved edits.

rust/app/src/quick_connect.rs

@@ -1,3 +1,6 @@
+// SPDX-License-Identifier: AGPL-3.0-only
+// Copyright (C) 2026 Andy Dixon
+
 //! Quick Connect dialog: an ad-hoc session without saving a profile.
 
 use crate::chrome::modal;

rust/app/src/raw_view.rs

@@ -1,3 +1,6 @@
+// SPDX-License-Identifier: AGPL-3.0-only
+// Copyright (C) 2026 Andy Dixon
+
 //! RAW TCP viewer: text / hex / split views of the capture, pause, clear, save, and a send bar.
 //! Port of the web build's `raw.js`. Sent data comes back through `Event::RawData` ("send"), so
 //! the echo of a sent entry needs no local bookkeeping.

rust/app/src/recordings.rs

@@ -1,3 +1,6 @@
+// SPDX-License-Identifier: AGPL-3.0-only
+// Copyright (C) 2026 Andy Dixon
+
 //! Recordings browser and playback window (port of the RecordingManager in recordings.js).
 
 use crate::state::Shared;

rust/app/src/restore.rs

@@ -1,3 +1,6 @@
+// SPDX-License-Identifier: AGPL-3.0-only
+// Copyright (C) 2026 Andy Dixon
+
 //! Reopens the previous run's tabs and splits at launch: saved profiles reconnect, local shells
 //! start again in the directory they were in. The layout is saved whenever it changes (not only on
 //! exit), so it survives a crash. Quick Connect tabs aren't restored (they have no saved profile).

rust/app/src/settings.rs

@@ -1,3 +1,6 @@
+// SPDX-License-Identifier: AGPL-3.0-only
+// Copyright (C) 2026 Andy Dixon
+
 //! Settings window: General, Terminal, Security, Known Hosts, Help, About. Also the
 //! master-password dialog (strength meter + confirm) used to create or unlock the vault.
 
@@ -781,14 +784,21 @@ impl Settings {
     // --- About ----------------------------------------------------------------------------
 
     fn about(&mut self, ui: &mut Ui, s: &mut Shared) {
+        const SOURCE_URL: &str = "https://github.com/andydixon/nexus";
         let t = Tokens::get(ui.ctx());
         ui.add_space(8.0);
         ui.label(RichText::new("Nexus Terminal").font(theme::semibold(22.0)));
         ui.label(RichText::new(format!("Version {}", nexus_core::service::VERSION)).color(t.text_dim));
         ui.label(RichText::new("Developed by Andy Dixon - dixon.cx/nexus").color(t.text_faint));
+        ui.horizontal(|ui| {
+            ui.label(RichText::new("Free software under the GNU Affero General Public License v3. Source:").color(t.text_faint));
+            if ui.link("github.com/andydixon/nexus").clicked() {
+                widgets::open_web_url(ui.ctx(), SOURCE_URL);
+            }
+        });
         ui.add_space(8.0);
         for f in [
-            "SSH, Telnet, RAW TCP, Serial, VNC, IRC, GitHub and local terminals",
+            "SSH, Telnet, RAW TCP, Serial, VNC, RDP, IRC, GitHub and local terminals",
             "AES-256-GCM encrypted credential vault",
             "Platform-native keychain integration",
             "SFTP file browser and transfer",

rust/app/src/sftp.rs

@@ -1,3 +1,6 @@
+// SPDX-License-Identifier: AGPL-3.0-only
+// Copyright (C) 2026 Andy Dixon
+
 //! SFTP browser (right dock), the file-drop dialog and the remote directory picker.
 //! Every SFTP call blocks on the network, so it runs on a worker thread; results come back
 //! through `inbox` and are applied on the UI thread at the start of the next frame.

rust/app/src/sidebar.rs

@@ -1,3 +1,6 @@
+// SPDX-License-Identifier: AGPL-3.0-only
+// Copyright (C) 2026 Andy Dixon
+
 //! The connection sidebar: Local Machine, Favourites, Recent, folders, Ungrouped; fuzzy search;
 //! click to connect, Ctrl/Cmd-click to multi-select, double-click to edit; bulk actions.
 

rust/app/src/snippets.rs

@@ -1,3 +1,6 @@
+// SPDX-License-Identifier: AGPL-3.0-only
+// Copyright (C) 2026 Andy Dixon
+
 //! Snippet library window and the {{variable}} prompt (port of snippets.js).
 
 use crate::state::{Request, Shared};

rust/app/src/splits.rs

@@ -1,3 +1,6 @@
+// SPDX-License-Identifier: AGPL-3.0-only
+// Copyright (C) 2026 Andy Dixon
+
 //! Split panes: a binary tree of sessions inside one tab. A new split starts as a placeholder
 //! pane offering Local Machine and the saved connections; ✕ on a pane promotes its sibling.
 

rust/app/src/ssh_keys.rs

@@ -1,3 +1,6 @@
+// SPDX-License-Identifier: AGPL-3.0-only
+// Copyright (C) 2026 Andy Dixon
+
 //! SSH Key Manager window: key pairs in ~/.ssh — copy public key, delete, generate (in-process, OpenSSH format).
 
 use crate::settings::{Job, poll};

rust/app/src/state.rs

@@ -1,3 +1,6 @@
+// SPDX-License-Identifier: AGPL-3.0-only
+// Copyright (C) 2026 Andy Dixon
+
 //! State shared by the main window and every feature module: the service, cached profiles and
 //! preferences, open tabs, toasts, and a request queue features use to ask the app to act.
 

rust/app/src/tabs.rs

@@ -1,3 +1,6 @@
+// SPDX-License-Identifier: AGPL-3.0-only
+// Copyright (C) 2026 Andy Dixon
+
 //! The tab strip and the workspace under it: the active tab's session (or its split panes),
 //! terminal find bar and connection overlays.
 

rust/app/src/terminal.rs

@@ -1,3 +1,6 @@
+// SPDX-License-Identifier: AGPL-3.0-only
+// Copyright (C) 2026 Andy Dixon
+
 //! TermView: an alacritty_terminal grid drawn with egui's painter. Bytes from a session go
 //! straight into the VT parser; keystrokes, paste, mouse reports and terminal replies come back
 //! out through `TermResponse` for the app to send to the session (and broadcast targets).

rust/app/src/terminal_themes.rs

@@ -1,3 +1,6 @@
+// SPDX-License-Identifier: AGPL-3.0-only
+// Copyright (C) 2026 Andy Dixon
+
 //! The 11 terminal colour schemes, generated from the web build's themes.js.
 
 pub struct TermTheme {

rust/app/src/theme.rs

@@ -1,3 +1,6 @@
+// SPDX-License-Identifier: AGPL-3.0-only
+// Copyright (C) 2026 Andy Dixon
+
 //! Design system: colour tokens, radii and typography (Inter for UI, JetBrains Mono for bytes).
 //! Widgets read `Tokens::get(ctx)` instead of hard-coding colours, so every theme applies
 //! everywhere. Copied from Leviathan Desktop so both apps share one look.

rust/app/src/transfer.rs

@@ -1,3 +1,6 @@
+// SPDX-License-Identifier: AGPL-3.0-only
+// Copyright (C) 2026 Andy Dixon
+
 //! Profile export/import: encrypted `.nexus` and plain JSON.
 
 use crate::settings::{Job, poll};

rust/app/src/triggers.rs

@@ -1,3 +1,6 @@
+// SPDX-License-Identifier: AGPL-3.0-only
+// Copyright (C) 2026 Andy Dixon
+
 //! Trigger rules: match terminal output lines and notify / highlight / beep (port of triggers.js).
 //! Rules live in `triggers.json` in the data directory (the web build's localStorage rules are
 //! not migrated).

rust/app/src/views.rs

@@ -1,3 +1,6 @@
+// SPDX-License-Identifier: AGPL-3.0-only
+// Copyright (C) 2026 Andy Dixon
+
 //! How a session is drawn. Terminal-style protocols share `TermView`; the rest have their own.
 
 use crate::desktop_view::DesktopView;

rust/app/src/widgets.rs

@@ -1,3 +1,6 @@
+// SPDX-License-Identifier: AGPL-3.0-only
+// Copyright (C) 2026 Andy Dixon
+
 //! Shared widgets: section headers, buttons, chips, key/value grids, virtual lists, empty states.
 //! Colours always come from `Tokens`.
 

rust/core/Cargo.toml

@@ -2,6 +2,9 @@
 name = "nexus-core"
 version.workspace = true
 edition.workspace = true
+license.workspace = true
+authors.workspace = true
+repository.workspace = true
 
 [features]
 # Exposes parser entry points for rust/fuzz (cargo-fuzz).

rust/core/examples/demo_data.rs

@@ -1,3 +1,6 @@
+// SPDX-License-Identifier: AGPL-3.0-only
+// Copyright (C) 2026 Andy Dixon
+
 //! Fills a data directory with demo profiles, snippets, known hosts, trigger rules and recordings
 //! for the user-guide screenshots (docs/guide/screenshots.sh).
 //!

rust/core/src/clients/github.rs

@@ -1,3 +1,6 @@
+// SPDX-License-Identifier: AGPL-3.0-only
+// Copyright (C) 2026 Andy Dixon
+
 //! Lightweight GitHub REST client for repository metadata and archive downloads. Works with
 //! github.com and GitHub Enterprise via a configurable API base URL.
 

rust/core/src/clients/irc.rs

@@ -1,3 +1,6 @@
+// SPDX-License-Identifier: AGPL-3.0-only
+// Copyright (C) 2026 Andy Dixon
+
 //! IRC client: registration, PING/PONG, channel/user tracking, CTCP ACTION, NickServ identify,
 //! auto-join and the composer's /commands, reporting through typed `Event`s.
 //!

rust/core/src/clients/local.rs

@@ -1,3 +1,6 @@
+// SPDX-License-Identifier: AGPL-3.0-only
+// Copyright (C) 2026 Andy Dixon
+
 //! Local shell in a PTY (forkpty on Unix, ConPTY on Windows), a port of internal/localshell.
 
 use super::Callbacks;

rust/core/src/clients/mod.rs

@@ -1,3 +1,6 @@
+// SPDX-License-Identifier: AGPL-3.0-only
+// Copyright (C) 2026 Andy Dixon
+
 //! Protocol clients. Conventions, shared by every client so the session manager treats them alike:
 //! - `connect()` blocks the calling thread (the manager calls it from a worker thread, as Go
 //!   called it from a goroutine) and returns once the connection is usable.

rust/core/src/clients/proxy.rs

@@ -1,3 +1,6 @@
+// SPDX-License-Identifier: AGPL-3.0-only
+// Copyright (C) 2026 Andy Dixon
+
 //! Outbound proxies (SOCKS5, HTTP CONNECT) for the clients that dial TCP themselves: SSH and RDP.
 //! Blocking; async callers run it on a blocking thread.
 

rust/core/src/clients/raw.rs

@@ -1,3 +1,6 @@
+// SPDX-License-Identifier: AGPL-3.0-only
+// Copyright (C) 2026 Andy Dixon
+
 //! RAW TCP client (port of Go `internal/rawclient`): binary-safe send/receive, a capped history
 //! of sent ("send") and received ("recv") frames, JSON capture, and the hex/escape encoders the
 //! RAW view reuses.

rust/core/src/clients/rdp.rs

@@ -1,3 +1,6 @@
+// SPDX-License-Identifier: AGPL-3.0-only
+// Copyright (C) 2026 Andy Dixon
+
 //! RDP client on IronRDP: TLS with NLA (CredSSP), the server certificate pinned through the
 //! caller's host-key check, any transport the caller dials (direct, SOCKS5/HTTP proxy or an SSH
 //! tunnel), and the desktop decoded into the same RGBA framebuffer the VNC client uses. Like the

rust/core/src/clients/rdp_devices.rs

@@ -1,3 +1,6 @@
+// SPDX-License-Identifier: AGPL-3.0-only
+// Copyright (C) 2026 Andy Dixon
+
 //! RDP device redirection: a shared folder as a drive, and a virtual printer whose jobs are saved
 //! as PostScript files.
 //!

rust/core/src/clients/serial.rs

@@ -1,3 +1,6 @@
+// SPDX-License-Identifier: AGPL-3.0-only
+// Copyright (C) 2026 Andy Dixon
+
 //! Serial client (new protocol, no Go original) on the `serialport` crate. The device path is
 //! `Profile::host`, line settings come from `Profile::serial`. Same conventions as the other
 //! clients: blocking `connect`, an own reader thread, `on_close` exactly once (unplug included).

rust/core/src/clients/sftp.rs

@@ -1,3 +1,6 @@
+// SPDX-License-Identifier: AGPL-3.0-only
+// Copyright (C) 2026 Andy Dixon
+
 //! SFTP operations over an SSH session's subsystem (internal/sftpclient). Every call blocks the
 //! caller, so the UI runs them on worker threads.
 

rust/core/src/clients/ssh.rs

@@ -1,3 +1,6 @@
+// SPDX-License-Identifier: AGPL-3.0-only
+// Copyright (C) 2026 Andy Dixon
+
 //! SSH client on russh: interactive PTY shell, the profile's auth chain (agent, public key,
 //! password, keyboard-interactive with TOTP), jump hosts, SOCKS5/HTTP proxies, local and remote
 //! port forwards, agent forwarding and SFTP. A port of internal/sshclient + sftpclient.

rust/core/src/clients/telnet.rs

@@ -1,3 +1,6 @@
+// SPDX-License-Identifier: AGPL-3.0-only
+// Copyright (C) 2026 Andy Dixon
+
 //! Telnet client (port of Go `internal/telnetclient`): RFC 854/855 option negotiation (ECHO, SGA,
 //! TTYPE, NAWS; everything else refused), IAC escaping, line-ending conversion, ISO 8859-1 output
 //! encoding and BRK. Go read but never acted on `lineMode`, and neither do we.

rust/core/src/clients/vnc.rs

@@ -1,3 +1,6 @@
+// SPDX-License-Identifier: AGPL-3.0-only
+// Copyright (C) 2026 Andy Dixon
+
 //! Native VNC (RFB 3.3/3.7/3.8) client: None and VNC Authentication, Raw, CopyRect, Hextile, ZRLE
 //! and Tight (zlib + JPEG), plus the DesktopSize, ExtendedDesktopSize and LastRect pseudo-encodings.
 //!

rust/core/src/config.rs

@@ -1,3 +1,6 @@
+// SPDX-License-Identifier: AGPL-3.0-only
+// Copyright (C) 2026 Andy Dixon
+
 //! Data directories.
 
 use std::path::{Path, PathBuf};

rust/core/src/exportimport.rs

@@ -1,3 +1,6 @@
+// SPDX-License-Identifier: AGPL-3.0-only
+// Copyright (C) 2026 Andy Dixon
+
 //! Password-encrypted profile exports: `[version 1][salt 32][nonce 12][AES-256-GCM ciphertext]`
 //! over a JSON bundle, with the vault's Argon2id parameters.
 

rust/core/src/ircformat.rs

@@ -1,3 +1,6 @@
+// SPDX-License-Identifier: AGPL-3.0-only
+// Copyright (C) 2026 Andy Dixon
+
 //! mIRC formatting (^B ^] ^^ ^_ ^V ^Q ^O ^C fg,bg ^D hex) to styled spans, the nick colour hash
 //! and the IRC event line layout. Ported from the Wails frontend's `irc.js`.
 //!

rust/core/src/keyfiles.rs

@@ -1,3 +1,6 @@
+// SPDX-License-Identifier: AGPL-3.0-only
+// Copyright (C) 2026 Andy Dixon
+
 //! SSH key file helpers that need no SSH crypto: spotting private keys, listing `~/.ssh`, and
 //! sanitising key and upload file names.
 

rust/core/src/known_hosts.rs

@@ -1,3 +1,6 @@
+// SPDX-License-Identifier: AGPL-3.0-only
+// Copyright (C) 2026 Andy Dixon
+
 //! OpenSSH `known_hosts` interchange and SSH certificate authorities.
 //!
 //! Imported host keys become ordinary known-host rows. `@cert-authority` lines become rows with

rust/core/src/lib.rs

@@ -1,3 +1,6 @@
+// SPDX-License-Identifier: AGPL-3.0-only
+// Copyright (C) 2026 Andy Dixon
+
 //! nexus-core: everything in Nexus Terminal that isn't drawing — storage, secrets, protocol
 //! clients and the session manager. The egui app is one client of this crate.
 

rust/core/src/models.rs

@@ -1,3 +1,6 @@
+// SPDX-License-Identifier: AGPL-3.0-only
+// Copyright (C) 2026 Andy Dixon
+
 //! Data model shared by storage, the session manager and the UI. Field names are the JSON keys
 //! used in the database's config columns and in `.nexus` exports.
 

rust/core/src/recording.rs

@@ -1,3 +1,6 @@
+// SPDX-License-Identifier: AGPL-3.0-only
+// Copyright (C) 2026 Andy Dixon
+
 //! Session recording in asciicast v2 (https://docs.asciinema.org/manual/asciicast/v2/): a JSON
 //! header line, then one `[elapsed_secs, type, data]` array per line. Same files as the Go app.
 

rust/core/src/secrets.rs

@@ -1,3 +1,6 @@
+// SPDX-License-Identifier: AGPL-3.0-only
+// Copyright (C) 2026 Andy Dixon
+
 //! Credential storage: the OS keychain first, then an Argon2id + AES-256-GCM vault file that is
 //! byte-compatible with the Go app's `vault/vault.json`.
 

rust/core/src/service.rs

@@ -1,3 +1,6 @@
+// SPDX-License-Identifier: AGPL-3.0-only
+// Copyright (C) 2026 Andy Dixon
+
 //! The app-facing API (a port of internal/api.Service minus the Wails plumbing): profiles,
 //! sessions, credentials, known hosts, preferences, snippets, import/export, SSH keys, updates.
 //! File dialogs live in the UI; methods here take paths.

rust/core/src/sessions/credentials.rs

@@ -1,3 +1,6 @@
+// SPDX-License-Identifier: AGPL-3.0-only
+// Copyright (C) 2026 Andy Dixon
+
 //! Credential resolution (saved, session-only, ask-every-time), prompts and host-key checks.
 
 use super::*;

rust/core/src/sessions/extras.rs

@@ -1,3 +1,6 @@
+// SPDX-License-Identifier: AGPL-3.0-only
+// Copyright (C) 2026 Andy Dixon
+
 //! Accessors and actions specific to one protocol (RAW, IRC, GitHub, desktops, SSH).
 
 use super::*;

rust/core/src/sessions/local.rs

@@ -1,3 +1,6 @@
+// SPDX-License-Identifier: AGPL-3.0-only
+// Copyright (C) 2026 Andy Dixon
+
 //! Local shells and login scripts.
 
 use super::*;

rust/core/src/sessions/mod.rs

@@ -1,3 +1,6 @@
+// SPDX-License-Identifier: AGPL-3.0-only
+// Copyright (C) 2026 Andy Dixon
+
 //! The session manager: one entry per open tab, each owning a protocol client. A port of
 //! internal/sessions — same lifecycle, reconnect backoff, login scripts, recording hooks and
 //! credential resolution — reporting to the UI through `Event`s.

rust/core/src/sessions/protocols.rs

@@ -1,3 +1,6 @@
+// SPDX-License-Identifier: AGPL-3.0-only
+// Copyright (C) 2026 Andy Dixon
+
 //! Per-protocol connect: SSH, GitHub, IRC, VNC and RDP, and the SSH tunnels they can use.
 
 use super::*;

rust/core/src/sshconfig.rs

@@ -1,3 +1,6 @@
+// SPDX-License-Identifier: AGPL-3.0-only
+// Copyright (C) 2026 Andy Dixon
+
 //! Parses OpenSSH `~/.ssh/config` Host blocks into SSH profiles. Supports HostName, Port, User,
 //! IdentityFile, ProxyJump (first hop), ForwardAgent and Compression. Match blocks, wildcard-only
 //! hosts, Include and `%h`-style tokens are ignored, as in the Go app.

rust/core/src/storage.rs

@@ -1,3 +1,6 @@
+// SPDX-License-Identifier: AGPL-3.0-only
+// Copyright (C) 2026 Andy Dixon
+
 //! SQLite persistence: profiles, known hosts, preferences, audit log, snippets and IRC channel
 //! state. The schema and migration files are the Go app's, so existing databases open unchanged.
 

rust/core/src/sync.rs

@@ -1,3 +1,6 @@
+// SPDX-License-Identifier: AGPL-3.0-only
+// Copyright (C) 2026 Andy Dixon
+
 //! Profile sync through a folder the user picks (a cloud drive, a network share, a git checkout):
 //! one encrypted file, `nexus-profiles.nexus`, in the export format (Argon2id + AES-256-GCM) under
 //! a sync password. Each side merges profile by profile — the newer `updated_at` wins — and

rust/core/src/terminalenv.rs

@@ -1,3 +1,6 @@
+// SPDX-License-Identifier: AGPL-3.0-only
+// Copyright (C) 2026 Andy Dixon
+
 //! Environment variables for terminal sessions: TERM and a UTF-8 character locale.
 
 use std::collections::BTreeMap;

rust/core/src/updater.rs

@@ -1,3 +1,6 @@
+// SPDX-License-Identifier: AGPL-3.0-only
+// Copyright (C) 2026 Andy Dixon
+
 //! Update checks against a self-hosted manifest. Check-only: nothing is downloaded or installed.
 //! The launch-time check honours `AppPreferences::check_for_updates`. Calls block; run them off
 //! the UI thread.

rust/core/src/validation.rs

@@ -1,3 +1,6 @@
+// SPDX-License-Identifier: AGPL-3.0-only
+// Copyright (C) 2026 Andy Dixon
+
 //! Field-level validation of profiles and their protocol configs. Enum-typed fields (secret modes,
 //! host-key policy, line endings, forward direction, protocol) can't hold invalid values in Rust,
 //! so the Go checks for those are enforced by the types instead.

rust/core/tests/sessions.rs

@@ -1,3 +1,6 @@
+// SPDX-License-Identifier: AGPL-3.0-only
+// Copyright (C) 2026 Andy Dixon
+
 //! Session manager end to end: events, writes, host-key prompts, auto-reconnect.
 
 use nexus_core::models::{Profile, Protocol, SessionState};

rust/core/tests/ssh_integration.rs

@@ -1,3 +1,6 @@
+// SPDX-License-Identifier: AGPL-3.0-only
+// Copyright (C) 2026 Andy Dixon
+
 //! End-to-end SSH tests against a throwaway OpenSSH server run as the current user. Skipped
 //! (passing) when `sshd`/`ssh-keygen` aren't installed.
 

rust/core/tests/sync.rs

@@ -1,3 +1,6 @@
+// SPDX-License-Identifier: AGPL-3.0-only
+// Copyright (C) 2026 Andy Dixon
+
 //! Profile sync between two "machines" (data directories) sharing one folder.
 
 use nexus_core::config::AppConfig;

rust/fuzz/Cargo.toml

@@ -3,6 +3,7 @@ name = "nexus-fuzz"
 version = "0.0.0"
 publish = false
 edition = "2024"
+license = "AGPL-3.0-only"
 
 [package.metadata]
 cargo-fuzz = true

rust/fuzz/fuzz_targets/irc.rs

@@ -1,3 +1,6 @@
+// SPDX-License-Identifier: AGPL-3.0-only
+// Copyright (C) 2026 Andy Dixon
+
 #![no_main]
 
 libfuzzer_sys::fuzz_target!(|data: &[u8]| nexus_core::clients::irc::fuzz_lines(data));

rust/fuzz/fuzz_targets/sshconfig.rs

@@ -1,3 +1,6 @@
+// SPDX-License-Identifier: AGPL-3.0-only
+// Copyright (C) 2026 Andy Dixon
+
 #![no_main]
 
 libfuzzer_sys::fuzz_target!(|data: &[u8]| nexus_core::sshconfig::fuzz_parse(data));

rust/fuzz/fuzz_targets/telnet.rs

@@ -1,3 +1,6 @@
+// SPDX-License-Identifier: AGPL-3.0-only
+// Copyright (C) 2026 Andy Dixon
+
 #![no_main]
 
 libfuzzer_sys::fuzz_target!(|data: &[u8]| nexus_core::clients::telnet::fuzz_negotiation(data));

rust/fuzz/fuzz_targets/updater.rs

@@ -1,3 +1,6 @@
+// SPDX-License-Identifier: AGPL-3.0-only
+// Copyright (C) 2026 Andy Dixon
+
 #![no_main]
 
 libfuzzer_sys::fuzz_target!(|data: &[u8]| nexus_core::updater::fuzz_manifest(data));

rust/fuzz/fuzz_targets/vnc.rs

@@ -1,3 +1,6 @@
+// SPDX-License-Identifier: AGPL-3.0-only
+// Copyright (C) 2026 Andy Dixon
+
 #![no_main]
 
 libfuzzer_sys::fuzz_target!(|data: &[u8]| nexus_core::clients::vnc::fuzz_updates(data));

rust/packaging/linux/install.sh

@@ -1,4 +1,6 @@
 #!/bin/sh
+# SPDX-License-Identifier: AGPL-3.0-only
+# Copyright (C) 2026 Andy Dixon
 # Install Nexus Terminal for the current user so it appears in the app launcher.
 # Usage: rust/packaging/linux/install.sh [path/to/nexus-terminal]   (default: target/release/nexus-terminal)
 set -eu

rust/packaging/macos/Info.plist

@@ -31,6 +31,6 @@
 	<key>NSSupportsAutomaticGraphicsSwitching</key>
 	<true/>
 	<key>NSHumanReadableCopyright</key>
-	<string>© Andy Dixon</string>
+	<string>© 2026 Andy Dixon. Licensed under the GNU AGPL v3.</string>
 </dict>
 </plist>

rust/packaging/macos/build-app.sh

@@ -1,4 +1,6 @@
 #!/bin/sh
+# SPDX-License-Identifier: AGPL-3.0-only
+# Copyright (C) 2026 Andy Dixon
 # Build NexusTerminal.app, a macOS application bundle. Run on a Mac with Xcode command-line tools:
 #
 #   rust/packaging/macos/build-app.sh            # universal (Apple Silicon + Intel) if both
@@ -44,6 +46,7 @@ mkdir -p "$APP/Contents/MacOS" "$APP/Contents/Resources"
 cp "$BIN" "$APP/Contents/MacOS/NexusTerminal"
 chmod +x "$APP/Contents/MacOS/NexusTerminal"
 cp "$HERE/NexusTerminal.icns" "$APP/Contents/Resources/NexusTerminal.icns"
+cp "$HERE/../../../LICENSE" "$APP/Contents/Resources/LICENSE"
 sed "s/__VERSION__/$VERSION/g" "$HERE/Info.plist" > "$APP/Contents/Info.plist"
 printf 'APPL????' > "$APP/Contents/PkgInfo"
 

rust/release.sh

@@ -1,4 +1,6 @@
 #!/usr/bin/env bash
+# SPDX-License-Identifier: AGPL-3.0-only
+# Copyright (C) 2026 Andy Dixon
 # release.sh — build and package Nexus Terminal release artefacts with cargo.
 #
 # Produces, under build/releases/<version>/ (repo root):
@@ -66,18 +68,18 @@ for target in "${TARGETS[@]}"; do
             NEXUS_BIN="$bin" packaging/macos/build-app.sh
             rm -rf "$OUT/$base.app"
             cp -R target/macos/NexusTerminal.app "$OUT/$base.app"
-            (cd "$OUT" && rm -f "$base.zip" && zip -qry "$base.zip" "$base.app")
+            (cd "$OUT" && rm -f "$base.zip" && zip -qry "$base.zip" "$base.app" && zip -qj "$base.zip" "$ROOT/LICENSE")
             ;;
         windows)
             cp "$bin.exe" "$OUT/$base.exe"
-            (cd "$OUT" && rm -f "$base.zip" && zip -qj "$base.zip" "$base.exe")
+            (cd "$OUT" && rm -f "$base.zip" && zip -qj "$base.zip" "$base.exe" "$ROOT/LICENSE")
             ;;
         *)
             cp "$bin" "$OUT/$base"
             strip "$OUT/$base" 2>/dev/null || true
             stage="$(mktemp -d)"
             cp "$OUT/$base" "$stage/nexus-terminal"
-            cp packaging/linux/nexus-terminal.desktop packaging/linux/install.sh "$stage/"
+            cp packaging/linux/nexus-terminal.desktop packaging/linux/install.sh "$ROOT/LICENSE" "$stage/"
             mkdir -p "$stage/app/assets/icon" && cp app/assets/icon/icon-256.png app/assets/icon/icon-512.png "$stage/app/assets/icon/"
             sed -i 's|\$HERE/../../app|$HERE/app|; s|\$HERE/../../target/release/nexus-terminal|$HERE/nexus-terminal|' "$stage/install.sh"
             (cd "$stage" && rm -f "$OUT/$base.zip" && zip -qr "$OUT/$base.zip" .)