license: release Nexus Terminal under the GNU AGPL v3

- LICENSE: the GNU Affero General Public License, version 3 (verbatim
  from gnu.org).
- SPDX-License-Identifier: AGPL-3.0-only plus a copyright line on every
  first-party source file (Rust, shell, Python, PHP); vendored crates keep
  their own licenses.
- Cargo manifests carry license/authors/repository; the macOS bundle
  copyright and the About page state the license and link the source.
- Release zips (and the macOS app bundle) include LICENSE.
- README: License section.

rust/core/Cargo.toml

@@ -2,6 +2,9 @@
 name = "nexus-core"
 version.workspace = true
 edition.workspace = true
+license.workspace = true
+authors.workspace = true
+repository.workspace = true
 
 [features]
 # Exposes parser entry points for rust/fuzz (cargo-fuzz).

rust/core/examples/demo_data.rs

@@ -1,3 +1,6 @@
+// SPDX-License-Identifier: AGPL-3.0-only
+// Copyright (C) 2026 Andy Dixon
+
 //! Fills a data directory with demo profiles, snippets, known hosts, trigger rules and recordings
 //! for the user-guide screenshots (docs/guide/screenshots.sh).
 //!

rust/core/src/clients/github.rs

@@ -1,3 +1,6 @@
+// SPDX-License-Identifier: AGPL-3.0-only
+// Copyright (C) 2026 Andy Dixon
+
 //! Lightweight GitHub REST client for repository metadata and archive downloads. Works with
 //! github.com and GitHub Enterprise via a configurable API base URL.
 

rust/core/src/clients/irc.rs

@@ -1,3 +1,6 @@
+// SPDX-License-Identifier: AGPL-3.0-only
+// Copyright (C) 2026 Andy Dixon
+
 //! IRC client: registration, PING/PONG, channel/user tracking, CTCP ACTION, NickServ identify,
 //! auto-join and the composer's /commands, reporting through typed `Event`s.
 //!

rust/core/src/clients/local.rs

@@ -1,3 +1,6 @@
+// SPDX-License-Identifier: AGPL-3.0-only
+// Copyright (C) 2026 Andy Dixon
+
 //! Local shell in a PTY (forkpty on Unix, ConPTY on Windows), a port of internal/localshell.
 
 use super::Callbacks;

rust/core/src/clients/mod.rs

@@ -1,3 +1,6 @@
+// SPDX-License-Identifier: AGPL-3.0-only
+// Copyright (C) 2026 Andy Dixon
+
 //! Protocol clients. Conventions, shared by every client so the session manager treats them alike:
 //! - `connect()` blocks the calling thread (the manager calls it from a worker thread, as Go
 //!   called it from a goroutine) and returns once the connection is usable.

rust/core/src/clients/proxy.rs

@@ -1,3 +1,6 @@
+// SPDX-License-Identifier: AGPL-3.0-only
+// Copyright (C) 2026 Andy Dixon
+
 //! Outbound proxies (SOCKS5, HTTP CONNECT) for the clients that dial TCP themselves: SSH and RDP.
 //! Blocking; async callers run it on a blocking thread.
 

rust/core/src/clients/raw.rs

@@ -1,3 +1,6 @@
+// SPDX-License-Identifier: AGPL-3.0-only
+// Copyright (C) 2026 Andy Dixon
+
 //! RAW TCP client (port of Go `internal/rawclient`): binary-safe send/receive, a capped history
 //! of sent ("send") and received ("recv") frames, JSON capture, and the hex/escape encoders the
 //! RAW view reuses.

rust/core/src/clients/rdp.rs

@@ -1,3 +1,6 @@
+// SPDX-License-Identifier: AGPL-3.0-only
+// Copyright (C) 2026 Andy Dixon
+
 //! RDP client on IronRDP: TLS with NLA (CredSSP), the server certificate pinned through the
 //! caller's host-key check, any transport the caller dials (direct, SOCKS5/HTTP proxy or an SSH
 //! tunnel), and the desktop decoded into the same RGBA framebuffer the VNC client uses. Like the

rust/core/src/clients/rdp_devices.rs

@@ -1,3 +1,6 @@
+// SPDX-License-Identifier: AGPL-3.0-only
+// Copyright (C) 2026 Andy Dixon
+
 //! RDP device redirection: a shared folder as a drive, and a virtual printer whose jobs are saved
 //! as PostScript files.
 //!

rust/core/src/clients/serial.rs

@@ -1,3 +1,6 @@
+// SPDX-License-Identifier: AGPL-3.0-only
+// Copyright (C) 2026 Andy Dixon
+
 //! Serial client (new protocol, no Go original) on the `serialport` crate. The device path is
 //! `Profile::host`, line settings come from `Profile::serial`. Same conventions as the other
 //! clients: blocking `connect`, an own reader thread, `on_close` exactly once (unplug included).

rust/core/src/clients/sftp.rs

@@ -1,3 +1,6 @@
+// SPDX-License-Identifier: AGPL-3.0-only
+// Copyright (C) 2026 Andy Dixon
+
 //! SFTP operations over an SSH session's subsystem (internal/sftpclient). Every call blocks the
 //! caller, so the UI runs them on worker threads.
 

rust/core/src/clients/ssh.rs

@@ -1,3 +1,6 @@
+// SPDX-License-Identifier: AGPL-3.0-only
+// Copyright (C) 2026 Andy Dixon
+
 //! SSH client on russh: interactive PTY shell, the profile's auth chain (agent, public key,
 //! password, keyboard-interactive with TOTP), jump hosts, SOCKS5/HTTP proxies, local and remote
 //! port forwards, agent forwarding and SFTP. A port of internal/sshclient + sftpclient.

rust/core/src/clients/telnet.rs

@@ -1,3 +1,6 @@
+// SPDX-License-Identifier: AGPL-3.0-only
+// Copyright (C) 2026 Andy Dixon
+
 //! Telnet client (port of Go `internal/telnetclient`): RFC 854/855 option negotiation (ECHO, SGA,
 //! TTYPE, NAWS; everything else refused), IAC escaping, line-ending conversion, ISO 8859-1 output
 //! encoding and BRK. Go read but never acted on `lineMode`, and neither do we.

rust/core/src/clients/vnc.rs

@@ -1,3 +1,6 @@
+// SPDX-License-Identifier: AGPL-3.0-only
+// Copyright (C) 2026 Andy Dixon
+
 //! Native VNC (RFB 3.3/3.7/3.8) client: None and VNC Authentication, Raw, CopyRect, Hextile, ZRLE
 //! and Tight (zlib + JPEG), plus the DesktopSize, ExtendedDesktopSize and LastRect pseudo-encodings.
 //!

rust/core/src/config.rs

@@ -1,3 +1,6 @@
+// SPDX-License-Identifier: AGPL-3.0-only
+// Copyright (C) 2026 Andy Dixon
+
 //! Data directories.
 
 use std::path::{Path, PathBuf};

rust/core/src/exportimport.rs

@@ -1,3 +1,6 @@
+// SPDX-License-Identifier: AGPL-3.0-only
+// Copyright (C) 2026 Andy Dixon
+
 //! Password-encrypted profile exports: `[version 1][salt 32][nonce 12][AES-256-GCM ciphertext]`
 //! over a JSON bundle, with the vault's Argon2id parameters.
 

rust/core/src/ircformat.rs

@@ -1,3 +1,6 @@
+// SPDX-License-Identifier: AGPL-3.0-only
+// Copyright (C) 2026 Andy Dixon
+
 //! mIRC formatting (^B ^] ^^ ^_ ^V ^Q ^O ^C fg,bg ^D hex) to styled spans, the nick colour hash
 //! and the IRC event line layout. Ported from the Wails frontend's `irc.js`.
 //!

rust/core/src/keyfiles.rs

@@ -1,3 +1,6 @@
+// SPDX-License-Identifier: AGPL-3.0-only
+// Copyright (C) 2026 Andy Dixon
+
 //! SSH key file helpers that need no SSH crypto: spotting private keys, listing `~/.ssh`, and
 //! sanitising key and upload file names.
 

rust/core/src/known_hosts.rs

@@ -1,3 +1,6 @@
+// SPDX-License-Identifier: AGPL-3.0-only
+// Copyright (C) 2026 Andy Dixon
+
 //! OpenSSH `known_hosts` interchange and SSH certificate authorities.
 //!
 //! Imported host keys become ordinary known-host rows. `@cert-authority` lines become rows with

rust/core/src/lib.rs

@@ -1,3 +1,6 @@
+// SPDX-License-Identifier: AGPL-3.0-only
+// Copyright (C) 2026 Andy Dixon
+
 //! nexus-core: everything in Nexus Terminal that isn't drawing — storage, secrets, protocol
 //! clients and the session manager. The egui app is one client of this crate.
 

rust/core/src/models.rs

@@ -1,3 +1,6 @@
+// SPDX-License-Identifier: AGPL-3.0-only
+// Copyright (C) 2026 Andy Dixon
+
 //! Data model shared by storage, the session manager and the UI. Field names are the JSON keys
 //! used in the database's config columns and in `.nexus` exports.
 

rust/core/src/recording.rs

@@ -1,3 +1,6 @@
+// SPDX-License-Identifier: AGPL-3.0-only
+// Copyright (C) 2026 Andy Dixon
+
 //! Session recording in asciicast v2 (https://docs.asciinema.org/manual/asciicast/v2/): a JSON
 //! header line, then one `[elapsed_secs, type, data]` array per line. Same files as the Go app.
 

rust/core/src/secrets.rs

@@ -1,3 +1,6 @@
+// SPDX-License-Identifier: AGPL-3.0-only
+// Copyright (C) 2026 Andy Dixon
+
 //! Credential storage: the OS keychain first, then an Argon2id + AES-256-GCM vault file that is
 //! byte-compatible with the Go app's `vault/vault.json`.
 

rust/core/src/service.rs

@@ -1,3 +1,6 @@
+// SPDX-License-Identifier: AGPL-3.0-only
+// Copyright (C) 2026 Andy Dixon
+
 //! The app-facing API (a port of internal/api.Service minus the Wails plumbing): profiles,
 //! sessions, credentials, known hosts, preferences, snippets, import/export, SSH keys, updates.
 //! File dialogs live in the UI; methods here take paths.

rust/core/src/sessions/credentials.rs

@@ -1,3 +1,6 @@
+// SPDX-License-Identifier: AGPL-3.0-only
+// Copyright (C) 2026 Andy Dixon
+
 //! Credential resolution (saved, session-only, ask-every-time), prompts and host-key checks.
 
 use super::*;

rust/core/src/sessions/extras.rs

@@ -1,3 +1,6 @@
+// SPDX-License-Identifier: AGPL-3.0-only
+// Copyright (C) 2026 Andy Dixon
+
 //! Accessors and actions specific to one protocol (RAW, IRC, GitHub, desktops, SSH).
 
 use super::*;

rust/core/src/sessions/local.rs

@@ -1,3 +1,6 @@
+// SPDX-License-Identifier: AGPL-3.0-only
+// Copyright (C) 2026 Andy Dixon
+
 //! Local shells and login scripts.
 
 use super::*;

rust/core/src/sessions/mod.rs

@@ -1,3 +1,6 @@
+// SPDX-License-Identifier: AGPL-3.0-only
+// Copyright (C) 2026 Andy Dixon
+
 //! The session manager: one entry per open tab, each owning a protocol client. A port of
 //! internal/sessions — same lifecycle, reconnect backoff, login scripts, recording hooks and
 //! credential resolution — reporting to the UI through `Event`s.

rust/core/src/sessions/protocols.rs

@@ -1,3 +1,6 @@
+// SPDX-License-Identifier: AGPL-3.0-only
+// Copyright (C) 2026 Andy Dixon
+
 //! Per-protocol connect: SSH, GitHub, IRC, VNC and RDP, and the SSH tunnels they can use.
 
 use super::*;

rust/core/src/sshconfig.rs

@@ -1,3 +1,6 @@
+// SPDX-License-Identifier: AGPL-3.0-only
+// Copyright (C) 2026 Andy Dixon
+
 //! Parses OpenSSH `~/.ssh/config` Host blocks into SSH profiles. Supports HostName, Port, User,
 //! IdentityFile, ProxyJump (first hop), ForwardAgent and Compression. Match blocks, wildcard-only
 //! hosts, Include and `%h`-style tokens are ignored, as in the Go app.

rust/core/src/storage.rs

@@ -1,3 +1,6 @@
+// SPDX-License-Identifier: AGPL-3.0-only
+// Copyright (C) 2026 Andy Dixon
+
 //! SQLite persistence: profiles, known hosts, preferences, audit log, snippets and IRC channel
 //! state. The schema and migration files are the Go app's, so existing databases open unchanged.
 

rust/core/src/sync.rs

@@ -1,3 +1,6 @@
+// SPDX-License-Identifier: AGPL-3.0-only
+// Copyright (C) 2026 Andy Dixon
+
 //! Profile sync through a folder the user picks (a cloud drive, a network share, a git checkout):
 //! one encrypted file, `nexus-profiles.nexus`, in the export format (Argon2id + AES-256-GCM) under
 //! a sync password. Each side merges profile by profile — the newer `updated_at` wins — and

rust/core/src/terminalenv.rs

@@ -1,3 +1,6 @@
+// SPDX-License-Identifier: AGPL-3.0-only
+// Copyright (C) 2026 Andy Dixon
+
 //! Environment variables for terminal sessions: TERM and a UTF-8 character locale.
 
 use std::collections::BTreeMap;

rust/core/src/updater.rs

@@ -1,3 +1,6 @@
+// SPDX-License-Identifier: AGPL-3.0-only
+// Copyright (C) 2026 Andy Dixon
+
 //! Update checks against a self-hosted manifest. Check-only: nothing is downloaded or installed.
 //! The launch-time check honours `AppPreferences::check_for_updates`. Calls block; run them off
 //! the UI thread.

rust/core/src/validation.rs

@@ -1,3 +1,6 @@
+// SPDX-License-Identifier: AGPL-3.0-only
+// Copyright (C) 2026 Andy Dixon
+
 //! Field-level validation of profiles and their protocol configs. Enum-typed fields (secret modes,
 //! host-key policy, line endings, forward direction, protocol) can't hold invalid values in Rust,
 //! so the Go checks for those are enforced by the types instead.

rust/core/tests/sessions.rs

@@ -1,3 +1,6 @@
+// SPDX-License-Identifier: AGPL-3.0-only
+// Copyright (C) 2026 Andy Dixon
+
 //! Session manager end to end: events, writes, host-key prompts, auto-reconnect.
 
 use nexus_core::models::{Profile, Protocol, SessionState};

rust/core/tests/ssh_integration.rs

@@ -1,3 +1,6 @@
+// SPDX-License-Identifier: AGPL-3.0-only
+// Copyright (C) 2026 Andy Dixon
+
 //! End-to-end SSH tests against a throwaway OpenSSH server run as the current user. Skipped
 //! (passing) when `sshd`/`ssh-keygen` aren't installed.
 

rust/core/tests/sync.rs

@@ -1,3 +1,6 @@
+// SPDX-License-Identifier: AGPL-3.0-only
+// Copyright (C) 2026 Andy Dixon
+
 //! Profile sync between two "machines" (data directories) sharing one folder.
 
 use nexus_core::config::AppConfig;