Cialai
Copyright 2026 ORDINUM INOVACAO E TECNOLOGIA LTDA

Licensed under the Apache License, Version 2.0. See LICENSE.

Phase 0 dependency inventory:

- Tailscale / tsnet: BSD-3-Clause
  https://github.com/tailscale/tailscale/blob/v1.102.0/LICENSE
- Headscale: BSD-3-Clause, used as a separate Docker test service
  https://github.com/juanfont/headscale/blob/v0.29.3/LICENSE
- Pion mDNS v2.2.0: MIT, announces the desktop on the local network in the
  tunnel core
  https://github.com/pion/mdns/blob/v2.2.0/LICENSE
- Pion logging v0.2.4: MIT, required by Pion mDNS
  https://github.com/pion/logging/blob/v0.2.4/LICENSE

Tor Expert Bundle 15.0.22, packaged with the desktop app as separate programs
in $RESOURCE/tor by tools/fetch-tor.mjs; the upstream license texts ship in
$RESOURCE/tor/docs:

- Tor 0.4.9.12: BSD-3-Clause source license; this build reports that it is
  covered by the GNU General Public License version 3
  https://gitlab.torproject.org/tpo/core/tor/-/blob/main/LICENSE
  https://www.gnu.org/licenses/gpl-3.0.html
- libevent 2.1: BSD-3-Clause, https://github.com/libevent/libevent/blob/master/LICENSE
- OpenSSL 3.5: Apache-2.0, https://github.com/openssl/openssl/blob/master/LICENSE.txt
- Build sources: https://gitlab.torproject.org/tpo/applications/tor-browser-build

Tor.framework 409.11.2, linked into the iOS app through the CocoaPods pod Tor to
run Tor in process; the pod downloads a prebuilt tor.xcframework checked by
SHA-256 at install time and nothing is committed to this repository:

- Tor.framework: MIT, Copyright (c) 2015-2026 The iCepa Contributors
  https://github.com/iCepa/Tor.framework/blob/v409.11.2/LICENSE
- Tor 0.4.9.11: BSD-3-Clause, built without --enable-gpl
  https://gitlab.torproject.org/tpo/core/tor/-/blob/main/LICENSE
- libevent 2.1.13: BSD-3-Clause, https://github.com/libevent/libevent/blob/master/LICENSE
- OpenSSL 3.6.3: Apache-2.0, https://github.com/openssl/openssl/blob/master/LICENSE.txt
- liblzma from XZ Utils 5.8.3: 0BSD, https://github.com/tukaani-project/xz/blob/master/COPYING

Tor for Android 0.4.9.11, packaged in the Android app by
apps/mobile/modules/cialai-tunnel as info.guardianproject:tor-android from
Maven Central. Its libtor.so is loaded into the app process through JNI, not
run as a separate program, so the GPL notice below needs a distribution review
before Android builds reach users. Only the arm64-v8a and x86_64 libraries are
packaged:

- tor-android 0.4.9.11: BSD-3-Clause according to its POM; Copyright 2009-2010
  Nathan Freitas, The Guardian Project; the repository LICENSE also carries the
  notices of the bundled components
  https://github.com/guardianproject/tor-android/blob/master/LICENSE
- Tor 0.4.9.11 inside libtor.so: BSD-3-Clause source license; this build
  reports that it is covered by the GNU General Public License version 3
  https://gitlab.torproject.org/tpo/core/tor/-/blob/main/LICENSE
  https://www.gnu.org/licenses/gpl-3.0.html
- libevent 2.1.12-stable inside libtor.so: BSD-3-Clause,
  https://github.com/libevent/libevent/blob/master/LICENSE
- OpenSSL 3.5.7 inside libtor.so: Apache-2.0,
  https://github.com/openssl/openssl/blob/master/LICENSE.txt
- zlib 1.3.2 inside libtor.so: Zlib, https://zlib.net/zlib_license.html
- zstd 1.5.7 inside libtor.so: BSD-3-Clause or GPL-2.0-only at the
  distributor's choice, https://github.com/facebook/zstd/blob/dev/LICENSE
- jtorctl 0.4.5.7, info.guardianproject:jtorctl: BSD-3-Clause according to its
  POM; Copyright 2005 Nick Mathewson, Roger Dingledine
  https://github.com/guardianproject/jtorctl/blob/master/LICENSE
- AndroidX LocalBroadcastManager 1.1.0, required by tor-android: Apache-2.0,
  https://developer.android.com/jetpack/androidx/releases/localbroadcastmanager

Provider glyphs bundled with the desktop interface, in
packages/ui/src/notch/glyphs with their own NOTICE.md, and copied unchanged
into the mobile app at apps/mobile/src/ui/agent-glyphs.ts:

- @lobehub/icons-static-svg 1.95.0: MIT, Copyright LobeHub; the Claude and
  OpenAI marks identify the provider of each profile in the AI bar and only
  say which product the usage belongs to
  https://github.com/lobehub/lobe-icons/blob/master/LICENSE

Outfit, the typeface of cialai.com.br, bundled with the mobile app in
apps/mobile/src/assets/fonts as static TTF files, weights 400 to 800, and with
the phone page in packages/ui/src/fonts as the variable WOFF2; the license text
ships next to the files as OFL.txt and OFL-Outfit.txt:

- Outfit 1.100: OFL-1.1, Copyright 2021 The Outfit Project Authors
  https://github.com/Outfitio/Outfit-Fonts

Planned dependencies, not yet bundled:

- xterm.js: MIT, https://github.com/xtermjs/xterm.js
- CodeMirror: MIT, https://github.com/codemirror/dev
- Tauri: Apache-2.0 OR MIT, https://github.com/tauri-apps/tauri
- React: MIT, https://github.com/facebook/react
- Expo: MIT, https://github.com/expo/expo
- JetBrains Mono: OFL-1.1, https://github.com/JetBrains/JetBrainsMono

This inventory does not replace upstream license texts. Before distributing
binaries, include the applicable copyright and license notices for all bundled
direct and transitive dependencies and fonts. No product binaries are distributed
at this stage.

Cialai Broto packages the same pinned Tor Expert Bundle as separate programs
in its tor directory. All Tor, libevent and OpenSSL notices and source references
above also apply to Broto. The payload includes LICENSE, NOTICE and the upstream
Tor bundle license texts. Its CycloneDX inventory covers Go modules; this notice
and the Tor bundle license texts cover the separately bundled native programs.

Broto installer and updater include aead.dev/minisign v0.3.0, MIT,
Copyright 2021 Andreas Auernhammer. The license text ships in
licenses/minisign-MIT.txt. https://github.com/aead/minisign/tree/v0.3.0
