Contributing

The canonical version of this lives in CONTRIBUTING.md in the repository. This page is the short form.

Ground rules CI enforces

• packages/agent may never import packages/proxy. The only path from agent to tools is the network call. An ESLint no-restricted-imports rule and a grep-level CI job enforce this; pull requests that route around either will not merge, regardless of how convenient it is.
• MIT/Apache-2.0 dependencies only in the core. The license gate fails the build on copyleft. Per GOVERNANCE.md, AGPL/SSPL and commercially-licensed packages are excluded; the latter are allowed only as optional, user-installed adapters.
• packages/proxy requires CODEOWNERS review. The proxy is the security boundary; changes there get extra scrutiny by design.
• Privileged workflows must not check out code. Any pull_request_target workflow containing an actions/checkout step fails CI.
• TypeScript strict, lint, and tests must pass.

CLA

A Contributor License Agreement (Apache-style) is required from your first pull request; a bot will prompt you in CI. The rationale is documented in GOVERNANCE.md — it is short, and it was written before you asked.

What the project most needs

The roadmap is phase-gated, and the priority is the governed core: vault, team-sheet enforcement, approval broker, budget meter, audit log, and the e2e security suite that attacks them. Features that outpace the proxy will be politely parked.

Development

pnpm install
pnpm -r build
pnpm -r test

Node 22+, pnpm 9+. The e2e harness — mock Slack plus a mock MCP server — lands in e2e/ with phase 1.

The packageManager field pins pnpm 9.15.0. On Node 22–24, corepack enable reads that field and provisions it. Corepack was removed from Node in v25, so on newer runtimes install the pinned version directly:

npm install -g pnpm@9.15.0

This site

The site lives in site/ and is deliberately outside the pnpm workspace, so Astro’s dependency tree stays out of the core license gate and the root pnpm -r scripts.

cd site
pnpm install
pnpm dev

It reads design/tokens.css and design/libero.css directly rather than vendoring copies. The design spec is locked: do not introduce a colour, font, radius, or component shape that is not already in it.