@arthai/agents 1.0.8 → 1.0.10

package/README.md

@@ -5,18 +5,22 @@ AI development toolkit for Claude Code — agents, skills, and hooks organized i
 ## Quick Start
 
 ```bash
-# 1. Activate your license (one time)
+# 1. Get a license key (email productive@getarth.ai)
+
+# 2. Activate your license (one time)
 npx @arthai/agents activate ARTH-XXXX-XXXX-XXXX-XXXX
 
-# 2. Install a bundle into your project
+# 3. Install a bundle into your project
 npx @arthai/agents install forge .
 
-# 3. Open Claude Code — skills are ready
+# 4. Open Claude Code — skills are ready
 /calibrate                  # auto-configure for your codebase
 /planning my-feature        # start building
 ```
 
-Don't have a key? Contact us at arthai.dev/pricing
+Don't have a key? Email **productive@getarth.ai** to get one.
+
+Already have the toolkit cloned at `~/.claude-agents/`? You don't need to activate — your existing key works automatically.
 
 ## Explore Before Installing
 
@@ -185,11 +189,35 @@ npx @arthai/agents@latest install forge .
 # Remove a specific bundle
 npx @arthai/agents uninstall forge .
 
-# Remove everything
-rm -rf .claude/skills .claude/agents .claude/hooks
+# Remove all bundles at once
+npx @arthai/agents uninstall prime .
 ```
 
-Note: hooks merged into `.claude/settings.json` need to be removed manually. Open the file and delete entries referencing `.claude/hooks/`.
+This removes skills and agents (63 files for prime). To fully clean up including hooks:
+
+```bash
+# 1. Remove hook scripts
+rm -rf .claude/hooks
+
+# 2. Remove hook entries from settings.json
+python3 -c "
+import json
+with open('.claude/settings.json') as f: s = json.load(f)
+s.pop('hooks', None)
+with open('.claude/settings.json', 'w') as f: json.dump(s, f, indent=2)
+"
+```
+
+**What uninstall removes vs keeps:**
+
+| Removed | Kept (never deleted) |
+|---------|------|
+| `.claude/skills/` | `CLAUDE.md` (your project context) |
+| `.claude/agents/` | `.claude/project-profile.md` (calibration data) |
+| | `.claude/knowledge/` (project knowledge base) |
+| | `.claude/settings.json` (hook entries — clean manually) |
+| | `.claude/hooks/` (script files — `rm -rf` manually) |
+| | `~/.arthai/license` (license key — per-machine) |
 
 ## License Activation
 
@@ -245,4 +273,4 @@ npx @arthai/agents activate ARTH-XXXX-XXXX-XXXX-XXXX
 
 - [Claude Code CLI](https://docs.anthropic.com/en/docs/claude-code)
 - Node.js 18+
-- License key (get one at arthai.dev/pricing)
+- License key (get one at productive@getarth.ai)

package/VERSION

@@ -1 +1 @@
-1.0.8
+1.0.10

package/bin/cli.js

@@ -107,7 +107,7 @@ function handleInstall(rawArgs) {
   const licenseKey = readLicenseKey(rawArgs);
   if (!licenseKey) {
     console.error('License required. Run: npx @arthai/agents activate ARTH-XXXX-XXXX-XXXX-XXXX');
-    console.error('Get a license at arthai.dev/pricing');
+    console.error('Get a license at productive@getarth.ai');
     process.exit(1);
   }
   const licenseResult = validateWithWorker(licenseKey);
@@ -116,7 +116,7 @@ function handleInstall(rawArgs) {
       console.error('License server unavailable. Cannot install without a validated license.');
       console.error('Check your internet connection and try again.');
     } else {
-      console.error('Invalid license key. Check your key or get one at arthai.dev/pricing');
+      console.error('Invalid license key. Check your key or get one at productive@getarth.ai');
     }
     process.exit(1);
   }
@@ -273,7 +273,7 @@ function handleActivate(key) {
   if (!result.valid) {
     const reason = result.reason === 'revoked'
       ? 'This license key has been revoked.'
-      : 'Invalid license key. Check your key or get one at arthai.dev/pricing';
+      : 'Invalid license key. Check your key or get one at productive@getarth.ai';
     console.error(`Activation failed: ${reason}`);
     process.exit(1);
   }

package/dist/plugins/canvas/.claude-plugin/plugin.json

@@ -1,7 +1,7 @@
 {
   "name": "canvas",
   "description": "Design-driven development — adversarial design critique + frontend",
-  "version": "1.0.8",
+  "version": "1.0.10",
   "author": {
     "name": "Arth AI"
   }

package/dist/plugins/canvas/VERSION

@@ -1 +1 @@
-1.0.8
+1.0.10

package/dist/plugins/canvas/hooks/project-setup.sh

@@ -45,6 +45,72 @@ if [ -f "$MARKER_FILE" ]; then
     fi
 fi
 
+# ---------------------------------------------------------------------------
+# License validation (marketplace gate)
+# ---------------------------------------------------------------------------
+# Check key: ARTHAI_LICENSE_KEY env → ~/.claude-agents/.license → ~/.arthai/license
+WORKER_URL="https://license-worker.muddassar-shaikh.workers.dev"
+KEY_FORMAT='^ARTH-[A-Z0-9]{4}-[A-Z0-9]{4}-[A-Z0-9]{4}-[A-Z0-9]{4}$'
+LICENSE_CACHE="$PROJECT_DIR/.claude/.license-validated"
+CACHE_TTL=86400
+
+REAL_HOME=$(eval echo ~"$(id -un)")
+LICENSE_KEY="${ARTHAI_LICENSE_KEY:-}"
+[ -z "$LICENSE_KEY" ] && [ -f "$REAL_HOME/.claude-agents/.license" ] && LICENSE_KEY=$(cat "$REAL_HOME/.claude-agents/.license" 2>/dev/null | tr -d '[:space:]')
+[ -z "$LICENSE_KEY" ] && [ -f "$REAL_HOME/.arthai/license" ] && LICENSE_KEY=$(cat "$REAL_HOME/.arthai/license" 2>/dev/null | tr -d '[:space:]')
+
+if [ -z "$LICENSE_KEY" ]; then
+    echo "LICENSE REQUIRED — No license key found for marketplace plugin."
+    echo "Run: npx @arthai/agents activate ARTH-XXXX-XXXX-XXXX-XXXX"
+    echo "Get a key: productive@getarth.ai"
+    exit 0
+fi
+
+# Validate format
+if ! echo "$LICENSE_KEY" | grep -qE "$KEY_FORMAT"; then
+    echo "LICENSE INVALID — Key format incorrect."
+    exit 0
+fi
+
+# Check cache (24h TTL)
+LICENSE_VALID=false
+NOW=$(date +%s)
+if [ -f "$LICENSE_CACHE" ]; then
+    CACHED_TIME=$(cat "$LICENSE_CACHE" 2>/dev/null | tr -d '[:space:]' || echo "0")
+    ELAPSED=$((NOW - CACHED_TIME))
+    if [ "$ELAPSED" -ge 0 ] && [ "$ELAPSED" -lt "$CACHE_TTL" ]; then
+        LICENSE_VALID=true
+    fi
+fi
+
+if ! $LICENSE_VALID; then
+    # Call Worker — same logic as sync-agents.sh
+    PAYLOAD=$(printf '{"key":"%s"}' "$LICENSE_KEY")
+    RESPONSE=$(printf '%s' "$PAYLOAD" | curl -sf -m 5 -X POST "$WORKER_URL/validate" \
+        -H "Content-Type: application/json" --data "@-" 2>/dev/null) || RESPONSE=""
+
+    if [ -n "$RESPONSE" ]; then
+        VALID=$(echo "$RESPONSE" | python3 -c "import json,sys; print(json.load(sys.stdin).get('valid',False))" 2>/dev/null) || VALID="False"
+        if [ "$VALID" = "True" ]; then
+            LICENSE_VALID=true
+            mkdir -p "$PROJECT_DIR/.claude"
+            echo "$NOW" > "$LICENSE_CACHE"
+        else
+            # Definitive invalid — no fallback
+            echo "LICENSE INVALID — Key not recognized."
+            echo "Check your key or get one at productive@getarth.ai"
+            exit 0
+        fi
+    else
+        # Network error — allow gracefully (don't block on Worker outage)
+        LICENSE_VALID=true
+    fi
+fi
+
+# ---------------------------------------------------------------------------
+# Project setup (only runs if license is valid)
+# ---------------------------------------------------------------------------
+
 CLAUDE_MD="$PROJECT_DIR/CLAUDE.md"
 GITIGNORE="$PROJECT_DIR/.gitignore"
 

package/dist/plugins/compass/.claude-plugin/plugin.json

@@ -1,7 +1,7 @@
 {
   "name": "compass",
   "description": "Product strategy — PM, GTM, user research, content strategy",
-  "version": "1.0.8",
+  "version": "1.0.10",
   "author": {
     "name": "Arth AI"
   }

package/dist/plugins/compass/VERSION

@@ -1 +1 @@
-1.0.8
+1.0.10

package/dist/plugins/compass/hooks/project-setup.sh

@@ -45,6 +45,72 @@ if [ -f "$MARKER_FILE" ]; then
     fi
 fi
 
+# ---------------------------------------------------------------------------
+# License validation (marketplace gate)
+# ---------------------------------------------------------------------------
+# Check key: ARTHAI_LICENSE_KEY env → ~/.claude-agents/.license → ~/.arthai/license
+WORKER_URL="https://license-worker.muddassar-shaikh.workers.dev"
+KEY_FORMAT='^ARTH-[A-Z0-9]{4}-[A-Z0-9]{4}-[A-Z0-9]{4}-[A-Z0-9]{4}$'
+LICENSE_CACHE="$PROJECT_DIR/.claude/.license-validated"
+CACHE_TTL=86400
+
+REAL_HOME=$(eval echo ~"$(id -un)")
+LICENSE_KEY="${ARTHAI_LICENSE_KEY:-}"
+[ -z "$LICENSE_KEY" ] && [ -f "$REAL_HOME/.claude-agents/.license" ] && LICENSE_KEY=$(cat "$REAL_HOME/.claude-agents/.license" 2>/dev/null | tr -d '[:space:]')
+[ -z "$LICENSE_KEY" ] && [ -f "$REAL_HOME/.arthai/license" ] && LICENSE_KEY=$(cat "$REAL_HOME/.arthai/license" 2>/dev/null | tr -d '[:space:]')
+
+if [ -z "$LICENSE_KEY" ]; then
+    echo "LICENSE REQUIRED — No license key found for marketplace plugin."
+    echo "Run: npx @arthai/agents activate ARTH-XXXX-XXXX-XXXX-XXXX"
+    echo "Get a key: productive@getarth.ai"
+    exit 0
+fi
+
+# Validate format
+if ! echo "$LICENSE_KEY" | grep -qE "$KEY_FORMAT"; then
+    echo "LICENSE INVALID — Key format incorrect."
+    exit 0
+fi
+
+# Check cache (24h TTL)
+LICENSE_VALID=false
+NOW=$(date +%s)
+if [ -f "$LICENSE_CACHE" ]; then
+    CACHED_TIME=$(cat "$LICENSE_CACHE" 2>/dev/null | tr -d '[:space:]' || echo "0")
+    ELAPSED=$((NOW - CACHED_TIME))
+    if [ "$ELAPSED" -ge 0 ] && [ "$ELAPSED" -lt "$CACHE_TTL" ]; then
+        LICENSE_VALID=true
+    fi
+fi
+
+if ! $LICENSE_VALID; then
+    # Call Worker — same logic as sync-agents.sh
+    PAYLOAD=$(printf '{"key":"%s"}' "$LICENSE_KEY")
+    RESPONSE=$(printf '%s' "$PAYLOAD" | curl -sf -m 5 -X POST "$WORKER_URL/validate" \
+        -H "Content-Type: application/json" --data "@-" 2>/dev/null) || RESPONSE=""
+
+    if [ -n "$RESPONSE" ]; then
+        VALID=$(echo "$RESPONSE" | python3 -c "import json,sys; print(json.load(sys.stdin).get('valid',False))" 2>/dev/null) || VALID="False"
+        if [ "$VALID" = "True" ]; then
+            LICENSE_VALID=true
+            mkdir -p "$PROJECT_DIR/.claude"
+            echo "$NOW" > "$LICENSE_CACHE"
+        else
+            # Definitive invalid — no fallback
+            echo "LICENSE INVALID — Key not recognized."
+            echo "Check your key or get one at productive@getarth.ai"
+            exit 0
+        fi
+    else
+        # Network error — allow gracefully (don't block on Worker outage)
+        LICENSE_VALID=true
+    fi
+fi
+
+# ---------------------------------------------------------------------------
+# Project setup (only runs if license is valid)
+# ---------------------------------------------------------------------------
+
 CLAUDE_MD="$PROJECT_DIR/CLAUDE.md"
 GITIGNORE="$PROJECT_DIR/.gitignore"
 

package/dist/plugins/counsel/.claude-plugin/plugin.json

@@ -1,7 +1,7 @@
 {
   "name": "counsel",
   "description": "AI consulting toolkit — client discovery, proposals, deliverables",
-  "version": "1.0.8",
+  "version": "1.0.10",
   "author": {
     "name": "Arth AI"
   }

package/dist/plugins/counsel/VERSION

@@ -1 +1 @@
-1.0.8
+1.0.10

package/dist/plugins/counsel/hooks/project-setup.sh

@@ -45,6 +45,72 @@ if [ -f "$MARKER_FILE" ]; then
     fi
 fi
 
+# ---------------------------------------------------------------------------
+# License validation (marketplace gate)
+# ---------------------------------------------------------------------------
+# Check key: ARTHAI_LICENSE_KEY env → ~/.claude-agents/.license → ~/.arthai/license
+WORKER_URL="https://license-worker.muddassar-shaikh.workers.dev"
+KEY_FORMAT='^ARTH-[A-Z0-9]{4}-[A-Z0-9]{4}-[A-Z0-9]{4}-[A-Z0-9]{4}$'
+LICENSE_CACHE="$PROJECT_DIR/.claude/.license-validated"
+CACHE_TTL=86400
+
+REAL_HOME=$(eval echo ~"$(id -un)")
+LICENSE_KEY="${ARTHAI_LICENSE_KEY:-}"
+[ -z "$LICENSE_KEY" ] && [ -f "$REAL_HOME/.claude-agents/.license" ] && LICENSE_KEY=$(cat "$REAL_HOME/.claude-agents/.license" 2>/dev/null | tr -d '[:space:]')
+[ -z "$LICENSE_KEY" ] && [ -f "$REAL_HOME/.arthai/license" ] && LICENSE_KEY=$(cat "$REAL_HOME/.arthai/license" 2>/dev/null | tr -d '[:space:]')
+
+if [ -z "$LICENSE_KEY" ]; then
+    echo "LICENSE REQUIRED — No license key found for marketplace plugin."
+    echo "Run: npx @arthai/agents activate ARTH-XXXX-XXXX-XXXX-XXXX"
+    echo "Get a key: productive@getarth.ai"
+    exit 0
+fi
+
+# Validate format
+if ! echo "$LICENSE_KEY" | grep -qE "$KEY_FORMAT"; then
+    echo "LICENSE INVALID — Key format incorrect."
+    exit 0
+fi
+
+# Check cache (24h TTL)
+LICENSE_VALID=false
+NOW=$(date +%s)
+if [ -f "$LICENSE_CACHE" ]; then
+    CACHED_TIME=$(cat "$LICENSE_CACHE" 2>/dev/null | tr -d '[:space:]' || echo "0")
+    ELAPSED=$((NOW - CACHED_TIME))
+    if [ "$ELAPSED" -ge 0 ] && [ "$ELAPSED" -lt "$CACHE_TTL" ]; then
+        LICENSE_VALID=true
+    fi
+fi
+
+if ! $LICENSE_VALID; then
+    # Call Worker — same logic as sync-agents.sh
+    PAYLOAD=$(printf '{"key":"%s"}' "$LICENSE_KEY")
+    RESPONSE=$(printf '%s' "$PAYLOAD" | curl -sf -m 5 -X POST "$WORKER_URL/validate" \
+        -H "Content-Type: application/json" --data "@-" 2>/dev/null) || RESPONSE=""
+
+    if [ -n "$RESPONSE" ]; then
+        VALID=$(echo "$RESPONSE" | python3 -c "import json,sys; print(json.load(sys.stdin).get('valid',False))" 2>/dev/null) || VALID="False"
+        if [ "$VALID" = "True" ]; then
+            LICENSE_VALID=true
+            mkdir -p "$PROJECT_DIR/.claude"
+            echo "$NOW" > "$LICENSE_CACHE"
+        else
+            # Definitive invalid — no fallback
+            echo "LICENSE INVALID — Key not recognized."
+            echo "Check your key or get one at productive@getarth.ai"
+            exit 0
+        fi
+    else
+        # Network error — allow gracefully (don't block on Worker outage)
+        LICENSE_VALID=true
+    fi
+fi
+
+# ---------------------------------------------------------------------------
+# Project setup (only runs if license is valid)
+# ---------------------------------------------------------------------------
+
 CLAUDE_MD="$PROJECT_DIR/CLAUDE.md"
 GITIGNORE="$PROJECT_DIR/.gitignore"
 

package/dist/plugins/cruise/.claude-plugin/plugin.json

@@ -1,7 +1,7 @@
 {
   "name": "cruise",
   "description": "Autopilot mode — autonomous task execution (requires forge+scalpel+sentinel)",
-  "version": "1.0.8",
+  "version": "1.0.10",
   "author": {
     "name": "Arth AI"
   }

package/dist/plugins/cruise/VERSION

@@ -1 +1 @@
-1.0.8
+1.0.10

package/dist/plugins/cruise/hooks/project-setup.sh

@@ -45,6 +45,72 @@ if [ -f "$MARKER_FILE" ]; then
     fi
 fi
 
+# ---------------------------------------------------------------------------
+# License validation (marketplace gate)
+# ---------------------------------------------------------------------------
+# Check key: ARTHAI_LICENSE_KEY env → ~/.claude-agents/.license → ~/.arthai/license
+WORKER_URL="https://license-worker.muddassar-shaikh.workers.dev"
+KEY_FORMAT='^ARTH-[A-Z0-9]{4}-[A-Z0-9]{4}-[A-Z0-9]{4}-[A-Z0-9]{4}$'
+LICENSE_CACHE="$PROJECT_DIR/.claude/.license-validated"
+CACHE_TTL=86400
+
+REAL_HOME=$(eval echo ~"$(id -un)")
+LICENSE_KEY="${ARTHAI_LICENSE_KEY:-}"
+[ -z "$LICENSE_KEY" ] && [ -f "$REAL_HOME/.claude-agents/.license" ] && LICENSE_KEY=$(cat "$REAL_HOME/.claude-agents/.license" 2>/dev/null | tr -d '[:space:]')
+[ -z "$LICENSE_KEY" ] && [ -f "$REAL_HOME/.arthai/license" ] && LICENSE_KEY=$(cat "$REAL_HOME/.arthai/license" 2>/dev/null | tr -d '[:space:]')
+
+if [ -z "$LICENSE_KEY" ]; then
+    echo "LICENSE REQUIRED — No license key found for marketplace plugin."
+    echo "Run: npx @arthai/agents activate ARTH-XXXX-XXXX-XXXX-XXXX"
+    echo "Get a key: productive@getarth.ai"
+    exit 0
+fi
+
+# Validate format
+if ! echo "$LICENSE_KEY" | grep -qE "$KEY_FORMAT"; then
+    echo "LICENSE INVALID — Key format incorrect."
+    exit 0
+fi
+
+# Check cache (24h TTL)
+LICENSE_VALID=false
+NOW=$(date +%s)
+if [ -f "$LICENSE_CACHE" ]; then
+    CACHED_TIME=$(cat "$LICENSE_CACHE" 2>/dev/null | tr -d '[:space:]' || echo "0")
+    ELAPSED=$((NOW - CACHED_TIME))
+    if [ "$ELAPSED" -ge 0 ] && [ "$ELAPSED" -lt "$CACHE_TTL" ]; then
+        LICENSE_VALID=true
+    fi
+fi
+
+if ! $LICENSE_VALID; then
+    # Call Worker — same logic as sync-agents.sh
+    PAYLOAD=$(printf '{"key":"%s"}' "$LICENSE_KEY")
+    RESPONSE=$(printf '%s' "$PAYLOAD" | curl -sf -m 5 -X POST "$WORKER_URL/validate" \
+        -H "Content-Type: application/json" --data "@-" 2>/dev/null) || RESPONSE=""
+
+    if [ -n "$RESPONSE" ]; then
+        VALID=$(echo "$RESPONSE" | python3 -c "import json,sys; print(json.load(sys.stdin).get('valid',False))" 2>/dev/null) || VALID="False"
+        if [ "$VALID" = "True" ]; then
+            LICENSE_VALID=true
+            mkdir -p "$PROJECT_DIR/.claude"
+            echo "$NOW" > "$LICENSE_CACHE"
+        else
+            # Definitive invalid — no fallback
+            echo "LICENSE INVALID — Key not recognized."
+            echo "Check your key or get one at productive@getarth.ai"
+            exit 0
+        fi
+    else
+        # Network error — allow gracefully (don't block on Worker outage)
+        LICENSE_VALID=true
+    fi
+fi
+
+# ---------------------------------------------------------------------------
+# Project setup (only runs if license is valid)
+# ---------------------------------------------------------------------------
+
 CLAUDE_MD="$PROJECT_DIR/CLAUDE.md"
 GITIGNORE="$PROJECT_DIR/.gitignore"
 

package/dist/plugins/forge/.claude-plugin/plugin.json

@@ -1,7 +1,7 @@
 {
   "name": "forge",
   "description": "Full development workflow — plan, build, test, ship",
-  "version": "1.0.8",
+  "version": "1.0.10",
   "author": {
     "name": "Arth AI"
   }

package/dist/plugins/forge/VERSION

@@ -1 +1 @@
-1.0.8
+1.0.10

package/dist/plugins/forge/hooks/project-setup.sh

@@ -45,6 +45,72 @@ if [ -f "$MARKER_FILE" ]; then
     fi
 fi
 
+# ---------------------------------------------------------------------------
+# License validation (marketplace gate)
+# ---------------------------------------------------------------------------
+# Check key: ARTHAI_LICENSE_KEY env → ~/.claude-agents/.license → ~/.arthai/license
+WORKER_URL="https://license-worker.muddassar-shaikh.workers.dev"
+KEY_FORMAT='^ARTH-[A-Z0-9]{4}-[A-Z0-9]{4}-[A-Z0-9]{4}-[A-Z0-9]{4}$'
+LICENSE_CACHE="$PROJECT_DIR/.claude/.license-validated"
+CACHE_TTL=86400
+
+REAL_HOME=$(eval echo ~"$(id -un)")
+LICENSE_KEY="${ARTHAI_LICENSE_KEY:-}"
+[ -z "$LICENSE_KEY" ] && [ -f "$REAL_HOME/.claude-agents/.license" ] && LICENSE_KEY=$(cat "$REAL_HOME/.claude-agents/.license" 2>/dev/null | tr -d '[:space:]')
+[ -z "$LICENSE_KEY" ] && [ -f "$REAL_HOME/.arthai/license" ] && LICENSE_KEY=$(cat "$REAL_HOME/.arthai/license" 2>/dev/null | tr -d '[:space:]')
+
+if [ -z "$LICENSE_KEY" ]; then
+    echo "LICENSE REQUIRED — No license key found for marketplace plugin."
+    echo "Run: npx @arthai/agents activate ARTH-XXXX-XXXX-XXXX-XXXX"
+    echo "Get a key: productive@getarth.ai"
+    exit 0
+fi
+
+# Validate format
+if ! echo "$LICENSE_KEY" | grep -qE "$KEY_FORMAT"; then
+    echo "LICENSE INVALID — Key format incorrect."
+    exit 0
+fi
+
+# Check cache (24h TTL)
+LICENSE_VALID=false
+NOW=$(date +%s)
+if [ -f "$LICENSE_CACHE" ]; then
+    CACHED_TIME=$(cat "$LICENSE_CACHE" 2>/dev/null | tr -d '[:space:]' || echo "0")
+    ELAPSED=$((NOW - CACHED_TIME))
+    if [ "$ELAPSED" -ge 0 ] && [ "$ELAPSED" -lt "$CACHE_TTL" ]; then
+        LICENSE_VALID=true
+    fi
+fi
+
+if ! $LICENSE_VALID; then
+    # Call Worker — same logic as sync-agents.sh
+    PAYLOAD=$(printf '{"key":"%s"}' "$LICENSE_KEY")
+    RESPONSE=$(printf '%s' "$PAYLOAD" | curl -sf -m 5 -X POST "$WORKER_URL/validate" \
+        -H "Content-Type: application/json" --data "@-" 2>/dev/null) || RESPONSE=""
+
+    if [ -n "$RESPONSE" ]; then
+        VALID=$(echo "$RESPONSE" | python3 -c "import json,sys; print(json.load(sys.stdin).get('valid',False))" 2>/dev/null) || VALID="False"
+        if [ "$VALID" = "True" ]; then
+            LICENSE_VALID=true
+            mkdir -p "$PROJECT_DIR/.claude"
+            echo "$NOW" > "$LICENSE_CACHE"
+        else
+            # Definitive invalid — no fallback
+            echo "LICENSE INVALID — Key not recognized."
+            echo "Check your key or get one at productive@getarth.ai"
+            exit 0
+        fi
+    else
+        # Network error — allow gracefully (don't block on Worker outage)
+        LICENSE_VALID=true
+    fi
+fi
+
+# ---------------------------------------------------------------------------
+# Project setup (only runs if license is valid)
+# ---------------------------------------------------------------------------
+
 CLAUDE_MD="$PROJECT_DIR/CLAUDE.md"
 GITIGNORE="$PROJECT_DIR/.gitignore"
 

package/dist/plugins/prime/.claude-plugin/plugin.json

@@ -1,7 +1,7 @@
 {
   "name": "prime",
   "description": "Everything — all agents, skills, and hooks in one plugin",
-  "version": "1.0.8",
+  "version": "1.0.10",
   "author": {
     "name": "Arth AI"
   }

package/dist/plugins/prime/VERSION

@@ -1 +1 @@
-1.0.8
+1.0.10

package/dist/plugins/prime/hooks/project-setup.sh

@@ -45,6 +45,72 @@ if [ -f "$MARKER_FILE" ]; then
     fi
 fi
 
+# ---------------------------------------------------------------------------
+# License validation (marketplace gate)
+# ---------------------------------------------------------------------------
+# Check key: ARTHAI_LICENSE_KEY env → ~/.claude-agents/.license → ~/.arthai/license
+WORKER_URL="https://license-worker.muddassar-shaikh.workers.dev"
+KEY_FORMAT='^ARTH-[A-Z0-9]{4}-[A-Z0-9]{4}-[A-Z0-9]{4}-[A-Z0-9]{4}$'
+LICENSE_CACHE="$PROJECT_DIR/.claude/.license-validated"
+CACHE_TTL=86400
+
+REAL_HOME=$(eval echo ~"$(id -un)")
+LICENSE_KEY="${ARTHAI_LICENSE_KEY:-}"
+[ -z "$LICENSE_KEY" ] && [ -f "$REAL_HOME/.claude-agents/.license" ] && LICENSE_KEY=$(cat "$REAL_HOME/.claude-agents/.license" 2>/dev/null | tr -d '[:space:]')
+[ -z "$LICENSE_KEY" ] && [ -f "$REAL_HOME/.arthai/license" ] && LICENSE_KEY=$(cat "$REAL_HOME/.arthai/license" 2>/dev/null | tr -d '[:space:]')
+
+if [ -z "$LICENSE_KEY" ]; then
+    echo "LICENSE REQUIRED — No license key found for marketplace plugin."
+    echo "Run: npx @arthai/agents activate ARTH-XXXX-XXXX-XXXX-XXXX"
+    echo "Get a key: productive@getarth.ai"
+    exit 0
+fi
+
+# Validate format
+if ! echo "$LICENSE_KEY" | grep -qE "$KEY_FORMAT"; then
+    echo "LICENSE INVALID — Key format incorrect."
+    exit 0
+fi
+
+# Check cache (24h TTL)
+LICENSE_VALID=false
+NOW=$(date +%s)
+if [ -f "$LICENSE_CACHE" ]; then
+    CACHED_TIME=$(cat "$LICENSE_CACHE" 2>/dev/null | tr -d '[:space:]' || echo "0")
+    ELAPSED=$((NOW - CACHED_TIME))
+    if [ "$ELAPSED" -ge 0 ] && [ "$ELAPSED" -lt "$CACHE_TTL" ]; then
+        LICENSE_VALID=true
+    fi
+fi
+
+if ! $LICENSE_VALID; then
+    # Call Worker — same logic as sync-agents.sh
+    PAYLOAD=$(printf '{"key":"%s"}' "$LICENSE_KEY")
+    RESPONSE=$(printf '%s' "$PAYLOAD" | curl -sf -m 5 -X POST "$WORKER_URL/validate" \
+        -H "Content-Type: application/json" --data "@-" 2>/dev/null) || RESPONSE=""
+
+    if [ -n "$RESPONSE" ]; then
+        VALID=$(echo "$RESPONSE" | python3 -c "import json,sys; print(json.load(sys.stdin).get('valid',False))" 2>/dev/null) || VALID="False"
+        if [ "$VALID" = "True" ]; then
+            LICENSE_VALID=true
+            mkdir -p "$PROJECT_DIR/.claude"
+            echo "$NOW" > "$LICENSE_CACHE"
+        else
+            # Definitive invalid — no fallback
+            echo "LICENSE INVALID — Key not recognized."
+            echo "Check your key or get one at productive@getarth.ai"
+            exit 0
+        fi
+    else
+        # Network error — allow gracefully (don't block on Worker outage)
+        LICENSE_VALID=true
+    fi
+fi
+
+# ---------------------------------------------------------------------------
+# Project setup (only runs if license is valid)
+# ---------------------------------------------------------------------------
+
 CLAUDE_MD="$PROJECT_DIR/CLAUDE.md"
 GITIGNORE="$PROJECT_DIR/.gitignore"
 

package/dist/plugins/prime/hooks/sync-agents.sh

@@ -306,7 +306,7 @@ if ! $LICENSE_VALID; then
     fi
 
     echo "Invalid license key. Toolkit has been disabled for this project."
-    echo "  Check your key or get one at arthai.dev/pricing"
+    echo "  Check your key or get one at productive@getarth.ai"
     exit 0
 fi
 

package/dist/plugins/prism/.claude-plugin/plugin.json

@@ -1,7 +1,7 @@
 {
   "name": "prism",
   "description": "Deep QA — multi-agent testing, baseline tracking, incident analysis",
-  "version": "1.0.8",
+  "version": "1.0.10",
   "author": {
     "name": "Arth AI"
   }

package/dist/plugins/prism/VERSION

@@ -1 +1 @@
-1.0.8
+1.0.10

package/dist/plugins/prism/hooks/project-setup.sh

@@ -45,6 +45,72 @@ if [ -f "$MARKER_FILE" ]; then
     fi
 fi
 
+# ---------------------------------------------------------------------------
+# License validation (marketplace gate)
+# ---------------------------------------------------------------------------
+# Check key: ARTHAI_LICENSE_KEY env → ~/.claude-agents/.license → ~/.arthai/license
+WORKER_URL="https://license-worker.muddassar-shaikh.workers.dev"
+KEY_FORMAT='^ARTH-[A-Z0-9]{4}-[A-Z0-9]{4}-[A-Z0-9]{4}-[A-Z0-9]{4}$'
+LICENSE_CACHE="$PROJECT_DIR/.claude/.license-validated"
+CACHE_TTL=86400
+
+REAL_HOME=$(eval echo ~"$(id -un)")
+LICENSE_KEY="${ARTHAI_LICENSE_KEY:-}"
+[ -z "$LICENSE_KEY" ] && [ -f "$REAL_HOME/.claude-agents/.license" ] && LICENSE_KEY=$(cat "$REAL_HOME/.claude-agents/.license" 2>/dev/null | tr -d '[:space:]')
+[ -z "$LICENSE_KEY" ] && [ -f "$REAL_HOME/.arthai/license" ] && LICENSE_KEY=$(cat "$REAL_HOME/.arthai/license" 2>/dev/null | tr -d '[:space:]')
+
+if [ -z "$LICENSE_KEY" ]; then
+    echo "LICENSE REQUIRED — No license key found for marketplace plugin."
+    echo "Run: npx @arthai/agents activate ARTH-XXXX-XXXX-XXXX-XXXX"
+    echo "Get a key: productive@getarth.ai"
+    exit 0
+fi
+
+# Validate format
+if ! echo "$LICENSE_KEY" | grep -qE "$KEY_FORMAT"; then
+    echo "LICENSE INVALID — Key format incorrect."
+    exit 0
+fi
+
+# Check cache (24h TTL)
+LICENSE_VALID=false
+NOW=$(date +%s)
+if [ -f "$LICENSE_CACHE" ]; then
+    CACHED_TIME=$(cat "$LICENSE_CACHE" 2>/dev/null | tr -d '[:space:]' || echo "0")
+    ELAPSED=$((NOW - CACHED_TIME))
+    if [ "$ELAPSED" -ge 0 ] && [ "$ELAPSED" -lt "$CACHE_TTL" ]; then
+        LICENSE_VALID=true
+    fi
+fi
+
+if ! $LICENSE_VALID; then
+    # Call Worker — same logic as sync-agents.sh
+    PAYLOAD=$(printf '{"key":"%s"}' "$LICENSE_KEY")
+    RESPONSE=$(printf '%s' "$PAYLOAD" | curl -sf -m 5 -X POST "$WORKER_URL/validate" \
+        -H "Content-Type: application/json" --data "@-" 2>/dev/null) || RESPONSE=""
+
+    if [ -n "$RESPONSE" ]; then
+        VALID=$(echo "$RESPONSE" | python3 -c "import json,sys; print(json.load(sys.stdin).get('valid',False))" 2>/dev/null) || VALID="False"
+        if [ "$VALID" = "True" ]; then
+            LICENSE_VALID=true
+            mkdir -p "$PROJECT_DIR/.claude"
+            echo "$NOW" > "$LICENSE_CACHE"
+        else
+            # Definitive invalid — no fallback
+            echo "LICENSE INVALID — Key not recognized."
+            echo "Check your key or get one at productive@getarth.ai"
+            exit 0
+        fi
+    else
+        # Network error — allow gracefully (don't block on Worker outage)
+        LICENSE_VALID=true
+    fi
+fi
+
+# ---------------------------------------------------------------------------
+# Project setup (only runs if license is valid)
+# ---------------------------------------------------------------------------
+
 CLAUDE_MD="$PROJECT_DIR/CLAUDE.md"
 GITIGNORE="$PROJECT_DIR/.gitignore"
 

package/dist/plugins/scalpel/.claude-plugin/plugin.json

@@ -1,7 +1,7 @@
 {
   "name": "scalpel",
   "description": "Surgical bug fixing — targeted fixes, CI repair, issue triage",
-  "version": "1.0.8",
+  "version": "1.0.10",
   "author": {
     "name": "Arth AI"
   }

package/dist/plugins/scalpel/VERSION

@@ -1 +1 @@
-1.0.8
+1.0.10

package/dist/plugins/scalpel/hooks/project-setup.sh

@@ -45,6 +45,72 @@ if [ -f "$MARKER_FILE" ]; then
     fi
 fi
 
+# ---------------------------------------------------------------------------
+# License validation (marketplace gate)
+# ---------------------------------------------------------------------------
+# Check key: ARTHAI_LICENSE_KEY env → ~/.claude-agents/.license → ~/.arthai/license
+WORKER_URL="https://license-worker.muddassar-shaikh.workers.dev"
+KEY_FORMAT='^ARTH-[A-Z0-9]{4}-[A-Z0-9]{4}-[A-Z0-9]{4}-[A-Z0-9]{4}$'
+LICENSE_CACHE="$PROJECT_DIR/.claude/.license-validated"
+CACHE_TTL=86400
+
+REAL_HOME=$(eval echo ~"$(id -un)")
+LICENSE_KEY="${ARTHAI_LICENSE_KEY:-}"
+[ -z "$LICENSE_KEY" ] && [ -f "$REAL_HOME/.claude-agents/.license" ] && LICENSE_KEY=$(cat "$REAL_HOME/.claude-agents/.license" 2>/dev/null | tr -d '[:space:]')
+[ -z "$LICENSE_KEY" ] && [ -f "$REAL_HOME/.arthai/license" ] && LICENSE_KEY=$(cat "$REAL_HOME/.arthai/license" 2>/dev/null | tr -d '[:space:]')
+
+if [ -z "$LICENSE_KEY" ]; then
+    echo "LICENSE REQUIRED — No license key found for marketplace plugin."
+    echo "Run: npx @arthai/agents activate ARTH-XXXX-XXXX-XXXX-XXXX"
+    echo "Get a key: productive@getarth.ai"
+    exit 0
+fi
+
+# Validate format
+if ! echo "$LICENSE_KEY" | grep -qE "$KEY_FORMAT"; then
+    echo "LICENSE INVALID — Key format incorrect."
+    exit 0
+fi
+
+# Check cache (24h TTL)
+LICENSE_VALID=false
+NOW=$(date +%s)
+if [ -f "$LICENSE_CACHE" ]; then
+    CACHED_TIME=$(cat "$LICENSE_CACHE" 2>/dev/null | tr -d '[:space:]' || echo "0")
+    ELAPSED=$((NOW - CACHED_TIME))
+    if [ "$ELAPSED" -ge 0 ] && [ "$ELAPSED" -lt "$CACHE_TTL" ]; then
+        LICENSE_VALID=true
+    fi
+fi
+
+if ! $LICENSE_VALID; then
+    # Call Worker — same logic as sync-agents.sh
+    PAYLOAD=$(printf '{"key":"%s"}' "$LICENSE_KEY")
+    RESPONSE=$(printf '%s' "$PAYLOAD" | curl -sf -m 5 -X POST "$WORKER_URL/validate" \
+        -H "Content-Type: application/json" --data "@-" 2>/dev/null) || RESPONSE=""
+
+    if [ -n "$RESPONSE" ]; then
+        VALID=$(echo "$RESPONSE" | python3 -c "import json,sys; print(json.load(sys.stdin).get('valid',False))" 2>/dev/null) || VALID="False"
+        if [ "$VALID" = "True" ]; then
+            LICENSE_VALID=true
+            mkdir -p "$PROJECT_DIR/.claude"
+            echo "$NOW" > "$LICENSE_CACHE"
+        else
+            # Definitive invalid — no fallback
+            echo "LICENSE INVALID — Key not recognized."
+            echo "Check your key or get one at productive@getarth.ai"
+            exit 0
+        fi
+    else
+        # Network error — allow gracefully (don't block on Worker outage)
+        LICENSE_VALID=true
+    fi
+fi
+
+# ---------------------------------------------------------------------------
+# Project setup (only runs if license is valid)
+# ---------------------------------------------------------------------------
+
 CLAUDE_MD="$PROJECT_DIR/CLAUDE.md"
 GITIGNORE="$PROJECT_DIR/.gitignore"
 

package/dist/plugins/sentinel/.claude-plugin/plugin.json

@@ -1,7 +1,7 @@
 {
   "name": "sentinel",
   "description": "Operations and reliability — SRE, incidents, deploy monitoring",
-  "version": "1.0.8",
+  "version": "1.0.10",
   "author": {
     "name": "Arth AI"
   }

package/dist/plugins/sentinel/VERSION

@@ -1 +1 @@
-1.0.8
+1.0.10

package/dist/plugins/sentinel/hooks/project-setup.sh

@@ -45,6 +45,72 @@ if [ -f "$MARKER_FILE" ]; then
     fi
 fi
 
+# ---------------------------------------------------------------------------
+# License validation (marketplace gate)
+# ---------------------------------------------------------------------------
+# Check key: ARTHAI_LICENSE_KEY env → ~/.claude-agents/.license → ~/.arthai/license
+WORKER_URL="https://license-worker.muddassar-shaikh.workers.dev"
+KEY_FORMAT='^ARTH-[A-Z0-9]{4}-[A-Z0-9]{4}-[A-Z0-9]{4}-[A-Z0-9]{4}$'
+LICENSE_CACHE="$PROJECT_DIR/.claude/.license-validated"
+CACHE_TTL=86400
+
+REAL_HOME=$(eval echo ~"$(id -un)")
+LICENSE_KEY="${ARTHAI_LICENSE_KEY:-}"
+[ -z "$LICENSE_KEY" ] && [ -f "$REAL_HOME/.claude-agents/.license" ] && LICENSE_KEY=$(cat "$REAL_HOME/.claude-agents/.license" 2>/dev/null | tr -d '[:space:]')
+[ -z "$LICENSE_KEY" ] && [ -f "$REAL_HOME/.arthai/license" ] && LICENSE_KEY=$(cat "$REAL_HOME/.arthai/license" 2>/dev/null | tr -d '[:space:]')
+
+if [ -z "$LICENSE_KEY" ]; then
+    echo "LICENSE REQUIRED — No license key found for marketplace plugin."
+    echo "Run: npx @arthai/agents activate ARTH-XXXX-XXXX-XXXX-XXXX"
+    echo "Get a key: productive@getarth.ai"
+    exit 0
+fi
+
+# Validate format
+if ! echo "$LICENSE_KEY" | grep -qE "$KEY_FORMAT"; then
+    echo "LICENSE INVALID — Key format incorrect."
+    exit 0
+fi
+
+# Check cache (24h TTL)
+LICENSE_VALID=false
+NOW=$(date +%s)
+if [ -f "$LICENSE_CACHE" ]; then
+    CACHED_TIME=$(cat "$LICENSE_CACHE" 2>/dev/null | tr -d '[:space:]' || echo "0")
+    ELAPSED=$((NOW - CACHED_TIME))
+    if [ "$ELAPSED" -ge 0 ] && [ "$ELAPSED" -lt "$CACHE_TTL" ]; then
+        LICENSE_VALID=true
+    fi
+fi
+
+if ! $LICENSE_VALID; then
+    # Call Worker — same logic as sync-agents.sh
+    PAYLOAD=$(printf '{"key":"%s"}' "$LICENSE_KEY")
+    RESPONSE=$(printf '%s' "$PAYLOAD" | curl -sf -m 5 -X POST "$WORKER_URL/validate" \
+        -H "Content-Type: application/json" --data "@-" 2>/dev/null) || RESPONSE=""
+
+    if [ -n "$RESPONSE" ]; then
+        VALID=$(echo "$RESPONSE" | python3 -c "import json,sys; print(json.load(sys.stdin).get('valid',False))" 2>/dev/null) || VALID="False"
+        if [ "$VALID" = "True" ]; then
+            LICENSE_VALID=true
+            mkdir -p "$PROJECT_DIR/.claude"
+            echo "$NOW" > "$LICENSE_CACHE"
+        else
+            # Definitive invalid — no fallback
+            echo "LICENSE INVALID — Key not recognized."
+            echo "Check your key or get one at productive@getarth.ai"
+            exit 0
+        fi
+    else
+        # Network error — allow gracefully (don't block on Worker outage)
+        LICENSE_VALID=true
+    fi
+fi
+
+# ---------------------------------------------------------------------------
+# Project setup (only runs if license is valid)
+# ---------------------------------------------------------------------------
+
 CLAUDE_MD="$PROJECT_DIR/CLAUDE.md"
 GITIGNORE="$PROJECT_DIR/.gitignore"
 

package/dist/plugins/shield/.claude-plugin/plugin.json

@@ -1,7 +1,7 @@
 {
   "name": "shield",
   "description": "Safety guardrails — bash guards, edit protection, session bootstrap",
-  "version": "1.0.8",
+  "version": "1.0.10",
   "author": {
     "name": "Arth AI"
   }

package/dist/plugins/shield/VERSION

@@ -1 +1 @@
-1.0.8
+1.0.10

package/dist/plugins/shield/hooks/project-setup.sh

@@ -45,6 +45,72 @@ if [ -f "$MARKER_FILE" ]; then
     fi
 fi
 
+# ---------------------------------------------------------------------------
+# License validation (marketplace gate)
+# ---------------------------------------------------------------------------
+# Check key: ARTHAI_LICENSE_KEY env → ~/.claude-agents/.license → ~/.arthai/license
+WORKER_URL="https://license-worker.muddassar-shaikh.workers.dev"
+KEY_FORMAT='^ARTH-[A-Z0-9]{4}-[A-Z0-9]{4}-[A-Z0-9]{4}-[A-Z0-9]{4}$'
+LICENSE_CACHE="$PROJECT_DIR/.claude/.license-validated"
+CACHE_TTL=86400
+
+REAL_HOME=$(eval echo ~"$(id -un)")
+LICENSE_KEY="${ARTHAI_LICENSE_KEY:-}"
+[ -z "$LICENSE_KEY" ] && [ -f "$REAL_HOME/.claude-agents/.license" ] && LICENSE_KEY=$(cat "$REAL_HOME/.claude-agents/.license" 2>/dev/null | tr -d '[:space:]')
+[ -z "$LICENSE_KEY" ] && [ -f "$REAL_HOME/.arthai/license" ] && LICENSE_KEY=$(cat "$REAL_HOME/.arthai/license" 2>/dev/null | tr -d '[:space:]')
+
+if [ -z "$LICENSE_KEY" ]; then
+    echo "LICENSE REQUIRED — No license key found for marketplace plugin."
+    echo "Run: npx @arthai/agents activate ARTH-XXXX-XXXX-XXXX-XXXX"
+    echo "Get a key: productive@getarth.ai"
+    exit 0
+fi
+
+# Validate format
+if ! echo "$LICENSE_KEY" | grep -qE "$KEY_FORMAT"; then
+    echo "LICENSE INVALID — Key format incorrect."
+    exit 0
+fi
+
+# Check cache (24h TTL)
+LICENSE_VALID=false
+NOW=$(date +%s)
+if [ -f "$LICENSE_CACHE" ]; then
+    CACHED_TIME=$(cat "$LICENSE_CACHE" 2>/dev/null | tr -d '[:space:]' || echo "0")
+    ELAPSED=$((NOW - CACHED_TIME))
+    if [ "$ELAPSED" -ge 0 ] && [ "$ELAPSED" -lt "$CACHE_TTL" ]; then
+        LICENSE_VALID=true
+    fi
+fi
+
+if ! $LICENSE_VALID; then
+    # Call Worker — same logic as sync-agents.sh
+    PAYLOAD=$(printf '{"key":"%s"}' "$LICENSE_KEY")
+    RESPONSE=$(printf '%s' "$PAYLOAD" | curl -sf -m 5 -X POST "$WORKER_URL/validate" \
+        -H "Content-Type: application/json" --data "@-" 2>/dev/null) || RESPONSE=""
+
+    if [ -n "$RESPONSE" ]; then
+        VALID=$(echo "$RESPONSE" | python3 -c "import json,sys; print(json.load(sys.stdin).get('valid',False))" 2>/dev/null) || VALID="False"
+        if [ "$VALID" = "True" ]; then
+            LICENSE_VALID=true
+            mkdir -p "$PROJECT_DIR/.claude"
+            echo "$NOW" > "$LICENSE_CACHE"
+        else
+            # Definitive invalid — no fallback
+            echo "LICENSE INVALID — Key not recognized."
+            echo "Check your key or get one at productive@getarth.ai"
+            exit 0
+        fi
+    else
+        # Network error — allow gracefully (don't block on Worker outage)
+        LICENSE_VALID=true
+    fi
+fi
+
+# ---------------------------------------------------------------------------
+# Project setup (only runs if license is valid)
+# ---------------------------------------------------------------------------
+
 CLAUDE_MD="$PROJECT_DIR/CLAUDE.md"
 GITIGNORE="$PROJECT_DIR/.gitignore"
 

package/dist/plugins/spark/.claude-plugin/plugin.json

@@ -1,7 +1,7 @@
 {
   "name": "spark",
   "description": "Project setup and onboarding — calibrate, scan, bootstrap",
-  "version": "1.0.8",
+  "version": "1.0.10",
   "author": {
     "name": "Arth AI"
   }

package/dist/plugins/spark/VERSION

@@ -1 +1 @@
-1.0.8
+1.0.10

package/dist/plugins/spark/hooks/project-setup.sh

@@ -45,6 +45,72 @@ if [ -f "$MARKER_FILE" ]; then
     fi
 fi
 
+# ---------------------------------------------------------------------------
+# License validation (marketplace gate)
+# ---------------------------------------------------------------------------
+# Check key: ARTHAI_LICENSE_KEY env → ~/.claude-agents/.license → ~/.arthai/license
+WORKER_URL="https://license-worker.muddassar-shaikh.workers.dev"
+KEY_FORMAT='^ARTH-[A-Z0-9]{4}-[A-Z0-9]{4}-[A-Z0-9]{4}-[A-Z0-9]{4}$'
+LICENSE_CACHE="$PROJECT_DIR/.claude/.license-validated"
+CACHE_TTL=86400
+
+REAL_HOME=$(eval echo ~"$(id -un)")
+LICENSE_KEY="${ARTHAI_LICENSE_KEY:-}"
+[ -z "$LICENSE_KEY" ] && [ -f "$REAL_HOME/.claude-agents/.license" ] && LICENSE_KEY=$(cat "$REAL_HOME/.claude-agents/.license" 2>/dev/null | tr -d '[:space:]')
+[ -z "$LICENSE_KEY" ] && [ -f "$REAL_HOME/.arthai/license" ] && LICENSE_KEY=$(cat "$REAL_HOME/.arthai/license" 2>/dev/null | tr -d '[:space:]')
+
+if [ -z "$LICENSE_KEY" ]; then
+    echo "LICENSE REQUIRED — No license key found for marketplace plugin."
+    echo "Run: npx @arthai/agents activate ARTH-XXXX-XXXX-XXXX-XXXX"
+    echo "Get a key: productive@getarth.ai"
+    exit 0
+fi
+
+# Validate format
+if ! echo "$LICENSE_KEY" | grep -qE "$KEY_FORMAT"; then
+    echo "LICENSE INVALID — Key format incorrect."
+    exit 0
+fi
+
+# Check cache (24h TTL)
+LICENSE_VALID=false
+NOW=$(date +%s)
+if [ -f "$LICENSE_CACHE" ]; then
+    CACHED_TIME=$(cat "$LICENSE_CACHE" 2>/dev/null | tr -d '[:space:]' || echo "0")
+    ELAPSED=$((NOW - CACHED_TIME))
+    if [ "$ELAPSED" -ge 0 ] && [ "$ELAPSED" -lt "$CACHE_TTL" ]; then
+        LICENSE_VALID=true
+    fi
+fi
+
+if ! $LICENSE_VALID; then
+    # Call Worker — same logic as sync-agents.sh
+    PAYLOAD=$(printf '{"key":"%s"}' "$LICENSE_KEY")
+    RESPONSE=$(printf '%s' "$PAYLOAD" | curl -sf -m 5 -X POST "$WORKER_URL/validate" \
+        -H "Content-Type: application/json" --data "@-" 2>/dev/null) || RESPONSE=""
+
+    if [ -n "$RESPONSE" ]; then
+        VALID=$(echo "$RESPONSE" | python3 -c "import json,sys; print(json.load(sys.stdin).get('valid',False))" 2>/dev/null) || VALID="False"
+        if [ "$VALID" = "True" ]; then
+            LICENSE_VALID=true
+            mkdir -p "$PROJECT_DIR/.claude"
+            echo "$NOW" > "$LICENSE_CACHE"
+        else
+            # Definitive invalid — no fallback
+            echo "LICENSE INVALID — Key not recognized."
+            echo "Check your key or get one at productive@getarth.ai"
+            exit 0
+        fi
+    else
+        # Network error — allow gracefully (don't block on Worker outage)
+        LICENSE_VALID=true
+    fi
+fi
+
+# ---------------------------------------------------------------------------
+# Project setup (only runs if license is valid)
+# ---------------------------------------------------------------------------
+
 CLAUDE_MD="$PROJECT_DIR/CLAUDE.md"
 GITIGNORE="$PROJECT_DIR/.gitignore"
 

package/hooks/project-setup.sh

@@ -45,6 +45,72 @@ if [ -f "$MARKER_FILE" ]; then
     fi
 fi
 
+# ---------------------------------------------------------------------------
+# License validation (marketplace gate)
+# ---------------------------------------------------------------------------
+# Check key: ARTHAI_LICENSE_KEY env → ~/.claude-agents/.license → ~/.arthai/license
+WORKER_URL="https://license-worker.muddassar-shaikh.workers.dev"
+KEY_FORMAT='^ARTH-[A-Z0-9]{4}-[A-Z0-9]{4}-[A-Z0-9]{4}-[A-Z0-9]{4}$'
+LICENSE_CACHE="$PROJECT_DIR/.claude/.license-validated"
+CACHE_TTL=86400
+
+REAL_HOME=$(eval echo ~"$(id -un)")
+LICENSE_KEY="${ARTHAI_LICENSE_KEY:-}"
+[ -z "$LICENSE_KEY" ] && [ -f "$REAL_HOME/.claude-agents/.license" ] && LICENSE_KEY=$(cat "$REAL_HOME/.claude-agents/.license" 2>/dev/null | tr -d '[:space:]')
+[ -z "$LICENSE_KEY" ] && [ -f "$REAL_HOME/.arthai/license" ] && LICENSE_KEY=$(cat "$REAL_HOME/.arthai/license" 2>/dev/null | tr -d '[:space:]')
+
+if [ -z "$LICENSE_KEY" ]; then
+    echo "LICENSE REQUIRED — No license key found for marketplace plugin."
+    echo "Run: npx @arthai/agents activate ARTH-XXXX-XXXX-XXXX-XXXX"
+    echo "Get a key: productive@getarth.ai"
+    exit 0
+fi
+
+# Validate format
+if ! echo "$LICENSE_KEY" | grep -qE "$KEY_FORMAT"; then
+    echo "LICENSE INVALID — Key format incorrect."
+    exit 0
+fi
+
+# Check cache (24h TTL)
+LICENSE_VALID=false
+NOW=$(date +%s)
+if [ -f "$LICENSE_CACHE" ]; then
+    CACHED_TIME=$(cat "$LICENSE_CACHE" 2>/dev/null | tr -d '[:space:]' || echo "0")
+    ELAPSED=$((NOW - CACHED_TIME))
+    if [ "$ELAPSED" -ge 0 ] && [ "$ELAPSED" -lt "$CACHE_TTL" ]; then
+        LICENSE_VALID=true
+    fi
+fi
+
+if ! $LICENSE_VALID; then
+    # Call Worker — same logic as sync-agents.sh
+    PAYLOAD=$(printf '{"key":"%s"}' "$LICENSE_KEY")
+    RESPONSE=$(printf '%s' "$PAYLOAD" | curl -sf -m 5 -X POST "$WORKER_URL/validate" \
+        -H "Content-Type: application/json" --data "@-" 2>/dev/null) || RESPONSE=""
+
+    if [ -n "$RESPONSE" ]; then
+        VALID=$(echo "$RESPONSE" | python3 -c "import json,sys; print(json.load(sys.stdin).get('valid',False))" 2>/dev/null) || VALID="False"
+        if [ "$VALID" = "True" ]; then
+            LICENSE_VALID=true
+            mkdir -p "$PROJECT_DIR/.claude"
+            echo "$NOW" > "$LICENSE_CACHE"
+        else
+            # Definitive invalid — no fallback
+            echo "LICENSE INVALID — Key not recognized."
+            echo "Check your key or get one at productive@getarth.ai"
+            exit 0
+        fi
+    else
+        # Network error — allow gracefully (don't block on Worker outage)
+        LICENSE_VALID=true
+    fi
+fi
+
+# ---------------------------------------------------------------------------
+# Project setup (only runs if license is valid)
+# ---------------------------------------------------------------------------
+
 CLAUDE_MD="$PROJECT_DIR/CLAUDE.md"
 GITIGNORE="$PROJECT_DIR/.gitignore"
 

package/hooks/sync-agents.sh

@@ -306,7 +306,7 @@ if ! $LICENSE_VALID; then
     fi
 
     echo "Invalid license key. Toolkit has been disabled for this project."
-    echo "  Check your key or get one at arthai.dev/pricing"
+    echo "  Check your key or get one at productive@getarth.ai"
     exit 0
 fi
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@arthai/agents",
-  "version": "1.0.8",
+  "version": "1.0.10",
   "description": "AI-powered development toolkit for Claude Code — agents, skills, and hooks",
   "bin": {
     "arthai": "bin/cli.js"

package/skills/license/SKILL.md

@@ -128,7 +128,7 @@ Returns:
 NEW USER ONBOARDING:
   1. User finds toolkit (npm, marketplace, docs)
   2. User tries: npx @arthai/agents install forge .
-     → "License required. Get a key at arthai.dev/pricing"
+     → "License required. Get a key at productive@getarth.ai"
   3. User contacts you
   4. You run: /license issue customer-name
   5. You send them the key