@arthai/agents 1.0.9 → 1.0.10

package/VERSION

@@ -1 +1 @@
-1.0.9
+1.0.10

package/dist/plugins/canvas/.claude-plugin/plugin.json

@@ -1,7 +1,7 @@
 {
   "name": "canvas",
   "description": "Design-driven development — adversarial design critique + frontend",
-  "version": "1.0.9",
+  "version": "1.0.10",
   "author": {
     "name": "Arth AI"
   }

package/dist/plugins/canvas/VERSION

@@ -1 +1 @@
-1.0.9
+1.0.10

package/dist/plugins/canvas/hooks/project-setup.sh

@@ -45,6 +45,72 @@ if [ -f "$MARKER_FILE" ]; then
     fi
 fi
 
+# ---------------------------------------------------------------------------
+# License validation (marketplace gate)
+# ---------------------------------------------------------------------------
+# Check key: ARTHAI_LICENSE_KEY env → ~/.claude-agents/.license → ~/.arthai/license
+WORKER_URL="https://license-worker.muddassar-shaikh.workers.dev"
+KEY_FORMAT='^ARTH-[A-Z0-9]{4}-[A-Z0-9]{4}-[A-Z0-9]{4}-[A-Z0-9]{4}$'
+LICENSE_CACHE="$PROJECT_DIR/.claude/.license-validated"
+CACHE_TTL=86400
+
+REAL_HOME=$(eval echo ~"$(id -un)")
+LICENSE_KEY="${ARTHAI_LICENSE_KEY:-}"
+[ -z "$LICENSE_KEY" ] && [ -f "$REAL_HOME/.claude-agents/.license" ] && LICENSE_KEY=$(cat "$REAL_HOME/.claude-agents/.license" 2>/dev/null | tr -d '[:space:]')
+[ -z "$LICENSE_KEY" ] && [ -f "$REAL_HOME/.arthai/license" ] && LICENSE_KEY=$(cat "$REAL_HOME/.arthai/license" 2>/dev/null | tr -d '[:space:]')
+
+if [ -z "$LICENSE_KEY" ]; then
+    echo "LICENSE REQUIRED — No license key found for marketplace plugin."
+    echo "Run: npx @arthai/agents activate ARTH-XXXX-XXXX-XXXX-XXXX"
+    echo "Get a key: productive@getarth.ai"
+    exit 0
+fi
+
+# Validate format
+if ! echo "$LICENSE_KEY" | grep -qE "$KEY_FORMAT"; then
+    echo "LICENSE INVALID — Key format incorrect."
+    exit 0
+fi
+
+# Check cache (24h TTL)
+LICENSE_VALID=false
+NOW=$(date +%s)
+if [ -f "$LICENSE_CACHE" ]; then
+    CACHED_TIME=$(cat "$LICENSE_CACHE" 2>/dev/null | tr -d '[:space:]' || echo "0")
+    ELAPSED=$((NOW - CACHED_TIME))
+    if [ "$ELAPSED" -ge 0 ] && [ "$ELAPSED" -lt "$CACHE_TTL" ]; then
+        LICENSE_VALID=true
+    fi
+fi
+
+if ! $LICENSE_VALID; then
+    # Call Worker — same logic as sync-agents.sh
+    PAYLOAD=$(printf '{"key":"%s"}' "$LICENSE_KEY")
+    RESPONSE=$(printf '%s' "$PAYLOAD" | curl -sf -m 5 -X POST "$WORKER_URL/validate" \
+        -H "Content-Type: application/json" --data "@-" 2>/dev/null) || RESPONSE=""
+
+    if [ -n "$RESPONSE" ]; then
+        VALID=$(echo "$RESPONSE" | python3 -c "import json,sys; print(json.load(sys.stdin).get('valid',False))" 2>/dev/null) || VALID="False"
+        if [ "$VALID" = "True" ]; then
+            LICENSE_VALID=true
+            mkdir -p "$PROJECT_DIR/.claude"
+            echo "$NOW" > "$LICENSE_CACHE"
+        else
+            # Definitive invalid — no fallback
+            echo "LICENSE INVALID — Key not recognized."
+            echo "Check your key or get one at productive@getarth.ai"
+            exit 0
+        fi
+    else
+        # Network error — allow gracefully (don't block on Worker outage)
+        LICENSE_VALID=true
+    fi
+fi
+
+# ---------------------------------------------------------------------------
+# Project setup (only runs if license is valid)
+# ---------------------------------------------------------------------------
+
 CLAUDE_MD="$PROJECT_DIR/CLAUDE.md"
 GITIGNORE="$PROJECT_DIR/.gitignore"
 

package/dist/plugins/compass/.claude-plugin/plugin.json

@@ -1,7 +1,7 @@
 {
   "name": "compass",
   "description": "Product strategy — PM, GTM, user research, content strategy",
-  "version": "1.0.9",
+  "version": "1.0.10",
   "author": {
     "name": "Arth AI"
   }

package/dist/plugins/compass/VERSION

@@ -1 +1 @@
-1.0.9
+1.0.10

package/dist/plugins/compass/hooks/project-setup.sh

@@ -45,6 +45,72 @@ if [ -f "$MARKER_FILE" ]; then
     fi
 fi
 
+# ---------------------------------------------------------------------------
+# License validation (marketplace gate)
+# ---------------------------------------------------------------------------
+# Check key: ARTHAI_LICENSE_KEY env → ~/.claude-agents/.license → ~/.arthai/license
+WORKER_URL="https://license-worker.muddassar-shaikh.workers.dev"
+KEY_FORMAT='^ARTH-[A-Z0-9]{4}-[A-Z0-9]{4}-[A-Z0-9]{4}-[A-Z0-9]{4}$'
+LICENSE_CACHE="$PROJECT_DIR/.claude/.license-validated"
+CACHE_TTL=86400
+
+REAL_HOME=$(eval echo ~"$(id -un)")
+LICENSE_KEY="${ARTHAI_LICENSE_KEY:-}"
+[ -z "$LICENSE_KEY" ] && [ -f "$REAL_HOME/.claude-agents/.license" ] && LICENSE_KEY=$(cat "$REAL_HOME/.claude-agents/.license" 2>/dev/null | tr -d '[:space:]')
+[ -z "$LICENSE_KEY" ] && [ -f "$REAL_HOME/.arthai/license" ] && LICENSE_KEY=$(cat "$REAL_HOME/.arthai/license" 2>/dev/null | tr -d '[:space:]')
+
+if [ -z "$LICENSE_KEY" ]; then
+    echo "LICENSE REQUIRED — No license key found for marketplace plugin."
+    echo "Run: npx @arthai/agents activate ARTH-XXXX-XXXX-XXXX-XXXX"
+    echo "Get a key: productive@getarth.ai"
+    exit 0
+fi
+
+# Validate format
+if ! echo "$LICENSE_KEY" | grep -qE "$KEY_FORMAT"; then
+    echo "LICENSE INVALID — Key format incorrect."
+    exit 0
+fi
+
+# Check cache (24h TTL)
+LICENSE_VALID=false
+NOW=$(date +%s)
+if [ -f "$LICENSE_CACHE" ]; then
+    CACHED_TIME=$(cat "$LICENSE_CACHE" 2>/dev/null | tr -d '[:space:]' || echo "0")
+    ELAPSED=$((NOW - CACHED_TIME))
+    if [ "$ELAPSED" -ge 0 ] && [ "$ELAPSED" -lt "$CACHE_TTL" ]; then
+        LICENSE_VALID=true
+    fi
+fi
+
+if ! $LICENSE_VALID; then
+    # Call Worker — same logic as sync-agents.sh
+    PAYLOAD=$(printf '{"key":"%s"}' "$LICENSE_KEY")
+    RESPONSE=$(printf '%s' "$PAYLOAD" | curl -sf -m 5 -X POST "$WORKER_URL/validate" \
+        -H "Content-Type: application/json" --data "@-" 2>/dev/null) || RESPONSE=""
+
+    if [ -n "$RESPONSE" ]; then
+        VALID=$(echo "$RESPONSE" | python3 -c "import json,sys; print(json.load(sys.stdin).get('valid',False))" 2>/dev/null) || VALID="False"
+        if [ "$VALID" = "True" ]; then
+            LICENSE_VALID=true
+            mkdir -p "$PROJECT_DIR/.claude"
+            echo "$NOW" > "$LICENSE_CACHE"
+        else
+            # Definitive invalid — no fallback
+            echo "LICENSE INVALID — Key not recognized."
+            echo "Check your key or get one at productive@getarth.ai"
+            exit 0
+        fi
+    else
+        # Network error — allow gracefully (don't block on Worker outage)
+        LICENSE_VALID=true
+    fi
+fi
+
+# ---------------------------------------------------------------------------
+# Project setup (only runs if license is valid)
+# ---------------------------------------------------------------------------
+
 CLAUDE_MD="$PROJECT_DIR/CLAUDE.md"
 GITIGNORE="$PROJECT_DIR/.gitignore"
 

package/dist/plugins/counsel/.claude-plugin/plugin.json

@@ -1,7 +1,7 @@
 {
   "name": "counsel",
   "description": "AI consulting toolkit — client discovery, proposals, deliverables",
-  "version": "1.0.9",
+  "version": "1.0.10",
   "author": {
     "name": "Arth AI"
   }

package/dist/plugins/counsel/VERSION

@@ -1 +1 @@
-1.0.9
+1.0.10

package/dist/plugins/counsel/hooks/project-setup.sh

@@ -45,6 +45,72 @@ if [ -f "$MARKER_FILE" ]; then
     fi
 fi
 
+# ---------------------------------------------------------------------------
+# License validation (marketplace gate)
+# ---------------------------------------------------------------------------
+# Check key: ARTHAI_LICENSE_KEY env → ~/.claude-agents/.license → ~/.arthai/license
+WORKER_URL="https://license-worker.muddassar-shaikh.workers.dev"
+KEY_FORMAT='^ARTH-[A-Z0-9]{4}-[A-Z0-9]{4}-[A-Z0-9]{4}-[A-Z0-9]{4}$'
+LICENSE_CACHE="$PROJECT_DIR/.claude/.license-validated"
+CACHE_TTL=86400
+
+REAL_HOME=$(eval echo ~"$(id -un)")
+LICENSE_KEY="${ARTHAI_LICENSE_KEY:-}"
+[ -z "$LICENSE_KEY" ] && [ -f "$REAL_HOME/.claude-agents/.license" ] && LICENSE_KEY=$(cat "$REAL_HOME/.claude-agents/.license" 2>/dev/null | tr -d '[:space:]')
+[ -z "$LICENSE_KEY" ] && [ -f "$REAL_HOME/.arthai/license" ] && LICENSE_KEY=$(cat "$REAL_HOME/.arthai/license" 2>/dev/null | tr -d '[:space:]')
+
+if [ -z "$LICENSE_KEY" ]; then
+    echo "LICENSE REQUIRED — No license key found for marketplace plugin."
+    echo "Run: npx @arthai/agents activate ARTH-XXXX-XXXX-XXXX-XXXX"
+    echo "Get a key: productive@getarth.ai"
+    exit 0
+fi
+
+# Validate format
+if ! echo "$LICENSE_KEY" | grep -qE "$KEY_FORMAT"; then
+    echo "LICENSE INVALID — Key format incorrect."
+    exit 0
+fi
+
+# Check cache (24h TTL)
+LICENSE_VALID=false
+NOW=$(date +%s)
+if [ -f "$LICENSE_CACHE" ]; then
+    CACHED_TIME=$(cat "$LICENSE_CACHE" 2>/dev/null | tr -d '[:space:]' || echo "0")
+    ELAPSED=$((NOW - CACHED_TIME))
+    if [ "$ELAPSED" -ge 0 ] && [ "$ELAPSED" -lt "$CACHE_TTL" ]; then
+        LICENSE_VALID=true
+    fi
+fi
+
+if ! $LICENSE_VALID; then
+    # Call Worker — same logic as sync-agents.sh
+    PAYLOAD=$(printf '{"key":"%s"}' "$LICENSE_KEY")
+    RESPONSE=$(printf '%s' "$PAYLOAD" | curl -sf -m 5 -X POST "$WORKER_URL/validate" \
+        -H "Content-Type: application/json" --data "@-" 2>/dev/null) || RESPONSE=""
+
+    if [ -n "$RESPONSE" ]; then
+        VALID=$(echo "$RESPONSE" | python3 -c "import json,sys; print(json.load(sys.stdin).get('valid',False))" 2>/dev/null) || VALID="False"
+        if [ "$VALID" = "True" ]; then
+            LICENSE_VALID=true
+            mkdir -p "$PROJECT_DIR/.claude"
+            echo "$NOW" > "$LICENSE_CACHE"
+        else
+            # Definitive invalid — no fallback
+            echo "LICENSE INVALID — Key not recognized."
+            echo "Check your key or get one at productive@getarth.ai"
+            exit 0
+        fi
+    else
+        # Network error — allow gracefully (don't block on Worker outage)
+        LICENSE_VALID=true
+    fi
+fi
+
+# ---------------------------------------------------------------------------
+# Project setup (only runs if license is valid)
+# ---------------------------------------------------------------------------
+
 CLAUDE_MD="$PROJECT_DIR/CLAUDE.md"
 GITIGNORE="$PROJECT_DIR/.gitignore"
 

package/dist/plugins/cruise/.claude-plugin/plugin.json

@@ -1,7 +1,7 @@
 {
   "name": "cruise",
   "description": "Autopilot mode — autonomous task execution (requires forge+scalpel+sentinel)",
-  "version": "1.0.9",
+  "version": "1.0.10",
   "author": {
     "name": "Arth AI"
   }

package/dist/plugins/cruise/VERSION

@@ -1 +1 @@
-1.0.9
+1.0.10

package/dist/plugins/cruise/hooks/project-setup.sh

@@ -45,6 +45,72 @@ if [ -f "$MARKER_FILE" ]; then
     fi
 fi
 
+# ---------------------------------------------------------------------------
+# License validation (marketplace gate)
+# ---------------------------------------------------------------------------
+# Check key: ARTHAI_LICENSE_KEY env → ~/.claude-agents/.license → ~/.arthai/license
+WORKER_URL="https://license-worker.muddassar-shaikh.workers.dev"
+KEY_FORMAT='^ARTH-[A-Z0-9]{4}-[A-Z0-9]{4}-[A-Z0-9]{4}-[A-Z0-9]{4}$'
+LICENSE_CACHE="$PROJECT_DIR/.claude/.license-validated"
+CACHE_TTL=86400
+
+REAL_HOME=$(eval echo ~"$(id -un)")
+LICENSE_KEY="${ARTHAI_LICENSE_KEY:-}"
+[ -z "$LICENSE_KEY" ] && [ -f "$REAL_HOME/.claude-agents/.license" ] && LICENSE_KEY=$(cat "$REAL_HOME/.claude-agents/.license" 2>/dev/null | tr -d '[:space:]')
+[ -z "$LICENSE_KEY" ] && [ -f "$REAL_HOME/.arthai/license" ] && LICENSE_KEY=$(cat "$REAL_HOME/.arthai/license" 2>/dev/null | tr -d '[:space:]')
+
+if [ -z "$LICENSE_KEY" ]; then
+    echo "LICENSE REQUIRED — No license key found for marketplace plugin."
+    echo "Run: npx @arthai/agents activate ARTH-XXXX-XXXX-XXXX-XXXX"
+    echo "Get a key: productive@getarth.ai"
+    exit 0
+fi
+
+# Validate format
+if ! echo "$LICENSE_KEY" | grep -qE "$KEY_FORMAT"; then
+    echo "LICENSE INVALID — Key format incorrect."
+    exit 0
+fi
+
+# Check cache (24h TTL)
+LICENSE_VALID=false
+NOW=$(date +%s)
+if [ -f "$LICENSE_CACHE" ]; then
+    CACHED_TIME=$(cat "$LICENSE_CACHE" 2>/dev/null | tr -d '[:space:]' || echo "0")
+    ELAPSED=$((NOW - CACHED_TIME))
+    if [ "$ELAPSED" -ge 0 ] && [ "$ELAPSED" -lt "$CACHE_TTL" ]; then
+        LICENSE_VALID=true
+    fi
+fi
+
+if ! $LICENSE_VALID; then
+    # Call Worker — same logic as sync-agents.sh
+    PAYLOAD=$(printf '{"key":"%s"}' "$LICENSE_KEY")
+    RESPONSE=$(printf '%s' "$PAYLOAD" | curl -sf -m 5 -X POST "$WORKER_URL/validate" \
+        -H "Content-Type: application/json" --data "@-" 2>/dev/null) || RESPONSE=""
+
+    if [ -n "$RESPONSE" ]; then
+        VALID=$(echo "$RESPONSE" | python3 -c "import json,sys; print(json.load(sys.stdin).get('valid',False))" 2>/dev/null) || VALID="False"
+        if [ "$VALID" = "True" ]; then
+            LICENSE_VALID=true
+            mkdir -p "$PROJECT_DIR/.claude"
+            echo "$NOW" > "$LICENSE_CACHE"
+        else
+            # Definitive invalid — no fallback
+            echo "LICENSE INVALID — Key not recognized."
+            echo "Check your key or get one at productive@getarth.ai"
+            exit 0
+        fi
+    else
+        # Network error — allow gracefully (don't block on Worker outage)
+        LICENSE_VALID=true
+    fi
+fi
+
+# ---------------------------------------------------------------------------
+# Project setup (only runs if license is valid)
+# ---------------------------------------------------------------------------
+
 CLAUDE_MD="$PROJECT_DIR/CLAUDE.md"
 GITIGNORE="$PROJECT_DIR/.gitignore"
 

package/dist/plugins/forge/.claude-plugin/plugin.json

@@ -1,7 +1,7 @@
 {
   "name": "forge",
   "description": "Full development workflow — plan, build, test, ship",
-  "version": "1.0.9",
+  "version": "1.0.10",
   "author": {
     "name": "Arth AI"
   }

package/dist/plugins/forge/VERSION

@@ -1 +1 @@
-1.0.9
+1.0.10

package/dist/plugins/forge/hooks/project-setup.sh

@@ -45,6 +45,72 @@ if [ -f "$MARKER_FILE" ]; then
     fi
 fi
 
+# ---------------------------------------------------------------------------
+# License validation (marketplace gate)
+# ---------------------------------------------------------------------------
+# Check key: ARTHAI_LICENSE_KEY env → ~/.claude-agents/.license → ~/.arthai/license
+WORKER_URL="https://license-worker.muddassar-shaikh.workers.dev"
+KEY_FORMAT='^ARTH-[A-Z0-9]{4}-[A-Z0-9]{4}-[A-Z0-9]{4}-[A-Z0-9]{4}$'
+LICENSE_CACHE="$PROJECT_DIR/.claude/.license-validated"
+CACHE_TTL=86400
+
+REAL_HOME=$(eval echo ~"$(id -un)")
+LICENSE_KEY="${ARTHAI_LICENSE_KEY:-}"
+[ -z "$LICENSE_KEY" ] && [ -f "$REAL_HOME/.claude-agents/.license" ] && LICENSE_KEY=$(cat "$REAL_HOME/.claude-agents/.license" 2>/dev/null | tr -d '[:space:]')
+[ -z "$LICENSE_KEY" ] && [ -f "$REAL_HOME/.arthai/license" ] && LICENSE_KEY=$(cat "$REAL_HOME/.arthai/license" 2>/dev/null | tr -d '[:space:]')
+
+if [ -z "$LICENSE_KEY" ]; then
+    echo "LICENSE REQUIRED — No license key found for marketplace plugin."
+    echo "Run: npx @arthai/agents activate ARTH-XXXX-XXXX-XXXX-XXXX"
+    echo "Get a key: productive@getarth.ai"
+    exit 0
+fi
+
+# Validate format
+if ! echo "$LICENSE_KEY" | grep -qE "$KEY_FORMAT"; then
+    echo "LICENSE INVALID — Key format incorrect."
+    exit 0
+fi
+
+# Check cache (24h TTL)
+LICENSE_VALID=false
+NOW=$(date +%s)
+if [ -f "$LICENSE_CACHE" ]; then
+    CACHED_TIME=$(cat "$LICENSE_CACHE" 2>/dev/null | tr -d '[:space:]' || echo "0")
+    ELAPSED=$((NOW - CACHED_TIME))
+    if [ "$ELAPSED" -ge 0 ] && [ "$ELAPSED" -lt "$CACHE_TTL" ]; then
+        LICENSE_VALID=true
+    fi
+fi
+
+if ! $LICENSE_VALID; then
+    # Call Worker — same logic as sync-agents.sh
+    PAYLOAD=$(printf '{"key":"%s"}' "$LICENSE_KEY")
+    RESPONSE=$(printf '%s' "$PAYLOAD" | curl -sf -m 5 -X POST "$WORKER_URL/validate" \
+        -H "Content-Type: application/json" --data "@-" 2>/dev/null) || RESPONSE=""
+
+    if [ -n "$RESPONSE" ]; then
+        VALID=$(echo "$RESPONSE" | python3 -c "import json,sys; print(json.load(sys.stdin).get('valid',False))" 2>/dev/null) || VALID="False"
+        if [ "$VALID" = "True" ]; then
+            LICENSE_VALID=true
+            mkdir -p "$PROJECT_DIR/.claude"
+            echo "$NOW" > "$LICENSE_CACHE"
+        else
+            # Definitive invalid — no fallback
+            echo "LICENSE INVALID — Key not recognized."
+            echo "Check your key or get one at productive@getarth.ai"
+            exit 0
+        fi
+    else
+        # Network error — allow gracefully (don't block on Worker outage)
+        LICENSE_VALID=true
+    fi
+fi
+
+# ---------------------------------------------------------------------------
+# Project setup (only runs if license is valid)
+# ---------------------------------------------------------------------------
+
 CLAUDE_MD="$PROJECT_DIR/CLAUDE.md"
 GITIGNORE="$PROJECT_DIR/.gitignore"
 

package/dist/plugins/prime/.claude-plugin/plugin.json

@@ -1,7 +1,7 @@
 {
   "name": "prime",
   "description": "Everything — all agents, skills, and hooks in one plugin",
-  "version": "1.0.9",
+  "version": "1.0.10",
   "author": {
     "name": "Arth AI"
   }

package/dist/plugins/prime/VERSION

@@ -1 +1 @@
-1.0.9
+1.0.10

package/dist/plugins/prime/hooks/project-setup.sh

@@ -45,6 +45,72 @@ if [ -f "$MARKER_FILE" ]; then
     fi
 fi
 
+# ---------------------------------------------------------------------------
+# License validation (marketplace gate)
+# ---------------------------------------------------------------------------
+# Check key: ARTHAI_LICENSE_KEY env → ~/.claude-agents/.license → ~/.arthai/license
+WORKER_URL="https://license-worker.muddassar-shaikh.workers.dev"
+KEY_FORMAT='^ARTH-[A-Z0-9]{4}-[A-Z0-9]{4}-[A-Z0-9]{4}-[A-Z0-9]{4}$'
+LICENSE_CACHE="$PROJECT_DIR/.claude/.license-validated"
+CACHE_TTL=86400
+
+REAL_HOME=$(eval echo ~"$(id -un)")
+LICENSE_KEY="${ARTHAI_LICENSE_KEY:-}"
+[ -z "$LICENSE_KEY" ] && [ -f "$REAL_HOME/.claude-agents/.license" ] && LICENSE_KEY=$(cat "$REAL_HOME/.claude-agents/.license" 2>/dev/null | tr -d '[:space:]')
+[ -z "$LICENSE_KEY" ] && [ -f "$REAL_HOME/.arthai/license" ] && LICENSE_KEY=$(cat "$REAL_HOME/.arthai/license" 2>/dev/null | tr -d '[:space:]')
+
+if [ -z "$LICENSE_KEY" ]; then
+    echo "LICENSE REQUIRED — No license key found for marketplace plugin."
+    echo "Run: npx @arthai/agents activate ARTH-XXXX-XXXX-XXXX-XXXX"
+    echo "Get a key: productive@getarth.ai"
+    exit 0
+fi
+
+# Validate format
+if ! echo "$LICENSE_KEY" | grep -qE "$KEY_FORMAT"; then
+    echo "LICENSE INVALID — Key format incorrect."
+    exit 0
+fi
+
+# Check cache (24h TTL)
+LICENSE_VALID=false
+NOW=$(date +%s)
+if [ -f "$LICENSE_CACHE" ]; then
+    CACHED_TIME=$(cat "$LICENSE_CACHE" 2>/dev/null | tr -d '[:space:]' || echo "0")
+    ELAPSED=$((NOW - CACHED_TIME))
+    if [ "$ELAPSED" -ge 0 ] && [ "$ELAPSED" -lt "$CACHE_TTL" ]; then
+        LICENSE_VALID=true
+    fi
+fi
+
+if ! $LICENSE_VALID; then
+    # Call Worker — same logic as sync-agents.sh
+    PAYLOAD=$(printf '{"key":"%s"}' "$LICENSE_KEY")
+    RESPONSE=$(printf '%s' "$PAYLOAD" | curl -sf -m 5 -X POST "$WORKER_URL/validate" \
+        -H "Content-Type: application/json" --data "@-" 2>/dev/null) || RESPONSE=""
+
+    if [ -n "$RESPONSE" ]; then
+        VALID=$(echo "$RESPONSE" | python3 -c "import json,sys; print(json.load(sys.stdin).get('valid',False))" 2>/dev/null) || VALID="False"
+        if [ "$VALID" = "True" ]; then
+            LICENSE_VALID=true
+            mkdir -p "$PROJECT_DIR/.claude"
+            echo "$NOW" > "$LICENSE_CACHE"
+        else
+            # Definitive invalid — no fallback
+            echo "LICENSE INVALID — Key not recognized."
+            echo "Check your key or get one at productive@getarth.ai"
+            exit 0
+        fi
+    else
+        # Network error — allow gracefully (don't block on Worker outage)
+        LICENSE_VALID=true
+    fi
+fi
+
+# ---------------------------------------------------------------------------
+# Project setup (only runs if license is valid)
+# ---------------------------------------------------------------------------
+
 CLAUDE_MD="$PROJECT_DIR/CLAUDE.md"
 GITIGNORE="$PROJECT_DIR/.gitignore"
 

package/dist/plugins/prism/.claude-plugin/plugin.json

@@ -1,7 +1,7 @@
 {
   "name": "prism",
   "description": "Deep QA — multi-agent testing, baseline tracking, incident analysis",
-  "version": "1.0.9",
+  "version": "1.0.10",
   "author": {
     "name": "Arth AI"
   }

package/dist/plugins/prism/VERSION

@@ -1 +1 @@
-1.0.9
+1.0.10

package/dist/plugins/prism/hooks/project-setup.sh

@@ -45,6 +45,72 @@ if [ -f "$MARKER_FILE" ]; then
     fi
 fi
 
+# ---------------------------------------------------------------------------
+# License validation (marketplace gate)
+# ---------------------------------------------------------------------------
+# Check key: ARTHAI_LICENSE_KEY env → ~/.claude-agents/.license → ~/.arthai/license
+WORKER_URL="https://license-worker.muddassar-shaikh.workers.dev"
+KEY_FORMAT='^ARTH-[A-Z0-9]{4}-[A-Z0-9]{4}-[A-Z0-9]{4}-[A-Z0-9]{4}$'
+LICENSE_CACHE="$PROJECT_DIR/.claude/.license-validated"
+CACHE_TTL=86400
+
+REAL_HOME=$(eval echo ~"$(id -un)")
+LICENSE_KEY="${ARTHAI_LICENSE_KEY:-}"
+[ -z "$LICENSE_KEY" ] && [ -f "$REAL_HOME/.claude-agents/.license" ] && LICENSE_KEY=$(cat "$REAL_HOME/.claude-agents/.license" 2>/dev/null | tr -d '[:space:]')
+[ -z "$LICENSE_KEY" ] && [ -f "$REAL_HOME/.arthai/license" ] && LICENSE_KEY=$(cat "$REAL_HOME/.arthai/license" 2>/dev/null | tr -d '[:space:]')
+
+if [ -z "$LICENSE_KEY" ]; then
+    echo "LICENSE REQUIRED — No license key found for marketplace plugin."
+    echo "Run: npx @arthai/agents activate ARTH-XXXX-XXXX-XXXX-XXXX"
+    echo "Get a key: productive@getarth.ai"
+    exit 0
+fi
+
+# Validate format
+if ! echo "$LICENSE_KEY" | grep -qE "$KEY_FORMAT"; then
+    echo "LICENSE INVALID — Key format incorrect."
+    exit 0
+fi
+
+# Check cache (24h TTL)
+LICENSE_VALID=false
+NOW=$(date +%s)
+if [ -f "$LICENSE_CACHE" ]; then
+    CACHED_TIME=$(cat "$LICENSE_CACHE" 2>/dev/null | tr -d '[:space:]' || echo "0")
+    ELAPSED=$((NOW - CACHED_TIME))
+    if [ "$ELAPSED" -ge 0 ] && [ "$ELAPSED" -lt "$CACHE_TTL" ]; then
+        LICENSE_VALID=true
+    fi
+fi
+
+if ! $LICENSE_VALID; then
+    # Call Worker — same logic as sync-agents.sh
+    PAYLOAD=$(printf '{"key":"%s"}' "$LICENSE_KEY")
+    RESPONSE=$(printf '%s' "$PAYLOAD" | curl -sf -m 5 -X POST "$WORKER_URL/validate" \
+        -H "Content-Type: application/json" --data "@-" 2>/dev/null) || RESPONSE=""
+
+    if [ -n "$RESPONSE" ]; then
+        VALID=$(echo "$RESPONSE" | python3 -c "import json,sys; print(json.load(sys.stdin).get('valid',False))" 2>/dev/null) || VALID="False"
+        if [ "$VALID" = "True" ]; then
+            LICENSE_VALID=true
+            mkdir -p "$PROJECT_DIR/.claude"
+            echo "$NOW" > "$LICENSE_CACHE"
+        else
+            # Definitive invalid — no fallback
+            echo "LICENSE INVALID — Key not recognized."
+            echo "Check your key or get one at productive@getarth.ai"
+            exit 0
+        fi
+    else
+        # Network error — allow gracefully (don't block on Worker outage)
+        LICENSE_VALID=true
+    fi
+fi
+
+# ---------------------------------------------------------------------------
+# Project setup (only runs if license is valid)
+# ---------------------------------------------------------------------------
+
 CLAUDE_MD="$PROJECT_DIR/CLAUDE.md"
 GITIGNORE="$PROJECT_DIR/.gitignore"
 

package/dist/plugins/scalpel/.claude-plugin/plugin.json

@@ -1,7 +1,7 @@
 {
   "name": "scalpel",
   "description": "Surgical bug fixing — targeted fixes, CI repair, issue triage",
-  "version": "1.0.9",
+  "version": "1.0.10",
   "author": {
     "name": "Arth AI"
   }

package/dist/plugins/scalpel/VERSION

@@ -1 +1 @@
-1.0.9
+1.0.10

package/dist/plugins/scalpel/hooks/project-setup.sh

@@ -45,6 +45,72 @@ if [ -f "$MARKER_FILE" ]; then
     fi
 fi
 
+# ---------------------------------------------------------------------------
+# License validation (marketplace gate)
+# ---------------------------------------------------------------------------
+# Check key: ARTHAI_LICENSE_KEY env → ~/.claude-agents/.license → ~/.arthai/license
+WORKER_URL="https://license-worker.muddassar-shaikh.workers.dev"
+KEY_FORMAT='^ARTH-[A-Z0-9]{4}-[A-Z0-9]{4}-[A-Z0-9]{4}-[A-Z0-9]{4}$'
+LICENSE_CACHE="$PROJECT_DIR/.claude/.license-validated"
+CACHE_TTL=86400
+
+REAL_HOME=$(eval echo ~"$(id -un)")
+LICENSE_KEY="${ARTHAI_LICENSE_KEY:-}"
+[ -z "$LICENSE_KEY" ] && [ -f "$REAL_HOME/.claude-agents/.license" ] && LICENSE_KEY=$(cat "$REAL_HOME/.claude-agents/.license" 2>/dev/null | tr -d '[:space:]')
+[ -z "$LICENSE_KEY" ] && [ -f "$REAL_HOME/.arthai/license" ] && LICENSE_KEY=$(cat "$REAL_HOME/.arthai/license" 2>/dev/null | tr -d '[:space:]')
+
+if [ -z "$LICENSE_KEY" ]; then
+    echo "LICENSE REQUIRED — No license key found for marketplace plugin."
+    echo "Run: npx @arthai/agents activate ARTH-XXXX-XXXX-XXXX-XXXX"
+    echo "Get a key: productive@getarth.ai"
+    exit 0
+fi
+
+# Validate format
+if ! echo "$LICENSE_KEY" | grep -qE "$KEY_FORMAT"; then
+    echo "LICENSE INVALID — Key format incorrect."
+    exit 0
+fi
+
+# Check cache (24h TTL)
+LICENSE_VALID=false
+NOW=$(date +%s)
+if [ -f "$LICENSE_CACHE" ]; then
+    CACHED_TIME=$(cat "$LICENSE_CACHE" 2>/dev/null | tr -d '[:space:]' || echo "0")
+    ELAPSED=$((NOW - CACHED_TIME))
+    if [ "$ELAPSED" -ge 0 ] && [ "$ELAPSED" -lt "$CACHE_TTL" ]; then
+        LICENSE_VALID=true
+    fi
+fi
+
+if ! $LICENSE_VALID; then
+    # Call Worker — same logic as sync-agents.sh
+    PAYLOAD=$(printf '{"key":"%s"}' "$LICENSE_KEY")
+    RESPONSE=$(printf '%s' "$PAYLOAD" | curl -sf -m 5 -X POST "$WORKER_URL/validate" \
+        -H "Content-Type: application/json" --data "@-" 2>/dev/null) || RESPONSE=""
+
+    if [ -n "$RESPONSE" ]; then
+        VALID=$(echo "$RESPONSE" | python3 -c "import json,sys; print(json.load(sys.stdin).get('valid',False))" 2>/dev/null) || VALID="False"
+        if [ "$VALID" = "True" ]; then
+            LICENSE_VALID=true
+            mkdir -p "$PROJECT_DIR/.claude"
+            echo "$NOW" > "$LICENSE_CACHE"
+        else
+            # Definitive invalid — no fallback
+            echo "LICENSE INVALID — Key not recognized."
+            echo "Check your key or get one at productive@getarth.ai"
+            exit 0
+        fi
+    else
+        # Network error — allow gracefully (don't block on Worker outage)
+        LICENSE_VALID=true
+    fi
+fi
+
+# ---------------------------------------------------------------------------
+# Project setup (only runs if license is valid)
+# ---------------------------------------------------------------------------
+
 CLAUDE_MD="$PROJECT_DIR/CLAUDE.md"
 GITIGNORE="$PROJECT_DIR/.gitignore"
 

package/dist/plugins/sentinel/.claude-plugin/plugin.json

@@ -1,7 +1,7 @@
 {
   "name": "sentinel",
   "description": "Operations and reliability — SRE, incidents, deploy monitoring",
-  "version": "1.0.9",
+  "version": "1.0.10",
   "author": {
     "name": "Arth AI"
   }

package/dist/plugins/sentinel/VERSION

@@ -1 +1 @@
-1.0.9
+1.0.10

package/dist/plugins/sentinel/hooks/project-setup.sh

@@ -45,6 +45,72 @@ if [ -f "$MARKER_FILE" ]; then
     fi
 fi
 
+# ---------------------------------------------------------------------------
+# License validation (marketplace gate)
+# ---------------------------------------------------------------------------
+# Check key: ARTHAI_LICENSE_KEY env → ~/.claude-agents/.license → ~/.arthai/license
+WORKER_URL="https://license-worker.muddassar-shaikh.workers.dev"
+KEY_FORMAT='^ARTH-[A-Z0-9]{4}-[A-Z0-9]{4}-[A-Z0-9]{4}-[A-Z0-9]{4}$'
+LICENSE_CACHE="$PROJECT_DIR/.claude/.license-validated"
+CACHE_TTL=86400
+
+REAL_HOME=$(eval echo ~"$(id -un)")
+LICENSE_KEY="${ARTHAI_LICENSE_KEY:-}"
+[ -z "$LICENSE_KEY" ] && [ -f "$REAL_HOME/.claude-agents/.license" ] && LICENSE_KEY=$(cat "$REAL_HOME/.claude-agents/.license" 2>/dev/null | tr -d '[:space:]')
+[ -z "$LICENSE_KEY" ] && [ -f "$REAL_HOME/.arthai/license" ] && LICENSE_KEY=$(cat "$REAL_HOME/.arthai/license" 2>/dev/null | tr -d '[:space:]')
+
+if [ -z "$LICENSE_KEY" ]; then
+    echo "LICENSE REQUIRED — No license key found for marketplace plugin."
+    echo "Run: npx @arthai/agents activate ARTH-XXXX-XXXX-XXXX-XXXX"
+    echo "Get a key: productive@getarth.ai"
+    exit 0
+fi
+
+# Validate format
+if ! echo "$LICENSE_KEY" | grep -qE "$KEY_FORMAT"; then
+    echo "LICENSE INVALID — Key format incorrect."
+    exit 0
+fi
+
+# Check cache (24h TTL)
+LICENSE_VALID=false
+NOW=$(date +%s)
+if [ -f "$LICENSE_CACHE" ]; then
+    CACHED_TIME=$(cat "$LICENSE_CACHE" 2>/dev/null | tr -d '[:space:]' || echo "0")
+    ELAPSED=$((NOW - CACHED_TIME))
+    if [ "$ELAPSED" -ge 0 ] && [ "$ELAPSED" -lt "$CACHE_TTL" ]; then
+        LICENSE_VALID=true
+    fi
+fi
+
+if ! $LICENSE_VALID; then
+    # Call Worker — same logic as sync-agents.sh
+    PAYLOAD=$(printf '{"key":"%s"}' "$LICENSE_KEY")
+    RESPONSE=$(printf '%s' "$PAYLOAD" | curl -sf -m 5 -X POST "$WORKER_URL/validate" \
+        -H "Content-Type: application/json" --data "@-" 2>/dev/null) || RESPONSE=""
+
+    if [ -n "$RESPONSE" ]; then
+        VALID=$(echo "$RESPONSE" | python3 -c "import json,sys; print(json.load(sys.stdin).get('valid',False))" 2>/dev/null) || VALID="False"
+        if [ "$VALID" = "True" ]; then
+            LICENSE_VALID=true
+            mkdir -p "$PROJECT_DIR/.claude"
+            echo "$NOW" > "$LICENSE_CACHE"
+        else
+            # Definitive invalid — no fallback
+            echo "LICENSE INVALID — Key not recognized."
+            echo "Check your key or get one at productive@getarth.ai"
+            exit 0
+        fi
+    else
+        # Network error — allow gracefully (don't block on Worker outage)
+        LICENSE_VALID=true
+    fi
+fi
+
+# ---------------------------------------------------------------------------
+# Project setup (only runs if license is valid)
+# ---------------------------------------------------------------------------
+
 CLAUDE_MD="$PROJECT_DIR/CLAUDE.md"
 GITIGNORE="$PROJECT_DIR/.gitignore"
 

package/dist/plugins/shield/.claude-plugin/plugin.json

@@ -1,7 +1,7 @@
 {
   "name": "shield",
   "description": "Safety guardrails — bash guards, edit protection, session bootstrap",
-  "version": "1.0.9",
+  "version": "1.0.10",
   "author": {
     "name": "Arth AI"
   }

package/dist/plugins/shield/VERSION

@@ -1 +1 @@
-1.0.9
+1.0.10

package/dist/plugins/shield/hooks/project-setup.sh

@@ -45,6 +45,72 @@ if [ -f "$MARKER_FILE" ]; then
     fi
 fi
 
+# ---------------------------------------------------------------------------
+# License validation (marketplace gate)
+# ---------------------------------------------------------------------------
+# Check key: ARTHAI_LICENSE_KEY env → ~/.claude-agents/.license → ~/.arthai/license
+WORKER_URL="https://license-worker.muddassar-shaikh.workers.dev"
+KEY_FORMAT='^ARTH-[A-Z0-9]{4}-[A-Z0-9]{4}-[A-Z0-9]{4}-[A-Z0-9]{4}$'
+LICENSE_CACHE="$PROJECT_DIR/.claude/.license-validated"
+CACHE_TTL=86400
+
+REAL_HOME=$(eval echo ~"$(id -un)")
+LICENSE_KEY="${ARTHAI_LICENSE_KEY:-}"
+[ -z "$LICENSE_KEY" ] && [ -f "$REAL_HOME/.claude-agents/.license" ] && LICENSE_KEY=$(cat "$REAL_HOME/.claude-agents/.license" 2>/dev/null | tr -d '[:space:]')
+[ -z "$LICENSE_KEY" ] && [ -f "$REAL_HOME/.arthai/license" ] && LICENSE_KEY=$(cat "$REAL_HOME/.arthai/license" 2>/dev/null | tr -d '[:space:]')
+
+if [ -z "$LICENSE_KEY" ]; then
+    echo "LICENSE REQUIRED — No license key found for marketplace plugin."
+    echo "Run: npx @arthai/agents activate ARTH-XXXX-XXXX-XXXX-XXXX"
+    echo "Get a key: productive@getarth.ai"
+    exit 0
+fi
+
+# Validate format
+if ! echo "$LICENSE_KEY" | grep -qE "$KEY_FORMAT"; then
+    echo "LICENSE INVALID — Key format incorrect."
+    exit 0
+fi
+
+# Check cache (24h TTL)
+LICENSE_VALID=false
+NOW=$(date +%s)
+if [ -f "$LICENSE_CACHE" ]; then
+    CACHED_TIME=$(cat "$LICENSE_CACHE" 2>/dev/null | tr -d '[:space:]' || echo "0")
+    ELAPSED=$((NOW - CACHED_TIME))
+    if [ "$ELAPSED" -ge 0 ] && [ "$ELAPSED" -lt "$CACHE_TTL" ]; then
+        LICENSE_VALID=true
+    fi
+fi
+
+if ! $LICENSE_VALID; then
+    # Call Worker — same logic as sync-agents.sh
+    PAYLOAD=$(printf '{"key":"%s"}' "$LICENSE_KEY")
+    RESPONSE=$(printf '%s' "$PAYLOAD" | curl -sf -m 5 -X POST "$WORKER_URL/validate" \
+        -H "Content-Type: application/json" --data "@-" 2>/dev/null) || RESPONSE=""
+
+    if [ -n "$RESPONSE" ]; then
+        VALID=$(echo "$RESPONSE" | python3 -c "import json,sys; print(json.load(sys.stdin).get('valid',False))" 2>/dev/null) || VALID="False"
+        if [ "$VALID" = "True" ]; then
+            LICENSE_VALID=true
+            mkdir -p "$PROJECT_DIR/.claude"
+            echo "$NOW" > "$LICENSE_CACHE"
+        else
+            # Definitive invalid — no fallback
+            echo "LICENSE INVALID — Key not recognized."
+            echo "Check your key or get one at productive@getarth.ai"
+            exit 0
+        fi
+    else
+        # Network error — allow gracefully (don't block on Worker outage)
+        LICENSE_VALID=true
+    fi
+fi
+
+# ---------------------------------------------------------------------------
+# Project setup (only runs if license is valid)
+# ---------------------------------------------------------------------------
+
 CLAUDE_MD="$PROJECT_DIR/CLAUDE.md"
 GITIGNORE="$PROJECT_DIR/.gitignore"
 

package/dist/plugins/spark/.claude-plugin/plugin.json

@@ -1,7 +1,7 @@
 {
   "name": "spark",
   "description": "Project setup and onboarding — calibrate, scan, bootstrap",
-  "version": "1.0.9",
+  "version": "1.0.10",
   "author": {
     "name": "Arth AI"
   }

package/dist/plugins/spark/VERSION

@@ -1 +1 @@
-1.0.9
+1.0.10

package/dist/plugins/spark/hooks/project-setup.sh

@@ -45,6 +45,72 @@ if [ -f "$MARKER_FILE" ]; then
     fi
 fi
 
+# ---------------------------------------------------------------------------
+# License validation (marketplace gate)
+# ---------------------------------------------------------------------------
+# Check key: ARTHAI_LICENSE_KEY env → ~/.claude-agents/.license → ~/.arthai/license
+WORKER_URL="https://license-worker.muddassar-shaikh.workers.dev"
+KEY_FORMAT='^ARTH-[A-Z0-9]{4}-[A-Z0-9]{4}-[A-Z0-9]{4}-[A-Z0-9]{4}$'
+LICENSE_CACHE="$PROJECT_DIR/.claude/.license-validated"
+CACHE_TTL=86400
+
+REAL_HOME=$(eval echo ~"$(id -un)")
+LICENSE_KEY="${ARTHAI_LICENSE_KEY:-}"
+[ -z "$LICENSE_KEY" ] && [ -f "$REAL_HOME/.claude-agents/.license" ] && LICENSE_KEY=$(cat "$REAL_HOME/.claude-agents/.license" 2>/dev/null | tr -d '[:space:]')
+[ -z "$LICENSE_KEY" ] && [ -f "$REAL_HOME/.arthai/license" ] && LICENSE_KEY=$(cat "$REAL_HOME/.arthai/license" 2>/dev/null | tr -d '[:space:]')
+
+if [ -z "$LICENSE_KEY" ]; then
+    echo "LICENSE REQUIRED — No license key found for marketplace plugin."
+    echo "Run: npx @arthai/agents activate ARTH-XXXX-XXXX-XXXX-XXXX"
+    echo "Get a key: productive@getarth.ai"
+    exit 0
+fi
+
+# Validate format
+if ! echo "$LICENSE_KEY" | grep -qE "$KEY_FORMAT"; then
+    echo "LICENSE INVALID — Key format incorrect."
+    exit 0
+fi
+
+# Check cache (24h TTL)
+LICENSE_VALID=false
+NOW=$(date +%s)
+if [ -f "$LICENSE_CACHE" ]; then
+    CACHED_TIME=$(cat "$LICENSE_CACHE" 2>/dev/null | tr -d '[:space:]' || echo "0")
+    ELAPSED=$((NOW - CACHED_TIME))
+    if [ "$ELAPSED" -ge 0 ] && [ "$ELAPSED" -lt "$CACHE_TTL" ]; then
+        LICENSE_VALID=true
+    fi
+fi
+
+if ! $LICENSE_VALID; then
+    # Call Worker — same logic as sync-agents.sh
+    PAYLOAD=$(printf '{"key":"%s"}' "$LICENSE_KEY")
+    RESPONSE=$(printf '%s' "$PAYLOAD" | curl -sf -m 5 -X POST "$WORKER_URL/validate" \
+        -H "Content-Type: application/json" --data "@-" 2>/dev/null) || RESPONSE=""
+
+    if [ -n "$RESPONSE" ]; then
+        VALID=$(echo "$RESPONSE" | python3 -c "import json,sys; print(json.load(sys.stdin).get('valid',False))" 2>/dev/null) || VALID="False"
+        if [ "$VALID" = "True" ]; then
+            LICENSE_VALID=true
+            mkdir -p "$PROJECT_DIR/.claude"
+            echo "$NOW" > "$LICENSE_CACHE"
+        else
+            # Definitive invalid — no fallback
+            echo "LICENSE INVALID — Key not recognized."
+            echo "Check your key or get one at productive@getarth.ai"
+            exit 0
+        fi
+    else
+        # Network error — allow gracefully (don't block on Worker outage)
+        LICENSE_VALID=true
+    fi
+fi
+
+# ---------------------------------------------------------------------------
+# Project setup (only runs if license is valid)
+# ---------------------------------------------------------------------------
+
 CLAUDE_MD="$PROJECT_DIR/CLAUDE.md"
 GITIGNORE="$PROJECT_DIR/.gitignore"
 

package/hooks/project-setup.sh

@@ -45,6 +45,72 @@ if [ -f "$MARKER_FILE" ]; then
     fi
 fi
 
+# ---------------------------------------------------------------------------
+# License validation (marketplace gate)
+# ---------------------------------------------------------------------------
+# Check key: ARTHAI_LICENSE_KEY env → ~/.claude-agents/.license → ~/.arthai/license
+WORKER_URL="https://license-worker.muddassar-shaikh.workers.dev"
+KEY_FORMAT='^ARTH-[A-Z0-9]{4}-[A-Z0-9]{4}-[A-Z0-9]{4}-[A-Z0-9]{4}$'
+LICENSE_CACHE="$PROJECT_DIR/.claude/.license-validated"
+CACHE_TTL=86400
+
+REAL_HOME=$(eval echo ~"$(id -un)")
+LICENSE_KEY="${ARTHAI_LICENSE_KEY:-}"
+[ -z "$LICENSE_KEY" ] && [ -f "$REAL_HOME/.claude-agents/.license" ] && LICENSE_KEY=$(cat "$REAL_HOME/.claude-agents/.license" 2>/dev/null | tr -d '[:space:]')
+[ -z "$LICENSE_KEY" ] && [ -f "$REAL_HOME/.arthai/license" ] && LICENSE_KEY=$(cat "$REAL_HOME/.arthai/license" 2>/dev/null | tr -d '[:space:]')
+
+if [ -z "$LICENSE_KEY" ]; then
+    echo "LICENSE REQUIRED — No license key found for marketplace plugin."
+    echo "Run: npx @arthai/agents activate ARTH-XXXX-XXXX-XXXX-XXXX"
+    echo "Get a key: productive@getarth.ai"
+    exit 0
+fi
+
+# Validate format
+if ! echo "$LICENSE_KEY" | grep -qE "$KEY_FORMAT"; then
+    echo "LICENSE INVALID — Key format incorrect."
+    exit 0
+fi
+
+# Check cache (24h TTL)
+LICENSE_VALID=false
+NOW=$(date +%s)
+if [ -f "$LICENSE_CACHE" ]; then
+    CACHED_TIME=$(cat "$LICENSE_CACHE" 2>/dev/null | tr -d '[:space:]' || echo "0")
+    ELAPSED=$((NOW - CACHED_TIME))
+    if [ "$ELAPSED" -ge 0 ] && [ "$ELAPSED" -lt "$CACHE_TTL" ]; then
+        LICENSE_VALID=true
+    fi
+fi
+
+if ! $LICENSE_VALID; then
+    # Call Worker — same logic as sync-agents.sh
+    PAYLOAD=$(printf '{"key":"%s"}' "$LICENSE_KEY")
+    RESPONSE=$(printf '%s' "$PAYLOAD" | curl -sf -m 5 -X POST "$WORKER_URL/validate" \
+        -H "Content-Type: application/json" --data "@-" 2>/dev/null) || RESPONSE=""
+
+    if [ -n "$RESPONSE" ]; then
+        VALID=$(echo "$RESPONSE" | python3 -c "import json,sys; print(json.load(sys.stdin).get('valid',False))" 2>/dev/null) || VALID="False"
+        if [ "$VALID" = "True" ]; then
+            LICENSE_VALID=true
+            mkdir -p "$PROJECT_DIR/.claude"
+            echo "$NOW" > "$LICENSE_CACHE"
+        else
+            # Definitive invalid — no fallback
+            echo "LICENSE INVALID — Key not recognized."
+            echo "Check your key or get one at productive@getarth.ai"
+            exit 0
+        fi
+    else
+        # Network error — allow gracefully (don't block on Worker outage)
+        LICENSE_VALID=true
+    fi
+fi
+
+# ---------------------------------------------------------------------------
+# Project setup (only runs if license is valid)
+# ---------------------------------------------------------------------------
+
 CLAUDE_MD="$PROJECT_DIR/CLAUDE.md"
 GITIGNORE="$PROJECT_DIR/.gitignore"
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@arthai/agents",
-  "version": "1.0.9",
+  "version": "1.0.10",
   "description": "AI-powered development toolkit for Claude Code — agents, skills, and hooks",
   "bin": {
     "arthai": "bin/cli.js"