@nac3/forge-cli 0.2.0-alpha.9 → 1.0.0

package/dist/docs/LIMITED_RESPONSIBILITY.md

@@ -0,0 +1,216 @@
+# Yujin Forge -- Limitation of Liability
+
+Effective date: 2026-06-04
+
+This document describes the limits of Yujin's responsibility
+when you use `@nac3/forge-cli` ("Forge") or any service it
+connects to (`prompts.yujin.app`, the managed brain, the
+license server). It complements `docs/PRIVACY_POLICY.md` and
+sits inside the product itself under **Config -> About**.
+
+By installing or using Forge, you agree to this limitation.
+If you do not agree, do not install, and contact
+contact@yujin.app to request removal of any account /
+license records.
+
+## 1. Forge is provided "AS IS"
+
+Forge is a development tool. It is provided as-is, without
+warranty of any kind, express or implied, including but not
+limited to:
+
+- merchantability,
+- fitness for a particular purpose,
+- non-infringement,
+- accuracy of generated output,
+- compatibility with your specific stack, OS, or workflow.
+
+This applies to every part of the product: the CLI, the
+chat panel, voice features, MCP bridges, the agent
+orchestrator, the managed flows (`spec-extract`,
+`spec-plan`, `ai-decorate`), and any default content shipped
+in the installer.
+
+## 2. You are responsible for your data
+
+Forge runs on your machine and edits files in your project
+root. You are responsible for:
+
+- maintaining backups of any code, specs, or documents you
+  feed into Forge.
+- reviewing every change Forge proposes before applying it
+  (the approval modal exists for this; do not bypass it for
+  destructive operations).
+- verifying the correctness, security, and licensing of any
+  code Forge generates, decorates, or migrates.
+- complying with the terms of any third-party libraries,
+  models, or APIs you connect through Forge (your Anthropic
+  / OpenAI / Gemini key, your GitHub PAT, your MCP bridges,
+  etc).
+
+Yujin does not store your project files. We do not have
+copies to restore from if you lose data due to a Forge
+action, a hardware failure, an OS crash, or a mistake of
+your own.
+
+## 3. No liability for indirect or consequential damages
+
+To the maximum extent permitted by law, Yujin (and its
+founder, employees, contractors, affiliates) is not liable
+for any:
+
+- indirect damages,
+- incidental damages,
+- consequential damages,
+- punitive damages,
+- loss of profit, revenue, business, data, or goodwill,
+- cost of substitute services,
+
+arising out of or in any way connected with your use of
+Forge, even if Yujin has been advised of the possibility
+of such damages.
+
+If applicable law restricts the above exclusion, Yujin's
+total cumulative liability for all claims arising under or
+related to Forge is limited to the lesser of:
+
+- the amount you paid Yujin for Forge subscriptions during
+  the 12 months immediately preceding the claim, OR
+- USD 100.
+
+This cap applies regardless of the legal theory of the
+claim (contract, tort, statute, or otherwise).
+
+## 4. Third-party services
+
+Forge connects to third-party services that have their own
+terms:
+
+| Service | When used | Their terms |
+|---|---|---|
+| Anthropic Claude | BYOK chat + 3 managed flows | https://www.anthropic.com/legal |
+| OpenAI (optional) | BYOK chat tier | https://openai.com/policies |
+| Google Gemini (optional) | BYOK chat tier | https://policies.google.com |
+| GitHub | `yf agent` GitHub verbs | https://docs.github.com/site-policy |
+| Polar | License + subscription | https://polar.sh/legal |
+| MCP bridges | User-installed | Per-bridge license |
+
+Yujin is not responsible for outages, changes, or actions
+of these third parties. Yujin does not guarantee continued
+availability of any third-party integration.
+
+## 5. Right to modify or discontinue
+
+Yujin may, at any time and without prior notice:
+
+- modify Forge features (CLI commands, verbs, panel
+  surfaces, prompts on the managed server),
+- modify pricing or subscription terms (existing
+  subscriptions honor their billing period; renewals
+  reflect new pricing),
+- discontinue specific managed flows (with a 30-day
+  deprecation notice posted via the panel banner and a
+  commit in this repo),
+- discontinue Forge entirely (with 90-day notice and a
+  one-time export of your local data via `yf export
+  --all`).
+
+Material breaking changes ship under a clear "BREAKING"
+tag in git commit messages and a banner in `yf chat`.
+
+## 6. Generated content disclaimer
+
+Forge uses LLMs (Claude, OpenAI, Gemini) to generate code,
+explanations, spec extractions, decorations, and chat
+replies. These outputs are:
+
+- not guaranteed to be correct,
+- not guaranteed to be secure,
+- not guaranteed to be free of bugs,
+- not guaranteed to compile, lint, or pass tests,
+- not legal advice, financial advice, or medical advice,
+- not a substitute for human review.
+
+You must review every generated output before adopting it.
+LLMs can:
+
+- hallucinate facts that look plausible,
+- invent APIs that do not exist,
+- produce code that compiles but does the wrong thing,
+- echo training-data licensing concerns into your project.
+
+Yujin is not liable for output you accept without review.
+
+## 7. License key + subscription
+
+Your license key controls access to the managed flows. If
+your subscription lapses:
+
+- BYOK chat keeps working.
+- The 3 managed flows return 402 (Payment Required) until
+  the subscription resumes.
+- Local agents keep running with BYOK; managed agents
+  pause.
+
+We do not retroactively bill for usage during a lapse, and
+we do not delete your license key on lapse -- it goes
+inactive, and the same key works when you resume the
+subscription.
+
+## 8. Indemnification
+
+You agree to indemnify and hold Yujin harmless from any
+claim brought by a third party (including but not limited
+to your end-users) arising out of:
+
+- your use of Forge,
+- your distribution of products built using Forge,
+- any code, content, or data you fed into Forge,
+- your breach of this limitation of liability or the
+  privacy policy.
+
+This means: if your customer sues you over something they
+got from a product you built with Forge, that is between
+you and your customer; Yujin is not on the hook.
+
+## 9. Governing law + dispute resolution
+
+This limitation of liability is governed by the laws of
+the Argentine Republic. Disputes that cannot be resolved by
+direct contact at contact@yujin.app are subject to the
+exclusive jurisdiction of the courts of the City of Buenos
+Aires.
+
+If your local consumer-protection law grants you stronger
+rights than this document, those local rights apply
+(this clause does not override them).
+
+## 10. Changes to this document
+
+Material changes ship with at least 30 days notice via:
+
+- A banner in `yf chat` panel.
+- An email to the address on file with your license.
+- A git commit to `docs/LIMITED_RESPONSIBILITY.md` with a
+  `BREAKING:` tag in the message.
+
+Continued use after a material change constitutes
+acceptance. If you do not accept, contact
+contact@yujin.app within the notice period for refund of
+the unused portion of your subscription.
+
+Cosmetic edits (typos, clarifications) ship silently with
+their git commits.
+
+## 11. Contact
+
+All requests go to **contact@yujin.app**.
+
+For legal or compliance inquiries, use subject prefix
+`[LEGAL]`.
+
+---
+
+This document is the source of truth. The version available
+inside Forge (`Config -> About -> Limitation of liability`)
+is a mirror of this markdown, refreshed on every commit.

package/dist/docs/PRIVACY_POLICY.md

@@ -0,0 +1,169 @@
+# Yujin Forge -- Privacy Policy
+
+Effective date: 2026-06-04 (draft pending Pablo's approval +
+publication on https://yujin.app/privacy)
+
+Yujin Forge is a development tool. This page describes what data
+it sends to Yujin servers, what we keep, and what we don't.
+
+## Quick summary
+
+- **BYOK chat** (`yf chat` with your own Anthropic / OpenAI /
+  Gemini API key): nothing leaves your machine except the call
+  to the LLM provider you chose. Yujin servers are not in the
+  loop.
+- **Managed flows** (3 of them: `spec-extract`, `spec-plan`,
+  `ai-decorate`): your payload travels to `prompts.yujin.app`
+  so we can compose the prompt + call Claude on your behalf.
+  Required for these features to work.
+- **Everything else** (verb dispatch, file I/O, voice, MCP
+  bridges, audit log, agent runtime): local to your machine.
+
+If you only use BYOK, this policy effectively does not apply to
+you. Read on if you use any of the 3 managed flows.
+
+## 1. What we send (managed flows only)
+
+When you invoke one of these 3 flows:
+
+| Flow | Triggered by | Payload sent |
+|---|---|---|
+| spec-extract | `yf chat` extracting structure from a spec doc | The spec text you supply (markdown, plain text, or a transcript) |
+| spec-plan | `yf chat` generating a plan from extracted spec | The extracted spec object |
+| ai-decorate | `yf migrate --ai-decorate` | The source HTML / JS being decorated to NAC-3 |
+
+Every request also carries:
+- Your `license_key` (so we can verify you're entitled to the
+  flow and meter token usage).
+- A `request_id` (so you can quote it to support when something
+  fails).
+- Forge CLI version (so we know which client capabilities you
+  have).
+
+Nothing else. We do NOT collect:
+- Your local filesystem path, project name, or hostname.
+- Other API keys you have stored in the vault.
+- The contents of files you didn't explicitly pass into the
+  flow.
+- Telemetry of your editor / OS / IDE.
+
+## 2. Why we send it
+
+`prompts.yujin.app` composes the full prompt (using
+Yujin-proprietary prompt engineering) and forwards it to
+Anthropic's Claude. The resulting structured output is returned
+to your CLI. The composed prompt itself is what we keep
+server-side; your payload is the variable input that completes
+it.
+
+This server-side composition is what makes the 3 managed flows
+deliver measurably better output than a naive Claude call.
+
+## 3. What we keep -- and what we don't
+
+**We keep, indefinitely**, the following metadata per request:
+- `request_id`
+- ISO timestamp
+- License key (foreign key into your subscription)
+- Per-flow status code (success / quota / claude-error / etc)
+- Token usage (input + output token counts)
+- Cost in fractional cents
+
+**We DO NOT keep**:
+- Your spec text, HTML, JS, transcripts, or any other content
+  you sent as the payload.
+- The composed prompt that included your payload (it lives in
+  memory only for the request lifetime, then is discarded).
+- Claude's response to you (we forward it; we don't store it).
+
+The "we keep nothing" rule is enforced by infrastructure: the
+request handlers run on stateless compute with no attached
+persistent storage. Structured logs go to a log aggregator
+with payload fields explicitly stripped at emit time.
+
+## 4. Where data is hosted
+
+- `prompts.yujin.app` runs on infrastructure managed by Yujin.
+  Specific region + cloud-provider details are documented
+  internally and disclosed on request to license holders via
+  contact@yujin.app.
+- Claude API calls go to Anthropic; Anthropic's privacy policy
+  applies to those request bodies once they leave our server.
+  We send only the composed prompt + the necessary parameters;
+  we do not opt your data into Anthropic's model training.
+- Logs are aggregated within the same hosting environment.
+
+## 5. Who at Yujin can access this data
+
+Only Yujin staff on incident-response rotation can query the
+logs. Every query is audited. There is no "ops dashboard with
+everyone's traffic" -- direct log access requires 2FA +
+audit trail.
+
+## 6. Your rights
+
+- **Right to deletion.** Email contact@yujin.app referencing
+  your license key; we delete all log entries referencing that
+  license within 30 days. This is free + does not affect your
+  subscription.
+- **Right to access.** Same email address; we export every log
+  row referencing your license as a JSON file and email it to
+  you within 30 days. Also free.
+- **Right to opt out.** You can stop using the 3 managed flows
+  at any time by setting `YF_USE_HITO4_FLOWS=0` in your shell.
+  The BYOK chat keeps working; the 3 managed features become
+  unavailable until you re-enable.
+
+## 7. Cost transparency
+
+Every managed-flow response includes a `billing` envelope:
+
+```json
+{
+  "billing": {
+    "this_call_cost_cents": 0.142,
+    "cumulative_month_cents": 38.50
+  }
+}
+```
+
+The Forge panel renders this in the cost tab so you always
+know what a call costs.
+
+## 8. Adopters building products on Forge
+
+If you publish a product that uses Forge as a tool, your
+end-users' data does NOT pass through `prompts.yujin.app`
+unless your product itself invokes the 3 managed flows on
+their behalf. Forge as a development tool is one thing;
+products built on Forge are a separate trust relationship
+between you and your users.
+
+## 9. Changes to this policy
+
+Material changes (anything that broadens what we collect or
+weakens what we delete) ship with at least 30 days notice via:
+- A banner in `yf chat` panel.
+- An email to the address on file with your license.
+- A git commit to `docs/PRIVACY_POLICY.md` with a clear
+  "BREAKING" tag in the message.
+
+Cosmetic edits (typos, clarifications) ship silently with
+their git commits.
+
+## 10. Contact
+
+All requests (privacy, security disclosure, billing,
+everything else) go to:
+
+- **contact@yujin.app**
+
+For security vulnerabilities, please use the subject prefix
+`[SECURITY]` so we can route quickly. See `docs/SECURITY.md`
+for the full disclosure process.
+
+---
+
+This document is the source of truth. The hosted version at
+https://yujin.app/privacy is a mirror of this markdown,
+regenerated on every `docs/PRIVACY_POLICY.md` commit.