@rhize/skill-forge 0.1.0 → 0.3.0

package/LICENSE

@@ -1,21 +1,30 @@
-MIT License
-
-Copyright (c) 2026 Rhize Media
-
-Permission is hereby granted, free of charge, to any person obtaining a copy
-of this software and associated documentation files (the "Software"), to deal
-in the Software without restriction, including without limitation the rights
-to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
-copies of the Software, and to permit persons to whom the Software is
-furnished to do so, subject to the following conditions:
-
-The above copyright notice and this permission notice shall be included in all
-copies or substantial portions of the Software.
-
-THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
-IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
-FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
-AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
-LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
-OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
-SOFTWARE.
+skill-forge licensing
+=====================
+
+This repository is open-core and uses a split license as of v0.2.0:
+
+- Everything EXCEPT the Pro Modules listed below is licensed under the MIT
+  License — see LICENSE-MIT.
+
+- The Pro Modules are source-available under the Rhize Commercial License —
+  see LICENSE-COMMERCIAL. Production use of their functionality requires a
+  valid license key.
+
+Pro Modules
+-----------
+
+- src/license.ts
+- src/gate/overlap.ts
+- src/provenance.ts
+- src/queue.ts
+
+...and the portions of built artifacts (e.g. dist/cli.js in the published npm
+package) generated from these files. Each Pro Module carries a header
+identifying its license.
+
+Notes
+-----
+
+- Versions up to and including 0.1.0 were published entirely under the MIT
+  License; this split applies from v0.2.0 onward.
+- Licensing inquiries: jim@rhize.media

package/LICENSE-COMMERCIAL

@@ -0,0 +1,42 @@
+Rhize Commercial License v1.0
+
+Copyright (c) 2026 Rhize Media (rhize.media)
+
+This license applies to the files identified as "Pro Modules" in the LICENSE file at
+the root of this repository, and to the portions of built artifacts generated from
+them (together, the "Pro Software"). The Pro Software is source-available. It is NOT
+open source and is NOT covered by the MIT license that applies to the rest of this
+repository.
+
+1. License required. Use of the Pro Software's functionality in production, or for
+   any commercial purpose, requires a valid skill-forge license key purchased from
+   Rhize Media.
+
+2. Permitted without a license key:
+   a. Viewing, auditing, and compiling the source code;
+   b. Evaluating the Pro Software's functionality for up to 30 days;
+   c. Submitting patches or contributions to the official repository.
+
+3. Prohibited:
+   a. Removing, disabling, or circumventing the license verification, or assisting
+      others in doing so;
+   b. Using the Pro Software's functionality beyond the evaluation period without a
+      valid license key;
+   c. Redistributing modified versions of the Pro Software;
+   d. Offering the Pro Software, or a service substantially based on it, to third
+      parties as a paid or unpaid service.
+
+4. Redistribution. The Pro Software may be redistributed only unmodified and only as
+   part of official @rhize/skill-forge releases.
+
+5. Termination. Any violation of this license immediately terminates the rights
+   granted by it.
+
+6. No warranty. THE PRO SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,
+   EXPRESS OR IMPLIED. IN NO EVENT SHALL RHIZE MEDIA BE LIABLE FOR ANY CLAIM, DAMAGES
+   OR OTHER LIABILITY ARISING FROM THE PRO SOFTWARE OR ITS USE.
+
+7. Reservation of rights. All rights not expressly granted are reserved by
+   Rhize Media.
+
+Licensing inquiries: jim@rhize.media

package/LICENSE-MIT

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 Rhize Media
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -24,7 +24,20 @@ promote/hold/reject decision**, before it is allowed anywhere near your working
 ## Quickstart
 
 ```bash
-npx skill-forge add <owner>/<skill-name>
+npx @rhize/skill-forge init
+```
+
+Optional, but recommended first: `init` detects which coding agents you have installed (Claude
+Code, Codex CLI, Cursor, Windsurf, OpenCode, Gemini CLI, and more), lets you pick which of their
+skill directories should be gated, a default promotion target, and an optional agent to hand
+follow-up prompts off to (see [`--ingest`](#ingestion-handoff---ingest)). No configuration is
+required for a first run either way — skip `init` and skill-forge defaults to `<cwd>/.claude/skills`
+as its promotion target and `~/.skill-forge/quarantine` as its sandbox (and offers to run `init` for
+you the first time `add`/`scan`/`list`/`status` runs with no config present, in an interactive
+terminal). See [docs/configuration.md](docs/configuration.md) for the full field reference.
+
+```bash
+npx @rhize/skill-forge add <owner>/<skill-name>
 ```
 
 One command runs the whole gate:
@@ -35,14 +48,10 @@ One command runs the whole gate:
 4. Runs overlap analysis against your configured skill set, if one is configured.
 5. Prints a report and asks you to **promote**, **hold**, or **reject** the candidate.
 
-No configuration is required for a first run: skill-forge defaults to `<cwd>/.claude/skills` as
-its promotion target and `~/.skill-forge/quarantine` as its sandbox. See
-[docs/configuration.md](docs/configuration.md) to change either.
-
 To gate a skill without installing it (always cleans up afterward):
 
 ```bash
-npx skill-forge scan <owner>/<skill-name>
+npx @rhize/skill-forge scan <owner>/<skill-name>
 ```
 
 `<source>` accepts a `skills.sh` `owner/name` slug, a git URL (`https://...`, `git@...`, or
@@ -51,12 +60,29 @@ anything ending in `.git`), or a local filesystem path.
 ## Commands
 
 ```
+skill-forge init [options]             Detect installed agents and set gate targets / handoff agent
 skill-forge add <source> [options]     Quarantine-install a skill and run it through the gate
-skill-forge scan <source>              Gate a skill without installing it (always cleans up)
+skill-forge scan <source> [options]    Gate a skill without installing it (always cleans up)
 skill-forge list                       List skills currently held in quarantine
 skill-forge status                     Show configuration and quarantine summary
 ```
 
+### `init`
+
+```bash
+skill-forge init              # interactive: pick targets, default target, handoff agent
+skill-forge init --defaults   # non-interactive: all detected agents, first as default (CI)
+skill-forge init --list       # print detected agent skill roots and exit — no writes
+```
+
+Probes the known agent matrix (`src/agents.ts`) for both project-relative (`.claude/skills`, ...)
+and global (`~/.codex/skills`, ...) skill directories that already exist on disk, then writes
+`skillsRoots`, `agents`, `defaultTarget`, and (if you pick a handoff agent) `handoffCommand` to
+`config.json`. Safe to re-run any time — it always starts from your existing config and only
+overwrites the fields it's responsible for. If no `config.json` exists yet, `add`/`scan`/`list`/
+`status` offer to run this for you on first use (skipped entirely for `--json`/`--yes`/non-TTY
+invocations, so scripted runs never block on a prompt).
+
 ### `add`
 
 ```bash
@@ -75,26 +101,28 @@ target skills root until you decide.
 |---|---|
 | *(none)* | Prompts you to **promote**, **hold**, or **reject** the candidate. |
 | `-y, --yes` | Skips the prompt and honors the gate verdict: a `block` safety verdict is rejected (process exits nonzero); anything else (`pass`/`warn`) is promoted. |
-| `-t, --target <dir>` | Skills root to promote into. Defaults to the config's `skillsRoots[0]`. |
-| `--json` | Prints the gate result (profile, safety findings, overlap) as JSON instead of the terminal report box. |
-| `--ingest` | Pro. After a successful promote, hands off to Claude — see [Claude handoff](#claude-handoff---ingest). |
+| `-t, --target <dir>` | Skills root to promote into. Defaults to the config's `defaultTarget`, then `skillsRoots[0]`. |
+| `--json` | Prints the gate result (profile, safety findings, overlap) as JSON instead of the terminal report box. Implies non-interactive: the decision is made the same way `--yes` makes it (verdict decides promote/hold/reject), never an interactive prompt. |
+| `--ingest` | Pro (free during the 0.x beta). After a successful promote, hands off to a coding agent — see [Ingestion handoff](#ingestion-handoff---ingest). |
 
-With a valid Pro license, a promoted skill gets a provenance entry appended to
-`<target>/SOURCES.md`, and every promote or hold decision is recorded to
-`~/.skill-forge/queue.json` (or `$SKILL_FORGE_HOME/queue.json`) — see
+A promoted skill gets a provenance entry appended to `<target>/SOURCES.md`, and every promote or
+hold decision is recorded to `~/.skill-forge/queue.json` (or `$SKILL_FORGE_HOME/queue.json`) — see
 [`docs/queue-schema.md`](docs/queue-schema.md) for the entry schema. A reject writes neither —
-nothing is left behind to record. Without a license, `add` prints a short upgrade notice in place
-of the ledger entry and queue write instead, and otherwise completes normally.
+nothing is left behind to record. These are Pro features that run free during the 0.x beta (see
+[docs/pro.md](docs/pro.md#beta-pricing-0x)): with no valid license, `add` still writes them, and
+prints a one-line notice above the report instead of skipping them.
 
 ### `scan`
 
 ```bash
 skill-forge scan owner/name
+skill-forge scan owner/name --json
 ```
 
 Runs the same gate pipeline as `add` (profile → safety → overlap → report) but never promotes
 anything — the quarantine sandbox is always cleaned up afterward, on success or failure. Exits
-nonzero when the safety verdict is `block`.
+nonzero when the safety verdict is `block`. `--json` prints the same gate-result payload shape as
+`add`'s.
 
 ### `list` / `status`
 
@@ -111,9 +139,10 @@ strictness) plus a count of held entries.
 | Safety gate — built-in ruleset + SkillSpector shell-out | ✓ | ✓ |
 | Terminal report + `--json` | ✓ | ✓ |
 | Promote / hold / reject decision | ✓ | ✓ |
+| `init` setup wizard (agent detection, gate targets, handoff agent) | ✓ | ✓ |
 | Overlap analysis against your configured skill set | | ✓ |
 | Provenance ledger (`SOURCES.md` audit trail) | | ✓ |
-| Pending-ingestion queue + `--ingest` Claude handoff | | ✓ |
+| Pending-ingestion queue + `--ingest` handoff | | ✓ |
 | Set-level organizer (capability registry, redundancy, dependency graph) | | ✓ |
 
 Free is the complete safety gate on its own — quarantine, profile, safety scan, and an explicit
@@ -121,13 +150,16 @@ promote/reject decision, with nothing held back. Pro is the curation layer on to
 candidate duplicates something you already have, and an ongoing provenance record across your
 whole skill set rather than a single install-time decision.
 
-**Current build status:** this is a pre-release build. Overlap analysis, the provenance ledger,
-and the pending-ingestion queue / `--ingest` handoff are gated on a valid license
-(`SKILL_FORGE_LICENSE` env var or `config.json`'s `licenseKey`, verified offline — see
-[docs/pro.md](docs/pro.md)); without one, `add` prints a short upgrade notice in place of each and
-otherwise completes normally. The set-level organizer and the skills.sh partner-audit enrichment
-are not yet exposed by any CLI command, licensed or not. See [docs/pro.md](docs/pro.md) for the
-per-feature implementation status.
+**Everything free until 1.0.** This is a 0.x beta build, and the Pro tier's runtime license check
+is intentionally asleep for the whole 0.x line: overlap analysis, the provenance ledger, and the
+pending-ingestion queue / `--ingest` handoff all run for everyone, licensed or not. Without a valid
+license (`SKILL_FORGE_LICENSE` env var or `config.json`'s `licenseKey`, verified offline), `add`
+prints a one-line notice — `Pro feature (...) — free during the 0.x beta; will require a license at
+1.0.` — above the report (or in the `--json` payload's `notices` array) and otherwise runs exactly
+as a licensed run would. At 1.0 the lock re-arms and these features go back to requiring a valid
+key. The set-level organizer and the skills.sh partner-audit enrichment are not yet exposed by any
+CLI command, licensed or not, beta or not. See [docs/pro.md](docs/pro.md) for the per-feature
+implementation status.
 
 ## Security model
 
@@ -152,37 +184,51 @@ per-feature implementation status.
   `VERCEL_OIDC_TOKEN`. The client exists (`src/gate/skillsSh.ts`) but `add`/`scan` do not call it
   yet in this build — see [docs/gate-policy.md](docs/gate-policy.md) for current status.
 
-## Claude handoff (`--ingest`)
+## Ingestion handoff (`--ingest`)
 
 `skill-forge` deliberately doesn't try to decide *what to extract* from a skill worth adopting —
 that deeper judgment (which patterns to keep, whether to absorb into an existing skill vs. fork a
-new one, verifying the result beats baseline) belongs to the companion Claude Code skill
-`rhize-skill-forge`, invoked via its `/rhize-meta:forge-ingest` slash command.
+new one, verifying the result beats baseline) is a job for a coding agent, not the gate. `--ingest`
+hands a promoted skill off to one, running the bundled, agent-neutral prompt at
+`assets/ingest-prompt.md` (Claude Code users get a deeper experience via the companion
+`rhize-skill-forge` plugin skill, but the bundled prompt works with any agent).
 
 ```bash
 skill-forge add owner/name --yes --ingest
 ```
 
-- If a `claude` binary is on `PATH`, skill-forge spawns it (inheriting your terminal) running
-  `claude -p "/rhize-meta:forge-ingest <installedPath>"`.
-- If not, skill-forge prints that exact command for you to run yourself.
-- Every promote or hold is recorded to the pending queue (`~/.skill-forge/queue.json`) regardless
-  of `--ingest` — nothing is lost if you skip the handoff. A later
-  `/rhize-meta:forge-ingest` run with no argument drains the whole pending queue.
+The command that gets run, in order:
+
+1. `config.handoffCommand` — an argv-style template (`["claude", "-p", "{prompt}"]`-shaped) set by
+   `skill-forge init`'s "handoff agent" prompt, with `{path}` (the installed skill) and `{prompt}`
+   (the bundled prompt file) substituted in. Never shell-parsed, so it's safe even if a substituted
+   path contains shell metacharacters.
+2. Otherwise, the first known agent binary found on `PATH` (`claude`, `codex`, `cursor-agent`,
+   `windsurf`, `opencode`, `gemini`), invoked generically with the prompt.
+3. Otherwise, skill-forge prints the prompt path and skill path for you to hand off yourself.
+
+Every promote or hold is recorded to the pending queue (`~/.skill-forge/queue.json`) regardless of
+`--ingest` — nothing is lost if you skip the handoff. See [`docs/queue-schema.md`](docs/queue-schema.md)
+for the entry schema.
 
 ## Configuration
 
-Config lives at `~/.skill-forge/config.json` (or `$SKILL_FORGE_HOME/config.json`):
+Config lives at `~/.skill-forge/config.json` (or `$SKILL_FORGE_HOME/config.json`). Run
+`skill-forge init` to generate it interactively, or write it by hand:
 
 ```json
 {
   "skillsRoots": ["/path/to/.claude/skills"],
   "quarantineDir": "/path/to/quarantine",
-  "strictness": "block-high"
+  "strictness": "block-high",
+  "defaultTarget": "/path/to/.claude/skills",
+  "agents": [{ "id": "claude-code", "skillsRoot": "/path/to/.claude/skills" }],
+  "handoffCommand": ["claude", "-p", "Read {prompt} and follow its instructions for the skill installed at {path}"]
 }
 ```
 
-Missing keys fall back to defaults (`skillsRoots: ["<cwd>/.claude/skills"]`). Full field reference,
+Missing keys fall back to defaults (`skillsRoots: ["<cwd>/.claude/skills"]`); `defaultTarget`,
+`agents`, and `handoffCommand` are optional and only written by `init`. Full field reference,
 including current caveats, in [docs/configuration.md](docs/configuration.md).
 
 ## FAQ
@@ -210,9 +256,22 @@ See [docs/gate-policy.md](docs/gate-policy.md).
 **Is there a license key or activation step?**
 An offline-verified license key exists (`SKILL_FORGE_LICENSE` env var or `config.json`'s
 `licenseKey`), but there's no `license`/`activate` CLI command — you set the key via config or
-environment, not a command. It gates overlap analysis, the provenance ledger, and the
-pending-ingestion queue / `--ingest` handoff. See [docs/pro.md](docs/pro.md) for details.
+environment, not a command. Through the 0.x beta the key doesn't gate anything: overlap analysis,
+the provenance ledger, and the pending-ingestion queue / `--ingest` handoff all run for everyone,
+with a one-line "free during the beta" notice if no valid key is set. See
+[docs/pro.md](docs/pro.md) for details.
 
 ## License
 
-MIT — see [LICENSE](LICENSE).
+skill-forge is open-core with a split license (as of v0.2.0):
+
+- **Free tier — MIT.** Everything except the Pro modules: quarantine install, profile,
+  safety gate, report, promote/hold/reject. See [LICENSE-MIT](LICENSE-MIT).
+- **Pro modules — Rhize Commercial License.** `src/license.ts`, `src/gate/overlap.ts`,
+  `src/provenance.ts`, `src/queue.ts` (overlap analysis, provenance ledger, pending
+  queue / `--ingest` handoff). The source is available to read and audit, but production
+  use of Pro functionality requires a license key — see
+  [LICENSE-COMMERCIAL](LICENSE-COMMERCIAL).
+
+[LICENSE](LICENSE) is the authoritative map of which files fall under which license.
+Versions up to and including 0.1.0 were published entirely under MIT.