loadout-ai 0.5.7 → 0.5.8

package/CHANGELOG.md

@@ -2,6 +2,13 @@
 
 ## Unreleased
 
+## 0.5.8 - 2026-07-21
+
+### Fixed
+
+- Make `install --mode custom` genuinely additive: it now keeps existing managed
+  skills active and does not replace the saved profile.
+
 ## 0.5.7 - 2026-07-21
 
 ### Changed

package/MASTER_PLAN.md

@@ -13,7 +13,7 @@ history** is evidence of how the product was built, not unfinished launch scope.
 
 ### Product complete
 
-- [x] Publish the CLI as `loadout-ai@0.5.6`; keep the product usable without cloning
+- [x] Publish the CLI as `loadout-ai@0.5.8`; keep the product usable without cloning
       this repository or providing an OpenAI/Anthropic API key.
 - [x] Ship Stable, Power, Maximum, and Custom profiles with preview-first apply,
       snapshots, drift protection, explicit rollback, removal, and complete uninstall.
@@ -35,16 +35,14 @@ history** is evidence of how the product was built, not unfinished launch scope.
 
 ### Final founder acceptance
 
-- [ ] Install the exact public npm release in a fresh terminal and run the final short
-      path: Humanizer Custom preview/apply/scan/rollback, read-only update/discovery,
-      complete uninstall, and clean reinstall. Stable, Power, Maximum, project
-      optimization, Graphify, and both-host Playwright MCP lifecycles have already
-      been exercised on the founder's real profiles.
-- [ ] Decide whether to rename the GitHub repository from `loadout` to `loadout-ai`.
-      If approved, rename it before recording and update canonical links; keep the
-      product name **Loadout** and npm package/CLI identity `loadout-ai` / `loadout`.
-- [ ] Make the six unresolved upstream-license decisions explicit. Do not silently
-      convert `NOASSERTION` into a license claim because a repository is popular.
+- [x] Install the exact public npm release, verify `loadout --version`, and scan the
+      founder's restored real profiles. Stable, Power, Maximum, project optimization,
+      Humanizer, Graphify, both-host Playwright MCP lifecycles, rollback, complete
+      uninstall, and clean reinstall were exercised during founder acceptance.
+- [x] Keep the GitHub repository name `loadout`. The product remains **Loadout** and
+      the npm package/CLI identities remain `loadout-ai` / `loadout`.
+- [x] Record explicit decisions for all six `NOASSERTION` sources in
+      `docs/UPSTREAM_LICENSE_DECISIONS.md` without inventing a license claim.
 
 ### Submission work
 
@@ -53,9 +51,11 @@ history** is evidence of how the product was built, not unfinished launch scope.
 - [ ] Replace the README demo placeholder with the final YouTube link.
 - [ ] In the voiceover, explain what Loadout does and how Codex and GPT-5.6 were used.
 - [ ] Run `/feedback` in Codex, copy the resulting session ID, and enter it in Devpost.
-- [ ] Confirm the repository URL is accessible to Devpost and OpenAI.
-- [ ] Confirm all team invitations are accepted, select **Developer Tools**, complete
-      the edited Devpost description, and submit rather than leaving a draft.
+- [x] Confirm the public repository URL is accessible to Devpost and OpenAI.
+- [x] Confirm all team invitations are accepted. Both teammates are collaborators and
+      there are no pending repository invitations.
+- [ ] Select **Developer Tools**, complete the edited Devpost description, and submit
+      rather than leaving a draft.
 
 ### Deliberately not part of this submission
 

package/README.md

@@ -34,7 +34,7 @@
 You need Node.js 20 or newer and Git.
 
 ```bash
-npm install --global loadout-ai@0.5.7
+npm install --global loadout-ai@0.5.8
 loadout setup --mode stable
 ```
 
@@ -87,10 +87,10 @@ Useful skills, plugins, MCP servers, and settings arrive one experiment at a tim
 Soon it is hard to remember what is installed, where it came from, whether something
 better launched yesterday, or how to undo a change. The name comes from games, where
 your loadout is the set of tools you choose for the mission. This does the same for AI
-coding agents—without making you rebuild the setup for every agent and every project.
+coding agents without making you rebuild the setup for every agent and every project.
 
 Most extension tools begin with a repo you already know. Loadout begins one step
-earlier—**what is actually worth knowing?**—and stays with you after installation.
+earlier: **what is actually worth knowing?** It stays with you after installation.
 
 Loadout watches a much wider catalog than it activates. You can keep thousands of
 technically screened skill copies in the disabled Maximum library, discover new projects as
@@ -112,7 +112,7 @@ their own explicit setup and permission steps.
 
 ### Demo
 
-**Demo video coming here.** The release walkthrough will show the real path—not a
+**Demo video coming here.** The release walkthrough will show the real path, not a
 mock UI: Stable install, cross-agent inventory, project optimization, update and
 discovery checks, MCP setup, Graphify, rollback, and complete uninstall. The exact
 under-three-minute [recording and voiceover script](./docs/DEMO_SCRIPT.md) is public.
@@ -122,7 +122,7 @@ commands you can run yourself.
 
 ## Stable workflow
 
-### Stable Boost — install the essentials and start building
+### Stable Boost: install the essentials and start building
 
 Stable is the recommended daily driver: **30 selected skill directories from four
 pinned public sources**, installed into each agent you choose. It covers planning,
@@ -181,7 +181,7 @@ checked by `loadout update` without moving them to a different agent path.
 
 Loadout is opinionated when you want it to be and precise when you do not.
 
-### Power Boost — a larger cross-project toolkit
+### Power Boost: a larger cross-project toolkit
 
 Power draws a skill-level allowlist from eight major collections. The prepared set
 is deduplicated and invalid units are quarantined, so the final count can be lower
@@ -203,11 +203,11 @@ skills per agent.
 loadout setup --mode power
 ```
 
-### Maximum Library — download broadly, activate intelligently
+### Maximum Library: download broadly, activate intelligently
 
 Maximum is for explorers. It downloads every non-archived, technically screened
 skill component in the catalog into Loadout's **disabled local library**. Disabled
-means cached and available—not injected into agent context. Then let the current
+means cached and available, not injected into agent context. Then let the current
 project choose a focused active set:
 
 ```bash
@@ -221,7 +221,7 @@ This is the difference between “install everything” and “have everything r
 The first overloads agents; the second gives you a large library with a small,
 relevant active loadout.
 
-### Custom — take exact control
+### Custom: take exact control
 
 Use `setup` when the listed packages should become the complete managed profile for
 the selected agents. Packages from the previous managed profile that are not listed
@@ -353,6 +353,10 @@ The checked-in discovery report proves only its dated snapshot, not the success
 
 <!-- loadout:current-limits:end -->
 
+The six records have an explicit public-release decision rather than an assumed
+license. Read [Upstream license decisions](./docs/UPSTREAM_LICENSE_DECISIONS.md) for
+the source-by-source record and the boundary applied to Power, Maximum, and Custom.
+
 Read the [security policy](./SECURITY.md), [catalog policy](./docs/CATALOG_POLICY.md), and [credential and update policy](./docs/CREDENTIAL_AND_UPDATE_POLICY.md) before trusting third-party content.
 
 ## Agent support
@@ -431,7 +435,7 @@ without loading thousands of skills into every prompt.
 | Ecosystem research | Compared repositories, checked source layouts and licenses, and separated popularity from evidence                           | 53 pinned catalog sources plus a discovery snapshot watching 240 repositories                               |
 | Implementation     | Wrote and refactored CLI commands, schemas, source fetchers, installers, active-set logic, and MCP configuration             | The published `loadout-ai` package and the commands documented above                                        |
 | Safety work        | Looked for scripts, hooks, binaries, credential references, target collisions, stale previews, and external edits            | Preview-first changes, quarantined skill units, explicit risk approval, drift protection, and rollback      |
-| Testing            | Generated adversarial cases, reproduced failures from real terminal sessions, and converted them into regression tests       | 620 passing tests, CLI and README end-to-end flows, package smoke tests, and a 1,000-skill performance gate |
+| Testing            | Generated adversarial cases, reproduced failures from real terminal sessions, and converted them into regression tests       | 625 passing tests, CLI and README end-to-end flows, package smoke tests, and a 1,000-skill performance gate |
 | Team integration   | Audited teammate branches, compared them with `main`, prepared focused pull requests, and checked what was actually complete | One public history instead of three disconnected prototypes                                                 |
 | Release work       | Verified npm contents, version behavior, GitHub metadata, documentation claims, and public CI                                | A public npm package, credited upstream catalog, release evidence, and a reproducible verification command  |
 
@@ -495,6 +499,7 @@ The repository's mixed README product-flow test uses an isolated build, disposab
 - [Daily discovery snapshot](./docs/DISCOVERED.md)
 - [Candidate inspection and promotion](./docs/CANDIDATE_INTELLIGENCE.md)
 - [Credential and update policy](./docs/CREDENTIAL_AND_UPDATE_POLICY.md)
+- [Upstream license decisions](./docs/UPSTREAM_LICENSE_DECISIONS.md)
 - [Changelog](./CHANGELOG.md)
 
 ## Contributing, security, and attribution

package/dist/src/cli.js

@@ -264,7 +264,7 @@ async function runSetup(options) {
         reader?.close();
     }
 }
-const LOADOUT_VERSION = "0.5.7";
+const LOADOUT_VERSION = "0.5.8";
 function durableSchedulerLauncher() {
     return [
         join(dirname(process.execPath), process.platform === "win32" ? "npx.cmd" : "npx"),
@@ -2711,6 +2711,7 @@ program
         const prepared = await prepareCatalogInstall(setupSelection(options.mode, packageIds), {
             requestedAgents: parseAgentSelection(options.agents),
             onProgress: printSetupProgress,
+            additive: options.mode === "custom",
         });
         console.log(formatPreparedCatalogInstall(prepared, {
             details: options.details,

package/dist/src/core/catalog-install.js

@@ -179,7 +179,7 @@ export async function prepareCatalogInstall(selection, options = {}) {
         });
         return false;
     });
-    const reconciliation = selection.mode === "maximum"
+    const reconciliation = selection.mode === "maximum" || options.additive
         ? {
             obsoleteActivationKeys: [],
             obsoletePackageIds: [],
@@ -189,6 +189,7 @@ export async function prepareCatalogInstall(selection, options = {}) {
         : await planManagedProfileReconciliation(usableEntries);
     return {
         selection,
+        additive: options.additive ?? false,
         resolution,
         agents,
         entries: usableEntries,
@@ -217,6 +218,8 @@ export function formatPreparedCatalogInstall(prepared, options = {}) {
         `Separately billed model API access: ${formatModelApiAccess(prepared.access)} (ChatGPT and Claude subscriptions do not count as API access)`,
         "Automatic skill setup does not require an OpenAI, Anthropic, or OpenRouter API key; credentialed MCP/runtime integrations remain explicit and deferred.",
     ];
+    if (prepared.additive)
+        lines.push("Additive install: existing managed skills will stay active.");
     if (directoriesPerAgent > RECOMMENDED_ACTIVE_SKILL_LIMIT)
         lines.push(`Capacity notice: about ${directoriesPerAgent} skill directories per agent exceeds Stable's ${RECOMMENDED_ACTIVE_SKILL_LIMIT}-skill bound.${prepared.selection.mode === "maximum" ? " Maximum stores them in the disabled library; optimize or activate a project-relevant working set." : prepared.selection.mode === "power" ? " Power is the explicit larger active mode; choose Stable or project optimization when lower context use matters." : " Use project-aware activation for a smaller working set."}`);
     if (failures.length)
@@ -263,11 +266,15 @@ export async function applyPreparedCatalogInstall(prepared, options = {}) {
         })
         : applySkillInstallBatch(prepared.entries, [], {
             replaceManagedTargets: true,
-            reconcileManagedTargets: true,
+            reconcileManagedTargets: !prepared.additive,
             ...(prepared.reconciliation
                 ? { expectedReconciliation: prepared.reconciliation }
                 : {}),
-            afterRecord: () => recordInstalledProfile(prepared).then(() => undefined),
+            ...(prepared.additive
+                ? {}
+                : {
+                    afterRecord: () => recordInstalledProfile(prepared).then(() => undefined),
+                }),
         });
 }
 export function formatCatalogApplyGuidance(riskApprovalRequired) {

package/docs/DEMO_SCRIPT.md

@@ -1,6 +1,6 @@
 # Loadout demo and voiceover
 
-Target length: **2:35–2:50**. Record the real CLI, cut fetch waits and typing, and do
+Target length: **2:35 to 2:50**. Record the real CLI, cut fetch waits and typing, and do
 not show the retired dashboard. The final YouTube upload must be public.
 
 ## Before recording
@@ -10,7 +10,7 @@ not show the retired dashboard. The final YouTube upload must be public.
 2. Confirm the release and product health:
 
    ```bash
-   npm install --global loadout-ai@0.5.7
+   npm install --global loadout-ai@0.5.8
    hash -r
    loadout --version
    loadout health
@@ -24,7 +24,7 @@ not show the retired dashboard. The final YouTube upload must be public.
 
 ## Shot list and exact narration
 
-### 0:00–0:15 — the problem
+### 0:00 to 0:15: the problem
 
 **Screen:** README hero, then a terminal showing `loadout --version`.
 
@@ -35,7 +35,7 @@ not show the retired dashboard. The final YouTube upload must be public.
 > or how to undo it. I built Loadout: one local CLI to discover, inspect, install,
 > update, and roll back agent extensions across Codex, Claude Code, and other agents.
 
-### 0:15–0:50 — one safe install
+### 0:15 to 0:50: one safe install
 
 **Screen:** Run the preview, then apply. Cut the fetch wait, not the result.
 
@@ -52,7 +52,7 @@ loadout setup --mode stable --agents codex,claude-code --api-access none --yes
 > transaction and gives me a rollback snapshot. My ChatGPT and Claude subscriptions
 > are not treated as API keys, and normal skill setup does not need one.
 
-### 0:50–1:12 — see what changed and undo it
+### 0:50 to 1:12: see what changed and undo it
 
 **Screen:**
 
@@ -70,25 +70,26 @@ loadout rollback --snapshot <stable-snapshot-id>
 > preserving unrelated skills. I use the exact snapshot ID shown by the install, so
 > there is no ambiguity. Complete uninstall is available too.
 
-### 1:12–1:42 — broad library, focused project
+### 1:12 to 1:42: broad catalog, focused project
 
-**Screen:** Use the already downloaded Maximum library from the acceptance run. Show
-the first part of `library`, then run the two read-only commands.
+**Screen:** Show the profile choices, catalog coverage, and a real project
+recommendation. These commands are read-only and do not require a prepared Maximum
+library.
 
 ```bash
-loadout library
+loadout profiles
+loadout catalog --coverage
 loadout recommend --project . --agent codex
-loadout optimize --project . --agents codex,claude-code --limit 30
 ```
 
 **Say:**
 
-> Maximum does not dump thousands of skills into every prompt. It keeps the broad
-> screened catalog disabled, detects this TypeScript CLI project, and proposes a
-> focused active set for each agent. That is the core idea: discover broadly, activate
-> narrowly, and keep every change reversible.
+> Loadout has three useful levels. Stable installs a bounded daily set. Power is
+> broader. Maximum keeps a large screened library disabled instead of dumping every
+> skill into every prompt. For this TypeScript CLI, the project recommender proposes
+> tools for documentation, testing, security, and MCP work without changing anything.
 
-### 1:42–2:05 — MCP, tools, and custom skills
+### 1:42 to 2:05: MCP, tools, and custom skills
 
 **Screen:**
 
@@ -106,7 +107,7 @@ loadout install --mode custom --package humanizer --agents codex
 > skill such as Humanizer can be installed directly through Custom mode. Each path
 > discloses permissions and credentials before approval.
 
-### 2:05–2:25 — today and tomorrow
+### 2:05 to 2:25: today and tomorrow
 
 **Screen:**
 
@@ -121,7 +122,7 @@ loadout discover --limit 5
 > watches a wider ecosystem and queues new projects for review, so something going
 > viral can be noticed quickly without being trusted blindly.
 
-### 2:25–2:48 — Codex, GPT-5.6, and close
+### 2:25 to 2:48: Codex, GPT-5.6, and close
 
 **Screen:** README section “Built with Codex and GPT-5.6”, then return to the hero.
 
@@ -138,7 +139,7 @@ loadout discover --limit 5
 
 - Remove loading screens, typing pauses, repeated commands, notifications, and secrets.
 - Keep terminal output readable at 1080p; do not use a synthetic dashboard or mock data.
-- Add a small title card: **Loadout — Agent extensions, under control.**
+- Add a small title card: **Loadout: Agent extensions, under control.**
 - Export under three minutes and upload publicly to YouTube.
 - Watch the uploaded video once, confirm audio and text are legible, then paste the
   exact public URL into README and Devpost.

package/docs/SUBMISSION_COPY.md

@@ -0,0 +1,90 @@
+# Devpost submission copy
+
+Edit this in your own voice before submitting. Replace the video placeholder and
+check every link while signed out.
+
+## Project name
+
+Loadout
+
+## Tagline
+
+One CLI to discover, install, update, and undo the best extensions for your AI coding
+agents.
+
+## Category
+
+Developer Tools
+
+## Short category and project answer
+
+We are building for the Developer Tools category. Loadout is a local CLI that finds,
+screens, installs, updates, and rolls back skills, MCP servers, and runtime tools
+across Codex, Claude Code, Cursor, and other coding agents, with project-aware
+recommendations and a daily read-only discovery feed.
+
+## Project description
+
+Improving an AI coding agent still means hunting through GitHub, Reddit, X, and
+bookmarks, then copying files into several different agent directories. A week later,
+you may not remember where a skill came from, whether a better option has appeared,
+or how to remove it safely.
+
+Loadout turns that mess into one local CLI. Stable installs a bounded 30-skill daily
+setup from four pinned public sources. Power prepares a broader toolkit. Maximum
+keeps thousands of screened skill copies in a disabled local library, then recommends
+a focused active set for the current project. Custom mode installs one exact package
+without replacing the rest of your setup.
+
+Every change is previewed first. Loadout records source and version ownership, checks
+for collisions and risky files, protects user edits, and creates a rollback snapshot
+before it changes managed files. MCP servers and executable tools remain separate,
+explicit choices. The normal skill workflow does not require an OpenAI or Anthropic
+API key.
+
+The bundled catalog credits 53 pinned public repositories. A generated discovery
+snapshot currently watches 240 repositories, including 216 candidates that have not
+been promoted into the catalog. Loadout treats popularity as a reason to inspect a
+project, not proof that it is safe or useful.
+
+We built Loadout with Codex and GPT-5.6 during OpenAI Build Week. We used Codex for
+architecture, implementation, repository research, threat modelling, cross-platform
+work, and the founder testing loop. Real tests on Codex and Claude Code exposed bugs
+in rollback history, update performance, project activation, MCP configuration,
+runtime-tool inventory, and adopted-skill removal. Each reproducible failure became a
+regression test. The current release passes 625 tests, packaged CLI journeys, public
+CI, and a 1,000-skill performance gate.
+
+Loadout is published on npm and the code is public. The dashboard was deliberately
+removed because it duplicated the CLI and made the product harder to understand. The
+result is the product we wanted to use ourselves: one command-line control layer for
+the extensions around every AI coding agent.
+
+## Links
+
+- GitHub: https://github.com/VirajMishra1/loadout
+- npm: https://www.npmjs.com/package/loadout-ai
+- Release: https://github.com/VirajMishra1/loadout/releases/tag/v0.5.8
+- Demo: PASTE_PUBLIC_YOUTUBE_URL_HERE
+
+## Judge testing path
+
+```bash
+npm install --global loadout-ai@0.5.8
+loadout --version
+loadout guide
+loadout setup --mode stable
+```
+
+The Stable command previews first. It changes nothing until the reviewer approves
+the plan. The README and user test guide cover rollback, Maximum, project
+recommendations, MCP recipes, Graphify, discovery, and complete uninstall.
+
+## Final fields to verify
+
+- Category is Developer Tools.
+- All three teammates appear on the Devpost submission.
+- The public YouTube URL works while signed out.
+- The Codex `/feedback` session ID is present.
+- The GitHub, npm, and video links are correct.
+- The submission is submitted, not saved as a draft.

package/docs/UPSTREAM_LICENSE_DECISIONS.md

@@ -0,0 +1,32 @@
+# Upstream license decisions
+
+Reviewed on July 21, 2026 for the public `0.5.8` release.
+
+Loadout records `NOASSERTION` when it cannot identify one repository-wide SPDX
+license from the inspected source. Popularity, an official publisher, or a public
+GitHub repository does not replace a license grant.
+
+## Release decision
+
+The six records below remain in the credited catalog as source metadata. Loadout
+does not copy their source into the npm package, claim ownership, or assign them a
+license. A selected profile may fetch a pinned upstream snapshot only after showing
+the user a preview. MCP configuration and executable tools remain separate explicit
+actions.
+
+None of these six records is part of Stable. Stable continues to use four sources
+with identified SPDX licenses. People who select Power, Maximum, or a Custom package
+must review the linked upstream terms before using content marked `NOASSERTION`.
+
+| Catalog record                 | Upstream source                                                                 | Recorded decision                                                                                                                   |
+| ------------------------------ | ------------------------------------------------------------------------------- | ----------------------------------------------------------------------------------------------------------------------------------- |
+| OpenAI Skills Catalog          | [openai/skills](https://github.com/openai/skills)                               | Retain the pinned catalog pointer with `NOASSERTION`; no repository-wide root license was identified.                               |
+| Anthropic Skills               | [anthropics/skills](https://github.com/anthropics/skills)                       | Retain the pinned catalog pointer with `NOASSERTION`; no repository-wide root license was identified.                               |
+| Vercel Agent Skills            | [vercel-labs/agent-skills](https://github.com/vercel-labs/agent-skills)         | Retain the pinned catalog pointer with `NOASSERTION`; no repository-wide root license was identified.                               |
+| Vercel Skills                  | [vercel-labs/skills](https://github.com/vercel-labs/skills)                     | Retain the pinned catalog pointer with `NOASSERTION`; no repository-wide root license was identified.                               |
+| Sentry MCP                     | [getsentry/sentry-mcp](https://github.com/getsentry/sentry-mcp)                 | Retain the pinned catalog pointer with `NOASSERTION`; the root license file is not identified as a standard SPDX license by GitHub. |
+| Model Context Protocol Servers | [modelcontextprotocol/servers](https://github.com/modelcontextprotocol/servers) | Retain the pinned catalog pointer with `NOASSERTION`; the root license file is not identified as a standard SPDX license by GitHub. |
+
+This is a transparent product policy decision, not legal advice or a claim that the
+upstream material may be redistributed under Loadout's MIT license. Each upstream
+project keeps its own copyright and terms.

package/docs/USER_TEST_GUIDE.md

@@ -211,7 +211,7 @@ cleanup deliberately deletes Loadout's snapshots, so it is the last lifecycle te
 ## Troubleshooting and recovery
 
 - **`loadout` is not found after installation:** confirm `npm install --global
-loadout-ai@0.5.7` completed, run `hash -r`, and confirm npm's global binary
+loadout-ai@0.5.8` completed, run `hash -r`, and confirm npm's global binary
   directory is on `PATH`. For a source checkout, run `npm run build` and `npm link`.
 - **A preview asks for `--approve-risk`:** read the reported scripts, domains,
   credentials, binaries, or instruction findings. If you accept that specific plan,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "loadout-ai",
-  "version": "0.5.7",
+  "version": "0.5.8",
   "private": false,
   "license": "MIT",
   "description": "Universal upgrade manager for AI coding agents",