loadout-ai 0.5.9 → 0.6.0

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (16) hide show
  1. package/README.md +70 -113
  2. package/catalog/discovered.json +26482 -22861
  3. package/catalog/packages.json +2 -2
  4. package/dist/src/commands/catalog.js +132 -2
  5. package/dist/src/commands/inventory.js +2 -1
  6. package/dist/src/commands/support.js +22 -2
  7. package/dist/src/core/catalog.js +13 -0
  8. package/dist/src/core/cli-guide.js +8 -7
  9. package/dist/src/core/doctor.js +73 -24
  10. package/dist/src/core/handoff.js +161 -0
  11. package/dist/src/core/review-queue.js +7 -2
  12. package/dist/src/core/route.js +248 -0
  13. package/docs/CATALOG.md +2 -2
  14. package/docs/DISCOVERED.md +249 -248
  15. package/docs/UPSTREAM_LICENSE_DECISIONS.md +19 -12
  16. package/package.json +1 -1
package/docs/UPSTREAM_LICENSE_DECISIONS.md CHANGED
@@ -1,31 +1,38 @@
1
1
  # Upstream license decisions
2
2
 
3
- Reviewed on July 21, 2026 for the public release catalog.
3
+ Reviewed on July 21, 2026 for the public release catalog. Re-reviewed on August 30,
4
+ 2026: two of the original six records had identifiable repository-wide licenses and
5
+ were updated in `catalog/packages.json`; four remain `NOASSERTION`.
4
6
 
5
7
  Loadout records `NOASSERTION` when it cannot identify one repository-wide SPDX
6
8
  license from the inspected source. Popularity, an official publisher, or a public
7
9
  GitHub repository does not replace a license grant.
8
10
 
9
- ## Release decision
11
+ ## Resolved out of NOASSERTION (August 30, 2026)
10
12
 
11
- The six records below remain in the credited catalog as source metadata. Loadout
13
+ | Catalog record | Upstream source | Recorded decision |
14
+ | -------------- | --------------------------------------------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
15
+ | Vercel Skills | [vercel-labs/skills](https://github.com/vercel-labs/skills) | Updated `license` to `MIT`. The repository now carries a root `LICENSE` file (MIT, Vercel, Inc., 2026) and GitHub's license API confirms `mit`. No longer `NOASSERTION`. |
16
+ | Sentry MCP | [getsentry/sentry-mcp](https://github.com/getsentry/sentry-mcp) | Updated `license` to `FSL-1.1-ALv2`. The root `LICENSE.md` is the Functional Source License 1.1, Apache-2.0 Future License — a single, identifiable repository-wide license, just not one GitHub's detector classifies as a standard OSS license. **This is not a permissive OSI license**: it forbids "Competing Use" (offering the software, or a substitute for it, as a competing commercial product or service) until it converts to Apache-2.0 two years after each release. Sentry MCP is not part of Stable and should stay out of any default/non-custom mode; Power, Maximum, or Custom selections must show this restriction before fetch, not just a generic "review upstream terms" notice. |
17
+
18
+ ## Remaining NOASSERTION (four records)
19
+
20
+ The four records below remain in the credited catalog as source metadata. Loadout
12
21
  does not copy their source into the npm package, claim ownership, or assign them a
13
22
  license. A selected profile may fetch a pinned upstream snapshot only after showing
14
23
  the user a preview. MCP configuration and executable tools remain separate explicit
15
24
  actions.
16
25
 
17
- None of these six records is part of Stable. Stable continues to use four sources
26
+ None of these four records is part of Stable. Stable continues to use four sources
18
27
  with identified SPDX licenses. People who select Power, Maximum, or a Custom package
19
28
  must review the linked upstream terms before using content marked `NOASSERTION`.
20
29
 
21
- | Catalog record | Upstream source | Recorded decision |
22
- | ------------------------------ | ------------------------------------------------------------------------------- | ----------------------------------------------------------------------------------------------------------------------------------- |
23
- | OpenAI Skills Catalog | [openai/skills](https://github.com/openai/skills) | Retain the pinned catalog pointer with `NOASSERTION`; no repository-wide root license was identified. |
24
- | Anthropic Skills | [anthropics/skills](https://github.com/anthropics/skills) | Retain the pinned catalog pointer with `NOASSERTION`; no repository-wide root license was identified. |
25
- | Vercel Agent Skills | [vercel-labs/agent-skills](https://github.com/vercel-labs/agent-skills) | Retain the pinned catalog pointer with `NOASSERTION`; no repository-wide root license was identified. |
26
- | Vercel Skills | [vercel-labs/skills](https://github.com/vercel-labs/skills) | Retain the pinned catalog pointer with `NOASSERTION`; no repository-wide root license was identified. |
27
- | Sentry MCP | [getsentry/sentry-mcp](https://github.com/getsentry/sentry-mcp) | Retain the pinned catalog pointer with `NOASSERTION`; the root license file is not identified as a standard SPDX license by GitHub. |
28
- | Model Context Protocol Servers | [modelcontextprotocol/servers](https://github.com/modelcontextprotocol/servers) | Retain the pinned catalog pointer with `NOASSERTION`; the root license file is not identified as a standard SPDX license by GitHub. |
30
+ | Catalog record | Upstream source | Recorded decision |
31
+ | ------------------------------ | ------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ |
32
+ | OpenAI Skills Catalog | [openai/skills](https://github.com/openai/skills) | Retain `NOASSERTION`; the repository has no root `LICENSE` file of any kind. |
33
+ | Anthropic Skills | [anthropics/skills](https://github.com/anthropics/skills) | Retain `NOASSERTION`; the repository has no root `LICENSE` file of any kind. |
34
+ | Vercel Agent Skills | [vercel-labs/agent-skills](https://github.com/vercel-labs/agent-skills) | Retain `NOASSERTION`; the repository has no root `LICENSE` file of any kind. |
35
+ | Model Context Protocol Servers | [modelcontextprotocol/servers](https://github.com/modelcontextprotocol/servers) | Retain `NOASSERTION`; the root `LICENSE` file itself states the project is mid-transition from MIT to Apache-2.0 — new/relicensed contributions are Apache-2.0, contributions whose authors have not consented to relicensing remain MIT. No single SPDX identifier covers the whole repository, so this is a genuine mixed-license case, not a missing-file case. |
29
36
 
30
37
  This is a transparent product policy decision, not legal advice or a claim that the
31
38
  upstream material may be redistributed under Loadout's MIT license. Each upstream
package/package.json CHANGED
@@ -1,6 +1,6 @@
1
1
  {
2
2
  "name": "loadout-ai",
3
- "version": "0.5.9",
3
+ "version": "0.6.0",
4
4
  "private": false,
5
5
  "license": "MIT",
6
6
  "description": "Universal upgrade manager for AI coding agents",