activate-license

SkillStack License Activation

Configures npm registry access and activates license keys for paid SkillStack plugins.

Step 1: Check registry configuration

Run the registry check script:

node <this-skill-dir>/../../../scripts/check-registry.mjs --npmrc ~/.npmrc

Output: { registryConfigured, existingToken }

• If registryConfigured is false, run: npm config set @skillstack:registry https://mcp.skillstack.sh
• If already configured, note it and continue

Step 2: Ask about license key

Ask if the user has a license key for a paid plugin. If no, explain they're set for free plugins — give the storefront URL (https://store.skillstack.sh/s/{github_owner}/{marketplace_slug}/marketplace.json) and /plugin install command. Done.

Step 3: Get license key

Ask the user to paste their key. Mention they can find it in their purchase confirmation email, Polar.sh dashboard (Orders → License Keys), or Lemon Squeezy (My Orders).

Step 4: Auto-resolve the plugin

Call skillstack_resolve_key with the license key.

Every SkillStack tool reply is JSON in the response text with a status field — parse it and branch on status, never on prose.

• resolved: Confirm the plugin name. Save marketplace_command and install_command if present.
• multiple_matches: Show matches, ask user to pick.
• not_found: Tell user to double-check key. Loop back to Step 3.
• The tool call itself errors / times out / returns no JSON (transport or network failure, not a status): this is a SkillStack-side or connectivity issue, NOT the buyer's key. Tell the user, and retry once; if it still fails, suggest checking their connection or reaching [email protected]. Do NOT tell them their key is invalid.

Step 5: Check for existing token

Use the existingToken from Step 1. If an sst_* token exists, it will be passed to activation so the new plugin links to the same account.

Step 6: Activate the license

Call skillstack_activate with plugin_slug, license_key, and existing_token (if any).

On success:

1. Set the auth token: npm config set //mcp.skillstack.sh/:_authToken <token>
2. Confirm activation with license-type-specific context:
   • subscription: updates included while active
   • lifetime: all future updates included
   • onetime: locked to current version
3. Show install commands using marketplace_command and install_command from this response or from the skillstack_resolve_key response in Step 4. These fields contain the exact ready-to-run commands. If neither response included them, fall back to the storefront URL pattern: https://store.skillstack.sh/s/{github_owner}/{marketplace_slug}/marketplace.json.
4. Remind user to select "Install for you (user scope)" and restart Claude Code.

On failure — every failure is JSON with a status field and an actionable message. Branch on status:

• misconfigured: Creator's config is broken, not the buyer's fault. Show creator_contact if available; otherwise suggest reaching out to [email protected] for help. Do NOT suggest re-entering the key.
• key_bound_to_other_plugin: This key is already tied to another plugin (bound_plugin in response). Show the bound plugin name. Do NOT suggest re-entering the key — it will always fail. Suggest the user check their purchase confirmation email, or contact the plugin creator (creator_contact if available) or [email protected].
• plugin_not_found: The slug didn't match a registered plugin. Re-run Step 4 (skillstack_resolve_key) to auto-detect the right plugin from the key, or run skillstack_list. Not the key's fault.
• not_found: Invalid key — ask user to double-check and retry.
• distribution_limit: The plugin creator's free-tier distribution limit has been reached. Tell the buyer this is a creator-side limit, not their fault. Show creator_contact if available so they can reach out to the creator; otherwise suggest contacting [email protected].
• revoked: License revoked — suggest renewing subscription or contacting the plugin creator.
• expired: License expired — suggest renewing.
• disabled: License disabled — show the message and suggest contacting the plugin creator to restore access. Do NOT suggest re-entering the key.
• free: This plugin is free — no key needed. Tell the user and point them at the install command / storefront; skip activation for it.
• persist_failed: The key validated but SkillStack couldn't save the activation (transient server issue). Retry skillstack_activate once; if it persists, [email protected]. Do NOT tell the user their key is invalid.
• The tool call itself errors / times out / returns no JSON: transport/connectivity issue, not the key. Retry once, then suggest checking the connection or [email protected].
• Any other status: show the message (it's written to be actionable) and, if it names the creator, surface creator_contact; otherwise [email protected].

Step 7: Offer to activate another key

If user wants to activate another plugin, loop to Step 3. The existing token links all plugins.

Step 8: Recommend auto-updates

Mention that third-party marketplaces don't auto-update by default. They can enable it via /plugin → Marketplaces tab → select storefront → Enable auto-update. Informational only — don't block.