toga-ai 1.0.1021 → 1.0.1023

package/.claude/settings.json

@@ -234,6 +234,15 @@
 						"timeout": 5000
 					}
 				]
+			},
+			{
+				"hooks": [
+					{
+						"type": "command",
+						"command": "node \"$CLAUDE_PROJECT_DIR/.claude/hooks/toga/harness-version-check.js\"",
+						"timeout": 5000
+					}
+				]
 			}
 		],
 		"Stop": [
@@ -270,7 +279,6 @@
 		"allow": [
 			"Bash(node .claude/knowledge.js *)",
 			"Bash(node .claude/hooks/toga/*.js)",
-			"Bash(node sync-skills.js *)",
 			"Bash(node scripts/harness.js *)",
 			"Bash(node scripts/install.js *)",
 			"Bash(php -l *)",

package/CLAUDE.md

@@ -13,7 +13,7 @@ loops that keep the main conversation lean.
 
 ## Skills (Claude Code slash commands)
 
-Install them into any project with `node sync-skills.js <project-path>`, then call them
+Install them into any project with `npx toga-ai@latest`, then call them
 as `/skill-name` inside Claude Code.
 
 | Skill | Command | When to use |
@@ -63,7 +63,7 @@ contents.
 
 ### Agents
 
-These install into a project's `.claude/agents/toga/` via `npx toga-ai`:
+These install into a project's `.claude/agents/toga/` via `npx toga-ai@latest`:
 
 - **context-primer** — DEPRECATED (2026-08-13); `/start` now primes in the main session, not via this agent.
 - **session-capture** — capture write pipeline; search → classify → draft → write → publish.
@@ -207,14 +207,10 @@ node knowledge.js search --framework=2.0 --repo=worker2 --q=<keywords>
 # Resolve dependency load order for a repo
 node knowledge.js deps --repo=worker2
 
-# Sync skills into a project
-node sync-skills.js [project-path]
-
 # Harness utilities (audit, status, new-repo wizard)
 node scripts/harness.js audit
 node scripts/harness.js status
 node scripts/harness.js new-repo
-node scripts/harness.js sync [project-path]
 ```
 
 ---
@@ -308,5 +304,5 @@ hook runs automatically and warns you of any frontmatter or schema errors.
 
 Pull latest skills, agents, and knowledge from the team repo:
 ```
-npx toga-ai
+npx toga-ai@latest
 ```

package/README.md

@@ -6,7 +6,7 @@ Shared Claude Code skills, configuration, and the team **knowledge base** for TO
 
 Do this once per developer. The harness has two independent parts: the **ECC plugin**
 (provides the `ecc:*` reviewer agents the TOGA agents delegate to) and the **TOGA harness**
-(`npx toga-ai`, which installs the skills, agents, rules, and knowledge base). Install order
+(`npx toga-ai@latest`, which installs the skills, agents, rules, and knowledge base). Install order
 between the two does not matter.
 
 **Prerequisites** (must already be installed):
@@ -28,7 +28,7 @@ between the two does not matter.
    ```
 3. Open a **new terminal**, and **from inside the project repo you'll work in**, run:
    ```
-   npx toga-ai
+   npx toga-ai@latest
    ```
    This installs the harness into that project's `.claude/` and clones the shared knowledge
    repo to `~/toga-tech`. **Run it once in each project folder** you work in.
@@ -39,7 +39,7 @@ between the two does not matter.
 > `agilantsolutions/claude`. Each developer must be a **collaborator on that repo with git
 > credentials configured** (HTTPS token / credential manager or SSH). Without it, `/finish`
 > still writes docs locally but the push fails silently — so the developer won't be
-> contributing knowledge back. `npx toga-ai` then delivers everyone's captured knowledge to
+> contributing knowledge back. `npx toga-ai@latest` then delivers everyone's captured knowledge to
 > the whole team on each run.
 
 ## Skills
@@ -92,21 +92,21 @@ developer references a repo on a new machine, the skill asks "What is the path t
 ## How skills are deployed
 
 Claude Code loads skills from `.claude/skills/` at the project root. The skills in this repo
-are the source of truth — run the sync script to copy them into that directory.
+are the source of truth — `npx toga-ai@latest` copies them into that directory.
 
-## Syncing skills
+## Updating skills
 
-After pulling new skills from this repo, run:
+Run this from the project root to install the latest skills, agents, rules, and knowledge:
 
 ```
-node claude/sync-skills.js
+npx toga-ai@latest
 ```
 
-Works on Mac and PC. Run it from anywhere inside the project.
+Works on Mac and PC.
 
 ## Adding a skill
 
 1. Create a directory under `skills/` with your skill name.
 2. Add a `SKILL.md` with YAML frontmatter (`name`, `description`) and the instructions.
-3. Run `node claude/sync-skills.js` to deploy it.
+3. Publish a new `toga-ai` version; teammates get it on `npx toga-ai@latest`.
 4. Update the table above.

package/agents/harness-optimizer.md

@@ -66,7 +66,7 @@ Score: <N>/100
 **Overall: 72/100**
 
 ### Priority Fixes (by score impact)
-1. [HOOKS -15pts] post-edit-validate.js exits with error → `npx toga-ai` to reinstall
+1. [HOOKS -15pts] post-edit-validate.js exits with error → `npx toga-ai@latest` to reinstall
 2. [KNOWLEDGE -10pts] validate ERROR in worker2/architecture.md → fix frontmatter
 3. [ECC +5pts] Install ECC for 200+ specialist agents → `claude plugin add ecc`
 ```

package/agents/session-capture.md

@@ -119,7 +119,7 @@ so the whole capture pushes once after approval. Act on the `PUBLISH:` line:
 `PUSHED` → done · `NO_CHANGES` → nothing durable · `VALIDATE_FAILED` → fix the printed
 `ERROR:` lines and re-publish · `CONFLICT` → resolve, re-publish ·
 `ABORT_OUTSIDE_KNOWLEDGE` → investigate · `NOT_GIT` → local-only, tell dev to run
-`npx toga-ai` · `PUSH_FAILED` → return the manual-push command.
+`npx toga-ai@latest` · `PUSH_FAILED` → return the manual-push command.
 
 ## Step 7 — Report (your entire output, kept short)
 

package/knowledge/1.0/apps/worker/features/staples-asn-856-outbound.md

@@ -6,7 +6,7 @@ project: Worker
 client: staples
 type: client-feature
 status: active
-updated: 2026-10-01
+updated: 2026-10-14
 owners: [mhammontree]
 files:
   - worker/crons/sync/staples/staples_asn_netsuite.php
@@ -20,7 +20,7 @@ related:
   - ../../library/features/mvc-page-pattern-and-app-skeleton.md
 ---
 
-Hourly cron sending Staples 856 ASNs for shipped NetSuite item fulfillments, one row per fulfillment in `Common.StaplesAdvanceShipNotices`; open for the queue/retry/dedupe design, the 855 gate, statuses, manual SKIPPED, alerts, and how to test it locally.
+Hourly cron sending Staples 856 ASNs for shipped NetSuite item fulfillments, one row per fulfillment in `Common.StaplesAdvanceShipNotices`; open for the queue/retry/dedupe design, the 855 gate, statuses, manual SKIPPED, alerts, how to test it locally, and how to check a "missing ASN" report.
 
 ## Summary
 
@@ -48,6 +48,14 @@ Each run (`cronInitialization(14400, false)` — must **not** use the read clust
 
 **Deploy order:** merge dbchanges first (`_production` applies on the next worker deploy), then deploy worker.
 
+## Checking a missing-ASN report
+
+1. **Table** (env `legacy`, 1.0 prod): `SELECT * FROM Common.StaplesAdvanceShipNotices WHERE poNumber IN (...)`. `SENT` + `dtSent` + `fileName` is the main proof. `dt*` columns are Central time (America/Chicago). The last part of `856_<PO>_<fulfillmentInternalId>_<n>` is the send's Unix timestamp — compare it to the SFTP file time.
+2. **NetSuite** `itemship.nl?id=<itemFulfillmentInternalId>`: Date (created), Shipped Date, SO. The job queues a fulfillment only once `shipStatus` is `_shipped`, so the row's `dtCreated` is the first run that saw it Shipped.
+3. **SFTP `/archive`** holds `855_<PO>_*` and `856_<PO>_*` once Staples picked them up.
+
+Usual answer (TRUE-82655, 9 POs over 2 rounds): every ASN was sent; the client checked before the fulfillment was Shipped in NetSuite (shipping was 1-3 days after the 855). No code issue. Client proof reports were built from these 3 sources.
+
 ## Testing locally
 
 1. Load prod `Common` locally and run `dbchanges/Common/MH/2026-09-30.sql`.
@@ -65,3 +73,4 @@ Expected (2026-10-01 run): first run 101 rows, 90 matched as already sent by the
 
 ## Change history
 - 2026-10-01 — First doc. TRUE-82180 rewrite: `StaplesAdvanceShipNotices` queue with 7-day lookback, shipping-hash dedupe, per-row retry/FAILED, 24 h alert, test mode never uploads, old-job match for pre-go-live shipments. Committed worker `cf5198a27`, dbchanges `8b1f7cb` on branch TRUE-82180; not deployed as of 2026-10-01. (mhammontree)
+- 2026-10-14 — Added "Checking a missing-ASN report" (TRUE-82655 investigation: all reported ASNs were sent, client checked before Shipped). (mhammontree)

package/knowledge.js

@@ -459,7 +459,7 @@ function cmdPublish(args) {
 
     // 0. must be a git clone
     try { run('git rev-parse --git-dir'); }
-    catch { console.log('PUBLISH: NOT_GIT — knowledge written locally only; run `npx toga-ai` to create a pushable clone'); return; }
+    catch { console.log('PUBLISH: NOT_GIT — knowledge written locally only; run `npx toga-ai@latest` to create a pushable clone'); return; }
 
     // 1. validate (inherit output so any ERROR: lines are visible); abort on failure
     try { cp.execSync(`"${node}" "${self}" validate`, { cwd: TEAM, stdio: 'inherit' }); }
@@ -498,7 +498,7 @@ function cmdPublish(args) {
             run('git fetch origin');
             run(`git rebase --autostash origin/${branch}`);
             run(`git push origin HEAD:${branch}`);
-            console.log(`PUBLISH: PUSHED to ${branch} — CI publishes a new npm version; teammates get it on \`npx toga-ai\``);
+            console.log(`PUBLISH: PUSHED to ${branch} — CI publishes a new npm version; teammates get it on \`npx toga-ai@latest\``);
             return;
         } catch (e) {
             lastError = String((e && (e.stderr || e.stdout)) || (e && e.message) || '').trim();
@@ -944,7 +944,7 @@ function cmdSessionSave(args) {
     if (!['active', 'stale'].includes(data.status)) { console.log('SESSION: INVALID — status must be active|stale'); process.exitCode = 1; return; }
     const secrets = scanSecrets(content);
     if (secrets.length) { console.log('SESSION: SECRET — ' + secrets.map(s => `line ${s.line}: ${s.reason}`).join('; ') + '; redact before saving'); process.exitCode = 1; return; }
-    if (!isGitClone()) { console.log('SESSION: NOT_GIT — session written locally only; run `npx toga-ai` to create a pushable clone'); return; }
+    if (!isGitClone()) { console.log('SESSION: NOT_GIT — session written locally only; run `npx toga-ai@latest` to create a pushable clone'); return; }
     const rel = 'knowledge/sessions/' + path.basename(abs);
     gitRun(`git add "${rel}"`);
     reportSession(pushStaged({ msg: args.msg || ('session: ' + data.slug), branch: args.branch, restrictPrefix: 'knowledge/sessions/' }), args.branch);
@@ -1032,7 +1032,7 @@ function cmdSkills(args) {
     if (args.json) { console.log(JSON.stringify(rows)); return; }
     console.log(padTo('STATUS', 11) + ' ' + padTo('SKILL', 22) + ' DESCRIPTION');
     for (const r of rows) console.log(padTo(r.status, 11) + ' ' + padTo(clip(r.skill, 22), 22) + ' ' + clip(r.description, 90));
-    if (installed && rows.some(r => r.status === 'available')) console.log('\nRun npx toga-ai to install the "available" skills.');
+    if (installed && rows.some(r => r.status === 'available')) console.log('\nRun npx toga-ai@latest to install the "available" skills.');
 }
 
 /* ------------------------------------------------------------------ */

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "toga-ai",
-  "version": "1.0.1021",
+  "version": "1.0.1023",
   "description": "TOGA Technology Team Claude Knowledge System — shared AI coding harness with skills, knowledge base CLI, and project installer for Claude Code.",
   "keywords": [
     "claude",
@@ -28,8 +28,7 @@
   "scripts": {
     "postinstall": "node scripts/install.js --post-install",
     "validate": "node knowledge.js validate",
-    "index": "node knowledge.js index",
-    "sync": "node sync-skills.js"
+    "index": "node knowledge.js index"
   },
   "files": [
     "agents/",
@@ -42,7 +41,6 @@
     ".claude/settings.json",
     "knowledge/",
     "knowledge.js",
-    "sync-skills.js",
     "CLAUDE.md"
   ],
   "main": "knowledge.js",

package/rules/common/communication.md

@@ -108,7 +108,7 @@ back to dense wording and teammates missed critical details. To stop that, a hoo
 - `scripts/hooks/plain-talk.js` runs on **every** developer turn (`UserPromptSubmit`). It
   injects a short reminder of these rules — plus the "mirror the person" instruction — into
   context right before each reply. So the model is reminded every turn, not just once.
-- The hook is wired in `.claude/settings.json` and ships to every repo on `npx toga-ai`.
+- The hook is wired in `.claude/settings.json` and ships to every repo on `npx toga-ai@latest`.
 - It never blocks anything; it only nudges. To silence it, set `TOGA_PLAIN_TALK_DISABLED=1`.
 
 ## Remember each person across sessions — style AND how they like to work

package/scripts/harness.js

@@ -5,7 +5,6 @@
  *
  * Commands:
  *   audit              Validate knowledge base, check completeness, output score 0-100
- *   sync [path]        Sync skills into a project's .claude/skills/
  *   status             Show knowledge base statistics and last git commit info
  *   new-repo           Interactive wizard to onboard a new repo into registry.json
  *
@@ -332,27 +331,6 @@ function cmdAudit() {
     process.exitCode = score < 60 ? 1 : 0;
 }
 
-/* ------------------------------------------------------------------ */
-/* command: sync                                                       */
-/* ------------------------------------------------------------------ */
-
-function cmdSync(args) {
-    const projectPath = args[0] || null;
-    const syncScript = path.join(REPO_ROOT, 'sync-skills.js');
-    if (!fs.existsSync(syncScript)) {
-        console.error('ERROR: sync-skills.js not found at ' + syncScript);
-        process.exit(1);
-    }
-    const spawnArgs = [syncScript];
-    if (projectPath) spawnArgs.push(projectPath);
-    const result = spawnSync('node', spawnArgs, {
-        cwd: process.cwd(),
-        stdio: 'inherit',
-        encoding: 'utf8'
-    });
-    process.exitCode = result.status || 0;
-}
-
 /* ------------------------------------------------------------------ */
 /* command: status                                                     */
 /* ------------------------------------------------------------------ */
@@ -576,9 +554,6 @@ async function main() {
         case 'audit':
             cmdAudit();
             break;
-        case 'sync':
-            cmdSync(rest);
-            break;
         case 'status':
             cmdStatus();
             break;
@@ -592,7 +567,6 @@ async function main() {
             console.log('');
             console.log('Commands:');
             console.log('  audit              Validate + completeness check, score 0-100');
-            console.log('  sync [path]        Sync skills into a project .claude/skills/');
             console.log('  status             Show knowledge base statistics');
             console.log('  new-repo           Interactive wizard to onboard a new repo');
             process.exitCode = 1;

package/scripts/hooks/harness-version-check.js

@@ -0,0 +1,74 @@
+#!/usr/bin/env node
+'use strict';
+
+/*
+ * harness-version-check.js — SessionStart: warn when the installed TOGA harness is stale.
+ *
+ * Reads <project>/.claude/toga-ai.version and compares it with the latest toga-ai on npm.
+ * The npm answer is cached in ~/.claude/toga-ai-latest.json for 1 hour. A failed lookup
+ * is cached too, but only for 10 minutes, so an offline machine does not retry on every
+ * launch and still recovers soon. A cache dated in the future (clock skew) counts as expired.
+ *
+ * Warn only: never writes .claude project files, never blocks, always exits 0.
+ * Opt out: TOGA_VERSION_CHECK_DISABLED=1.
+ */
+
+const fs = require('fs');
+const os = require('os');
+const path = require('path');
+
+const CACHE_TTL_MS = 60 * 60 * 1000;
+const FAILED_CACHE_TTL_MS = 10 * 60 * 1000;
+const CACHE_FILE = process.env.TOGA_VERSION_CACHE_FILE || path.join(os.homedir(), '.claude', 'toga-ai-latest.json');
+
+function readLocalVersion(projectDir) {
+  try {
+    return fs.readFileSync(path.join(projectDir, '.claude', 'toga-ai.version'), 'utf8').trim();
+  } catch (e) { return null; } // no version file = not installed by toga-ai; nothing to check
+}
+
+// Cached latest version (null when the last lookup failed), or undefined when missing/expired.
+function readCache() {
+  try {
+    const data = JSON.parse(fs.readFileSync(CACHE_FILE, 'utf8'));
+    if (typeof data.checkedAt !== 'number') return undefined;
+    const latest = data.latest || null;
+    const age = Date.now() - data.checkedAt;
+    const ttl = latest ? CACHE_TTL_MS : FAILED_CACHE_TTL_MS;
+    if (age < 0 || age > ttl) return undefined;
+    return latest;
+  } catch (e) { return undefined; } // missing or corrupt cache = treat as expired and re-check
+}
+
+function writeCache(latest) {
+  try {
+    fs.mkdirSync(path.dirname(CACHE_FILE), { recursive: true });
+    fs.writeFileSync(CACHE_FILE, JSON.stringify({ latest, checkedAt: Date.now() }) + '\n');
+  } catch (e) { /* cache is best effort */ }
+}
+
+function main() {
+  if (process.env.TOGA_VERSION_CHECK_DISABLED === '1') return;
+  const { getLatestNpmVersion, parseVersion, semverLt } = require('./lib/npm-latest');
+
+  const projectDir = process.env.CLAUDE_PROJECT_DIR || process.cwd();
+  const local = readLocalVersion(projectDir);
+  if (!parseVersion(local)) return;
+
+  let latest = readCache();
+  if (latest === undefined) {
+    latest = getLatestNpmVersion();
+    writeCache(latest);
+  }
+  if (!latest || !semverLt(local, latest)) return;
+
+  const msg = 'Your TOGA harness is out of date (v' + local + ' -> v' + latest + '). Run: npx toga-ai@latest';
+  const out = {
+    hookEventName: 'SessionStart',
+    additionalContext: 'TOGA HARNESS UPDATE: ' + msg + '\nTell the developer this in your first reply.',
+  };
+  process.stdout.write(JSON.stringify({ systemMessage: msg, hookSpecificOutput: out }) + '\n');
+}
+
+try { main(); } catch (e) { /* safe: a version warning must never block or fail a session */ }
+process.exit(0);

package/scripts/hooks/lib/npm-latest.js

@@ -0,0 +1,45 @@
+'use strict';
+
+/*
+ * npm-latest.js — shared helpers for "what is the latest toga-ai on npm?".
+ * Used by scripts/install.js and hooks/harness-version-check.js.
+ * Ships in scripts/ and is copied to .claude/hooks/toga/lib/ with the other hooks.
+ */
+
+const { spawnSync } = require('child_process');
+
+const PACKAGE_NAME = 'toga-ai';
+const NPM_TIMEOUT_MS = 3000;
+
+// Latest published version, or null on any failure (offline, npm missing, timeout).
+function getLatestNpmVersion() {
+  try {
+    const isWin = process.platform === 'win32';
+    const result = spawnSync(isWin ? 'npm.cmd' : 'npm', ['view', PACKAGE_NAME, 'version', '--json'], {
+      stdio: 'pipe', shell: isWin, timeout: NPM_TIMEOUT_MS,
+    });
+    if (result.status !== 0 || !result.stdout) return null;
+    const version = result.stdout.toString().trim().replace(/"/g, '');
+    return parseVersion(version) ? version : null;
+  } catch (e) { return null; }
+}
+
+// [major, minor, patch], or null when not a usable version (e.g. "unknown").
+function parseVersion(v) {
+  if (typeof v !== 'string') return null;
+  const m = v.trim().match(/^v?(\d+)\.(\d+)\.(\d+)/);
+  return m ? [Number(m[1]), Number(m[2]), Number(m[3])] : null;
+}
+
+// True only when both versions parse and a < b. Unknown versions never compare.
+function semverLt(a, b) {
+  const pa = parseVersion(a);
+  const pb = parseVersion(b);
+  if (!pa || !pb) return false;
+  for (let i = 0; i < 3; i++) {
+    if (pa[i] !== pb[i]) return pa[i] < pb[i];
+  }
+  return false;
+}
+
+module.exports = { getLatestNpmVersion, parseVersion, semverLt };

package/scripts/install.js

@@ -12,7 +12,7 @@
  *   4. Install from chosen source into project .claude/
  *
  * Usage:
- *   npx toga-ai                     — auto-detect project, use bundle, update from git
+ *   npx toga-ai@latest              — auto-detect project, use bundle, update from git
  *   toga-ai                         — same (after global install)
  *   toga-ai --repo /path/to/claude  — explicit repo path
  *   toga-ai --project /path/to/proj — explicit project path
@@ -50,24 +50,8 @@ function getBundleVersion() {
   }
 }
 
-function getLatestNpmVersion() {
-  try {
-    const result = spawnSync('npm', ['view', 'toga-ai', 'version', '--json'], {
-      stdio: 'pipe', shell: false, timeout: 5000,
-    });
-    if (result.status !== 0 || !result.stdout) return null;
-    return result.stdout.toString().trim().replace(/"/g, '');
-  } catch (e) { return null; }
-}
-
-function semverLt(a, b) {
-  const parse = (v) => v.replace(/[^0-9.]/g, '').split('.').map(Number);
-  const [aMajor, aMinor, aPatch] = parse(a);
-  const [bMajor, bMinor, bPatch] = parse(b);
-  if (aMajor !== bMajor) return aMajor < bMajor;
-  if (aMinor !== bMinor) return aMinor < bMinor;
-  return aPatch < bPatch;
-}
+// Latest npm version + semver compare live in a shared helper the version-check hook uses too.
+const { getLatestNpmVersion, semverLt } = require('./hooks/lib/npm-latest');
 
 /* ------------------------------------------------------------------ */
 /* repo discovery (git update source)                                   */
@@ -436,7 +420,9 @@ const RETIRED_TOGA_HOOKS = ['kickoff-gate.js'];
 
 // Permission rules the TOGA template once shipped and no longer wants. Only exact TOGA-owned
 // strings go here — a developer's own rules are never removed.
-const RETIRED_TOGA_PERMISSIONS = { ask: [
+const RETIRED_TOGA_PERMISSIONS = { allow: [
+  'Bash(node sync-skills.js *)',
+], ask: [
   'mcp__clickup__clickup_create_task_comment',
   'mcp__clickup__clickup_create_comment',
   'mcp__clickup__clickup_update_task',
@@ -645,7 +631,7 @@ hook runs automatically and warns you of any frontmatter or schema errors.
 
 Pull latest skills, agents, and knowledge from the team repo:
 \`\`\`
-npx toga-ai
+npx toga-ai@latest
 \`\`\`
 `;
   const block = CLAUDE_MD_BEGIN + '\n' + body.trimStart() + CLAUDE_MD_END + '\n';
@@ -963,7 +949,7 @@ function main() {
       try {
         const reg = JSON.parse(fs.readFileSync(registryDest, 'utf8'));
         repoCount = Array.isArray(reg) ? reg.length : 0;
-      } catch (e) {}
+      } catch (e) { /* safe: count is display only; registry file was already copied */ }
       console.log('  ✓ Registry  (' + repoCount + ' repos): synced from ' + (knowledgeDir !== PACKAGE_ROOT ? 'git repo' : 'npm bundle'));
     } catch (e) { errors.push('registry.json: ' + e.message); }
   } else {
@@ -976,7 +962,7 @@ function main() {
   console.log('  ✓ CLAUDE.md ' + action);
 
   // Write version marker so /start can detect stale installs
-  try { fs.writeFileSync(path.join(claudeDir, 'toga-ai.version'), bundleVersion, 'utf8'); } catch (e) {}
+  try { fs.writeFileSync(path.join(claudeDir, 'toga-ai.version'), bundleVersion, 'utf8'); } catch (e) { /* safe: marker only feeds stale-install warnings; install itself succeeded */ }
 
   // ECC global integration — detect and report
   const eccPath = detectEcc();
@@ -1041,7 +1027,7 @@ function main() {
   console.log('  UPDATING (get latest skills + team knowledge)');
   console.log('─────────────────────────────────────────────');
   console.log('');
-  console.log('  npx toga-ai       ← run this any time to pull updates');
+  console.log('  npx toga-ai@latest  ← run this any time to pull updates');
   console.log('');
   console.log('═════════════════════════════════════════════');
   console.log('');

package/skills/finish/SKILL.md

@@ -86,7 +86,7 @@ subagent and let it do the heavy I/O in its own context.
 
 Every `/finish` validates, indexes, then **pushes** `knowledge/` to the team git repo (only
 `knowledge/` is ever staged — never source code). Teammates receive it on their next
-`npx toga-ai` run (which git-pulls before installing). The push is **non-blocking**: if offline
+`npx toga-ai@latest` run (which git-pulls before installing). The push is **non-blocking**: if offline
 or unauthenticated, the capture still succeeds — report a manual-push reminder.
 
 ## Step 1 — Resolve TEAM_REPO and classify it
@@ -112,13 +112,13 @@ done
 # 5. Ask the developer
 ```
 
-**`~/toga-tech` must be probed first** — `npx toga-ai` runs `initLocalRepo` there, which
+**`~/toga-tech` must be probed first** — `npx toga-ai@latest` runs `initLocalRepo` there, which
 creates a proper git repo seeded from the bundle even when the remote is private.
 
 **If `IS_GIT_CLONE` is false** (only `.claude/` bundle found): the subagent can still write
 docs locally, but its publish reports `NOT_GIT` instead of pushing. Warn:
 > "No git clone found at standard paths. Docs will be written locally only.
-> Run `npx toga-ai` first (it creates `~/toga-tech` as a pushable git repo),
+> Run `npx toga-ai@latest` first (it creates `~/toga-tech` as a pushable git repo),
 > then re-run /finish to push to GitHub."
 
 **Persist** `team-repo-path` to Claude memory only when `IS_GIT_CLONE` is true — never persist

package/skills/migrate-github-org/SKILL.md

@@ -33,7 +33,7 @@ for d in claude ../claude; do [ -f "$d/skills/migrate-github-org/migrate-github-
 echo "${REPO:-NOT_FOUND}"
 ```
 
-If `NOT_FOUND`, tell the user to run `npx toga-ai` first (or clone
+If `NOT_FOUND`, tell the user to run `npx toga-ai@latest` first (or clone
 `https://github.com/TOGATechnology/claude`), then retry.
 
 ## Step 2 — Run it against their workspace

package/skills/session-save/SKILL.md

@@ -90,7 +90,7 @@ The `<author>` suffix lets two developers use the same slug without collision.
 **No git clone / TEAM_REPO unresolved →** fall back to the legacy local-only path
 `~/.claude/session-data/YYYY-MM-DD-<slug>-session.md` (create the dir if needed), warn the
 developer that the session was saved **locally only** (no team push possible without a
-clone — `npx toga-ai` creates one), and skip Step 4.
+clone — `npx toga-ai@latest` creates one), and skip Step 4.
 
 ---
 

package/skills/start/SKILL.md

@@ -183,6 +183,8 @@ Same method as the old /kickoff. Do it in this main session, no agents.
    commands. If they differ, run `npx toga-ai@latest`, re-read the version file, and report.
    If still stale: `npm cache clean --force`, then `npx toga-ai@latest` once more. If still
    stale, warn and continue. Never report success unless the file equals the latest version.
+   The `harness-version-check.js` SessionStart hook also warns every session while the
+   harness is stale; this step is the fix, not a second warning.
 2. **Team repo.** Resolve `<TEAM_REPO>` (memory `team-repo-path`, then env `CLAUDE_TEAM_REPO`,
    then probe `~/toga-tech`, `~/claude`, `C:\WWW\claude`, `D:\WWW\claude` for
    `knowledge/registry.json`, then `.claude/` as read-only last resort, then ask). Save a

package/skills/team-skills/SKILL.md

@@ -1,11 +1,11 @@
 ---
 name: team-skills
-description: Lists every skill available in the team `claude` knowledge repo with its description, and marks which are installed in this project, available to pull, or local-only. Use when the developer says "what skills are available", "list team skills", "team skills", "show skills", "what can you do", or asks which team skills exist. Pairs with `npx toga-ai`, which installs them.
+description: Lists every skill available in the team `claude` knowledge repo with its description, and marks which are installed in this project, available to pull, or local-only. Use when the developer says "what skills are available", "list team skills", "team skills", "show skills", "what can you do", or asks which team skills exist. Pairs with `npx toga-ai@latest`, which installs them.
 ---
 
 # Team Skills — discover what the team knowledge base offers
 
-`npx toga-ai` *installs* skills but there's no way to *see* what exists first. This
+`npx toga-ai@latest` *installs* skills but there's no way to *see* what exists first. This
 skill renders an always-current listing straight from each skill's `SKILL.md` frontmatter
 (the README skill table is hand-maintained and drifts — do not use it as the source).
 
@@ -29,7 +29,7 @@ node "<TEAM_REPO>/knowledge.js" skills --installed="<project-root>/.claude/skill
 `.claude`). This prints a table `STATUS  SKILL  DESCRIPTION` where STATUS is one of:
 
 - **installed** — present in this project's `.claude/skills/`; ready to use now.
-- **available** — in the team repo but not installed here → run `npx toga-ai`.
+- **available** — in the team repo but not installed here → run `npx toga-ai@latest`.
 - **local-only** — installed locally but absent from the team repo (a personal/unpushed
   skill, e.g. `worker2-action`). Flag it so the developer can decide whether to contribute it.
 
@@ -37,7 +37,7 @@ node "<TEAM_REPO>/knowledge.js" skills --installed="<project-root>/.claude/skill
 
 Render the table grouped by status (installed first, then available, then local-only). Then:
 
-- If any row is **available**, tell the developer: "Run `npx toga-ai` to install these."
+- If any row is **available**, tell the developer: "Run `npx toga-ai@latest` to install these."
 - If any row is **local-only**, note it: "`<skill>` exists only on this machine — if it's
   useful to the team, add it to `<TEAM_REPO>/skills/` and push."
 - Keep descriptions to one line each; the full skill prose lives in its `SKILL.md`.
@@ -45,6 +45,6 @@ Render the table grouped by status (installed first, then available, then local-
 ## Notes
 
 - This is read-only discovery. It never installs or modifies skills — that's
-  `npx toga-ai`'s job.
-- The canonical skill source is `<TEAM_REPO>/skills/*/SKILL.md` (what `sync-skills.js`
-  copies from), not the repo's `.claude/skills/` (an untracked local install).
+  `npx toga-ai@latest`'s job.
+- The canonical skill source is `<TEAM_REPO>/skills/*/SKILL.md` (what `npx toga-ai@latest`
+  installs from), not the repo's `.claude/skills/` (an untracked local install).

package/sync-skills.js

@@ -1,71 +0,0 @@
-#!/usr/bin/env node
-
-/**
- * Syncs skills from this repo's skills/ folder into a project's .claude/skills/.
- *
- * Source  = <this script's dir>/skills    (resolved via __dirname, so it works no
- *           matter where the claude repo is cloned — inside a project as `claude/`,
- *           or as a shared sibling repo like C:\WWW\claude used by many projects).
- * Dest    = the nearest ancestor of the current working directory that contains a
- *           `.claude` folder; falls back to <cwd>/.claude when none is found.
- *
- * Run from the target project's root: node <path-to>/sync-skills.js
- * Optionally pass an explicit destination project root as the first argument:
- *   node C:\WWW\claude\sync-skills.js C:\WWW\2.0
- */
-
-const fs = require('fs');
-const path = require('path');
-
-function findProjectRoot(start) {
-    let dir = start;
-    while (true) {
-        if (fs.existsSync(path.join(dir, '.claude'))) return dir;
-        const parent = path.dirname(dir);
-        if (parent === dir) return start; // no .claude ancestor — default to where we started
-        dir = parent;
-    }
-}
-
-function copyDir(src, dest) {
-    fs.mkdirSync(dest, { recursive: true });
-    for (const entry of fs.readdirSync(src, { withFileTypes: true })) {
-        const srcPath = path.join(src, entry.name);
-        const destPath = path.join(dest, entry.name);
-        if (entry.isDirectory()) {
-            copyDir(srcPath, destPath);
-        } else {
-            fs.copyFileSync(srcPath, destPath);
-        }
-    }
-}
-
-const src = path.join(__dirname, 'skills');
-if (!fs.existsSync(src)) {
-    console.error(`No skills/ folder found next to this script (${src}).`);
-    process.exit(1);
-}
-
-const projectRoot = process.argv[2]
-    ? path.resolve(process.argv[2])
-    : findProjectRoot(process.cwd());
-const dest = path.join(projectRoot, '.claude', 'skills');
-
-console.log(`source: ${src}`);
-console.log(`dest:   ${dest}\n`);
-
-const skills = fs.readdirSync(src, { withFileTypes: true })
-    .filter(e => e.isDirectory())
-    .map(e => e.name);
-
-if (skills.length === 0) {
-    console.log('No skills found in skills/.');
-    process.exit(0);
-}
-
-for (const skill of skills) {
-    copyDir(path.join(src, skill), path.join(dest, skill));
-    console.log(`  synced: ${skill}`);
-}
-
-console.log(`\n${skills.length} skill(s) synced to ${dest}`);