toga-ai 1.0.81 → 1.0.83

package/.claude/settings.json

@@ -1,6 +1,27 @@
 {
   "hooks": {
+    "UserPromptSubmit": [
+      {
+        "hooks": [
+          {
+            "type": "command",
+            "command": "node \".claude/hooks/toga/kickoff-gate.js\"",
+            "timeout": 3000
+          }
+        ]
+      }
+    ],
     "PreToolUse": [
+      {
+        "matcher": "Bash|Read|Grep|Glob|Edit|Write|MultiEdit|NotebookEdit|Task|WebFetch|WebSearch",
+        "hooks": [
+          {
+            "type": "command",
+            "command": "node \".claude/hooks/toga/kickoff-gate.js\"",
+            "timeout": 3000
+          }
+        ]
+      },
       {
         "matcher": "Bash",
         "hooks": [

package/knowledge/INDEX.md

@@ -20,6 +20,10 @@ _Auto-generated by `knowledge.js index`. Do not hand-edit._
 - **toga2-view** (TOGa View Frontend) — 0 doc(s) → [2.0/apps/toga2-view/INDEX.md](2.0/apps/toga2-view/INDEX.md)
 - **toga2-hub** (TOGa Hub) — 2 doc(s) → [2.0/apps/toga2-hub/INDEX.md](2.0/apps/toga2-hub/INDEX.md)
 
+## standalone framework
+
+- **togatech** (TOGA Technology Website) — 1 doc(s) → [standalone/apps/togatech/INDEX.md](standalone/apps/togatech/INDEX.md)
+
 ## Clients
 
 - **Compass Canada** (`compass-canada`) → [clients/compass-canada/INDEX.md](clients/compass-canada/INDEX.md)

package/knowledge/registry.json

@@ -10,6 +10,7 @@
   { "repo": "toga2-view",  "project": "TOGa View Frontend", "framework": "2.0", "role": "app",  "dependsOn": ["api2"] },
   { "repo": "togadesk",    "project": "TOGa Desk",   "framework": "1.0", "role": "app",  "dependsOn": [] },
   { "repo": "togaview",    "project": "TOGa View",   "framework": "1.0", "role": "app",  "dependsOn": [] },
-  { "repo": "toga2-hub",   "project": "TOGa Hub",    "framework": "2.0", "role": "app",  "dependsOn": ["api2"] }
+  { "repo": "toga2-hub",   "project": "TOGa Hub",    "framework": "2.0", "role": "app",  "dependsOn": ["api2"] },
+  { "repo": "togatech",    "project": "TOGA Technology Website", "framework": "standalone", "role": "app", "dependsOn": [] }
 
 ]

package/knowledge/standalone/apps/togatech/INDEX.md

@@ -0,0 +1,5 @@
+# togatech (TOGA Technology Website) — standalone knowledge
+
+| Doc | Summary | Files |
+|-----|---------|-------|
+| [TOGA Technology Website Architecture](architecture.md) | The public-facing TOGA Technology corporate/marketing website. | togatech/src/main.tsx, togatech/src/App.tsx, togatech/src/routes.tsx, togatech/src/lib/api.ts, togatech/src/lib/contentful.ts, togatech/src/themeConfig/ThemeContext.tsx, togatech/vite.config.ts, togatech/package.json |

package/knowledge/standalone/apps/togatech/architecture.md

@@ -0,0 +1,153 @@
+---
+title: TOGA Technology Website Architecture
+framework: "standalone"
+repo: togatech
+project: TOGA Technology Website
+client: shared
+type: architecture
+status: active
+updated: 2026-06-15
+owners: [jcardinal]
+files:
+  - togatech/src/main.tsx
+  - togatech/src/App.tsx
+  - togatech/src/routes.tsx
+  - togatech/src/lib/api.ts
+  - togatech/src/lib/contentful.ts
+  - togatech/src/themeConfig/ThemeContext.tsx
+  - togatech/vite.config.ts
+  - togatech/package.json
+related: []
+---
+
+# TOGA Technology Website Architecture
+
+The public-facing TOGA Technology corporate/marketing website. It is a **standalone
+single-page React application** — it does **not** use either PHP framework (1.0 `App_`
+or 2.0 `_underscore`), which is why it lives under the `standalone/` knowledge partition
+rather than `1.0/` or `2.0/`. It consumes TOGA backend services (email + the Talos AI
+API) over HTTP and pulls editorial content from Contentful, but ships no server code of
+its own — it builds to static assets served from `dist/`.
+
+Local path on dev machines is tracked in Claude memory (`repo-path-togatech`), not here.
+
+## Stack
+
+- **React 18.3 + TypeScript 5.8**, bundled with **Vite 5.4** (`@vitejs/plugin-react`).
+- **Tailwind CSS 3.4** (+ PostCSS / autoprefixer) for styling; theme tokens are driven
+  from `src/themeConfig/themes.json`.
+- **React Router 7.9** using `createBrowserRouter` (data-router API).
+- **@agilant/toga-blox** (internal design-system / component + API library) — supplies
+  shared UI and the `apiGet` HTTP helper (`@agilant/toga-blox/dist/api/apiFunctions`).
+- **FontAwesome Pro** icon set.
+- **Cypress 15** for end-to-end tests.
+
+## Application bootstrap
+
+`src/main.tsx` → `src/App.tsx` → `src/routes.tsx`.
+
+- `main.tsx` mounts `<App/>` inside `HelmetProvider` (react-helmet-async, for per-page
+  SEO `<head>` management) and `StrictMode`.
+- `App.tsx` wires the global providers, in order:
+  1. `PersistQueryClientProvider` — TanStack **React Query** client persisted to
+     `localStorage` (persister key `"commerce"`); default query `staleTime` is 24h.
+  2. `ThemeProvider` (`src/themeConfig/ThemeContext.tsx`) — applies the active theme
+     from `themes.json` (color/btn token sets, e.g. the `DEFAULT` theme).
+  3. `RouterProvider` with the `routes` browser router.
+  - Also initializes **Google Analytics 4** (`react-ga4`, measurement ID is hardcoded
+    in `App.tsx`) and mounts React Query Devtools.
+- **Zustand** is also a dependency for lightweight local state where React Query is not
+  the right fit.
+
+## Routing
+
+`src/routes.tsx` defines a single `createBrowserRouter`. All routes render under
+`components/templates/AppLayout` (the shared header/footer chrome), and the index route
+group has `ErrorPage` as its `ErrorBoundary`. Pages:
+
+| Path | Page |
+|---|---|
+| `/` (index) | `pages/Home` |
+| `/about` | `pages/About` |
+| `/what-we-do` | `pages/WhatWeDo` |
+| `/our-platform` | `pages/OurPlatform` |
+| `/contact` | `pages/Contact` |
+| `/privacy-policy` | `pages/PrivacyPolicy` |
+| `/terms-and-conditions` | `pages/TermsAndConditions` |
+| `*` | `pages/NotFound` |
+
+Lazy-route scaffolding is present but commented out (pages are eagerly imported today).
+A Cypress-only test route swaps `WhatWeDoPage` for a component that throws, to exercise
+the error boundary (`VITE_CY_TEST` / `window.Cypress`).
+
+## Page structure — MVVM per page
+
+Each page in `src/pages/<Page>/` follows a **view / viewModel** split, e.g. `Home`:
+
+```
+pages/Home/
+  HomePage.tsx        # entry, composes the view
+  index.ts            # barrel export
+  types.ts            # page-local types
+  view/               # presentational components (+ components/, index.ts)
+  viewModel/          # useHomeViewModel.ts, FIELDS/, index.ts — data + form logic
+```
+
+The **viewModel** holds data fetching (React Query hooks), form field definitions
+(`FIELDS`), and behavior; the **view** is presentational. This keeps page logic testable
+and out of JSX.
+
+## Shared layers
+
+- `src/components/` — reusable UI (Header, Footer, Hero, Carousel/Swiper wrappers, Modal,
+  TalosChat + TalosChatInput, motion/animation helpers, animated SVGs, etc.).
+- `src/components/templates/` — layout primitives: `AppLayout` (router root chrome),
+  `DefaultContainer`, `MarginContainer`, `GlowingContainer`, `ErrorContainer`.
+- `src/lib/` — data/integration layer:
+  - `api.ts` — `useSendEmail` (contact-form submission) and `postTalosMessage` (AI chat).
+  - `contentful.ts` — Contentful delivery client (`createClient`).
+  - `talosSystemPrompt.ts` — system prompt for the Talos chat assistant.
+  - `types.ts` — shared API/domain types (`ChatMessage`, `OutputField`, `ChatAPIError`…).
+- `src/utils/` — helpers (`emphasizeText`, `getFontAwesomeIcon`, `animateSections`) and
+  hooks (`useFocusTrap`, `useLockBgScroll`).
+- `src/themeConfig/` — `ThemeContext.tsx`, `themes.json`, `types.ts`.
+
+## External integrations
+
+All configured via Vite `VITE_*` env vars (values in `.env`, never in the repo docs):
+
+- **Email** — `useSendEmail` (`src/lib/api.ts`) calls toga-blox `apiGet` against the
+  `email-templates/sendEmail?uuid=…` endpoint (base `VITE_API`), passing a per-form
+  `templateUuid` plus a `fieldMapping` of form fields → template `varN` slots. This is
+  the consumer side of the 2.0 EmailTemplate `sendEmail` API.
+- **Talos AI chat** — `postTalosMessage` POSTs to `VITE_TALOS_API` with header
+  `X-API-Key: VITE_TALOS_API_KEY`, body `{ model: VITE_TALOS_MODEL, system_prompt,
+  messages, output_schema, temperature, max_tokens }`. Surfaced by the `TalosChat` UI.
+- **Contentful CMS** — `VITE_CONTENTFUL_SPACE_ID` / `VITE_CONTENTFUL_ACCESS_TOKEN`.
+- **Sentry** (`@sentry/react`) for error monitoring; **GA4** for analytics.
+
+## Build, environments, and deploy
+
+- `package.json` scripts: `dev`, `togatech` (dev with `--host togatech`), `build`
+  (`tsc && vite build`), `buildBeta` (`--mode beta`), `buildGamma` (`--mode gamma`),
+  `preview`, `lint` (ESLint, `--max-warnings 0`).
+- **Multi-environment**: `development`, `beta`, `gamma`, `production` (Vite modes).
+- Vite `base: "/"`, output to `dist/`, `publicDir: public`. A custom `robotsPlugin`
+  copies `public/robots.prod.txt` or `public/robots.dev.txt` to `dist/robots.txt` at
+  `closeBundle` depending on prod detection (`NODE_ENV` + `VITE_ENV`).
+- `@` path alias → `./src` (Vite `resolve.alias`).
+- Dev server `allowedHosts: ["togatech"]` (matches the `togatech` host script).
+
+## Testing
+
+Cypress e2e under `cypress/` (config `cypress.config.ts`). The router exposes a
+deliberate crash route under Cypress to verify the `ErrorPage` boundary.
+
+## Notes / gotchas
+
+- `togatech/.env` is currently **tracked in git** and holds the `VITE_*` credentials
+  (Contentful token, Talos API key). Treat those as committed secrets — they should be
+  rotated and the file removed from tracking / added to `.gitignore`.
+- There is a nested `togatech/` folder inside the repo root containing its own small
+  `package.json` and a `cypress/` dir — appears to be a secondary/legacy Cypress setup;
+  the primary app lives at the repo root.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "toga-ai",
-  "version": "1.0.81",
+  "version": "1.0.83",
   "description": "TOGA Technology Team Claude Knowledge System — shared AI coding harness with skills, knowledge base CLI, and project installer for Claude Code.",
   "keywords": [
     "claude",

package/scripts/hooks/kickoff-gate.js

@@ -0,0 +1,180 @@
+#!/usr/bin/env node
+'use strict';
+
+/*
+ * kickoff-gate.js — DETERMINISTIC enforcement of the /kickoff priming gate.
+ *
+ * Why this exists: the kickoff SKILL.md states a "hard gate" — when /kickoff is
+ * invoked you MUST complete priming (Steps 0–6) BEFORE touching the task with any
+ * Read/Grep/Glob/Edit/Write/Task call. Prose alone did not stop the model from
+ * jumping straight to investigation when /kickoff was followed by a long, specific
+ * task description. This hook makes the gate mechanical, not advisory.
+ *
+ * It registers for TWO events from a single file:
+ *
+ *   UserPromptSubmit  → if the submitted prompt invokes /kickoff, ARM the gate:
+ *                       write a session-scoped lock and inject a forceful reminder.
+ *
+ *   PreToolUse        → while the gate is armed for THIS session, ALLOW only the
+ *                       read-only priming steps (the priming Bash commands + the
+ *                       interview via AskUserQuestion/Skill, which don't match the
+ *                       PreToolUse matcher) and BLOCK every task tool
+ *                       (Read/Grep/Glob/Edit/Write/MultiEdit/NotebookEdit/Task/
+ *                       WebFetch/WebSearch and any non-priming Bash). The lock
+ *                       AUTO-CLEARS the moment `knowledge.js kickoff-preflight`
+ *                       runs — the definitive priming step that precedes Step 4's
+ *                       first Read. So the model literally cannot investigate or
+ *                       edit the task until it has actually primed.
+ *
+ * Fail-open: any internal/parse error allows the tool (a crashing gate must never
+ * brick every session). The SKILL.md prose remains the backup.
+ *
+ * Escape hatch: set KICKOFF_GATE_DISABLED=1 to disable enforcement entirely.
+ */
+
+const fs = require('fs');
+const path = require('path');
+
+/* ---------- input: read stdin JSON (CC standard), fall back to env ---------- */
+function readPayload() {
+  let raw = '';
+  try { raw = fs.readFileSync(0, 'utf8'); } catch (e) { /* no stdin */ }
+  let data = {};
+  if (raw && raw.trim()) {
+    try { data = JSON.parse(raw); } catch (e) { data = {}; }
+  }
+  // env fallbacks used by this harness's other hooks
+  if (!data.tool_name && process.env.CLAUDE_TOOL_NAME) data.tool_name = process.env.CLAUDE_TOOL_NAME;
+  if (!data.tool_input && process.env.CLAUDE_TOOL_INPUT) {
+    try { data.tool_input = JSON.parse(process.env.CLAUDE_TOOL_INPUT); } catch (e) {}
+  }
+  if (!data.prompt && process.env.CLAUDE_USER_PROMPT) data.prompt = process.env.CLAUDE_USER_PROMPT;
+  if (!data.session_id && process.env.CLAUDE_SESSION_ID) data.session_id = process.env.CLAUDE_SESSION_ID;
+  return data;
+}
+
+function lockPath() {
+  return path.join(process.cwd(), '.claude', '.kickoff-gate.json');
+}
+
+function readLock() {
+  try { return JSON.parse(fs.readFileSync(lockPath(), 'utf8')); } catch (e) { return null; }
+}
+
+function writeLock(sessionId) {
+  try {
+    fs.mkdirSync(path.dirname(lockPath()), { recursive: true });
+    fs.writeFileSync(lockPath(), JSON.stringify({ session: sessionId || null, ts: Date.now() }) + '\n');
+  } catch (e) { /* non-fatal */ }
+}
+
+function clearLock() {
+  try { fs.unlinkSync(lockPath()); } catch (e) { /* already gone */ }
+}
+
+/* A prompt invokes /kickoff if it carries any of these signals (covers the literal
+ * "/kickoff ...", the expanded skill command form, and the rendered skill header). */
+function invokesKickoff(prompt) {
+  if (typeof prompt !== 'string' || !prompt) return false;
+  return (
+    /(^|\s)\/kickoff(\s|$)/.test(prompt) ||
+    /command-name>\s*\/?kickoff\s*<\/command-name>/i.test(prompt) ||
+    /Kickoff\s+—\s+prime a coding session/i.test(prompt)
+  );
+}
+
+/* Bash commands that ARE the read-only priming steps (Steps 0–3). Everything else
+ * is task work and stays blocked until preflight clears the gate. */
+function isPrimingBash(command) {
+  if (typeof command !== 'string') return false;
+  return /knowledge\.js|kickoff-preflight|toga-ai\.version|npm\s+view\s+toga-ai|npx\s+toga-ai|registry\.json|rev-parse/i.test(command);
+}
+
+function isPreflightBash(command) {
+  return typeof command === 'string' && /kickoff-preflight/i.test(command);
+}
+
+/* Tools that constitute touching the task — blocked while the gate is armed. */
+const BLOCKED_TOOLS = new Set([
+  'Read', 'Grep', 'Glob', 'Edit', 'Write', 'MultiEdit',
+  'NotebookEdit', 'Task', 'Agent', 'WebFetch', 'WebSearch',
+]);
+
+function blockMessage() {
+  return [
+    '🛑 KICKOFF GATE — priming is not complete.',
+    '',
+    '/kickoff was invoked this session. You MUST finish priming BEFORE touching the task',
+    'with any Read/Grep/Glob/Edit/Write/Task call — no matter how detailed the request after',
+    '/kickoff looks. That trailing text is the Step 2 task description, NOT permission to start.',
+    '',
+    'Do this now, in order (these are allowed while the gate is armed):',
+    '  • Step 0  version check (cat .claude/toga-ai.version ; npm view toga-ai version)',
+    '  • Step 1  resolve the team repo (probe for knowledge/registry.json)',
+    '  • Step 2  interview the developer (framework / layer / repo(s) / client / task)',
+    '  • Step 3  node "<TEAM_REPO>/knowledge.js" kickoff-preflight ...   ← this AUTO-CLEARS the gate',
+    '  • Step 4+ THEN read the knowledge docs and start the task',
+    '',
+    'The gate releases automatically the instant kickoff-preflight runs.',
+    '(Emergency override only: set KICKOFF_GATE_DISABLED=1.)',
+  ].join('\n');
+}
+
+function main() {
+  if (process.env.KICKOFF_GATE_DISABLED === '1') process.exit(0);
+
+  const data = readPayload();
+
+  // ---- UserPromptSubmit: arm the gate when /kickoff is invoked ----
+  // Identify by the presence of a prompt and absence of a tool call.
+  const isPromptEvent =
+    data.hook_event_name === 'UserPromptSubmit' ||
+    (typeof data.prompt === 'string' && !data.tool_name);
+
+  if (isPromptEvent) {
+    if (invokesKickoff(data.prompt)) {
+      writeLock(data.session_id);
+      // stdout from UserPromptSubmit is injected into the model's context.
+      console.log(
+        '<system-reminder>KICKOFF GATE ARMED. Before ANY other tool call, complete priming ' +
+        'Steps 0–6 of the kickoff skill — version check, resolve team repo, interview, then ' +
+        'run `knowledge.js kickoff-preflight` (which releases the gate), THEN read docs and work. ' +
+        'The trailing task description is Step 2 input, not permission to start. ' +
+        'A hook will block Read/Grep/Edit/Write/Task until preflight runs.</system-reminder>'
+      );
+    }
+    process.exit(0);
+  }
+
+  // ---- PreToolUse: enforce while armed for THIS session ----
+  const lock = readLock();
+  if (!lock) process.exit(0);
+
+  // Cross-session safety: only enforce for the session that armed the gate.
+  // If we can't match sessions, fall back to a 3-hour staleness window.
+  const sameSession = lock.session && data.session_id && lock.session === data.session_id;
+  const fresh = lock.ts && (Date.now() - lock.ts) < 3 * 60 * 60 * 1000;
+  if (!sameSession && !fresh) { clearLock(); process.exit(0); }
+  if (data.session_id && lock.session && !sameSession) process.exit(0);
+
+  const tool = data.tool_name || '';
+  const command = (data.tool_input && data.tool_input.command) || '';
+
+  if (tool === 'Bash') {
+    if (isPreflightBash(command)) { clearLock(); process.exit(0); } // priming reached — release
+    if (isPrimingBash(command)) process.exit(0);                    // other read-only priming step
+    console.log(blockMessage());
+    process.exit(2);
+  }
+
+  if (BLOCKED_TOOLS.has(tool)) {
+    console.log(blockMessage());
+    process.exit(2);
+  }
+
+  // Anything else (AskUserQuestion, Skill, TodoWrite, ExitPlanMode, …) is part of
+  // priming/interview — allow.
+  process.exit(0);
+}
+
+try { main(); } catch (e) { process.exit(0); } // fail-open: never brick a session

package/skills/kickoff/SKILL.md

@@ -22,6 +22,16 @@ description: Start-of-session context loader for TOGA Technology projects. Run t
 >
 > Only after Step 5's "primed and ready" summary (and Step 6's plan, for non-trivial work)
 > may you touch the task itself.
+>
+> **This gate is mechanically enforced — it is not just prose.** A hook
+> (`hooks/toga/kickoff-gate.js`, wired on `UserPromptSubmit` + `PreToolUse`) arms the
+> instant `/kickoff` is invoked and will **hard-block** `Read`, `Grep`, `Glob`, `Edit`,
+> `Write`, `Task`, and any non-priming `Bash` until you actually prime. The only calls it
+> permits while armed are the read-only priming steps (the version check, team-repo probe,
+> `knowledge.js manifest`, the developer interview) and `knowledge.js kickoff-preflight` —
+> **running preflight (Step 3) is what releases the gate.** So the correct response to a
+> block message is never to fight it: run Steps 0–3, and the moment preflight executes you
+> are free to read docs and work. (Emergency override only: `KICKOFF_GATE_DISABLED=1`.)
 
 ## Arguments — text passed after `/kickoff` never skips any step