Everything below is the real CLI against a real way (Incu's gated development flow, the reference way). Node ≥ 18; no global install needed.

1. Add a way — pinned, then approved

npx ways.sh add github:incu-tech/incuway#v1.0.0

add resolves the ref to an exact commit, computes a content digest, validates the manifest (schema and conformance — a non-conformant way is refused), and then shows you the full-clarity plan before anything is enabled:

ways add — plan for incu/dev
  source: github:incu-tech/incuway  ref: v1.0.0
  digest: sha256:ea677c882c62…
  skills → skills.sh:
    + skills/incu-way-development (bundled)
  rules → steering:
    + rules/typescript.md (bundled)
  executable surface (will be enabled):
    ! check: git --version
    ! check: gh --version

Enable this way? [y/N]

On approval the skills are placed by skills.sh, the rules by steering, and the way is recorded in ways.lock (source, ref, sha, digest, approvedDigest) and ways.yaml. Any later content change requires re-approval — trust is bound to the digest, not the name.

2. Bind the slots to your tools

npx ways.sh bind          # guided wizard over every unbound/default slot

The way declares capabilities (vcs-host, issue-tracker); the wizard walks you through binding each one to your actual tool, marking which choices doctor can validate (✓ profile). Scripted form: ways bind incu/dev vcs-host github. Details in Slots & bindings.

3. Prove the environment

npx ways.sh doctor        # no args: project mode

Project mode checks cross-way conflicts and pins, then every declared way: CLIs on PATH (running their declared check commands when the way is trusted), env vars (secrets never echoed), MCP servers (via the agent inspector), slot bindings, companion ways. Exit 0 = ready; every failure comes with a copy-pasteable remediation. Details in Doctor & trust.

4. Run the way

The way's skills are now installed agent-natively — in Claude Code, /incu-way-development runs the gated flow, generating the declared documents (PRD → PLAN → TESTING) and honoring the declared gates. ways doesn't run the flow; it guarantees the flow can run.

5. Reproduce it elsewhere — teammates & CI

add is what the first person runs. Everyone after them clones the repo (with its committed ways.yaml + ways.lock) and runs:

npx ways.sh install       # restore every declared way at its locked sha — the npm-ci equivalent

install re-acquires each way at its locked commit, verifies the content digest, and places it. Because the approval is recorded in the lock (approvedDigest), byte-identical content is never re-prompted — and content that doesn't match the lock is refused, not silently accepted. External skills are restored at their recorded pins too.

In CI, add --frozen: anything missing from or drifted against the lock becomes a hard failure, so the pipeline only ever installs ways a human already approved.

npx ways.sh install --frozen && npx ways.sh doctor --strict

Day-2 commands

npx ways.sh list          # installed ways: trust, scope, pin drift
npx ways.sh doctor        # re-verify any time; drift is flagged with a fix
npx ways.sh remove incu/dev

Getting started