boost-skill-cli 1.0.135__tar.gz → 1.0.136__tar.gz

{boost_skill_cli-1.0.135 → boost_skill_cli-1.0.136}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: boost-skill-cli
-Version: 1.0.135
+Version: 1.0.136
 Summary: boost — Homebrew for AI coding skills
 Author: Jonathan Reyes
 License: GNU GENERAL PUBLIC LICENSE
@@ -766,8 +766,9 @@ boost tap --defaults          # pull in the 5 starter registries
 ```
 
 The default install is **zero-dependency** (pure stdlib). `boost search` and the
-`boost_search` MCP tool rank results with a built-in full-content BM25 engine
-(run `boost reindex` once to build the index). For optional **dense semantic
+`boost_search` MCP tool rank results with a built-in full-content BM25 engine —
+the index builds automatically on your first search, so BM25 is the default with
+no setup (`boost reindex` just forces a rebuild). For optional **dense semantic
 search**, install the `[rag]` extra and set an embeddings key — retrieval then
 embeds every skill and ranks by vector similarity, falling back to BM25 whenever
 the extra or key is absent:

{boost_skill_cli-1.0.135 → boost_skill_cli-1.0.136}/README.md

@@ -54,8 +54,9 @@ boost tap --defaults          # pull in the 5 starter registries
 ```
 
 The default install is **zero-dependency** (pure stdlib). `boost search` and the
-`boost_search` MCP tool rank results with a built-in full-content BM25 engine
-(run `boost reindex` once to build the index). For optional **dense semantic
+`boost_search` MCP tool rank results with a built-in full-content BM25 engine —
+the index builds automatically on your first search, so BM25 is the default with
+no setup (`boost reindex` just forces a rebuild). For optional **dense semantic
 search**, install the `[rag]` extra and set an embeddings key — retrieval then
 embeds every skill and ranks by vector similarity, falling back to BM25 whenever
 the extra or key is absent:

{boost_skill_cli-1.0.135 → boost_skill_cli-1.0.136}/boost_cli/_version.py

@@ -18,7 +18,7 @@ version_tuple: tuple[int | str, ...]
 commit_id: str | None
 __commit_id__: str | None
 
-__version__ = version = '1.0.135'
-__version_tuple__ = version_tuple = (1, 0, 135)
+__version__ = version = '1.0.136'
+__version_tuple__ = version_tuple = (1, 0, 136)
 
 __commit_id__ = commit_id = None

{boost_skill_cli-1.0.135 → boost_skill_cli-1.0.136}/boost_cli/commands/configuration.py

@@ -745,6 +745,7 @@ REGISTRY = mcp.Registry()
 
 def _tool_search(args: dict):
     query = str(args.get("query", ""))
+    rag.ensure()  # build the full-content index on first use (BM25 by default)
     rag_result = rag.search(query, limit=10)
     if rag_result is not None:  # full-content index is built
         hits, _ranker = rag_result

{boost_skill_cli-1.0.135 → boost_skill_cli-1.0.136}/boost_cli/commands/discovery.py

@@ -91,9 +91,14 @@ def cmd_search(argv):
     if not registry.list_taps():
         raise BoostError("no taps configured — nothing to search",
                         hint="add the recommended registries with `boost tap --defaults`")
-    # Prefer the full-content (RAG) index when it exists; otherwise fall back
-    # to the frontmatter search so nothing regresses before `boost reindex`.
+    # Full-content (RAG) search is the default: build the index on first use so
+    # every user gets BM25 ranking without having to know about `boost reindex`.
+    # rag.ensure() is incremental, offline, and degrades to frontmatter search
+    # if the build fails — so a search never hard-fails on an indexing problem.
     use_rag = rag.ready()
+    if not use_rag:
+        with spin.Spinner("building the search index (first run)"):
+            use_rag = rag.ensure()
     if use_rag:
         scored = [(h["entry"], h["score"])
                   for h in rag.retrieve(query, k=max(60, args.limit * 4))]

{boost_skill_cli-1.0.135 → boost_skill_cli-1.0.136}/boost_cli/commands/pkg.py

@@ -15,7 +15,7 @@ from pathlib import Path
 from typing import Dict, List, Optional
 
 from .. import cliparse
-from ..core import (adapters, agents, catalog, frontmatter, gitutil,
+from ..core import (adapters, agents, catalog, config, frontmatter, gitutil,
                     injectscan, journal, lockfile, paths, registry,
                     secretscan, staleness, store, typosquat, updatediff, util)
 from ..core import output as out
@@ -66,36 +66,51 @@ def _check_agents(names: Optional[List[str]]) -> Optional[List[str]]:
     return names
 
 
+def _scan_label(res: store.InstallResult) -> str:
+    """What was scanned, for the warning text: skills ship a SKILL.md; rules and
+    workflows ship a single file, so name the kind instead."""
+    return "SKILL.md" if res.kind == "skill" else "%s content" % res.kind
+
+
+def _scan_findings(res: store.InstallResult, scanner):
+    """Findings for the content boost just installed. Skills scan their
+    SKILL.md; rules/workflows scan the raw source (res.scan_text) — the exact
+    Markdown that landed, not a non-existent SKILL.md under the dest file."""
+    if res.scan_text is not None:
+        return scanner.scan_text(res.scan_text)
+    return scanner.scan_file(res.dest / "SKILL.md")
+
+
 def _warn_injection(res: store.InstallResult) -> None:
-    """Flag prompt-injection / risky-content patterns in the skill just copied.
+    """Flag prompt-injection / risky-content patterns in what was just installed.
 
-    boost installs Markdown the agent then executes, so the installed
-    ``SKILL.md`` is scanned (core.injectscan) and any hits are surfaced worst
-    -first. Advisory only — it warns, it never blocks the install.
+    boost installs Markdown the agent then executes, so the installed content is
+    scanned (core.injectscan) and any hits are surfaced worst-first. Advisory
+    only — it warns, it never blocks the install.
     """
-    findings = injectscan.scan_file(res.dest / "SKILL.md")
+    findings = _scan_findings(res, injectscan)
     if not findings:
         return
-    out.warn("%s: %d suspicious pattern%s in SKILL.md (%s) — review before use"
+    out.warn("%s: %d suspicious pattern%s in %s (%s) — review before use"
              % (res.name, len(findings), "" if len(findings) == 1 else "s",
-                injectscan.worst_severity(findings)))
+                _scan_label(res), injectscan.worst_severity(findings)))
     for f in findings[:3]:
         out.warn("  L%d [%s] %s" % (f.line, f.severity, f.description))
 
 
 def _warn_secrets(res: store.InstallResult) -> None:
-    """Flag embedded credentials / secrets in the skill just copied.
+    """Flag embedded credentials / secrets in what was just installed.
 
-    Scans the installed ``SKILL.md`` (core.secretscan) for known secret shapes
-    and surfaces any hits worst-first, with the secret value redacted. Advisory
+    Scans the installed content (core.secretscan) for known secret shapes and
+    surfaces any hits worst-first, with the secret value redacted. Advisory
     only — it warns, it never blocks the install.
     """
-    findings = secretscan.scan_file(res.dest / "SKILL.md")
+    findings = _scan_findings(res, secretscan)
     if not findings:
         return
-    out.warn("%s: %d possible secret%s in SKILL.md (%s) — do not commit"
+    out.warn("%s: %d possible secret%s in %s (%s) — do not commit"
              % (res.name, len(findings), "" if len(findings) == 1 else "s",
-                secretscan.worst_severity(findings)))
+                _scan_label(res), secretscan.worst_severity(findings)))
     for f in findings[:3]:
         out.warn("  L%d [%s] %s" % (f.line, f.severity, f.description))
 
@@ -106,6 +121,7 @@ def _report_result(res: store.InstallResult) -> None:
         out.ok("materialized → %s" % (" · ".join(res.linked) or "(no enabled agents)"))
         out.ok("lock updated (.skill-lock.json)")
         _warn_injection(res)
+        _warn_secrets(res)
         return
     out.ok("copied to %s" % _tilde(res.dest))
     if res.linked:
@@ -268,6 +284,7 @@ _PLAN_LABELS = [
     ("missing_links", "missing agent links"),
     ("stale_links", "stale links"),
     ("orphaned_store", "orphaned store dirs"),
+    ("missing_materializations", "missing rule/workflow files"),
 ]
 
 
@@ -297,6 +314,8 @@ def cmd_sync(argv: List[str]) -> int:
             for item in plan[key]:
                 if key == "missing_links":
                     out.info("%s → %s" % (item[0], item[1]))
+                elif key == "missing_materializations":
+                    out.info("%s %s" % (item[0], item[1]))  # (kind, name)
                 else:
                     out.info(_tilde(item))
         return 0
@@ -1020,14 +1039,22 @@ def cmd_adapt(argv: List[str]) -> int:
     ap.add_argument("name", help="skill to adapt")
     ap.add_argument("--to", metavar="FRAMEWORK", required=True,
                     help="target framework: %s" % ", ".join(adapters.formats()))
+    ap.add_argument("--model", metavar="M", default=None,
+                    help="LLM the exported agent runs on (default: boost's "
+                         "ai.model; pass 'none' for the framework's own default)")
     ap.add_argument("-o", "--out", metavar="FILE",
                     help="write to FILE instead of stdout")
     args = ap.parse_args(argv)
     if args.to not in adapters.FORMATS:
         raise BoostError("unknown framework: %s" % args.to,
                         hint="supported: %s" % ", ".join(adapters.formats()))
+    # Default to boost's configured model so exported agents run on the same LLM
+    # boost uses; `--model none` opts out and lets the framework pick.
+    model = args.model if args.model is not None else str(config.get("ai.model") or "")
+    if model.strip().lower() in ("none", "off", ""):
+        model = None
     display, description, body = _resolve_skill_source(args.name)
-    source = adapters.render(args.to, display, description, body)
+    source = adapters.render(args.to, display, description, body, model)
     if args.out:
         dest = paths.expand(args.out)
         try:
@@ -1035,7 +1062,8 @@ def cmd_adapt(argv: List[str]) -> int:
         except OSError as e:
             raise BoostError("cannot write %s: %s" % (_tilde(dest), e.strerror or e),
                             hint="check the output path exists and is writable")
-        out.ok("adapted %s → %s (%s)" % (display, _tilde(dest.resolve()), args.to))
+        out.ok("adapted %s → %s (%s · %s)" % (display, _tilde(dest.resolve()),
+                                              args.to, model or "framework default"))
     else:
         sys.stdout.write(source)
     return 0

{boost_skill_cli-1.0.135 → boost_skill_cli-1.0.136}/boost_cli/core/adapters.py

@@ -18,11 +18,11 @@ from __future__ import annotations
 import json
 import keyword
 import re
-from typing import Callable, Dict, List
+from typing import Callable, Dict, List, Optional
 
 # Public: the format id shown in `--to`/errors -> its renderer.
 # Populated at the bottom once the render_* functions are defined.
-FORMATS: Dict[str, "Callable[[str, str, str], str]"] = {}
+FORMATS: Dict[str, "Callable[..., str]"] = {}
 
 
 def formats() -> List[str]:
@@ -30,12 +30,15 @@ def formats() -> List[str]:
     return sorted(FORMATS)
 
 
-def render(fmt: str, name: str, description: str, body: str) -> str:
+def render(fmt: str, name: str, description: str, body: str,
+           model: Optional[str] = None) -> str:
     """Dispatch to the renderer for `fmt`. Raises KeyError on unknown fmt.
 
-    The command layer turns that into a friendly BoostError listing formats().
+    `model` (a boost/LiteLLM model id) wires the emitted agent to a specific
+    LLM; when falsy the agent inherits its framework's default provider. The
+    command layer turns a KeyError into a BoostError listing formats().
     """
-    return FORMATS[fmt](name, description, body)
+    return FORMATS[fmt](name, description, body, model)
 
 
 # --- shared helpers -------------------------------------------------------
@@ -68,47 +71,88 @@ def _clean(text: str) -> str:
     return text.strip()
 
 
+def _litellm_model(model: str) -> str:
+    """Normalize a boost model id to a LiteLLM `provider/model` string.
+
+    boost's AI bridge is Anthropic (the `claude` CLI / Anthropic API), so a bare
+    Claude id like `claude-haiku-4-5-20251001` gets an `anthropic/` prefix.
+    A value that already names a provider (`anthropic/…`, `openai/gpt-4o`) is
+    passed through unchanged. Both CrewAI and the Agents SDK route through
+    LiteLLM, so this one form serves both.
+    """
+    m = model.strip()
+    return m if "/" in m else "anthropic/" + m
+
+
 # --- renderers ------------------------------------------------------------
 
-def render_crewai(name: str, description: str, body: str) -> str:
-    """A CrewAI Agent: role=name, goal=description, backstory=instructions."""
+def render_crewai(name: str, description: str, body: str,
+                  model: Optional[str] = None) -> str:
+    """A CrewAI Agent: role=name, goal=description, backstory=instructions.
+
+    With `model`, pins the agent's LLM via `crewai.LLM` (LiteLLM under the
+    hood); without it, the agent uses CrewAI's default provider.
+    """
     var = _ident(name)
+    imports = "from crewai import Agent\n"
+    llm = ""
+    if model:
+        imports = "from crewai import Agent, LLM\n"
+        llm = "    llm=LLM(model=%s),\n" % _py_str(_litellm_model(model))
     return (
         "# Generated by `boost adapt %s --to crewai`. Do not edit by hand.\n"
-        "from crewai import Agent\n"
+        "%s"
         "\n"
         "%s = Agent(\n"
         "    role=%s,\n"
         "    goal=%s,\n"
         "    backstory=%s,\n"
+        "%s"
         ")\n"
     ) % (
         name,
+        imports,
         var,
         _py_str(name),
         _py_str(_clean(description)),
         _py_str(_clean(body)),
+        llm,
     )
 
 
-def render_agents_sdk(name: str, description: str, body: str) -> str:
-    """An OpenAI Agents SDK Agent: instructions carry the skill body."""
+def render_agents_sdk(name: str, description: str, body: str,
+                      model: Optional[str] = None) -> str:
+    """An OpenAI Agents SDK Agent: instructions carry the skill body.
+
+    With `model`, pins the agent's LLM via the SDK's LiteLLM extension
+    (`pip install "openai-agents[litellm]"`); without it, the agent uses the
+    SDK's default OpenAI model.
+    """
     var = _ident(name)
+    imports = "from agents import Agent\n"
+    llm = ""
+    if model:
+        imports = ("from agents import Agent\n"
+                   "from agents.extensions.models.litellm_model import LitellmModel\n")
+        llm = "    model=LitellmModel(model=%s),\n" % _py_str(_litellm_model(model))
     return (
         "# Generated by `boost adapt %s --to agents-sdk`. Do not edit by hand.\n"
-        "from agents import Agent\n"
+        "%s"
         "\n"
         "%s = Agent(\n"
         "    name=%s,\n"
         "    handoff_description=%s,\n"
         "    instructions=%s,\n"
+        "%s"
         ")\n"
     ) % (
         name,
+        imports,
         var,
         _py_str(name),
         _py_str(_clean(description)),
         _py_str(_clean(body)),
+        llm,
     )
 
 

{boost_skill_cli-1.0.135 → boost_skill_cli-1.0.136}/boost_cli/core/rag.py

@@ -303,6 +303,25 @@ def ready() -> bool:
     return bool(raw and raw.get("docs"))
 
 
+def ensure() -> bool:
+    """Ensure a usable full-content index exists, building it on first use.
+
+    This makes BM25 search the default for every surface (CLI + MCP) without the
+    user having to run ``boost reindex`` first. Returns True when RAG is usable.
+    Never raises: with no taps, or if the build fails, it returns False so the
+    caller degrades to frontmatter search instead of erroring.
+    """
+    if ready():
+        return True
+    if not registry.list_taps():
+        return False
+    try:
+        build()
+    except Exception:  # noqa: BLE001 — degrade to heuristic, never crash search
+        return False
+    return ready()
+
+
 def _bm25(query_terms: List[str], raw: dict) -> Dict[int, float]:
     docs = raw["docs"]
     n = len(docs)

{boost_skill_cli-1.0.135 → boost_skill_cli-1.0.136}/boost_cli/core/store.py

@@ -26,6 +26,10 @@ class InstallResult:
     score: int = 0
     upgraded: bool = False
     kind: str = "skill"
+    # For rules/workflows the installed content is a single file (or a merged
+    # CLAUDE.md block), not a SKILL.md tree — carry the raw source so the caller
+    # scans exactly what it installed instead of a non-existent SKILL.md.
+    scan_text: Optional[str] = None
 
 
 def skill_store_dir(name: str) -> Path:
@@ -233,7 +237,7 @@ def _install_rule(entry: dict, force: bool = False,
     res = InstallResult(
         name=name,
         dest=Path(materializations[0]["path"]) if materializations else paths.store_dir(),
-        kind="rule")
+        kind="rule", scan_text=raw)
     res.linked = linked
     res.upgraded = existing is not None
     return res
@@ -322,7 +326,7 @@ def _install_workflow(entry: dict, force: bool = False,
     res = InstallResult(
         name=name,
         dest=Path(materializations[0]["path"]) if materializations else paths.store_dir(),
-        kind="workflow")
+        kind="workflow", scan_text=raw)
     res.linked = linked
     res.upgraded = existing is not None
     return res
@@ -408,7 +412,8 @@ def sync_plan() -> Dict[str, list]:
     """
     lock = lockfile.installed()
     plan: dict[str, list] = {"missing_store": [], "missing_links": [],
-            "stale_links": [], "orphaned_store": []}
+            "stale_links": [], "orphaned_store": [],
+            "missing_materializations": []}
     for name, entry in lock.items():
         sdir = skill_store_dir(name)
         if not sdir.is_dir():
@@ -434,9 +439,34 @@ def sync_plan() -> Dict[str, list]:
                     link.resolve() if link.exists() else link.readlink())
                 if not link.exists() or (points_into_store and link.name not in lock):
                     plan["stale_links"].append(str(link))
+    # Rules/workflows don't live in the store — they materialize into agent dirs.
+    # A materialization whose file (or CLAUDE.md block) is gone can be repaired
+    # by re-materializing from the tap, same as a missing skill store dir.
+    for name, entry in lockfile.installed_rules().items():
+        if any(not _rule_materialization_ok(name, m)
+               for m in entry.get("materializations") or []):
+            plan["missing_materializations"].append(("rule", name))
+    for name, entry in lockfile.installed_workflows().items():
+        if any(not Path(m.get("path", "")).is_file()
+               for m in entry.get("materializations") or []):
+            plan["missing_materializations"].append(("workflow", name))
     return plan
 
 
+def _rule_materialization_ok(name: str, m: dict) -> bool:
+    """True if a rule materialization is still present: a file drop must exist,
+    and a Claude rule's CLAUDE.md must still carry its managed block."""
+    from . import rules
+    p = Path(m.get("path", ""))
+    if m.get("mode") == rules.MODE_CLAUDE:
+        try:
+            return p.exists() and ("boost:rule:%s start" % name) in \
+                p.read_text(encoding="utf-8")
+        except OSError:
+            return False
+    return p.is_file()
+
+
 def sync_apply(plan: Dict[str, list]) -> List[str]:
     """Fix what sync_plan found. Returns human-readable actions taken."""
     actions = []
@@ -466,6 +496,24 @@ def sync_apply(plan: Dict[str, list]) -> List[str]:
         if not restored:
             lockfile.remove_skill(name)
             actions.append("dropped %s from lock (store dir missing, source gone)" % name)
+    for kind, name in plan.get("missing_materializations", []):
+        getter = lockfile.get_rule if kind == "rule" else lockfile.get_workflow
+        entry = getter(name) or {}
+        tap_name = entry.get("tap")
+        if tap_name and tap_name != "local":
+            try:
+                from . import catalog
+                matches = [e for e in catalog.find(name)
+                           if e["tap"] == tap_name and e.get("kind", "skill") == kind]
+                if matches:
+                    install(matches[0], force=True)
+                    actions.append("re-materialized %s %s from %s"
+                                   % (kind, name, tap_name))
+                    continue
+            except BoostError:
+                pass
+        actions.append("%s %s has a missing materialization but its source is "
+                       "gone — run `boost update` or reinstall" % (kind, name))
     if actions:
         journal.log("sync", "%d fixes" % len(actions))
     return actions

{boost_skill_cli-1.0.135 → boost_skill_cli-1.0.136}/boost_skill_cli.egg-info/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: boost-skill-cli
-Version: 1.0.135
+Version: 1.0.136
 Summary: boost — Homebrew for AI coding skills
 Author: Jonathan Reyes
 License: GNU GENERAL PUBLIC LICENSE
@@ -766,8 +766,9 @@ boost tap --defaults          # pull in the 5 starter registries
 ```
 
 The default install is **zero-dependency** (pure stdlib). `boost search` and the
-`boost_search` MCP tool rank results with a built-in full-content BM25 engine
-(run `boost reindex` once to build the index). For optional **dense semantic
+`boost_search` MCP tool rank results with a built-in full-content BM25 engine —
+the index builds automatically on your first search, so BM25 is the default with
+no setup (`boost reindex` just forces a rebuild). For optional **dense semantic
 search**, install the `[rag]` extra and set an embeddings key — retrieval then
 embeds every skill and ranks by vector similarity, falling back to BM25 whenever
 the extra or key is absent:

{boost_skill_cli-1.0.135 → boost_skill_cli-1.0.136}/boost_skill_cli.egg-info/SOURCES.txt

@@ -179,6 +179,7 @@ docs/roadmap/items/rule-install-native-materialization.md
 docs/roadmap/items/runner-egress-monitoring-stepsecurity-harden-run.md
 docs/roadmap/items/sbom-aware-scanning-osv-scanner.md
 docs/roadmap/items/sbom-on-every-release-cyclonedx-syft.md
+docs/roadmap/items/scan-and-sync-rules-and-workflows.md
 docs/roadmap/items/second-type-checker-pyright.md
 docs/roadmap/items/secret-and-pii-scanning-of-installed-skills.md
 docs/roadmap/items/secret-scanning-gitleaks-push-protection.md

{boost_skill_cli-1.0.135 → boost_skill_cli-1.0.136}/docs/adapters.html

@@ -311,10 +311,15 @@ code_reviewer = <span class="fn">Agent</span>(
 boost adapt code-reviewer --to crewai -o reviewer.py
 
 <span class="c"># 2 — in a throwaway venv, install the framework and load it</span>
-python3 -m venv /tmp/crew && /tmp/crew/bin/pip install crewai
-/tmp/crew/bin/python -c <span class="s">"import reviewer; print(reviewer.code_reviewer.role)"</span>
-<span class="c"># → code-reviewer   ✦ the emitted file imported and instantiated</span></pre>
-      <p class="sec-sub" style="margin-top:22px">Supported targets today: <code>crewai</code>,
+python3 -m venv /tmp/crew && /tmp/crew/bin/pip install <span class="s">"crewai[anthropic]"</span>
+/tmp/crew/bin/python -c <span class="s">"import reviewer; print(reviewer.code_reviewer.role, reviewer.code_reviewer.llm.model)"</span>
+<span class="c"># → code-reviewer claude-haiku-4-5-20251001   ✦ imported, instantiated, on boost's model</span></pre>
+      <p class="sec-sub" style="margin-top:22px"><b>Runs on boost's model by default.</b> With no
+        <code>--model</code>, the exported agent is wired to boost's configured <code>ai.model</code>
+        (Claude) via each framework's LiteLLM path — so it runs on the same LLM boost uses, no OpenAI key.
+        Override with <code>--model openai/gpt-4o</code>, or <code>--model none</code> for the framework's
+        own default. (The <code>[anthropic]</code>/<code>[litellm]</code> extras carry that provider.)</p>
+      <p class="sec-sub" style="margin-top:14px">Supported targets today: <code>crewai</code>,
         <code>agents-sdk</code>. Adding another framework is one <code>render_*</code> function plus a row in
         the <code>FORMATS</code> registry and its golden test.</p>
     </div>

boost_skill_cli-1.0.136/docs/roadmap/items/scan-and-sync-rules-and-workflows.md

@@ -0,0 +1,27 @@
+---
+id: scan-and-sync-rules-and-workflows
+board: code
+section: internals
+status: shipped
+category: Install engine · Safety
+complexity: M
+impact: Med
+wow: 2
+note: close the last skill-only gaps for rules/workflows
+order: 26
+owner: loop/scan-sync-all-kinds
+pr: 160
+title: Scan and <code>sync</code> rules/workflows like skills
+---
+Two skill-only gaps remained after rule (<code>#141</code>) / workflow
+           (<code>#150</code>) install: the install-time injection + secret scan
+           read <code>res.dest/SKILL.md</code>, which doesn't exist for a
+           rule/workflow (a single file / merged block), so their executable
+           Markdown went unscanned; and <code>boost sync</code> only reconciled
+           skills, so a deleted rule/workflow materialization couldn't be
+           repaired. Fix both: carry the raw source on the install result
+           (<code>scan_text</code>) so injectscan/secretscan see exactly what was
+           installed, and extend <code>sync_plan</code>/<code>sync_apply</code>
+           with a <code>missing_materializations</code> pass that re-materializes
+           a rule/workflow from its tap when a drop file or CLAUDE.md block is
+           gone — mirroring the missing-store-dir repair for skills.

{boost_skill_cli-1.0.135 → boost_skill_cli-1.0.136}/docs/roadmap.html

@@ -118,7 +118,7 @@
       <div class="stat"><b>16</b><span>Shipped</span></div>
       <div class="stat"><b>1</b><span>Next up</span></div>
       <div class="stat"><b>4</b><span>Planned</span></div>
-      <div class="stat"><b>100</b><span>Loop finds</span></div>
+      <div class="stat"><b>101</b><span>Loop finds</span></div>
       <!-- /ROADMAP:stats -->
     </div>
   </section>
@@ -817,6 +817,29 @@ chunks instead cost ~70%.</p>
           <span class="m">update was skill-only after rule/workflow install</span>
         </div>
       </article>
+
+      <article class="cap rcard">
+        <div class="head"><span class="pill shipped">Shipped</span><span class="cat">Install engine · Safety</span></div>
+        <h3>Scan and <code>sync</code> rules/workflows like skills</h3>
+        <p>Two skill-only gaps remained after rule (<code>#141</code>) / workflow
+           (<code>#150</code>) install: the install-time injection + secret scan
+           read <code>res.dest/SKILL.md</code>, which doesn't exist for a
+           rule/workflow (a single file / merged block), so their executable
+           Markdown went unscanned; and <code>boost sync</code> only reconciled
+           skills, so a deleted rule/workflow materialization couldn't be
+           repaired. Fix both: carry the raw source on the install result
+           (<code>scan_text</code>) so injectscan/secretscan see exactly what was
+           installed, and extend <code>sync_plan</code>/<code>sync_apply</code>
+           with a <code>missing_materializations</code> pass that re-materializes
+           a rule/workflow from its tap when a drop file or CLAUDE.md block is
+           gone — mirroring the missing-store-dir repair for skills.</p>
+        <div class="meta">
+          <span class="m">Complexity <b>M</b></span>
+          <span class="m">Impact <b>Med</b></span>
+          <span class="m">Wow <b class="wow">★★</b></span>
+          <span class="m">close the last skill-only gaps for rules/workflows</span>
+        </div>
+      </article>
       <!-- /ROADMAP:cards -->
 
     </div>

{boost_skill_cli-1.0.135 → boost_skill_cli-1.0.136}/examples/README.md

@@ -19,11 +19,14 @@ What it does (all offline — **no `OPENAI_API_KEY` needed**):
 2. Authors **one** `SKILL.md` and imports it into boost.
 3. **Value 1** — renders it to *both* frameworks and instantiates each:
    a real `crewai.Agent` and a real `agents.Agent` from the same source, no
-   hand-porting.
+   hand-porting. Both are wired to **boost's configured `ai.model` (Claude)** by
+   default, so they run on the same LLM boost uses — no OpenAI key. Override per
+   run with `boost adapt … --model openai/gpt-4o`, or `--model none` for the
+   framework's own default.
 4. **Value 2** — edits the skill **once** and re-adapts; the change appears in
    **both** generated files (before/after `0 0` → `1 1`). That is the
    drift-killing payoff: one edit, every runtime current.
-5. Optional: if `OPENAI_API_KEY` is set, actually runs the agent.
+5. Optional: if `ANTHROPIC_API_KEY` is set, actually runs the agent on Claude.
 
 Requirements: **Python 3.11–3.13** (CrewAI's `tiktoken` dependency has no 3.14
 wheel yet; boost itself supports 3.9–3.14). Clean up with