boost-skill-cli 1.0.188__tar.gz → 1.0.190__tar.gz

boost_skill_cli-1.0.190/.lighthouserc.json

@@ -0,0 +1,29 @@
+{
+  "ci": {
+    "collect": {
+      "startServerCommand": "python3 -m http.server 8099 --bind 127.0.0.1",
+      "startServerReadyPattern": "Serving HTTP",
+      "url": [
+        "http://127.0.0.1:8099/docs/index.html",
+        "http://127.0.0.1:8099/docs/roadmap.html"
+      ],
+      "numberOfRuns": 3,
+      "settings": {
+        "chromeFlags": "--no-sandbox --headless=new"
+      }
+    },
+    "assert": {
+      "aggregationMethod": "median-run",
+      "assertions": {
+        "categories:performance": ["error", { "minScore": 0.85 }],
+        "categories:accessibility": ["error", { "minScore": 0.95 }],
+        "categories:best-practices": ["error", { "minScore": 0.9 }],
+        "categories:seo": ["error", { "minScore": 0.95 }]
+      }
+    },
+    "upload": {
+      "target": "filesystem",
+      "outputDir": ".lighthouseci"
+    }
+  }
+}

{boost_skill_cli-1.0.188 → boost_skill_cli-1.0.190}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: boost-skill-cli
-Version: 1.0.188
+Version: 1.0.190
 Summary: boost — Homebrew for AI coding skills
 Author: Jonathan Reyes
 License: GNU GENERAL PUBLIC LICENSE

{boost_skill_cli-1.0.188 → boost_skill_cli-1.0.190}/boost_cli/_version.py

@@ -18,7 +18,7 @@ version_tuple: tuple[int | str, ...]
 commit_id: str | None
 __commit_id__: str | None
 
-__version__ = version = '1.0.188'
-__version_tuple__ = version_tuple = (1, 0, 188)
+__version__ = version = '1.0.190'
+__version_tuple__ = version_tuple = (1, 0, 190)
 
 __commit_id__ = commit_id = None

{boost_skill_cli-1.0.188 → boost_skill_cli-1.0.190}/boost_cli/core/scopes.py

@@ -203,3 +203,27 @@ def contains(base, path) -> bool:
         return os.path.commonpath([str(base_r), str(path_r)]) == str(base_r)
     except (OSError, ValueError):
         return False
+
+
+def ensure_in_base(base, path):
+    """Raise if ``path`` would resolve outside ``base`` — the guard before any
+    project-scope WRITE, the mirror of :func:`contains` before every delete.
+
+    A project destination is built from directory names committed in the repo
+    (``.claude/skills`` and its per-agent siblings). A hostile repo can ship one
+    of those as a symlink pointing outside the tree — at ``~/.ssh``, say — and
+    the ``mkdir(parents=True)`` + ``os.replace`` that materializes a skill would
+    then run on the far side, escaping the project entirely. The squatter check
+    (refuse to overwrite a path boost did not create) does not stop this:
+    dropping a *new* name like ``authorized_keys`` collides with nothing, and
+    ``--force`` waives it regardless. ``contains`` resolves symlinks on both
+    ends, so re-deriving containment here — before the write, independent of
+    existence or force — is the boundary that actually holds. Returns ``path``
+    so a caller can wrap the target inline.
+    """
+    if not contains(base, path):
+        raise BoostError(
+            "refusing to install %s: it resolves outside this project" % path,
+            hint="a directory such as .claude/skills in this repo is a symlink "
+                 "pointing outside it — remove or replace it, then reinstall")
+    return Path(path)

{boost_skill_cli-1.0.188 → boost_skill_cli-1.0.190}/boost_cli/core/store.py

@@ -281,6 +281,15 @@ def _install_project_skill(entry: dict, force: bool = False,
                for agent, skills_dir in agents.enabled_agents().items()
                if not only_agents or agent in only_agents]
 
+    # Refuse to write through a symlink that leaves the repo. An agent dir like
+    # ``.claude/skills`` is committed, so a hostile clone can ship it as a
+    # symlink to ``~/.ssh`` and the copy below would land on the far side.
+    # Checked for every target up front — before existence, force, or any write
+    # — so a single escaping dir aborts the whole install rather than writing
+    # part of it outside the project first.
+    for _agent, dest in targets:
+        scopes.ensure_in_base(resolved_base, dest)
+
     # Refuse to clobber a directory boost did not put there. In user scope the
     # store is boost's alone, but here the destination is inside someone's repo
     # — a same-named hand-written skill is a real possibility, and overwriting
@@ -492,6 +501,11 @@ def _install_rule(entry: dict, force: bool = False,
         if only_agents and agent not in only_agents:
             continue
         mode, path = rules.rule_target(agent, skills_dir, name, base=resolved_base)
+        # Project scope writes into the repo, so a committed agent dir could be
+        # a symlink escaping it (see scopes.ensure_in_base). User scope writes
+        # into the user's own ~/.claude, which they control — nothing to guard.
+        if resolved_base is not None:
+            scopes.ensure_in_base(resolved_base, path)
         path.parent.mkdir(parents=True, exist_ok=True)
         if mode == rules.MODE_CLAUDE:
             current = path.read_text(encoding="utf-8") if path.exists() else ""
@@ -591,6 +605,11 @@ def _install_workflow(entry: dict, force: bool = False,
         if only_agents and agent not in only_agents:
             continue
         path = workflows.workflow_target(skills_dir, slot, name, base=resolved_base)
+        # Project scope writes into the repo; a committed agent dir could be a
+        # symlink escaping it (see scopes.ensure_in_base). User scope writes into
+        # the user's own ~/.claude, which they control — nothing to guard.
+        if resolved_base is not None:
+            scopes.ensure_in_base(resolved_base, path)
         path.parent.mkdir(parents=True, exist_ok=True)
         util.atomic_write_text(path, raw)
         materializations.append({"agent": agent, "slot": slot, "path": str(path)})

{boost_skill_cli-1.0.188 → boost_skill_cli-1.0.190}/boost_skill_cli.egg-info/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: boost-skill-cli
-Version: 1.0.188
+Version: 1.0.190
 Summary: boost — Homebrew for AI coding skills
 Author: Jonathan Reyes
 License: GNU GENERAL PUBLIC LICENSE

{boost_skill_cli-1.0.188 → boost_skill_cli-1.0.190}/boost_skill_cli.egg-info/SOURCES.txt

@@ -2,6 +2,7 @@
 .gitignore
 .gitleaks.toml
 .htmlvalidate.json
+.lighthouserc.json
 .lycheeignore
 .markdownlint-cli2.jsonc
 .pre-commit-config.yaml
@@ -184,6 +185,7 @@ docs/roadmap/items/performance-regression-gate-pytest-benchmark.md
 docs/roadmap/items/post-deploy-smoke-headless-load-check.md
 docs/roadmap/items/pre-release-python-canary-3-14t-free-threaded.md
 docs/roadmap/items/project-scope-across-every-command.md
+docs/roadmap/items/project-scope-symlink-escape-on-write.md
 docs/roadmap/items/promote-nav-footer-into-the-shared-style-system.md
 docs/roadmap/items/prompt-injection-scanning-of-skill-markdown.md
 docs/roadmap/items/property-based-tests-hypothesis-on-the-parsers.md

{boost_skill_cli-1.0.188 → boost_skill_cli-1.0.190}/docs/index.html

@@ -3,6 +3,7 @@
 <head>
 <meta charset="utf-8">
 <meta name="viewport" content="width=device-width, initial-scale=1">
+<meta name="description" content="boost is a package manager for AI coding skills — find, install, and govern the SKILL.md, rule, and workflow files that Claude Code, Cursor, and Windsurf run on, wired into every agent in one pass.">
 <title>boost — Homebrew for AI coding skills</title>
 <!-- Canonical Aurora tokens + primitives (single source of truth). The
      inline block below carries ONLY page-specific layout, and wins ties
@@ -184,8 +185,8 @@
     font-family: var(--mono); font-size: 10.5px; font-weight: 700;
     letter-spacing: .2em; text-transform: uppercase; color: var(--text-2);
   }
-  .node h4 { font-size: 18px; font-weight: 750; margin-top: 8px; letter-spacing: -.01em; }
-  .node h4 code { font-size: 15.5px; color: var(--cyan); }
+  .node h3 { font-size: 18px; font-weight: 750; margin-top: 8px; letter-spacing: -.01em; }
+  .node h3 code { font-size: 15.5px; color: var(--cyan); }
   .node p { font-size: 13.5px; color: var(--text-2); margin-top: 6px; }
   .node.src   { border-color: rgba(96,165,250,.5);  box-shadow: 0 0 32px rgba(96,165,250,.07); }
   .node.mid   { border-color: rgba(255,255,255,.14); }
@@ -473,7 +474,7 @@ facilitate structured divergent thinking:
         <div class="flow-row one reveal">
           <div class="node src">
             <span class="tag">Source</span>
-            <h4>GitHub registries</h4>
+            <h3>GitHub registries</h3>
             <p>5 pre-tapped registries + a 10,000-skill discovery index</p>
           </div>
         </div>
@@ -484,12 +485,12 @@ facilitate structured divergent thinking:
         <div class="flow-row two reveal">
           <div class="node mid">
             <span class="tag">Local Mirror</span>
-            <h4><code>~/.boost/repos/</code></h4>
+            <h3><code>~/.boost/repos/</code></h3>
             <p>Shallow git clones</p>
           </div>
           <div class="node mid">
             <span class="tag">Search Cache</span>
-            <h4><code>~/.boost/cache/</code></h4>
+            <h3><code>~/.boost/cache/</code></h3>
             <p>JSON catalogs from SKILL.md frontmatter</p>
           </div>
         </div>
@@ -500,12 +501,12 @@ facilitate structured divergent thinking:
         <div class="flow-row two reveal">
           <div class="node store">
             <span class="tag">Canonical Store</span>
-            <h4><code>~/.agents/skills/</code></h4>
+            <h3><code>~/.agents/skills/</code></h3>
             <p>Single source of truth for installed skills</p>
           </div>
           <div class="node lock">
             <span class="tag">Lock File</span>
-            <h4><code>.skill-lock.json</code></h4>
+            <h3><code>.skill-lock.json</code></h3>
             <p>v3 schema — pins version, commit &amp; content hash</p>
           </div>
         </div>
@@ -516,17 +517,17 @@ facilitate structured divergent thinking:
         <div class="flow-row three reveal">
           <div class="node agent">
             <span class="tag">Agent</span>
-            <h4>Claude Code</h4>
+            <h3>Claude Code</h3>
             <p><code>~/.claude/skills/</code></p>
           </div>
           <div class="node agent">
             <span class="tag">Agent</span>
-            <h4>Windsurf</h4>
+            <h3>Windsurf</h3>
             <p><code>~/.windsurf/skills/</code></p>
           </div>
           <div class="node agent">
             <span class="tag">Agent</span>
-            <h4>Cursor</h4>
+            <h3>Cursor</h3>
             <p><code>~/.cursor/skills/</code></p>
           </div>
         </div>

boost_skill_cli-1.0.190/docs/roadmap/items/lighthouse-ci-on-the-pages-site.md

@@ -0,0 +1,27 @@
+---
+id: lighthouse-ci-on-the-pages-site
+board: code
+section: docsite
+status: shipped
+category: Docs · Perf
+complexity: M
+impact: High
+wow: 5
+note: 4 budgets + 3 real a11y fixes
+order: 2
+owner: loop/lighthouse
+pr: 214
+title: Lighthouse CI on the Pages site
+---
+<code>treosh/lighthouse-ci-action</code> scores <code>index.html</code>
+           and <code>roadmap.html</code> on performance, accessibility,
+           best-practices and SEO on every deploy, and fails the build against
+           budgets. Turns the marketing surface's quality into four numbers that can't
+           silently regress as the Aurora theme evolves — four floors (a11y and
+           SEO 0.95, best-practices 0.90, the noisier performance 0.85) asserted
+           on the median of three runs, calibrated below the real scores with
+           margin the same way <code>perf_gate</code> sets its thresholds. And,
+           as every checker on this repo has, it found real defects on the
+           storefront: muted text at <code>3.9:1</code> contrast (below WCAG AA),
+           an <code>h2 → h4</code> heading skip, and colour-only footer links —
+           all fixed, so both pages now score <code>100</code> on accessibility.

boost_skill_cli-1.0.190/docs/roadmap/items/project-scope-symlink-escape-on-write.md

@@ -0,0 +1,33 @@
+---
+id: project-scope-symlink-escape-on-write
+board: code
+section: trust
+status: shipped
+category: Security · Integrity
+complexity: S
+impact: High
+wow: 4
+note: hostile repo could write outside itself
+order: 6
+owner: loop/writeguard
+pr: 213
+title: Project scope — refuse to write through an escaping symlink
+---
+Workspace scope (<a href="https://github.com/jonnyeclectic/boost/pull/212">#212</a>)
+           guarded the delete side — <code>uninstall --local</code> re-derives every
+           recorded path and refuses one that resolves outside the repo — but not
+           the <em>write</em> side. A project install builds its destination from
+           agent-dir names committed in the repo
+           (<code>.claude/skills</code> and its per-agent siblings), and a hostile
+           clone can ship one of those as a <strong>symlink pointing outside the
+           tree</strong> — at <code>~/.ssh</code>, say. Cloning that repo and
+           running <code>boost install &lt;skill&gt; --local</code> then writes on the
+           far side: confirmed by reproduction, a skill directory landed in a
+           sibling of the repo instead of inside it. The squatter check does not
+           stop it (a brand-new leaf name like <code>authorized_keys</code>
+           collides with nothing, and <code>--force</code> waives it anyway).
+           <code>scopes.ensure_in_base</code> is the write-side mirror of the
+           delete guard: it re-derives containment through symlinks for every
+           target up front, so one escaping directory aborts the whole install
+           before anything is written. Covers all three project-scope kinds —
+           skill, rule and workflow.

{boost_skill_cli-1.0.188 → boost_skill_cli-1.0.190}/docs/roadmap.html

@@ -73,7 +73,7 @@
   .legend .k { display: inline-flex; align-items: center; gap: 8px; }
 
   footer { text-align: center; padding: 60px 0 48px; color: var(--text-3); font-size: 13px; }
-  footer a { color: var(--cyan); text-decoration: none; }
+  footer a { color: var(--cyan); text-decoration: underline; }
 
   @media (max-width: 560px) { .topbar nav { display: none; } }
 </style>
@@ -118,7 +118,7 @@
       <div class="stat"><b>16</b><span>Shipped</span></div>
       <div class="stat"><b>1</b><span>Next up</span></div>
       <div class="stat"><b>4</b><span>Planned</span></div>
-      <div class="stat"><b>109</b><span>Loop finds</span></div>
+      <div class="stat"><b>110</b><span>Loop finds</span></div>
       <!-- /ROADMAP:stats -->
     </div>
   </section>
@@ -1560,18 +1560,25 @@ and the work stays visible.</p>
       </article>
 
       <article class="cap rcard">
-        <div class="head"><span class="pill planned">Planned</span><span class="cat">Docs · Perf</span></div>
+        <div class="head"><span class="pill shipped">Shipped</span><span class="cat">Docs · Perf</span></div>
         <h3>Lighthouse CI on the Pages site</h3>
         <p><code>treosh/lighthouse-ci-action</code> scores <code>index.html</code>
            and <code>roadmap.html</code> on performance, accessibility,
            best-practices and SEO on every deploy, and fails the build against
-           budgets. Turns the marketing surface's quality into a number that can't
-           silently regress as the Aurora theme evolves.</p>
+           budgets. Turns the marketing surface's quality into four numbers that can't
+           silently regress as the Aurora theme evolves — four floors (a11y and
+           SEO 0.95, best-practices 0.90, the noisier performance 0.85) asserted
+           on the median of three runs, calibrated below the real scores with
+           margin the same way <code>perf_gate</code> sets its thresholds. And,
+           as every checker on this repo has, it found real defects on the
+           storefront: muted text at <code>3.9:1</code> contrast (below WCAG AA),
+           an <code>h2 → h4</code> heading skip, and colour-only footer links —
+           all fixed, so both pages now score <code>100</code> on accessibility.</p>
         <div class="meta">
           <span class="m">Complexity <b>M</b></span>
           <span class="m hi">Impact <b>High</b></span>
           <span class="m">Wow <b class="wow">★★★★★</b></span>
-          <span class="m">4 score budgets</span>
+          <span class="m">4 budgets + 3 real a11y fixes</span>
         </div>
       </article>
 
@@ -2082,6 +2089,35 @@ paths.</p>
         </div>
       </article>
 
+      <article class="cap rcard">
+        <div class="head"><span class="pill shipped">Shipped</span><span class="cat">Security · Integrity</span></div>
+        <h3>Project scope — refuse to write through an escaping symlink</h3>
+        <p>Workspace scope (<a href="https://github.com/jonnyeclectic/boost/pull/212">#212</a>)
+           guarded the delete side — <code>uninstall --local</code> re-derives every
+           recorded path and refuses one that resolves outside the repo — but not
+           the <em>write</em> side. A project install builds its destination from
+           agent-dir names committed in the repo
+           (<code>.claude/skills</code> and its per-agent siblings), and a hostile
+           clone can ship one of those as a <strong>symlink pointing outside the
+           tree</strong> — at <code>~/.ssh</code>, say. Cloning that repo and
+           running <code>boost install &lt;skill&gt; --local</code> then writes on the
+           far side: confirmed by reproduction, a skill directory landed in a
+           sibling of the repo instead of inside it. The squatter check does not
+           stop it (a brand-new leaf name like <code>authorized_keys</code>
+           collides with nothing, and <code>--force</code> waives it anyway).
+           <code>scopes.ensure_in_base</code> is the write-side mirror of the
+           delete guard: it re-derives containment through symlinks for every
+           target up front, so one escaping directory aborts the whole install
+           before anything is written. Covers all three project-scope kinds —
+           skill, rule and workflow.</p>
+        <div class="meta">
+          <span class="m">Complexity <b>S</b></span>
+          <span class="m hi">Impact <b>High</b></span>
+          <span class="m">Wow <b class="wow">★★★★</b></span>
+          <span class="m">hostile repo could write outside itself</span>
+        </div>
+      </article>
+
       <article class="cap rcard">
         <div class="head"><span class="pill shipped">Shipped</span><span class="cat">Security · Secrets</span></div>
         <h3>Secret &amp; PII scanning of installed skills</h3>

{boost_skill_cli-1.0.188 → boost_skill_cli-1.0.190}/style/boost.css

@@ -26,7 +26,7 @@
   --line-hi:     rgb(255 255 255 / 22%);
   --text:        #e9ebf5;
   --text-2:      #9298b0;
-  --text-3:      #676d86;
+  --text-3:      #767c96;   /* muted; ≥4.5:1 on --bg (WCAG AA) — was #676d86 (3.9:1) */
 
   /* --- the triad: the whole identity lives in these three --- */
   --cyan:        #22d3ee;   /* primary accent */
@@ -385,7 +385,10 @@ footer {
   border-top: 1px solid var(--line);
   color: var(--text-3); font-size: 13px;
 }
-footer a { color: var(--text-2); text-decoration: none; }
+/* Underlined, not colour-only: a link inside footer prose must be
+   distinguishable without relying on colour (WCAG 1.4.1 / Lighthouse
+   link-in-text-block). */
+footer a { color: var(--text-2); text-decoration: underline; }
 footer a:hover { color: var(--text); }
 
 @media (max-width: 720px) {

{boost_skill_cli-1.0.188 → boost_skill_cli-1.0.190}/tests/unit/test_scopes.py

@@ -284,3 +284,41 @@ def test_contains_fails_closed_when_resolution_errors(tmp_path, monkeypatch):
 
     monkeypatch.setattr(scopes, "Path", ExplodingPath)
     assert scopes.contains(tmp_path, tmp_path / "x") is False
+
+
+# ── ensure_in_base: the write guard ──────────────────────────────────────
+
+def test_ensure_in_base_returns_the_path_when_inside(tmp_path):
+    dest = tmp_path / ".claude" / "skills" / "x"
+    assert scopes.ensure_in_base(tmp_path, dest) == Path(dest)
+
+
+def test_ensure_in_base_raises_on_a_plain_escape(tmp_path):
+    (tmp_path / "repo").mkdir()
+    with pytest.raises(BoostError) as err:
+        scopes.ensure_in_base(tmp_path / "repo", tmp_path / "elsewhere" / "x")
+    assert "outside this project" in err.value.message
+
+
+def test_ensure_in_base_raises_when_a_symlinked_dir_escapes(tmp_path):
+    """The write-side attack contains() is reused for: an agent dir committed as
+    a symlink pointing outside the repo, targeting a NEW leaf that does not yet
+    exist — so nothing but the containment check can catch it."""
+    repo = tmp_path / "repo"
+    (repo / ".git").mkdir(parents=True)
+    (repo / ".claude").mkdir()
+    outside = tmp_path / "outside"
+    outside.mkdir()
+    (repo / ".claude" / "skills").symlink_to(outside, target_is_directory=True)
+    # repo/.claude/skills/authorized_keys resolves to outside/authorized_keys.
+    dest = repo / ".claude" / "skills" / "authorized_keys"
+    with pytest.raises(BoostError):
+        scopes.ensure_in_base(repo, dest)
+
+
+def test_ensure_in_base_allows_a_real_nested_dir(tmp_path):
+    # A legitimate project dir, even several levels deep, must pass untouched.
+    repo = tmp_path / "repo"
+    (repo / ".claude" / "skills").mkdir(parents=True)
+    dest = repo / ".claude" / "skills" / "ok"
+    assert scopes.ensure_in_base(repo, dest) == Path(dest)

{boost_skill_cli-1.0.188 → boost_skill_cli-1.0.190}/tests/unit/test_store.py

@@ -860,6 +860,31 @@ class TestProjectSkills:
         store.install(entry, scope="project", base=str(repo), force=True)
         assert projectlock.get_skill(repo, "brainstorming")["installed_at"] == first
 
+    def test_symlinked_agent_dir_cannot_escape_the_repo(self, entry, tmp_path):
+        """A committed ``.claude/skills`` symlink pointing outside the repo must
+        not let the install write on the far side.
+
+        The attack: a hostile clone ships an agent dir as a symlink to, say,
+        ``~/.ssh``; ``_copy_skill`` would then ``mkdir``/``os.replace`` through
+        it and land outside the project. Guarded by ``scopes.ensure_in_base``
+        before any write. Uses a fresh skill name so the squatter check (which
+        only fires on an existing path) is not what does the blocking.
+        """
+        repo = self._repo(tmp_path)
+        outside = tmp_path / "outside"          # stands in for ~/.ssh
+        outside.mkdir()
+        (repo / ".claude").mkdir()
+        (repo / ".claude" / "skills").symlink_to(outside, target_is_directory=True)
+
+        with pytest.raises(BoostError) as err:
+            store.install(entry, scope="project", base=str(repo))
+        assert "outside this project" in err.value.message
+        # Nothing written through the symlink, and the all-or-nothing pre-check
+        # means the other agents' in-repo dirs stay untouched too.
+        assert list(outside.iterdir()) == []
+        assert not (repo / ".windsurf" / "skills" / "brainstorming").exists()
+        assert not (repo / ".cursor" / "skills" / "brainstorming").exists()
+
     def test_policy_blocks_a_project_install_too(self, entry, tmp_path):
         # Vendoring into a repo is not an escape hatch around policy.
         policy.save({"blocked_skills": ["brainstorming"]})

boost_skill_cli-1.0.188/docs/roadmap/items/lighthouse-ci-on-the-pages-site.md

@@ -1,20 +0,0 @@
----
-id: lighthouse-ci-on-the-pages-site
-board: code
-section: docsite
-status: planned
-category: Docs · Perf
-complexity: M
-impact: High
-wow: 5
-note: 4 score budgets
-order: 2
-owner:
-pr:
-title: Lighthouse CI on the Pages site
----
-<code>treosh/lighthouse-ci-action</code> scores <code>index.html</code>
-           and <code>roadmap.html</code> on performance, accessibility,
-           best-practices and SEO on every deploy, and fails the build against
-           budgets. Turns the marketing surface's quality into a number that can't
-           silently regress as the Aurora theme evolves.