boost-skill-cli 1.0.1__tar.gz → 1.0.4__tar.gz

boost_skill_cli-1.0.4/.gitignore

@@ -0,0 +1,221 @@
+# Byte-compiled / optimized / DLL files
+__pycache__/
+*.py[codz]
+*$py.class
+
+# C extensions
+*.so
+
+# Distribution / packaging
+.Python
+build/
+develop-eggs/
+dist/
+downloads/
+eggs/
+.eggs/
+lib/
+lib64/
+parts/
+sdist/
+var/
+wheels/
+share/python-wheels/
+*.egg-info/
+.installed.cfg
+*.egg
+MANIFEST
+
+# PyInstaller
+#   Usually these files are written by a python script from a template
+#   before PyInstaller builds the exe, so as to inject date/other infos into it.
+*.manifest
+*.spec
+
+# Installer logs
+pip-log.txt
+pip-delete-this-directory.txt
+
+# Unit test / coverage reports
+htmlcov/
+.tox/
+.nox/
+.coverage
+.coverage.*
+.cache
+nosetests.xml
+coverage.xml
+*.cover
+*.py.cover
+.hypothesis/
+.pytest_cache/
+cover/
+
+# Translations
+*.mo
+*.pot
+
+# Django stuff:
+*.log
+local_settings.py
+db.sqlite3
+db.sqlite3-journal
+
+# Flask stuff:
+instance/
+.webassets-cache
+
+# Scrapy stuff:
+.scrapy
+
+# Sphinx documentation
+docs/_build/
+
+# PyBuilder
+.pybuilder/
+target/
+
+# Jupyter Notebook
+.ipynb_checkpoints
+
+# IPython
+profile_default/
+ipython_config.py
+
+# pyenv
+#   For a library or package, you might want to ignore these files since the code is
+#   intended to run in multiple environments; otherwise, check them in:
+# .python-version
+
+# pipenv
+#   According to pypa/pipenv#598, it is recommended to include Pipfile.lock in version control.
+#   However, in case of collaboration, if having platform-specific dependencies or dependencies
+#   having no cross-platform support, pipenv may install dependencies that don't work, or not
+#   install all needed dependencies.
+# Pipfile.lock
+
+# UV
+#   Similar to Pipfile.lock, it is generally recommended to include uv.lock in version control.
+#   This is especially recommended for binary packages to ensure reproducibility, and is more
+#   commonly ignored for libraries.
+# uv.lock
+
+# poetry
+#   Similar to Pipfile.lock, it is generally recommended to include poetry.lock in version control.
+#   This is especially recommended for binary packages to ensure reproducibility, and is more
+#   commonly ignored for libraries.
+#   https://python-poetry.org/docs/basic-usage/#commit-your-poetrylock-file-to-version-control
+# poetry.lock
+# poetry.toml
+
+# pdm
+#   Similar to Pipfile.lock, it is generally recommended to include pdm.lock in version control.
+#   pdm recommends including project-wide configuration in pdm.toml, but excluding .pdm-python.
+#   https://pdm-project.org/en/latest/usage/project/#working-with-version-control
+# pdm.lock
+# pdm.toml
+.pdm-python
+.pdm-build/
+
+# pixi
+#   Similar to Pipfile.lock, it is generally recommended to include pixi.lock in version control.
+# pixi.lock
+#   Pixi creates a virtual environment in the .pixi directory, just like venv module creates one
+#   in the .venv directory. It is recommended not to include this directory in version control.
+.pixi
+
+# PEP 582; used by e.g. github.com/David-OConnor/pyflow and github.com/pdm-project/pdm
+__pypackages__/
+
+# Celery stuff
+celerybeat-schedule
+celerybeat.pid
+
+# Redis
+*.rdb
+*.aof
+*.pid
+
+# RabbitMQ
+mnesia/
+rabbitmq/
+rabbitmq-data/
+
+# ActiveMQ
+activemq-data/
+
+# SageMath parsed files
+*.sage.py
+
+# Environments
+.env
+.envrc
+.venv
+env/
+venv/
+ENV/
+env.bak/
+venv.bak/
+
+# Spyder project settings
+.spyderproject
+.spyproject
+
+# Rope project settings
+.ropeproject
+
+# mkdocs documentation
+/site
+
+# mypy
+.mypy_cache/
+.dmypy.json
+dmypy.json
+
+# Pyre type checker
+.pyre/
+
+# pytype static type analyzer
+.pytype/
+
+# Cython debug symbols
+cython_debug/
+
+# PyCharm
+#   JetBrains specific template is maintained in a separate JetBrains.gitignore that can
+#   be found at https://github.com/github/gitignore/blob/main/Global/JetBrains.gitignore
+#   and can be added to the global gitignore or merged into this file.  For a more nuclear
+#   option (not recommended) you can uncomment the following to ignore the entire idea folder.
+# .idea/
+
+# Abstra
+#   Abstra is an AI-powered process automation framework.
+#   Ignore directories containing user credentials, local state, and settings.
+#   Learn more at https://abstra.io/docs
+.abstra/
+
+# Visual Studio Code
+#   Visual Studio Code specific template is maintained in a separate VisualStudioCode.gitignore 
+#   that can be found at https://github.com/github/gitignore/blob/main/Global/VisualStudioCode.gitignore
+#   and can be added to the global gitignore or merged into this file. However, if you prefer, 
+#   you could uncomment the following to ignore the entire vscode folder
+# .vscode/
+# Temporary file for partial code execution
+tempCodeRunnerFile.py
+
+# Ruff stuff:
+.ruff_cache/
+
+# PyPI configuration file
+.pypirc
+
+# Marimo
+marimo/_static/
+marimo/_lsp/
+__marimo__/
+
+# Streamlit
+.streamlit/secrets.toml
+
+# setuptools-scm generated version file
+boost_cli/_version.py

boost_skill_cli-1.0.4/CONTRIBUTING.md

@@ -0,0 +1,39 @@
+# Contributing to boost
+
+Thanks for taking an interest! boost is deliberately small and dependency-free,
+so contributing is mostly about keeping the quality gates green.
+
+## Dev setup
+
+```bash
+git clone https://github.com/jonnyeclectic/boost && cd boost
+make venv          # pytest, coverage, mutmut, ruff, mypy — runtime stays stdlib-only
+```
+
+Every test runs against a throwaway `$HOME`, so nothing touches your real
+agent configs.
+
+## The gates (CI runs all of these)
+
+| Command | Gate |
+|---|---|
+| `make test` | unit + functional suites, **≥80% line coverage** |
+| `bash tests/smoke.sh` | 152 end-to-end checks through the real `./boost` shim |
+| `make mutation` | mutmut over `boost_cli/core`, **≥80% mutants killed** |
+| `ruff check boost_cli tests` | lint, zero findings |
+| `mypy` | type check, zero errors |
+
+## Ground rules
+
+- **Stdlib only** at runtime. No third-party imports in `boost_cli/`.
+- New commands live in `boost_cli/commands/<group>.py` as
+  `def cmd_<name>(argv) -> int` and are dispatched lazily from `cli.py`.
+- Behavior changes need tests — functional tests drive the CLI in-process via
+  `boost_cli.cli.main` (see `tests/conftest.py` for the fixtures).
+- Anything under `boost_cli/core/` is mutation-tested; expect to add unit
+  tests that actually kill your mutants.
+
+## Pull requests
+
+Branch from `main`, keep PRs focused, and write the PR description in the
+commit message (it becomes the release notes via release-drafter).

boost_skill_cli-1.0.4/MANIFEST.in

@@ -0,0 +1,12 @@
+# Keep source releases lean: the runtime is boost_cli/ (with its bundled
+# data), plus the usual metadata. Everything below is dev-only or generated
+# and should never ship in the sdist.
+include README.md LICENSE pyproject.toml setup.cfg
+recursive-include boost_cli *.py *.json
+prune mutants
+prune dist
+prune .idea
+prune .claude
+prune .github
+exclude .coverage
+global-exclude __pycache__ *.pyc *.pyo .DS_Store

boost_skill_cli-1.0.4/Makefile

@@ -0,0 +1,47 @@
+# boost — test & quality gates
+# `make check` is the full production gate: unit + functional with >=80%
+# coverage, the shell-level smoke suite, and >=80% mutation strength.
+
+VENV    := .venv
+PY      := $(VENV)/bin/python
+PYTEST  := $(VENV)/bin/pytest
+
+.PHONY: venv test unit functional smoke coverage mutation lint check demo clean-test
+
+venv:
+	python3 -m venv $(VENV)
+	$(VENV)/bin/pip -q install pytest pytest-cov coverage mutmut ruff mypy
+
+unit:
+	$(PYTEST) tests/unit -q
+
+functional:
+	$(PYTEST) tests/functional -q
+
+# pytest suites with the 80% line-coverage gate (fail_under in pyproject.toml)
+test:
+	$(PYTEST) tests/unit tests/functional --cov=boost_cli --cov-report=term-missing -q
+
+coverage: test
+
+# shell-level functional suite: drives the real shim end-to-end in a sandbox
+smoke:
+	bash tests/smoke.sh
+
+# mutation testing over boost_cli/core with the unit suite; 80% kill gate
+mutation:
+	$(PY) scripts/mutation_gate.py --run --min 80
+
+lint:
+	$(VENV)/bin/ruff check boost_cli tests
+	$(VENV)/bin/mypy
+
+# regenerate docs/demo.gif (brew install vhs)
+demo:
+	vhs docs/demo.tape
+
+check: lint test smoke mutation
+	@echo "== all gates passed =="
+
+clean-test:
+	rm -rf mutants .coverage htmlcov .pytest_cache

{boost_skill_cli-1.0.1 → boost_skill_cli-1.0.4}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: boost-skill-cli
-Version: 1.0.1
+Version: 1.0.4
 Summary: boost — Homebrew for AI coding skills
 Author: Jonathan Reyes
 License: GNU GENERAL PUBLIC LICENSE
@@ -740,9 +740,26 @@ Needs Python 3.9+ and `git`.
 ```bash
 pipx install boost-skill-cli        # or: pip install boost-skill-cli
 boost --version
-boost tap --defaults          # pull in the starter registries
+boost tap --defaults          # pull in the 5 starter registries
 ```
 
+Want the whole ecosystem instead of the starter set? boost ships a **curated
+registry catalog** — 90+ classified GitHub registries of skills, Cursor/Windsurf
+**rules**, and Claude Code **workflows** (slash commands & subagents),
+collectively indexing thousands of items:
+
+```bash
+boost tap --catalog --dry-run                 # browse the classified catalog
+boost tap --catalog --type skill --limit 20   # tap the 20 biggest skill packs
+boost tap --catalog --type rule               # every rules registry
+boost tap --catalog --category security       # filter by category
+```
+
+boost indexes three item kinds out of the same registries: `SKILL.md` **skills**,
+`.mdc`/`.cursorrules`/`.windsurfrules` **rules**, and command/agent **workflows**
+(Markdown under `commands/`·`agents/`·`workflows/`, or carrying subagent
+frontmatter). Rules and workflows are searchable today; only skills install.
+
 Or run it straight from a checkout — the runtime is stdlib-only, so there's
 nothing to install beyond the shim:
 

{boost_skill_cli-1.0.1 → boost_skill_cli-1.0.4}/README.md

@@ -36,9 +36,26 @@ Needs Python 3.9+ and `git`.
 ```bash
 pipx install boost-skill-cli        # or: pip install boost-skill-cli
 boost --version
-boost tap --defaults          # pull in the starter registries
+boost tap --defaults          # pull in the 5 starter registries
 ```
 
+Want the whole ecosystem instead of the starter set? boost ships a **curated
+registry catalog** — 90+ classified GitHub registries of skills, Cursor/Windsurf
+**rules**, and Claude Code **workflows** (slash commands & subagents),
+collectively indexing thousands of items:
+
+```bash
+boost tap --catalog --dry-run                 # browse the classified catalog
+boost tap --catalog --type skill --limit 20   # tap the 20 biggest skill packs
+boost tap --catalog --type rule               # every rules registry
+boost tap --catalog --category security       # filter by category
+```
+
+boost indexes three item kinds out of the same registries: `SKILL.md` **skills**,
+`.mdc`/`.cursorrules`/`.windsurfrules` **rules**, and command/agent **workflows**
+(Markdown under `commands/`·`agents/`·`workflows/`, or carrying subagent
+frontmatter). Rules and workflows are searchable today; only skills install.
+
 Or run it straight from a checkout — the runtime is stdlib-only, so there's
 nothing to install beyond the shim:
 

boost_skill_cli-1.0.4/SECURITY.md

@@ -0,0 +1,22 @@
+# Security policy
+
+## Supported versions
+
+Only the latest release receives security fixes.
+
+## Reporting a vulnerability
+
+Please **do not** open a public issue for security reports. Instead, use
+GitHub's private vulnerability reporting:
+
+**[Report a vulnerability](https://github.com/jonnyeclectic/boost/security/advisories/new)**
+
+You can expect an acknowledgement within a few days. Please include steps to
+reproduce and the affected command(s).
+
+## Scope notes
+
+boost executes `git` against registry URLs you tap and symlinks skills into
+agent directories. Reports about tap-supplied content escaping the store,
+path traversal via `SKILL.md` frontmatter, or command injection through
+skill/tap names are especially valuable.

boost_skill_cli-1.0.4/boost

@@ -0,0 +1,39 @@
+#!/usr/bin/env bash
+# boost — Homebrew for AI coding skills.
+# Thin shim: finds Python 3.9+, runs the boost_cli package that lives
+# next to this script (resolving symlinks, so `ln -s .../boost ~/bin/boost`
+# just works). No PyPI, no Artifactory — stdlib only.
+set -euo pipefail
+
+SOURCE="${BASH_SOURCE[0]:-$0}"
+while [ -h "$SOURCE" ]; do
+  DIR="$(cd -P "$(dirname "$SOURCE")" >/dev/null 2>&1 && pwd)"
+  SOURCE="$(readlink "$SOURCE")"
+  [[ "$SOURCE" != /* ]] && SOURCE="$DIR/$SOURCE"
+done
+ROOT="$(cd -P "$(dirname "$SOURCE")" >/dev/null 2>&1 && pwd)"
+
+find_python() {
+  for py in python3 python; do
+    if command -v "$py" >/dev/null 2>&1; then
+      if "$py" -c 'import sys; sys.exit(0 if sys.version_info >= (3, 9) else 1)' 2>/dev/null; then
+        echo "$py"
+        return 0
+      fi
+    fi
+  done
+  return 1
+}
+
+PY="$(find_python)" || {
+  echo "boost: Python 3.9+ is required but was not found on PATH" >&2
+  echo "  hint: brew install python3" >&2
+  exit 1
+}
+
+exec "$PY" -S -c "
+import sys
+sys.path.insert(0, '$ROOT')
+from boost_cli.cli import main
+sys.exit(main(sys.argv[1:]))
+" "$@"

boost_skill_cli-1.0.4/boost_cli/__init__.py

@@ -0,0 +1,38 @@
+"""boost — Homebrew for AI coding skills."""
+
+
+def _detect_version() -> str:
+    """Resolve the package version without a hard-coded constant.
+
+    Order: the file setuptools-scm writes at build time, then installed
+    package metadata, then a git-checkout fallback (stdlib only, so the
+    dependency-free runtime stays intact), then a sentinel.
+    """
+    try:
+        from ._version import version as scm_version
+        return scm_version
+    except Exception:
+        pass
+    try:
+        from importlib.metadata import version as dist_version
+        return dist_version("boost-skill-cli")
+    except Exception:
+        pass
+    try:
+        import subprocess
+        from pathlib import Path
+        root = Path(__file__).resolve().parent.parent
+        proc = subprocess.run(
+            ["git", "-C", str(root), "describe", "--tags", "--always", "--dirty"],
+            capture_output=True, text=True, timeout=3)
+        described = proc.stdout.strip()
+        if proc.returncode == 0 and described:
+            return described.lstrip("v")
+    except Exception:
+        pass
+    return "0.0.0+unknown"
+
+
+__version__ = _detect_version()
+PRODUCT = "boost"
+TAGLINE = "AI Skill Package Manager"

boost_skill_cli-1.0.4/boost_cli/_version.py

@@ -0,0 +1,24 @@
+# file generated by vcs-versioning
+# don't change, don't track in version control
+from __future__ import annotations
+
+__all__ = [
+    "__version__",
+    "__version_tuple__",
+    "version",
+    "version_tuple",
+    "__commit_id__",
+    "commit_id",
+]
+
+version: str
+__version__: str
+__version_tuple__: tuple[int | str, ...]
+version_tuple: tuple[int | str, ...]
+commit_id: str | None
+__commit_id__: str | None
+
+__version__ = version = '1.0.4'
+__version_tuple__ = version_tuple = (1, 0, 4)
+
+__commit_id__ = commit_id = None

{boost_skill_cli-1.0.1 → boost_skill_cli-1.0.4}/boost_cli/commands/taps.py

@@ -21,8 +21,58 @@ def _tilde(p) -> str:
     return s
 
 
+def _tap_catalog(args) -> int:
+    """Tap every registry in the filtered catalog selection."""
+    selection = _catalog_selection(args)
+    if not selection:
+        out.warn("no catalog registries match that filter")
+        return 1
+    if args.dry_run:
+        rows = [(e["name"], e["type"], e.get("category", ""),
+                 "~%d" % (e.get("est_items") or 0),
+                 out.c(e.get("focus", ""), out.DIM)) for e in selection]
+        out.table(rows, headers=("NAME", "TYPE", "CATEGORY", "EST", "FOCUS"))
+        print()
+        out.dim("%d registries · ~%d items (dry run — nothing tapped)"
+                % (len(selection), sum(e.get("est_items") or 0 for e in selection)))
+        return 0
+    existing = {t.name for t in registry.list_taps()}
+    rc = 0
+    for e in selection:
+        if e["name"] in existing:
+            out.info(out.c("%s already tapped" % e["name"], out.DIM))
+            continue
+        try:
+            tap = registry.add(str(e["url"]), curated=True)
+            entries = catalog.rebuild_tap(tap)
+        except BoostError as err:
+            out.warn("could not tap %s: %s" % (e["name"], err.message))
+            rc = 1
+            continue
+        journal.log("tap", tap.name)
+        out.ok("tapped %s (%d items) — %s"
+               % (tap.name, len(entries), e.get("focus", "")))
+    return rc
+
+
+def _catalog_selection(args) -> list:
+    """Filter the bundled registry catalog by --type/--category/--limit."""
+    entries = config.load_registry_catalog()
+    if args.type:
+        entries = [e for e in entries
+                   if e.get("type") == args.type or args.type in e.get("also_types", [])]
+    if args.category:
+        entries = [e for e in entries if e.get("category") == args.category]
+    if not args.include_lists:
+        entries = [e for e in entries if not e.get("list_only")]
+    entries.sort(key=lambda e: (-int(e.get("est_items") or 0), e["name"].lower()))
+    if args.limit:
+        entries = entries[:args.limit]
+    return entries
+
+
 def cmd_tap(argv) -> int:
-    """boost tap [SPEC] [--defaults] [--curated]"""
+    """boost tap [SPEC] [--defaults] [--catalog] [--curated]"""
     p = argparse.ArgumentParser(
         prog="boost tap",
         description="Add a GitHub repo as a skill registry")
@@ -30,13 +80,26 @@ def cmd_tap(argv) -> int:
                    help="owner/repo, a git URL, or a local directory")
     p.add_argument("--defaults", action="store_true",
                    help="tap the recommended public registries")
+    p.add_argument("--catalog", action="store_true",
+                   help="tap from the bundled curated registry catalog")
+    p.add_argument("--type", choices=("skill", "rule", "workflow"),
+                   help="with --catalog: restrict to one item type")
+    p.add_argument("--category", help="with --catalog: restrict to one category")
+    p.add_argument("--limit", type=int, metavar="N",
+                   help="with --catalog: only the top N registries by est. size")
+    p.add_argument("--include-lists", action="store_true",
+                   help="with --catalog: also tap awesome-list/index repos")
+    p.add_argument("--dry-run", action="store_true",
+                   help="with --catalog: print what would be tapped, tap nothing")
     p.add_argument("--curated", action="store_true",
                    help="mark the tap as curated (★ in listings)")
     args = p.parse_args(argv)
-    if not args.spec and not args.defaults:
-        p.error("provide a SPEC or --defaults")
+    if not args.spec and not args.defaults and not args.catalog:
+        p.error("provide a SPEC, --defaults, or --catalog")
 
     rc = 0
+    if args.catalog:
+        rc |= _tap_catalog(args)
     if args.defaults:
         existing = {t.name for t in registry.list_taps()}
         for default in config.DEFAULT_TAPS: