boost-skill-cli 1.0.201__tar.gz → 1.0.203__tar.gz

{boost_skill_cli-1.0.201/boost_skill_cli.egg-info → boost_skill_cli-1.0.203}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: boost-skill-cli
-Version: 1.0.201
+Version: 1.0.203
 Summary: boost — Homebrew for AI coding skills
 Author: Jonathan Reyes
 License: GNU GENERAL PUBLIC LICENSE

{boost_skill_cli-1.0.201 → boost_skill_cli-1.0.203}/boost_cli/_version.py

@@ -18,7 +18,7 @@ version_tuple: tuple[int | str, ...]
 commit_id: str | None
 __commit_id__: str | None
 
-__version__ = version = '1.0.201'
-__version_tuple__ = version_tuple = (1, 0, 201)
+__version__ = version = '1.0.203'
+__version_tuple__ = version_tuple = (1, 0, 203)
 
 __commit_id__ = commit_id = None

{boost_skill_cli-1.0.201 → boost_skill_cli-1.0.203}/boost_cli/commands/pkg.py

@@ -17,8 +17,8 @@ from typing import Dict, List, Optional
 from .. import cliparse
 from ..core import (adapters, agents, catalog, config, frontmatter, gitutil,
                     injectscan, integrity, journal, lockfile, paths, projectlock,
-                    registry, scopes, secretscan, staleness, store, typosquat,
-                    updatediff, util)
+                    registry, resolve, scopes, secretscan, staleness, store,
+                    typosquat, updatediff, util)
 from ..core import output as out
 from ..errors import BoostError
 
@@ -163,6 +163,56 @@ def _boostfile_text(skills: Dict[str, dict], via: str = "boost bundle dump") ->
     return "\n".join(lines) + "\n"
 
 
+def _rel_list(meta: dict, key: str) -> List[str]:
+    """A skill's `requires:`/`conflicts:` frontmatter as a clean name list."""
+    val = (meta or {}).get(key)
+    if val in (None, "", False):
+        return []
+    if isinstance(val, list):
+        return [str(x).strip() for x in val if str(x).strip()]
+    return [s.strip() for s in str(val).split(",") if s.strip()]
+
+
+def _skill_relations(name: str, key: str) -> List[str]:
+    """`requires:`/`conflicts:` for a skill by name, from its catalog entry."""
+    matches = catalog.find(name)
+    if not matches:
+        return []
+    return _rel_list(matches[0].get("meta") or {}, key)
+
+
+def _expand_dependencies(entries: List[dict]) -> "tuple[List[dict], resolve.Resolution]":
+    """Grow the requested entries into their full `requires:` closure.
+
+    Returns ``(ordered_entries, resolution)`` — the entries to install in
+    dependency-first order (roots plus any pulled-in dependencies that are not
+    already installed), and the :class:`resolve.Resolution` carrying what was
+    added, any advisory conflicts, and unresolved (dangling) requirements.
+    """
+    installed = frozenset(lockfile.installed())
+    res = resolve.resolve(
+        [e["name"] for e in entries],
+        lambda n: _skill_relations(n, "requires"),
+        lambda n: _skill_relations(n, "conflicts"),
+        installed=installed,
+        known=lambda n: bool(catalog.find(n)),
+    )
+    by_name = {e["name"]: e for e in entries}
+    ordered: List[dict] = []
+    for name in res.order:
+        if name in by_name:
+            ordered.append(by_name[name])
+            continue
+        try:
+            ordered.append(catalog.resolve_one(name))
+        except BoostError:
+            # A dep that resolves nowhere unambiguously is reported via
+            # res.unresolved; skip it here rather than abort the whole install.
+            if name not in res.unresolved:
+                res.unresolved.append(name)
+    return ordered, res
+
+
 # ── install ──────────────────────────────────────────────────────────────
 
 def cmd_install(argv: List[str]) -> int:
@@ -186,6 +236,8 @@ def cmd_install(argv: List[str]) -> int:
                          help="into your user config (= --scope user, default)")
     ap.add_argument("--dry-run", action="store_true",
                     help="show what would happen without changing anything")
+    ap.add_argument("--no-deps", action="store_true",
+                    help="install only the named skills, not their `requires:`")
     args = ap.parse_args(argv)
     args.scope = args.scope or scopes.SCOPE_USER
     only = _check_agents(args.agent)
@@ -202,6 +254,25 @@ def cmd_install(argv: List[str]) -> int:
 
     _warn_confusions(entries)
 
+    # Grow the request into its `requires:` closure (deps installed first),
+    # unless the caller opted out. Only skills carry dependency frontmatter;
+    # rules/workflows pass through unchanged.
+    if not args.no_deps and entries:
+        entries, dep_res = _expand_dependencies(entries)
+        if dep_res.added:
+            out.info("pulling in %s required by your selection: %s"
+                     % (_plural(len(dep_res.added), "dependency"),
+                        ", ".join(dep_res.added)))
+        for name in dep_res.unresolved:
+            out.warn("required skill %r is in no tap — skipped "
+                     "(install it manually or `boost tap` its source)" % name)
+        for skill, clash in dep_res.conflicts:
+            out.warn("%s declares a conflict with %s (also present)" % (skill, clash))
+        # Pulling in dependencies can turn a single-name request into a multi-item
+        # install (per-item headings); it must never *lower* multi (e.g. when an
+        # unknown co-requested name was dropped), so OR rather than reassign.
+        multi = multi or len(entries) > 1
+
     if args.dry_run:
         targets = [a for a in agents.enabled_agents() if not only or a in only]
         pbase = scopes.resolve_base(args.scope)

boost_skill_cli-1.0.203/boost_cli/core/resolve.py

@@ -0,0 +1,136 @@
+"""Skill dependency resolution — turn a set of requested skills into the full,
+correctly-ordered install list by following each skill's ``requires:`` closure.
+
+boost skills declare relationships in frontmatter (``requires:`` /
+``conflicts:``); until now those were only *displayed* (``boost info`` /
+``boost deps``). This module is the resolver that makes ``boost install`` act on
+them — the "Homebrew installs dependencies" behavior — as a pure, dependency-
+injected function so it is unit- and mutation-testable with no catalog or
+filesystem access.
+
+The caller supplies two lookups so the core stays I/O-free:
+
+* ``requires_of(name) -> list[str]`` — the skills ``name`` declares it needs.
+* ``conflicts_of(name) -> list[str]`` — the skills ``name`` declares it clashes
+  with (optional; defaults to none).
+
+and, optionally, ``known(name) -> bool`` to tell a resolvable dependency from a
+dangling one (a ``requires:`` naming a skill in no tap). Everything else is
+plain graph work.
+"""
+from __future__ import annotations
+
+from dataclasses import dataclass, field
+from typing import Callable, FrozenSet, List, Optional, Sequence, Tuple
+
+__all__ = ["Resolution", "resolve"]
+
+
+@dataclass
+class Resolution:
+    """The outcome of resolving a set of requested skills.
+
+    * ``order`` — the install order, dependencies before dependents, with
+      already-installed skills that were only pulled in as dependencies dropped.
+      A *requested* skill stays in ``order`` even when already installed (so an
+      explicit ``boost install x`` still reinstalls/upgrades it, matching the
+      pre-resolver behavior).
+    * ``added`` — the transitive dependencies that were pulled in (``order``
+      minus the requested roots), in install order — what to tell the user got
+      added on their behalf.
+    * ``conflicts`` — ``(skill, clashes_with)`` pairs where a skill in the plan
+      declares a ``conflicts:`` against something already installed or also
+      being installed. Advisory (a warning), never a hard failure.
+    * ``unresolved`` — required skill names with no known source (a dangling
+      ``requires:``); surfaced so the caller can warn rather than crash.
+    """
+
+    order: List[str] = field(default_factory=list)
+    added: List[str] = field(default_factory=list)
+    conflicts: List[Tuple[str, str]] = field(default_factory=list)
+    unresolved: List[str] = field(default_factory=list)
+
+
+def _norm(names: Sequence[str]) -> List[str]:
+    """De-dupe a name sequence preserving first-seen order."""
+    seen: List[str] = []
+    for n in names:
+        if n and n not in seen:
+            seen.append(n)
+    return seen
+
+
+def resolve(
+    roots: Sequence[str],
+    requires_of: Callable[[str], Sequence[str]],
+    conflicts_of: Optional[Callable[[str], Sequence[str]]] = None,
+    *,
+    installed: FrozenSet[str] = frozenset(),
+    known: Optional[Callable[[str], bool]] = None,
+) -> Resolution:
+    """Resolve ``roots`` plus their ``requires:`` closure into an install plan.
+
+    Post-order depth-first traversal yields dependencies before the skills that
+    need them. The traversal is cycle-safe (a skill on the current DFS stack is
+    not re-entered) and each skill is visited once. A dependency that is already
+    ``installed`` is not re-added; a *requested* root is always kept so an
+    explicit reinstall/upgrade still happens. Unknown dependencies (per
+    ``known``) are recorded in ``unresolved`` and not traversed further.
+    """
+    conflicts_of = conflicts_of or (lambda _n: [])
+    known = known or (lambda _n: True)
+    roots = _norm(roots)
+    root_set = set(roots)
+
+    order: List[str] = []
+    done: set = set()      # fully-processed (post-order emitted)
+    on_stack: set = set()  # currently being visited — cycle guard
+    unresolved: List[str] = []
+
+    def visit(name: str, is_root: bool) -> None:
+        if name in done or name in on_stack:
+            return  # already emitted, or a cycle — stop
+        # An already-installed skill pulled in only as a dependency is assumed
+        # satisfied — don't re-traverse or re-emit its subtree. (A requested root
+        # is still walked so an explicit reinstall re-checks its deps; gap-filling
+        # of a broken installed skill is `boost heal`'s job, not install's.)
+        if name in installed and not is_root:
+            done.add(name)
+            return
+        on_stack.add(name)
+        for dep in _norm(list(requires_of(name) or [])):
+            if dep == name:
+                continue  # a self-require is a no-op, never a cycle error
+            if not known(dep):
+                if dep not in unresolved:
+                    unresolved.append(dep)
+                continue
+            visit(dep, is_root=False)
+        on_stack.discard(name)
+        done.add(name)
+        # Emit unless it is an already-installed skill pulled in only as a dep;
+        # a requested root is always emitted (reinstall/upgrade semantics).
+        if is_root or name not in installed:
+            order.append(name)
+
+    for r in roots:
+        visit(r, is_root=True)
+
+    added = [n for n in order if n not in root_set]
+
+    # Conflict scan: anything in the plan (being installed) OR already installed
+    # is a live presence; flag a declared conflict against any live presence.
+    live = set(order) | set(installed)
+    conflicts: List[Tuple[str, str]] = []
+    seen_pairs: set = set()
+    for skill in order:
+        for clash in _norm(list(conflicts_of(skill) or [])):
+            if clash == skill or clash not in live:
+                continue
+            key = (skill, clash)
+            if key not in seen_pairs:
+                seen_pairs.add(key)
+                conflicts.append(key)
+
+    return Resolution(order=order, added=added,
+                      conflicts=conflicts, unresolved=unresolved)

{boost_skill_cli-1.0.201 → boost_skill_cli-1.0.203}/boost_cli/core/serve.py

@@ -20,7 +20,7 @@ from typing import Optional, Tuple
 
 from .. import __version__
 from ..errors import BoostError
-from . import catalog, lockfile, registry, store
+from . import catalog, lockfile, logs, registry, store
 from . import output as out
 import contextlib
 
@@ -173,9 +173,16 @@ class _CatalogHandler(BaseHTTPRequestHandler):
         except BrokenPipeError:
             pass
         except Exception as e:
+            # Never leak internal exception detail (filesystem paths, state) to
+            # the HTTP client — it reaches remote callers when the server is
+            # exposed with `--host 0.0.0.0`. Log the specifics server-side and
+            # return a generic body.
+            logs.get_logger().warning("serve: %s %s failed: %s: %s",
+                                      self.command, self.path,
+                                      type(e).__name__, e)
             with contextlib.suppress(Exception):
                 self._send(500, "application/json",
-                           json.dumps({"error": str(e)}).encode())
+                           json.dumps({"error": "internal server error"}).encode())
 
 
 def serve_http(host: str, port: int) -> None:

{boost_skill_cli-1.0.201 → boost_skill_cli-1.0.203/boost_skill_cli.egg-info}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: boost-skill-cli
-Version: 1.0.201
+Version: 1.0.203
 Summary: boost — Homebrew for AI coding skills
 Author: Jonathan Reyes
 License: GNU GENERAL PUBLIC LICENSE

{boost_skill_cli-1.0.201 → boost_skill_cli-1.0.203}/boost_skill_cli.egg-info/SOURCES.txt

@@ -74,6 +74,7 @@ boost_cli/core/projectlock.py
 boost_cli/core/provenance.py
 boost_cli/core/rag.py
 boost_cli/core/registry.py
+boost_cli/core/resolve.py
 boost_cli/core/rules.py
 boost_cli/core/scopes.py
 boost_cli/core/secretscan.py
@@ -165,7 +166,9 @@ docs/roadmap/items/github-pages-deploy-is-broken-every-push.md
 docs/roadmap/items/golden-set-statistical-power.md
 docs/roadmap/items/hash-pinned-reproducible-toolchain-uv-lock.md
 docs/roadmap/items/html-validation-html-validate.md
+docs/roadmap/items/install-resolves-skill-dependencies.md
 docs/roadmap/items/install-scope-user-or-project.md
+docs/roadmap/items/installed-skill-trust-audit.md
 docs/roadmap/items/integrity-verification-boost-verify.md
 docs/roadmap/items/invocation-pid-logging-for-crash-correlation.md
 docs/roadmap/items/layering-guard-import-linter.md
@@ -177,6 +180,7 @@ docs/roadmap/items/log-timestamps-mislabeled-utc.md
 docs/roadmap/items/lowest-version-resolution-uv-resolution-lowest-d.md
 docs/roadmap/items/make-the-roadmaps-discoverable.md
 docs/roadmap/items/markdown-consistency-markdownlint-cli2.md
+docs/roadmap/items/mcp-aware-skills.md
 docs/roadmap/items/mcp-hub-diagram-node-text-overflow.md
 docs/roadmap/items/mcp-launch-objc-fork-safety.md
 docs/roadmap/items/mcp-register-names-server-before-env.md
@@ -352,6 +356,7 @@ tests/unit/test_provenance.py
 tests/unit/test_rag.py
 tests/unit/test_registries_fresh.py
 tests/unit/test_registry.py
+tests/unit/test_resolve.py
 tests/unit/test_roadmap_fresh.py
 tests/unit/test_rules.py
 tests/unit/test_scopes.py

{boost_skill_cli-1.0.201 → boost_skill_cli-1.0.203}/docs/commands.html

@@ -80,7 +80,7 @@
     <input id="q" type="search" placeholder="Filter 78 commands…" autocomplete="off" aria-label="Filter commands">
     <div class="group" data-group="pkg">
       <div class="group-h">Install &amp; lifecycle</div>
-      <a class="cmd-link" href="#cmd-install" data-search="install install a skill from a tap registry  --force --agent a --scope {user,project} --local --global --dry-run name">install</a>
+      <a class="cmd-link" href="#cmd-install" data-search="install install a skill from a tap registry  --force --agent a --scope {user,project} --local --global --dry-run --no-deps name">install</a>
       <a class="cmd-link" href="#cmd-uninstall" data-search="uninstall remove an installed skill, rule, workflow, or config  --local name">uninstall</a>
       <a class="cmd-link" href="#cmd-sync" data-search="sync reconcile installed skills &amp; symlinks against the lock file  --diff --prune --json">sync</a>
       <a class="cmd-link" href="#cmd-update" data-search="update sync taps or update installed skills  --taps-only tap">update</a>
@@ -187,10 +187,10 @@
     <p class="lead">All <b>78</b> commands, generated from the CLI itself —
        run <code>boost &lt;command&gt; --help</code> for the same in your terminal.</p>
       <h2 class="group-h" id="grp-pkg">Install &amp; lifecycle</h2>
-      <section class="cmd" id="cmd-install" data-search="install install a skill from a tap registry  --force --agent a --scope {user,project} --local --global --dry-run name">
+      <section class="cmd" id="cmd-install" data-search="install install a skill from a tap registry  --force --agent a --scope {user,project} --local --global --dry-run --no-deps name">
         <h3><span class="cname">install</span><span class="gtag">pkg</span></h3>
         <p class="summary">Install a skill from a tap registry</p>
-        <pre class="syn">boost install [--force] [--agent A] [--scope {user,project}] [--local] [--global] [--dry-run] NAME [NAME ...]</pre>
+        <pre class="syn">boost install [--force] [--agent A] [--scope {user,project}] [--local] [--global] [--dry-run] [--no-deps] NAME [NAME ...]</pre>
         <div class="args-h">Arguments</div>
         <div class="args">
           <div class="arg"><code>NAME</code><span>skill name, optionally qualified as tap:skill</span></div>
@@ -203,6 +203,7 @@
           <div class="arg"><code>--local</code><span>into this repo, committable (= --scope project)</span></div>
           <div class="arg"><code>--global</code><span>into your user config (= --scope user, default)</span></div>
           <div class="arg"><code>--dry-run</code><span>show what would happen without changing anything</span></div>
+          <div class="arg"><code>--no-deps</code><span>install only the named skills, not their `requires:`</span></div>
         </div>
       </section>
       <section class="cmd" id="cmd-uninstall" data-search="uninstall remove an installed skill, rule, workflow, or config  --local name">

boost_skill_cli-1.0.203/docs/roadmap/items/install-resolves-skill-dependencies.md

@@ -0,0 +1,30 @@
+---
+id: install-resolves-skill-dependencies
+board: code
+section: dx
+status: inflight
+category: Core · Package manager
+complexity: M
+impact: High
+wow: 4
+note: the Homebrew move
+order: 45
+owner: loop/install-deps
+pr: 227
+title: <code>boost install</code> resolves a skill's <code>requires:</code> closure
+---
+Skills already declare relationships in frontmatter (<code>requires:</code> /
+           <code>conflicts:</code>), and <code>boost info</code> / <code>boost deps</code>
+           <em>show</em> them — but <code>boost install X</code> only ever installed
+           exactly what you named, never what X depends on. That is the one headline
+           package-manager behavior boost was missing: installing a skill should pull
+           in the skills it needs, in the right order. Add a pure, mutation-tested
+           resolver in <code>core/resolve.py</code> — post-order DFS over the
+           <code>requires:</code> graph, cycle-safe, deduped, already-installed nodes
+           pruned — and wire it into <code>cmd_install</code> so a named skill installs
+           its transitive <code>requires:</code> closure (dependencies first), with a
+           <code>--no-deps</code> escape hatch. Declared <code>conflicts:</code> against
+           an installed or co-installed skill surface as an advisory warning, and a
+           <code>requires:</code> naming a skill in no tap is flagged, not fatal.
+           Surfaced by mining boost's own catalog: the densest skill cluster is
+           dependency management, which every package manager treats as table stakes.

boost_skill_cli-1.0.203/docs/roadmap/items/installed-skill-trust-audit.md

@@ -0,0 +1,25 @@
+---
+id: installed-skill-trust-audit
+board: code
+section: trust
+status: planned
+category: Trust · Health
+complexity: M
+impact: Med
+wow: 3
+note: audit what you run
+order: 47
+owner:
+pr:
+title: <code>boost audit --skills</code> — a trust/staleness report for installed skills
+---
+<code>boost audit</code> today gates CVEs in boost's <em>own</em> Python dependencies,
+           and <code>boost outdated</code> compares an installed skill's version against
+           its tap — but nothing gives a single trust-health report for the set of skills
+           you actually run. The catalog's large supply-chain / dependency-audit cluster
+           is the tell: users want to know what they're trusting. Add
+           <code>boost audit --skills</code> — flag each installed skill that is unsigned,
+           came from an untrusted or now-stale tap, is behind its tap, or newly conflicts
+           with another installed skill. Composes with the provenance work already shipped
+           (signing, trusted keys, <code>verify</code>) and the <code>requires:</code>/<code>conflicts:</code>
+           graph, turning scattered signals into one "is my installed set healthy?" answer.

boost_skill_cli-1.0.203/docs/roadmap/items/mcp-aware-skills.md

@@ -0,0 +1,25 @@
+---
+id: mcp-aware-skills
+board: code
+section: dx
+status: planned
+category: Interop · MCP
+complexity: L
+impact: Med
+wow: 4
+note: skills that need a server
+order: 46
+owner:
+pr:
+title: MCP-aware skills — declare and wire an <code>.mcp.json</code> on install
+---
+Mining boost's catalog surfaces a recurring shape: skills that only work paired
+           with a Model Context Protocol server (<code>manage-mcp-servers</code>,
+           <code>mcp-integration</code>, <code>mcp-builder</code> and dozens more). boost
+           already <em>is</em> an MCP server and registers itself, but a skill can't say
+           "I need MCP server Y," and boost can't help install or wire other servers.
+           Let a skill declare an <code>mcp:</code> block (or bundle an <code>.mcp.json</code>)
+           in its frontmatter; on install, boost offers to register that server into the
+           agent the same way <code>boost mcp register</code> wires boost itself. Extends
+           the "search boost before reinventing" reflex from skills to the MCP tools a
+           skill depends on, and pairs naturally with the <code>requires:</code> resolver.

{boost_skill_cli-1.0.201 → boost_skill_cli-1.0.203}/docs/roadmap.html

@@ -118,7 +118,7 @@
       <div class="stat"><b>16</b><span>Shipped</span></div>
       <div class="stat"><b>1</b><span>Next up</span></div>
       <div class="stat"><b>4</b><span>Planned</span></div>
-      <div class="stat"><b>112</b><span>Loop finds</span></div>
+      <div class="stat"><b>115</b><span>Loop finds</span></div>
       <!-- /ROADMAP:stats -->
     </div>
   </section>
@@ -1577,6 +1577,53 @@ improvement is real (or isn't)."</p>
           <span class="m">agent reflex</span>
         </div>
       </article>
+
+      <article class="cap rcard">
+        <div class="head"><span class="pill inflight">In flight</span><span class="cat">Core · Package manager</span></div>
+        <h3><code>boost install</code> resolves a skill's <code>requires:</code> closure</h3>
+        <p>Skills already declare relationships in frontmatter (<code>requires:</code> /
+           <code>conflicts:</code>), and <code>boost info</code> / <code>boost deps</code>
+           <em>show</em> them — but <code>boost install X</code> only ever installed
+           exactly what you named, never what X depends on. That is the one headline
+           package-manager behavior boost was missing: installing a skill should pull
+           in the skills it needs, in the right order. Add a pure, mutation-tested
+           resolver in <code>core/resolve.py</code> — post-order DFS over the
+           <code>requires:</code> graph, cycle-safe, deduped, already-installed nodes
+           pruned — and wire it into <code>cmd_install</code> so a named skill installs
+           its transitive <code>requires:</code> closure (dependencies first), with a
+           <code>--no-deps</code> escape hatch. Declared <code>conflicts:</code> against
+           an installed or co-installed skill surface as an advisory warning, and a
+           <code>requires:</code> naming a skill in no tap is flagged, not fatal.
+           Surfaced by mining boost's own catalog: the densest skill cluster is
+           dependency management, which every package manager treats as table stakes.</p>
+        <div class="meta">
+          <span class="m">Complexity <b>M</b></span>
+          <span class="m hi">Impact <b>High</b></span>
+          <span class="m">Wow <b class="wow">★★★★</b></span>
+          <span class="m">the Homebrew move</span>
+        </div>
+      </article>
+
+      <article class="cap rcard">
+        <div class="head"><span class="pill planned">Planned</span><span class="cat">Interop · MCP</span></div>
+        <h3>MCP-aware skills — declare and wire an <code>.mcp.json</code> on install</h3>
+        <p>Mining boost's catalog surfaces a recurring shape: skills that only work paired
+           with a Model Context Protocol server (<code>manage-mcp-servers</code>,
+           <code>mcp-integration</code>, <code>mcp-builder</code> and dozens more). boost
+           already <em>is</em> an MCP server and registers itself, but a skill can't say
+           "I need MCP server Y," and boost can't help install or wire other servers.
+           Let a skill declare an <code>mcp:</code> block (or bundle an <code>.mcp.json</code>)
+           in its frontmatter; on install, boost offers to register that server into the
+           agent the same way <code>boost mcp register</code> wires boost itself. Extends
+           the "search boost before reinventing" reflex from skills to the MCP tools a
+           skill depends on, and pairs naturally with the <code>requires:</code> resolver.</p>
+        <div class="meta">
+          <span class="m">Complexity <b>L</b></span>
+          <span class="m">Impact <b>Med</b></span>
+          <span class="m">Wow <b class="wow">★★★★</b></span>
+          <span class="m">skills that need a server</span>
+        </div>
+      </article>
       <!-- /ROADMAP:cards -->
 
     </div>
@@ -2224,6 +2271,27 @@ paths.</p>
           <span class="m">builds on policy.py</span>
         </div>
       </article>
+
+      <article class="cap rcard">
+        <div class="head"><span class="pill planned">Planned</span><span class="cat">Trust · Health</span></div>
+        <h3><code>boost audit --skills</code> — a trust/staleness report for installed skills</h3>
+        <p><code>boost audit</code> today gates CVEs in boost's <em>own</em> Python dependencies,
+           and <code>boost outdated</code> compares an installed skill's version against
+           its tap — but nothing gives a single trust-health report for the set of skills
+           you actually run. The catalog's large supply-chain / dependency-audit cluster
+           is the tell: users want to know what they're trusting. Add
+           <code>boost audit --skills</code> — flag each installed skill that is unsigned,
+           came from an untrusted or now-stale tap, is behind its tap, or newly conflicts
+           with another installed skill. Composes with the provenance work already shipped
+           (signing, trusted keys, <code>verify</code>) and the <code>requires:</code>/<code>conflicts:</code>
+           graph, turning scattered signals into one "is my installed set healthy?" answer.</p>
+        <div class="meta">
+          <span class="m">Complexity <b>M</b></span>
+          <span class="m">Impact <b>Med</b></span>
+          <span class="m">Wow <b class="wow">★★★</b></span>
+          <span class="m">audit what you run</span>
+        </div>
+      </article>
       <!-- /ROADMAP:cards -->
 
     </div>

{boost_skill_cli-1.0.201 → boost_skill_cli-1.0.203}/tests/functional/test_cli_intelligence.py

@@ -427,7 +427,9 @@ class TestContext:
 class TestFocus:
     def test_focus_sidelines_others(self, boost, tapped):
         boost("install", "brainstorming")
-        boost("install", "jira-integration")
+        # --no-deps: this test wants exactly two installed skills; without it,
+        # jira-integration would also pull in its `requires: commit-messages`.
+        boost("install", "jira-integration", "--no-deps")
         r = boost("focus", "brainstorming")
         assert "focus: brainstorming" in r.out
         assert "(other 1 skills sidelined)" in r.out

{boost_skill_cli-1.0.201 → boost_skill_cli-1.0.203}/tests/functional/test_cli_pkg.py

@@ -116,6 +116,29 @@ class TestInstall:
         assert not (paths.store_dir() / "brainstorming").exists()
         assert not paths.lockfile_path().exists()
 
+    def test_installs_declared_requires_closure(self, boost, tapped):
+        # jira-integration declares `requires: [commit-messages]` in the fixture;
+        # installing it must pull in the dependency, dependency-first.
+        r = boost("install", "jira-integration")
+        assert "pulling in 1 dependency" in r.out
+        assert "commit-messages" in r.out
+        assert "Installed 2 new skills" in r.out
+        assert "commit-messages" in _lock() and "jira-integration" in _lock()
+        assert (paths.store_dir() / "commit-messages" / "SKILL.md").is_file()
+
+    def test_no_deps_installs_only_named(self, boost, tapped):
+        r = boost("install", "jira-integration", "--no-deps")
+        assert "pulling in" not in r.out
+        assert "Installed 1 new skill" in r.out
+        assert "jira-integration" in _lock()
+        assert "commit-messages" not in _lock()          # dep NOT pulled in
+
+    def test_already_installed_dependency_not_repulled(self, boost, tapped):
+        boost("install", "commit-messages")              # dep present first
+        r = boost("install", "jira-integration")
+        assert "pulling in" not in r.out                 # nothing to add
+        assert "Installed 1 new skill" in r.out          # only jira is new
+
     def test_agent_flag_links_only_claude(self, boost, tapped):
         r = boost("install", "brainstorming", "--agent", "claude-code")
         assert "linked → claude-code" in r.out

{boost_skill_cli-1.0.201 → boost_skill_cli-1.0.203}/tests/functional/test_everyday_loop.py

@@ -19,7 +19,9 @@ def test_tap_search_install_doctor_uninstall(boost, fixture_tap_src):
     assert "jira-integration" in r.out
     assert "ranked by full-content BM25" in r.out
 
-    r = boost("install", "jira-integration")
+    # --no-deps keeps this a single-skill lifecycle (doctor asserts "1 skill");
+    # jira-integration otherwise pulls in its `requires: commit-messages`.
+    r = boost("install", "jira-integration", "--no-deps")
     assert "copied to" in r.out
     assert "linked → claude-code · windsurf · cursor" in r.out
     assert "lock updated (.skill-lock.json)" in r.out

{boost_skill_cli-1.0.201 → boost_skill_cli-1.0.203}/tests/smoke.sh

@@ -42,7 +42,10 @@ run "outdated (clean)"       0 ./boost outdated
 echo "== everyday loop"
 run "search jira"            0 ./boost search jira
 run "install brainstorming"  0 ./boost install brainstorming
-run "install jira-integration" 0 ./boost install jira-integration
+# --no-deps: install each fixture skill independently. jira-integration declares
+# `requires: commit-messages`, which install now resolves — without this the
+# separate `install commit-messages` below would hit the already-installed path.
+run "install jira-integration" 0 ./boost install jira-integration --no-deps
 run "install commit-messages"  0 ./boost install commit-messages
 run "install tdd-workflow"     0 ./boost install tdd-workflow
 run "install cowboy-coding"    0 ./boost install cowboy-coding