boost-skill-cli 1.0.22__tar.gz → 1.0.24__tar.gz

{boost_skill_cli-1.0.22 → boost_skill_cli-1.0.24}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: boost-skill-cli
-Version: 1.0.22
+Version: 1.0.24
 Summary: boost — Homebrew for AI coding skills
 Author: Jonathan Reyes
 License: GNU GENERAL PUBLIC LICENSE

{boost_skill_cli-1.0.22 → boost_skill_cli-1.0.24}/boost_cli/_version.py

@@ -18,7 +18,7 @@ version_tuple: tuple[int | str, ...]
 commit_id: str | None
 __commit_id__: str | None
 
-__version__ = version = '1.0.22'
-__version_tuple__ = version_tuple = (1, 0, 22)
+__version__ = version = '1.0.24'
+__version_tuple__ = version_tuple = (1, 0, 24)
 
 __commit_id__ = commit_id = None

{boost_skill_cli-1.0.22 → boost_skill_cli-1.0.24}/boost_cli/commands/info.py

@@ -175,6 +175,25 @@ def cmd_info(argv):
         return 0
 
     out.heading(name)
+    # Identity-card badges: a scannable status strip beneath the name, echoing
+    # the web .badge pills. The detailed kv rows below still carry the specifics.
+    badges = []
+    if lock:
+        badges.append(out.badge("installed", "green"))
+        if lock.get("pinned"):
+            badges.append(out.badge("pinned", "yellow"))
+        if lock.get("quarantined"):
+            badges.append(out.badge("quarantined", "pink"))
+        latest = str((cat or {}).get("version") or "")
+        if cat and latest != str(lock.get("version", "?")):
+            badges.append(out.badge("update available", "yellow"))
+    else:
+        badges.append(out.badge("not installed", "cyan"))
+    tapname = (lock or cat or {}).get("tap")
+    if tapname:
+        badges.append(out.badge(str(tapname), "violet"))
+    if badges:
+        out.info(" ".join(badges))
     if desc:
         lines = textwrap.wrap(desc, width=62)
         out.kv("description", lines[0])

{boost_skill_cli-1.0.22 → boost_skill_cli-1.0.24}/boost_cli/core/output.py

@@ -177,6 +177,12 @@ def truncate(text: str, width: int, ellipsis: str = "…") -> str:
     return text[:width - len(ellipsis)] + ellipsis
 
 
+def badge(label: str, hue: str = "cyan") -> str:
+    """A compact status pill for identity cards — an Aurora-tinted [label]
+    (plain under NO_COLOR), echoing the web design system's .badge pills."""
+    return aurora("[" + label + "]", hue)
+
+
 def kv(key: str, value: str, width: int = 14) -> None:
     print("  " + c(key.ljust(width), DIM) + str(value))
 

{boost_skill_cli-1.0.22 → boost_skill_cli-1.0.24}/boost_skill_cli.egg-info/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: boost-skill-cli
-Version: 1.0.22
+Version: 1.0.24
 Summary: boost — Homebrew for AI coding skills
 Author: Jonathan Reyes
 License: GNU GENERAL PUBLIC LICENSE

{boost_skill_cli-1.0.22 → boost_skill_cli-1.0.24}/docs/design-roadmap.html

@@ -404,7 +404,7 @@
         </article>
 
         <article class="ritem" data-track="commands" data-impact="low">
-          <div class="ritem-top"><span class="rid">BOOST-D17</span><span class="rstatus proposed">Proposed</span></div>
+          <div class="ritem-top"><span class="rid">BOOST-D17</span><span class="rstatus done">Shipped</span></div>
           <h4><code>list</code> polish — chips &amp; aligned counts</h4>
           <p><code>list</code> already uses a nice <code>·</code> agent separator; take it further. Color the agent names as small chips, right-align the count footer with tabular figures, and add a dim header rule so the table reads as a designed object rather than raw columns.</p>
           <div class="rmeta"><span class="m-cat">commands</span><span>Complexity S</span><span class="m-imp low">Impact Low</span><span class="m-wow">★★★☆☆</span></div>

{boost_skill_cli-1.0.22 → boost_skill_cli-1.0.24}/docs/roadmap.html

@@ -116,7 +116,7 @@
       <div class="stat"><b>4</b><span>Shipped</span></div>
       <div class="stat"><b>3</b><span>Next up</span></div>
       <div class="stat"><b>4</b><span>Planned</span></div>
-      <div class="stat"><b>8</b><span>Code-health finds</span></div>
+      <div class="stat"><b>16</b><span>Loop finds</span></div>
     </div>
   </section>
 
@@ -456,6 +456,146 @@
     </div>
   </section>
 
+  <!-- ============ PIPELINE & SUPPLY-CHAIN INTEGRITY ============ -->
+  <section class="block reveal" id="pipeline">
+    <div class="block-head">
+      <h2>Pipeline &amp; supply-chain integrity</h2>
+      <span class="count">// planned · free tooling to secure the CI/CD path itself</span>
+      <span class="rule"></span>
+    </div>
+    <div class="rgrid">
+
+      <article class="cap rcard">
+        <div class="head"><span class="pill planned">Planned</span><span class="cat">Security · CI/CD</span></div>
+        <h3>Workflow SAST — <code>zizmor</code></h3>
+        <p>boost's four workflows embed <code>github-script</code> JavaScript and
+           shell and drive a Trusted-Publisher release — a rich attack surface.
+           <code>zizmor</code> statically flags template injection, unpinned
+           actions, over-broad <code>GITHUB_TOKEN</code> permissions and dangerous
+           triggers. The one tool that audits the automation that ships every
+           other fix.</p>
+        <div class="meta">
+          <span class="m">Complexity <b>S</b></span>
+          <span class="m hi">Impact <b>High</b></span>
+          <span class="m">Wow <b class="wow">★★★★★</b></span>
+          <span class="m">pipx-run</span>
+        </div>
+      </article>
+
+      <article class="cap rcard">
+        <div class="head"><span class="pill planned">Planned</span><span class="cat">Quality · CI/CD</span></div>
+        <h3>Workflow linting — <code>actionlint</code></h3>
+        <p>Catches GitHub Actions YAML bugs before they fail a live release:
+           malformed <code>${{ }}</code> expressions, deprecated syntax, and
+           shellcheck run over every <code>run:</code> block. Cheap insurance for a
+           repo whose release is fully automated — a broken workflow is a broken
+           publish.</p>
+        <div class="meta">
+          <span class="m">Complexity <b>S</b></span>
+          <span class="m">Impact <b>Med</b></span>
+          <span class="m">Wow <b class="wow">★★★</b></span>
+          <span class="m">shellcheck built in</span>
+        </div>
+      </article>
+
+      <article class="cap rcard">
+        <div class="head"><span class="pill planned">Planned</span><span class="cat">Security · Supply chain</span></div>
+        <h3>Build provenance — SLSA attestations</h3>
+        <p><code>actions/attest-build-provenance</code> emits a cryptographically
+           signed, verifiable record of <em>which workflow built which wheel from
+           which commit</em>, layered on top of the existing PyPI Trusted
+           Publishing. Consumers can <code>gh attestation verify</code> the
+           artifact they install — provenance without a paid signing service.</p>
+        <div class="meta">
+          <span class="m">Complexity <b>S</b></span>
+          <span class="m">Impact <b>Med</b></span>
+          <span class="m">Wow <b class="wow">★★★★</b></span>
+          <span class="m">SLSA build L2</span>
+        </div>
+      </article>
+
+      <article class="cap rcard">
+        <div class="head"><span class="pill planned">Planned</span><span class="cat">Security · Supply chain</span></div>
+        <h3>SBOM on every release — CycloneDX / Syft</h3>
+        <p>Generate a CycloneDX SBOM with the free <code>anchore/sbom-action</code>
+           and attach it to each GitHub Release, so downstreams can inventory and
+           scan exactly what boost is built from. Modest today (boost is close to
+           stdlib-only) but it grows in value as the optional <code>[rag]</code>
+           extras pull in real dependencies.</p>
+        <div class="meta">
+          <span class="m">Complexity <b>S</b></span>
+          <span class="m">Impact <b>Med</b></span>
+          <span class="m">Wow <b class="wow">★★★</b></span>
+          <span class="m">feeds osv-scanner</span>
+        </div>
+      </article>
+
+      <article class="cap rcard">
+        <div class="head"><span class="pill planned">Planned</span><span class="cat">Security · Vuln</span></div>
+        <h3>SBOM-aware scanning — <code>osv-scanner</code></h3>
+        <p>Google's <code>osv-scanner</code> cross-checks a lockfile or the SBOM
+           above against the OSV database, with broader ecosystem coverage than a
+           single-language audit. The SBOM-driven complement to <code>pip-audit</code>:
+           one scans the resolved env, the other scans the published manifest.</p>
+        <div class="meta">
+          <span class="m">Complexity <b>S</b></span>
+          <span class="m">Impact <b>Med</b></span>
+          <span class="m">Wow <b class="wow">★★</b></span>
+          <span class="m">OSV-backed</span>
+        </div>
+      </article>
+
+      <article class="cap rcard">
+        <div class="head"><span class="pill planned">Planned</span><span class="cat">Testing · Type</span></div>
+        <h3>Second type checker — <code>pyright</code></h3>
+        <p>Run Microsoft's <code>pyright</code> alongside mypy. Its independent
+           inference catches <code>None</code>-flow and narrowing bugs the current
+           mypy config lets slide, and it's the same engine most editors use — so
+           CI enforces what contributors already see. Two type checkers rarely
+           agree on <em>nothing</em>.</p>
+        <div class="meta">
+          <span class="m">Complexity <b>M</b></span>
+          <span class="m">Impact <b>Med</b></span>
+          <span class="m">Wow <b class="wow">★★★</b></span>
+          <span class="m">editor-parity</span>
+        </div>
+      </article>
+
+      <article class="cap rcard">
+        <div class="head"><span class="pill planned">Planned</span><span class="cat">Quality · Smell</span></div>
+        <h3>Widen the ruff rule surface — <code>B·SIM·C4·PERF·RUF</code></h3>
+        <p>Beyond the <code>S</code> security family (round 1), enable
+           flake8-bugbear (<code>B</code>), simplify (<code>SIM</code>),
+           comprehensions (<code>C4</code>), perflint (<code>PERF</code>) and
+           Ruff-native (<code>RUF</code>) rules — bug, readability and performance
+           smells caught at zero new-tool cost since ruff already runs in the lint
+           gate.</p>
+        <div class="meta">
+          <span class="m">Complexity <b>S</b></span>
+          <span class="m">Impact <b>Med</b></span>
+          <span class="m">Wow <b class="wow">★★★</b></span>
+          <span class="m">0 new deps</span>
+        </div>
+      </article>
+
+      <article class="cap rcard">
+        <div class="head"><span class="pill planned">Planned</span><span class="cat">Testing · Gap</span></div>
+        <h3>Patch-coverage gate — <code>diff-cover</code></h3>
+        <p>Enforce coverage on the <em>changed lines</em> of each PR — no external
+           service needed, it reads the same <code>coverage.xml</code> the suite
+           already emits. Pairs with the 80% project gate so new code can't quietly
+           ride in under-tested behind an already-high overall number.</p>
+        <div class="meta">
+          <span class="m">Complexity <b>S</b></span>
+          <span class="m">Impact <b>Med</b></span>
+          <span class="m">Wow <b class="wow">★★</b></span>
+          <span class="m">self-hosted</span>
+        </div>
+      </article>
+
+    </div>
+  </section>
+
   <footer>
     <p>Maintained by the boost quality loop · themed with
        <a href="../style/boost.css">style/boost.css</a> ·

{boost_skill_cli-1.0.22 → boost_skill_cli-1.0.24}/tests/functional/test_cli_info.py

@@ -83,6 +83,9 @@ class TestInfo:
         assert "claude-code, windsurf, cursor" in r.out
         assert re.search(r"pinned\s+no", r.out)
         assert re.search(r"quarantined\s+no", r.out)
+        # D17: identity-card badges beneath the name
+        assert "[installed]" in r.out
+        assert "[fixture-tap]" in r.out
 
     def test_tap_only_skill(self, boost, tapped):
         r = boost("info", "jira-integration")
@@ -90,6 +93,7 @@ class TestInfo:
         assert re.search(r"tap\s+fixture-tap", r.out)
         assert re.search(r"source\s+skills/jira-integration", r.out)
         assert "~/.agents/skills" not in r.out      # no store line
+        assert "[not installed]" in r.out           # D17 badge for tap-only
         assert re.search(r"quality\s+\d+/100", r.out)
 
     def test_json_pure(self, boost, installed):

{boost_skill_cli-1.0.22 → boost_skill_cli-1.0.24}/tests/unit/test_output.py

@@ -278,6 +278,24 @@ class TestTruncate:
         assert output.truncate("abcdef", 1) == "…"
 
 
+class TestBadge:
+    def test_plain_when_no_color(self, monkeypatch):
+        monkeypatch.setenv("NO_COLOR", "1")
+        assert output.badge("installed", "green") == "[installed]"
+
+    def test_default_hue_is_cyan(self, monkeypatch):
+        monkeypatch.setenv("COLORTERM", "truecolor")
+        monkeypatch.setenv("CLICOLOR_FORCE", "1")
+        assert output.badge("x") == "\033[38;2;34;211;238m[x]\033[0m"
+
+    def test_truecolor_wraps_label_in_brackets(self, monkeypatch):
+        monkeypatch.setenv("COLORTERM", "truecolor")
+        monkeypatch.setenv("CLICOLOR_FORCE", "1")
+        # green #4ade80
+        assert output.badge("installed", "green") == (
+            "\033[38;2;74;222;128m[installed]\033[0m")
+
+
 class TestHelpers:
     @pytest.fixture(autouse=True)
     def plain(self, monkeypatch):