boost-skill-cli 1.0.23__tar.gz → 1.0.25__tar.gz

{boost_skill_cli-1.0.23 → boost_skill_cli-1.0.25}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: boost-skill-cli
-Version: 1.0.23
+Version: 1.0.25
 Summary: boost — Homebrew for AI coding skills
 Author: Jonathan Reyes
 License: GNU GENERAL PUBLIC LICENSE

{boost_skill_cli-1.0.23 → boost_skill_cli-1.0.25}/boost_cli/_version.py

@@ -18,7 +18,7 @@ version_tuple: tuple[int | str, ...]
 commit_id: str | None
 __commit_id__: str | None
 
-__version__ = version = '1.0.23'
-__version_tuple__ = version_tuple = (1, 0, 23)
+__version__ = version = '1.0.25'
+__version_tuple__ = version_tuple = (1, 0, 25)
 
 __commit_id__ = commit_id = None

{boost_skill_cli-1.0.23 → boost_skill_cli-1.0.25}/boost_cli/commands/discovery.py

@@ -602,7 +602,9 @@ def cmd_trending(argv):
         if not curated:
             out.info("no curated skills available — add taps with `boost tap --defaults`")
             return 0
-        out.table([(e["name"], "v" + e["version"], e["description"])
+        descw = max(out.term_width() - 24, 24)  # reserve name + version columns
+        out.table([(e["name"], "v" + e["version"],
+                    out.truncate(e["description"], descw))
                    for e in sorted(curated, key=lambda e: e["name"])[:args.limit]])
         return 0
     agg = {}
@@ -611,8 +613,9 @@ def cmd_trending(argv):
         rec = agg.setdefault(name, {"count": 0, "last": ev.get("ts", "")})
         rec["count"] += 1
     ranked = sorted(agg.items(), key=lambda kv: (-kv[1]["count"], kv[0]))
+    descw = max(out.term_width() - 44, 24)  # reserve name/installs/last columns
     out.table([(name, str(rec["count"]), util.rel_time(rec["last"]),
-                by_name.get(name, {}).get("description", ""))
+                out.truncate(by_name.get(name, {}).get("description", ""), descw))
                for name, rec in ranked[:args.limit]],
               headers=("name", "installs", "last", "description"))
     out.info(out.c("based on local install activity", out.DIM))

{boost_skill_cli-1.0.23 → boost_skill_cli-1.0.25}/boost_skill_cli.egg-info/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: boost-skill-cli
-Version: 1.0.23
+Version: 1.0.25
 Summary: boost — Homebrew for AI coding skills
 Author: Jonathan Reyes
 License: GNU GENERAL PUBLIC LICENSE

{boost_skill_cli-1.0.23 → boost_skill_cli-1.0.25}/docs/design-roadmap.html

@@ -142,7 +142,7 @@
       <code>NO_COLOR</code> and non-TTY are always respected.
     </p>
     <div class="stats">
-      <div class="stat reveal"><b>22</b><span>Design opportunities</span></div>
+      <div class="stat reveal"><b>25</b><span>Design opportunities</span></div>
       <div class="stat reveal"><b>5</b><span>Design tracks</span></div>
       <div class="stat reveal"><b>0</b><span>New dependencies</span></div>
       <div class="stat reveal"><b>1:1</b><span>Web ↔ CLI parity goal</span></div>
@@ -213,7 +213,7 @@
       <button class="pill" data-filter="impact" data-val="med">Med</button>
       <button class="pill" data-filter="impact" data-val="low">Low</button>
     </div>
-    <p class="roadmap-count"><b id="shown">22</b> of <b>22</b> opportunities shown</p>
+    <p class="roadmap-count"><b id="shown">25</b> of <b>25</b> opportunities shown</p>
   </div>
 
   <div class="wrap" id="board">
@@ -273,7 +273,7 @@
           <h3>Structure &amp; Layout</h3>
           <p>Width-aware output, glass panels, and results that never blow up the pane.</p>
         </div>
-        <span class="n">5 items</span>
+        <span class="n">7 items</span>
       </div>
       <div class="rcards">
 
@@ -317,6 +317,22 @@
           <div class="rref"><code>commands/info.py · preview/cat</code></div>
         </article>
 
+        <article class="ritem" data-track="layout" data-impact="high">
+          <div class="ritem-top"><span class="rid">BOOST-D23</span><span class="rstatus done">Shipped</span></div>
+          <h4><code>trending</code> had the same overflow as <code>search</code></h4>
+          <p>Grading the un-touched commands surfaced a sibling of D05: <code>boost trending</code> piped raw catalog descriptions straight into <code>table()</code>, so a single 300-char description blew the table across the pane. Fixed by clipping each description through <code>out.truncate()</code> to the width left after the name/installs/last columns — the same helper the search fix introduced.</p>
+          <div class="rmeta"><span class="m-cat">layout</span><span>Complexity S</span><span class="m-imp high">Impact High</span><span class="m-wow">★★★★☆</span></div>
+          <div class="rref"><code>commands/discovery.py · cmd_trending</code></div>
+        </article>
+
+        <article class="ritem" data-track="layout" data-impact="med">
+          <div class="ritem-top"><span class="rid">BOOST-D24</span><span class="rstatus proposed">Proposed</span></div>
+          <h4>Width-aware shared <code>table()</code></h4>
+          <p><code>out.table()</code> backs 28 call sites, and several still overflow: <code>taps</code> pads the NAME column to the widest repo (<code>K-Dense-AI/claude-scientific-skills</code> = 44 cols) and then prints full URLs, so wide catalogs wrap. The durable fix is to make <code>table()</code> itself width-aware — shrink the widest text column to the terminal and right-align numeric columns — instead of truncating per-caller. Higher blast radius (28 callers, many exact-output tests), so it needs a careful, test-first pass.</p>
+          <div class="rmeta"><span class="m-cat">layout</span><span>Complexity L</span><span class="m-imp med">Impact Med</span><span class="m-wow">★★★★☆</span></div>
+          <div class="rref"><code>core/output.py:table() · commands/taps.py</code></div>
+        </article>
+
       </div>
     </section>
 
@@ -375,12 +391,12 @@
           <h3>Command-by-command Polish</h3>
           <p>The screens users actually stare at — front door, doctor, list, info.</p>
         </div>
-        <span class="n">5 items</span>
+        <span class="n">6 items</span>
       </div>
       <div class="rcards">
 
         <article class="ritem" data-track="commands" data-impact="med">
-          <div class="ritem-top"><span class="rid">BOOST-D14</span><span class="rstatus progress">In progress</span></div>
+          <div class="ritem-top"><span class="rid">BOOST-D14</span><span class="rstatus done">Shipped</span></div>
           <h4>Front door: gradient wordmark + section glyphs</h4>
           <p>The <code>boost</code> home screen is the first thing everyone sees. Today the wordmark is plain bold and every group header is the same generic yellow. Paint the <code>boost</code> wordmark with the Aurora gradient and give each command group a colored bullet/glyph keyed to a brand hue — turning a flat list into a branded index.</p>
           <div class="rmeta"><span class="m-cat">commands</span><span>Complexity M</span><span class="m-imp med">Impact Med</span><span class="m-wow">★★★★★</span></div>
@@ -419,6 +435,14 @@
           <div class="rref"><code>commands/info.py:117–119 · core/output.py</code></div>
         </article>
 
+        <article class="ritem" data-track="commands" data-impact="med">
+          <div class="ritem-top"><span class="rid">BOOST-D25</span><span class="rstatus proposed">Proposed</span></div>
+          <h4>Branded usage &amp; error output</h4>
+          <p>Run a subcommand wrong — <code>boost snapshot</code> with no action — and you get raw, unstyled <code>argparse</code>: a multi-line usage dump with a bare <code>error:</code>, nothing like the branded help. Route argparse's usage/error through the Aurora output layer (accent the program name, dim the usage grammar, use the standard <code>Error:</code> affordance) so <em>failure</em> looks as designed as success. Bonus: a "did you mean …" suggestion for unknown commands.</p>
+          <div class="rmeta"><span class="m-cat">ux</span><span>Complexity M</span><span class="m-imp med">Impact Med</span><span class="m-wow">★★★☆☆</span></div>
+          <div class="rref"><code>cli.py · argparse formatter</code></div>
+        </article>
+
       </div>
     </section>
 

{boost_skill_cli-1.0.23 → boost_skill_cli-1.0.25}/docs/roadmap.html

@@ -116,7 +116,7 @@
       <div class="stat"><b>4</b><span>Shipped</span></div>
       <div class="stat"><b>3</b><span>Next up</span></div>
       <div class="stat"><b>4</b><span>Planned</span></div>
-      <div class="stat"><b>8</b><span>Code-health finds</span></div>
+      <div class="stat"><b>16</b><span>Loop finds</span></div>
     </div>
   </section>
 
@@ -456,6 +456,146 @@
     </div>
   </section>
 
+  <!-- ============ PIPELINE & SUPPLY-CHAIN INTEGRITY ============ -->
+  <section class="block reveal" id="pipeline">
+    <div class="block-head">
+      <h2>Pipeline &amp; supply-chain integrity</h2>
+      <span class="count">// planned · free tooling to secure the CI/CD path itself</span>
+      <span class="rule"></span>
+    </div>
+    <div class="rgrid">
+
+      <article class="cap rcard">
+        <div class="head"><span class="pill planned">Planned</span><span class="cat">Security · CI/CD</span></div>
+        <h3>Workflow SAST — <code>zizmor</code></h3>
+        <p>boost's four workflows embed <code>github-script</code> JavaScript and
+           shell and drive a Trusted-Publisher release — a rich attack surface.
+           <code>zizmor</code> statically flags template injection, unpinned
+           actions, over-broad <code>GITHUB_TOKEN</code> permissions and dangerous
+           triggers. The one tool that audits the automation that ships every
+           other fix.</p>
+        <div class="meta">
+          <span class="m">Complexity <b>S</b></span>
+          <span class="m hi">Impact <b>High</b></span>
+          <span class="m">Wow <b class="wow">★★★★★</b></span>
+          <span class="m">pipx-run</span>
+        </div>
+      </article>
+
+      <article class="cap rcard">
+        <div class="head"><span class="pill planned">Planned</span><span class="cat">Quality · CI/CD</span></div>
+        <h3>Workflow linting — <code>actionlint</code></h3>
+        <p>Catches GitHub Actions YAML bugs before they fail a live release:
+           malformed <code>${{ }}</code> expressions, deprecated syntax, and
+           shellcheck run over every <code>run:</code> block. Cheap insurance for a
+           repo whose release is fully automated — a broken workflow is a broken
+           publish.</p>
+        <div class="meta">
+          <span class="m">Complexity <b>S</b></span>
+          <span class="m">Impact <b>Med</b></span>
+          <span class="m">Wow <b class="wow">★★★</b></span>
+          <span class="m">shellcheck built in</span>
+        </div>
+      </article>
+
+      <article class="cap rcard">
+        <div class="head"><span class="pill planned">Planned</span><span class="cat">Security · Supply chain</span></div>
+        <h3>Build provenance — SLSA attestations</h3>
+        <p><code>actions/attest-build-provenance</code> emits a cryptographically
+           signed, verifiable record of <em>which workflow built which wheel from
+           which commit</em>, layered on top of the existing PyPI Trusted
+           Publishing. Consumers can <code>gh attestation verify</code> the
+           artifact they install — provenance without a paid signing service.</p>
+        <div class="meta">
+          <span class="m">Complexity <b>S</b></span>
+          <span class="m">Impact <b>Med</b></span>
+          <span class="m">Wow <b class="wow">★★★★</b></span>
+          <span class="m">SLSA build L2</span>
+        </div>
+      </article>
+
+      <article class="cap rcard">
+        <div class="head"><span class="pill planned">Planned</span><span class="cat">Security · Supply chain</span></div>
+        <h3>SBOM on every release — CycloneDX / Syft</h3>
+        <p>Generate a CycloneDX SBOM with the free <code>anchore/sbom-action</code>
+           and attach it to each GitHub Release, so downstreams can inventory and
+           scan exactly what boost is built from. Modest today (boost is close to
+           stdlib-only) but it grows in value as the optional <code>[rag]</code>
+           extras pull in real dependencies.</p>
+        <div class="meta">
+          <span class="m">Complexity <b>S</b></span>
+          <span class="m">Impact <b>Med</b></span>
+          <span class="m">Wow <b class="wow">★★★</b></span>
+          <span class="m">feeds osv-scanner</span>
+        </div>
+      </article>
+
+      <article class="cap rcard">
+        <div class="head"><span class="pill planned">Planned</span><span class="cat">Security · Vuln</span></div>
+        <h3>SBOM-aware scanning — <code>osv-scanner</code></h3>
+        <p>Google's <code>osv-scanner</code> cross-checks a lockfile or the SBOM
+           above against the OSV database, with broader ecosystem coverage than a
+           single-language audit. The SBOM-driven complement to <code>pip-audit</code>:
+           one scans the resolved env, the other scans the published manifest.</p>
+        <div class="meta">
+          <span class="m">Complexity <b>S</b></span>
+          <span class="m">Impact <b>Med</b></span>
+          <span class="m">Wow <b class="wow">★★</b></span>
+          <span class="m">OSV-backed</span>
+        </div>
+      </article>
+
+      <article class="cap rcard">
+        <div class="head"><span class="pill planned">Planned</span><span class="cat">Testing · Type</span></div>
+        <h3>Second type checker — <code>pyright</code></h3>
+        <p>Run Microsoft's <code>pyright</code> alongside mypy. Its independent
+           inference catches <code>None</code>-flow and narrowing bugs the current
+           mypy config lets slide, and it's the same engine most editors use — so
+           CI enforces what contributors already see. Two type checkers rarely
+           agree on <em>nothing</em>.</p>
+        <div class="meta">
+          <span class="m">Complexity <b>M</b></span>
+          <span class="m">Impact <b>Med</b></span>
+          <span class="m">Wow <b class="wow">★★★</b></span>
+          <span class="m">editor-parity</span>
+        </div>
+      </article>
+
+      <article class="cap rcard">
+        <div class="head"><span class="pill planned">Planned</span><span class="cat">Quality · Smell</span></div>
+        <h3>Widen the ruff rule surface — <code>B·SIM·C4·PERF·RUF</code></h3>
+        <p>Beyond the <code>S</code> security family (round 1), enable
+           flake8-bugbear (<code>B</code>), simplify (<code>SIM</code>),
+           comprehensions (<code>C4</code>), perflint (<code>PERF</code>) and
+           Ruff-native (<code>RUF</code>) rules — bug, readability and performance
+           smells caught at zero new-tool cost since ruff already runs in the lint
+           gate.</p>
+        <div class="meta">
+          <span class="m">Complexity <b>S</b></span>
+          <span class="m">Impact <b>Med</b></span>
+          <span class="m">Wow <b class="wow">★★★</b></span>
+          <span class="m">0 new deps</span>
+        </div>
+      </article>
+
+      <article class="cap rcard">
+        <div class="head"><span class="pill planned">Planned</span><span class="cat">Testing · Gap</span></div>
+        <h3>Patch-coverage gate — <code>diff-cover</code></h3>
+        <p>Enforce coverage on the <em>changed lines</em> of each PR — no external
+           service needed, it reads the same <code>coverage.xml</code> the suite
+           already emits. Pairs with the 80% project gate so new code can't quietly
+           ride in under-tested behind an already-high overall number.</p>
+        <div class="meta">
+          <span class="m">Complexity <b>S</b></span>
+          <span class="m">Impact <b>Med</b></span>
+          <span class="m">Wow <b class="wow">★★</b></span>
+          <span class="m">self-hosted</span>
+        </div>
+      </article>
+
+    </div>
+  </section>
+
   <footer>
     <p>Maintained by the boost quality loop · themed with
        <a href="../style/boost.css">style/boost.css</a> ·

{boost_skill_cli-1.0.23 → boost_skill_cli-1.0.25}/tests/functional/test_cli_discovery.py

@@ -563,6 +563,14 @@ class TestTrending:
         assert "jira-integration" in r.out
         assert "brainstorming" not in r.out
 
+    def test_long_description_is_clipped(self, boost, tapped, monkeypatch):
+        # D23: description column must not dump raw — it clips to the width.
+        boost("install", "brainstorming")
+        monkeypatch.setenv("COLUMNS", "40")
+        r = boost("trending")
+        assert "brainstorming" in r.out
+        assert "…" in r.out
+
 
 # ---------------------------------------------------------------- stats