boost-skill-cli 1.0.267__tar.gz → 1.0.269__tar.gz

{boost_skill_cli-1.0.267/boost_skill_cli.egg-info → boost_skill_cli-1.0.269}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: boost-skill-cli
-Version: 1.0.267
+Version: 1.0.269
 Summary: boost — Homebrew for AI coding skills
 Author: Jonathan Reyes
 License: GNU GENERAL PUBLIC LICENSE

{boost_skill_cli-1.0.267 → boost_skill_cli-1.0.269}/boost_cli/_version.py

@@ -18,7 +18,7 @@ version_tuple: tuple[int | str, ...]
 commit_id: str | None
 __commit_id__: str | None
 
-__version__ = version = '1.0.267'
-__version_tuple__ = version_tuple = (1, 0, 267)
+__version__ = version = '1.0.269'
+__version_tuple__ = version_tuple = (1, 0, 269)
 
 __commit_id__ = commit_id = None

{boost_skill_cli-1.0.267 → boost_skill_cli-1.0.269}/boost_cli/core/store.py

@@ -126,6 +126,41 @@ def preserved_agent_scope(only_agents: Optional[List[str]],
     return [a for a in recorded if a] or None
 
 
+def declared_agent_scope(only_agents: Optional[List[str]],
+                         existing: Optional[dict]) -> Optional[List[str]]:
+    """The scope to RECORD in the lock: an explicit narrowing, or the last one.
+
+    Deliberately *not* :func:`preserved_agent_scope`. That one answers "which
+    agents should this install link into", and falls back to the lock's
+    ``agents`` — which records what happens to be linked right now. Writing
+    that back as a declared scope would promote "these were the enabled agents
+    at install time" into "the user asked for exactly these", permanently
+    freezing a skill out of any agent enabled later. The two questions look
+    alike and are not, so they get separate functions.
+
+    Only an explicit ``--agent`` narrows. Absent that, an earlier declaration
+    is carried forward so ``update``/``reinstall`` don't drop it, and a skill
+    that was never narrowed keeps no scope at all (``None``).
+    """
+    if only_agents is not None:
+        return list(only_agents)
+    return (existing or {}).get("only_agents")
+
+
+def scoped_agents(entry: dict, enabled: Dict[str, Path]) -> Dict[str, Path]:
+    """The enabled agents a locked skill is supposed to be linked into.
+
+    Fails **open**: an entry with no ``only_agents`` — every entry written
+    before this field existed — means "not narrowed", so it gets every enabled
+    agent. That keeps ``boost sync`` doing its other job, which is linking
+    already-installed skills into an agent that was enabled afterwards.
+    """
+    scope = entry.get("only_agents")
+    if not scope:
+        return enabled.copy()
+    return {a: d for a, d in enabled.items() if a in scope}
+
+
 def unlink_agents(name: str) -> List[str]:
     """Remove the ``name`` symlink from every enabled agent dir.
 
@@ -326,6 +361,11 @@ def install(entry: dict, force: bool = False,
         "pinned": bool((existing or {}).get("pinned")),
         "quarantined": False,
         "agents": res.linked,
+        # `agents` is what IS linked; `only_agents` is what the user ASKED for.
+        # sync needs the second: it links a skill into every enabled agent, and
+        # without a record of the request it cannot tell a deliberate `--agent`
+        # narrowing from a skill that simply predates a newly enabled agent.
+        "only_agents": declared_agent_scope(only_agents, existing),
         "tags": (existing or {}).get("tags", []),
     })
     journal.log("install", name, tap=entry["tap"], version=entry.get("version"))
@@ -806,6 +846,10 @@ def install_from_path(src_dir: Path, name: Optional[str] = None,
         "pinned": bool((existing or {}).get("pinned")),
         "quarantined": False,
         "agents": res.linked,
+        # `boost import --agent ...` narrows the same way `install` does, so it
+        # has to record the same declaration — otherwise the links are narrow
+        # but sync sees no scope and widens them right back.
+        "only_agents": declared_agent_scope(only_agents, existing),
         "tags": (existing or {}).get("tags", []),
     })
     journal.log("import", name, source=str(src_dir))
@@ -922,7 +966,12 @@ def sync_plan() -> Dict[str, list]:
             continue
         if entry.get("quarantined"):
             continue
-        for agent, adir in agents.enabled_agents().items():
+        # Only the agents this skill was installed for. Walking every enabled
+        # agent made `boost sync` a second path to the scope leak that
+        # `preserved_agent_scope` closed on the install side: it reported a
+        # missing_link for each agent outside the narrowing, and sync_apply
+        # dutifully linked them, undoing `install --agent` in one command.
+        for agent, adir in scoped_agents(entry, agents.enabled_agents()).items():
             link = adir / name
             if not link.is_symlink() or not link.exists():
                 plan["missing_links"].append((name, agent))

{boost_skill_cli-1.0.267 → boost_skill_cli-1.0.269/boost_skill_cli.egg-info}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: boost-skill-cli
-Version: 1.0.267
+Version: 1.0.269
 Summary: boost — Homebrew for AI coding skills
 Author: Jonathan Reyes
 License: GNU GENERAL PUBLIC LICENSE

{boost_skill_cli-1.0.267 → boost_skill_cli-1.0.269}/boost_skill_cli.egg-info/SOURCES.txt

@@ -182,6 +182,7 @@ docs/roadmap/items/crash-recorder-error-paths-core-logs-py.md
 docs/roadmap/items/demo-gif-workflow-has-never-succeeded.md
 docs/roadmap/items/dense-search-fallback-and-stale-tap-pruning.md
 docs/roadmap/items/dependabot-missing-pip-ecosystem.md
+docs/roadmap/items/dependabot-root-pip-entry-duplicates-requirements.md
 docs/roadmap/items/dependency-cve-gate-pip-audit.md
 docs/roadmap/items/docsite-chrome-and-content-audit.md
 docs/roadmap/items/docstring-coverage-interrogate.md
@@ -296,6 +297,7 @@ docs/roadmap/items/structured-json-log-output-mode.md
 docs/roadmap/items/supply-chain-posture-openssf-scorecard.md
 docs/roadmap/items/surface-every-docs-page-from-the-guide.md
 docs/roadmap/items/sync-deletes-unowned-broken-symlinks.md
+docs/roadmap/items/sync-relinks-into-every-agent-ignoring-scope.md
 docs/roadmap/items/tap-signing-and-provenance-sigstore-minisign.md
 docs/roadmap/items/theme-asset-linting-stylelint-eslint.md
 docs/roadmap/items/typo-detection-codespell.md

{boost_skill_cli-1.0.267 → boost_skill_cli-1.0.269}/docs/roadmap/items/ai-bridge-silent-failure-logging.md

@@ -2,15 +2,15 @@
 id: ai-bridge-silent-failure-logging
 board: code
 section: internals
-status: planned
+status: shipped
 category: Observability
 complexity: S
 impact: Med
 wow: 2
 note:
 order: 40
-owner:
-pr:
+owner: loop/ai-failure-logging
+pr: 284
 title: AI bridge swallows failures with zero diagnostic trail
 ---
 <code>core/ai.py</code>'s CLI and API call paths both catch their failure modes (timeout, OS error,

{boost_skill_cli-1.0.267 → boost_skill_cli-1.0.269}/docs/roadmap/items/crash-listing-branch-untested.md

@@ -2,15 +2,15 @@
 id: crash-listing-branch-untested
 board: code
 section: internals
-status: planned
+status: shipped
 category: Testing · Bug
 complexity: S
 impact: Low
 wow: 1
 note:
 order: 37
-owner:
-pr:
+owner: loop/crash-listing-tests
+pr: 291
 title: <code>boost log --crashes</code> listing branch has no non-empty test
 ---
 <code>_show_crashes</code> has an empty-state branch and a listing branch that reads each

{boost_skill_cli-1.0.267 → boost_skill_cli-1.0.269}/docs/roadmap/items/demo-gif-workflow-has-never-succeeded.md

@@ -2,15 +2,15 @@
 id: demo-gif-workflow-has-never-succeeded
 board: code
 section: docsite
-status: planned
+status: shipped
 category: Bug
 complexity: S
 impact: Low
 wow: 2
 note: 3 runs, 3 failures, 0 PRs opened
 order: 52
-owner:
-pr:
+owner: loop/fix-demo-recorder
+pr: 294
 title: <code>demo.yml</code> has failed every run since it landed — vhs-action cannot install ffmpeg
 ---
 <code>demo.yml</code> re-records <code>docs/demo.gif</code> with

{boost_skill_cli-1.0.267 → boost_skill_cli-1.0.269}/docs/roadmap/items/dense-search-fallback-and-stale-tap-pruning.md

@@ -2,15 +2,15 @@
 id: dense-search-fallback-and-stale-tap-pruning
 board: code
 section: internals
-status: planned
+status: shipped
 category: Bug
 complexity: M
 impact: Med
 wow: 2
 note:
 order: 30
-owner:
-pr:
+owner: loop/dense-fallback-and-prune
+pr: 293
 title: Dense search's empty result skips the BM25 fallback
 ---
 <code>_retrieve_any</code> treats any non-<code>None</code> dense result as final, but

{boost_skill_cli-1.0.267 → boost_skill_cli-1.0.269}/docs/roadmap/items/dependabot-missing-pip-ecosystem.md

@@ -2,15 +2,15 @@
 id: dependabot-missing-pip-ecosystem
 board: code
 section: pipeline
-status: planned
+status: shipped
 category: Supply chain
 complexity: S
 impact: Low
 wow: 1
 note: extras only — <code>/requirements</code> is covered
 order: 11
-owner:
-pr:
+owner: loop/dependabot-pyproject-extras
+pr: 289
 title: Dependabot's <code>pip</code> entry misses <code>pyproject.toml</code>'s extras
 ---
 <code>.github/dependabot.yml</code> declares <code>pip</code> for

boost_skill_cli-1.0.269/docs/roadmap/items/dependabot-root-pip-entry-duplicates-requirements.md

@@ -0,0 +1,45 @@
+---
+id: dependabot-root-pip-entry-duplicates-requirements
+board: code
+section: internals
+status: planned
+category: Build · Gap
+complexity: S
+impact: Low
+wow: 1
+note: fallout from #289 — every toolchain bump now arrives twice
+order: 35
+owner:
+pr:
+title: Dependabot raises every toolchain bump <em>twice</em>
+---
+PR #289 added a third Dependabot entry, <code>package-ecosystem: pip</code> with
+<code>directory: /</code>, to give <code>pyproject.toml</code>'s optional extras the proactive bump
+PRs they had never had. The first scheduled run after it merged produced <b>eight</b> PRs, and two
+pairs of them are duplicates: <code>#301</code>/<code>#302</code> (twine) and
+<code>#300</code>/<code>#303</code> (hypothesis) change <b>byte-identical file sets</b> — one PR from
+the <code>/</code> entry and one from the pre-existing <code>/requirements</code> entry, for the same
+bump. Merging either makes the other redundant, and Dependabot closes the twin automatically, so the
+cost is noise rather than breakage. It will recur every week.
+
+Worse, the entry cannot deliver what it was added for. Every constraint under
+<code>[project.optional-dependencies]</code> is either an open lower bound
+(<code>sqlite-vec&gt;=0.1.6</code>) or explicitly listed in that entry's own <code>ignore</code>
+block (the pinned langchain 0.3 stack held back for ragas). Dependabot does not raise a
+<i>version</i> PR when the declared range already admits the newest release, so the set of
+<code>pyproject.toml</code> version updates this entry can ever produce is <b>empty</b> — which is
+why none of the eight touched <code>pyproject.toml</code>.
+
+Do not simply revert it. Dependabot <i>security</i> updates ignore the versioning strategy and fire
+on a vulnerable version inside a permitted range, so the entry does give the extras security
+coverage they previously lacked — the item it closed was right that
+<code>[rag]</code>/<code>[bdd]</code>/<code>[perf]</code> had only reactive pip-audit flags. The
+entry should be <b>narrowed</b>, not removed.
+
+Two candidate fixes, both needing verification against a real scheduled run rather than reasoning —
+Dependabot's file discovery is what got this wrong in the first place. <b>First</b>, scope the
+<code>/</code> entry so it stops matching <code>requirements/**</code>, leaving
+<code>/requirements</code> as the single owner of the hash-pinned lock. <b>Second</b>, if proactive
+extras bumps are genuinely wanted, that needs <code>versioning-strategy: increase</code> so open
+lower bounds are raised at all; otherwise accept that this entry is security-only and say so in the
+comment, which is the honest smaller change.

{boost_skill_cli-1.0.267 → boost_skill_cli-1.0.269}/docs/roadmap/items/github-community-health-files.md

@@ -2,15 +2,15 @@
 id: github-community-health-files
 board: code
 section: dx
-status: planned
+status: shipped
 category: Developer Experience
 complexity: S
 impact: Med
 wow: 2
 note:
 order: 11
-owner:
-pr:
+owner: loop/community-health-files
+pr: 290
 title: No issue/PR templates or a code of conduct
 ---
 The repo has <code>SECURITY.md</code>, <code>CONTRIBUTING.md</code>, and

{boost_skill_cli-1.0.267 → boost_skill_cli-1.0.269}/docs/roadmap/items/license-compliance-scanning.md

@@ -2,15 +2,15 @@
 id: license-compliance-scanning
 board: code
 section: pipeline
-status: planned
+status: shipped
 category: Supply chain
 complexity: S
 impact: Med
 wow: 2
 note:
 order: 12
-owner:
-pr:
+owner: loop/license-compliance
+pr: 310
 title: License-compliance scanning of the dependency closure
 ---
 Nothing in CI checks SPDX license compatibility of resolved dependencies — <code>pip-audit</code>

{boost_skill_cli-1.0.267 → boost_skill_cli-1.0.269}/docs/roadmap/items/lint-tap-misscopes-rule-workflow-entries.md

@@ -2,15 +2,15 @@
 id: lint-tap-misscopes-rule-workflow-entries
 board: code
 section: internals
-status: planned
+status: shipped
 category: Bug
 complexity: S
 impact: Med
 wow: 2
 note:
 order: 34
-owner:
-pr:
+owner: loop/lint-tap-scope
+pr: 279
 title: <code>lint --tap</code> mis-scores rule/workflow entries as broken
 ---
 <code>boost lint --tap</code> builds its target list without filtering by kind, so rule/workflow

{boost_skill_cli-1.0.267 → boost_skill_cli-1.0.269}/docs/roadmap/items/lock-invariant-cannot-parse-extras-pins.md

@@ -2,15 +2,15 @@
 id: lock-invariant-cannot-parse-extras-pins
 board: code
 section: health
-status: planned
+status: shipped
 category: Latent bug
 complexity: S
 impact: Med
 wow: 2
 note: <code>pkg[extra]==x</code> reads as unpinned
 order: 16
-owner:
-pr:
+owner: loop/lock-invariant-extras
+pr: 306
 title: The lock invariant can't parse <code>name[extra]==version</code>, so a valid pin fails the gate
 ---
 <code>tests/unit/test_toolchain_lock.py</code> (added with the lock-stability fix, #248)

{boost_skill_cli-1.0.267 → boost_skill_cli-1.0.269}/docs/roadmap/items/merge-queue-would-deadlock-most-required-checks.md

@@ -2,15 +2,15 @@
 id: merge-queue-would-deadlock-most-required-checks
 board: code
 section: pipeline
-status: planned
+status: shipped
 category: Release safety
 complexity: S
 impact: Med
 wow: 3
 note: a latent trap, only if someone enables the queue
 order: 58
-owner:
-pr:
+owner: loop/merge-queue
+pr: 280
 title: Enabling a merge queue would deadlock every required check except ci.yml's
 ---
 Only <code>ci.yml</code> declares <code>merge_group</code> among its triggers. The other

{boost_skill_cli-1.0.267 → boost_skill_cli-1.0.269}/docs/roadmap/items/mypy-strict-mode-for-commands.md

@@ -2,15 +2,15 @@
 id: mypy-strict-mode-for-commands
 board: code
 section: health
-status: planned
+status: shipped
 category: Testing · Type
 complexity: M
 impact: High
 wow: 3
 note:
 order: 11
-owner:
-pr:
+owner: loop/mypy-check-command-bodies
+pr: 309
 title: mypy's default mode skips untyped command bodies
 ---
 <code>[tool.mypy]</code> in <code>pyproject.toml</code> sets only <code>python_version</code>/

{boost_skill_cli-1.0.267 → boost_skill_cli-1.0.269}/docs/roadmap/items/negative-limit-inverts-log-pulse-output.md

@@ -2,15 +2,15 @@
 id: negative-limit-inverts-log-pulse-output
 board: code
 section: internals
-status: planned
+status: shipped
 category: CLI ergonomics
 complexity: S
 impact: Low
 wow: 1
 note:
 order: 36
-owner:
-pr:
+owner: loop/positive-count-flags
+pr: 285
 title: Negative <code>-n</code> silently inverts <code>log</code>/<code>pulse</code> output
 ---
 <code>boost log</code>/<code>boost pulse</code> accept <code>-n</code>/<code>--limit</code> as a bare

{boost_skill_cli-1.0.267 → boost_skill_cli-1.0.269}/docs/roadmap/items/onboard-overwrites-generated-files-without-confirm.md

@@ -2,15 +2,15 @@
 id: onboard-overwrites-generated-files-without-confirm
 board: code
 section: internals
-status: planned
+status: shipped
 category: UX · Bug
 complexity: S
 impact: Med
 wow: 2
 note:
 order: 35
-owner:
-pr:
+owner: loop/onboard-confirm-overwrite
+pr: 287
 title: <code>boost onboard</code> silently overwrites existing generated files
 ---
 <code>boost onboard</code> writes <code>.boost/telemetry.json</code>, a GitHub Actions workflow, and

{boost_skill_cli-1.0.267 → boost_skill_cli-1.0.269}/docs/roadmap/items/roadmap-html-goes-stale-on-every-rebase.md

@@ -2,15 +2,15 @@
 id: roadmap-html-goes-stale-on-every-rebase
 board: code
 section: dx
-status: planned
+status: shipped
 category: DX
 complexity: M
 impact: Med
 wow: 3
 note: hit twice on one PR in a single afternoon
 order: 59
-owner:
-pr:
+owner: loop/roadmap-stale-diagnosis
+pr: 307
 title: <code>roadmap.html</code> goes stale on every rebase, so a card and a merge race redden the whole matrix
 ---
 The data-driven roadmap solved the conflict problem for <em>item files</em>: two loops adding

{boost_skill_cli-1.0.267 → boost_skill_cli-1.0.269}/docs/roadmap/items/sbom-release-event-never-fires.md

@@ -9,7 +9,7 @@ impact: High
 wow: 4
 note: 253 releases shipped with no SBOM; fixed with workflow_run
 order: 50
-owner:
+owner: loop/sbom-trigger
 pr: 295
 title: <code>sbom.yml</code> has never run — it waits for an event <code>GITHUB_TOKEN</code> cannot emit
 ---

{boost_skill_cli-1.0.267 → boost_skill_cli-1.0.269}/docs/roadmap/items/serve-py-traversal-guards-untested.md

@@ -2,15 +2,15 @@
 id: serve-py-traversal-guards-untested
 board: code
 section: internals
-status: planned
+status: shipped
 category: Testing · Security
 complexity: S
 impact: Med
 wow: 2
 note: lowest coverage in core/
 order: 38
-owner:
-pr:
+owner: loop/serve-guard-coverage
+pr: 282
 title: <code>boost serve</code>'s own path-traversal guards are untested
 ---
 <code>serve.py</code>'s defenses against a malicious catalog <code>skill_md</code> path

{boost_skill_cli-1.0.267 → boost_skill_cli-1.0.269}/docs/roadmap/items/structured-json-log-output-mode.md

@@ -2,15 +2,15 @@
 id: structured-json-log-output-mode
 board: code
 section: internals
-status: planned
+status: shipped
 category: Observability
 complexity: M
 impact: Med
 wow: 2
 note:
 order: 39
-owner:
-pr:
+owner: loop/json-log-format
+pr: 308
 title: Diagnostic log has no structured/JSON output mode
 ---
 <code>core/logs.py</code> uses stdlib <code>logging</code> with rotation and crash reports, but its

boost_skill_cli-1.0.269/docs/roadmap/items/sync-relinks-into-every-agent-ignoring-scope.md

@@ -0,0 +1,36 @@
+---
+id: sync-relinks-into-every-agent-ignoring-scope
+board: code
+section: internals
+status: shipped
+category: Bug
+complexity: S
+impact: Med
+wow: 2
+note: the half of the scope leak PR #288 deliberately left open
+order: 34
+owner: loop/sync-agent-scope
+pr: 311
+title: <code>sync</code> relinks a narrowed skill into every agent
+---
+<code>store.preserved_agent_scope</code> (PR #288) stopped <code>update</code> and
+<code>reinstall</code> widening a skill installed with <code>--agent</code> narrowing, but
+<code>sync_plan()</code> was a second, independent path to the same leak: it walked
+<code>agents.enabled_agents()</code> for <b>every</b> locked skill and reported a
+<code>missing_link</code> for any agent the skill was not linked into — the lock's recorded
+scope was never consulted. <code>sync_apply</code> then dutifully linked them, so a
+single <code>boost sync</code> undid the narrowing that <code>install --agent</code> asked for and
+rewrote the lock to match.
+
+It was left out of #288 because the fix is a real trade-off, not an oversight:
+<code>boost sync</code> is also how a <i>newly enabled</i> agent picks up skills installed
+before it existed, and honouring the lock's <code>agents</code> list would silently break that —
+<code>agents</code> records what is linked <i>right now</i>, so reading it as a scope would
+freeze every existing skill out of any agent enabled later.
+
+Resolved by separating the two questions. A new <code>only_agents</code> field records what the
+user <i>asked</i> for, written only by an explicit <code>--agent</code> and carried forward across
+<code>update</code>/<code>reinstall</code>; <code>agents</code> keeps meaning what is actually linked.
+<code>sync_plan</code> filters through <code>scoped_agents()</code>, which <b>fails open</b> — an entry
+with no declaration, which is every entry written before this field existed, still fans out to
+every enabled agent. So narrowing is honoured and the newly-enabled-agent path is untouched.

{boost_skill_cli-1.0.267 → boost_skill_cli-1.0.269}/docs/roadmap/items/update-reinstall-widens-agent-scope.md

@@ -2,15 +2,15 @@
 id: update-reinstall-widens-agent-scope
 board: code
 section: internals
-status: planned
+status: shipped
 category: Bug
 complexity: S
 impact: Med
 wow: 2
 note:
 order: 33
-owner:
-pr:
+owner: loop/keep-agent-scope
+pr: 288
 title: <code>update</code>/<code>reinstall</code> silently widen a skill's agent scope
 ---
 A skill installed with <code>--agent</code> narrowing (e.g. <code>boost install foo --agent

{boost_skill_cli-1.0.267 → boost_skill_cli-1.0.269}/docs/roadmap/items/wire-bdd-suite-into-ci.md

@@ -2,15 +2,15 @@
 id: wire-bdd-suite-into-ci
 board: code
 section: dx
-status: planned
+status: shipped
 category: Test infra
 complexity: S
 impact: Med
 wow: 2
 note:
 order: 12
-owner:
-pr:
+owner: loop/wire-bdd-into-ci
+pr: 292
 title: New BDD suite has zero CI wiring
 ---
 The behave suite added under <code>tests/bdd/</code> (11 features, 47 scenarios) passes cleanly