boost-skill-cli 1.0.400__tar.gz → 1.0.401__tar.gz

{boost_skill_cli-1.0.400 → boost_skill_cli-1.0.401}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: boost-skill-cli
-Version: 1.0.400
+Version: 1.0.401
 Summary: boost — Homebrew for AI coding skills
 Author: Jonathan Reyes
 License: GNU GENERAL PUBLIC LICENSE

{boost_skill_cli-1.0.400 → boost_skill_cli-1.0.401}/boost_cli/_version.py

@@ -18,7 +18,7 @@ version_tuple: tuple[int | str, ...]
 commit_id: str | None
 __commit_id__: str | None
 
-__version__ = version = '1.0.400'
-__version_tuple__ = version_tuple = (1, 0, 400)
+__version__ = version = '1.0.401'
+__version_tuple__ = version_tuple = (1, 0, 401)
 
 __commit_id__ = commit_id = None

{boost_skill_cli-1.0.400 → boost_skill_cli-1.0.401}/boost_cli/commands/pkg.py

@@ -725,19 +725,32 @@ def cmd_update(argv: List[str]) -> int:
     ap.add_argument("-y", "--yes", action="store_true",
                     help="skip the confirmation prompt")
     args = ap.parse_args(argv)
-    results = registry.update(args.tap or None)
-    if not results:
+    results, failures = registry.update(args.tap or None)
+    if not results and not failures:
         out.info("no taps configured — start with `boost tap --defaults`")
         return 0
     for tname, summary in results.items():
         catalog.rebuild_tap(registry.get(tname))
         out.ok("%s: %s" % (tname, summary))
+    # Report the dead ones by name, after the successes, so a broken upstream
+    # reads as one line of bad news rather than as the whole command failing.
+    for tname, err in failures.items():
+        out.warn("%s: %s" % (tname, err))
+    if failures:
+        out.info(out.role(
+            "%d of %d taps could not be refreshed — the rest are up to date. "
+            "Drop a dead one with `boost untap <name>`."
+            % (len(failures), len(results) + len(failures)), "muted"))
     # A pulled tap can add, drop, or rename catalogue entries, so the
     # completion name cache must not survive an update unrefreshed.
     complete.refresh_names()
     journal.log("update", args.tap or "all")
     if args.taps_only:
-        return 0
+        # Same exit-code rule as the end of the full path: non-zero only when
+        # nothing was refreshed at all. This early return predates that rule
+        # and kept answering 0 with every tap dead — and a cron'd
+        # `boost update --taps-only` exists precisely to notice that morning.
+        return 1 if failures and not results else 0
 
     upgraded = 0
     for name, lk in sorted(lockfile.installed().items()):
@@ -782,8 +795,14 @@ def cmd_update(argv: List[str]) -> int:
     upgraded += _update_materialized("rule", lockfile.installed_rules(), results)
     upgraded += _update_materialized("workflow", lockfile.installed_workflows(), results)
     if not upgraded:
-        out.ok("everything up to date")
-    return 0
+        # Don't claim "everything up to date" when some taps were never
+        # reached — that is exactly the false all-clear this fix exists to stop.
+        out.ok("everything up to date" if not failures
+               else "everything up to date, except the taps above")
+    # Non-zero only when nothing was refreshed at all. A partial run did the job
+    # it could do, and failing it would put us back to one dead upstream
+    # breaking `boost update` for the other 79.
+    return 1 if failures and not results else 0
 
 
 # ── reinstall ────────────────────────────────────────────────────────────

{boost_skill_cli-1.0.400 → boost_skill_cli-1.0.401}/boost_cli/core/gitutil.py

@@ -32,11 +32,36 @@ def run(args: List[str], cwd: Optional[Path] = None, check: bool = True,
     except subprocess.TimeoutExpired:
         raise BoostError("git %s timed out after %ds" % (args[0], timeout)) from None
     if check and proc.returncode != 0:
-        detail = (proc.stderr or proc.stdout or "").strip().splitlines()
-        raise BoostError("git %s failed: %s" % (args[0], detail[-1] if detail else "unknown error"))
+        raise BoostError("git %s failed: %s"
+                         % (args[0], _git_error(proc.stderr or proc.stdout or "")))
     return proc
 
 
+def _git_error(text: str) -> str:
+    """Pull the one useful line out of git's multi-line failure output.
+
+    git states the cause first and then advises, so the LAST line is usually the
+    tail of a prose hint. A missing remote prints::
+
+        fatal: '/nope' does not appear to be a git repository
+        fatal: Could not read from remote repository.
+        <blank>
+        Please make sure you have the correct access rights
+        and the repository exists.
+
+    Taking the last line surfaced "and the repository exists." — a sentence
+    fragment, with the one line that names the bad path thrown away. Prefer the
+    first ``fatal:``/``error:`` line, which is git's own convention for the
+    cause, and fall back to the last non-empty line for output that has neither.
+    """
+    lines = [ln.strip() for ln in text.strip().splitlines() if ln.strip()]
+    for line in lines:
+        low = line.lower()
+        if low.startswith(("fatal:", "error:")):
+            return line
+    return lines[-1] if lines else "unknown error"
+
+
 # git's remote-helper transports run arbitrary commands straight from the URL
 # (notably `ext::sh -c …`), so refuse them outright — boost only ever clones
 # real http(s)/ssh/git remotes.

{boost_skill_cli-1.0.400 → boost_skill_cli-1.0.401}/boost_cli/core/registry.py

@@ -4,7 +4,7 @@ from __future__ import annotations
 import difflib
 from dataclasses import dataclass
 from pathlib import Path
-from typing import List, Optional
+from typing import List, Optional, Tuple
 
 from ..errors import BoostError
 from . import config, gitutil, paths, policy, util
@@ -151,14 +151,38 @@ def remove(name: str) -> Tap:
     return tap
 
 
-def update(name: Optional[str] = None) -> dict:
-    """git-pull one tap (or all). Returns {tap_name: summary}."""
+def update(name: Optional[str] = None) -> Tuple[dict, dict]:
+    """git-pull one tap (or all). Returns ``({name: summary}, {name: error})``.
+
+    **A named tap still raises.** ``boost update sometap`` is a request about
+    that one tap, so its failure is the answer to the question asked.
+
+    **Across all taps it does not.** Upstream repos get deleted, renamed and
+    made private by people who have never heard of this machine, and one of them
+    used to abort the whole loop: every tap after the dead one went unrefreshed,
+    the ones already pulled never had their catalogs rebuilt, and the user saw a
+    bare git error naming neither the tap nor the URL. With 80+ taps that is a
+    near-certainty rather than an edge case. Collecting failures instead lets the
+    other 79 refresh, and lets the caller name the broken one.
+
+    This mirrors what the skill-update loop in ``cmd_update`` already does — warn
+    per item and carry on. The tap loop was the one place that did not.
+    """
     targets = [get(name)] if name else list_taps()
-    results = {}
+    results: dict = {}
+    failures: dict = {}
     for tap in targets:
-        if not tap.is_cloned:
-            gitutil.clone_shallow(tap.url, tap.path)
-            results[tap.name] = "cloned"
-        else:
-            results[tap.name] = gitutil.pull(tap.path)
-    return results
+        try:
+            if not tap.is_cloned:
+                gitutil.clone_shallow(tap.url, tap.path)
+                results[tap.name] = "cloned"
+            else:
+                results[tap.name] = gitutil.pull(tap.path)
+        except BoostError as err:
+            if name:
+                raise
+            # The caller prefixes the tap name, which is the part git never
+            # says; git's own first line already carries the URL or path. See
+            # gitutil._git_error for why that line is now the one we show.
+            failures[tap.name] = err.message
+    return results, failures

{boost_skill_cli-1.0.400 → boost_skill_cli-1.0.401}/boost_skill_cli.egg-info/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: boost-skill-cli
-Version: 1.0.400
+Version: 1.0.401
 Summary: boost — Homebrew for AI coding skills
 Author: Jonathan Reyes
 License: GNU GENERAL PUBLIC LICENSE

{boost_skill_cli-1.0.400 → boost_skill_cli-1.0.401}/boost_skill_cli.egg-info/SOURCES.txt

@@ -293,6 +293,7 @@ docs/roadmap/items/negative-limit-inverts-log-pulse-output.md
 docs/roadmap/items/onboard-overwrites-generated-files-without-confirm.md
 docs/roadmap/items/one-command-every-env-nox.md
 docs/roadmap/items/one-commit-can-cut-two-releases.md
+docs/roadmap/items/one-dead-tap-broke-every-update.md
 docs/roadmap/items/one-shared-atomic-write-helper.md
 docs/roadmap/items/package-metadata-validation-twine-check-friends.md
 docs/roadmap/items/patch-coverage-gate-diff-cover.md

boost_skill_cli-1.0.401/docs/roadmap/items/one-dead-tap-broke-every-update.md

@@ -0,0 +1,57 @@
+---
+id: one-dead-tap-broke-every-update
+board: code
+section: internals
+status: shipped
+category: Bug
+complexity: S
+impact: High
+wow: 4
+note: found on the maintainer's own machine — 80+ taps, one deleted upstream, no updates for any of them
+order: 95
+owner: loop/update-survives-a-dead-tap
+title: one deleted upstream stopped <code>boost update</code> for every other tap
+---
+<code>registry.update()</code> looped over the configured taps with <b>no error handling at all</b>.
+The first tap whose upstream had been deleted, renamed or made private raised, and everything after
+it never ran: later taps went unrefreshed, the taps that <i>had</i> already pulled never had their
+catalogs rebuilt, and the whole command exited non-zero.
+
+<b>Found by accident, on real data.</b> A test escaped its sandbox and ran <code>boost update</code>
+against the maintainer's actual <code>~/.boost</code>, which died on
+<code>MikroJit-Technologies/claude-skills</code> — a repo that no longer exists. With 80+ taps
+configured, an upstream disappearing is routine rather than an edge case, and one of them was
+silently costing every other tap its updates.
+
+<b>The error was unactionable twice over.</b> It named no tap, and it was not even a sentence:
+<i>"git -C failed: and the repository exists."</i> That is the last line of git's output, and git
+states the cause <i>first</i> and advises after —
+
+<code>fatal: '/nope' does not appear to be a git repository</code> &middot;
+<code>fatal: Could not read from remote repository.</code> &middot; <i>(blank)</i> &middot;
+<code>Please make sure you have the correct access rights</code> &middot;
+<code>and the repository exists.</code>
+
+&mdash; so <code>detail[-1]</code> surfaced the tail of a prose hint and threw away the one line that
+names the bad path. <code>gitutil._git_error</code> now prefers the first
+<code>fatal:</code>/<code>error:</code> line, git's own convention for the cause, and falls back to
+the last non-empty line. That improves <i>every</i> git failure boost reports, not just this one.
+
+<b>The shape of the fix was already in the codebase.</b> The skill-update loop in
+<code>cmd_update</code> has caught <code>BoostError</code> per item and carried on with a warning
+for a long time; the tap loop was the one place that did not. <code>update()</code> now returns
+<code>(results, failures)</code>, and a named tap — <code>boost update sometap</code> — still
+raises, because asking about one tap makes its failure the answer to the question asked. Only the
+all-taps path is forgiving.
+
+<b>Exit code and wording, both deliberate.</b> A partial run returns <b>0</b>: failing it would put
+us back to one dead upstream breaking the command for the other 79. But it must not print a clean
+bill of health either, so the closing line becomes <i>"everything up to date, except the taps
+above"</i>, and a count plus the fix (<code>boost untap &lt;name&gt;</code>) is printed. Non-zero is
+reserved for the case where nothing refreshed at all. Skills belonging to a failed tap are skipped
+automatically — the update pass already gates on <code>tapname not in results</code>, so a failed
+tap simply never appears there.
+
+<b>Verified by reversion</b>: the git-message test was confirmed to fail with the old
+<code>detail[-1]</code> restored, reproducing <i>"git -C failed: and the repository exists."</i>
+exactly.

{boost_skill_cli-1.0.400 → boost_skill_cli-1.0.401}/docs/roadmap.html

@@ -125,7 +125,7 @@
       <div class="stat"><b>16</b><span>Shipped</span></div>
       <div class="stat"><b>1</b><span>Next up</span></div>
       <div class="stat"><b>8</b><span>Planned</span></div>
-      <div class="stat"><b>213</b><span>Loop finds</span></div>
+      <div class="stat"><b>214</b><span>Loop finds</span></div>
       <!-- /ROADMAP:stats -->
     </div>
   </section>
@@ -3332,6 +3332,61 @@ minutes pulling real tap clones over the network before failing.</p></details>
           <span class="m">the only escape from the security gate was a flag the parser refused</span>
         </div>
       </article>
+
+      <article class="cap rcard" id="one-dead-tap-broke-every-update">
+        <div class="head"><span class="pill shipped">Shipped</span><span class="cat">Bug</span></div>
+        <h3>one deleted upstream stopped <code>boost update</code> for every other tap</h3>
+        <details class="cardbody"><summary>Write-up</summary>
+        <p><code>registry.update()</code> looped over the configured taps with <b>no error handling at all</b>.
+The first tap whose upstream had been deleted, renamed or made private raised, and everything after
+it never ran: later taps went unrefreshed, the taps that <i>had</i> already pulled never had their
+catalogs rebuilt, and the whole command exited non-zero.
+
+<b>Found by accident, on real data.</b> A test escaped its sandbox and ran <code>boost update</code>
+against the maintainer's actual <code>~/.boost</code>, which died on
+<code>MikroJit-Technologies/claude-skills</code> — a repo that no longer exists. With 80+ taps
+configured, an upstream disappearing is routine rather than an edge case, and one of them was
+silently costing every other tap its updates.
+
+<b>The error was unactionable twice over.</b> It named no tap, and it was not even a sentence:
+<i>"git -C failed: and the repository exists."</i> That is the last line of git's output, and git
+states the cause <i>first</i> and advises after —
+
+<code>fatal: '/nope' does not appear to be a git repository</code> &middot;
+<code>fatal: Could not read from remote repository.</code> &middot; <i>(blank)</i> &middot;
+<code>Please make sure you have the correct access rights</code> &middot;
+<code>and the repository exists.</code>
+
+&mdash; so <code>detail[-1]</code> surfaced the tail of a prose hint and threw away the one line that
+names the bad path. <code>gitutil._git_error</code> now prefers the first
+<code>fatal:</code>/<code>error:</code> line, git's own convention for the cause, and falls back to
+the last non-empty line. That improves <i>every</i> git failure boost reports, not just this one.
+
+<b>The shape of the fix was already in the codebase.</b> The skill-update loop in
+<code>cmd_update</code> has caught <code>BoostError</code> per item and carried on with a warning
+for a long time; the tap loop was the one place that did not. <code>update()</code> now returns
+<code>(results, failures)</code>, and a named tap — <code>boost update sometap</code> — still
+raises, because asking about one tap makes its failure the answer to the question asked. Only the
+all-taps path is forgiving.
+
+<b>Exit code and wording, both deliberate.</b> A partial run returns <b>0</b>: failing it would put
+us back to one dead upstream breaking the command for the other 79. But it must not print a clean
+bill of health either, so the closing line becomes <i>"everything up to date, except the taps
+above"</i>, and a count plus the fix (<code>boost untap &lt;name&gt;</code>) is printed. Non-zero is
+reserved for the case where nothing refreshed at all. Skills belonging to a failed tap are skipped
+automatically — the update pass already gates on <code>tapname not in results</code>, so a failed
+tap simply never appears there.
+
+<b>Verified by reversion</b>: the git-message test was confirmed to fail with the old
+<code>detail[-1]</code> restored, reproducing <i>"git -C failed: and the repository exists."</i>
+exactly.</p></details>
+        <div class="meta">
+          <span class="m">Complexity <b>S</b></span>
+          <span class="m hi">Impact <b>High</b></span>
+          <span class="m">Wow <b class="wow">★★★★</b></span>
+          <span class="m">found on the maintainer's own machine — 80+ taps, one deleted upstream, no updates for any of them</span>
+        </div>
+      </article>
       <!-- /ROADMAP:cards -->
 
     </div>

{boost_skill_cli-1.0.400 → boost_skill_cli-1.0.401}/tests/functional/test_cli_pkg.py

@@ -317,6 +317,44 @@ class TestUpdate:
         assert "fixture-tap: already up to date" in r.out
         assert "everything up to date" in r.out
 
+    def test_a_dead_upstream_does_not_take_the_other_taps_down(
+            self, boost, fixture_tap_src, tmp_path):
+        """One deleted upstream must cost you that tap, not the whole command.
+
+        It used to cost the whole command: `registry.update()` had no error
+        handling, so the loop aborted on the dead tap and every later tap went
+        unrefreshed — while the user got a bare git error naming neither the tap
+        nor the URL. With 80+ taps a dead upstream is routine, not an edge case.
+        """
+        dead = _copy_tap(fixture_tap_src, tmp_path / "dead-tap")
+        live = _copy_tap(fixture_tap_src, tmp_path / "live-tap")
+        boost("tap", dead)
+        boost("tap", live)
+        shutil.rmtree(dead)               # upstream deleted out from under us
+
+        r = boost("update", expect=None)
+        assert "live-tap: already up to date" in r.out    # the healthy tap ran
+        assert "dead-tap" in r.out                        # named, not anonymous
+        assert "1 of 2 taps could not be refreshed" in r.out
+        # and it must not claim a clean bill of health
+        assert "everything up to date, except the taps above" in r.out
+        assert r.rc == 0                  # partial success is still success
+
+    def test_the_git_error_names_the_cause_not_the_hint_tail(
+            self, boost, fixture_tap_src, tmp_path):
+        """git states the cause first and advises after.
+
+        Reporting the LAST line of git's output surfaced "and the repository
+        exists." — the tail of a prose hint — and discarded the line naming the
+        missing path.
+        """
+        dead = _copy_tap(fixture_tap_src, tmp_path / "gone-tap")
+        boost("tap", dead)
+        shutil.rmtree(dead)
+        r = boost("update", expect=None)
+        assert "and the repository exists" not in r.out
+        assert "does not appear to be a git repository" in r.out
+
     def test_upgrades_unpinned_skips_pinned(self, boost, fixture_tap_src,
                                             tmp_path):
         tap_dir = _copy_tap(fixture_tap_src, tmp_path / "up-tap")
@@ -345,6 +383,48 @@ class TestUpdate:
         assert "upgraded" not in r.out
         assert _lock()["brainstorming"]["version"] == "1.4.0"
 
+    def test_taps_only_with_every_tap_dead_is_a_failure(
+            self, boost, fixture_tap_src, tmp_path):
+        """`--taps-only` must obey the same exit-code rule as the full path.
+
+        It didn't: `if args.taps_only: return 0` sat above the
+        `1 if failures and not results else 0` rule, so with every upstream
+        dead the taps-only path answered 0 while the full path answered 1.
+        A cron'd `boost update --taps-only` is exactly the caller that reads
+        nothing but the exit code — it would have slept through every tap
+        being gone.
+        """
+        dead = _copy_tap(fixture_tap_src, tmp_path / "only-dead-tap")
+        boost("tap", dead)
+        shutil.rmtree(dead)               # upstream deleted out from under us
+        r = boost("update", "--taps-only", expect=None)
+        assert "only-dead-tap" in r.out   # still named, same as the full path
+        assert r.rc == 1, "every tap failed and --taps-only said success"
+
+    def test_taps_only_partial_failure_is_still_success(
+            self, boost, fixture_tap_src, tmp_path):
+        # The other half of the rule: a partial run did the job it could do,
+        # and failing it would put us back to one dead upstream breaking
+        # `boost update` for the other 79.
+        dead = _copy_tap(fixture_tap_src, tmp_path / "half-dead-tap")
+        live = _copy_tap(fixture_tap_src, tmp_path / "half-live-tap")
+        boost("tap", dead)
+        boost("tap", live)
+        shutil.rmtree(dead)
+        r = boost("update", "--taps-only", expect=None)
+        assert "half-live-tap" in r.out
+        assert r.rc == 0
+
+    def test_every_tap_dead_is_a_failure_on_the_full_path_too(
+            self, boost, fixture_tap_src, tmp_path):
+        # Pins the rule itself, not just the taps-only copy of it — this is
+        # the assertion that keeps the two paths from drifting apart again.
+        dead = _copy_tap(fixture_tap_src, tmp_path / "all-dead-tap")
+        boost("tap", dead)
+        shutil.rmtree(dead)
+        r = boost("update", expect=None)
+        assert r.rc == 1
+
     def test_refreshes_the_completion_cache(self, boost, fixture_tap_src,
                                             tmp_path):
         from boost_cli.core import complete

{boost_skill_cli-1.0.400 → boost_skill_cli-1.0.401}/tests/unit/test_registry.py

@@ -271,13 +271,13 @@ class TestUpdate:
         origin = _make_repo(tmp_path / "pullme")
         tap = registry.add(str(origin))
         util.rmtree(tap.path)
-        assert registry.update("pullme") == {"pullme": "cloned"}
+        assert registry.update("pullme") == ({"pullme": "cloned"}, {})
         assert tap.is_cloned
 
     def test_update_already_up_to_date(self, sandbox, tmp_path):
         origin = _make_repo(tmp_path / "pullme")
         registry.add(str(origin))
-        assert registry.update() == {"pullme": "already up to date"}
+        assert registry.update() == ({"pullme": "already up to date"}, {})
 
     def test_update_pulls_new_commit(self, sandbox, tmp_path):
         origin = _make_repo(tmp_path / "pullme")
@@ -286,7 +286,7 @@ class TestUpdate:
         (origin / "b.txt").write_text("two\n", encoding="utf-8")
         _git("add", "-A", cwd=origin)
         _git("commit", "-qm", "add b", cwd=origin)
-        summary = registry.update("pullme")["pullme"]
+        summary = registry.update("pullme")[0]["pullme"]
         after = gitutil.head_commit(tap.path)
         assert re.fullmatch(r"[0-9a-f]{7} → [0-9a-f]{7}", summary)
         assert summary == "%s → %s" % (before[:7], after[:7])
@@ -295,3 +295,56 @@ class TestUpdate:
     def test_update_unknown_tap_raises(self, sandbox):
         with pytest.raises(BoostError):
             registry.update("nope")
+
+    def test_one_dead_upstream_does_not_stop_the_others(self, sandbox, tmp_path):
+        """The regression: `update()` had no error handling, so the first tap
+        with a deleted upstream aborted the loop and every later tap went
+        unrefreshed — with the successful pulls thrown away unreported.
+        """
+        dead_origin = _make_repo(tmp_path / "deadtap")
+        registry.add(str(dead_origin))
+        live_origin = _make_repo(tmp_path / "livetap")
+        registry.add(str(live_origin))
+        util.rmtree(dead_origin)             # upstream deleted out from under us
+
+        results, failures = registry.update()
+        assert "livetap" in results          # the healthy tap still refreshed
+        assert "deadtap" not in results      # and is not reported as a success
+        assert "deadtap" in failures
+        assert failures["deadtap"]           # carries a reason, not an empty string
+
+    def test_a_named_dead_tap_still_raises(self, sandbox, tmp_path):
+        """Asking about one tap makes its failure the answer, not a warning."""
+        origin = _make_repo(tmp_path / "solo")
+        registry.add(str(origin))
+        util.rmtree(origin)
+        with pytest.raises(BoostError):
+            registry.update("solo")
+
+
+class TestGitErrorLine:
+    """gitutil._git_error — git states the cause first, then advises."""
+
+    def test_prefers_the_first_fatal_line_over_the_hint_tail(self):
+        # Real `git fetch` output for a missing remote. The last line is the
+        # tail of a prose hint; the first names the bad path.
+        text = ("fatal: '/nope' does not appear to be a git repository\n"
+                "fatal: Could not read from remote repository.\n"
+                "\n"
+                "Please make sure you have the correct access rights\n"
+                "and the repository exists.\n")
+        assert gitutil._git_error(text) == (
+            "fatal: '/nope' does not appear to be a git repository")
+
+    def test_error_prefix_counts_too(self):
+        assert gitutil._git_error("error: pathspec 'x' did not match\ntrailing\n") == (
+            "error: pathspec 'x' did not match")
+
+    def test_falls_back_to_last_line_without_a_marker(self):
+        assert gitutil._git_error("something odd\nlast word\n") == "last word"
+
+    def test_blank_output_is_named_rather_than_empty(self):
+        assert gitutil._git_error("   \n\n") == "unknown error"
+
+    def test_skips_blank_lines_when_falling_back(self):
+        assert gitutil._git_error("only line\n\n\n") == "only line"