boost-skill-cli 1.0.417__tar.gz → 1.0.418__tar.gz

{boost_skill_cli-1.0.417/boost_skill_cli.egg-info → boost_skill_cli-1.0.418}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: boost-skill-cli
-Version: 1.0.417
+Version: 1.0.418
 Summary: boost — Homebrew for AI coding skills
 Author: Jonathan Reyes
 License: GNU GENERAL PUBLIC LICENSE

{boost_skill_cli-1.0.417 → boost_skill_cli-1.0.418}/boost_cli/_version.py

@@ -18,7 +18,7 @@ version_tuple: tuple[int | str, ...]
 commit_id: str | None
 __commit_id__: str | None
 
-__version__ = version = '1.0.417'
-__version_tuple__ = version_tuple = (1, 0, 417)
+__version__ = version = '1.0.418'
+__version_tuple__ = version_tuple = (1, 0, 418)
 
 __commit_id__ = commit_id = None

{boost_skill_cli-1.0.417 → boost_skill_cli-1.0.418/boost_skill_cli.egg-info}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: boost-skill-cli
-Version: 1.0.417
+Version: 1.0.418
 Summary: boost — Homebrew for AI coding skills
 Author: Jonathan Reyes
 License: GNU GENERAL PUBLIC LICENSE

{boost_skill_cli-1.0.417 → boost_skill_cli-1.0.418}/boost_skill_cli.egg-info/SOURCES.txt

@@ -238,6 +238,7 @@ docs/roadmap/items/framework-adapter-langgraph.md
 docs/roadmap/items/framework-adapter-multi-agent.md
 docs/roadmap/items/framework-adapters-boost-adapt.md
 docs/roadmap/items/frontmatter-scalar-over-coercion.md
+docs/roadmap/items/gemini-agent-frontmatter-sanitizer.md
 docs/roadmap/items/gemini-cli-agent-target.md
 docs/roadmap/items/github-community-health-files.md
 docs/roadmap/items/github-pages-deploy-is-broken-every-push.md

boost_skill_cli-1.0.418/docs/roadmap/items/gemini-agent-frontmatter-sanitizer.md

@@ -0,0 +1,39 @@
+---
+id: gemini-agent-frontmatter-sanitizer
+board: code
+section: compat
+status: planned
+category: Bug
+complexity: S
+impact: Med
+wow: 2
+note: measured on Gemini CLI 0.53.1 — a boost-installed agent fails Zod validation at startup, and hand-fixes regress on the next sync
+order: 97
+title: sanitize agent frontmatter for Gemini instead of copying it verbatim
+---
+boost's Gemini <code>agents/</code> slot copies workflow Markdown into
+<code>~/.gemini/agents/</code> <b>verbatim</b> — the deliberate contrast to the
+<code>commands/</code> slot, which renders TOML. That is right for the body and wrong for the
+frontmatter: taps carry agent files written for <i>other</i> hosts, and Gemini validates the
+frontmatter with a Zod schema at startup. Measured with <code>trojan-skill-hunter</code> from the
+<code>github/awesome-copilot</code> tap on Gemini CLI 0.53.1: the load fails with
+<i>"name: Name must be a valid slug"</i> plus six <i>"Invalid tool name"</i> errors, once per
+Copilot tool. Every session greets the user with a validation error for a file boost installed.
+
+<b>The schema, verified against the shipped bundle</b> (docs <code>core/subagents.md</code> +
+the validator itself): <code>name</code> must match <code>^[a-z0-9-_]+$</code>, with a separate
+optional <code>display_name</code> for the human-facing string; <code>tools</code> entries must be
+Gemini built-ins (<code>read_file</code>, <code>replace</code>, <code>grep_search</code>,
+<code>run_shell_command</code>, …) or <code>*</code>/<code>mcp_*</code> wildcards, and an
+<b>omitted</b> list inherits the parent session's toolset; <code>model</code> is any string — so
+<code>model: GPT-5</code> passes validation and then fails at runtime, the worst of both.
+
+<b>The fix is a sanitizer in the Gemini agents-slot materializer</b> (beside
+<code>workflows.render_gemini_command</code>): slug-ify <code>name</code> and move the original to
+<code>display_name</code>; drop a <code>tools</code> list whose entries are not Gemini's (mapping
+Copilot/Claude names one-to-one is guesswork — inheriting the session toolset is the documented
+safe default); drop a <code>model</code> Gemini cannot resolve. Body stays byte-identical. Pin the
+valid-tool set with a unit test the way <code>tests/unit/test_mcphost.py</code> pins the MCP
+grammar, so a Gemini schema change surfaces as a red test rather than a user-visible load error.
+Hand-editing <code>~/.gemini/agents/</code> is not a fix: <code>boost sync</code> regenerates the
+file from the tap source and the lock's sha256 flags the edit as drift.

{boost_skill_cli-1.0.417 → boost_skill_cli-1.0.418}/docs/roadmap.html

@@ -126,7 +126,7 @@
       <div class="stat"><b>16</b><span>Shipped</span></div>
       <div class="stat"><b>1</b><span>Next up</span></div>
       <div class="stat"><b>6</b><span>Planned</span></div>
-      <div class="stat"><b>222</b><span>Loop finds</span></div>
+      <div class="stat"><b>223</b><span>Loop finds</span></div>
       <!-- /ROADMAP:stats -->
     </div>
   </section>
@@ -8027,6 +8027,43 @@ standalone distribution is ever wanted again, the extra's contents become a depe
           <span class="m">same import, same tests, zero new infrastructure — the wheel that already ships on every merge carries the integration too</span>
         </div>
       </article>
+
+      <article class="cap rcard" id="gemini-agent-frontmatter-sanitizer">
+        <div class="head"><span class="pill planned">Planned</span><span class="cat">Bug</span></div>
+        <h3>sanitize agent frontmatter for Gemini instead of copying it verbatim</h3>
+        <p>boost's Gemini <code>agents/</code> slot copies workflow Markdown into
+<code>~/.gemini/agents/</code> <b>verbatim</b> — the deliberate contrast to the
+<code>commands/</code> slot, which renders TOML. That is right for the body and wrong for the
+frontmatter: taps carry agent files written for <i>other</i> hosts, and Gemini validates the
+frontmatter with a Zod schema at startup. Measured with <code>trojan-skill-hunter</code> from the
+<code>github/awesome-copilot</code> tap on Gemini CLI 0.53.1: the load fails with
+<i>"name: Name must be a valid slug"</i> plus six <i>"Invalid tool name"</i> errors, once per
+Copilot tool. Every session greets the user with a validation error for a file boost installed.
+
+<b>The schema, verified against the shipped bundle</b> (docs <code>core/subagents.md</code> +
+the validator itself): <code>name</code> must match <code>^[a-z0-9-_]+$</code>, with a separate
+optional <code>display_name</code> for the human-facing string; <code>tools</code> entries must be
+Gemini built-ins (<code>read_file</code>, <code>replace</code>, <code>grep_search</code>,
+<code>run_shell_command</code>, …) or <code>*</code>/<code>mcp_*</code> wildcards, and an
+<b>omitted</b> list inherits the parent session's toolset; <code>model</code> is any string — so
+<code>model: GPT-5</code> passes validation and then fails at runtime, the worst of both.
+
+<b>The fix is a sanitizer in the Gemini agents-slot materializer</b> (beside
+<code>workflows.render_gemini_command</code>): slug-ify <code>name</code> and move the original to
+<code>display_name</code>; drop a <code>tools</code> list whose entries are not Gemini's (mapping
+Copilot/Claude names one-to-one is guesswork — inheriting the session toolset is the documented
+safe default); drop a <code>model</code> Gemini cannot resolve. Body stays byte-identical. Pin the
+valid-tool set with a unit test the way <code>tests/unit/test_mcphost.py</code> pins the MCP
+grammar, so a Gemini schema change surfaces as a red test rather than a user-visible load error.
+Hand-editing <code>~/.gemini/agents/</code> is not a fix: <code>boost sync</code> regenerates the
+file from the tap source and the lock's sha256 flags the edit as drift.</p>
+        <div class="meta">
+          <span class="m">Complexity <b>S</b></span>
+          <span class="m">Impact <b>Med</b></span>
+          <span class="m">Wow <b class="wow">★★</b></span>
+          <span class="m">measured on Gemini CLI 0.53.1 — a boost-installed agent fails Zod validation at startup, and hand-fixes regress on the next sync</span>
+        </div>
+      </article>
       <!-- /ROADMAP:cards -->
 
     </div>