boost-skill-cli 1.0.449__tar.gz → 1.0.450__tar.gz

{boost_skill_cli-1.0.449 → boost_skill_cli-1.0.450}/.vale/styles/config/vocabularies/boost/accept.txt

@@ -55,6 +55,7 @@ onboards
 OpenShift
 overclaiming
 Pinecone
+pipx
 PrestaShop
 Pulumi
 pytest
@@ -65,12 +66,12 @@ reindex
 repo
 repo's
 repos
-rerank
 Rerank
+rerank
 reranking
 ruleset
-rulesets
 Rulesets
+rulesets
 sandboxed
 sandboxing
 Shopify
@@ -98,6 +99,7 @@ unlinking
 unregister
 unstaged
 untap
+uv
 Vaadin
 vendored
 vendoring

{boost_skill_cli-1.0.449/boost_skill_cli.egg-info → boost_skill_cli-1.0.450}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: boost-skill-cli
-Version: 1.0.449
+Version: 1.0.450
 Summary: boost — Homebrew for AI coding skills
 Author: Jonathan Reyes
 License: GNU GENERAL PUBLIC LICENSE

{boost_skill_cli-1.0.449 → boost_skill_cli-1.0.450}/boost_cli/_version.py

@@ -18,7 +18,7 @@ version_tuple: tuple[int | str, ...]
 commit_id: str | None
 __commit_id__: str | None
 
-__version__ = version = '1.0.449'
-__version_tuple__ = version_tuple = (1, 0, 449)
+__version__ = version = '1.0.450'
+__version_tuple__ = version_tuple = (1, 0, 450)
 
 __commit_id__ = commit_id = None

{boost_skill_cli-1.0.449 → boost_skill_cli-1.0.450}/boost_cli/commands/configuration.py

@@ -1498,12 +1498,40 @@ def _self_update_package(method: str, dry_run: bool) -> int:
     journal.log("self-update", new or old, previous=old, method=method)
     if new and new != old:
         out.ok("boost v%s → v%s" % (old, new))
-    elif new:
-        out.ok("already up to date (v%s)" % new)
-    else:
+        return 0
+    if not new:
         # The upgrade succeeded but we never saw a version — say exactly that
         # rather than claim one.
         out.ok("upgraded via %s; run `boost --version` to confirm" % method)
+        return 0
+    return _report_no_op(method, new)
+
+
+def _report_no_op(method: str, here: str) -> int:
+    """Explain a manager that exited 0 without moving the version.
+
+    "The version did not change" is not "you are on the latest release", and
+    boost used to print the second on evidence for only the first. When the
+    index pip resolved against was stale, that told a user who was a release
+    behind that they were current — so ask PyPI which it is, and let the three
+    possible answers say three different things.
+    """
+    latest = selfupdate.latest_version()
+    if latest is None:
+        # Offline. Report only what was observed; claiming "up to date" here is
+        # the same unearned claim with a different cause.
+        out.ok("boost is unchanged (v%s); could not reach PyPI to confirm it is "
+               "the latest" % here)
+        return 0
+    if selfupdate.is_behind(here, latest):
+        raise BoostError(
+            "%s exited 0 but boost is still v%s — PyPI has v%s"
+            % (method, here, latest),
+            hint="no newer candidate was offered: either the index it resolved "
+                 "against was stale, or this environment's python is too old "
+                 "for the new wheel. Pin it with `%s`"
+                 % " ".join(selfupdate.force_command(method, latest)))
+    out.ok("already up to date (v%s)" % here)
     return 0
 
 

boost_skill_cli-1.0.450/boost_cli/core/selfupdate.py

@@ -0,0 +1,268 @@
+"""How this boost was installed, and the command that upgrades it in place.
+
+`boost self-update` assumed a git checkout and told everyone else to abandon
+their install method — but the documented way in is `pipx install
+boost-skill-cli` or `pip install boost-skill-cli`, where the package lives in
+site-packages and there is nothing to `git pull`. This resolves the install
+method from evidence on disk and hands the command layer the exact argv that
+upgrades *this* copy.
+
+It also answers the question the command layer used to guess at: **is this copy
+actually current?** "The version did not change" and "you are on the latest
+release" are different propositions, and conflating them let boost tell a user
+who was one release behind that they were up to date. See :func:`latest_version`
+and :func:`is_behind`.
+"""
+from __future__ import annotations
+
+import http.client
+import json
+import os
+import re
+import shutil
+import subprocess
+import sys
+import urllib.error
+import urllib.request
+from pathlib import Path
+
+from ..errors import BoostError
+from . import gitutil, nethttp, paths
+
+DIST = "boost-skill-cli"
+
+GIT = "git"
+PIPX = "pipx"
+UV_TOOL = "uv-tool"
+PIP = "pip"
+UNKNOWN = "unknown"
+
+PYPI_JSON = "https://pypi.org/pypi/%s/json" % DIST
+
+# `boost --version` prints "boost <version>"; anything else means we did not
+# actually observe a version and must not report one.
+_VERSION_LINE = re.compile(r"^boost\s+(\S+)$", re.MULTILINE)
+
+# Leading digits of one dotted segment. Enough to read the numeric release
+# prefix out of `1.0.423` and out of a setuptools-scm `1.0.424.dev3+g36b74ba`.
+_LEADING_DIGITS = re.compile(r"\d+")
+
+
+def installed_version() -> str | None:
+    """Version recorded in installed package metadata, or None.
+
+    None is the useful answer, not a failure: it means no Python package
+    manager has a record of this boost, so none of them can upgrade it.
+    """
+    try:
+        from importlib.metadata import version
+        return version(DIST)
+    except Exception:
+        return None
+
+
+def detect(root: Path | None = None, prefix: Path | None = None,
+           metadata_version=None) -> str:
+    """Resolve how this boost was installed.
+
+    Order matters. A source checkout wins first — that includes `pip install
+    -e .`, where the package metadata exists too but `git pull` is what the
+    user means. Then the two managers that own a private venv and leave a
+    receipt inside it. Then plain pip, but only if pip actually has a record
+    of the distribution: telling someone to `pip install --upgrade` a boost
+    that pip never installed sends them chasing a package that isn't there.
+    """
+    root = paths.repo_root() if root is None else Path(root)
+    if gitutil.is_repo(root):
+        return GIT
+    prefix = Path(sys.prefix) if prefix is None else Path(prefix)
+    if (prefix / "pipx_metadata.json").is_file():
+        return PIPX
+    if (prefix / "uv-receipt.toml").is_file():
+        return UV_TOOL
+    # Resolved here, not as a default argument: a default binds the function
+    # object once at import, which silently defeats every attempt to swap it —
+    # including a test's, which is how a test of the "nothing installed this"
+    # branch ended up running a real `pip install` against PyPI.
+    lookup = installed_version if metadata_version is None else metadata_version
+    return PIP if lookup() else UNKNOWN
+
+
+def _require(tool: str) -> str:
+    """Absolute path to `tool`, or a BoostError naming what is missing.
+
+    Falling back to another manager here would upgrade a different copy of
+    boost — or none at all — while reporting success.
+    """
+    found = shutil.which(tool)
+    if not found:
+        raise BoostError(
+            "boost was installed with %s, but %s is not on PATH" % (tool, tool),
+            hint="install %s, or upgrade manually with `%s upgrade %s`"
+                 % (tool, tool, DIST))
+    return found
+
+
+def upgrade_command(method: str) -> list[str]:
+    """The argv that upgrades boost for `method`.
+
+    Each manager is told to fetch a fresh package index. PyPI serves the simple
+    index with ``Cache-Control: max-age=600`` and pip honours it, so two
+    self-updates inside ten minutes are answered from pip's HTTP cache — and a
+    release published between them is invisible. That is not hypothetical: three
+    consecutive `pipx upgrade` runs spanning the 1.0.423 upload all reported
+    "Requirement already satisfied ... (1.0.422)" off a cached index fetched
+    eight minutes before the wheel existed.
+
+    The flag differs per manager because the managers differ: pip has no
+    index-only refresh, so it gets `--no-cache-dir`, while uv does and gets
+    `--refresh` (keeping its wheel cache). Don't collapse them into one shape.
+    """
+    if method == PIPX:
+        # pipx owns the venv and shells out to its pip; `--pip-args` is how the
+        # flag reaches that pip. The `=` form is required — the value itself
+        # starts with `--`.
+        return [_require("pipx"), "upgrade", DIST, "--pip-args=--no-cache-dir"]
+    if method == UV_TOOL:
+        return [_require("uv"), "tool", "upgrade", "--refresh", DIST]
+    if method == PIP:
+        # sys.executable, never a bare `pip`: the pip first on PATH can belong
+        # to a different interpreter than the one running boost, and upgrading
+        # that one leaves this install exactly where it was while printing
+        # every sign of success.
+        return [sys.executable, "-m", "pip", "install", "--no-cache-dir",
+                "--upgrade", DIST]
+    raise BoostError(
+        "cannot work out how boost was installed, so it cannot update itself",
+        hint="upgrade with your package manager, e.g. `pipx upgrade %s`" % DIST)
+
+
+def force_command(method: str, version: str) -> list[str]:
+    """The argv that pins boost to `version`, bypassing the resolver.
+
+    Offered only when the manager exited 0 without moving the version while
+    PyPI has a newer one. A plain `upgrade` is no help there — the resolver has
+    already declined — so this names the exact version and forces the install.
+    """
+    spec = "%s==%s" % (DIST, version)
+    if method == PIPX:
+        return [_require("pipx"), "install", "--force", spec]
+    if method == UV_TOOL:
+        return [_require("uv"), "tool", "install", "--force", spec]
+    if method == PIP:
+        return [sys.executable, "-m", "pip", "install", "--no-cache-dir",
+                "--force-reinstall", spec]
+    raise BoostError(
+        "cannot work out how boost was installed, so it cannot update itself",
+        hint="install the version by hand, e.g. `pipx install --force %s`" % spec)
+
+
+def latest_version(timeout: float = 10.0) -> str | None:
+    """Newest version PyPI publishes for boost, or None if we could not ask.
+
+    None is the load-bearing third answer, as in ``scripts/release_guard.py``:
+    it means "PyPI did not tell us", and the caller must not read it as either
+    "up to date" or "behind". Every failure — offline, DNS, 503, a maintenance
+    HTML page where JSON was expected — degrades to None rather than raising,
+    because a version check is never worth failing a self-update over.
+
+    ``BOOST_NO_NET=1`` skips the request entirely, the same contract as
+    ``BOOST_NO_AI`` / ``BOOST_NO_SEED``: an air-gapped user (or a test) can
+    guarantee nothing leaves the machine.
+    """
+    if os.environ.get("BOOST_NO_NET"):
+        return None
+    # S310 is suppressed below: PYPI_JSON is a module constant with an https
+    # scheme and no caller-controlled component.
+    req = urllib.request.Request(  # noqa: S310
+        PYPI_JSON, headers={"Accept": "application/json",
+                            "User-Agent": "boost-self-update"})
+    try:
+        with nethttp.urlopen(req, timeout=timeout) as resp:
+            if not 200 <= getattr(resp, "status", 0) < 300:
+                return None
+            payload = json.loads(resp.read().decode("utf-8", "replace"))
+    # http.client.HTTPException covers the body going wrong after the headers
+    # arrived — the response is ~735 KB (every release's file list), so a
+    # connection that drops mid-read raises IncompleteRead. Listing it
+    # explicitly is load-bearing: on CPython <= 3.13 IncompleteRead was also a
+    # ValueError and JSONDecodeError's clause swallowed it, but on 3.14 its
+    # only base is HTTPException, and it escaped this function as a traceback.
+    except (urllib.error.URLError, OSError, TimeoutError, ValueError,
+            http.client.HTTPException):
+        return None
+    info = payload.get("info") if isinstance(payload, dict) else None
+    version = info.get("version") if isinstance(info, dict) else None
+    if not isinstance(version, str) or not version.strip():
+        return None
+    return version.strip()
+
+
+def _release_key(version: str) -> tuple[int, ...]:
+    """The leading numeric release segments of `version`, as ints.
+
+    Deliberately not a PEP 440 parser: `packaging` is not a dependency of the
+    zero-dependency install, boost ships `1.0.N`, and the only other shape that
+    reaches here is a setuptools-scm dev string (`1.0.424.dev3+g36b74ba`).
+    Comparing the numeric release prefix answers "is PyPI ahead of me" for
+    both. An empty tuple means "not a version we can reason about".
+    """
+    head = version.strip().lstrip("v").split("+", 1)[0]
+    parts: list[int] = []
+    for chunk in head.split("."):
+        m = _LEADING_DIGITS.match(chunk)
+        if not m:
+            break
+        parts.append(int(m.group()))
+    return tuple(parts)
+
+
+def is_behind(installed: str | None, latest: str | None) -> bool:
+    """True only when `latest` is visibly a newer release than `installed`.
+
+    Compares numbers, not text — `"1.0.9" > "1.0.10"` lexicographically, which
+    is how a version check ships an upgrade nag that never clears. Every
+    uncertain input (either side missing or unparseable) is False: a spurious
+    "you are behind" would turn a successful upgrade into an alarm, and no
+    version string is worth that.
+    """
+    if not installed or not latest:
+        return False
+    here, there = _release_key(installed), _release_key(latest)
+    if not here or not there:
+        return False
+    return there > here
+
+
+def run_upgrade(cmd: list[str], timeout: float = 300.0):
+    """Run the upgrade, raising BoostError with the manager's own last words."""
+    try:
+        proc = subprocess.run(cmd, capture_output=True, text=True,
+                              timeout=timeout)
+    except (OSError, subprocess.SubprocessError) as err:
+        raise BoostError("could not run %s" % " ".join(cmd),
+                         hint=str(err)) from err
+    if proc.returncode != 0:
+        detail = ((proc.stderr or "") + (proc.stdout or "")).strip().splitlines()
+        raise BoostError(
+            "upgrade failed (%s exited %d)" % (Path(cmd[0]).name, proc.returncode),
+            hint=detail[-1] if detail else "re-run the command by hand to see why")
+    return proc
+
+
+def observed_version(timeout: float = 30.0) -> str | None:
+    """Ask a freshly-spawned boost what version it is now, or None.
+
+    This process imported its own version before the upgrade ran, so it cannot
+    answer the question. None means "we did not see one" — better to say
+    nothing than to report a version we never observed.
+    """
+    try:
+        proc = subprocess.run([str(paths.launcher()), "--version"],
+                              capture_output=True, text=True, timeout=timeout)
+    except (OSError, subprocess.SubprocessError):
+        return None
+    if proc.returncode != 0:
+        return None
+    match = _VERSION_LINE.search(proc.stdout or "")
+    return match.group(1) if match else None

{boost_skill_cli-1.0.449 → boost_skill_cli-1.0.450/boost_skill_cli.egg-info}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: boost-skill-cli
-Version: 1.0.449
+Version: 1.0.450
 Summary: boost — Homebrew for AI coding skills
 Author: Jonathan Reyes
 License: GNU GENERAL PUBLIC LICENSE

{boost_skill_cli-1.0.449 → boost_skill_cli-1.0.450}/boost_skill_cli.egg-info/SOURCES.txt

@@ -382,6 +382,7 @@ docs/roadmap/items/secret-and-pii-scanning-of-installed-skills.md
 docs/roadmap/items/secret-scanning-gitleaks-push-protection.md
 docs/roadmap/items/security-linting-bandit-via-ruff-s-rules.md
 docs/roadmap/items/self-update-broken-for-pip-pipx-installs.md
+docs/roadmap/items/self-update-claims-up-to-date-without-asking.md
 docs/roadmap/items/serve-404-reflected-the-request.md
 docs/roadmap/items/serve-is-a-searchable-catalogue.md
 docs/roadmap/items/serve-py-traversal-guards-untested.md

{boost_skill_cli-1.0.449 → boost_skill_cli-1.0.450}/docs/DEBUGGING.md

@@ -166,6 +166,41 @@ reports are present, so a stuck environment points you at its own evidence.
 
 ---
 
+## `boost self-update` didn't move
+
+`boost self-update` drives whatever installed this copy — `pipx upgrade`,
+`uv tool upgrade`, or `<this python> -m pip install --upgrade`. Use
+`--dry-run` to see the exact command without running it:
+
+```bash
+boost self-update --dry-run
+#   installed with: pipx
+#   would run: /opt/homebrew/bin/pipx upgrade boost-skill-cli --pip-args=--no-cache-dir
+```
+
+**Why the no-cache flag is there.** PyPI serves its package index with
+`Cache-Control: max-age=600` and pip honours it, so two upgrades inside ten
+minutes are answered from pip's HTTP cache — and a release published in between
+is invisible. pip then says `Requirement already satisfied` and exits 0. Every
+manager is therefore told to refresh its index (`--refresh` for uv, which has an
+index-only refresh; `--no-cache-dir` for pip and pipx, which don't).
+
+**If the version still doesn't move**, boost does not report success. It asks
+PyPI what the newest release is and says which of three things happened:
+
+| What you see | What it means |
+|--------------|---------------|
+| `boost v1.0.422 → v1.0.423` | upgraded |
+| `already up to date (v1.0.423)` | PyPI confirms this is the newest release |
+| `boost is unchanged (v…); could not reach PyPI to confirm…` | nothing moved and the check couldn't run — no claim either way |
+| `pipx exited 0 but boost is still v… — PyPI has v…` | the manager declined to upgrade; the hint gives you a pinned, forced install |
+
+That last case is usually a stale index or an environment whose Python is too
+old for the new wheel. The hint names the exact command to force it, because a
+plain `upgrade` has already been tried and refused.
+
+---
+
 ## Environment variables
 
 Everything that changes boost's runtime behaviour, in one place:
@@ -179,6 +214,7 @@ Everything that changes boost's runtime behaviour, in one place:
 | `BOOST_LOG_FORMAT` | `text` (default) or `json` — one JSON object per log line |
 | `BOOST_NO_LOG` | `=1` → don't write the diagnostic log file |
 | `BOOST_NO_AI` | `=1` → disable all AI calls (offline / deterministic) |
+| `BOOST_NO_NET` | `=1` → skip the PyPI version check in `self-update` (air-gapped) |
 | `BOOST_ASSUME_YES` | `=1` → auto-confirm prompts (also `--yes`/`-y`) |
 | `NO_COLOR` / `CLICOLOR_FORCE` | force color off / on |
 

boost_skill_cli-1.0.450/docs/roadmap/items/self-update-claims-up-to-date-without-asking.md

@@ -0,0 +1,52 @@
+---
+id: self-update-claims-up-to-date-without-asking
+board: code
+section: compat
+status: shipped
+category: Bug
+complexity: S
+impact: High
+wow: 4
+note:
+order: 11
+owner: loop/self-update-freshness
+pr:
+title: <code>self-update</code> said "already up to date" without asking PyPI
+---
+<code>boost self-update</code> inferred "already up to date (vN)" from the fact that
+<code>observed_version()</code> came back unchanged. Those are two different propositions, and the
+gap between them is exactly one stale HTTP cache wide. Observed on the 1.0.422 → 1.0.423 release:
+PyPI serves the simple index with <code>Cache-Control: max-age=600</code> and pip honours it, so a
+<code>pipx upgrade</code> at 13:15 — eight minutes before the 1.0.423 wheel existed — cached an
+index that had never heard of it, and the two retries at 13:22 and 13:23 (the second one
+<em>after</em> the upload) were both answered from that cache. pip's own words each time:
+<code>Requirement already satisfied: boost-skill-cli in ./lib/python3.14/site-packages
+(1.0.422)</code>. pipx exited 0, the version did not move, and boost reported that the user was
+current while they were a release behind — the most expensive kind of wrong answer, because it
+tells you to stop looking.
+
+Fixed at both ends. <code>upgrade_command()</code> now tells each manager to refresh its index
+(<code>--pip-args=--no-cache-dir</code> for pipx, <code>--no-cache-dir</code> for pip,
+<code>--refresh</code> for uv — pip has no index-only refresh and uv does, so the flag is
+per-manager rather than one shape), which removes the cause. And <code>selfupdate.latest_version()</code>
+asks PyPI's JSON API what the newest release actually is, so a no-op upgrade now has three
+distinct outcomes instead of one claim: PyPI is ahead → a <code>BoostError</code> naming both
+versions plus <code>force_command()</code>, which pins the exact version and forces the install
+(a plain upgrade is no help — the resolver has already declined); PyPI agrees → "already up to
+date"; PyPI unreachable → "boost is unchanged (vN); could not reach PyPI to confirm it is the
+latest", because an unearned claim with a different cause is the same bug. <code>None</code> is
+the load-bearing third answer throughout, as in <code>scripts/release_guard.py</code>, and
+<code>is_behind()</code> compares release numbers rather than text — <code>"1.0.9" &gt; "1.0.10"</code>
+lexicographically, which is how a version check ships a nag that never clears.
+
+Two findings came out of pointing the new code at real PyPI rather than only at fakes. The
+payload is ~735 KB (the JSON API embeds every release's file list), and a body that drops
+mid-read raises <code>http.client.IncompleteRead</code> — which on CPython ≤ 3.13 was also a
+<code>ValueError</code> and was caught by accident, but on 3.14 has <code>HTTPException</code> as
+its only base and escaped as a traceback out of a check that must never fail. It is now caught
+explicitly. The endpoint stays the fatter one on purpose: <code>info.version</code> excludes
+yanked releases, and computing the max over the leaner simple-API version list would offer a
+yanked release as "newer" and hand the user a force command that installs it.
+<code>BOOST_NO_NET=1</code> skips the request entirely, the same contract as
+<code>BOOST_NO_AI</code> / <code>BOOST_NO_SEED</code>, and the test sandbox sets it so no test
+reaches the network as a side effect of checking what a command prints.

{boost_skill_cli-1.0.449 → boost_skill_cli-1.0.450}/docs/roadmap.html

@@ -133,7 +133,7 @@
       <div class="stat"><b>16</b><span>Shipped</span></div>
       <div class="stat"><b>1</b><span>Next up</span></div>
       <div class="stat"><b>7</b><span>Planned</span></div>
-      <div class="stat"><b>244</b><span>Loop finds</span></div>
+      <div class="stat"><b>245</b><span>Loop finds</span></div>
       <!-- /ROADMAP:stats -->
     </div>
   </section>
@@ -9108,6 +9108,54 @@ nothing, neither does boost.</p></details>
         </div>
       </article>
 
+      <article class="cap rcard" id="self-update-claims-up-to-date-without-asking">
+        <div class="head"><span class="pill shipped">Shipped</span><span class="cat">Bug</span></div>
+        <h3><code>self-update</code> said "already up to date" without asking PyPI</h3>
+        <details class="cardbody"><summary>Write-up</summary>
+        <p><code>boost self-update</code> inferred "already up to date (vN)" from the fact that
+<code>observed_version()</code> came back unchanged. Those are two different propositions, and the
+gap between them is exactly one stale HTTP cache wide. Observed on the 1.0.422 → 1.0.423 release:
+PyPI serves the simple index with <code>Cache-Control: max-age=600</code> and pip honours it, so a
+<code>pipx upgrade</code> at 13:15 — eight minutes before the 1.0.423 wheel existed — cached an
+index that had never heard of it, and the two retries at 13:22 and 13:23 (the second one
+<em>after</em> the upload) were both answered from that cache. pip's own words each time:
+<code>Requirement already satisfied: boost-skill-cli in ./lib/python3.14/site-packages
+(1.0.422)</code>. pipx exited 0, the version did not move, and boost reported that the user was
+current while they were a release behind — the most expensive kind of wrong answer, because it
+tells you to stop looking.
+
+Fixed at both ends. <code>upgrade_command()</code> now tells each manager to refresh its index
+(<code>--pip-args=--no-cache-dir</code> for pipx, <code>--no-cache-dir</code> for pip,
+<code>--refresh</code> for uv — pip has no index-only refresh and uv does, so the flag is
+per-manager rather than one shape), which removes the cause. And <code>selfupdate.latest_version()</code>
+asks PyPI's JSON API what the newest release actually is, so a no-op upgrade now has three
+distinct outcomes instead of one claim: PyPI is ahead → a <code>BoostError</code> naming both
+versions plus <code>force_command()</code>, which pins the exact version and forces the install
+(a plain upgrade is no help — the resolver has already declined); PyPI agrees → "already up to
+date"; PyPI unreachable → "boost is unchanged (vN); could not reach PyPI to confirm it is the
+latest", because an unearned claim with a different cause is the same bug. <code>None</code> is
+the load-bearing third answer throughout, as in <code>scripts/release_guard.py</code>, and
+<code>is_behind()</code> compares release numbers rather than text — <code>"1.0.9" &gt; "1.0.10"</code>
+lexicographically, which is how a version check ships a nag that never clears.
+
+Two findings came out of pointing the new code at real PyPI rather than only at fakes. The
+payload is ~735 KB (the JSON API embeds every release's file list), and a body that drops
+mid-read raises <code>http.client.IncompleteRead</code> — which on CPython ≤ 3.13 was also a
+<code>ValueError</code> and was caught by accident, but on 3.14 has <code>HTTPException</code> as
+its only base and escaped as a traceback out of a check that must never fail. It is now caught
+explicitly. The endpoint stays the fatter one on purpose: <code>info.version</code> excludes
+yanked releases, and computing the max over the leaner simple-API version list would offer a
+yanked release as "newer" and hand the user a force command that installs it.
+<code>BOOST_NO_NET=1</code> skips the request entirely, the same contract as
+<code>BOOST_NO_AI</code> / <code>BOOST_NO_SEED</code>, and the test sandbox sets it so no test
+reaches the network as a side effect of checking what a command prints.</p></details>
+        <div class="meta">
+          <span class="m">Complexity <b>S</b></span>
+          <span class="m hi">Impact <b>High</b></span>
+          <span class="m">Wow <b class="wow">★★★★</b></span>
+        </div>
+      </article>
+
       <article class="cap rcard" id="mcp-register-names-server-before-env">
         <div class="head"><span class="pill shipped">Shipped</span><span class="cat">Bug · MCP</span></div>
         <h3>Order the server name before -e flags in `boost mcp register`</h3>

{boost_skill_cli-1.0.449 → boost_skill_cli-1.0.450}/tests/conftest.py

@@ -99,6 +99,10 @@ def sandbox(tmp_path, monkeypatch):
     # which this fixture also sets, so without this guard every register
     # test would silently write a standing block into its sandbox HOME.
     monkeypatch.setenv("BOOST_NO_RULE", "1")
+    # `self-update` asks PyPI which version is newest before it will claim to
+    # be up to date. Same contract again: no test reaches the network as a side
+    # effect of checking what a command prints.
+    monkeypatch.setenv("BOOST_NO_NET", "1")
     monkeypatch.delenv("VOYAGE_API_KEY", raising=False)   # no real embed calls
     monkeypatch.delenv("OPENAI_API_KEY", raising=False)
     monkeypatch.delenv("BOOST_NO_EMBED", raising=False)

{boost_skill_cli-1.0.449 → boost_skill_cli-1.0.450}/tests/functional/test_cli_configuration.py

@@ -1660,7 +1660,8 @@ class TestSelfUpdate:
         self._pipx_install(monkeypatch, sandbox)
         r = boost("self-update", "--dry-run")
         assert "installed with: pipx" in r.out
-        assert "would run: /opt/bin/pipx upgrade boost-skill-cli" in r.out
+        assert ("would run: /opt/bin/pipx upgrade boost-skill-cli "
+                "--pip-args=--no-cache-dir") in r.out
 
     def test_plain_pip_install_upgrades_with_this_interpreter(
             self, boost, sandbox, monkeypatch):
@@ -1670,8 +1671,8 @@ class TestSelfUpdate:
                             lambda: "1.0.0")
         r = boost("self-update", "--dry-run")
         assert "installed with: pip" in r.out
-        assert ("would run: %s -m pip install --upgrade boost-skill-cli"
-                % sys.executable) in r.out
+        assert ("would run: %s -m pip install --no-cache-dir --upgrade "
+                "boost-skill-cli" % sys.executable) in r.out
 
     def test_pipx_upgrade_reports_the_new_version(self, boost, sandbox,
                                                   monkeypatch):
@@ -1683,11 +1684,76 @@ class TestSelfUpdate:
                             lambda: "9.9.9")
         r = boost("self-update")
         from boost_cli import __version__
-        assert ran == [["/opt/bin/pipx", "upgrade", "boost-skill-cli"]]
+        assert ran == [["/opt/bin/pipx", "upgrade", "boost-skill-cli",
+                        "--pip-args=--no-cache-dir"]]
         assert ("boost v%s → v9.9.9" % __version__) in r.out
         ev = journal.events(action="self-update")[0]
         assert ev["subject"] == "9.9.9" and ev["method"] == "pipx"
 
+    def _no_op_upgrade(self, monkeypatch, sandbox, latest):
+        """A manager that exits 0 and leaves the version exactly where it was.
+
+        `latest` is what PyPI is made to report — None for "PyPI would not say".
+        """
+        from boost_cli import __version__
+        self._pipx_install(monkeypatch, sandbox)
+        monkeypatch.setattr("boost_cli.core.selfupdate.run_upgrade",
+                            lambda cmd, **kw: None)
+        monkeypatch.setattr("boost_cli.core.selfupdate.observed_version",
+                            lambda: __version__)
+        monkeypatch.setattr("boost_cli.core.selfupdate.latest_version",
+                            lambda *a, **kw: latest)
+        return __version__
+
+    def test_a_no_op_upgrade_that_leaves_you_behind_is_not_up_to_date(
+            self, boost, sandbox, monkeypatch):
+        # The bug, end to end. pipx exits 0, pip says "Requirement already
+        # satisfied (1.0.422)" because PyPI's simple index was still cached
+        # from before the 1.0.423 upload, the version does not move — and boost
+        # used to print "already up to date (v1.0.422)". It never asked PyPI.
+        here = self._no_op_upgrade(monkeypatch, sandbox, latest="99.0.0")
+        r = boost("self-update", expect=1)
+        assert "already up to date" not in r.out
+        assert ("pipx exited 0 but boost is still v%s — PyPI has v99.0.0"
+                % here) in r.err
+        # The hint has to be actionable: a plain `upgrade` has already been
+        # tried and declined, so it must pin the version and force it.
+        assert "pipx install --force boost-skill-cli==99.0.0" in r.err
+
+    def test_a_no_op_upgrade_at_the_latest_version_is_up_to_date(
+            self, boost, sandbox, monkeypatch):
+        # PyPI agrees this version is the newest, so the claim is earned.
+        from boost_cli import __version__
+        here = self._no_op_upgrade(monkeypatch, sandbox, latest=__version__)
+        r = boost("self-update")
+        assert ("already up to date (v%s)" % here) in r.out
+
+    def test_a_no_op_upgrade_offline_admits_it_could_not_confirm(
+            self, boost, sandbox, monkeypatch):
+        # PyPI unreachable. "Nothing changed" is all boost observed, so that is
+        # all it may claim — asserting "up to date" here is the original bug
+        # with a different cause.
+        here = self._no_op_upgrade(monkeypatch, sandbox, latest=None)
+        r = boost("self-update")
+        assert ("boost is unchanged (v%s)" % here) in r.out
+        assert "could not reach PyPI to confirm" in r.out
+        assert "already up to date" not in r.out
+
+    def test_an_upgrade_that_moved_does_not_ask_pypi(self, boost, sandbox,
+                                                     monkeypatch):
+        # The version moved, so the question is already answered. Asking PyPI
+        # anyway would put a network round-trip on the happy path.
+        self._pipx_install(monkeypatch, sandbox)
+        monkeypatch.setattr("boost_cli.core.selfupdate.run_upgrade",
+                            lambda cmd, **kw: None)
+        monkeypatch.setattr("boost_cli.core.selfupdate.observed_version",
+                            lambda: "9.9.9")
+
+        def never(*a, **kw):
+            raise AssertionError("a successful upgrade must not query PyPI")
+        monkeypatch.setattr("boost_cli.core.selfupdate.latest_version", never)
+        assert "→ v9.9.9" in boost("self-update").out
+
     def test_upgrade_that_reveals_no_version_does_not_claim_one(
             self, boost, sandbox, monkeypatch):
         self._pipx_install(monkeypatch, sandbox)