boost-skill-cli 1.0.79__tar.gz → 1.0.80__tar.gz

{boost_skill_cli-1.0.79 → boost_skill_cli-1.0.80}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: boost-skill-cli
-Version: 1.0.79
+Version: 1.0.80
 Summary: boost — Homebrew for AI coding skills
 Author: Jonathan Reyes
 License: GNU GENERAL PUBLIC LICENSE

{boost_skill_cli-1.0.79 → boost_skill_cli-1.0.80}/boost_cli/_version.py

@@ -18,7 +18,7 @@ version_tuple: tuple[int | str, ...]
 commit_id: str | None
 __commit_id__: str | None
 
-__version__ = version = '1.0.79'
-__version_tuple__ = version_tuple = (1, 0, 79)
+__version__ = version = '1.0.80'
+__version_tuple__ = version_tuple = (1, 0, 80)
 
 __commit_id__ = commit_id = None

{boost_skill_cli-1.0.79 → boost_skill_cli-1.0.80}/boost_cli/commands/info.py

@@ -591,16 +591,17 @@ def cmd_tag(argv):
     ap.add_argument("--json", action="store_true", help="machine-readable output")
     ap.add_argument("name", nargs="?", help="installed skill")
     ap.add_argument("mods", nargs="*", help="+tag to add, -tag to remove")
-    args, extras = ap.parse_known_args(argv)
-    # '-tag' tokens land in extras; re-order the combined pool to match the
-    # user's original argv so `-x +x` nets differently from `+x -x`.
-    remaining = list(args.mods) + extras
-    mods = []
-    for tok in argv:
-        if tok in remaining:
-            mods.append(tok)
-            remaining.remove(tok)
-    mods += remaining   # anything unmatched keeps parse order (defensive)
+    # A `-tag` removal looks like an option to argparse, which forced the old
+    # parse_known_args + argv re-walk. Instead split the literal option strings
+    # from operands ourselves: the skill name and its +tag/-tag operands keep
+    # their exact argv order with no re-walk, so `-x +x` still nets differently
+    # from `+x -x`.
+    flag_strings = {"--list", "--json", "-h", "--help"}
+    flags = [t for t in argv if t in flag_strings]
+    operands = [t for t in argv if t not in flag_strings]
+    args = ap.parse_args(flags)
+    args.name = operands[0] if operands else None
+    mods = operands[1:]
 
     if args.list_all:
         mapping = {}

{boost_skill_cli-1.0.79 → boost_skill_cli-1.0.80}/boost_cli/core/logs.py

@@ -170,8 +170,16 @@ def configure(verbose: bool = False, debug: bool = False,
 
 
 def log_invocation(argv: List[str]) -> None:
-    """Record a command invocation at the head of the trail."""
-    get_logger().info("invoke: boost %s", " ".join(argv))
+    """Record a command invocation at the head of the trail.
+
+    Includes ``pid``/``ppid`` and the interpreter path so a *native* crash —
+    which Python can't catch, so it never reaches :func:`write_crash_report` —
+    can still be correlated against an OS crash report by PID. If an OS report
+    names a PID that never appears here, boost is ruled out as that process.
+    """
+    get_logger().info(
+        "invoke: boost %s [pid=%d ppid=%d py=%s]",
+        " ".join(argv), os.getpid(), os.getppid(), sys.executable)
 
 
 def log_completion(argv: List[str], rc: int, elapsed_ms: float) -> None:

{boost_skill_cli-1.0.79 → boost_skill_cli-1.0.80}/boost_skill_cli.egg-info/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: boost-skill-cli
-Version: 1.0.79
+Version: 1.0.80
 Summary: boost — Homebrew for AI coding skills
 Author: Jonathan Reyes
 License: GNU GENERAL PUBLIC LICENSE

{boost_skill_cli-1.0.79 → boost_skill_cli-1.0.80}/boost_skill_cli.egg-info/SOURCES.txt

@@ -115,11 +115,13 @@ docs/roadmap/items/extension-free-tests-core-dense-py.md
 docs/roadmap/items/extract-mcp-http-servers-out-of-configuration-py.md
 docs/roadmap/items/finish-mutation-hardening-across-core.md
 docs/roadmap/items/fix-self-update-version-detection-dead-branch.md
+docs/roadmap/items/fork-safe-network-proxy-handler.md
 docs/roadmap/items/frontmatter-scalar-over-coercion.md
 docs/roadmap/items/github-pages-deploy-is-broken-every-push.md
 docs/roadmap/items/hash-pinned-reproducible-toolchain-uv-lock.md
 docs/roadmap/items/html-validation-html-validate.md
 docs/roadmap/items/integrity-verification-boost-verify.md
+docs/roadmap/items/invocation-pid-logging-for-crash-correlation.md
 docs/roadmap/items/layering-guard-import-linter.md
 docs/roadmap/items/lighthouse-ci-on-the-pages-site.md
 docs/roadmap/items/localize-the-stored-bm25-snippet.md

boost_skill_cli-1.0.80/docs/roadmap/items/fork-safe-network-proxy-handler.md

@@ -0,0 +1,26 @@
+---
+id: fork-safe-network-proxy-handler
+board: code
+section: health
+status: planned
+category: Reliability · Network
+complexity: S
+impact: Med
+wow: 3
+note: avoid macOS _scproxy Obj-C path
+order: 9
+owner:
+pr:
+title: Fork-safe network layer — explicit <code>ProxyHandler</code>
+---
+<code>core/ai.py</code> and <code>core/embed.py</code> call
+           <code>urllib.request.urlopen</code> with the default opener, which on
+           macOS runs <code>getproxies_macosx_sysconf()</code> →
+           <code>_scproxy</code> → SystemConfiguration/CoreFoundation — an
+           Obj-C path that is <strong>not fork-safe</strong> and aborts on the
+           child side of a <code>fork()</code>. Harmless in today's single-process
+           CLI, but fragile if boost ever runs post-fork (a future multiprocessing
+           worker, or an embedding host). Build the opener with an explicit
+           <code>ProxyHandler</code> honoring <code>HTTP(S)_PROXY</code>/<code>NO_PROXY</code>
+           so network calls never touch the Obj-C proxy machinery — deterministic
+           and fork-safe.

boost_skill_cli-1.0.80/docs/roadmap/items/invocation-pid-logging-for-crash-correlation.md

@@ -0,0 +1,23 @@
+---
+id: invocation-pid-logging-for-crash-correlation
+board: code
+section: shipped
+status: shipped
+category: Observability · Diagnostics
+complexity: S
+impact: Med
+wow: 3
+note: rule boost in/out of OS crash reports
+order: 9
+owner:
+pr:
+title: Crash-correlation breadcrumbs in the invocation log
+---
+A native abort (e.g. a macOS Obj-C fork-safety <code>SIGABRT</code>) kills the
+           process outright, so it never reaches boost's Python crash recorder —
+           leaving no boost-side trace to confirm or clear boost when an OS crash
+           report appears. <code>log_invocation</code> now records
+           <code>pid</code>, <code>ppid</code> and the interpreter path on every
+           run, so any OS crash report can be cross-referenced by PID: if the
+           crashing PID never appears in <code>~/.boost/logs/boost.log</code>,
+           boost is definitively ruled out.

{boost_skill_cli-1.0.79 → boost_skill_cli-1.0.80}/docs/roadmap/items/robust-tag-argument-parsing.md

@@ -2,15 +2,15 @@
 id: robust-tag-argument-parsing
 board: code
 section: internals
-status: planned
+status: shipped
 category: Maintainability
 complexity: M
 impact: Med
 wow: 2
 note: 
 order: 16
-owner:
-pr:
+owner: loop/robust-tag-parsing
+pr: 94
 title: Robust <code>tag</code> argument parsing
 ---
 Because <code>-tag</code> looks like an option, <code>cmd_tag</code> calls <code>parse_known_args</code> then re-walks raw <code>argv</code> to reorder tokens (<code>info.py:575–584</code>) — fragile enough that the comment calls it "defensive". Replace with a positional-only sub-parser or an explicit <code>--add/--remove</code> design.

{boost_skill_cli-1.0.79 → boost_skill_cli-1.0.80}/docs/roadmap.html

@@ -115,10 +115,10 @@
   <section class="block reveal">
     <div class="stats">
       <!-- ROADMAP:stats -->
-      <div class="stat"><b>8</b><span>Shipped</span></div>
+      <div class="stat"><b>9</b><span>Shipped</span></div>
       <div class="stat"><b>3</b><span>Next up</span></div>
       <div class="stat"><b>4</b><span>Planned</span></div>
-      <div class="stat"><b>83</b><span>Loop finds</span></div>
+      <div class="stat"><b>85</b><span>Loop finds</span></div>
       <!-- /ROADMAP:stats -->
     </div>
   </section>
@@ -270,6 +270,25 @@
           <span class="m">transport allow-list + -- guard</span>
         </div>
       </article>
+
+      <article class="cap rcard">
+        <div class="head"><span class="pill shipped">Shipped</span><span class="cat">Observability · Diagnostics</span></div>
+        <h3>Crash-correlation breadcrumbs in the invocation log</h3>
+        <p>A native abort (e.g. a macOS Obj-C fork-safety <code>SIGABRT</code>) kills the
+           process outright, so it never reaches boost's Python crash recorder —
+           leaving no boost-side trace to confirm or clear boost when an OS crash
+           report appears. <code>log_invocation</code> now records
+           <code>pid</code>, <code>ppid</code> and the interpreter path on every
+           run, so any OS crash report can be cross-referenced by PID: if the
+           crashing PID never appears in <code>~/.boost/logs/boost.log</code>,
+           boost is definitively ruled out.</p>
+        <div class="meta">
+          <span class="m">Complexity <b>S</b></span>
+          <span class="m">Impact <b>Med</b></span>
+          <span class="m">Wow <b class="wow">★★★</b></span>
+          <span class="m">rule boost in/out of OS crash reports</span>
+        </div>
+      </article>
       <!-- /ROADMAP:cards -->
 
     </div>
@@ -553,7 +572,7 @@
       </article>
 
       <article class="cap rcard">
-        <div class="head"><span class="pill planned">Planned</span><span class="cat">Maintainability</span></div>
+        <div class="head"><span class="pill shipped">Shipped</span><span class="cat">Maintainability</span></div>
         <h3>Robust <code>tag</code> argument parsing</h3>
         <p>Because <code>-tag</code> looks like an option, <code>cmd_tag</code> calls <code>parse_known_args</code> then re-walks raw <code>argv</code> to reorder tokens (<code>info.py:575–584</code>) — fragile enough that the comment calls it "defensive". Replace with a positional-only sub-parser or an explicit <code>--add/--remove</code> design.</p>
         <div class="meta">
@@ -742,6 +761,28 @@
           <span class="m">stretch</span>
         </div>
       </article>
+
+      <article class="cap rcard">
+        <div class="head"><span class="pill planned">Planned</span><span class="cat">Reliability · Network</span></div>
+        <h3>Fork-safe network layer — explicit <code>ProxyHandler</code></h3>
+        <p><code>core/ai.py</code> and <code>core/embed.py</code> call
+           <code>urllib.request.urlopen</code> with the default opener, which on
+           macOS runs <code>getproxies_macosx_sysconf()</code> →
+           <code>_scproxy</code> → SystemConfiguration/CoreFoundation — an
+           Obj-C path that is <strong>not fork-safe</strong> and aborts on the
+           child side of a <code>fork()</code>. Harmless in today's single-process
+           CLI, but fragile if boost ever runs post-fork (a future multiprocessing
+           worker, or an embedding host). Build the opener with an explicit
+           <code>ProxyHandler</code> honoring <code>HTTP(S)_PROXY</code>/<code>NO_PROXY</code>
+           so network calls never touch the Obj-C proxy machinery — deterministic
+           and fork-safe.</p>
+        <div class="meta">
+          <span class="m">Complexity <b>S</b></span>
+          <span class="m">Impact <b>Med</b></span>
+          <span class="m">Wow <b class="wow">★★★</b></span>
+          <span class="m">avoid macOS _scproxy Obj-C path</span>
+        </div>
+      </article>
       <!-- /ROADMAP:cards -->
 
     </div>

{boost_skill_cli-1.0.79 → boost_skill_cli-1.0.80}/tests/functional/test_cli_info.py

@@ -330,3 +330,27 @@ class TestTag:
         assert len(events) == 1
         assert events[0]["subject"] == "brainstorming"
         assert events[0]["tags"] == ["kept"]
+
+    def test_operand_order_preserved_add_then_remove(self, boost, installed):
+        # `+x -x` in argv order: add then remove -> nets to no tag.
+        boost("tag", "brainstorming", "+x", "-x")
+        assert _lock()["brainstorming"].get("tags", []) == []
+
+    def test_operand_order_preserved_remove_then_add(self, boost, installed):
+        # `-x +x`: remove (no-op on absent) then add -> nets to the tag present.
+        boost("tag", "brainstorming", "-x", "+x")
+        assert _lock()["brainstorming"]["tags"] == ["x"]
+
+    def test_removal_token_not_parsed_as_option(self, boost, installed):
+        # `-alpha` looks like an option but must be treated as a removal.
+        boost("tag", "brainstorming", "+alpha", "+beta")
+        r = boost("tag", "brainstorming", "-alpha")
+        assert "#beta" in r.out and "#alpha" not in r.out
+        assert _lock()["brainstorming"]["tags"] == ["beta"]
+
+    def test_list_flag_after_name_still_lists(self, boost, tapped):
+        # `--list` anywhere is a flag, not an operand.
+        boost("install", "brainstorming")
+        boost("tag", "brainstorming", "+shared")
+        r = boost("tag", "--list")
+        assert "#shared" in r.out

{boost_skill_cli-1.0.79 → boost_skill_cli-1.0.80}/tests/unit/test_logs.py

@@ -79,6 +79,19 @@ def test_invocation_is_logged(env):
     assert "invoke: boost install foo" in logs.log_path().read_text()
 
 
+def test_invocation_records_pid_ppid_and_interpreter(env):
+    """PID/PPID + interpreter are logged so a native crash can be correlated
+    against an OS crash report (and boost ruled in or out) by PID."""
+    import os
+    import sys
+    logs.configure()
+    logs.log_invocation(["mcp", "--stdio"])
+    line = logs.log_path().read_text()
+    assert ("pid=%d" % os.getpid()) in line
+    assert ("ppid=%d" % os.getppid()) in line
+    assert ("py=%s" % sys.executable) in line
+
+
 def test_completion_logs_rc_and_duration(env):
     logs.configure()
     logs.log_completion(["count"], 0, 12.7)