boost-skill-cli 1.0.87__tar.gz → 1.0.89__tar.gz

{boost_skill_cli-1.0.87 → boost_skill_cli-1.0.89}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: boost-skill-cli
-Version: 1.0.87
+Version: 1.0.89
 Summary: boost — Homebrew for AI coding skills
 Author: Jonathan Reyes
 License: GNU GENERAL PUBLIC LICENSE
@@ -731,8 +731,8 @@ update all of them, you run one command.
 boost is built in the open. Two living boards — generated from
 `docs/roadmap/items/*.md` — track what's shipped, in flight, and planned:
 
-- **[Code roadmap](https://jonnyeclectic.github.io/boost/roadmap.html)** — engine, correctness, and tooling work
-- **[Design roadmap](https://jonnyeclectic.github.io/boost/design-roadmap.html)** — the Visual Guide and docsite aesthetics
+- **[Code roadmap](https://jonnyeclectic.github.io/boost/docs/roadmap.html)** — engine, correctness, and tooling work
+- **[Design roadmap](https://jonnyeclectic.github.io/boost/docs/design-roadmap.html)** — the Visual Guide and docsite aesthetics
 
 Both are reachable from the [Visual Guide](https://jonnyeclectic.github.io/boost/) nav.
 

{boost_skill_cli-1.0.87 → boost_skill_cli-1.0.89}/README.md

@@ -25,8 +25,8 @@ update all of them, you run one command.
 boost is built in the open. Two living boards — generated from
 `docs/roadmap/items/*.md` — track what's shipped, in flight, and planned:
 
-- **[Code roadmap](https://jonnyeclectic.github.io/boost/roadmap.html)** — engine, correctness, and tooling work
-- **[Design roadmap](https://jonnyeclectic.github.io/boost/design-roadmap.html)** — the Visual Guide and docsite aesthetics
+- **[Code roadmap](https://jonnyeclectic.github.io/boost/docs/roadmap.html)** — engine, correctness, and tooling work
+- **[Design roadmap](https://jonnyeclectic.github.io/boost/docs/design-roadmap.html)** — the Visual Guide and docsite aesthetics
 
 Both are reachable from the [Visual Guide](https://jonnyeclectic.github.io/boost/) nav.
 

{boost_skill_cli-1.0.87 → boost_skill_cli-1.0.89}/boost_cli/_version.py

@@ -18,7 +18,7 @@ version_tuple: tuple[int | str, ...]
 commit_id: str | None
 __commit_id__: str | None
 
-__version__ = version = '1.0.87'
-__version_tuple__ = version_tuple = (1, 0, 87)
+__version__ = version = '1.0.89'
+__version_tuple__ = version_tuple = (1, 0, 89)
 
 __commit_id__ = commit_id = None

{boost_skill_cli-1.0.87 → boost_skill_cli-1.0.89}/boost_cli/commands/pkg.py

@@ -771,8 +771,11 @@ def _snapshot_restore(snap_id: str) -> int:
                 child.unlink()
         try:
             tf.extractall(str(root), members=members, filter="data")
-        except TypeError:  # Python < 3.12
-            tf.extractall(str(root), members=members)
+        except TypeError:  # Python < 3.12: no data filter available
+            # snapshots are archives boost itself produced under the user's own
+            # store (never fetched from a remote), so this legacy-interpreter
+            # fallback restores a locally-trusted tar.
+            tf.extractall(str(root), members=members)  # noqa: S202
     for action in store.sync_apply(store.sync_plan()):
         out.ok(action)
     journal.log("snapshot-restore", snap_id)

{boost_skill_cli-1.0.87 → boost_skill_cli-1.0.89}/boost_cli/core/ai.py

@@ -82,7 +82,7 @@ def _ask_api(prompt: str, system: Optional[str], model: str,
     }
     if system:
         body["system"] = system
-    req = urllib.request.Request(
+    req = urllib.request.Request(  # noqa: S310  API_URL is a hardcoded https endpoint
         API_URL,
         data=json.dumps(body).encode(),
         headers={
@@ -93,7 +93,7 @@ def _ask_api(prompt: str, system: Optional[str], model: str,
         method="POST",
     )
     try:
-        with urllib.request.urlopen(req, timeout=timeout) as resp:
+        with urllib.request.urlopen(req, timeout=timeout) as resp:  # noqa: S310  fixed https endpoint
             data = json.loads(resp.read().decode())
     except (urllib.error.URLError, TimeoutError, json.JSONDecodeError, OSError):
         return None

{boost_skill_cli-1.0.87 → boost_skill_cli-1.0.89}/boost_cli/core/dense.py

@@ -237,7 +237,7 @@ def retrieve(query: str, k: int = 60, kind: Optional[str] = None,
         if not knn:
             return []
         by_id = {r[0]: (r[1], r[2], r[3], r[4]) for r in con.execute(
-            "SELECT id, name, tap, kind, snip FROM chunks WHERE id IN (%s)"
+            "SELECT id, name, tap, kind, snip FROM chunks WHERE id IN (%s)"  # noqa: S608  interpolates only `?` placeholders; ids are bound params
             % ",".join("?" * len(knn)), [rid for rid, _d in knn])}
     finally:
         con.close()

{boost_skill_cli-1.0.87 → boost_skill_cli-1.0.89}/boost_cli/core/embed.py

@@ -91,12 +91,12 @@ def embed(texts: List[str], input_type: Optional[str] = None,
 
 def _post(url: str, key: str, payload: dict, timeout: int) -> Optional[dict]:
     data = json.dumps(payload).encode("utf-8")
-    req = urllib.request.Request(url, data=data, headers={
+    req = urllib.request.Request(url, data=data, headers={  # noqa: S310  url is a hardcoded VOYAGE_URL/OPENAI_URL constant
         "Authorization": "Bearer %s" % key,
         "Content-Type": "application/json",
     })
     try:
-        with urllib.request.urlopen(req, timeout=timeout) as resp:
+        with urllib.request.urlopen(req, timeout=timeout) as resp:  # noqa: S310  fixed https endpoint
             return json.loads(resp.read())
     except (urllib.error.URLError, OSError, ValueError):
         return None

{boost_skill_cli-1.0.87 → boost_skill_cli-1.0.89}/boost_skill_cli.egg-info/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: boost-skill-cli
-Version: 1.0.87
+Version: 1.0.89
 Summary: boost — Homebrew for AI coding skills
 Author: Jonathan Reyes
 License: GNU GENERAL PUBLIC LICENSE
@@ -731,8 +731,8 @@ update all of them, you run one command.
 boost is built in the open. Two living boards — generated from
 `docs/roadmap/items/*.md` — track what's shipped, in flight, and planned:
 
-- **[Code roadmap](https://jonnyeclectic.github.io/boost/roadmap.html)** — engine, correctness, and tooling work
-- **[Design roadmap](https://jonnyeclectic.github.io/boost/design-roadmap.html)** — the Visual Guide and docsite aesthetics
+- **[Code roadmap](https://jonnyeclectic.github.io/boost/docs/roadmap.html)** — engine, correctness, and tooling work
+- **[Design roadmap](https://jonnyeclectic.github.io/boost/docs/design-roadmap.html)** — the Visual Guide and docsite aesthetics
 
 Both are reachable from the [Visual Guide](https://jonnyeclectic.github.io/boost/) nav.
 

{boost_skill_cli-1.0.87 → boost_skill_cli-1.0.89}/boost_skill_cli.egg-info/SOURCES.txt

@@ -181,6 +181,7 @@ docs/roadmap/items/widen-the-ruff-rule-surface-b-sim-c4-perf-ruf.md
 docs/roadmap/items/windows-in-the-ci-matrix.md
 docs/roadmap/items/workflow-linting-actionlint.md
 docs/roadmap/items/workflow-sast-zizmor.md
+docs/roadmap/items/workspace-scope-install.md
 scripts/build_registries.py
 scripts/build_roadmap.py
 scripts/mutation_gate.py

{boost_skill_cli-1.0.87 → boost_skill_cli-1.0.89}/docs/roadmap/items/security-linting-bandit-via-ruff-s-rules.md

@@ -2,15 +2,15 @@
 id: security-linting-bandit-via-ruff-s-rules
 board: code
 section: health
-status: planned
+status: shipped
 category: Security · Vuln
 complexity: S
 impact: High
 wow: 3
-note: 0 new deps
+note: extend-select S; git/swallow rules ignored, real cases noqa'd
 order: 1
-owner:
-pr:
+owner: loop/bandit-s-rules
+pr: 99
 title: Security linting — <code>bandit</code> via ruff <code>S</code> rules
 ---
 Turn on the <em>flake8-bandit</em> (<code>S</code>) rule family already

boost_skill_cli-1.0.89/docs/roadmap/items/workspace-scope-install.md

@@ -0,0 +1,29 @@
+---
+id: workspace-scope-install
+board: code
+section: internals
+status: planned
+category: Install engine · Scope
+complexity: L
+impact: High
+wow: 4
+note: --global vs --local, project .claude/
+order: 22
+owner:
+pr:
+title: Workspace scope — <code>boost install --local</code> into the project
+---
+boost is user-global only: the store is <code>~/.agents/skills</code> and every
+           install symlinks into home-level agent dirs (<code>~/.claude/skills</code>,
+           <code>~/.cursor/skills</code>, <code>~/.windsurf/skills</code>). There is
+           no per-project scope — <code>install</code> takes <code>--agent</code>
+           (which agents) but no <code>--global</code>/<code>--local</code>. Add a
+           workspace paradigm mirroring <code>npm</code> (local vs
+           <code>-g</code>): <code>boost install &lt;skill&gt; --local</code> writes
+           into the current repo's <code>.claude/skills/</code> (and the other
+           agents' project dirs), and — paired with rule install — merges a rule
+           into the project's <code>./CLAUDE.md</code> rather than the global one,
+           so a team can commit its skills and rules with the repo. Needs a
+           per-scope store/lock, scope resolution (walk up for the nearest
+           project root), and <code>list</code>/<code>sync</code>/<code>uninstall</code>
+           that understand both scopes.

{boost_skill_cli-1.0.87 → boost_skill_cli-1.0.89}/docs/roadmap.html

@@ -118,7 +118,7 @@
       <div class="stat"><b>10</b><span>Shipped</span></div>
       <div class="stat"><b>3</b><span>Next up</span></div>
       <div class="stat"><b>4</b><span>Planned</span></div>
-      <div class="stat"><b>88</b><span>Loop finds</span></div>
+      <div class="stat"><b>89</b><span>Loop finds</span></div>
       <!-- /ROADMAP:stats -->
     </div>
   </section>
@@ -640,6 +640,31 @@
           <span class="m">rules are indexed but never installed</span>
         </div>
       </article>
+
+      <article class="cap rcard">
+        <div class="head"><span class="pill planned">Planned</span><span class="cat">Install engine · Scope</span></div>
+        <h3>Workspace scope — <code>boost install --local</code> into the project</h3>
+        <p>boost is user-global only: the store is <code>~/.agents/skills</code> and every
+           install symlinks into home-level agent dirs (<code>~/.claude/skills</code>,
+           <code>~/.cursor/skills</code>, <code>~/.windsurf/skills</code>). There is
+           no per-project scope — <code>install</code> takes <code>--agent</code>
+           (which agents) but no <code>--global</code>/<code>--local</code>. Add a
+           workspace paradigm mirroring <code>npm</code> (local vs
+           <code>-g</code>): <code>boost install &lt;skill&gt; --local</code> writes
+           into the current repo's <code>.claude/skills/</code> (and the other
+           agents' project dirs), and — paired with rule install — merges a rule
+           into the project's <code>./CLAUDE.md</code> rather than the global one,
+           so a team can commit its skills and rules with the repo. Needs a
+           per-scope store/lock, scope resolution (walk up for the nearest
+           project root), and <code>list</code>/<code>sync</code>/<code>uninstall</code>
+           that understand both scopes.</p>
+        <div class="meta">
+          <span class="m">Complexity <b>L</b></span>
+          <span class="m hi">Impact <b>High</b></span>
+          <span class="m">Wow <b class="wow">★★★★</b></span>
+          <span class="m">--global vs --local, project .claude/</span>
+        </div>
+      </article>
       <!-- /ROADMAP:cards -->
 
     </div>
@@ -656,7 +681,7 @@
 
       <!-- ROADMAP:cards section=health -->
       <article class="cap rcard">
-        <div class="head"><span class="pill planned">Planned</span><span class="cat">Security · Vuln</span></div>
+        <div class="head"><span class="pill shipped">Shipped</span><span class="cat">Security · Vuln</span></div>
         <h3>Security linting — <code>bandit</code> via ruff <code>S</code> rules</h3>
         <p>Turn on the <em>flake8-bandit</em> (<code>S</code>) rule family already
            bundled in ruff — one line in <code>pyproject.toml</code>, zero new
@@ -669,7 +694,7 @@
           <span class="m">Complexity <b>S</b></span>
           <span class="m hi">Impact <b>High</b></span>
           <span class="m">Wow <b class="wow">★★★</b></span>
-          <span class="m">0 new deps</span>
+          <span class="m">extend-select S; git/swallow rules ignored, real cases noqa'd</span>
         </div>
       </article>
 

{boost_skill_cli-1.0.87 → boost_skill_cli-1.0.89}/pyproject.toml

@@ -59,9 +59,27 @@ boost_cli = ["data/*.json"]
 [tool.ruff]
 target-version = "py39"
 
+[tool.ruff.lint]
+# Turn on flake8-bandit (S) — Python SAST smells ruff's default E/F set is
+# blind to: shell=True, assert-as-runtime-check, tempfile.mktemp, unsafe
+# yaml.load, hardcoded secrets, weak hashing. Zero new tools.
+extend-select = ["S"]
+ignore = [
+    # boost is a CLI that shells out to git by design: every subprocess call
+    # passes an argument LIST (never a shell string) and resolves `git` via
+    # PATH on purpose, so these two fire only on safe, intentional code.
+    "S603",  # subprocess-without-shell-equals-true (list form is not injectable)
+    "S607",  # start-process-with-partial-path (`git` on PATH is deliberate)
+    # Best-effort cleanup/logging swallows are a pervasive, commented pattern
+    # (logger teardown, corrupt-lock preservation, the crash handler) where a
+    # raised exception would be worse than the one being swallowed.
+    "S110",  # try-except-pass
+]
+
 [tool.ruff.lint.per-file-ignores]
-# short throwaway names and lambda helpers are fine in tests
-"tests/*" = ["E741", "E731"]
+# short throwaway names and lambda helpers are fine in tests; asserts are the
+# whole point of a test suite, and tests legitimately open fixture URLs.
+"tests/*" = ["E741", "E731", "S101", "S310"]
 
 [tool.codespell]
 # Spell-check user-facing text (see `make lint`: boost_cli, docs, README).